@elitedcs/ghl-mcp 3.81.0 → 3.82.0

package/dist/index.js

@@ -1006,10 +1006,10 @@ function parkedRefusal(current, next, parked) {
   const currentById = new Map(current.filter(hasId).map((a) => [a.id, a]));
   const nextById = new Map(next.filter(hasId).map((a) => [a.id, a]));
   const contactsByStep = new Map(occupied.map((p) => [p.currentStepId, p.total]));
-  const guarded = protectedClosure([...contactsByStep.keys()], currentById);
+  const guarded2 = protectedClosure([...contactsByStep.keys()], currentById);
   const deleted = [];
   const altered = [];
-  for (const id of guarded) {
+  for (const id of guarded2) {
     const before = currentById.get(id);
     if (!before) continue;
     const after = nextById.get(id);
@@ -1019,11 +1019,11 @@ function parkedRefusal(current, next, parked) {
     }
     if (stable(before) !== stable(after)) altered.push(id);
   }
-  for (const id of guarded) {
+  for (const id of guarded2) {
     const head3 = currentById.get(id);
     if (!head3) continue;
     for (const target of branchTargetStepIds(head3)) {
-      if (guarded.has(target) || deleted.includes(target)) continue;
+      if (guarded2.has(target) || deleted.includes(target)) continue;
       if (currentById.has(target) && !nextById.has(target)) deleted.push(target);
     }
   }
@@ -12921,7 +12921,8 @@ var init_schema = __esm({
       }).strict(),
       logo: import_zod42.z.object({
         inlineSvg: import_zod42.z.string().optional(),
-        dataUri: import_zod42.z.string().optional(),
+        // A raster image carried inline (png/jpeg/gif/webp, base64): the brand page puts it straight into an <img src>.
+        dataUri: import_zod42.z.string().regex(/^data:image\/(png|jpe?g|gif|webp);base64,[A-Za-z0-9+/=]+$/, "logo.dataUri must be a base64 png, jpeg, gif or webp data URI").optional(),
         width: import_zod42.z.number().optional(),
         height: import_zod42.z.number().optional(),
         whiteFillFixed: import_zod42.z.boolean(),
@@ -13294,6 +13295,108 @@ var init_store = __esm({
   }
 });
 
+// src/command-os/design/svg-sanitize.ts
+function unquote(v) {
+  return v.replace(/^"(.*)"$/s, "$1").replace(/^'(.*)'$/s, "$1");
+}
+function decoded(v) {
+  let s = v;
+  for (let i = 0; i < 5; i++) {
+    const next = s.replace(/&#x([0-9a-f]{1,6});?/gi, (_m, h) => String.fromCodePoint(parseInt(h, 16))).replace(/&#(\d{1,7});?/g, (_m, n) => String.fromCodePoint(Math.min(parseInt(n, 10), 1114111))).replace(/&([a-z]+);/gi, (m, name) => NAMED_ENTITIES[name.toLowerCase()] ?? m);
+    if (next === s) break;
+    s = next;
+  }
+  s = s.replace(/\\([0-9a-f]{1,6})\s?/gi, (_m, h) => String.fromCodePoint(parseInt(h, 16))).replace(/\\(.)/g, "$1");
+  return s.replace(/[\u0000-\u0020\u007f-\u009f\u200b-\u200f\u2028\u2029\ufeff]/g, "");
+}
+function safeUrl(raw) {
+  const s = decoded(unquote(raw)).toLowerCase();
+  if (/[&\\<>]/.test(s)) return false;
+  return s === "" || s.startsWith("#") || isRasterDataUri(s);
+}
+function safeStyle(v) {
+  const s = decoded(v);
+  if (/[&\\<>]/.test(s)) return false;
+  return !/url\s*\(|@import|expression\s*\(|javascript:|vbscript:|behavior\s*:|-moz-binding|@charset|@namespace|image-set\s*\(|src\s*:/i.test(s);
+}
+function isRasterDataUri(v) {
+  return typeof v === "string" && /^data:image\/(png|jpe?g|gif|webp);base64,[a-z0-9+/=]+$/i.test(v);
+}
+function sanitizeSvg(input) {
+  if (typeof input !== "string") throw new Error(SVG_SHAPE_ERROR);
+  let svg = input.replace(CDATA, "").replace(COMMENTS, "").replace(PROCESSING, "").replace(DOCTYPE, "").trim();
+  if (!SHAPE.test(svg) || svg.length > SVG_MAX_BYTES) throw new Error(SVG_SHAPE_ERROR);
+  let before = "";
+  while (before !== svg) {
+    before = svg;
+    svg = svg.replace(DROP_ELEMENTS, "");
+  }
+  const classRules = /* @__PURE__ */ new Map();
+  svg = svg.replace(/<style\b[^>]*>([\s\S]*?)<\/style>/gi, (_m, css2) => {
+    for (const rule5 of css2.matchAll(/([^{}]+)\{([^{}]*)\}/g)) {
+      const decls = rule5[2].trim().replace(/;\s*$/, "");
+      if (!decls || !safeStyle(decls)) continue;
+      for (const sel of rule5[1].split(",")) {
+        const cm = /^\s*\.([A-Za-z_][\w-]*)\s*$/.exec(sel);
+        if (cm) classRules.set(cm[1], classRules.has(cm[1]) ? `${classRules.get(cm[1])};${decls}` : decls);
+      }
+    }
+    return "";
+  });
+  const attrValue = (v) => `"${v.replace(/"/g, "&quot;")}"`;
+  svg = svg.replace(TAG, (_m, name, attrs, selfClose) => {
+    let kept = [];
+    let classes = [];
+    let ownStyle = "";
+    for (const a of attrs.matchAll(ATTR)) {
+      const key = a[1];
+      const k = key.toLowerCase();
+      const hasValue = a[2] !== void 0;
+      const val = a[2] ?? "";
+      if (k.startsWith("on")) continue;
+      if (URL_ATTRS.has(k) && !safeUrl(val)) continue;
+      if (k === "style" && !safeStyle(unquote(val))) continue;
+      if (/javascript:|data:text|vbscript:|data:image\/svg/i.test(decoded(unquote(val)))) continue;
+      if (k === "class") classes = unquote(val).split(/\s+/).filter(Boolean);
+      if (k === "style") ownStyle = unquote(val);
+      kept.push(hasValue ? `${key}=${/^["']/.test(val) ? val : attrValue(val)}` : key);
+    }
+    const fromClasses = classes.flatMap((c) => classRules.has(c) ? [classRules.get(c)] : []);
+    if (fromClasses.length) {
+      kept = kept.filter((a) => !/^style=/i.test(a));
+      kept.push(`style=${attrValue([...fromClasses, ownStyle].filter(Boolean).join(";"))}`);
+    }
+    return `<${name}${kept.length ? " " + kept.join(" ") : ""}${selfClose ? "/" : ""}>`;
+  });
+  if (/<style\b/i.test(svg) || !SHAPE.test(svg)) throw new Error(SVG_SHAPE_ERROR);
+  return svg;
+}
+function sanitizeSvgOrDrop(input) {
+  try {
+    return sanitizeSvg(input);
+  } catch {
+    return void 0;
+  }
+}
+var SVG_MAX_BYTES, SVG_SHAPE_ERROR, DROP_ELEMENTS, COMMENTS, PROCESSING, DOCTYPE, CDATA, TAG, ATTR, URL_ATTRS, NAMED_ENTITIES, SHAPE;
+var init_svg_sanitize = __esm({
+  "src/command-os/design/svg-sanitize.ts"() {
+    "use strict";
+    SVG_MAX_BYTES = 6e4;
+    SVG_SHAPE_ERROR = "The logo must be one <svg>\u2026</svg> under 60 KB.";
+    DROP_ELEMENTS = /<\s*(script|foreignObject|iframe|object|embed|handler|set|animate|animateMotion|animateTransform|discard|audio|video)\b[^>]*(?:\/\s*>|>[\s\S]*?<\/\s*\1\s*>)/gi;
+    COMMENTS = /<!--[\s\S]*?-->/g;
+    PROCESSING = /<\?[\s\S]*?\?>/g;
+    DOCTYPE = /<!DOCTYPE[\s\S]*?(?:\[[\s\S]*?\])?\s*>/gi;
+    CDATA = /<!\[CDATA\[[\s\S]*?\]\]>/g;
+    TAG = /<([a-zA-Z][\w:.-]*)((?:\s+[^\s=>/]+(?:\s*=\s*(?:"[^"]*"|'[^']*'|[^\s>]+))?)*)\s*(\/?)>/g;
+    ATTR = /([^\s=/]+)(?:\s*=\s*("[^"]*"|'[^']*'|[^\s>]+))?/g;
+    URL_ATTRS = /* @__PURE__ */ new Set(["href", "xlink:href", "src", "from", "to", "values", "by", "formaction", "action"]);
+    NAMED_ENTITIES = { amp: "&", lt: "<", gt: ">", quot: '"', apos: "'", nbsp: " " };
+    SHAPE = /^<svg[\s>][\s\S]*<\/svg>$/i;
+  }
+});
+
 // src/command-os/design/extract.ts
 async function fetchText(url, fetchImpl, timeoutMs = 15e3) {
   const ctl = new AbortController();
@@ -13702,10 +13805,15 @@ function deriveBrandDna(raw, opts = {}) {
       fixed = true;
     }
     const vb = svg.match(/viewBox=["']\s*[\d.-]+\s+[\d.-]+\s+([\d.]+)\s+([\d.]+)/i);
-    logoSvg = svg;
-    logo = { inlineSvg: svg.length <= 6e4 ? svg : void 0, whiteFillFixed: fixed, source: bl.where, rights: opts.rights ? "declared" : "inherits", ...vb && { width: parseFloat(vb[1]), height: parseFloat(vb[2]) } };
-    declared++;
-    evidence["logo"] = `${bl.where}${fixed ? "; white fills replaced with currentColor" : ""}`;
+    const clean = sanitizeSvgOrDrop(svg);
+    if (clean) {
+      logoSvg = clean;
+      logo = { inlineSvg: clean, whiteFillFixed: fixed, source: bl.where, rights: opts.rights ? "declared" : "inherits", ...vb && { width: parseFloat(vb[1]), height: parseFloat(vb[2]) } };
+      declared++;
+      evidence["logo"] = `${bl.where}${fixed ? "; white fills replaced with currentColor" : ""}${clean !== svg ? "; scripts, handlers and outside references stripped" : ""}`;
+    } else {
+      evidence["logo"] = `${bl.where}: not a plain drawing (or over 60 KB), so it was not kept`;
+    }
   } else if (raw.logo?.bytes && raw.logo.kind !== "svg") {
     logoPng = raw.logo.bytes;
     const mime = raw.logo.kind === "png" ? "image/png" : raw.logo.kind === "webp" ? "image/webp" : "image/jpeg";
@@ -13769,6 +13877,7 @@ var init_extract = __esm({
     init_fonts();
     init_schema();
     init_store();
+    init_svg_sanitize();
     UA = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36 GHLCommand-DesignStudio/0.1";
     rank = (arr) => {
       const m = /* @__PURE__ */ new Map();
@@ -16683,7 +16792,7 @@ function registerSetupTool(server2, pkgVersion) {
   if (pkgVersion) setupPkgVersion = pkgVersion;
   server2.tool(
     "setup_ghl_mcp",
-    "First-run setup AND license upgrades for GHL Command MCP. Validates your license and GHL credentials, then writes them to a per-user credentials file; restart Claude once after it completes. UPGRADING an existing install (e.g. free key to paid)? Supply ONLY email + license_key \u2014 the GHL credentials and any Workflow Builder unlock already saved on this machine are reused and kept; do not re-enter ghl_api_key or ghl_location_id. No license yet? Paid ($97/mo) at https://ghlcommand.com \u2014 or a FREE read-only key, instantly, at https://ghlcommand.com/free.",
+    "First-run setup AND license upgrades for GHL Command. Validates your license and GHL credentials, then writes them to a per-user credentials file; restart Claude once after it completes. UPGRADING an existing install (e.g. free key to paid)? Supply ONLY email + license_key \u2014 the GHL credentials and any Workflow Builder unlock already saved on this machine are reused and kept; do not re-enter ghl_api_key or ghl_location_id. No license yet? Paid ($97/mo) at https://ghlcommand.com \u2014 or a FREE read-only key, instantly, at https://ghlcommand.com/free.",
     {
       email: import_zod48.z.string().email().describe("Email used at purchase."),
       license_key: import_zod48.z.string().min(20).describe("License key from your purchase email."),
@@ -16987,7 +17096,7 @@ function registerFirebaseCaptureScriptTool(server2) {
         "}",
         "```",
         "",
-        "**Step 5.** Come back to Claude. Run `setup_ghl_mcp` (first-time install) or `enable_workflow_builder` (already set up) and paste the JSON into the `firebase_paste` field. The MCP parses it automatically \u2014 you don't need to fill the individual `ghl_user_id`, `ghl_firebase_api_key`, `ghl_firebase_refresh_token` fields.",
+        "**Step 5.** Come back to Claude. Run `setup_ghl_mcp` (first-time install) or `enable_workflow_builder` (already set up) and paste the JSON into the `firebase_paste` field. GHL Command reads it automatically \u2014 you don't need to fill the individual `ghl_user_id`, `ghl_firebase_api_key`, `ghl_firebase_refresh_token` fields.",
         "",
         "Step-by-step screenshots: https://elitedcs.com/ghl-mcp-firebase"
       ].join("\n");
@@ -16998,7 +17107,7 @@ function registerFirebaseCaptureScriptTool(server2) {
 function registerInteractiveCaptureTool(server2) {
   server2.tool(
     "capture_firebase_interactive",
-    "One-click Workflow Builder unlock (EASIEST PATH \u2014 try this before auto_capture_firebase_script). Also the unlock for the FREE tier's account auditor (audit_workflows, validate_workflow) \u2014 same one-time login. Opens a Chrome window where you just log into GHL; the MCP captures the Firebase credentials itself and saves them. No DevTools, no pasting. Re-run the same tool if the first call says it's still waiting for your login. After the first successful run, future re-captures (refresh-token rotations) happen silently with no window at all. Falls back cleanly: if no Chrome/Edge is installed, use auto_capture_firebase_script instead.",
+    "One-click Workflow Builder unlock (EASIEST PATH \u2014 try this before auto_capture_firebase_script). Also the unlock for the FREE tier's account auditor (audit_workflows, validate_workflow) \u2014 same one-time login. Opens a Chrome window where you just log into GHL; GHL Command captures the Firebase credentials itself and saves them. No DevTools, no pasting. Re-run the same tool if the first call says it's still waiting for your login. After the first successful run, future re-captures (refresh-token rotations) happen silently with no window at all. Falls back cleanly: if no Chrome/Edge is installed, use auto_capture_firebase_script instead.",
     {},
     async () => {
       const existing = readCredentials();
@@ -17239,10 +17348,10 @@ function withSwitchLock(fn) {
 }
 function registerLocationSwitcherTools(server2, client, builderClient, registry2, mcpVersion) {
   const versionLine = mcpVersion ? `
-MCP version: v${mcpVersion}` : "";
+GHL Command version: v${mcpVersion}` : "";
   server2.tool(
     "get_current_location",
-    "Show which GHL sub-account (location) is currently active, including API key status and installed MCP version. All tools use this location by default unless you specify a different one.",
+    "Show which GHL sub-account (location) is currently active, including API key status and the installed GHL Command version. All tools use this location by default unless you specify a different one.",
     {},
     async () => {
       const locId = client.defaultLocationId || "NOT SET";
@@ -21314,11 +21423,11 @@ async function collectInstallChecks(installedVersion, client, builderClient, reg
   ]);
   let versionCheck;
   if (versionStatus.latest === null) {
-    versionCheck = { name: "npm registry + version", status: "warn", detail: `Installed v${versionStatus.installed}. Could not reach npm registry to check for updates: ${versionStatus.fetchError ?? "unknown"}.` };
+    versionCheck = { name: "GHL Command version", status: "warn", detail: `You're on v${versionStatus.installed}. Could not reach npm to check for a newer version: ${versionStatus.fetchError ?? "unknown"}.` };
   } else if (versionStatus.upToDate) {
-    versionCheck = { name: "npm registry + version", status: "pass", detail: `Up to date at v${versionStatus.installed}.` };
+    versionCheck = { name: "GHL Command version", status: "pass", detail: `Up to date at v${versionStatus.installed}.` };
   } else {
-    versionCheck = { name: "npm registry + version", status: "warn", detail: `Installed v${versionStatus.installed} but latest is v${versionStatus.latest}. Quit Claude (Cmd+Q) and reopen to upgrade.` };
+    versionCheck = { name: "GHL Command version", status: "warn", detail: `You're on v${versionStatus.installed}; the latest is v${versionStatus.latest}. Quit Claude (Cmd+Q) and reopen to update.` };
   }
   const gatingCheck = (() => {
     const r = getGatingReport?.();
@@ -21379,7 +21488,7 @@ function summarizeChecks(checks) {
 function registerDiagnosticTools(server2, installedVersion, client, builderClient, registry2, getGatingReport, plan = "mcp") {
   server2.tool(
     "health_check",
-    "Run a full health check of the GHL Command MCP install. Reports on: npm registry + version status, GHL API key validity, default location reachability, Firebase auth status (workflow builder), token registry, and the tool-gating policy (disabled tools/modules, account-admin opt-in, typos in gating env vars). Returns a structured pass/fail/warn list with detail per check. Use this when something feels broken or after credentials change. For a wider report that also probes every GHL capability live and shows what you are not yet using, run `run_checkup`.",
+    "Run a full health check of your GHL Command install. Reports on: version status, GHL API key validity, default location reachability, Firebase auth status (workflow builder), token registry, and the tool-gating policy (disabled tools/modules, account-admin opt-in, typos in gating env vars). Returns a structured pass/fail/warn list with detail per check. Use this when something feels broken or after credentials change. For a wider report that also probes every GHL capability live and shows what you are not yet using, run `run_checkup`.",
     {},
     async () => {
       const checks = await collectInstallChecks(installedVersion, client, builderClient, registry2, getGatingReport, plan);
@@ -21870,7 +21979,7 @@ function safeParse(raw) {
     return {};
   }
 }
-function safeUrl(x, max = MAX_URL) {
+function safeUrl2(x, max = MAX_URL) {
   const raw = str2(x, max);
   if (!raw) return void 0;
   let u;
@@ -21898,8 +22007,8 @@ function sanitizeProfile(raw) {
     agencyName: str2(r.agencyName, 80),
     legalName: str2(r.legalName),
     accent: normalizeAccent(r.accent),
-    logoUrl: safeUrl(r.logoUrl),
-    website: safeUrl(r.website),
+    logoUrl: safeUrl2(r.logoUrl),
+    website: safeUrl2(r.website),
     sender: drop({
       fromName: str2(sender?.fromName, 80),
       replyTo: str2(sender?.replyTo),
@@ -21940,9 +22049,44 @@ function sanitizeProfile(raw) {
       timezone: str2(defaults?.timezone, 64),
       industry: str2(defaults?.industry, 64)
     }),
+    agencyOs: sanitizeAgencyOs(r.agencyOs),
     updated_at: str2(r.updated_at, 40)
   };
 }
+function sanitizeAgencyOs(raw) {
+  if (!raw || typeof raw !== "object") return void 0;
+  const r = raw;
+  const ica = r.ica ?? {};
+  const offer = r.offer ?? {};
+  const lines = (x) => list(x, (s) => str2(s, MAX_STR * 2));
+  const out = drop({
+    story: str2(r.story, MAX_PARA),
+    method: str2(r.method, MAX_PARA),
+    voice: str2(r.voice, 400),
+    values: lines(r.values),
+    goals: str2(r.goals, 400),
+    proof: lines(r.proof),
+    ica: drop({
+      who: str2(ica.who, 400),
+      pains: lines(ica.pains),
+      desires: lines(ica.desires),
+      objections: lines(ica.objections),
+      triggers: lines(ica.triggers),
+      vocabulary: lines(ica.vocabulary),
+      hangouts: lines(ica.hangouts),
+      villains: lines(ica.villains)
+    }),
+    offer: drop({
+      name: str2(offer.name, 120),
+      promise: str2(offer.promise, 400),
+      valueStack: lines(offer.valueStack),
+      price: str2(offer.price, 120),
+      guarantee: str2(offer.guarantee, 600),
+      accelerators: lines(offer.accelerators)
+    })
+  });
+  return out && Object.keys(out).length ? out : void 0;
+}
 function legacyBranding(profileFile) {
   try {
     const raw = JSON.parse(fs12.readFileSync(path11.join(path11.dirname(profileFile), "cockpit-state.json"), "utf8"));
@@ -21960,6 +22104,23 @@ function readAgencyProfile(file = agencyProfilePath()) {
   const legacy = legacyBranding(file);
   return legacy.agencyName || legacy.accent ? sanitizeProfile({ ...EMPTY, ...legacy }) : { ...EMPTY };
 }
+function mergeNested(base, patch, depth) {
+  const out = { ...base };
+  for (const [ck, cv] of Object.entries(patch)) {
+    if (ck === "__proto__" || ck === "constructor" || ck === "prototype") continue;
+    if (cv === void 0) continue;
+    if (cv === null) {
+      delete out[ck];
+      continue;
+    }
+    if (depth > 1 && isPlainObject(cv) && isPlainObject(out[ck])) {
+      out[ck] = mergeNested(out[ck], cv, depth - 1);
+      continue;
+    }
+    out[ck] = cv;
+  }
+  return out;
+}
 function mergeAgencyProfile(existing, patch) {
   const p = isPlainObject(patch) ? patch : {};
   const merged = Object.assign(/* @__PURE__ */ Object.create(null), existing);
@@ -21972,17 +22133,7 @@ function mergeAgencyProfile(existing, patch) {
       continue;
     }
     if (NESTED.has(k) && isPlainObject(v)) {
-      const base = isPlainObject(merged[k]) ? { ...merged[k] } : {};
-      for (const [ck, cv] of Object.entries(v)) {
-        if (ck === "__proto__" || ck === "constructor" || ck === "prototype") continue;
-        if (cv === void 0) continue;
-        if (cv === null) {
-          delete base[ck];
-          continue;
-        }
-        base[ck] = cv;
-      }
-      merged[k] = base;
+      merged[k] = mergeNested(isPlainObject(merged[k]) ? merged[k] : {}, v, 2);
       continue;
     }
     merged[k] = v;
@@ -22043,7 +22194,7 @@ function writeAgencyProfile(patch, file = agencyProfilePath()) {
 function profileIsUsable(p) {
   return Boolean(p.agencyName);
 }
-var fs12, path11, AGENCY_PROFILE_ENV, EMPTY, MAX_URL, MAX_SOP, PATCHABLE, NESTED, isPlainObject;
+var fs12, path11, AGENCY_PROFILE_ENV, EMPTY, MAX_URL, MAX_SOP, MAX_PARA, PATCHABLE, NESTED, isPlainObject;
 var init_agency_profile = __esm({
   "src/agency-profile.ts"() {
     "use strict";
@@ -22055,6 +22206,7 @@ var init_agency_profile = __esm({
     EMPTY = { v: 1 };
     MAX_URL = 500;
     MAX_SOP = 2e3;
+    MAX_PARA = 2e3;
     PATCHABLE = [
       "agencyName",
       "legalName",
@@ -22066,9 +22218,10 @@ var init_agency_profile = __esm({
       "pricing",
       "delivery",
       "staff",
-      "defaults"
+      "defaults",
+      "agencyOs"
     ];
-    NESTED = /* @__PURE__ */ new Set(["sender", "pricing", "delivery", "defaults"]);
+    NESTED = /* @__PURE__ */ new Set(["sender", "pricing", "delivery", "defaults", "agencyOs"]);
     isPlainObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
   }
 });
@@ -22262,7 +22415,7 @@ function parseNote(body) {
   if (!s || typeof s !== "object" || typeof s.biz !== "string") return null;
   if (!s.ans || typeof s.ans !== "object") return null;
   return {
-    state: { biz: s.biz, trade: s.trade, ans: s.ans, skip: s.skip ?? {}, asm: s.asm ?? {} },
+    state: { biz: s.biz, trade: s.trade, ans: s.ans, skip: s.skip ?? {}, asm: s.asm ?? {}, ...s.client && typeof s.client === "object" ? { client: s.client } : {} },
     computed: p.computed ?? null
   };
 }
@@ -22820,7 +22973,12 @@ function renderReport(opts) {
   out.push("<header>");
   if (agency.name) out.push('<p class="by">Prepared by ' + esc(agency.name) + "</p>");
   out.push("<h1>Where " + biz + " is leaking</h1>");
+  var who = state.client && state.client.name ? esc(state.client.name) + (state.client.role ? ", " + esc(state.client.role) : "") : "";
+  if (who) out.push('<p class="for">Prepared for ' + who + "</p>");
   if (date) out.push('<p class="when">' + esc(date) + "</p>");
+  if (agency.method || agency.promise) {
+    out.push('<p class="about">' + [agency.method, agency.promise].filter(Boolean).map(esc).join(" ") + "</p>");
+  }
   out.push("</header>");
   if (r.verdict === "insufficient") {
     out.push('<div class="verdict stop"><b>We could not put a number on this yet</b>' + esc(r.line || "") + "</div>");
@@ -22939,7 +23097,7 @@ function sourceLine(state, r, labels) {
 }
 function footer(agency) {
   if (!agency.name) return "";
-  return "<footer>" + esc(agency.name) + (agency.contact ? " &middot; " + esc(agency.contact) : "") + "</footer>";
+  return "<footer>" + esc(agency.name) + (agency.contact ? " &middot; " + esc(agency.contact) : "") + (agency.guarantee ? '<br><span class="guarantee">' + esc(agency.guarantee) + "</span>" : "") + "</footer>";
 }
 function css(accent) {
   return [
@@ -22951,6 +23109,9 @@ function css(accent) {
     ".by{font-size:.72rem;letter-spacing:.09em;text-transform:uppercase;color:var(--a);margin:0 0 .4rem;font-weight:600}",
     "h1{font-size:1.9rem;line-height:1.15;margin:0;font-weight:700}",
     ".when{color:var(--mut);font-size:.82rem;margin:.4rem 0 0}",
+    ".for{color:var(--ink);font-size:.95rem;margin:.5rem 0 0}",
+    ".about{color:var(--mut);font-size:.95rem;margin:.6rem 0 0;max-width:38rem}",
+    ".guarantee{color:var(--mut);font-size:.85rem}",
     "h2{font-size:1.15rem;margin:2rem 0 .5rem;font-weight:700}",
     "table{border-collapse:collapse;width:100%;margin:.6rem 0;font-size:.94rem}",
     "th,td{text-align:left;padding:.5rem .6rem;border-bottom:1px solid var(--rule);vertical-align:top}",
@@ -22988,7 +23149,7 @@ function today() {
   return (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
 }
 function normalise(s) {
-  return { biz: s.biz, trade: s.trade, ans: s.ans, skip: s.skip ?? {}, asm: s.asm ?? {} };
+  return { biz: s.biz, trade: s.trade, ans: s.ans, skip: s.skip ?? {}, asm: s.asm ?? {}, ...s.client ? { client: s.client } : {} };
 }
 function computedFor(state) {
   const r = compute(state.ans, state.skip, state.asm);
@@ -23004,9 +23165,11 @@ function computedFor(state) {
 async function createPipeline(client, locationId2) {
   try {
     await client.post("/opportunities/pipelines", {
-      locationId: locationId2,
-      name: PIPELINE_NAME,
-      stages: STAGES.map((name, position2) => ({ name, position: position2, showInFunnel: true, showInPieChart: true }))
+      body: {
+        locationId: locationId2,
+        name: PIPELINE_NAME,
+        stages: STAGES.map((name, position2) => ({ name, position: position2, showInFunnel: true, showInPieChart: true }))
+      }
     });
     return { ok: true };
   } catch (e) {
@@ -23045,6 +23208,87 @@ async function findStage(client, locationId2, stage, mayCreate = false) {
   }
   return { pipelineId: pipe.id, stageId: st.id, stageName: stage };
 }
+async function saveAssessment(client, locationId2, args) {
+  const state = normalise(args.assessment);
+  const computed = computedFor(state);
+  const stage = stageFor({ verdict: computed.verdict, proposalSent: args.proposalSent, outcome: args.outcome });
+  const { payload: contactBody, dedupable } = buildContact(state, stage, {
+    name: args.contactName,
+    email: args.email,
+    phone: args.phone
+  });
+  const upserted = await client.post("/contacts/upsert", {
+    body: { ...contactBody, locationId: locationId2 }
+  });
+  const contactId = upserted?.contact?.id ?? upserted?.id;
+  if (!contactId) {
+    return { saved: false, error: "GoHighLevel did not return a contact id, so nothing was written. Nothing partial was left behind." };
+  }
+  const bodies = buildNoteBodies(buildNote(state, computed, LOOKUP, today()));
+  const noteIds = [];
+  for (const body of bodies) {
+    const note = await client.post(`/contacts/${contactId}/notes`, { body: { body } });
+    const id = note?.note?.id ?? note?.id;
+    if (id) noteIds.push(id);
+  }
+  if (noteIds.length !== bodies.length) {
+    return {
+      saved: false,
+      contactId,
+      error: `the answer sheet needed ${bodies.length} note(s) and only ${noteIds.length} were written. A part-written record will NOT load \u2014 it refuses rather than returning half an assessment. Save again.`
+    };
+  }
+  const hit = await findStage(client, locationId2, stage, args.createPipeline === true);
+  const opp = buildOpportunity(state, computed, stage, args.proposalValue);
+  let opportunity = null;
+  let opportunityNote = null;
+  if ("error" in hit) {
+    opportunityNote = hit.error;
+  } else {
+    const body = {
+      locationId: locationId2,
+      contactId,
+      name: opp.name,
+      status: opp.status,
+      monetaryValue: opp.monetaryValue,
+      pipelineId: hit.pipelineId,
+      pipelineStageId: hit.stageId,
+      source: "Command OS assessment"
+    };
+    try {
+      opportunity = await client.post("/opportunities/", { body });
+    } catch (e) {
+      const raw = String(e?.message ?? e);
+      const existing = /OPPORTUNITY_NO_DUPLICATE/.test(raw) ? raw.match(/"existingId"\s*:\s*"([^"]+)"/)?.[1] : void 0;
+      if (!existing) throw e;
+      opportunity = await client.put(`/opportunities/${existing}`, {
+        body: {
+          name: opp.name,
+          status: opp.status,
+          monetaryValue: opp.monetaryValue,
+          pipelineId: hit.pipelineId,
+          pipelineStageId: hit.stageId
+        }
+      });
+      opportunityNote = `This business already had a deal on your Assessments board, so it was moved to "${stage}" and its value updated rather than a second one being created.`;
+    }
+  }
+  return {
+    saved: true,
+    contactId,
+    noteIds,
+    notesWritten: bodies.length,
+    stage,
+    tag: tagFor(stage),
+    verdict: computed.verdict,
+    monthly: Math.round(computed.monthly),
+    hoursPerWeek: Number(computed.hrsWk.toFixed(1)),
+    opportunity,
+    opportunityNote,
+    warning: dedupable ? null : "No email or phone was given, so this contact cannot be matched next time and a second assessment for the same business would create a second contact.",
+    whereItLives: `Contact ${contactId} in location ${locationId2}. Anyone on your team with a GoHighLevel login can open it.`
+  };
+}
 function registerAssessmentTools(server2, client) {
   safeTool(
     server2,
@@ -23061,88 +23305,7 @@ function registerAssessmentTools(server2, client) {
       proposalSent: import_zod62.z.boolean().optional(),
       createPipeline: import_zod62.z.boolean().optional().describe('Create the "Assessments" pipeline in your own GoHighLevel if it is not there yet. Off by default: it is a write to your account, so it is asked for rather than assumed. Say yes the first time and never again.')
     },
-    async (args) => {
-      const locationId2 = client.resolveLocationId(args.locationId);
-      const state = normalise(args.assessment);
-      const computed = computedFor(state);
-      const stage = stageFor({ verdict: computed.verdict, proposalSent: args.proposalSent, outcome: args.outcome });
-      const { payload: contactBody, dedupable } = buildContact(state, stage, {
-        name: args.contactName,
-        email: args.email,
-        phone: args.phone
-      });
-      const upserted = await client.post("/contacts/upsert", {
-        body: { ...contactBody, locationId: locationId2 }
-      });
-      const contactId = upserted?.contact?.id ?? upserted?.id;
-      if (!contactId) {
-        return { saved: false, error: "GoHighLevel did not return a contact id, so nothing was written. Nothing partial was left behind." };
-      }
-      const bodies = buildNoteBodies(buildNote(state, computed, LOOKUP, today()));
-      const noteIds = [];
-      for (const body of bodies) {
-        const note = await client.post(`/contacts/${contactId}/notes`, { body: { body } });
-        const id = note?.note?.id ?? note?.id;
-        if (id) noteIds.push(id);
-      }
-      if (noteIds.length !== bodies.length) {
-        return {
-          saved: false,
-          contactId,
-          error: `the answer sheet needed ${bodies.length} note(s) and only ${noteIds.length} were written. A part-written record will NOT load \u2014 it refuses rather than returning half an assessment. Save again.`
-        };
-      }
-      const hit = await findStage(client, locationId2, stage, args.createPipeline === true);
-      const opp = buildOpportunity(state, computed, stage, args.proposalValue);
-      let opportunity = null;
-      let opportunityNote = null;
-      if ("error" in hit) {
-        opportunityNote = hit.error;
-      } else {
-        const body = {
-          locationId: locationId2,
-          contactId,
-          name: opp.name,
-          status: opp.status,
-          monetaryValue: opp.monetaryValue,
-          pipelineId: hit.pipelineId,
-          pipelineStageId: hit.stageId,
-          source: "Command OS assessment"
-        };
-        try {
-          opportunity = await client.post("/opportunities/", { body });
-        } catch (e) {
-          const raw = String(e?.message ?? e);
-          const existing = /OPPORTUNITY_NO_DUPLICATE/.test(raw) ? raw.match(/"existingId"\s*:\s*"([^"]+)"/)?.[1] : void 0;
-          if (!existing) throw e;
-          opportunity = await client.put(`/opportunities/${existing}`, {
-            body: {
-              name: opp.name,
-              status: opp.status,
-              monetaryValue: opp.monetaryValue,
-              pipelineId: hit.pipelineId,
-              pipelineStageId: hit.stageId
-            }
-          });
-          opportunityNote = `This business already had a deal on your Assessments board, so it was moved to "${stage}" and its value updated rather than a second one being created.`;
-        }
-      }
-      return {
-        saved: true,
-        contactId,
-        noteIds,
-        notesWritten: bodies.length,
-        stage,
-        tag: tagFor(stage),
-        verdict: computed.verdict,
-        monthly: Math.round(computed.monthly),
-        hoursPerWeek: Number(computed.hrsWk.toFixed(1)),
-        opportunity,
-        opportunityNote,
-        warning: dedupable ? null : "No email or phone was given, so this contact cannot be matched next time and a second assessment for the same business would create a second contact.",
-        whereItLives: `Contact ${contactId} in location ${locationId2}. Anyone on your team with a GoHighLevel login can open it.`
-      };
-    }
+    async (args) => saveAssessment(client, client.resolveLocationId(args.locationId), args)
   );
   safeTool(
     server2,
@@ -23340,7 +23503,8 @@ var init_assessment = __esm({
       trade: import_zod62.z.string().optional().describe("Their trade. Decides which benchmarks may be applied."),
       ans: import_zod62.z.record(import_zod62.z.union([import_zod62.z.string(), import_zod62.z.number()])).describe("questionId -> answer, exactly as typed."),
       skip: import_zod62.z.record(import_zod62.z.boolean()).optional().describe("questionId -> true where they did not know."),
-      asm: import_zod62.z.record(import_zod62.z.number()).optional().describe("assumption id -> rate as a decimal.")
+      asm: import_zod62.z.record(import_zod62.z.number()).optional().describe("assumption id -> rate as a decimal."),
+      client: import_zod62.z.object({ name: import_zod62.z.string().max(120), role: import_zod62.z.string().max(80), email: import_zod62.z.string().max(200), phone: import_zod62.z.string().max(40), website: import_zod62.z.string().max(300), city: import_zod62.z.string().max(120) }).partial().optional().describe("The person and place this is for, as typed on The client step. Rides with the answers so a load brings it back.")
     });
   }
 });
@@ -24315,9 +24479,9 @@ function scanTags(html2) {
     if (!m[1]) {
       const raw = m[3];
       let a;
-      ATTR.lastIndex = 0;
-      while (a = ATTR.exec(raw)) {
-        if (a.index === ATTR.lastIndex) ATTR.lastIndex++;
+      ATTR2.lastIndex = 0;
+      while (a = ATTR2.exec(raw)) {
+        if (a.index === ATTR2.lastIndex) ATTR2.lastIndex++;
         const k = a[1].toLowerCase();
         if (k === "/") continue;
         attrs[k] = (a[2] ?? a[3] ?? a[4] ?? "").trim();
@@ -24420,13 +24584,13 @@ function lintDesignContract(html2, medium) {
     }
   };
 }
-var SLIDE_TYPES, ROLES, ATTR;
+var SLIDE_TYPES, ROLES, ATTR2;
 var init_lint = __esm({
   "src/command-os/design/lint.ts"() {
     "use strict";
     SLIDE_TYPES = ["title", "section", "content", "quote", "closing"];
     ROLES = ["headline", "body", "caption", "logo", "cta-primary", "cta-secondary", "nav", "eyebrow"];
-    ATTR = /([\w:.-]+)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'>]+)))?/g;
+    ATTR2 = /([\w:.-]+)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'>]+)))?/g;
   }
 });
 
@@ -24556,8 +24720,9 @@ function composeBrief(d, brief) {
   ];
   const chosenContract = conversionMode ? conversionContract : contract;
   const checklist = design.map((r) => `${r.id} ${r.name} \u2014 ${r.threshold}`);
-  const logoBlock = d.logo?.inlineSvg ? `Logo markup (use verbatim, colour via currentColor):
-${d.logo.inlineSvg.slice(0, 6e3)}` : d.logo?.dataUri ? `Logo markup: <img src="${d.logo.dataUri.slice(0, 40)}\u2026" alt="${d.name}" data-role="logo" data-media="semantic"> (the full data URI is in the brand file)` : 'No logo is stored for this brand; use the brand name set in the display face as a wordmark, data-role="logo".';
+  const cleanLogo = d.logo?.inlineSvg ? sanitizeSvgOrDrop(d.logo.inlineSvg) : void 0;
+  const logoBlock = cleanLogo ? `Logo markup (use verbatim, colour via currentColor):
+${cleanLogo.slice(0, 6e3)}` : d.logo?.dataUri ? `Logo markup: <img src="${d.logo.dataUri.slice(0, 40)}\u2026" alt="${d.name}" data-role="logo" data-media="semantic"> (the full data URI is in the brand file)` : 'No logo is stored for this brand; use the brand name set in the display face as a wordmark, data-role="logo".';
   const markdown = [
     `# Design brief \u2014 ${brief.medium} for ${d.name}`,
     "",
@@ -24610,6 +24775,7 @@ var init_brief = __esm({
     init_color();
     init_fonts();
     init_lint();
+    init_svg_sanitize();
   }
 });
 
@@ -26562,7 +26728,7 @@ function readAgencyBranding(base = appDataDir()) {
     const out = {};
     if (typeof st.agencyName === "string" && st.agencyName.trim()) out.agencyName = st.agencyName.trim();
     if (isHex(st.agencyAccent)) out.accent = st.agencyAccent;
-    if (typeof st.agencyLogoDataUri === "string" && st.agencyLogoDataUri.startsWith("data:image/")) out.logoDataUri = st.agencyLogoDataUri;
+    if (isRasterDataUri(st.agencyLogoDataUri)) out.logoDataUri = st.agencyLogoDataUri;
     return out;
   } catch {
     return {};
@@ -26572,7 +26738,7 @@ function resolveBranding(overrides = {}, base) {
   const saved = readAgencyBranding(base);
   const agencyName = overrides.agencyName?.trim() || saved.agencyName;
   const accent = isHex(overrides.accent) ? overrides.accent : saved.accent ?? DEFAULT_ACCENT;
-  const logoDataUri = overrides.logoDataUri ?? saved.logoDataUri;
+  const logoDataUri = isRasterDataUri(overrides.logoDataUri) ? overrides.logoDataUri : saved.logoDataUri;
   return { ...agencyName && { agencyName }, accent, ...logoDataUri && { logoDataUri } };
 }
 var import_node_fs2, import_node_path2, DEFAULT_ACCENT;
@@ -26582,6 +26748,7 @@ var init_branding = __esm({
     import_node_fs2 = require("node:fs");
     import_node_path2 = require("node:path");
     init_credentials_store();
+    init_svg_sanitize();
     DEFAULT_ACCENT = "#B8934A";
   }
 });
@@ -26631,7 +26798,7 @@ td.ev{font-family:ui-monospace,Menlo,monospace;font-size:12.5px;color:var(--mute
 .shots a{font-size:13px;color:var(--accent)}
 footer{margin-top:40px;color:var(--muted);font-size:13px;border-top:1px solid var(--line);padding-top:12px}
 </style></head><body><div class="wrap">
-<header><div>${b.logoDataUri ? `<img src="${b.logoDataUri}" alt="" style="height:28px;margin-bottom:8px">` : ""}<h1>Design check</h1><div class="agency">${b.agencyName ? esc2(b.agencyName) + " \xB7 " : ""}${esc2(v.medium)} \xB7 ${esc2(v.target)} \xB7 ${esc2(v.at.slice(0, 16).replace("T", " "))} \xB7 ${v.renderedWith === "browser" ? "rendered in a browser" : "static checks only"}</div></div><div class="verdict ${verdictClass}">${v.verdict === "PASS" ? "Passes every measured rule" : v.verdict === "FAIL" ? "Fails a measured rule" : "Not graded"}</div></header>
+<header><div>${isRasterDataUri(b.logoDataUri) ? `<img src="${esc2(b.logoDataUri)}" alt="" style="height:28px;margin-bottom:8px">` : ""}<h1>Design check</h1><div class="agency">${b.agencyName ? esc2(b.agencyName) + " \xB7 " : ""}${esc2(v.medium)} \xB7 ${esc2(v.target)} \xB7 ${esc2(v.at.slice(0, 16).replace("T", " "))} \xB7 ${v.renderedWith === "browser" ? "rendered in a browser" : "static checks only"}</div></div><div class="verdict ${verdictClass}">${v.verdict === "PASS" ? "Passes every measured rule" : v.verdict === "FAIL" ? "Fails a measured rule" : "Not graded"}</div></header>
 <p class="scope"><strong>What this report is not.</strong> Every rule here measures craft \u2014 type, spacing, colour, contrast, structure, performance, and the tells that make a page look machine-made. <strong>None of them measures whether the page persuades anyone.</strong> A page can pass every rule and still be boring, unconvincing and unsellable: no hook, no proof, no reason to care. Judge the writing separately, and never read a pass here as "this is a good page".</p>
 <div class="conf ${v.conformance.ok ? "ok" : ""}"><b>${v.conformance.ok ? "The file honours the output contract." : "The file breaks the output contract, so the design rules were not graded."}</b>${v.conformance.problems.length ? `<ul>${v.conformance.problems.map((p) => `<li>${esc2(p)}</li>`).join("")}</ul>` : ""}${v.conformance.warnings.length ? `<div class="det">Warnings: ${v.conformance.warnings.map(esc2).join(" \xB7 ")}</div>` : ""}</div>
 <div class="sum"><div><b>${s.measuredPass}</b><span>measured, pass</span></div><div><b>${s.measuredFail}</b><span>measured, fail</span></div><div><b>${s.proxyPass}</b><span>proxy, pass</span></div><div><b>${s.proxyFail}</b><span>proxy, fail</span></div><div><b>${s.asserted}</b><span>judgment calls</span></div><div><b>${s.na + s.unchecked}</b><span>not applicable / not checked</span></div></div>
@@ -26646,6 +26813,7 @@ var init_report2 = __esm({
   "src/command-os/design/report.ts"() {
     "use strict";
     init_branding();
+    init_svg_sanitize();
     esc2 = (s) => String(s ?? "").replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
     STATE_LABEL = {
       "MEASURED-PASS": "Pass",
@@ -27428,8 +27596,14 @@ function registerDesignStudioTools(server2) {
         d.provenance.evidence["shape.radius"] = `set by ${stamp}`;
       }
       if (a.logoSvg) {
-        if (!/^\s*<svg[\s\S]*<\/svg>\s*$/i.test(a.logoSvg) || a.logoSvg.length > 6e4) throw new Error("logoSvg must be one <svg>\u2026</svg> under 60 KB. Nothing was changed.");
-        d.logo = { inlineSvg: a.logoSvg, whiteFillFixed: false, source: `set by ${stamp}`, rights: "declared" };
+        let clean;
+        try {
+          clean = sanitizeSvg(a.logoSvg);
+        } catch (e) {
+          throw new Error(`${e.message} Nothing was changed.`);
+        }
+        a.logoSvg = clean;
+        d.logo = { inlineSvg: clean, whiteFillFixed: false, source: `set by ${stamp}`, rights: "declared" };
         d.provenance.evidence["logo"] = `set by ${stamp}`;
       }
       if (a.tone) d.voice.tone = a.tone;
@@ -27655,6 +27829,7 @@ var init_design_studio = __esm({
     init_fonts();
     init_color();
     init_branding();
+    init_svg_sanitize();
     summarise2 = (d) => ({
       slug: d.slug,
       name: d.name,
@@ -28820,9 +28995,9 @@ function registerConnectorTools(server2) {
       links.push(...proposeClientLinks(result.customers, known, observedAt));
       const timeZone = readAgencyProfile()?.defaults?.timezone;
       const bridged = bridgeToEngagements(identities, links, observations, clients, { timeZone });
-      const nameOf = (t) => clients[t]?.clientName ?? t;
-      const owed = owedByClient(outstanding(result.invoices), identities, links, nameOf);
-      const abandoned = owedByClient(writtenOff(result.invoices), identities, links, nameOf);
+      const nameOf2 = (t) => clients[t]?.clientName ?? t;
+      const owed = owedByClient(outstanding(result.invoices), identities, links, nameOf2);
+      const abandoned = owedByClient(writtenOff(result.invoices), identities, links, nameOf2);
       const renewals = renewalsDue(result.subs);
       let written = 0;
       let created = 0;
@@ -28864,7 +29039,7 @@ function registerConnectorTools(server2) {
           stripeCustomerId: c.id,
           email: c.email ?? null,
           name: c.name ?? null,
-          looksLike: hits.length === 1 ? nameOf(hits[0]) : null,
+          looksLike: hits.length === 1 ? nameOf2(hits[0]) : null,
           looksLikeClientKey: hits.length === 1 ? hits[0] : null
         };
       });
@@ -33396,7 +33571,7 @@ function runStage(locationId2, stage, onEvent, opts = {}) {
   const permission = buildPermission(locationId2, { name: opts.name, approvedAt: opts.approvedAt });
   if (!permission.allowed) return Promise.reject(new Error(`Refused: ${permission.reason}`));
   const locationName = SANDBOX_ALLOWLIST[locationId2] || opts.name || locationId2;
-  const spec = STAGE_SPECS[stage];
+  const spec = opts.spec ?? STAGE_SPECS[stage];
   if (!spec) return Promise.reject(new Error(`Stage ${stage} is not powered yet.`));
   return new Promise((resolve11) => {
     void (async () => {
@@ -33736,6 +33911,7 @@ var init_handoff_pack = __esm({
     "use strict";
     init_report_tokens();
     import_zod69 = require("zod");
+    init_svg_sanitize();
     RunnerCheckSchema = import_zod69.z.object({
       name: import_zod69.z.string().min(1),
       state: import_zod69.z.enum(["CHECKED", "DONE_UNCHECKED"]),
@@ -34808,7 +34984,7 @@ function idFor(kind, what) {
   for (let i = 0; i < what.length; i++) h = h * 31 + what.charCodeAt(i) >>> 0;
   return `site-${kind}-${h.toString(36)}`;
 }
-function safeUrl2(u) {
+function safeUrl3(u) {
   const s = trim(u, 500);
   if (!s) return "";
   try {
@@ -34841,7 +35017,7 @@ function siteObservationsToFindings(input) {
       refused.push({ what: "(no description)", reason: "the observation said nothing" });
       continue;
     }
-    const evidence = (o.evidence ?? []).map((e) => ({ url: safeUrl2(e?.url), quote: trim(e?.quote, 300) })).filter((e) => e.url && e.quote);
+    const evidence = (o.evidence ?? []).map((e) => ({ url: safeUrl3(e?.url), quote: trim(e?.quote, 300) })).filter((e) => e.url && e.quote);
     if (o.kind === "present") {
       if (!evidence.length) {
         refused.push({ what, reason: "said the site does something, without quoting where" });
@@ -34865,7 +35041,7 @@ function siteObservationsToFindings(input) {
       }
     }
     if (o.kind === "absent") {
-      const checked = (o.checkedPages ?? []).map(safeUrl2).filter(Boolean);
+      const checked = (o.checkedPages ?? []).map(safeUrl3).filter(Boolean);
       if (!checked.length) {
         refused.push({ what, reason: "claimed something is missing without saying what was read \u2014 unverifiable, so it does not ship" });
         continue;
@@ -34884,7 +35060,7 @@ function siteObservationsToFindings(input) {
       remedy: remedyFor(kind),
       fix: "manual",
       minutes: kind === "contradiction" ? 15 : 30,
-      evidence: kind === "contradiction" ? evidence.map((e) => ({ tool: "website", detail: `"${e.quote}" \u2014 ${e.url}` })) : (o.checkedPages ?? []).map(safeUrl2).filter(Boolean).map((u) => ({ tool: "website", detail: `checked, not found: ${u}` }))
+      evidence: kind === "contradiction" ? evidence.map((e) => ({ tool: "website", detail: `"${e.quote}" \u2014 ${e.url}` })) : (o.checkedPages ?? []).map(safeUrl3).filter(Boolean).map((u) => ({ tool: "website", detail: `checked, not found: ${u}` }))
     });
   }
   return {
@@ -36123,8 +36299,22 @@ async function submitIntakeAnswers(client, locationId2, snapshot, answers, conta
     return { ok: false, unmapped, error: e instanceof Error ? e.message : String(e) };
   }
 }
+function escapeHtml2(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function intakeEmailHtml(to, formUrl, agencyName) {
+  if (!/^https:\/\/[^\s"'<>]+$/.test(formUrl)) throw new Error("the form link is not a web address");
+  return [
+    `<p>Hi ${escapeHtml2(to.firstName?.trim() || "there")},</p>`,
+    `<p>Before we build out your account, we need the details only you can give us. It takes about ten minutes, and you can stop and come back to it.</p>`,
+    `<p><a href="${escapeHtml2(formUrl)}"><strong>Open your onboarding questionnaire</strong></a></p>`,
+    `<p>Answer what you know. Anything you're unsure about, leave it and we'll cover it on our next call.</p>`,
+    `<p>${escapeHtml2(agencyName)}</p>`
+  ].join("");
+}
 async function emailIntakeLink(client, locationId2, to, formUrl, agencyName) {
   try {
+    const html2 = intakeEmailHtml(to, formUrl, agencyName);
     const found = await client.get("/contacts/", { params: { locationId: locationId2, query: to.email, limit: 5 } });
     let contactId = (found.contacts ?? []).find((c) => c.email?.toLowerCase() === to.email.toLowerCase())?.id;
     if (!contactId) {
@@ -36134,13 +36324,6 @@ async function emailIntakeLink(client, locationId2, to, formUrl, agencyName) {
       contactId = made.contact?.id;
     }
     if (!contactId) throw new Error("could not create a contact to email");
-    const html2 = [
-      `<p>Hi ${to.firstName || "there"},</p>`,
-      `<p>Before we build out your account, we need the details only you can give us. It takes about ten minutes, and you can stop and come back to it.</p>`,
-      `<p><a href="${formUrl}"><strong>Open your onboarding questionnaire</strong></a></p>`,
-      `<p>Answer what you know. Anything you're unsure about, leave it and we'll cover it on our next call.</p>`,
-      `<p>${agencyName}</p>`
-    ].join("");
     await client.post("/conversations/messages", {
       body: { type: "Email", contactId, emailTo: to.email, subject: "Your onboarding questionnaire", html: html2 }
     });
@@ -36165,9 +36348,14 @@ function prefillTools(source, recorderPatterns = []) {
   const deny = "Bash,Write,Edit,MultiEdit,NotebookEdit,Task";
   if (source.kind === "text") return { allow: "", deny: deny + ",WebFetch,WebSearch,Read,Glob,Grep" };
   if (source.kind === "url") return { allow: "WebFetch", deny: deny + ",WebSearch,Read,Glob,Grep" };
+  if (source.kind === "file") return { allow: "Read", deny: deny + ",WebFetch,WebSearch,Glob,Grep" };
   return { allow: recorderPatterns.join(","), deny: deny + ",Read,Glob,Grep" };
 }
 function sourcePreamble(source) {
+  if (source.kind === "file") {
+    return `Read the document at this exact path with the Read tool and use its contents as the material: ${source.path}
+It may be a PDF, a Word document or plain text (the file is "${source.name}"). If it cannot be read or is empty, say so \u2014 do not guess from the file name.`;
+  }
   if (source.kind === "url") {
     return `Fetch this and use it as the material: ${source.url}
 If it needs a login or returns nothing usable, say so \u2014 do not guess from the URL alone.`;
@@ -36204,7 +36392,7 @@ function prefillPromptForSource(labels, source) {
 ${body}` : body;
 }
 async function prefillFromSource(spawnClaude, labels, source, recorderPatterns = []) {
-  const empty = source.kind === "text" && !source.text.trim() || source.kind === "url" && !source.url.trim() || source.kind === "recorder" && !source.instruction.trim();
+  const empty = source.kind === "text" && !source.text.trim() || source.kind === "url" && !source.url.trim() || source.kind === "recorder" && !source.instruction.trim() || source.kind === "file" && !source.path.trim();
   if (empty) return { ok: false, answers: {}, unknown: labels, error: "nothing to read" };
   return runPrefill(() => spawnClaude(prefillPromptForSource(labels, source), prefillTools(source, recorderPatterns)), labels);
 }
@@ -38928,10 +39116,10 @@ async function executeBackbone(plan, deps, opts = {}) {
   }
   return { ok: true, idMap, built, manual, published, publishFailed, deferred, staff, templates, templatesUnverified, templatesFormatNote, calendarPending, refreshed, missingSteps, recipients };
 }
-async function buildSimple(objects, type, list2, create, nameOf, pollForNew, idMap, built) {
+async function buildSimple(objects, type, list2, create, nameOf2, pollForNew, idMap, built) {
   if (objects.length === 0) return null;
   for (const obj of objects) {
-    const name = nameOf(obj);
+    const name = nameOf2(obj);
     let existing;
     try {
       existing = await list2();
@@ -40938,6 +41126,340 @@ var init_intake_contact = __esm({
   }
 });
 
+// src/command-os/client-capabilities.ts
+function findArray(raw, key) {
+  if (Array.isArray(raw)) return raw;
+  if (!raw || typeof raw !== "object") return null;
+  const seen = /* @__PURE__ */ new Set();
+  const byKey = (o, depth) => {
+    if (!o || typeof o !== "object" || seen.has(o) || depth > 3) return null;
+    seen.add(o);
+    const r = o;
+    if (key && Array.isArray(r[key])) return r[key];
+    for (const v of Object.values(r)) {
+      const hit = byKey(v, depth + 1);
+      if (hit) return hit;
+    }
+    return null;
+  };
+  if (key) {
+    const hit = byKey(raw, 0);
+    if (hit) return hit;
+    const r = raw;
+    for (const env of ["data", "results"]) {
+      const inner = r[env];
+      if (Array.isArray(inner)) return inner;
+      if (inner && typeof inner === "object" && Array.isArray(inner[key])) return inner[key];
+    }
+    return null;
+  }
+  seen.clear();
+  const anyArray = (o, depth) => {
+    if (!o || typeof o !== "object" || seen.has(o) || depth > 2) return null;
+    seen.add(o);
+    for (const v of Object.values(o)) if (Array.isArray(v)) return v;
+    for (const v of Object.values(o)) {
+      const hit = anyArray(v, depth + 1);
+      if (hit) return hit;
+    }
+    return null;
+  };
+  return anyArray(raw, 0);
+}
+function capabilityByKey(key) {
+  return CAPABILITIES.find((c) => c.key === key);
+}
+function nameOf(item, field) {
+  if (!item || typeof item !== "object") return "";
+  const o = item;
+  for (const k of [field, "name", "title", "label", "agentName", "value", "phoneNumber"].filter(Boolean)) {
+    const v = o[k];
+    if (typeof v === "string" && v.trim()) return v.trim();
+    if (v && typeof v === "object" && typeof v.singular === "string") return String(v.singular);
+  }
+  return "";
+}
+var CAPABILITY_GROUPS, N, AI2, CAPABILITIES, NO_BUILD_BUTTON;
+var init_client_capabilities = __esm({
+  "src/command-os/client-capabilities.ts"() {
+    "use strict";
+    CAPABILITY_GROUPS = [
+      { key: "setup", label: "Set up", blurb: "The bones of the account: who, where, what it sells and where people book." },
+      { key: "messaging", label: "Messaging and automation", blurb: "What runs on its own once a lead arrives, and what goes out to the whole list." },
+      { key: "ai", label: "AI employee", blurb: "The bot that answers texts, the agent that answers calls, and the demo you show a prospect." },
+      { key: "money", label: "Money and paperwork", blurb: "Getting paid and getting it signed." },
+      { key: "reputation", label: "Reputation and content", blurb: "Reviews, social posts and the blog." },
+      { key: "health", label: "Health and handoff", blurb: "Proving it works, keeping it clean, and handing it over." }
+    ];
+    N = (label, path36, params, key, nameField, version) => ({ label, path: path36, params, key, nameField, version });
+    AI2 = "2021-04-15";
+    CAPABILITIES = [
+      // ── Set up ──────────────────────────────────────────────────────────────
+      {
+        key: "intake",
+        group: "setup",
+        label: "Intake and documents",
+        what: "What the client told you, in one place: the intake answers, and the documents and links they sent.",
+        says: "Show me {client}'s intake answers and what is still unanswered.",
+        hub: "guides/blueprint-build-a-client-account.html",
+        reads: [N("forms on the account", "/forms/", { locationId: "{loc}", limit: "100" }, "forms", "name")],
+        blueprint: "The Blueprint intake form and its answers. Document and link uploads are the next build."
+      },
+      {
+        key: "pipelines",
+        group: "setup",
+        label: "Pipelines and stages",
+        what: "The board every lead moves across, from first contact to paid, with a stage for each step the client actually takes.",
+        says: "Stand up a pipeline for {client} with the stages a new lead moves through, from first contact to paid.",
+        hub: "guides/stand-up-a-pipeline.html",
+        reads: [N("pipelines", "/opportunities/pipelines", { locationId: "{loc}" }, "pipelines", "name")],
+        blueprint: "One pipeline, Patient Journey or the industry's equivalent, with seven stages."
+      },
+      {
+        key: "calendars",
+        group: "setup",
+        label: "Calendars and booking",
+        what: "Where people book: the calendar, its hours, who gets the appointment, and the reminders around it.",
+        says: "Set up a booking calendar for {client}: consultation, 30 minutes, weekdays 9 to 5, round robin across the staff.",
+        hub: "guides/set-up-a-booking-calendar.html",
+        reads: [N("calendars", "/calendars/", { locationId: "{loc}" }, "calendars", "name")],
+        blueprint: "One consultation calendar, round robin, 30-minute slots, pointed at the staff from the brief."
+      },
+      {
+        key: "forms",
+        group: "setup",
+        label: "Forms and surveys",
+        what: "The questions a lead answers before anyone calls them, and where those answers land.",
+        says: "Build an intake form for {client} that asks for name, email, phone and what they are interested in, and show me where the answers land.",
+        hub: "guides/create-forms-and-read-submissions.html",
+        reads: [N("forms", "/forms/", { locationId: "{loc}", limit: "100" }, "forms", "name"), N("surveys", "/surveys/", { locationId: "{loc}", limit: "100" }, "surveys", "name")],
+        blueprint: "One New Client Inquiry form, wired to the intake funnel."
+      },
+      {
+        key: "pages",
+        group: "setup",
+        label: "Pages and funnels",
+        what: "The website, the landing page and the funnel a lead lands on. Brands is only the shelf; this is where a page gets built.",
+        says: "Build {client} a landing page for their main offer using their brand from the shelf, with a booking button that opens their calendar. Show me the draft before it goes live.",
+        hub: "guides/page-studio-pages-and-sites.html",
+        reads: [N("funnels", "/funnels/funnel/list", { locationId: "{loc}", limit: "50" }, "funnels", "name")],
+        blueprint: "One intake funnel with the inquiry form on it. Full sites and offer pages are built here, one at a time."
+      },
+      {
+        key: "fields",
+        group: "setup",
+        label: "Fields, values and tags",
+        what: "The custom fields the account records, the values every message reads from, and the tags that move people between sequences.",
+        says: "Show me {client}'s custom fields, custom values and tags, and add the ones the build needs.",
+        hub: "guides/custom-fields-and-objects.html",
+        reads: [
+          N("custom fields", "/locations/{loc}/customFields", void 0, "customFields", "name"),
+          N("custom values", "/locations/{loc}/customValues", void 0, "customValues", "name"),
+          N("tags", "/locations/{loc}/tags", void 0, "tags", "name")
+        ],
+        blueprint: "Six fields, four custom values and 24 tags, including the hand-off tags the sequences use."
+      },
+      {
+        key: "staff",
+        group: "setup",
+        label: "Staff and users",
+        what: "Who works in the account, what each one may see, and who gets the alerts and the appointments.",
+        says: "Show me the staff on {client}'s account and who is assigned to the calendar and the alerts.",
+        hub: "guides/account-admin-basics.html",
+        reads: [N("users", "/users/", { locationId: "{loc}" }, "users", "name")],
+        blueprint: "One user per staff member in the brief, added in GoHighLevel's own screen because the API refuses to create them."
+      },
+      {
+        key: "phone",
+        group: "setup",
+        label: "Phone numbers and A2P",
+        what: "The number the account texts and calls from, and the registration without which no text is delivered.",
+        says: "Show me {client}'s phone numbers and whether A2P registration is done, and what is left to do by hand.",
+        hub: "guides/account-admin-basics.html",
+        reads: [N("phone numbers", "/phone-system/numbers/", { locationId: "{loc}" }, "phoneNumbers", "title")],
+        blueprint: "Nothing. Numbers and A2P are bought and registered by hand in GoHighLevel; the build checks they exist."
+      },
+      // ── Messaging and automation ────────────────────────────────────────────
+      {
+        key: "workflows",
+        group: "messaging",
+        label: "Workflows and automations",
+        what: "What happens on its own when a lead arrives, books, goes quiet or replies: speed to lead, missed-call text-back, nurture, reminders, no-show rescue.",
+        says: "Show me {client}'s workflows and which of the standard eight are missing, then build the missing ones as drafts for my review.",
+        hub: "guides/speed-to-lead.html",
+        reads: [N("workflows", "/workflows/", { locationId: "{loc}" }, "workflows", "name")],
+        blueprint: "Eight workflows: Speed to Lead, Lead Nurture, Win-back, Replied Stop and Route, Missed Call Text-Back, Confirm and Move, Reminders, No-Show Rescue."
+      },
+      {
+        key: "reactivation",
+        group: "messaging",
+        label: "Reactivation campaigns",
+        what: "Bringing a cold list back: one reason to return per message, over a month, to everyone who went quiet.",
+        says: "Build a reactivation campaign for {client}: find everyone who has not booked in 90 days and run the win-back sequence on them, as a draft first.",
+        hub: "guides/win-back-a-cold-list.html",
+        reads: [N("workflows", "/workflows/", { locationId: "{loc}" }, "workflows", "name"), N("campaigns", "/campaigns/", { locationId: "{loc}" }, "campaigns", "name")],
+        blueprint: "The Win-back sequence, five touches over 31 days, started by the winback-start tag."
+      },
+      {
+        key: "templates",
+        group: "messaging",
+        label: "Email and SMS templates",
+        what: "The messages themselves, written once in the client's voice and reused by every workflow and broadcast.",
+        says: "Show me {client}'s email and text templates, and write the ones the sequences still need in their voice.",
+        hub: "guides/build-email-templates.html",
+        reads: [N("email templates", "/emails/builder", { locationId: "{loc}", limit: "100" }, "builders", "name")],
+        blueprint: "Fifteen emails and seventeen texts, send-ready, one copy guide."
+      },
+      {
+        key: "broadcasts",
+        group: "messaging",
+        label: "Broadcasts and email campaigns",
+        what: "One message to a whole list, now or scheduled: an offer, an event, a newsletter.",
+        says: "Draft an email to {client}'s list about their next event and show it to me. Do not send or schedule anything; I do that.",
+        hub: "guides/send-texts-and-emails.html",
+        reads: [N("scheduled emails", "/emails/schedule", { locationId: "{loc}", limit: "50" }, "schedules", "name"), N("email templates", "/emails/builder", { locationId: "{loc}", limit: "100" }, "builders", "name")]
+      },
+      // ── AI employee ─────────────────────────────────────────────────────────
+      {
+        key: "conversation-ai",
+        group: "ai",
+        label: "Conversation AI",
+        what: "GoHighLevel's name for the bot that answers texts and chats from the client's own website and written answers.",
+        says: "Build {client} a Conversation AI bot: read their website into a knowledge base, build the bot in suggestive mode, and show me its first answers.",
+        hub: "command-os/ai-employee.html",
+        reads: [
+          N("knowledge bases", "/knowledge-bases/", { locationId: "{loc}", limit: "50" }, "knowledgeBases", "name", AI2),
+          N("bots", "/conversation-ai/agents/search", { limit: "50" }, "agents", "name", AI2)
+        ]
+      },
+      {
+        key: "voice-ai",
+        group: "ai",
+        label: "Voice AI",
+        what: "GoHighLevel's name for the agent that answers the phone. Built without a number, given one on purpose, proven by the transcript.",
+        says: "Check whether a call can land on {client}'s account, then build a Voice AI agent that answers, books and takes a message. Leave it unbound until I say.",
+        hub: "modules/11-your-ai-employee/lesson-05-the-phone-agent.html",
+        reads: [N("phone agents", "/voice-ai/agents", { locationId: "{loc}", page: "1", pageSize: "50" }, "agents", "agentName", AI2), N("phone numbers", "/phone-system/numbers/", { locationId: "{loc}" }, "phoneNumbers", "title")]
+      },
+      {
+        key: "demo",
+        group: "ai",
+        label: "Prospect demo",
+        what: "One sentence about a prospect's business becomes a bot they can text, on your own demo account, and one command puts it back. It messages a real prospect, so it runs from your own Claude with you watching, never from a button.",
+        says: "Prepare an AI employee demo for {client} from their website and arm it so they can text it.",
+        hub: "modules/11-your-ai-employee/lesson-04-the-five-minute-demo.html",
+        reads: []
+      },
+      // ── Money and paperwork ─────────────────────────────────────────────────
+      {
+        key: "payments",
+        group: "money",
+        label: "Products, invoices and payments",
+        what: "What the client sells, the invoices that ask for it, and the payments that came in.",
+        says: "Show me {client}'s products and open invoices, and set up the three packages with payment links.",
+        hub: "guides/invoices-and-payments.html",
+        reads: [N("products", "/products/", { locationId: "{loc}", limit: "100" }, "products", "name"), N("invoices", "/invoices/", { altId: "{loc}", altType: "location", limit: "50", offset: "0" }, "invoices", "name")]
+      },
+      {
+        key: "documents",
+        group: "money",
+        label: "Documents and signatures",
+        what: "The templates a new patient agreement or a proposal is made from.",
+        says: "Show me {client}'s document templates and tell me what a new patient agreement from the template would say. I press send.",
+        hub: "guides/documents-and-contracts.html",
+        reads: [N("document templates", "/proposals/templates", { locationId: "{loc}", limit: "50" }, "data", "name")]
+      },
+      {
+        key: "memberships",
+        group: "money",
+        label: "Memberships and courses",
+        what: "Courses, memberships and the content behind a paywall.",
+        says: "Set up a members area for {client} with their program as a course, and show me the offer page.",
+        hub: "guides/courses-and-memberships.html",
+        reads: []
+      },
+      // ── Reputation and content ──────────────────────────────────────────────
+      {
+        key: "reviews",
+        group: "reputation",
+        label: "Reviews",
+        what: "Asking for reviews at the right moment, and watching the ones that arrive.",
+        says: "Show me {client}'s latest reviews and set up a review request after every completed appointment.",
+        hub: "guides/watch-your-reviews.html",
+        reads: []
+      },
+      {
+        key: "social",
+        group: "reputation",
+        label: "Social posting",
+        what: "Posts scheduled to the client's connected social accounts.",
+        says: "Show me which social accounts {client} has connected, then write this week's posts for me to review. Nothing is posted until I say.",
+        hub: "guides/social-posting.html",
+        reads: [N("connected social accounts", "/social-media-posting/{loc}/accounts", void 0, "accounts", "name")]
+      },
+      {
+        key: "blogs",
+        group: "reputation",
+        label: "Blogs",
+        what: "The client's blog and its posts.",
+        says: "Show me {client}'s blogs and draft a post on their most asked question.",
+        hub: "guides/social-posting.html",
+        reads: [N("blogs", "/blogs/site/all", { locationId: "{loc}", limit: "50" }, "data", "name")]
+      },
+      // ── Health and handoff ──────────────────────────────────────────────────
+      {
+        key: "checkup",
+        group: "health",
+        label: "Checkup and audit",
+        what: "Whether the account works the way a lead would meet it, and whether every workflow can still be saved.",
+        says: "Run a checkup on {client}'s account and audit every workflow, then tell me what is broken before the client finds it.",
+        hub: "guides/run-a-checkup.html",
+        reads: [N("workflows", "/workflows/", { locationId: "{loc}" }, "workflows", "name")],
+        blueprint: "The Verify stage runs this after every build."
+      },
+      {
+        key: "contacts",
+        group: "health",
+        label: "Contacts and data cleanup",
+        what: "The people in the account, the duplicates, the tags, and the lists you report from.",
+        says: "Show me how many contacts {client} has, find the duplicates, and tag everyone who has not booked in 90 days.",
+        hub: "guides/bulk-tag-and-clean-up.html",
+        reads: [N("tags", "/locations/{loc}/tags", void 0, "tags", "name")]
+      },
+      {
+        key: "integrations",
+        group: "health",
+        label: "Integrations and webhooks",
+        what: "Sending the account's data to other apps, tracked links, and custom objects.",
+        says: "Set up a webhook so every new {client} lead lands in their spreadsheet, and give me a tracked link for the ad.",
+        hub: "guides/send-data-to-other-apps.html",
+        reads: [N("trigger links", "/links/", { locationId: "{loc}" }, "links", "name"), N("custom objects", "/objects/", { locationId: "{loc}" }, "objects", "labels")]
+      },
+      {
+        key: "handoff",
+        group: "health",
+        label: "Go-live and handoff",
+        what: "The final sign-off, the handoff page the client receives, and the snapshot that lets the build be reused.",
+        says: "Build {client}'s handoff page and the offboarding kit, and tell me what is still waiting on someone else.",
+        hub: "guides/snapshots-and-reusing-a-build.html",
+        reads: [],
+        blueprint: "Stage 7, Go-live, ends with the handoff page."
+      }
+    ];
+    NO_BUILD_BUTTON = /* @__PURE__ */ new Set(["demo", "documents", "social"]);
+  }
+});
+
+// src/command-os/script-json.ts
+function scriptJson(value) {
+  return JSON.stringify(value === void 0 ? null : value).replace(/</g, "\\u003c").replace(/>/g, "\\u003e").replace(/&/g, "\\u0026").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
+}
+var init_script_json = __esm({
+  "src/command-os/script-json.ts"() {
+    "use strict";
+  }
+});
+
 // src/command-os/cockpit-shell.ts
 function cockpitTokensCss(opts = {}) {
   const webfont = opts.webfont !== false;
@@ -41020,21 +41542,74 @@ function cockpitChromeCss() {
   .stepper button:disabled{opacity:.35;cursor:default}
   .stepper output{font-size:var(--fs-label);min-width:2.6rem;text-align:center;color:var(--ink-2)}
   footer{color:var(--ink-3);font-size:var(--fs-sm);text-align:center;margin:2rem 0;padding:0 1rem}
-  @media (max-width: 52rem){.brand-sub,.localpill{display:none}}
+  /* \u2500\u2500 The two-column shell: the hub's sidebar, ported (hub.css .side) \u2500\u2500 */
+  .shell{display:flex;align-items:stretch;min-height:calc(100vh - 3rem)}
+  .side{width:13.5rem;flex:none;box-sizing:border-box;background:var(--navy-deep);color:rgba(250,247,242,.74);padding:1rem .6rem 3rem;position:sticky;top:3rem;height:calc(100vh - 3rem);overflow-y:auto}
+  .side-group{margin-bottom:1rem}
+  .side-label{font-size:var(--fs-label);font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:rgba(250,247,242,.42);padding:.3rem .7rem}
+  .side a,.side .active{display:flex;align-items:center;gap:.55rem;padding:.42rem .7rem;border-radius:.45rem;color:rgba(250,247,242,.78);font-size:var(--fs-sm);font-weight:500;text-decoration:none}
+  .side a:hover{background:rgba(255,255,255,.08);color:#FAF7F2;text-decoration:none}
+  .side .active{background:rgba(255,255,255,.09);color:#FAF7F2;box-shadow:inset .18rem 0 0 var(--gold-light)}
+  .side .tag{margin-left:auto;font-size:var(--fs-label);font-weight:500;color:rgba(250,247,242,.5);white-space:nowrap}
+  .side .tag.soon{color:#CEAB6A}
+  .side .side-client{display:block;text-transform:none;letter-spacing:0;font-weight:500;color:#CEAB6A;margin-top:.15rem}
+  .side a.sub,.side .active.sub{padding-left:1.5rem;font-size:var(--fs-label);font-weight:500}
+  .side .active.grp{box-shadow:none;background:none;color:#FAF7F2}
+  .side-foot{margin-top:.6rem;padding:.7rem .7rem;border-top:1px solid rgba(255,255,255,.09);font-size:var(--fs-label);color:rgba(250,247,242,.45);line-height:1.5;display:flex;flex-direction:column;gap:.3rem}
+  .side-foot a{display:inline;padding:0;color:rgba(250,247,242,.78)}
+  .content{flex:1;min-width:0}
+  .topbar .screens{display:none}
+  @media (max-width: 52rem){.brand-sub,.localpill{display:none}.side{display:none}.topbar .screens{display:flex;align-items:center;gap:.4rem}}
 `;
 }
-function cockpitHeaderHtml(active) {
+function forThisClientHtml(capability) {
+  const current = capability ? CAPABILITIES.find((c) => c.key === capability) : void 0;
+  const rows = CAPABILITY_GROUPS.map((g) => {
+    const caps = CAPABILITIES.filter((c) => c.group === g.key);
+    const first = caps[0];
+    const open = current?.group === g.key;
+    const head3 = open ? `<span class="active grp" aria-current="true">${g.label}</span>` : `<a class="grp" href="/for/${first?.key ?? ""}" title="${g.blurb}">${g.label}</a>`;
+    const subs = open ? caps.map((c) => c.key === capability ? `<span class="active sub" aria-current="page">${c.label}</span>` : `<a class="sub" href="/for/${c.key}" title="${c.what.replace(/"/g, "&quot;")}">${c.label}</a>`).join("\n        ") : "";
+    return head3 + (subs ? "\n        " + subs : "");
+  }).join("\n        ");
+  return `<div class="side-group"><div class="side-label">For this client <span id="side-client" class="side-client"></span></div>
+        ${rows}
+      </div>`;
+}
+function cockpitSidebarHtml(active, capability) {
+  const groups = SIDEBAR.map(([label, rows]) => {
+    const links = rows.map((r) => {
+      const tag = r.note ? `<span class="tag soon">${r.note}</span>` : r.hub ? `<span class="tag">hub &nearr;</span>` : "";
+      return r.screen === active ? `<span class="active" aria-current="page">${r.label}</span>` : `<a href="${r.href}"${r.title ? ` title="${r.title}"` : ""}${r.hub ? ' target="_blank" rel="noopener"' : ""}>${r.label}${tag}</a>`;
+    }).join("\n        ");
+    return `<div class="side-group"><div class="side-label">${label}</div>
+        ${links}
+      </div>`;
+  }).join("\n      ");
+  return `<aside class="side" aria-label="Command OS">
+      ${groups}
+      ${forThisClientHtml(capability)}
+      <div class="side-foot"><a href="${HUB_URL}#do">&larr; Back to hub</a><span>Runs on this computer. What you type stays here. What Claude reads for you goes to your own Claude account; a link or a call recording is fetched from its own site or recorder first. No copy comes to us.</span></div>
+    </aside>`;
+}
+function cockpitHeaderHtml(active, opts = {}) {
   const links = NAV.filter((n) => n.key !== active).map((n) => `<a class="backhub" href="${n.href}" title="${n.title}">${n.label}</a>`).join("");
   const here = NAV.find((n) => n.key === active);
   return `<header class="topbar">
   <a class="brand" href="${HUB_URL}#do" title="Back to the member hub"><span class="brand-mark">G</span><span><span class="brand-name">GHL Command</span><span class="brand-sub">&nbsp; Command OS</span></span></a>
   <a class="backhub" href="${HUB_URL}#do">&larr; Back to hub</a>
   <div class="topbar-right">
-    ${here ? `<span class="backhub" aria-current="page">${here.label}</span>` : ""}${links}
+    <span class="screens">${here ? `<span class="backhub" aria-current="page">${here.label}</span>` : ""}${links}</span>
     <span class="localpill">Runs on this computer</span>
     <div class="stepper" role="group" aria-label="Type size"><button id="sz-down" type="button" aria-label="Smaller type">A&minus;</button><output id="sz-val" aria-live="polite">${TYPE_DEFAULT}px</output><button id="sz-up" type="button" aria-label="Larger type">A+</button></div>
   </div>
-</header>`;
+</header>
+<div class="shell">
+${cockpitSidebarHtml(active, opts.capability)}
+<div class="content">`;
+}
+function cockpitShellClose() {
+  return `</div></div>`;
 }
 function cockpitHeadHtml(title2, opts = {}) {
   const fonts = opts.webfont === false ? "" : COCKPIT_FONT_LINKS;
@@ -41042,10 +41617,12 @@ function cockpitHeadHtml(title2, opts = {}) {
 ${fonts}
 <style>${cockpitTokensCss(opts)}${cockpitChromeCss()}${opts.extraCss ?? ""}</style></head>`;
 }
-var HUB_URL, COCKPIT_FONT_LINKS, TYPE_MIN, TYPE_MAX, TYPE_DEFAULT, TYPE_STORAGE_KEY, NAV, COCKPIT_TYPE_JS;
+var HUB_URL, COCKPIT_FONT_LINKS, TYPE_MIN, TYPE_MAX, TYPE_DEFAULT, TYPE_STORAGE_KEY, NAV, SIDEBAR, COCKPIT_TYPE_JS;
 var init_cockpit_shell = __esm({
   "src/command-os/cockpit-shell.ts"() {
     "use strict";
+    init_client_capabilities();
+    init_script_json();
     HUB_URL = "https://os.ghlcommand.com/";
     COCKPIT_FONT_LINKS = `<link rel="preconnect" href="https://fonts.googleapis.com"><link rel="preconnect" href="https://fonts.gstatic.com" crossorigin><link href="https://fonts.googleapis.com/css2?family=DM+Sans:opsz,wght@9..40,400;9..40,500;9..40,600;9..40,700&family=Playfair+Display:ital,wght@0,400;0,500;0,600;1,400&display=swap" rel="stylesheet">`;
     TYPE_MIN = 20;
@@ -41053,13 +41630,28 @@ var init_cockpit_shell = __esm({
     TYPE_DEFAULT = 22;
     TYPE_STORAGE_KEY = "cmdos-cockpit-fs";
     NAV = [
-      { key: "board", href: "/", label: "Board", title: "Every client account and where its build stands" },
-      { key: "agency", href: "/agency", label: "Your agency", title: "Your agency's own details, used on every client" },
-      { key: "brands", href: "/brands", label: "Brands", title: "Brands: pull a client's brand from their site, or start from a reference look" },
-      { key: "assessment", href: "/assessment", label: "Assessment", title: "Run the paid assessment on a prospect. Everything stays on this computer." }
+      { key: "board", href: "/", label: "Board", title: "What is waiting on you, and every client account" },
+      { key: "agency", href: "/agency", label: "Your agency", title: "Your agency's own details, set up once and used on every client" },
+      { key: "assessment", href: "/assessment", label: "Assessment", title: "Run the paid assessment on a prospect. The answers stay on this computer until you save them to your own GoHighLevel account." },
+      { key: "brands", href: "/brands", label: "Brands", title: "The shelf every deck, page and report starts from" }
+    ];
+    SIDEBAR = [
+      ["Start", [
+        { label: "Board", href: "/", screen: "board", title: NAV[0].title },
+        { label: "Your agency", href: "/agency", screen: "agency", title: NAV[1].title }
+      ]],
+      ["Clients", [
+        { label: "Assessment", href: "/assessment", screen: "assessment", title: NAV[2].title },
+        { label: "Build a Client Account", href: "/new", screen: "new", title: "Register the account, answer the intake, then run the seven stages" },
+        { label: "Work Queue", href: "/queue", screen: "queue", title: "The steps waiting on you, across every client" },
+        { label: "Client Builds", href: "/clients", screen: "clients", title: "Every client account and where its build stands" }
+      ]],
+      ["Design Studio", [
+        { label: "Brands", href: "/brands", screen: "brands", title: NAV[3].title }
+      ]]
     ];
     COCKPIT_TYPE_JS = `/* Type size stepper \u2014 same behaviour as the hub (${TYPE_MIN}\u2013${TYPE_MAX}px, remembered). */
-(function(){var MIN=${TYPE_MIN},MAX=${TYPE_MAX},STEP=2,DEF=${TYPE_DEFAULT},KEY=${JSON.stringify(TYPE_STORAGE_KEY)};
+(function(){var MIN=${TYPE_MIN},MAX=${TYPE_MAX},STEP=2,DEF=${TYPE_DEFAULT},KEY=${scriptJson(TYPE_STORAGE_KEY)};
  var down=document.getElementById("sz-down"),up=document.getElementById("sz-up"),val=document.getElementById("sz-val");
  if(!down||!up||!val)return;
  var size=DEF;try{var s=parseInt(localStorage.getItem(KEY),10);if(s>=MIN&&s<=MAX)size=s}catch(e){}
@@ -41073,6 +41665,8 @@ var init_cockpit_shell = __esm({
 // src/agency-profile-page.ts
 function agencyProfilePageHtml(p, clients = [], seatToken = "") {
   const offers = (p.offers ?? []).map((o) => `${o.name}${o.priceFloor ? ` \u2014 ${o.priceFloor}${o.cadence === "monthly" ? "/mo" : ""}` : ""}`).join("\n");
+  const os7 = p.agencyOs ?? {};
+  const lines = (xs) => (xs ?? []).join("\n");
   const sops = (p.delivery?.sops ?? []).join("\n");
   const staff = (p.staff ?? []).map((m) => [m.name, m.role, m.email].filter(Boolean).join(" \xB7 ")).join("\n");
   const clientBlocks = clients.map((c) => {
@@ -41139,21 +41733,21 @@ ${cockpitHeaderHtml("agency")}
  <form id="f">
   <fieldset><legend>Brand</legend>
    <label for="agencyName">Agency name, as clients see it</label>
-   <input id="agencyName" name="agencyName" value="${esc3(p.agencyName)}" placeholder="Elite DCs">
+   <input id="agencyName" name="agencyName" value="${esc3(p.agencyName)}" placeholder="Your Agency">
    <div class="row">
     <div><label for="accent">Brand colour</label><input type="color" id="accent" name="accent" value="${esc3(p.accent || "#b8934a")}"></div>
-    <div><label for="website">Website</label><input id="website" name="website" value="${esc3(p.website)}" placeholder="https://elitedcs.com"></div>
+    <div><label for="website">Website</label><input id="website" name="website" value="${esc3(p.website)}" placeholder="https://youragency.com"></div>
    </div>
    <label for="logoUrl">Logo URL</label>
-   <input id="logoUrl" name="logoUrl" value="${esc3(p.logoUrl)}" placeholder="https://elitedcs.com/logo.svg">
+   <input id="logoUrl" name="logoUrl" value="${esc3(p.logoUrl)}" placeholder="https://youragency.com/logo.svg">
    <p class="hint">Must start with https. A logo link that isn't https is refused, because this one goes on pages your prospects open.</p>
    <label for="legalName">Registered entity, if different</label>
-   <input id="legalName" name="legalName" value="${esc3(p.legalName)}" placeholder="Elite DCS LLC \u2014 used on contracts and A2P">
+   <input id="legalName" name="legalName" value="${esc3(p.legalName)}" placeholder="Your Agency LLC \u2014 used on contracts and A2P">
   </fieldset>
 
   <fieldset><legend>Who messages come from</legend>
    <div class="row">
-    <div><label for="fromName">From name</label><input id="fromName" name="fromName" value="${esc3(p.sender?.fromName)}" placeholder="Dr Jerry Relth"></div>
+    <div><label for="fromName">From name</label><input id="fromName" name="fromName" value="${esc3(p.sender?.fromName)}" placeholder="Dr Pat Owner"></div>
     <div><label for="replyTo">Reply-to email</label><input id="replyTo" name="replyTo" value="${esc3(p.sender?.replyTo)}"></div>
     <div><label for="phone">Phone</label><input id="phone" name="phone" value="${esc3(p.sender?.phone)}"></div>
    </div>
@@ -41171,11 +41765,61 @@ ${cockpitHeaderHtml("agency")}
    <p class="hint">The floors are the numbers below which you don't take the work. Anything quoting a price checks them first.</p>
   </fieldset>
 
+  <fieldset><legend>Brand DNA \u2014 who you are (Agency OS build 1)</legend>
+   <p class="hint">Filled in once, in your own words. Used on the assessment report, in proposals, in every Claude session's opening brief, and by the Agency OS builds.</p>
+   <label for="story">Your story \u2014 why this agency exists, in two or three sentences</label>
+   <textarea id="story" name="story" placeholder="I ran a clinic for twelve years and watched good practices lose patients to voicemail\u2026">${esc3(os7.story)}</textarea>
+   <label for="method">Your method \u2014 how you get results, and what you call it</label>
+   <textarea id="method" name="method" placeholder="The Full Room method: one weekend, a full calendar, a system that keeps booking after we leave">${esc3(os7.method)}</textarea>
+   <div class="two">
+    <div><label for="voice">How you sound \u2014 three words, then a sentence</label><textarea id="voice" name="voice" placeholder="Direct, warm, clinical. Specifics over hype.">${esc3(os7.voice)}</textarea></div>
+    <div><label for="goals">Your goal for the next twelve months</label><textarea id="goals" name="goals" placeholder="$50k a month from 51 subscribers">${esc3(os7.goals)}</textarea></div>
+   </div>
+   <label for="values">What you stand for and what you refuse to do \u2014 one per line</label>
+   <textarea id="values" name="values" placeholder="Never a false all-clear&#10;No cold texting anyone who did not opt in">${esc3(lines(os7.values))}</textarea>
+   <label for="proof">Proof you may state, with permission \u2014 one per line</label>
+   <textarea id="proof" name="proof" placeholder="Radiance Med Spa: 34 consults booked in one weekend (permission on file)">${esc3(lines(os7.proof))}</textarea>
+  </fieldset>
+
+  <fieldset><legend>Ideal client \u2014 who you serve (build 2)</legend>
+   <label for="icaWho">Who they are \u2014 role, business, size, where</label>
+   <textarea id="icaWho" name="icaWho" placeholder="The owner of a two-provider med spa in a mid-size US city, doing $40k a month and answering the phone herself">${esc3(os7.ica?.who)}</textarea>
+   <div class="two">
+    <div><label for="icaPains">Their pains, worst first \u2014 one per line</label><textarea id="icaPains" name="icaPains">${esc3(lines(os7.ica?.pains))}</textarea></div>
+    <div><label for="icaDesires">What they want, most first \u2014 one per line</label><textarea id="icaDesires" name="icaDesires">${esc3(lines(os7.ica?.desires))}</textarea></div>
+   </div>
+   <div class="two">
+    <div><label for="icaObjections">Why they say no \u2014 one per line</label><textarea id="icaObjections" name="icaObjections">${esc3(lines(os7.ica?.objections))}</textarea></div>
+    <div><label for="icaTriggers">What makes them buy now \u2014 one per line</label><textarea id="icaTriggers" name="icaTriggers">${esc3(lines(os7.ica?.triggers))}</textarea></div>
+   </div>
+   <div class="two">
+    <div><label for="icaVocabulary">Their own words for the problem \u2014 one per line</label><textarea id="icaVocabulary" name="icaVocabulary">${esc3(lines(os7.ica?.vocabulary))}</textarea></div>
+    <div><label for="icaHangouts">Where they read, listen and gather \u2014 one per line</label><textarea id="icaHangouts" name="icaHangouts">${esc3(lines(os7.ica?.hangouts))}</textarea></div>
+   </div>
+   <label for="icaVillains">What they have tried and blame \u2014 one per line</label>
+   <textarea id="icaVillains" name="icaVillains" placeholder="The last agency that charged $3,000 a month for two posts a week">${esc3(lines(os7.ica?.villains))}</textarea>
+  </fieldset>
+
+  <fieldset><legend>The offer \u2014 what you promise (build 3)</legend>
+   <div class="two">
+    <div><label for="offerName">The offer's name</label><input id="offerName" name="offerName" value="${esc3(os7.offer?.name)}" placeholder="The Full Room"></div>
+    <div><label for="offerPrice">Price, and what it is per</label><input id="offerPrice" name="offerPrice" value="${esc3(os7.offer?.price)}" placeholder="$5,000 per event plus 30% of revenue"></div>
+   </div>
+   <label for="offerPromise">The promise \u2014 one sentence a prospect could repeat</label>
+   <textarea id="offerPromise" name="offerPromise" placeholder="A full room in one weekend, and a system that keeps booking after we leave">${esc3(os7.offer?.promise)}</textarea>
+   <label for="offerStack">What is in it \u2014 one per line</label>
+   <textarea id="offerStack" name="offerStack" placeholder="The campaign page&#10;The AI receptionist&#10;The 30-day nurture">${esc3(lines(os7.offer?.valueStack))}</textarea>
+   <div class="two">
+    <div><label for="offerGuarantee">The guarantee, exactly as you would say it</label><textarea id="offerGuarantee" name="offerGuarantee">${esc3(os7.offer?.guarantee)}</textarea></div>
+    <div><label for="offerAccelerators">Why now \u2014 bonuses, deadlines, scarcity, one per line</label><textarea id="offerAccelerators" name="offerAccelerators">${esc3(lines(os7.offer?.accelerators))}</textarea></div>
+   </div>
+  </fieldset>
+
   <fieldset><legend>How you deliver</legend>
    <label for="sops">Delivery SOPs \u2014 one per line</label>
    <textarea id="sops" name="sops" placeholder="Every build gets a rollback journal before go-live">${esc3(sops)}</textarea>
    <label for="staff">Staff \u2014 one per line, "name \xB7 role \xB7 email"</label>
-   <textarea id="staff" name="staff" placeholder="Dr Jerry Relth \xB7 owner \xB7 jerry@elitedcs.com">${esc3(staff)}</textarea>
+   <textarea id="staff" name="staff" placeholder="Dr Pat Owner \xB7 owner \xB7 pat@youragency.com">${esc3(staff)}</textarea>
    <p class="hint">Who may approve what is recorded here for reference. The approval gates themselves are still enforced by the ritual, not by this list.</p>
   </fieldset>
 
@@ -41198,12 +41842,12 @@ ${cockpitHeaderHtml("agency")}
  </fieldset>
 
 ${clientsSection}
-</main>
+</main>${cockpitShellClose()}
 <script>
 ${READ_NUMBER_JS}
 /* Served key first: this page is reachable on its own, so it cannot depend on
    the board having been opened first in this browser. */
-const SERVED=${JSON.stringify(seatToken)};
+const SERVED=${scriptJson(seatToken)};
 const KEY=SERVED||new URLSearchParams(location.search).get("seat")||localStorage.getItem("cockpit_seat")||"";
 try{if(SERVED)localStorage.setItem("cockpit_seat",SERVED)}catch(e){}
 /* The Anthropic key: saved on its own, and CHECKED before it is kept. A key that
@@ -41254,7 +41898,14 @@ document.getElementById("f").addEventListener("submit",async e=>{
   offers:offers.length?offers:null,
   pricing:{minMonthly:num("minMonthly"),minSetup:num("minSetup"),currency:v("currency")||null},
   delivery:{sops:lines("sops").length?lines("sops"):null},
-  staff:staff.length?staff:null};
+  staff:staff.length?staff:null,
+  agencyOs:{story:v("story")||null,method:v("method")||null,voice:v("voice")||null,goals:v("goals")||null,
+   values:lines("values").length?lines("values"):null,proof:lines("proof").length?lines("proof"):null,
+   ica:{who:v("icaWho")||null,pains:lines("icaPains").length?lines("icaPains"):null,desires:lines("icaDesires").length?lines("icaDesires"):null,
+    objections:lines("icaObjections").length?lines("icaObjections"):null,triggers:lines("icaTriggers").length?lines("icaTriggers"):null,
+    vocabulary:lines("icaVocabulary").length?lines("icaVocabulary"):null,hangouts:lines("icaHangouts").length?lines("icaHangouts"):null,villains:lines("icaVillains").length?lines("icaVillains"):null},
+   offer:{name:v("offerName")||null,promise:v("offerPromise")||null,price:v("offerPrice")||null,guarantee:v("offerGuarantee")||null,
+    valueStack:lines("offerStack").length?lines("offerStack"):null,accelerators:lines("offerAccelerators").length?lines("offerAccelerators"):null}}};
  const m=document.getElementById("msg");
  const badNum=["minMonthly","minSetup"].find(id=>body.pricing[id]===undefined);
  if(badNum){m.textContent="That is not a number I can read, so nothing was saved. Check the "+(badNum==="minMonthly"?"minimum monthly":"minimum setup fee")+".";return}
@@ -41302,6 +41953,7 @@ var init_agency_profile_page = __esm({
     "use strict";
     init_cockpit_shell();
     init_client_engagements();
+    init_script_json();
     READ_NUMBER_JS = `function readNumber(raw){
  var s=String(raw==null?"":raw).trim();
  if(!s)return{clear:true};
@@ -41315,6 +41967,1067 @@ var init_agency_profile_page = __esm({
   }
 });
 
+// src/command-os/assessment/app-html.ts
+var ASSESSMENT_HTML;
+var init_app_html = __esm({
+  "src/command-os/assessment/app-html.ts"() {
+    "use strict";
+    ASSESSMENT_HTML = `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<!-- The page had neither of the two lines above until 2026-08-30, and it holds
+     ~1,600 non-ASCII bytes. Chrome read it as windows-1252 in QUIRKS MODE, so
+     every em-dash in the interview rendered as mojibake \u2014 including the two in
+     the header beside the hours and money figures, which is the state an
+     operator sees the moment they open it. The exported report always had both
+     lines; only the shell that writes it was missing them. Caught by a browser
+     pass, because nothing in the suite had ever loaded the page in a browser. -->
+<title>Assessment \u2014 Command OS</title>
+<!--COCKPIT_SHELL_CSS-->
+<style>
+:root{
+/* No webfont, and no palette of its own. This page is opened in a clinic with
+   no wifi and handed to a client's accountant, so it may not fetch a stylesheet
+   from Google \u2014 the cockpit injects the shared shell's tokens above this block
+   with webfont:false, and these names are aliases onto them. Before the hub
+   audit of 2026-09-04 this screen had its own dark-slate palette and read as a
+   different product from the board. --ink, --warn and --shadow are NOT redefined
+   here: they come from the shell under the same names. */
+--mono:ui-monospace,SFMono-Regular,Menlo,Consolas,"Liberation Mono",monospace;
+--serif:var(--font-display);--sans:var(--font-body);
+--ground:var(--bg);--panel:var(--bg-2);--panel-2:var(--surface-2);--paper:var(--surface);
+--muted:var(--ink-2);--rule:var(--line);--accent:var(--gold);--soft:var(--gold-soft);
+--stop:var(--rose);--go:var(--ok)}
+*{box-sizing:border-box}
+body{margin:0;background:var(--ground);color:var(--ink);font-family:var(--sans);
+font-size:1rem;line-height:1.5}
+/* Sticks BELOW the cockpit header (3rem tall, z-index 40), never over it:
+   at z-index 50 and top:0 it covered the only way back to the board on scroll. */
+.top{background:var(--paper);border-bottom:1px solid var(--rule);padding:.6rem .9rem;position:sticky;top:3rem;z-index:30}
+.topin{max-width:60rem;margin:0 auto;display:flex;gap:1rem;align-items:baseline;flex-wrap:wrap}
+.topin h1{font-family:var(--serif);font-size:1.05rem;margin:0;font-weight:600}
+.who{color:var(--muted);font-size:var(--fs-sm)}
+.live{margin-left:auto;display:flex;gap:1rem;font-family:var(--mono);font-size:var(--fs-label)}
+.live b{display:block;font-size:.92rem;font-weight:500}
+.live .m{color:var(--stop)}.live .h{color:var(--accent)}.live .p{color:var(--muted)}
+.tabs{max-width:60rem;margin:0 auto;display:flex;gap:.3rem;padding:.5rem .9rem 0}
+.tabs button{background:none;border:none;border-bottom:2px solid transparent;padding:.3rem .5rem;
+cursor:pointer;font:inherit;font-size:var(--fs-sm);color:var(--muted)}
+.tabs button.on{color:var(--accent);border-bottom-color:var(--accent);font-weight:600}
+.main{max-width:60rem;margin:0 auto;padding:.9rem;display:grid;grid-template-columns:13rem 1fr;gap:1rem}
+@media(max-width:760px){.main{grid-template-columns:1fr}}
+.rail{align-self:start;position:sticky;top:4.2rem}
+@media(max-width:760px){.rail{position:static;display:flex;overflow-x:auto;gap:.3rem}}
+.rail button{display:block;width:100%;text-align:left;background:none;border:none;cursor:pointer;font:inherit;
+font-size:var(--fs-sm);color:var(--muted);padding:.32rem .45rem;border-radius:.22rem;line-height:1.3}
+@media(max-width:760px){.rail button{white-space:nowrap;width:auto}}
+.rail button.on{background:var(--accent);color:var(--paper);font-weight:600}
+.rail button:hover:not(.on){background:var(--soft);color:var(--accent)}
+.rail .c{font-family:var(--mono);font-size:var(--fs-label);opacity:.75;float:right}
+.intro{color:var(--muted);font-size:var(--fs-sm);font-style:italic;margin:0 0 .8rem;max-width:60ch}
+h2{font-family:var(--serif);font-size:1.16rem;margin:0 0 .15rem;font-weight:600}
+.q{background:var(--paper);border:1px solid var(--rule);border-left:3px solid var(--rule);
+border-radius:.3rem;padding:.6rem .75rem;margin:.5rem 0}
+.q.done{border-left-color:var(--go)}.q.skip{border-left-color:var(--muted);opacity:.72}
+.q .ask{font-size:.9rem;font-weight:600;margin:0 0 .2rem}
+.q .probe{font-size:var(--fs-sm);color:var(--muted);font-style:italic;margin:0 0 .35rem}
+.q .why{font-size:var(--fs-sm);color:var(--muted);margin:.3rem 0 0;display:none}
+.q.open .why{display:block}
+.row{display:flex;gap:.4rem;align-items:center;flex-wrap:wrap}
+input.a,select.a,textarea.a{background:var(--ground);border:1px solid var(--rule);border-radius:.22rem;
+padding:.3rem .45rem;font:inherit;font-size:var(--fs-sm);color:var(--ink);max-width:11rem}
+textarea.a{max-width:100%;width:100%;min-height:2.6rem}
+input.a:focus,select.a:focus,textarea.a:focus{outline:2px solid var(--accent);outline-offset:1px}
+.unit{font-family:var(--mono);font-size:var(--fs-label);color:var(--muted)}
+.mini{background:none;border:1px solid var(--rule);border-radius:.2rem;padding:.2rem .45rem;cursor:pointer;
+font:inherit;font-size:var(--fs-sm);color:var(--muted)}
+.mini:hover{border-color:var(--accent);color:var(--accent)}
+.mini.on{background:var(--panel-2);color:var(--ink)}
+.card{background:var(--paper);border:1px solid var(--rule);border-radius:.35rem;padding:.8rem .9rem;
+margin:.6rem 0;box-shadow:var(--shadow)}
+table{border-collapse:collapse;width:100%;font-size:var(--fs-sm)}
+th,td{text-align:left;padding:.35rem .5rem;border-bottom:1px solid var(--rule);vertical-align:top}
+th{font-size:var(--fs-label);text-transform:uppercase;letter-spacing:.06em;color:var(--muted);font-weight:600}
+.num{font-family:var(--mono);font-variant-numeric:tabular-nums;text-align:right;white-space:nowrap}
+th.num{text-align:right}
+.note{background:var(--panel);border-left:3px solid var(--accent);border-radius:.22rem;padding:.5rem .65rem;
+margin:.5rem 0;font-size:var(--fs-sm)}
+.note.warn{border-left-color:var(--warn)}.note.go{border-left-color:var(--go)}.note.stop{border-left-color:var(--stop)}
+.note b{display:block;margin-bottom:.1rem}
+.btn{background:var(--accent);color:var(--paper);border:none;border-radius:.22rem;padding:.4rem .8rem;
+font:inherit;font-size:var(--fs-sm);font-weight:600;cursor:pointer}
+.btn.ghost{background:none;color:var(--accent);border:1px solid var(--rule)}
+.btnrow{display:flex;gap:.5rem;flex-wrap:wrap;margin-top:.9rem}
+.assume{display:grid;grid-template-columns:1fr auto;gap:.5rem;align-items:center;padding:.35rem 0;
+border-bottom:1px solid var(--rule);font-size:var(--fs-sm)}
+.hide{display:none}
+</style>
+</head>
+<body>
+<!--COCKPIT_HEADER-->
+
+<div class="top"><div class="topin">
+  <h1 id="bizname">New assessment</h1>
+  <span class="who" id="bizmeta"></span>
+  <div class="live">
+    <div class="p"><b id="lProg">0/46</b>answered</div>
+    <div class="h"><b id="lHrs">&mdash;</b>hrs/week</div>
+    <div class="m"><b id="lMon">&mdash;</b>/month</div>
+  </div>
+</div></div>
+<div class="tabs">
+  <button data-t="ask" class="on">Ask</button>
+  <button data-t="set">Assumptions</button>
+  <button data-t="find">Findings</button>
+  <button data-t="rep">Report</button>
+</div>
+
+<div class="main">
+  <nav class="rail" id="rail"></nav>
+  <div id="body"></div>
+</div>
+
+<script>
+/**
+ * The assessment engine \u2014 the ONE place the questions and the findings maths live.
+ *
+ * Plain JavaScript with a single export block at the end, because it has two
+ * consumers with incompatible needs: the test suite imports it, and build-app.mjs
+ * inlines it into app.html (which must stay a single self-contained file, since
+ * Command OS serves it from the operator's own machine with no build step and no
+ * network). The build strips the export block; nothing else about the file changes.
+ *
+ * It existed as two copies for one day \u2014 once here and once inside app.html \u2014 and
+ * two copies of a rule that decides what a client is told is a defect waiting to
+ * happen, so it is one copy now.
+ */
+
+var AREAS = [
+  ["money", "What the work is worth", "Before anything else I need two numbers, because everything today gets multiplied by them."],
+  ["phone", "The phone", "Let's start where most of it goes."],
+  ["speed", "How fast anyone replies", "Now the enquiries that don't come by phone."],
+  ["repeat", "The same questions, again", "This one is about your time rather than your money."],
+  ["quotes", "After the quote goes out", "Walk me through what happens after you send a price."],
+  ["booking", "Getting them in the diary", "How does an appointment actually get made?"],
+  ["dormant", "Everyone who went quiet", "Now the cheapest money in the building, and the part nobody works."],
+  ["reviews", "What people see about you", "Your reviews, and how they happen."],
+  ["website", "What your website does", "What the site is actually for."],
+  ["found", "Whether you get found", "And how people arrive in the first place."],
+  ["week", "Your own week", "Last part, and it's about you rather than the business."]
+];
+
+var Q = [
+  ["avg_value","money","When you win a job, what's it worth on average?","Give me the middle of it. Not your best month, not the tiny ones.","currency","Every finding today gets multiplied by this. Without it I can't put a number on anything."],
+  ["close_rate","money","When you actually get someone talking properly, how often does that turn into work?","Out of ten real conversations, how many buy?","rate","Turns a lost enquiry into a lost job rather than a lost phone call."],
+  ["margin_basis","money","Do you want me to work in what the job brings in, or what you keep?","","text","The report says which one it used, every time."],
+  ["capacity","money","If I found you thirty percent more work tomorrow, could you do it?","What breaks first, crews or trucks or you?","text","If they can't deliver more, the whole report points at margin and time instead of volume."],
+
+  ["calls_month","phone","Roughly how many calls come in on a normal month?","Think about a busy Tuesday and work out from there.","count","The base for everything else on the phone."],
+  ["calls_missed","phone","How many of those go to voicemail or just ring out?","What happens when you're up a ladder and it rings?","count","The most common leak, and the one owners underestimate most."],
+  ["missed_never_return","phone","Of the ones you miss, how many never call back?","Half? More?","rate","This is what stops us overclaiming. We only count the ones you genuinely lose."],
+  ["who_answers","phone","Who answers the phone when it rings?","And what were they doing before it rang?","text","If it's you, this is a time finding as well as a money one."],
+  ["after_hours_calls","phone","What share of your calls come in outside working hours?","Evenings and weekends. Storm season?","rate","Separates a staffing problem from an automation one."],
+  ["voicemail_fate","phone","When someone does leave a voicemail, what happens to it?","","text","'I get to them at night' is the after-hours finding in their own words."],
+
+  ["nonphone_month","speed","How many enquiries a month come in some other way? Form, text, Facebook.","","count","Counted separately from calls so nobody gets counted twice."],
+  ["first_response","speed","From one of those landing to a real person replying, how long is that usually?","Same hour? Same day? Next morning?","minutes","The gap between arriving and being answered is where enquiries go cold."],
+  ["waited_month","speed","How many a month sit overnight before anyone replies?","","count","The slow-response finding is priced on this count, not on your average."],
+  ["reply_channel","speed","When you do reply, do you call them or write back?","","text","Shapes what we'd build, not what we'd charge."],
+
+  ["repeat_questions","repeat","What are the three questions you answer over and over every week?","The ones where you know the answer before they finish asking.","text","Every one of these is a job a machine does perfectly and you do resentfully."],
+  ["repeat_time","repeat","How much of your week goes on answering those?","","hours","Straight into the hours number."],
+  ["who_fields","repeat","Who fields them, you or someone else?","","text","If it's a person on payroll, this finding has a salary attached."],
+
+  ["quotes_month","quotes","How many quotes or estimates go out in a month?","","count","These are your warmest people. They already talked to you."],
+  ["quotes_won","quotes","How many of those turn into work?","","count","The gap between sent and won is the follow-up finding."],
+  ["quote_followup","quotes","What happens to a quote after you send it?","Be honest. Does anything chase it, or is it on them to call you?","text","'Nothing' is the most common answer in this whole assessment."],
+  ["quote_time","quotes","How many hours a week go on putting quotes together?","","hours","Quoting is often the biggest single block of hours we find."],
+  ["quote_delay","quotes","How long between the site visit and them getting the price?","","text","A quote that arrives four days later competes with three that arrived first."],
+
+  ["booked_month","booking","How many appointments or site visits get booked in a month?","","count","The base for the no-show finding."],
+  ["show_rate","booking","Of those, how many actually happen?","Nobody home, cancelled last minute, forgot.","rate","A no-show is a job you paid to get twice."],
+  ["reminders","booking","Does anything remind them before the appointment?","","text","If the answer is 'I text them myself', that's both a time and a money finding."],
+  ["noshow_fate","booking","When someone no-shows, what happens next?","","text","'Nothing' means the rebooking finding is real."],
+
+  ["dormant_count","dormant","How many people are sitting in your system who enquired once and never went anywhere?","Old quotes, old customers, people who called in 2023.","count","These people already raised their hand once. The cheapest money you have."],
+  ["dormant_worked","dormant","Has anyone ever gone back to that list?","","text","If nothing has ever been sent, the whole list is untouched revenue."],
+  ["past_customers","dormant","How many are past customers rather than people who never bought?","","count","Past customers convert far better, and they need a different message."],
+  ["repeat_cycle","dormant","How often would a past customer normally need you again?","","text","Decides whether reactivation is a one-off campaign or a standing programme."],
+
+  ["review_count","reviews","How many Google reviews do you have?","","count","The number a new customer sees before they call you."],
+  ["review_ask","reviews","How do you ask for a review at the moment?","Who remembers to do it, and when?","text","'When I remember' is why the newest one is months old."],
+  ["review_reply","reviews","Do you reply to them?","","text","An unanswered bad review is the first thing a new customer reads."],
+  ["review_time","reviews","How many hours a week go on chasing reviews?","","hours","Small on its own. Adds up with the rest."],
+
+  ["site_job","website","What do you want someone to do when they land on your site?","Call, book, fill something in?","text","Most sites do not do the thing the owner assumes they do."],
+  ["site_capture","website","Can someone book you from the website without speaking to anyone?","","text","If not, every after-hours visitor is gone."],
+  ["site_leads","website","How many enquiries a month come from the site itself?","","count","Against traffic this gives the conversion finding, scoped to your trade."],
+  ["site_age","website","When was the site last touched?","","text","Decides rebuild versus repair."],
+
+  ["lead_sources","found","Where does your work actually come from? Rank them.","Word of mouth, Google, Facebook, repeat, trucks?","text","Tells us which leak matters most before we price any of them."],
+  ["paid_spend","found","Are you spending anything on advertising each month?","","currency","If they are, every leak we find is also wasted ad spend."],
+  ["gbp_status","found","Do you manage your Google listing yourself?","","text","The cheapest visibility fix there is, and usually neglected."],
+
+  ["admin_hours","week","How many hours a week go on paperwork and admin rather than actual work?","Including the bits you do at night.","hours","The number the whole hours promise is measured against."],
+  ["evening_work","week","How much of that happens after dinner?","","hours","The answer that makes owners sit up. Part of the number above, not extra."],
+  ["stop_doing","week","If you could stop doing one thing tomorrow and never do it again, what is it?","","text","Their priority in their words. It leads the roadmap even if it isn't the biggest number."],
+  ["team_size","week","Who else is in the business?","","count","Decides whether a fix is automation or delegation."],
+  ["growth_goal","week","What would a good twelve months look like?","A number, if you have one.","text","The report closes against their goal, not ours."]
+];
+
+var ASSUMPTIONS = [
+  ["recovery","How much of the leak we actually stop",0.5,"Assumes we recover half of what is leaking. Your number, and the most important one here."],
+  ["quote_recovery","Chasing an unclosed quote recovers",0.10,"Assumes chasing recovers 1 in 10. Your number, not ours."],
+  ["response_penalty","Fall-off once an enquiry has waited",0.25,"Assumes a 25% fall-off once they have waited. Your number."],
+  ["noshow_recovery","A no-show that gets rebooked",0.50,"Assumes half could be rebooked. Your number."],
+  ["reactivation","Dormant contacts who respond",0.02,"Assumes 2% come back. Your number. One-off, not annual."]
+];
+
+/**
+ * Hours questions that feed the weekly total. evening_work is deliberately NOT
+ * here: it asks how much of admin_hours happens after dinner, so adding it would
+ * count the same hours twice. It is a headline, not an addend.
+ */
+var HOUR_KEYS = [
+  ["repeat_time", "Answering the same questions"],
+  ["quote_time", "Putting quotes together"],
+  ["review_time", "Chasing reviews"],
+  ["admin_hours", "Paperwork and admin"]
+];
+
+/** The two answers without which nothing at all can be priced. */
+var PRICING_CORE = ["avg_value", "close_rate"];
+
+/**
+ * What a missing input is called in the PROSPECT'S document.
+ *
+ * The report printed the raw question id \u2014 "close_rate" \u2014 into a page going out
+ * on the operator's letterhead. These are the same measurements written as
+ * instructions, because "what to measure first" is a list of things to go and
+ * count, not a list of fields.
+ *
+ * Every id that can reach O[].missing must have an entry. engine.test.ts asserts
+ * that coverage, so a new priced finding cannot ship a raw id into a client
+ * document by forgetting this table.
+ */
+var MEASURE = {
+  avg_value: "What one won job is worth to you, on average",
+  close_rate: "Out of ten real conversations, how many buy",
+  calls_missed: "Calls a month that go to voicemail or ring out",
+  missed_never_return: "How many of those callers never try again",
+  waited_month: "Enquiries a month that sit overnight before anyone replies",
+  quotes_month: "Quotes sent in a month",
+  quotes_won: "How many of those quotes turned into work",
+  booked_month: "Appointments booked in a month",
+  show_rate: "How many booked appointments actually happen"
+};
+
+/**
+ * Which of the two load-bearing numbers are not usable yet.
+ *
+ * Module-level and exported because the INTERVIEW needs this, not only the
+ * report. Every finding multiplies by both, so one blank here voids the whole
+ * document \u2014 and the app used to let an operator answer all 46 questions before
+ * anything said so. compute() derives \`core\` from this same function rather than
+ * repeating the rule, because two copies of a rule that decides what a client is
+ * told is a defect waiting to happen.
+ */
+function coreMissing(ans, skip) {
+  ans = ans || {}; skip = skip || {};
+  var out = [];
+  PRICING_CORE.forEach(function (id) {
+    if (skip[id]) { out.push(id); return; }
+    var v = ans[id];
+    if (v === undefined || v === null || String(v).trim() === "") { out.push(id); return; }
+    var n = parseTyped(v, UNIT[id]);
+    if (!isFinite(n) || n <= 0) { out.push(id); return; }
+    // A share is only a share inside 0..1 once scaled; 400% is not a close rate.
+    if (UNIT[id] === "rate") { var r = n > 1 ? n / 100 : n; if (!(r > 0 && r <= 1)) out.push(id); }
+  });
+  return out;
+}
+
+/** id -> the measurement in words. Never returns the id: an unlabelled id is a bug, not a fallback. */
+function measureLabel(id) {
+  return MEASURE[id] || null;
+}
+
+/** Ids -> labels, dropping any we cannot name rather than printing machine text at a stranger. */
+function measureLabels(ids) {
+  var out = [];
+  for (var i = 0; i < ids.length; i++) {
+    var l = measureLabel(ids[i]);
+    if (l && out.indexOf(l) === -1) out.push(l);
+  }
+  return out;
+}
+
+/** id -> unit, so number parsing can be unit-aware. Built from Q, never hand-listed. */
+var UNIT = {};
+Q.forEach(function (q) { UNIT[q[0]] = q[4]; });
+
+/**
+ * Parse a number the way the person typing it meant it.
+ *
+ * The trap this exists for: an owner outside the US types 6.800 meaning six
+ * thousand eight hundred. Read naively that is 6.8, and the report tells them
+ * their business leaks $24 a month instead of $24,412 \u2014 plausible, silent, and
+ * completely wrong, on their own letterhead. So a dot used as a THOUSANDS
+ * separator (digits in exact groups of three) is stripped, and only for units
+ * where that grouping is possible. A rate is never grouped, so 0.500 stays 0.5.
+ */
+function parseTyped(text, unit) {
+  var t = String(text).trim().replace(/[^0-9.,\\-]/g, "");
+  if (t === "" || t === "-") return NaN;
+  var grouped = unit !== "rate";
+  if (grouped && /^-?\\d{1,3}(\\.\\d{3})+$/.test(t)) t = t.replace(/\\./g, "");   // 6.800 -> 6800
+  if (grouped && /^-?\\d{1,3}(,\\d{3})+(\\.\\d+)?$/.test(t)) t = t.replace(/,/g, ""); // 6,800.50 -> 6800.50
+  t = t.replace(/,/g, ".");                                                        // 6,5 -> 6.5
+  var parts = t.split(".");
+  if (parts.length > 2) return NaN;   // 6.800.500 is not a number we will guess at
+  return parseFloat(t);
+}
+
+/**
+ * Read an assumption the operator typed, in the same way an answer is read.
+ *
+ * These went through a bare parseFloat until 2026-08-30, which meant an operator
+ * typing 0,5 got 0 \u2014 and an assumption of zero DROPS its finding. So the report
+ * quietly lost a finding because of a comma, and said nothing about it. Same
+ * class as the 6.800 bug, one screen over.
+ */
+function parseRate(text) {
+  var n = parseTyped(text, "rate");
+  if (!isFinite(n) || n < 0) return 0;
+  return n > 1 ? n / 100 : n;
+}
+
+/**
+ * Compute findings from raw answers.
+ *   ans  { id: value as typed }
+ *   skip { id: true } when the operator marked it unknown
+ *   asm  { id: rate as a decimal }
+ * A value is only usable when it is present, not skipped, and finite. Anything
+ * else is treated as unknown, and an unknown OMITS its finding rather than
+ * being defaulted from the industry.
+ */
+function compute(ans, skip, asm) {
+  ans = ans || {}; skip = skip || {}; asm = asm || {};
+
+  function raw(id) {
+    if (skip[id]) return null;
+    var v = ans[id];
+    if (v === undefined || v === null || String(v).trim() === "") return null;
+    var n = parseTyped(v, UNIT[id]);
+    return isFinite(n) ? n : null;
+  }
+  /** A share typed as either 28 or 0.28. Anything outside 0..1 after scaling is not a share. */
+  function share(id) {
+    var n = raw(id);
+    if (n === null) return null;
+    var r = n > 1 ? n / 100 : n;
+    return r >= 0 && r <= 1 ? r : null;
+  }
+  function a(k) { var n = Number(asm[k]); return isFinite(n) && n > 0 ? n : 0; }
+
+  var v = raw("avg_value"), c = share("close_rate");
+  var coreGaps = coreMissing(ans, skip);
+  var core = coreGaps.length === 0;
+  var F = [], O = [];
+
+  /**
+   * The ONE place an omission is recorded. Every push goes through here so a new
+   * finding cannot ship a bare id list: the labels are attached where the ids
+   * are, not at the render site that happens to remember.
+   */
+  function omit(o) {
+    o.missing = o.missing || [];
+    o.missingLabels = measureLabels(o.missing);
+    O.push(o);
+    return o;
+  }
+
+  function add(id, title, needs, assumption, fn, fix) {
+    var missing = needs.filter(function (n) {
+      return (n.share ? share(n.id) : raw(n.id)) === null;
+    }).map(function (n) { return n.id; });
+    if (!core) { omit({ id: id, title: title, missing: coreGaps }); return; }
+    if (missing.length) { omit({ id: id, title: title, missing: missing }); return; }
+    if (assumption && a(assumption) === 0) { omit({ id: id, title: title, missing: [], declined: assumption }); return; }
+    var m = fn();
+    if (!isFinite(m) || m < 0) { omit({ id: id, title: title, missing: needs.map(function (n) { return n.id; }) }); return; }
+    // Zero is not a finding. Listing "Quotes nobody chases \u2014 $0" pads a client
+    // document with things that are not happening.
+    if (m === 0) { omit({ id: id, title: title, missing: [], reason: "nothing to price here on your numbers" }); return; }
+    F.push({ id: id, title: title, monthly: m, assumption: assumption || null, fix: fix });
+  }
+
+  add("missed", "Calls you never get back to",
+    [{ id: "calls_missed" }, { id: "missed_never_return", share: true }], null,
+    function () { return raw("calls_missed") * share("missed_never_return") * c * v; },
+    "Call answering, day and night");
+
+  add("waited", "Enquiries that waited",
+    [{ id: "waited_month" }], "response_penalty",
+    function () { return raw("waited_month") * a("response_penalty") * c * v; },
+    "Instant reply on every channel");
+
+  // quotes_won > quotes_month means the two answers disagree. Clamping to zero
+  // would hide a contradiction the operator needs to go back and resolve.
+  if (core && raw("quotes_month") !== null && raw("quotes_won") !== null && raw("quotes_won") > raw("quotes_month")) {
+    omit({ id: "quotes", title: "Quotes nobody chases", missing: [],
+      reason: "you told us more quotes were won than were sent \u2014 worth checking before this is priced" });
+  } else {
+    add("quotes", "Quotes nobody chases",
+      [{ id: "quotes_month" }, { id: "quotes_won" }], "quote_recovery",
+      function () { return (raw("quotes_month") - raw("quotes_won")) * a("quote_recovery") * v; },
+      "Follow-up that runs itself");
+  }
+
+  add("noshow", "No-shows nobody rebooks",
+    [{ id: "booked_month" }, { id: "show_rate", share: true }], "noshow_recovery",
+    function () { return raw("booked_month") * (1 - share("show_rate")) * a("noshow_recovery") * c * v; },
+    "Reminders and rebooking");
+
+  var monthly = F.reduce(function (s, f) { return s + f.monthly; }, 0);
+  var stop = monthly * a("recovery");
+
+  var oneoff = null;
+  if (core && raw("dormant_count") !== null && a("reactivation") > 0) {
+    oneoff = raw("dormant_count") * a("reactivation") * c * v;
+  }
+
+  var hrs = [];
+  HOUR_KEYS.forEach(function (p) { var n = raw(p[0]); if (n !== null && n >= 0) hrs.push({ id: p[0], t: p[1], h: n }); });
+  var hrsWk = hrs.reduce(function (s, x) { return s + x.h; }, 0);
+
+  var verdict, line;
+  if (!core) {
+    verdict = "insufficient";
+    // Names the gap. "The figures are not known" made a one-number gap sound
+    // like the whole interview had failed, and gave nobody anything to go and do.
+    line = coreGaps.length === 1
+      ? "We could not put a number on anything yet. Every finding is multiplied by one figure we do not have, and that is the only thing standing in the way."
+      : "We could not put a number on anything yet, because the two figures everything else is priced against are not known.";
+  } else if (!F.length) {
+    verdict = "insufficient";
+    line = "We could not price a single leak from the numbers available.";
+  } else if (monthly < v) {
+    // Thin is measured against THEIR average job: everything found together is
+    // worth less than one new customer a month. Never a benchmark, never a fee.
+    verdict = "thin";
+    line = "Everything we found together is worth less than one new customer a month to you. That is worth saying plainly rather than dressing up.";
+  } else {
+    verdict = "findings";
+    line = "We found " + F.length + " thing" + (F.length === 1 ? "" : "s") + " worth fixing.";
+  }
+
+  return {
+    F: F, O: O, core: core,
+    monthly: monthly, annual: monthly * 12,
+    stop: stop, annualStop: stop * 12,
+    oneoff: oneoff, hrs: hrs, hrsWk: hrsWk,
+    verdict: verdict, line: line
+  };
+}
+
+/**
+ * The report \u2014 the document the agency hands their prospect.
+ *
+ * This is the only thing here a stranger ever reads, and it goes out on the
+ * agency's letterhead, not ours. Three rules are enforced by construction:
+ *
+ *  1. NOTHING OF OURS APPEARS. No product name, no tool name, no "generated by".
+ *     Paul's client is buying from Paul.
+ *  2. EVERY FIGURE CARRIES ITS SOURCE. A number the owner gave, a number the
+ *     operator assumed, and a number nobody knew are visibly different things,
+ *     and the assumption prints beside the figure it moved rather than in a
+ *     footnote nobody reads.
+ *  3. EVERY PIECE OF TEXT IS ESCAPED. The report is published to a real domain
+ *     and is full of words a prospect typed into a form. Escaping is a
+ *     correctness requirement here, not hygiene.
+ *
+ * Pure: takes data, returns an HTML string. No DOM, no network, no clock beyond
+ * the date it is handed. That is what makes it testable, and it is inlined into
+ * the assessment page by build-app.mjs like the engine.
+ */
+
+function esc(s) {
+  return String(s === undefined || s === null ? "" : s)
+    .replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+
+/** Does this value look like a figure rather than a sentence? Fallback only. */
+function isFigure(v) {
+  return /^[\\s$\xA3\u20AC]*[-+]?[\\d][\\d.,]*\\s*(%|hrs?|hours?|mins?|minutes?|days?)?\\s*$/i.test(String(v === undefined || v === null ? "" : v));
+}
+
+function money(n) {
+  return "$" + Math.round(Number(n) || 0).toLocaleString("en-US");
+}
+
+/** A colour the operator typed is going straight into a style attribute. */
+function safeColour(c) {
+  return /^#[0-9a-fA-F]{3,8}$/.test(String(c || "")) ? String(c) : "#1F4E79";
+}
+
+/**
+ * agency  { name, accent?, contact? }            \u2014 from Layer 1. Never invented.
+ * services[] { name, price?, covers:[findingId] } \u2014 THEIR menu at THEIR prices.
+ * A finding with no matching service still appears; it just has no price beside
+ * it, because recommending something the agency does not sell is worse than a
+ * gap in a table.
+ */
+function renderReport(opts) {
+  var state = opts.state || {};
+  var r = opts.computed || {};
+  var agency = opts.agency || {};
+  var services = Array.isArray(opts.services) ? opts.services : [];
+  var assumptionLabels = opts.assumptionLabels || {};
+  var date = opts.date || "";
+  var accent = safeColour(agency.accent);
+
+  var biz = esc(state.biz || "your business");
+  var F = Array.isArray(r.F) ? r.F : [];
+  var O = Array.isArray(r.O) ? r.O : [];
+  var hrs = Array.isArray(r.hrs) ? r.hrs : [];
+
+  var out = [];
+  out.push('<!doctype html><html lang="en"><head><meta charset="utf-8">');
+  out.push('<meta name="viewport" content="width=device-width,initial-scale=1">');
+  // This document carries another business's revenue, close rate and list size.
+  // Wherever it ends up, it must never be indexed.
+  out.push('<meta name="robots" content="noindex,nofollow,noarchive">');
+  out.push("<title>Where " + biz + " is leaking</title>");
+  out.push("<style>" + css(accent) + "</style></head><body><div class=wrap>");
+
+  // \u2500\u2500 masthead: theirs, not ours \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  out.push("<header>");
+  if (agency.name) out.push('<p class="by">Prepared by ' + esc(agency.name) + "</p>");
+  out.push("<h1>Where " + biz + " is leaking</h1>");
+  var who = state.client && state.client.name ? esc(state.client.name) + (state.client.role ? ", " + esc(state.client.role) : "") : "";
+  if (who) out.push('<p class="for">Prepared for ' + who + "</p>");
+  if (date) out.push('<p class="when">' + esc(date) + "</p>");
+  // The agency's own method and promise, from Layer 1's Agency OS inputs. Their
+  // words, never ours; absent when they have not written them.
+  if (agency.method || agency.promise) {
+    out.push('<p class="about">' + [agency.method, agency.promise].filter(Boolean).map(esc).join(" ") + "</p>");
+  }
+  out.push("</header>");
+
+  // \u2500\u2500 the three verdicts are three different documents \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  if (r.verdict === "insufficient") {
+    out.push('<div class="verdict stop"><b>We could not put a number on this yet</b>'
+      + esc(r.line || "") + "</div>");
+    out.push(measureFirst(O));
+    out.push(footer(agency));
+    return out.join("\\n") + "</div></body></html>";
+  }
+
+  if (r.verdict === "thin") {
+    out.push('<div class="verdict warn"><b>Honestly, there is not much here</b>'
+      + esc(r.line || "") + "</div>");
+  }
+
+  // \u2500\u2500 headline numbers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  out.push('<div class="hgrid">');
+  if (r.hrsWk > 0) out.push(head(r.hrsWk.toFixed(1), "hours a week going into work a system should do"));
+  if (r.annual > 0) out.push(head(money(r.annual), "a year leaking, on your own numbers"));
+  if (r.annualStop > 0) out.push(head(money(r.annualStop), "a year we expect to actually stop"));
+  out.push("</div>");
+
+  // \u2500\u2500 what you told us \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  if (opts.answered && opts.answered.length) {
+    out.push("<h2>What we started from, in your words</h2><table class=\\"qa\\">");
+    for (var a = 0; a < opts.answered.length; a++) {
+      var q = opts.answered[a];
+      // \`.num\` is right-aligned AND nowrap, which is right for a figure and
+      // ruinous for a sentence: one typed answer like "I get to them at night,
+      // usually" held the value column open and crushed the question column to
+      // 113px of a 926px page, wrapping every question over five lines. The
+      // unit says which kind of answer this is; the shape of the value is the
+      // fallback for a caller that does not send one.
+      var numeric = q.unit !== undefined ? q.unit !== "text" : isFigure(q.value);
+      out.push("<tr><td>" + esc(q.ask) + '</td><td class="' + (numeric ? "num" : "said") + '">'
+        + (q.unknown ? '<span class="unk">you did not know</span>' : esc(q.value)) + "</td></tr>");
+    }
+    out.push("</table>");
+  }
+
+  // \u2500\u2500 the findings \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  if (F.length) {
+    out.push("<h2>Where the money goes</h2><table>");
+    out.push('<tr><th>What is happening</th><th class="num">A month</th></tr>');
+    for (var i = 0; i < F.length; i++) {
+      var f = F[i];
+      var note = f.assumption
+        ? '<span class="assume">' + esc(assumptionLabels[f.assumption] || "This is your assumption, not a measurement.") + "</span>"
+        : "";
+      out.push("<tr><td><strong>" + esc(f.title) + "</strong>" + note + '</td><td class="num">'
+        + money(f.monthly) + "</td></tr>");
+    }
+    out.push('<tr class="tot"><td><strong>Leaking, every month</strong></td><td class="num"><strong>'
+      + money(r.monthly) + "</strong></td></tr>");
+    if (r.stop > 0) {
+      out.push('<tr><td><strong>What we expect to actually stop</strong><span class="assume">'
+        + esc(assumptionLabels.recovery || "No system catches everything. This is your figure.")
+        + '</span></td><td class="num"><strong>' + money(r.stop) + "</strong></td></tr>");
+    }
+    if (r.oneoff !== null && r.oneoff !== undefined && r.oneoff > 0) {
+      out.push('<tr><td>Your dormant list, worked once<span class="assume">'
+        + esc(assumptionLabels.reactivation || "Your assumption, not a measurement.")
+        + " This is a one-off and is left out of every annual figure above."
+        + '</span></td><td class="num">' + money(r.oneoff) + "</td></tr>");
+    }
+    out.push("</table>");
+  }
+
+  // \u2500\u2500 named, deliberately not priced \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  var named = O.filter(function (o) { return o.reason || o.declined; });
+  if (named.length) {
+    out.push("<h2>Named, and deliberately not priced</h2><ul>");
+    for (var j = 0; j < named.length; j++) {
+      var o = named[j];
+      out.push("<li><strong>" + esc(o.title) + "</strong> &mdash; "
+        + esc(o.declined ? "priced only on an assumption you chose not to make." : o.reason) + "</li>");
+    }
+    out.push("</ul><p class=small>We can see these matter and we are not going to invent a number for them.</p>");
+  }
+
+  // \u2500\u2500 hours \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  if (hrs.length) {
+    out.push("<h2>Where the time goes</h2><table>");
+    for (var h = 0; h < hrs.length; h++) {
+      out.push("<tr><td>" + esc(hrs[h].t) + '</td><td class="num">' + Number(hrs[h].h).toFixed(1) + " hrs</td></tr>");
+    }
+    out.push('<tr class="tot"><td><strong>A week</strong></td><td class="num"><strong>'
+      + Number(r.hrsWk).toFixed(1) + "</strong></td></tr></table>");
+  }
+
+  // \u2500\u2500 the plan, from THEIR menu \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  if (F.length) {
+    out.push("<h2>What we would do, in order</h2><table>");
+    out.push('<tr><th>Fixes</th><th>What it is</th></tr>');
+    for (var k = 0; k < F.length; k++) {
+      var fx = F[k];
+      var svc = services.find(function (s) {
+        return Array.isArray(s.covers) && s.covers.indexOf(fx.id) !== -1;
+      });
+      out.push("<tr><td>" + esc(fx.title) + "</td><td>" + esc(svc ? svc.name : fx.fix || "") + "</td></tr>");
+    }
+    out.push("</table>");
+    if (!services.length) {
+      out.push('<p class="small">Service names above are descriptions, not a quote. Add your own offers so this reads in your language and at your prices.</p>');
+    }
+  }
+
+  // \u2500\u2500 investment, only when they have priced it \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  var priced = services.filter(function (s) { return typeof s.price === "number" && s.price > 0; });
+  if (priced.length && r.annualStop > 0) {
+    var total = priced.reduce(function (s, x) { return s + x.price; }, 0);
+    out.push("<h2>The investment</h2><table>");
+    for (var p = 0; p < priced.length; p++) {
+      out.push("<tr><td>" + esc(priced[p].name) + '</td><td class="num">' + money(priced[p].price) + "</td></tr>");
+    }
+    out.push('<tr class="tot"><td><strong>Total</strong></td><td class="num"><strong>' + money(total) + "</strong></td></tr>");
+    out.push('<tr><td>Against what we expect to stop, first year</td><td class="num">' + money(r.annualStop) + "</td></tr>");
+    if (total > 0) {
+      var ratio = r.annualStop / total;
+      out.push('<tr class="tot"><td><strong>You are spending $1 to stop $' + ratio.toFixed(2)
+        + "</strong></td><td class=\\"num\\"><strong>" + ratio.toFixed(1) + "&times;</strong></td></tr>");
+    }
+    out.push("</table>");
+  }
+
+  out.push(sourceLine(state, r, assumptionLabels));
+  out.push(footer(agency));
+  return out.join("\\n") + "</div></body></html>";
+}
+
+function head(n, label) {
+  return '<div><span class="hn">' + esc(n) + '</span><span class="hl">' + esc(label) + "</span></div>";
+}
+
+/**
+ * The list of things to go and count.
+ *
+ * Reads the labels the ENGINE attached beside the ids, never the ids. This
+ * printed "close_rate" at a prospect until 2026-08-30 \u2014 machine text in a
+ * document going out on the operator's letterhead. An id with no label is
+ * dropped rather than printed, because a stranger reading a field name is a
+ * worse failure than a short list.
+ */
+function measureFirst(O) {
+  var seen = [];
+  for (var i = 0; i < O.length; i++) {
+    var m = O[i].missingLabels || [];
+    for (var j = 0; j < m.length; j++) if (seen.indexOf(m[j]) === -1) seen.push(m[j]);
+  }
+  if (!seen.length) return "";
+  return "<h2>What to measure first</h2><p>These are the numbers that would let us price the rest. "
+    + "None of them need a system &mdash; a week of writing them down is enough.</p><ul><li>"
+    + seen.map(esc).join("</li><li>") + "</li></ul>";
+}
+
+/** The sentence the whole document rests on. */
+function sourceLine(state, r, labels) {
+  var used = [];
+  var F = r.F || [];
+  for (var i = 0; i < F.length; i++) if (F[i].assumption && used.indexOf(F[i].assumption) === -1) used.push(F[i].assumption);
+  var n = used.length + (r.stop > 0 ? 1 : 0);
+  return '<p class="src">Every figure here came from what you told us'
+    + (state.trade ? ", or from your own " + esc(state.trade) + " business" : "")
+    + ". " + (n > 0
+      ? n + " of them " + (n === 1 ? "is an estimate" : "are estimates") + " we chose together, each marked where it is used. "
+      : "")
+    + "Nothing here is an industry average applied to your business.</p>";
+}
+
+function footer(agency) {
+  if (!agency.name) return "";
+  return '<footer>' + esc(agency.name) + (agency.contact ? " &middot; " + esc(agency.contact) : "")
+    + (agency.guarantee ? '<br><span class="guarantee">' + esc(agency.guarantee) + "</span>" : "") + "</footer>";
+}
+
+function css(accent) {
+  return [
+    ":root{--a:" + accent + ";--ink:#14171F;--mut:#4A5163;--rule:#D8DDE5;--pan:#F4F6F8}",
+    "*{box-sizing:border-box}",
+    "body{margin:0;background:#fff;color:var(--ink);font:16px/1.6 -apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif}",
+    ".wrap{max-width:44rem;margin:0 auto;padding:2rem 1.1rem 4rem}",
+    "header{border-bottom:3px solid var(--a);padding-bottom:.9rem;margin-bottom:1.4rem}",
+    ".by{font-size:.72rem;letter-spacing:.09em;text-transform:uppercase;color:var(--a);margin:0 0 .4rem;font-weight:600}",
+    "h1{font-size:1.9rem;line-height:1.15;margin:0;font-weight:700}",
+    ".when{color:var(--mut);font-size:.82rem;margin:.4rem 0 0}",
+    ".for{color:var(--ink);font-size:.95rem;margin:.5rem 0 0}",
+    ".about{color:var(--mut);font-size:.95rem;margin:.6rem 0 0;max-width:38rem}",
+    ".guarantee{color:var(--mut);font-size:.85rem}",
+    "h2{font-size:1.15rem;margin:2rem 0 .5rem;font-weight:700}",
+    "table{border-collapse:collapse;width:100%;margin:.6rem 0;font-size:.94rem}",
+    "th,td{text-align:left;padding:.5rem .6rem;border-bottom:1px solid var(--rule);vertical-align:top}",
+    "th{font-size:.7rem;text-transform:uppercase;letter-spacing:.06em;color:var(--mut);border-bottom:2px solid var(--rule)}",
+    ".num{text-align:right;white-space:nowrap;font-variant-numeric:tabular-nums}",
+    // A typed sentence wraps and stays left. It is prose, not a figure.
+    ".said{text-align:left;white-space:normal}",
+    // The question is the column that must stay readable, so it gets the space
+    // and the answer takes what it needs.
+    "table.qa td:first-child{width:62%}",
+    "tr.tot td{background:var(--pan)}",
+    ".assume{display:block;font-size:.76rem;color:var(--mut);font-style:italic;margin-top:.2rem}",
+    ".unk{color:var(--mut);font-style:italic}",
+    ".hgrid{display:grid;grid-template-columns:repeat(auto-fit,minmax(9rem,1fr));gap:1rem;margin:1.2rem 0}",
+    ".hn{display:block;font-size:1.7rem;font-weight:700;color:var(--a);line-height:1.1}",
+    ".hl{display:block;font-size:.78rem;color:var(--mut);margin-top:.15rem}",
+    ".verdict{border-left:4px solid var(--a);background:var(--pan);padding:.75rem .9rem;margin:1rem 0;font-size:.94rem}",
+    ".verdict.warn{border-left-color:#8A5300}.verdict.stop{border-left-color:#9A3324}",
+    ".verdict b{display:block;margin-bottom:.15rem}",
+    ".src{margin-top:1.6rem;padding-top:.8rem;border-top:1px solid var(--rule);font-size:.82rem;color:var(--mut)}",
+    ".small{font-size:.82rem;color:var(--mut)}",
+    "ul{padding-left:1.1rem}li{margin-bottom:.3rem}",
+    "footer{margin-top:2rem;padding-top:.8rem;border-top:3px solid var(--a);font-size:.8rem;color:var(--mut)}",
+    "@media print{.wrap{max-width:none}body{font-size:11pt}}",
+  ].join("");
+}
+
+/* \u2500\u2500 state (persistence only; all maths lives in engine.js) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 */
+var K="cmdos-assessment-v1";
+var S={biz:"",trade:"",client:{},saveTo:"",ans:{},skip:{},asm:{},tab:"ask",area:"client"};
+ASSUMPTIONS.forEach(function(a){S.asm[a[0]]=a[2]});
+try{var raw=localStorage.getItem(K);if(raw)S=Object.assign(S,JSON.parse(raw))}catch(e){}
+if(!S.client)S.client={};if(S.saveTo===undefined)S.saveTo="";
+function save(){try{localStorage.setItem(K,JSON.stringify(S))}catch(e){}}
+function txt(id){return S.skip[id]?null:(S.ans[id]||null)}
+function money(n){return "$"+Math.round(n).toLocaleString()}
+function R(){return compute(S.ans,S.skip,S.asm)}
+/* \u2500\u2500 render \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 */
+function progress(){var d=0;Q.forEach(function(q){if(S.skip[q[0]]||(S.ans[q[0]]!==undefined&&S.ans[q[0]]!==""))d++});return d}
+function areaCount(a){var t=0,d=0;Q.forEach(function(q){if(q[1]===a){t++;if(S.skip[q[0]]||(S.ans[q[0]]!==undefined&&S.ans[q[0]]!==""))d++}});return d+"/"+t}
+
+function head(){
+  var r=R();
+  document.getElementById("lProg").textContent=progress()+"/"+Q.length;
+  document.getElementById("lHrs").textContent=r.hrsWk?r.hrsWk.toFixed(1):"\u2014";
+  document.getElementById("lMon").textContent=r.monthly?money(r.monthly):"\u2014";
+  document.getElementById("bizname").textContent=S.biz||"New assessment";
+  document.getElementById("bizmeta").textContent=[S.trade,(S.client&&S.client.name)?"with "+S.client.name:""].filter(Boolean).join(" \xB7 ");
+}
+
+/**
+ * The banner that stops an operator answering 46 questions for nothing.
+ *
+ * Every priced finding multiplies by the average job value AND the close rate,
+ * so one blank there produces a report that can price nothing at all. It used to
+ * say so only at the very end, on the report itself. Now it says so on every
+ * tab, names which number is missing in words, and links straight to it.
+ */
+function coreWarnHtml(){
+  var gaps=coreMissing(S.ans,S.skip);
+  if(!gaps.length)return "";
+  var names=measureLabels(gaps);
+  var one=gaps.length===1;
+  return '<div class="note stop"><b>'+(one?"One number is missing, and nothing can be priced without it"
+      :"Two numbers are missing, and nothing can be priced without them")+'</b>'
+    +'Every finding in this assessment is multiplied by '+(one?"it":"them")+', so the report will say it could not put a number on anything until '+(one?"it is":"they are")+' filled in.'
+    +'<ul style="margin:.4rem 0 .3rem;padding-left:1.1rem">'
+    +names.map(function(n){return "<li>"+n+"</li>"}).join("")+'</ul>'
+    +'<button class="mini" onclick="goCore()">Take me to '+(one?"it":"them")+'</button></div>';
+}
+/**
+ * The report is addressed to somebody, and renders nothing without a name \u2014 a
+ * third blocker that announced itself only on the Report tab, after all 46
+ * questions were done. Same failure as the two numbers (command-center found it
+ * in the browser pass), so it gets the same treatment rather than a second
+ * style of warning living somewhere else.
+ */
+function bizWarnHtml(){
+  if(S.biz&&S.biz.trim())return "";
+  return '<div class="note warn"><b>No business name yet</b>'
+    +'The report below is addressed to &ldquo;your business&rdquo; until you give it one. It renders either way, and that is the problem: it looks finished and is not sendable.'
+    +' <button class="mini" onclick="goBiz()">Take me to it</button></div>';
+}
+function goBiz(){S.tab="ask";S.area="client";save();draw();
+  var el=document.getElementById("f_biz");
+  if(el){el.scrollIntoView({behavior:"smooth",block:"center"});el.focus()}}
+/** Every standing warning, in one place, so all three tabs show the same set. */
+function warnsHtml(){return coreWarnHtml()+bizWarnHtml()}
+
+function goCore(){S.tab="ask";S.area="money";save();draw();
+  var g=coreMissing(S.ans,S.skip);
+  if(g.length){var el=document.getElementById("q_"+g[0]);
+    if(el){el.scrollIntoView({behavior:"smooth",block:"center"});var i=el.querySelector("input");if(i)i.focus()}}}
+
+/** How much of the client step is filled: the two the report needs plus the contact. */
+function clientCount(){var c=S.client||{};var f=[S.biz,S.trade,c.name,c.email||c.phone].filter(function(v){return v&&String(v).trim()}).length;return f+"/4"}
+function railHtml(){
+  if(S.tab!=="ask")return "";
+  return '<button class="'+(S.area==="client"?"on":"")+'" onclick="goArea(\\'client\\')">The client<span class="c">'+clientCount()+'</span></button>'
+    +AREAS.map(function(a){return '<button class="'+(S.area===a[0]?"on":"")+'" onclick="goArea(\\''+a[0]+'\\')">'
+    +a[1]+'<span class="c">'+areaCount(a[0])+'</span></button>'}).join("")}
+
+function inputFor(q){
+  var id=q[0],u=q[4],val=S.ans[id]===undefined?"":S.ans[id],sk=!!S.skip[id];
+  var unit={currency:"$",rate:"% or 0-1",count:"number",minutes:"minutes",hours:"hrs/week",text:""}[u]||"";
+  var el= u==="text"
+    ? '<textarea class="a" oninput="setA(\\''+id+'\\',this.value)" '+(sk?"disabled":"")+'>'+String(val).replace(/</g,"&lt;")+'</textarea>'
+    : '<input class="a" inputmode="decimal" value="'+String(val).replace(/"/g,"&quot;")+'" oninput="setA(\\''+id+'\\',this.value)" '+(sk?"disabled":"")+'>';
+  return '<div class="row">'+el+'<span class="unit">'+unit+'</span>'
+    +'<button class="mini '+(sk?"on":"")+'" onclick="skip(\\''+id+'\\')">'+(sk?"marked don\\'t know":"don\\'t know")+'</button>'
+    +'<button class="mini" onclick="why(\\''+id+'\\')">why</button></div>'}
+
+/**
+ * The first step: who this is for. Most operators use the assessment as the
+ * sales pitch and the proposal, so the client and the business come before any
+ * number (Jerry, 2026-09-05). It also says which account on the board the
+ * assessment belongs to, so Save to GoHighLevel knows where to put it.
+ */
+function escH(s){return String(s==null?"":s).replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&#39;")}
+function cf(k,ph,type){var c=S.client||{};return '<input class="a" type="'+(type||"text")+'" placeholder="'+escH(ph)+'" value="'+escH(c[k]||"")+'" oninput="setClient(\\''+k+'\\',this.value)">'}
+function setClient(k,v){if(!S.client)S.client={};S.client[k]=v;save();head()}
+function setSaveTo(v){S.saveTo=v;save();try{localStorage.setItem(K+":saveTo",v)}catch(e){}}
+function accountSelectHtml(){
+  var list=window.COMMAND_OS_CLIENTS;
+  if(!list||!list.length)return '<p class="probe">Open this page from Command OS to choose the account it is saved into.</p>';
+  var cur=S.saveTo;try{if(!cur)cur=localStorage.getItem(K+":saveTo")||""}catch(e){}
+  return '<div class="row"><select class="a" onchange="setSaveTo(this.value)"><option value="">Which account does this belong to?</option>'
+    +list.map(function(c){return '<option value="'+escH(c.locationId)+'"'+(c.locationId===cur?" selected":"")+'>'+escH(c.name)+'</option>'}).join("")
+    +'</select></div><p class="why" style="display:block">Usually your own agency account: the prospect becomes a contact there, the answers a note on that contact, and the deal a card on your Assessments board. A client account only once they are one.</p>';
+}
+function clientHtml(){
+  return warnsHtml()+'<h2>The client</h2><p class="intro">&ldquo;Before any number: who this is for, and where it lives.&rdquo;</p>'
+    +'<div class="q done" id="q_client"><p class="ask">The business</p>'
+    +'<div class="row"><input class="a" id="f_biz" placeholder="Business name" value="'+escH(S.biz||"")+'" oninput="S.biz=this.value;save();head()">'
+    +'<input class="a" placeholder="Trade (med spa, dental, home care\u2026)" value="'+escH(S.trade||"")+'" oninput="S.trade=this.value;save();head()"></div>'
+    +'<div class="row">'+cf("website","Website","url")+cf("city","City, state")+'</div></div>'
+    +'<div class="q done"><p class="ask">The person you are talking to</p>'
+    +'<div class="row">'+cf("name","Their name")+cf("role","Their role (owner, office manager\u2026)")+'</div>'
+    +'<div class="row">'+cf("email","Email","email")+cf("phone","Phone","tel")+'</div>'
+    +'<p class="why" style="display:block">An email or a phone number is what lets the same business be found again next time instead of a second contact being created.</p></div>'
+    +'<div class="q done"><p class="ask">Where this assessment is saved</p>'+accountSelectHtml()+'</div>'
+    +'<div class="btnrow"><button class="btn" onclick="goArea(\\''+AREAS[0][0]+'\\')">Next: '+AREAS[0][1]+'</button></div>'}
+function askHtml(){
+  if(S.area==="client")return clientHtml();
+  var a=AREAS.filter(function(x){return x[0]===S.area})[0];
+  var qs=Q.filter(function(q){return q[1]===S.area});
+  return warnsHtml()+'<h2>'+a[1]+'</h2><p class="intro">&ldquo;'+a[2]+'&rdquo;</p>'
+    +qs.map(function(q){
+      var done=S.ans[q[0]]!==undefined&&S.ans[q[0]]!=="",sk=!!S.skip[q[0]];
+      return '<div class="q '+(sk?"skip":done?"done":"")+'" id="q_'+q[0]+'">'
+        +'<p class="ask">'+q[2]+'</p>'
+        +(q[3]?'<p class="probe">If they go vague: &ldquo;'+q[3]+'&rdquo;</p>':'')
+        +inputFor(q)+'<p class="why">'+q[5]+'</p></div>'}).join("")
+    +'<div class="btnrow"><button class="btn" onclick="nextArea()">Next area</button>'
+    +'<button class="btn ghost" onclick="tab(\\'find\\')">See findings</button></div>'}
+
+function setHtml(){
+  return '<h2>Your assumptions</h2><p class="intro">Every one of these prints in the report next to the figure it moved. Set one to zero and its finding disappears rather than falling back to an industry number.</p><div class="card">'
+    +ASSUMPTIONS.map(function(a){
+      return '<div class="assume"><div><b>'+a[1]+'</b><br><span class="unit">'+a[3]+'</span></div>'
+      +'<input class="a" style="max-width:5rem" value="'+(S.asm[a[0]])+'" oninput="setAsm(\\''+a[0]+'\\',this.value)"></div>'}).join("")
+    +'</div><div class="card"><h2 style="font-size:1rem">Who is this for?</h2>'
+    +'<p class="intro">'+(S.biz?escH(S.biz)+(S.trade?", "+escH(S.trade):""):"No business named yet")+'. <button class="mini" onclick="goBiz()">Edit on The client step</button></p></div>'}
+
+function findHtml(){
+  var r=R();
+  var vb={findings:"note go",thin:"note warn",insufficient:"note stop"}[r.verdict];
+  var h=warnsHtml()+'<h2>What it found</h2><div class="'+vb+'"><b>Verdict: '+r.verdict+'</b>'+r.line+'</div>';
+  if(r.F.length){
+    h+='<div class="card"><table><thead><tr><th>Finding</th><th class="num">A month</th></tr></thead><tbody>'
+    +r.F.map(function(f){return '<tr><td>'+f.title+(f.asm?' <span class="unit">(uses your '+f.asm.replace(/_/g," ")+')</span>':'')+'</td><td class="num">'+money(f.monthly)+'</td></tr>'}).join("")
+    +'<tr><td><b>Leaking, monthly</b></td><td class="num"><b>'+money(r.monthly)+'</b></td></tr>'
+    +'<tr><td><b>Expected to stop, at your '+Math.round((S.asm.recovery||0)*100)+'%</b></td><td class="num"><b>'+money(r.stop)+'</b></td></tr>'
+    +(r.oneoff!==null?'<tr><td>Dormant list, worked once <span class="unit">(one-off, not in the annual)</span></td><td class="num">'+money(r.oneoff)+'</td></tr>':'')
+    +'</tbody></table></div>'}
+  if(r.hrs.length){
+    h+='<div class="card"><table><thead><tr><th>Where the time goes</th><th class="num">Hrs/week</th></tr></thead><tbody>'
+    +r.hrs.map(function(x){return '<tr><td>'+x.t+'</td><td class="num">'+x.h.toFixed(1)+'</td></tr>'}).join("")
+    +'<tr><td><b>Total</b></td><td class="num"><b>'+r.hrsWk.toFixed(1)+'</b></td></tr></tbody></table></div>'}
+  if(r.O.length){
+    h+='<div class="note warn"><b>Not priced, and deliberately not guessed</b>'
+    +r.O.map(function(o){return o.declined?(o.title+" &mdash; you set "+o.declined.replace(/_/g," ")+" to zero")
+      :(o.title+" &mdash; missing: "+o.miss.join(", "))}).join("<br>")+'</div>'}
+  h+='<div class="btnrow"><button class="btn" onclick="tab(\\'rep\\')">Build the report</button></div>';
+  return h}
+
+function reportHtml(){
+  var r=R();
+  var answered=[];
+  Q.forEach(function(q){
+    var id=q[0];
+    if(S.skip[id]) answered.push({ask:q[2],unknown:true,unit:q[4]});
+    else if(S.ans[id]!==undefined&&String(S.ans[id]).trim()!=="") answered.push({ask:q[2],value:S.ans[id],unit:q[4]});
+  });
+  var labels={};
+  ASSUMPTIONS.forEach(function(a){labels[a[0]]=a[3]});
+  return renderReport({
+    state:{biz:S.biz,trade:S.trade,ans:S.ans,client:S.client||{}},
+    computed:r, agency:S.agency||window.COMMAND_OS_AGENCY||{}, services:S.services||[],
+    assumptionLabels:labels,
+    date:new Date().toLocaleDateString(undefined,{day:"numeric",month:"long",year:"numeric"}),
+    answered:answered
+  });
+}
+function repHtml(){
+  var r=R();
+  var doc=reportHtml();
+  return '<h2>The report</h2><p class="intro">This is the document, exactly as your prospect receives it. Your branding, your prices, every estimate marked where it is used.</p>'
+  +warnsHtml()
+  +'<div class="card" style="padding:0;overflow:hidden"><iframe id="rpv" style="width:100%;height:34rem;border:0;background:#fff" title="Report preview"></iframe></div>'
+  +'<div class="btnrow"><button class="btn" onclick="openReport()">Open it full size</button>'
+  +'<button class="btn ghost" onclick="showSource()">Save the report</button>'
+  +'<button class="btn ghost" onclick="dl()">Save answers</button>'
+  +(window.COMMAND_OS_CLIENTS?'<button class="btn" onclick="saveToGhl()">Save to GoHighLevel</button>':'')+'</div>'
+  +'<div id="savemsg"></div>'
+  +'<div class="note"><b>Publishing it</b>Open it full size and print to PDF, or hand the file to your own site. Putting it on your domain automatically is the next piece, and it is not built yet.</div>';
+}
+function paintReport(){
+  var f=document.getElementById("rpv");
+  if(f) f.srcdoc=reportHtml();
+}
+function openReport(){
+  var w=window.open("","_blank");
+  if(w){w.document.open();w.document.write(reportHtml());w.document.close();}
+}
+function showSource(){
+  var text=reportHtml(), name=slug(S.biz)+"-report.html";
+  dump(savedMsg(saveFile(name,text,"text/html"),name), text);
+}
+function draw(){
+  head();
+  document.getElementById("rail").innerHTML=railHtml();
+  document.getElementById("body").innerHTML=
+    S.tab==="ask"?askHtml():S.tab==="set"?setHtml():S.tab==="find"?findHtml():repHtml();
+  if(S.tab==="rep") paintReport();
+  Array.prototype.forEach.call(document.querySelectorAll(".tabs button"),function(b){
+    b.className=b.dataset.t===S.tab?"on":""})}
+
+function setA(id,v){S.ans[id]=v;if(v!=="")S.skip[id]=false;save();head();
+  var el=document.getElementById("q_"+id);if(el)el.className="q "+(v!==""?"done":"")}
+function skip(id){S.skip[id]=!S.skip[id];if(S.skip[id])S.ans[id]="";save();draw()}
+function why(id){var el=document.getElementById("q_"+id);if(el)el.classList.toggle("open")}
+function setAsm(k,v){S.asm[k]=parseRate(v);save();head()}
+function goArea(a){S.area=a;save();draw();window.scrollTo({top:0,behavior:"smooth"})}
+function nextArea(){if(S.area==="client"){goArea(AREAS[0][0]);return}var i=AREAS.map(function(x){return x[0]}).indexOf(S.area);
+  if(i<AREAS.length-1)goArea(AREAS[i+1][0]);else tab("find")}
+function tab(t){S.tab=t;save();draw();window.scrollTo({top:0,behavior:"smooth"})}
+/** One copy box, two callers. */
+function dump(title,text){
+  var d=document.getElementById("dump"); if(d)d.remove();
+  var w=document.createElement("div");w.id="dump";w.className="card";
+  w.innerHTML='<b style="font-size:var(--fs-sm)"></b>'
+   +'<textarea class="a" style="min-height:12rem;font-family:var(--mono);font-size:var(--fs-sm)"></textarea>';
+  w.querySelector("b").textContent=title;
+  document.getElementById("body").appendChild(w);
+  var t=w.querySelector("textarea");t.value=text;t.focus();t.select();
+  w.scrollIntoView({behavior:"smooth",block:"nearest"});
+}
+function slug(s){return String(s||"assessment").toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"assessment"}
+/**
+ * Write a real file to the operator's downloads.
+ *
+ * The button said "Save answers" and saved nothing \u2014 it opened a textarea and
+ * expected a human to select and copy it. Now it downloads, and the copy box
+ * stays as the fallback for the browsers that refuse a download from file://.
+ */
+function saveFile(name,text,type){
+  try{
+    var b=new Blob([text],{type:type});
+    var u=URL.createObjectURL(b);
+    var a=document.createElement("a");a.href=u;a.download=name;a.style.display="none";
+    document.body.appendChild(a);a.click();document.body.removeChild(a);
+    setTimeout(function(){URL.revokeObjectURL(u)},4000);
+    return true;
+  }catch(e){return false}
+}
+/**
+ * What to say about a download we cannot confirm.
+ *
+ * \`a.click()\` throws when the API is missing, and stays silent when the browser
+ * simply refuses \u2014 which is exactly what some Chrome configurations do to a page
+ * opened from file://, the way this one ships. So a true return means "asked",
+ * never "saved", so announcing a completed save on the strength of it would be
+ * a confident claim about something unobserved. The copy box is shown every
+ * time and the wording is true under both outcomes.
+ */
+function savedMsg(ok,name){
+  return ok
+    ? "Asked your browser to save it as "+name+". If it did not appear in your downloads, it was blocked \u2014 the same text is here, so select all, copy, and save it as "+name+"."
+    : "Your browser would not save the file. Select all, copy, and save it as "+name+".";
+}
+function dl(){
+  var text=JSON.stringify(S,null,2), name=slug(S.biz)+"-answers.json";
+  dump(savedMsg(saveFile(name,text,"application/json"),name), text);
+}
+function wipe(){if(!confirm)return;S.ans={};S.skip={};S.biz="";S.trade="";S.client={};S.tab="ask";S.area="client";save();draw()}
+/** Save into the chosen account through Command OS on this computer: the same
+ *  write the save_assessment tool makes, nothing else. */
+function saveToGhl(){
+  var box=document.getElementById("savemsg");
+  var loc=S.saveTo;try{if(!loc)loc=localStorage.getItem(K+":saveTo")||""}catch(e){}
+  if(!loc){if(box)box.innerHTML='<div class="note warn"><b>Which account?</b>Pick it on The client step first. <button class="mini" onclick="goBiz()">Take me there</button></div>';return}
+  if(!S.biz||!S.biz.trim()){if(box)box.innerHTML='<div class="note warn"><b>No business name yet</b><button class="mini" onclick="goBiz()">Take me to it</button></div>';return}
+  if(box)box.innerHTML='<div class="note"><b>Saving\u2026</b>The prospect as a contact, the answers as a note, the deal on your Assessments board.</div>';
+  var c=S.client||{};
+  fetch("/api/assessment-save",{method:"POST",headers:{"Content-Type":"application/json","x-command-os-seat":window.COMMAND_OS_SEAT||""},
+    body:JSON.stringify({locationId:loc,assessment:{biz:S.biz,trade:S.trade,ans:S.ans,skip:S.skip,asm:S.asm,client:c},contactName:c.name||"",email:c.email||"",phone:c.phone||""})})
+  .then(function(r){return r.json()}).then(function(j){
+    if(!box)return;
+    if(!j.ok||j.saved===false){box.innerHTML='<div class="note stop"><b>Not saved</b>'+String(j.error||"unknown").replace(/</g,"&lt;")+'</div>';return}
+    box.innerHTML='<div class="note go"><b>Saved</b>'+String(j.whereItLives||"").replace(/</g,"&lt;")+' Stage: '+String(j.stage||"")+'. '+String(j.opportunityNote||"").replace(/</g,"&lt;")+(j.warning?' '+String(j.warning).replace(/</g,"&lt;"):'')+'</div>'})
+  .catch(function(e){if(box)box.innerHTML='<div class="note stop"><b>Not saved</b>Command OS is not answering on this computer.</div>'})}
+
+Array.prototype.forEach.call(document.querySelectorAll(".tabs button"),function(b){
+  b.onclick=function(){tab(b.dataset.t)}});
+draw();
+</script>
+</body>
+</html>
+`;
+  }
+});
+
 // src/command-os/design/brand-page.ts
 function head2(title2) {
   return `${cockpitHeadHtml(`${esc4(title2)} \u2014 Command OS`, { extraCss: STYLE })}<body>
@@ -41352,7 +43065,8 @@ function brandCardHtml(d, opts = {}) {
   const sw = (label, t) => `<tr><td><span class="sw" style="margin:0"><span style="background:${t.hex}"></span></span></td><td>${esc4(label)}</td><td class="hex">${esc4(t.hex)}</td><td class="small">${esc4(t.source)}</td></tr>`;
   const face = (label, f) => `<tr><td>${esc4(label)}</td><td><b>${esc4(f.family)}</b></td><td>${f.renderIntent === "google" ? `<span class="pill ok">Google Fonts</span>` : `<span class="pill warn">${f.renderIntent === "licensed-webfont" ? "licensed" : "system"}</span> renders as <b>${esc4(renderedFamily(f))}</b>`}</td><td class="small">${esc4(f.source)}</td></tr>`;
   const pairs = d.contrast.pairs.map((p) => `<tr><td class="hex">${esc4(p.fg)} on ${esc4(p.bg)}</td><td>${p.ratio}:1 ${p.ratio >= 4.5 ? `<span class="pill ok">AA</span>` : `<span class="pill warn">under 4.5</span>`}</td><td class="small">${p.correctedFg ? `text shade corrected to <span class="hex">${esc4(p.correctedFg)}</span> (${p.correctedRatio}:1)` : ""}</td></tr>`).join("");
-  const logo = d.logo?.inlineSvg ? d.logo.inlineSvg : d.logo?.dataUri ? `<img src="${d.logo.dataUri}" alt="">` : `<span class="small">no logo stored</span>`;
+  const cleanSvg = d.logo?.inlineSvg ? sanitizeSvgOrDrop(d.logo.inlineSvg) : void 0;
+  const logo = cleanSvg ? `<img src="data:image/svg+xml;base64,${Buffer.from(cleanSvg.replace(/currentColor/g, c.fg.hex)).toString("base64")}" alt="">` : d.logo?.inlineSvg ? `<span class="small">the stored logo is not a plain drawing, so it is not shown</span>` : isRasterDataUri(d.logo?.dataUri) ? `<img src="${esc4(d.logo.dataUri)}" alt="">` : d.logo?.dataUri ? `<span class="small">the stored logo image is not a plain picture, so it is not shown</span>` : `<span class="small">no logo stored</span>`;
   return `${head2(`${d.name} \xB7 brand`)}
 <h1>${esc4(d.name)}</h1>
 <p class="muted">${esc4(d.website ?? "")} \xB7 <span class="pill">${esc4(d.provenance.extractedVia)}</span><span class="pill ${d.provenance.confidence >= 0.7 ? "ok" : "warn"}">confidence ${Math.round(d.provenance.confidence * 100)}%</span> ${esc4(d.scheme)} scheme \xB7 ${esc4(d.provenance.extractedAt.slice(0, 10))}</p>
@@ -41403,7 +43117,7 @@ document.getElementById("make").addEventListener("submit",async function(e){
   var g=function(id){return document.getElementById(id).value.trim()};
   var pts=g("mk-points").split("|").map(function(x){return x.trim()}).filter(Boolean);
   if(!g("mk-headline")||!pts.length){say("mk-status","A headline and at least one point, please.","err");return}
-  var body={brand:${JSON.stringify(d.slug)},medium:g("mk-medium"),headline:g("mk-headline"),points:pts};
+  var body={brand:${scriptJson(d.slug)},medium:g("mk-medium"),headline:g("mk-headline"),points:pts};
   if(g("mk-audience"))body.audience=g("mk-audience");
   if(g("mk-cta"))body.cta=g("mk-cta");
   if(g("mk-grade"))body.gradeCopyFor=g("mk-grade");
@@ -41433,7 +43147,7 @@ document.getElementById("mk-cancel").addEventListener("click",async function(){
   try{await post("/api/design/cancel",{id:runId});stopPolling();say("mk-status","Stopped.");document.getElementById("mk-go").disabled=false;this.hidden=true}catch(e){say("mk-status",e.message,"err")}
 });
 })();
-document.getElementById("override").addEventListener("submit",async(e)=>{e.preventDefault();const g=(id)=>document.getElementById(id).value.trim();const body={slug:${JSON.stringify(d.slug)}};if(g("accent"))body.accent=g("accent");if(g("displayFont"))body.displayFont=g("displayFont");if(g("bodyFont"))body.bodyFont=g("bodyFont");if(g("brandName"))body.name=g("brandName");if(g("logoSvg"))body.logoSvg=g("logoSvg");if(Object.keys(body).length===1){say("save-status","Nothing to change.");return}const b=document.getElementById("save");b.disabled=true;try{await post("/api/brand/set",body);say("save-status","Saved.","ok");location.reload()}catch(err){say("save-status",err.message,"err");b.disabled=false}});
+document.getElementById("override").addEventListener("submit",async(e)=>{e.preventDefault();const g=(id)=>document.getElementById(id).value.trim();const body={slug:${scriptJson(d.slug)}};if(g("accent"))body.accent=g("accent");if(g("displayFont"))body.displayFont=g("displayFont");if(g("bodyFont"))body.bodyFont=g("bodyFont");if(g("brandName"))body.name=g("brandName");if(g("logoSvg"))body.logoSvg=g("logoSvg");if(Object.keys(body).length===1){say("save-status","Nothing to change.");return}const b=document.getElementById("save");b.disabled=true;try{await post("/api/brand/set",body);say("save-status","Saved.","ok");location.reload()}catch(err){say("save-status",err.message,"err");b.disabled=false}});
 `)}`;
 }
 var esc4, STYLE, SHELL_JS, foot;
@@ -41442,6 +43156,8 @@ var init_brand_page = __esm({
     "use strict";
     init_fonts();
     init_cockpit_shell();
+    init_script_json();
+    init_svg_sanitize();
     esc4 = (s) => String(s ?? "").replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
     STYLE = `
 main{max-width:1080px;margin:0 auto;padding:28px 24px 80px}
@@ -41469,13 +43185,13 @@ td.hex{font-family:ui-monospace,Menlo,monospace}
 .shot{max-width:100%;border:1px solid var(--line);border-radius:var(--radius-sm)}
 `;
     SHELL_JS = (seatToken) => `
-const SERVED=${JSON.stringify(seatToken)};
+const SERVED=${scriptJson(seatToken)};
 const KEY=SERVED||new URLSearchParams(location.search).get("seat")||localStorage.getItem("cockpit_seat")||"";
 try{if(SERVED)localStorage.setItem("cockpit_seat",SERVED)}catch(e){}
 async function post(url,body){const r=await fetch(url,{method:"POST",headers:{"Content-Type":"application/json","x-command-os-seat":KEY},body:JSON.stringify(body)});let j={};try{j=await r.json()}catch(e){}if(!r.ok||j.ok===false)throw new Error(j.error||("Request failed ("+r.status+")"));return j}
 function say(id,msg,cls){const el=document.getElementById(id);if(!el)return;el.textContent=msg;el.style.color=cls==="err"?"#A63D3D":cls==="ok"?"#2F7A5A":""}
 `;
-    foot = (js) => `</main><script>${js}</script><script>${COCKPIT_TYPE_JS}</script></body></html>`;
+    foot = (js) => `</main>${cockpitShellClose()}<script>${js}</script><script>${COCKPIT_TYPE_JS}</script></body></html>`;
   }
 });
 
@@ -41763,7 +43479,7 @@ function renderClientStatusHtml(input) {
   </div>
 </div></div>
 <div class="page"><div class="sheet">
-${agency || input.logoDataUri ? `<div class="brand">${input.logoDataUri ? `<img src="${esc5(input.logoDataUri)}" alt="${esc5(agency ?? "")}">` : ""}${agency ? `<span class="agency">${esc5(agency)}</span>` : ""}<span class="for">Prepared for<br><b>${esc5(input.accountName)}</b></span></div>` : ""}
+${agency || isRasterDataUri(input.logoDataUri) ? `<div class="brand">${isRasterDataUri(input.logoDataUri) ? `<img src="${esc5(input.logoDataUri)}" alt="${esc5(agency ?? "")}">` : ""}${agency ? `<span class="agency">${esc5(agency)}</span>` : ""}<span class="for">Prepared for<br><b>${esc5(input.accountName)}</b></span></div>` : ""}
 <p class="eyebrow">What is live in your account</p>
 <h1>${esc5(input.accountName)}</h1>
 <p class="stamp">${esc5(revLine)}</p>
@@ -41812,6 +43528,7 @@ var init_client_status = __esm({
     "use strict";
     init_handoff_pack();
     init_branding();
+    init_svg_sanitize();
     CLIENT_STATE_LABEL = {
       "in-place": "Live in your account",
       "not-yet": "Not confirmed yet",
@@ -42475,6 +44192,76 @@ var init_blueprint_review = __esm({
   }
 });
 
+// src/command-os/capability-runs.ts
+function capabilitySentence(cap, clientName) {
+  return cap.says.replace(/\{client\}/g, clientName);
+}
+function capabilitySpec(cap, clientName) {
+  const tools = CAPABILITY_TOOLS[cap.key] ?? [];
+  if (!tools.length) throw new Error(`${cap.label} is not built from a button. Run it from your own Claude, watching.`);
+  return {
+    stage: -1,
+    name: cap.label,
+    allowedTools: T([...ALWAYS, ...tools]),
+    maxTurns: 30,
+    timeoutMs: 15 * 6e4,
+    prompt: (locationId2, locationName) => `You are Command OS, working inside ONE GoHighLevel sub-account for a client: ${locationName} (${locationId2}).
+1. Call switch_location with locationId ${locationId2}.
+2. Call get_current_location and STOP with a line "RESULT: {\\"ok\\":false,\\"error\\":\\"wrong location\\"}" if it is not ${locationId2}.
+3. Do exactly this, and nothing beyond it: ${capabilitySentence(cap, clientName)}
+Rules that are not negotiable:
+- Read what the account already has BEFORE you create anything, and reuse what is there instead of duplicating it.
+- Any workflow you create or change stays a DRAFT. Never publish. Never delete anything. Never send a message to a real contact.
+- Every id you use (calendar, pipeline, stage, field, user, workflow) comes from a read of THIS account in this run, never from memory or another account.
+- If a step needs a human (a number to buy, a Stripe connection, a staff member to add, a decision), do not guess: list it as an issue.
+- Say what you did in the owner's words, not tool names.
+Finish with ONE line, exactly:
+RESULT: {"ok":true,"summary":"<what exists now versus what was already there, with counts>","issues":["<anything skipped or waiting on a person>"]}
+If it cannot be done, finish with: RESULT: {"ok":false,"error":"<short reason>"}`
+  };
+}
+var T, ALWAYS, CAPABILITY_TOOLS;
+var init_capability_runs = __esm({
+  "src/command-os/capability-runs.ts"() {
+    "use strict";
+    T = (names) => names.map((n) => `mcp__ghl__${n}`);
+    ALWAYS = ["switch_location", "get_current_location"];
+    CAPABILITY_TOOLS = {
+      intake: ["get_forms", "get_form_full", "get_form_submissions", "get_intake_question_set"],
+      pipelines: ["get_pipelines", "get_pipeline_full", "create_pipeline", "update_pipeline"],
+      calendars: ["get_calendars", "get_calendar", "get_users", "create_calendar", "update_calendar"],
+      forms: ["get_forms", "get_form_full", "get_form_submissions", "create_form", "update_form", "get_surveys", "get_custom_fields"],
+      pages: ["get_funnels", "get_funnel_pages", "get_page_full", "list_brands", "get_brand", "get_calendars", "find_ghl_template", "install_ghl_template", "create_funnel", "create_funnel_page", "compose_page", "update_page_content", "verify_funnel", "check_page_theme"],
+      fields: ["get_custom_fields", "create_custom_field", "update_custom_field", "get_custom_values", "create_custom_value", "update_custom_value", "get_location_tags", "create_location_tag"],
+      staff: ["get_users", "get_user", "get_calendars"],
+      phone: ["list_phone_numbers", "list_number_pools", "get_location"],
+      workflows: ["get_workflows", "get_workflow_full", "get_trigger_registry", "get_users", "get_calendars", "get_pipelines", "get_pipeline_full", "get_custom_fields", "get_custom_values", "get_location_tags", "list_email_templates", "list_message_templates", "validate_workflow", "create_workflow", "update_workflow_actions", "audit_workflows"],
+      reactivation: ["get_contact_count", "search_contacts", "get_location_tags", "create_location_tag", "get_workflows", "get_workflow_full", "validate_workflow", "create_workflow", "update_workflow_actions", "create_smart_list", "list_smart_lists"],
+      // no bulk tagging: that is a mass write the operator does by hand
+      templates: ["list_email_templates", "create_email_template", "update_email_template", "list_message_templates", "create_sms_template", "get_custom_values"],
+      broadcasts: ["list_email_templates", "create_email_template", "update_email_template", "list_smart_lists", "get_email_campaigns"],
+      // drafts the email as a template; sending or scheduling is the operator's click
+      "conversation-ai": ["list_knowledge_bases", "get_knowledge_base", "create_knowledge_base", "crawl_kb_website", "get_kb_crawl_status", "train_kb_urls", "list_kb_urls", "list_kb_faqs", "create_kb_faq", "list_conversation_agents", "get_conversation_agent", "create_conversation_agent", "list_conversation_actions", "create_conversation_action", "get_agent_generations", "get_calendars", "get_users"],
+      "voice-ai": ["check_voice_ai_readiness", "list_voice_agents", "get_voice_agent", "create_voice_agent", "get_voice_action", "create_voice_action", "update_voice_action", "get_voice_call_logs", "get_calendars", "get_users", "get_workflows", "list_knowledge_bases"],
+      demo: [],
+      // messages a real prospect: never from a button (NO_BUILD_BUTTON)
+      payments: ["list_products", "get_product", "list_product_prices", "create_product", "update_product", "list_invoices", "get_invoice", "create_invoice", "list_coupons"],
+      documents: [],
+      // reads only would be a brochure and a send is not a build: no button (NO_BUILD_BUTTON)
+      memberships: ["get_courses", "create_course", "list_membership_categories", "create_membership_category", "list_membership_lessons", "create_membership_lesson", "list_membership_offers", "create_membership_offer"],
+      reviews: ["list_reviews", "get_review_link_list", "get_workflows", "get_workflow_full", "validate_workflow", "create_workflow", "update_workflow_actions", "get_calendars"],
+      social: [],
+      // a post is a send: no button (NO_BUILD_BUTTON)
+      blogs: ["get_blogs", "get_blog_posts", "get_blog_post", "get_blog_authors", "get_blog_categories", "check_blog_slug"],
+      checkup: ["run_checkup", "audit_workflows", "get_account_health_summary", "audit_my_delivery", "build_audit_report", "get_workflows"],
+      contacts: ["get_contact_count", "search_contacts", "get_contact", "get_location_tags", "create_location_tag", "create_smart_list", "list_smart_lists"],
+      // no bulk writes from a button
+      integrations: ["list_webhooks", "get_webhook", "create_webhook", "get_trigger_links", "create_trigger_link", "list_custom_objects", "get_custom_object"],
+      handoff: ["build_offboarding_kit", "build_audit_report", "list_snapshots", "create_snapshot_share_link", "export_account", "run_checkup"]
+    };
+  }
+});
+
 // src/shared-brain.ts
 function isSharedRecord(x) {
   const r = x;
@@ -42558,33 +44345,47 @@ var init_shared_brain = __esm({
 var dashboard_exports = {};
 __export(dashboard_exports, {
   ACCOUNT_TYPES: () => ACCOUNT_TYPES,
+  INTAKE_OWN_MESSAGES: () => INTAKE_OWN_MESSAGES,
   NOT_SIGNED_IN_MSG: () => NOT_SIGNED_IN_MSG,
+  SEAT_GUARDED_READS: () => SEAT_GUARDED_READS,
   SEAT_TOKEN_HEADER: () => SEAT_TOKEN_HEADER,
   STAGES: () => STAGES2,
   accountTypeOf: () => accountTypeOf,
-  assessmentPagePath: () => assessmentPagePath,
+  assessmentAgencyTag: () => assessmentAgencyTag,
   checkMutationGuard: () => checkMutationGuard,
   checkSeatToken: () => checkSeatToken,
   clearPending: () => clearPending,
+  clientDocsDir: () => clientDocsDir,
+  cockpitGate: () => cockpitGate,
   cockpitStatePath: () => cockpitStatePath,
   forgetAnthropicKey: () => forgetAnthropicKey,
+  guarded: () => guarded,
+  insideDir: () => insideDir,
   isLoopback: () => isLoopback,
   launcherAlreadyOffered: () => launcherAlreadyOffered,
+  listClientDocs: () => listClientDocs,
+  memberFacingError: () => memberFacingError,
   overlayPath: () => overlayPath,
+  readBody: () => readBody,
   readCockpitState: () => readCockpitState,
+  readFailureText: () => readFailureText,
   readOverlay: () => readOverlay,
+  readableAccount: () => readableAccount,
   recordLauncherOffered: () => recordLauncherOffered,
   recoverStuckStages: () => recoverStuckStages,
   renderCockpitHtml: () => renderCockpitHtml,
   resolvePlan: () => resolvePlan2,
   runDashboard: () => runDashboard,
+  safeDocName: () => safeDocName,
   setAccountIndustry: () => setAccountIndustry,
   setAccountType: () => setAccountType,
   setBuildApproval: () => setBuildApproval,
   setPending: () => setPending,
   setStage: () => setStage,
+  uniqueDocName: () => uniqueDocName,
   withCockpitShell: () => withCockpitShell,
   writeCockpitState: () => writeCockpitState,
+  writeDocAtomically: () => writeDocAtomically,
   writeOverlay: () => writeOverlay
 });
 function recoverStuckStages(state) {
@@ -42596,25 +44397,6 @@ function recoverStuckStages(state) {
   }));
   return { state: { ...state, clients }, recovered };
 }
-function assessmentPagePath(dirname14 = __dirname) {
-  const candidates = [
-    path31.join(dirname14, "assessment.html"),
-    // dist/, as published
-    path31.join(dirname14, "..", "dist", "assessment.html"),
-    // running from src/
-    path31.join(dirname14, "..", "src", "command-os", "assessment", "app.html"),
-    // dist/ in a dev checkout
-    path31.join(dirname14, "command-os", "assessment", "app.html")
-    // src/
-  ];
-  for (const c of candidates) {
-    try {
-      if (fs32.existsSync(c) && fs32.statSync(c).isFile()) return c;
-    } catch {
-    }
-  }
-  return null;
-}
 function cockpitStatePath() {
   return path31.join(appDataDir(), "cockpit-state.json");
 }
@@ -42697,7 +44479,7 @@ async function resolvePlan2(creds) {
   return { error: "Could not verify the license (offline and no valid cached attestation)." };
 }
 function startRun(locationId2, stage, onDone, meta = {}) {
-  activeRun2 = { locationId: locationId2, stage, running: true, lines: [] };
+  activeRun2 = { locationId: locationId2, stage, running: true, lines: [], ...meta.capability ? { capability: meta.capability } : {} };
   const run = activeRun2;
   const state = readCockpitState();
   const industry = state.accounts?.[locationId2]?.industry;
@@ -42723,7 +44505,7 @@ function startRun(locationId2, stage, onDone, meta = {}) {
     if (run.lines.length > 200) run.lines.shift();
   }, { context, name: meta.name, approvedAt: meta.approvedAt, onProgress: (p) => {
     run.progress = p;
-  } }).then(async (outcome) => {
+  }, spec: meta.spec }).then(async (outcome) => {
     try {
       const at = (/* @__PURE__ */ new Date()).toISOString();
       const shared = { at, locationId: locationId2, stage, engineVersion: outcome.engineVersion, engineModel: outcome.engineModel };
@@ -42775,7 +44557,7 @@ function startRun(locationId2, stage, onDone, meta = {}) {
     }
     run.ok = outcome.ok;
     const before = readCockpitState().clients[locationId2]?.stages;
-    onDone(outcome.ok);
+    onDone(outcome.ok, outcome);
     const after = readCockpitState().clients[locationId2]?.stages;
     if (stage === 4) await refreshAfterVerify(locationId2, meta.name || locationId2, (l) => run.lines.push(l));
     if (meta.writeReview && shouldAutoGenerateReview(before, after, Boolean(readCockpitState().reviews?.[locationId2]?.ok))) {
@@ -42855,16 +44637,164 @@ function recordLauncherOffered() {
   } catch {
   }
 }
-function withCockpitShell(page, screen) {
-  const css2 = `<style>${cockpitTokensCss({ webfont: false })}${cockpitChromeCss()}</style>`;
+function assessmentAgencyTag(ap = readAgencyProfile()) {
+  const forReport = {
+    name: ap.agencyName,
+    accent: ap.accent,
+    contact: [ap.sender?.replyTo, ap.sender?.phone, ap.website].filter(Boolean).join(" \xB7 ") || void 0,
+    method: ap.agencyOs?.method,
+    promise: ap.agencyOs?.offer?.promise,
+    guarantee: ap.agencyOs?.offer?.guarantee
+  };
+  return `<script>window.COMMAND_OS_AGENCY=${scriptJson(forReport)}</script>`;
+}
+function withCockpitShell(page, screen, extraHead = "") {
+  const css2 = `<style>${cockpitTokensCss({ webfont: false })}${cockpitChromeCss()}</style>${extraHead}`;
   const header = `${cockpitHeaderHtml(screen)}<script>${COCKPIT_TYPE_JS}</script>`;
   const withCss = page.includes("<!--COCKPIT_SHELL_CSS-->") ? page.replace("<!--COCKPIT_SHELL_CSS-->", css2) : page.replace("</head>", `${css2}</head>`);
-  return withCss.includes("<!--COCKPIT_HEADER-->") ? withCss.replace("<!--COCKPIT_HEADER-->", header) : withCss.replace(/<body([^>]*)>/, `<body$1>${header}`);
+  const withHeader = withCss.includes("<!--COCKPIT_HEADER-->") ? withCss.replace("<!--COCKPIT_HEADER-->", header) : withCss.replace(/<body([^>]*)>/, `<body$1>${header}`);
+  return withHeader.includes("</body>") ? withHeader.replace("</body>", `${cockpitShellClose()}</body>`) : withHeader + cockpitShellClose();
+}
+function clientDocsDir(locationId2, base = appDataDir()) {
+  const safeLoc = String(locationId2).replace(/[^A-Za-z0-9_-]/g, "");
+  if (!safeLoc) throw new Error("no client");
+  return path31.join(base, "clients", safeLoc, "documents");
+}
+function safeDocName(name) {
+  const cleaned = path31.basename(String(name ?? "")).replace(/[^A-Za-z0-9._ -]/g, "_").replace(/\s+/g, " ").trim();
+  const ext = path31.extname(cleaned).toLowerCase();
+  if (!cleaned || cleaned.startsWith(".") || !DOC_EXTS.has(ext)) throw new Error("Only PDF, Word (.docx/.doc), text, Markdown, RTF and CSV files can be saved here.");
+  const stem = cleaned.slice(0, cleaned.length - ext.length).slice(0, 120 - ext.length).trim();
+  return `${stem || "document"}${ext}`;
+}
+function listClientDocs(locationId2, base = appDataDir()) {
+  const dir = clientDocsDir(locationId2, base);
+  if (!fs32.existsSync(dir)) return [];
+  return fs32.readdirSync(dir).filter((f) => DOC_EXTS.has(path31.extname(f).toLowerCase())).map((f) => {
+    const st = fs32.statSync(path31.join(dir, f));
+    return { name: f, bytes: st.size, savedAt: st.mtime.toISOString() };
+  }).sort((a, b) => b.savedAt.localeCompare(a.savedAt));
+}
+function readFailureText(e) {
+  const m = /GHL API Error (\d{3})/.exec(e instanceof Error ? e.message : String(e));
+  if (m) {
+    const code = m[1];
+    if (code === "401" || code === "403") return "could not read: the key on file for this account is not allowed to";
+    if (code === "404") return "could not read: GoHighLevel has no such list on this account";
+    if (code === "429") return "could not read: GoHighLevel asked us to slow down; try again in a minute";
+    return `could not read (HTTP ${code})`;
+  }
+  return "could not read";
+}
+function logQuietly(message) {
+  try {
+    ensureAppDataDir();
+    fs32.appendFileSync(path31.join(appDataDir(), "cockpit.log"), `[${(/* @__PURE__ */ new Date()).toISOString()}] ${message}
+`);
+  } catch {
+  }
 }
-function html(roster, seatToken) {
-  return `${cockpitHeadHtml("Command OS \u2014 GHL Command", { extraCss: `
+function readBody(req, res, max, onDone, tooLarge = "That request is too large.") {
+  let body = "";
+  let tooBig = false;
+  const fail = (e) => {
+    logQuietly(`request handler: ${e instanceof Error ? e.stack ?? e.message : String(e)}`);
+    try {
+      if (!res.headersSent) res.writeHead(500, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ ok: false, error: "That did not finish. The detail is in cockpit.log." }));
+    } catch {
+    }
+  };
+  req.on("data", (chunk) => {
+    if (tooBig) return;
+    body += chunk;
+    if (body.length > max) {
+      tooBig = true;
+      body = "";
+      res.writeHead(413, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ ok: false, error: tooLarge }));
+      req.resume?.();
+    }
+  });
+  req.on("end", () => {
+    if (tooBig) return;
+    try {
+      const r = onDone(body);
+      if (r && typeof r.catch === "function") r.catch(fail);
+    } catch (e) {
+      fail(e);
+    }
+  });
+}
+function memberFacingError(e, own = []) {
+  const raw = e instanceof Error ? e.message : String(e);
+  return own.includes(raw) ? raw : readFailureText(e);
+}
+function insideDir(dir, p) {
+  try {
+    const real = fs32.realpathSync(p);
+    const base = fs32.realpathSync(dir);
+    return real === base || real.startsWith(base + path31.sep);
+  } catch {
+    return false;
+  }
+}
+function uniqueDocName(dir, name) {
+  const ext = path31.extname(name), stem = name.slice(0, name.length - ext.length);
+  let candidate = name;
+  for (let n = 2; fs32.existsSync(path31.join(dir, candidate)); n++) candidate = `${stem} (${n})${ext}`;
+  return candidate;
+}
+function writeDocAtomically(dir, name, bytes) {
+  fs32.mkdirSync(dir, { recursive: true, mode: 448 });
+  const finalName = uniqueDocName(dir, name);
+  const tmp = path31.join(dir, `.${finalName}.${process.pid}.tmp`);
+  const fd = fs32.openSync(tmp, fs32.constants.O_WRONLY | fs32.constants.O_CREAT | fs32.constants.O_EXCL | (fs32.constants.O_NOFOLLOW ?? 0), 384);
+  try {
+    fs32.writeSync(fd, bytes);
+    fs32.fsyncSync(fd);
+  } finally {
+    fs32.closeSync(fd);
+  }
+  const dest = path31.join(dir, finalName);
+  try {
+    if (fs32.lstatSync(dest).isSymbolicLink()) {
+      fs32.unlinkSync(tmp);
+      throw new Error("that name is taken by a link");
+    }
+  } catch (e) {
+    if (e.code !== "ENOENT") throw e;
+  }
+  fs32.renameSync(tmp, dest);
+  return finalName;
+}
+function readableAccount(locationId2, roster = currentRosterRef(), state = readCockpitState()) {
+  if (!locationId2 || !roster.some((r) => r.locationId === locationId2)) return false;
+  const t = state.accounts?.[locationId2]?.type;
+  return t !== "hidden" && t !== "template";
+}
+function html(roster, seatToken, screen = "board", cap) {
+  const capForPage = cap ? { ...cap, groupLabel: CAPABILITY_GROUPS.find((g) => g.key === cap.group)?.label ?? cap.group, noBuild: NO_BUILD_BUTTON.has(cap.key) } : null;
+  return `${cockpitHeadHtml(cap ? `${cap.label} \u2014 Command OS` : BOARD_TITLES[screen] ?? BOARD_TITLES.board, { extraCss: `
 
   main{max-width:56rem;margin:1.4rem auto 4rem;padding:0 1rem}
+  .screen-head{margin:0 0 1.2rem}.screen-head h1{font-family:var(--font-display);font-weight:500;font-size:1.6rem;color:var(--heading);margin:0 0 .3rem}
+  .screen-head .lead{color:var(--ink-2);font-size:var(--fs-body);margin:0;max-width:40rem}
+  .home{display:grid;grid-template-columns:repeat(auto-fit,minmax(14rem,1fr));gap:1rem}
+  .home .tile{display:block;padding:1rem 1.1rem;color:inherit;text-decoration:none}
+  .home .tile:hover{border-color:var(--gold);text-decoration:none}
+  .home .big{font-family:var(--font-display);font-size:2.1rem;line-height:1.1;color:var(--heading);margin:.25rem 0 .35rem}
+  .home .tile p{color:var(--ink-2);font-size:var(--fs-sm);margin:0}
+  .home .go{display:inline-block;margin-top:.7rem;font-weight:600;font-size:var(--fs-sm);color:var(--gold-light)}
+  a.newbtn{display:inline-flex;align-items:center;text-decoration:none}
+  .capsel{font:inherit;font-size:var(--fs-body);padding:.45rem .7rem;border-radius:var(--radius-sm);border:1px solid var(--line);background:var(--surface);color:var(--heading);min-width:16rem}
+  .cap-reads .cap-row{padding:.35rem 0;border-bottom:1px solid var(--line);font-size:var(--fs-body)}.cap-reads .cap-row:last-of-type{border-bottom:0}
+  .cap-words{margin:0;padding:.8rem 1rem;border-left:3px solid var(--gold);background:var(--bg-2);border-radius:var(--radius-sm);font-size:var(--fs-lg);line-height:1.5;color:var(--heading)}
+  .cap-log{margin:.8rem 0 0;padding:.8rem 1rem;background:var(--bg-2);border-radius:var(--radius-sm);font-size:var(--fs-sm);line-height:1.5;white-space:pre-wrap;max-height:22rem;overflow:auto}
+  a.intakebtn{text-decoration:none;display:inline-flex;align-items:center}
+  .muted{color:var(--ink-2)}.small{font-size:var(--fs-sm)}
+  .idrop{border:1px dashed var(--line);border-radius:var(--radius-sm);padding:.9rem 1rem;color:var(--ink-2);font-size:var(--fs-sm);background:var(--surface)}
+  .idocs{margin-top:.6rem}.idoc{display:flex;align-items:center;justify-content:space-between;gap:.6rem;padding:.45rem 0;border-bottom:1px solid var(--line);font-size:var(--fs-sm)}.idoc:last-child{border-bottom:0}
   footer{color:var(--ink-3);font-size:var(--fs-sm);text-align:center;margin:2rem 0;padding:0 1rem}
 
   /* \u2500\u2500 Building blocks (hub) \u2500\u2500 */
@@ -42997,7 +44927,7 @@ function html(roster, seatToken) {
   .ifield label{display:block;font-size:var(--fs-sm);color:var(--ink-2);margin-bottom:.2rem}
   .ifield input,.ifield textarea,.ifield select{width:100%;box-sizing:border-box;padding:.5rem .65rem;border:1px solid var(--line);border-radius:var(--radius-sm);font-size:var(--fs-sm);font-family:inherit;background:var(--surface)}
   .ifield.prefilled input,.ifield.prefilled textarea{border-color:var(--ok);background:var(--ok-soft)}
-  .ifield.prefilled label:after{content:" \xB7 from your call";color:var(--ok);font-weight:600}
+  .ifield.prefilled label:after{content:" \xB7 from " attr(data-src);color:var(--ok);font-weight:600}
   .istatus{font-size:var(--fs-label);font-weight:700;letter-spacing:.04em;padding:.14rem .5rem;border-radius:999px;background:var(--bg-2);color:var(--ink-2);vertical-align:middle}
   .istatus.received{background:var(--ok-soft);color:var(--ok)}.istatus.sent{background:var(--gold-soft);color:var(--gold-ink)}
   .iq{font-size:1.05rem;color:var(--heading);font-weight:600;margin:.3rem 0 .1rem}
@@ -43024,10 +44954,11 @@ function html(roster, seatToken) {
     .stage{min-width:4.2rem}
   }
   @media (prefers-reduced-motion: reduce){*{transition:none !important}}
-` })}<body>
-${cockpitHeaderHtml("board")}
+` })}<body data-screen="${screen}"${cap ? ` data-capability="${cap.key}"` : ""}>
+${cockpitHeaderHtml(screen, { capability: cap?.key })}
 <main id="main">Loading\u2026</main>
-<footer>Command OS runs only on this computer \u2014 your client accounts and their logins never leave it.<br>Steps marked "your call" are yours to mark, and your name goes on them. The steps Command OS runs are settled by the run, never by a click.</footer>
+<footer>Command OS runs on this computer, and your client accounts' logins stay on it. What Claude reads or writes for you goes through your own Claude account and to GoHighLevel. A pre-fill from a web address or a call recorder also fetches from that site or that recorder. No copy comes to us.<br>Steps marked "your call" are yours to mark, and your name goes on them. The steps Command OS runs are settled by the run, never by a click.</footer>
+${cockpitShellClose()}
 <script>
 /* \u2500\u2500 Seat key bootstrap (PRD row 0) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
    This page was handed out by the copy of Command OS running on this computer,
@@ -43039,7 +44970,7 @@ ${cockpitHeaderHtml("board")}
    every call on the page is covered, including ones added later. Same-origin
    only: an absolute or protocol-relative URL goes out untouched, so the key can
    never ride along to somebody else's server. */
-const SEAT_HEADER=${JSON.stringify(SEAT_TOKEN_HEADER)};const SEAT=${JSON.stringify(seatToken)};
+const SEAT_HEADER=${scriptJson(SEAT_TOKEN_HEADER)};const SEAT=${scriptJson(seatToken)};
 (function(){var raw=window.fetch.bind(window);
  window.fetch=function(input,init){
   var u=String(typeof input==="string"?input:(input&&input.url)||"");
@@ -43048,17 +44979,20 @@ const SEAT_HEADER=${JSON.stringify(SEAT_TOKEN_HEADER)};const SEAT=${JSON.stringi
   var opts={};for(var k in (init||{}))opts[k]=init[k];
   var h=new Headers((init&&init.headers)||{});h.set(SEAT_HEADER,SEAT);opts.headers=h;
   return raw(input,opts)};})();
-const STAGES=${JSON.stringify(STAGES2)};const ROSTER=${JSON.stringify(roster)};
-const SANDBOX=${JSON.stringify(Object.keys(SANDBOX_ALLOWLIST))};const POWERED=${JSON.stringify(Object.keys(STAGE_SPECS).map(Number))};
-const GATES=${JSON.stringify(HUMAN_GATE_STAGES)};let PROTECTED=${JSON.stringify(PROTECTED_LOCATIONS)};
+const STAGES=${scriptJson(STAGES2)};const ROSTER=${scriptJson(roster)};
+const SANDBOX=${scriptJson(Object.keys(SANDBOX_ALLOWLIST))};const POWERED=${scriptJson(Object.keys(STAGE_SPECS).map(Number))};
+const GATES=${scriptJson(HUMAN_GATE_STAGES)};let PROTECTED=${scriptJson(PROTECTED_LOCATIONS)};
 const TYPES=["client","sandbox","template","hidden"];
 const TYPE_LABELS={client:"Client",sandbox:"Practice sandbox",template:"Template",hidden:"Hidden"};
 const LABELS=["Intake","Brief","Approve","Build","Verify","Manual tasks","Go-live"];
 const STATUS_TEXT={pending:"not started",in_progress:"in progress",done:"done"};
 const NEXT={pending:"in_progress",in_progress:"done",done:"pending"};
 let polling=false,query="",showParked=false,showNew=false,snapshots=null;
+/* Which of the board's four screens this page is: board (overview), new, queue, clients. */
+const SCREEN=document.body.getAttribute("data-screen")||"board";
+const CAP=${scriptJson(capForPage)};const HUB=${scriptJson(HUB_URL)};
 const INDUSTRIES=["Med spa","Clinic / practice","Coach / consultant","Local service","Ecommerce","Agency","Other"];
-const INDUSTRIES2=${JSON.stringify(INDUSTRY_PACKS.map((p) => ({ slug: p.slug, label: p.label })))};
+const INDUSTRIES2=${scriptJson(INDUSTRY_PACKS.map((p) => ({ slug: p.slug, label: p.label })))};
 /* One account at a time (Jerry, 2026-08-26: "way too busy\u2026 tempting to work on multiple
    accounts at once"). One card is ever expanded; every other account is a one-line row. */
 let activeId=null;try{activeId=localStorage.getItem("cmdos-active")||null}catch(e){}
@@ -43066,7 +45000,7 @@ function setActive(id){activeId=id;try{localStorage.setItem("cmdos-active",id)}c
 function initials(name){const p=String(name||"").trim().split(/\\s+/);return ((p[0]||"?")[0]+(p[1]?p[1][0]:"")).toUpperCase()}
 function typeOf(state,id){return (state.accounts&&state.accounts[id]&&state.accounts[id].type)||(SANDBOX.includes(id)?"sandbox":"client")}
 function activityScore(state,id){const c=state.clients[id];if(!c)return 0;return c.stages.some(s=>s!=="pending")?1:0}
-async function load(){const s=await(await fetch("/api/state")).json();const r=await(await fetch("/api/run/status")).json();await loadQueue();render(s,r);
+async function load(){const s=await(await fetch("/api/state")).json();const r=await(await fetch("/api/run/status")).json();await loadQueue();if(SCREEN==="new"&&!snapshots){try{const sr=await(await fetch("/api/snapshots")).json();snapshots=sr.ok?sr.snapshots:[]}catch(e){snapshots=[]}}render(s,r);
  if(r.running&&!polling){polling=true;const t=setInterval(async()=>{if(userIsBusy())return;const rr=await(await fetch("/api/run/status")).json();const ss=await(await fetch("/api/state")).json();await loadQueue();render(ss,rr);if(!rr.running){clearInterval(t);polling=false}},1500)}}
 // Heartbeat (2026-08-25): the fast poller above only starts for a run THIS page saw begin. A page that was
 // already open, or opened mid-run, or a run kicked off from another seat/the API, showed "pending" until a
@@ -43114,7 +45048,8 @@ function intakePanel(){const d=document.createElement("div");d.className="ncform
  reset.onclick=()=>{if(confirm("Remove all your customizations and go back to the base question set?"))saveOverlay({})};
  d.appendChild(reset);
  return d}
-let iOpen={},iData={},iMode={},iAnswers={},iIdx={},iPre={},iSub={},oOpen={};
+let iOpen={},iData={},iMode={},iAnswers={},iIdx={},iPre={},iSub={},oOpen={},iDocs={},iPreSrc={};
+async function iDocsLoad(id){try{const r=await(await fetch("/api/intake-documents?locationId="+encodeURIComponent(id))).json();iDocs[id]=(r&&r.files)||[]}catch(e){iDocs[id]=[]}render(lastState,lastRun)}
 // What came back, written for the operator (oc.plain). The raw report the stage produced stays
 // behind "Details for the operator" (2026-08-26: "The Verify report was written for you, not them").
 function outcomePanel(id,i,state){const oc=(state.outcomes||{})[id+":"+i];if(!oc)return null;
@@ -43137,7 +45072,7 @@ function outcomePanel(id,i,state){const oc=(state.outcomes||{})[id+":"+i];if(!oc
 async function iLoad(id){const r=await(await fetch("/api/client-intake?locationId="+id)).json();iData[id]=r;
  if(r.ok&&!iAnswers[id]){iAnswers[id]={}}render(lastState,lastRun)}
 function iField(id,q,val,prefilled){const w=document.createElement("div");w.className="ifield"+(prefilled?" prefilled":"");
- const l=document.createElement("label");l.textContent=q.label+(q.required?" *":"");w.appendChild(l);
+ const l=document.createElement("label");l.textContent=q.label+(q.required?" *":"");if(prefilled)l.setAttribute("data-src",iPreSrc[id]||"your call");w.appendChild(l);
  let inp;
  if(q.multi&&q.options&&q.options.length){
   // Several answers allowed (the GHL field is multi-choice) \u2014 checkboxes, stored as a list. (2026-08-25, finding 8)
@@ -43157,13 +45092,13 @@ function iField(id,q,val,prefilled){const w=document.createElement("div");w.clas
  w.appendChild(inp);return w}
 function intakeWorkspace(id,name){const d=iData[id];const box=document.createElement("div");box.className="ipanel";
  if(!d){box.textContent="Loading intake\u2026";return box}
- if(!d.ok){box.innerHTML="<h3>Intake</h3><p style='font-size:var(--fs-sm);color:var(--warn)'>"+d.error+"</p>";return box}
- box.innerHTML="<h3>Intake for "+name+"</h3>";
+ if(!d.ok){box.innerHTML="<h3>Intake</h3><p style='font-size:var(--fs-sm);color:var(--warn)'>"+escT(d.error)+"</p>";return box}
+ box.innerHTML="<h3>Intake for "+escT(name)+"</h3>";
  const sub=document.createElement("p");sub.className="small muted";sub.style.margin=".1rem 0 .2rem";
  sub.textContent=d.status==="received"?((d.channel==="form"?"Submitted through the GHL form":"Saved from Command OS")+(d.answeredAt?" \xB7 "+new Date(d.answeredAt).toLocaleString():"")):d.status==="sent"?"Link sent \u2014 waiting on the client":"Ready to complete";
  box.appendChild(sub);
  const ch=document.createElement("div");ch.className="ichoice";
- const modes=[["fill","Fill it here"],["interview","Interview mode"],["transcript","From a call"],["send","Send to client"],["link","Copy link"]];
+ const modes=[["fill","Fill it here"],["interview","Interview mode"],["transcript","From a call or a document"],["send","Send to client"],["link","Copy link"]];
  for(const [k,label] of modes){const b=document.createElement("button");b.textContent=label;if(iMode[id]===k)b.className="on";
   b.onclick=async()=>{if(k==="link"){try{await navigator.clipboard.writeText(d.formUrl);b.textContent="Copied \u2713";setTimeout(()=>render(lastState,lastRun),1200)}catch(e){prompt("Copy this link:",d.formUrl)}return}
    iMode[id]=iMode[id]===k?null:k;iIdx[id]=0;render(lastState,lastRun)};
@@ -43184,7 +45119,7 @@ function intakeWorkspace(id,name){const d=iData[id];const box=document.createEle
  if(mode==="transcript"){const w=document.createElement("div");
   const tabs=document.createElement("div");tabs.className="ichoice";tabs.style.margin=".2rem 0 .6rem";
   iSub[id]=iSub[id]||"paste";
-  for(const [k,lab] of [["paste","Paste / drop file"],["url","From a link"],["recorder","From my recorder"]]){
+  for(const [k,lab] of [["paste","Paste a transcript"],["doc","A document (PDF, Word, text)"],["url","From a link"],["recorder","From my recorder"]]){
    const tb=document.createElement("button");tb.textContent=lab;if(iSub[id]===k)tb.className="on";
    tb.onclick=()=>{iSub[id]=k;render(lastState,lastRun)};tabs.appendChild(tb)}
   w.appendChild(tabs);
@@ -43201,13 +45136,13 @@ function intakeWorkspace(id,name){const d=iData[id];const box=document.createEle
    else if(sub==="recorder"){if(!recIn.value.trim())return alert("Tell it which recording to grab");payload.instruction=recIn.value.trim()}
    else {if(!ta.value.trim())return alert("Paste or drop the transcript first");payload.transcript=ta.value}
    b.disabled=true;b.textContent="Reading the call\u2026";
-   st.textContent=sub==="paste"?"Your own Claude is reading this locally \u2014 nothing is uploaded anywhere."
-    :sub==="url"?"Your own Claude is fetching that link \u2014 it can read the web but nothing else."
-    :"Your own Claude is searching your connected recorder (Plaud, Otter, Fireflies\u2026) for that call.";
+   st.textContent=sub==="paste"?"This text goes to your own Claude account to be read, and nowhere else."
+    :sub==="url"?"Your own Claude fetches that link, so that site sees the request; the page text then goes to your Claude account and nowhere else."
+    :"Your own Claude asks the recorder you connected (Plaud, Otter, Fireflies\u2026) for that call; the transcript then goes to your Claude account and nowhere else.";
    const r=await(await fetch("/api/intake-prefill",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(payload)})).json();
    b.disabled=false;b.textContent="Fill the intake from this";
    if(!r.ok){st.textContent="Could not read that: "+(r.error||"unknown");return}
-   iAnswers[id]=Object.assign({},iAnswers[id],r.answers);iPre[id]=Object.keys(r.answers);
+   iAnswers[id]=Object.assign({},iAnswers[id],r.answers);iPre[id]=Object.keys(r.answers);iPreSrc[id]=sub==="url"?"the link":"your call";
    iMode[id]="fill";render(lastState,lastRun)};
   const urlIn=document.createElement("input");urlIn.placeholder="https://\u2026 a shared transcript or recording page";
   urlIn.style.cssText="width:100%;box-sizing:border-box;padding:.6rem;border:1px solid var(--line);border-radius:7px;font-size:var(--fs-sm);background:var(--surface)";
@@ -43215,13 +45150,45 @@ function intakeWorkspace(id,name){const d=iData[id];const box=document.createEle
   recIn.style.cssText=urlIn.style.cssText;
   const hint=document.createElement("p");hint.className="small muted";hint.style.margin=".4rem 0 0";
   if(iSub[id]==="paste"){w.appendChild(ta)}
+  else if(iSub[id]==="doc"){
+   /* A document the client sent: PDF, Word or text. Stored with the client on this
+      computer; your own Claude reads it here and fills the intake from it. */
+   const docs=iDocs[id];
+   if(docs===undefined){iDocs[id]=[];iDocsLoad(id)}
+   const drop=document.createElement("div");drop.className="idrop";
+   drop.textContent="Drop a PDF, Word or text file here, or choose one";
+   const fi=document.createElement("input");fi.type="file";fi.accept=".pdf,.docx,.doc,.md,.txt,.rtf,.csv";fi.style.display="block";fi.style.marginTop=".5rem";
+   const up=async(f)=>{if(!f)return;if(f.size>20*1024*1024){alert("That file is over 20 MB. Split it or export the part that matters.");return}
+    drop.textContent="Saving "+f.name+"\u2026";
+    const b64=await new Promise((res,rej)=>{const rd=new FileReader();rd.onload=()=>res(String(rd.result).split(",")[1]||"");rd.onerror=rej;rd.readAsDataURL(f)});
+    const r=await(await fetch("/api/intake-document",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({locationId:id,name:f.name,base64:b64})})).json();
+    if(!r.ok){alert(r.error||"Could not save that file");drop.textContent="Drop a PDF, Word or text file here, or choose one";return}
+    iDocs[id]=r.files||[];render(lastState,lastRun)};
+   drop.ondragover=(e)=>{e.preventDefault();drop.style.borderColor="var(--gold)"};
+   drop.ondragleave=()=>{drop.style.borderColor="var(--line)"};
+   drop.ondrop=(e)=>{e.preventDefault();drop.style.borderColor="var(--line)";up(e.dataTransfer.files[0])};
+   fi.onchange=()=>up(fi.files[0]);
+   drop.appendChild(fi);w.appendChild(drop);
+   const list=document.createElement("div");list.className="idocs";
+   if(!docs||!docs.length){const p=document.createElement("p");p.className="small muted";p.style.margin=".5rem 0 0";p.textContent="No documents saved for this client yet.";list.appendChild(p)}
+   for(const f of (docs||[])){const row=document.createElement("div");row.className="idoc";
+    const nm=document.createElement("span");nm.textContent=f.name+" \xB7 "+Math.max(1,Math.round(f.bytes/1024))+" KB";row.appendChild(nm);
+    const rb=document.createElement("button");rb.className="intakebtn";rb.textContent="Fill the intake from this";
+    rb.onclick=async()=>{rb.disabled=true;rb.textContent="Reading it\u2026";st.textContent="The text of "+f.name+" goes to your own Claude account to be read, and nowhere else.";
+     const r=await(await fetch("/api/intake-prefill",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({locationId:id,labels:d.questions.map(q=>q.label),file:f.name})})).json();
+     rb.disabled=false;rb.textContent="Fill the intake from this";
+     if(!r.ok){st.textContent="Could not read that: "+(r.error||"unknown");return}
+     iAnswers[id]=Object.assign({},iAnswers[id],r.answers);iPre[id]=Object.keys(r.answers);iPreSrc[id]="the document";iMode[id]="fill";render(lastState,lastRun)};
+    row.appendChild(rb);list.appendChild(row)}
+   w.appendChild(list);
+   hint.textContent="Stored with this client on this computer. When you press the button, the document's text goes to your own Claude account to be read, and nowhere else. Only what it does not answer is left for you.";w.appendChild(hint);w.appendChild(st)}
   else if(iSub[id]==="url"){w.appendChild(urlIn);hint.textContent="Works for links that don't need a login. Behind a login? Use \\u201cFrom my recorder\\u201d.";w.appendChild(hint)}
   else {w.appendChild(recIn);hint.textContent="Uses the recorder you already have connected to Claude (Plaud, Otter, Fireflies, Zoom). Nothing new to set up if it's already there.";w.appendChild(hint)}
-  w.appendChild(b);w.appendChild(st);box.appendChild(w)}
+  if(iSub[id]!=="doc"){w.appendChild(b);w.appendChild(st)}box.appendChild(w)}
  if(mode==="fill"||mode==="interview"){
   const qs=d.questions;const ans=iAnswers[id]||{};const pre=iPre[id]||[];
   if(pre.length&&mode==="fill"){const banner=document.createElement("div");banner.className="pendpanel";
-   banner.textContent="\u2713 "+pre.length+" answers pre-filled from your call. Correct anything wrong; "+(qs.length-pre.length)+" still need you.";box.appendChild(banner)}
+   banner.textContent="\u2713 "+pre.length+" answers pre-filled from "+(iPreSrc[id]||"your call")+". Correct anything wrong; "+(qs.length-pre.length)+" still need you.";box.appendChild(banner)}
   if(mode==="interview"){const i=Math.min(iIdx[id]||0,qs.length-1);const q=qs[i];
    const prog=document.createElement("p");prog.className="small muted";prog.style.margin=".2rem 0";prog.textContent="Question "+(i+1)+" of "+qs.length+" \xB7 "+q.sectionLabel;
    const qq=document.createElement("div");qq.className="iq";qq.textContent=q.label;
@@ -43272,8 +45239,10 @@ async function rLoad(id){const r=await(await fetch("/api/review?locationId="+id)
 // which wiped the button's "Thinking it through\u2026" \u2014 a click looked like nothing happened. The in-flight flag
 // lives outside the card so re-renders keep it; a failure is shown in the panel instead of vanishing.
 function reviewBusy(id,run){return Boolean(rBusy[id])||Boolean(run&&run.running&&run.reviewing&&run.locationId===id)}
+/* The review is written by the model from the client's intake answers, so every value in it is untrusted text (Codex, round 2). */
+function escT(s){return String(s==null?"":s).replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;")}
 function reviewPanel(id,name,state,run){const r=rData[id];const d=document.createElement("div");d.className="review";
- d.innerHTML="<h3>Blueprint Review \u2014 "+name+"</h3>";
+ d.innerHTML="<h3>Blueprint Review \u2014 "+escT(name)+"</h3>";
  const busy=reviewBusy(id,run);
  const gen=document.createElement("button");gen.className="runbtn";gen.style.marginTop=".4rem";
  gen.textContent=busy?"Thinking it through\u2026":(r&&r.ok)?"Regenerate":"Generate the review";gen.disabled=busy;
@@ -43290,24 +45259,24 @@ function reviewPanel(id,name,state,run){const r=rData[id];const d=document.creat
  if(r.headline){const h=document.createElement("div");h.className="headline";h.textContent=r.headline;d.appendChild(h)}
  if(r.ica){const s1=document.createElement("div");s1.innerHTML="<h4>Who they actually sell to</h4>";
   const p1=document.createElement("p");p1.textContent=r.ica.who||"";s1.appendChild(p1);
-  if((r.ica.painPoints||[]).length){const p2=document.createElement("p");p2.innerHTML="<b>Pain:</b> "+r.ica.painPoints.join(" \xB7 ");s1.appendChild(p2)}
-  if((r.ica.objections||[]).length){const p3=document.createElement("p");p3.innerHTML="<b>Objections:</b> "+r.ica.objections.join(" \xB7 ");s1.appendChild(p3)}
-  if(r.ica.buyingTrigger){const p4=document.createElement("p");p4.innerHTML="<b>Buys when:</b> "+r.ica.buyingTrigger;s1.appendChild(p4)}
-  if(r.ica.whereTheyAre){const p5=document.createElement("p");p5.innerHTML="<b>Found at:</b> "+r.ica.whereTheyAre;s1.appendChild(p5)}
+  if((r.ica.painPoints||[]).length){const p2=document.createElement("p");p2.innerHTML="<b>Pain:</b> "+r.ica.painPoints.map(escT).join(" \xB7 ");s1.appendChild(p2)}
+  if((r.ica.objections||[]).length){const p3=document.createElement("p");p3.innerHTML="<b>Objections:</b> "+r.ica.objections.map(escT).join(" \xB7 ");s1.appendChild(p3)}
+  if(r.ica.buyingTrigger){const p4=document.createElement("p");p4.innerHTML="<b>Buys when:</b> "+escT(r.ica.buyingTrigger);s1.appendChild(p4)}
+  if(r.ica.whereTheyAre){const p5=document.createElement("p");p5.innerHTML="<b>Found at:</b> "+escT(r.ica.whereTheyAre);s1.appendChild(p5)}
   d.appendChild(s1)}
- if(r.offer){const s2=document.createElement("div");s2.innerHTML='<h4>The offer <span class="score">'+(r.offer.score||0)+'/10</span></h4>';
+ if(r.offer){const s2=document.createElement("div");s2.innerHTML='<h4>The offer <span class="score">'+(Number(r.offer.score)||0)+'/10</span></h4>';
   for(const [k,lab] of [["dreamOutcome","Worth wanting"],["believability","Believable"],["speed","Speed to result"],["effort","Effort asked"]]){
-   if(r.offer[k]){const p=document.createElement("p");p.innerHTML="<b>"+lab+":</b> "+r.offer[k];s2.appendChild(p)}}
-  if(r.offer.biggestLever){const p=document.createElement("p");p.innerHTML="<b>Biggest lever:</b> "+r.offer.biggestLever;s2.appendChild(p)}
+   if(r.offer[k]){const p=document.createElement("p");p.innerHTML="<b>"+escT(lab)+":</b> "+escT(r.offer[k]);s2.appendChild(p)}}
+  if(r.offer.biggestLever){const p=document.createElement("p");p.innerHTML="<b>Biggest lever:</b> "+escT(r.offer.biggestLever);s2.appendChild(p)}
   if(r.offer.recommendedOffer){const p=document.createElement("p");p.className="headline";p.textContent="Run this instead: "+r.offer.recommendedOffer;s2.appendChild(p)}
   d.appendChild(s2)}
- if((r.gaps||[]).length){const s3=document.createElement("div");s3.innerHTML="<h4>What's missing ("+r.gaps.length+")</h4>";
+ if((r.gaps||[]).length){const s3=document.createElement("div");s3.innerHTML="<h4>What's missing ("+(Number(r.gaps.length)||0)+")</h4>";
   for(const g of r.gaps){const gg=document.createElement("div");gg.className="gap "+(g.priority||"soon");
-   gg.innerHTML="<b>"+g.title+"</b><span>"+(g.cost?g.cost+" \u2014 ":"")+(g.fix||"")+"</span>";s3.appendChild(gg)}
+   gg.innerHTML="<b>"+escT(g.title)+"</b><span>"+(g.cost?escT(g.cost)+" \u2014 ":"")+escT(g.fix||"")+"</span>";s3.appendChild(gg)}
   d.appendChild(s3)}
  if((r.build||[]).length){const s4=document.createElement("div");s4.innerHTML="<h4>What we build</h4>";
   for(const b of r.build){const bb=document.createElement("div");bb.className="buildline";
-   bb.innerHTML=b.item+"<em>"+(b.because||"")+"</em>";s4.appendChild(bb)}
+   bb.innerHTML=escT(b.item)+"<em>"+escT(b.because||"")+"</em>";s4.appendChild(bb)}
   d.appendChild(s4)}
  if((r.unknowns||[]).length){const s5=document.createElement("div");s5.innerHTML="<h4>Ask them next</h4>";
   const p=document.createElement("p");p.textContent=r.unknowns.join(" \xB7 ");s5.appendChild(p);d.appendChild(s5)}
@@ -43340,7 +45309,7 @@ function pendingCard(c,state){const div=document.createElement("div");div.classN
  div.appendChild(head);
  const p=document.createElement("div");p.className="pendpanel";
  p.innerHTML="<strong>Account created \u2014 one 2-minute step left.</strong> GHL requires a key made inside the new sub-account:"+
-  "<ol><li>Open the new sub-account in GHL (switch into <em>"+c.name+"</em>)</li>"+
+  "<ol><li>Open the new sub-account in GHL (switch into <em>"+escT(c.name)+"</em>)</li>"+
   "<li>Settings \u2192 Private Integrations \u2192 Create New Integration \u2192 name it anything \u2192 Scopes: <strong>Select all</strong> \u2192 Create \u2192 Confirm</li>"+
   "<li>Copy the <code>pit-</code> key and paste it below</li></ol>";
  const inp=document.createElement("input");inp.placeholder="pit-\u2026";p.appendChild(inp);
@@ -43600,7 +45569,7 @@ function proofLine(p){const d=document.createElement("div");
  const when=new Date(p.at).toLocaleDateString(undefined,{month:"short",day:"numeric"});
  d.textContent=p.step+" \u2014 "+(bad?(p.issues.length+" to sort out: "+shorten(p.issues[0],120)):shorten(p.summary,150))+" \xB7 "+when;
  return d}
-function queueOpen(id){setActive(id);try{window.scrollTo({top:0,behavior:"smooth"})}catch(e){}}
+function queueOpen(id){activeId=id;try{localStorage.setItem("cmdos-active",id)}catch(e){};if(SCREEN!=="clients"){location.href="/clients";return}setActive(id);try{window.scrollTo({top:0,behavior:"smooth"})}catch(e){}}
 function queueRow(it){const row=document.createElement("div");row.className="q-row";
  row.setAttribute("role","button");row.tabIndex=0;
  const pill=document.createElement("span");pill.className=it.needs==="you"?"state warn":"state live";
@@ -43643,7 +45612,8 @@ function queueBlock(match){const q=queueData;if(!q||!q.ok)return null;
  const live=items.filter(i=>i.rank<6),later=items.filter(i=>i.rank>=6);
  const fin=(q.finished||[]).filter(f=>match({name:f.clientName,locationId:f.locationId}));
  const head=document.createElement("div");head.className="q-head";
- const eb=document.createElement("div");eb.className="eyebrow";eb.textContent="What needs doing";head.appendChild(eb);
+ head.id="queue";
+ const eb=document.createElement("div");eb.className="eyebrow";eb.textContent="Waiting on you";head.appendChild(eb);
  if(q.counts&&q.counts.you){const c=document.createElement("span");c.className="chip space";
   c.textContent=q.counts.you+" waiting on you";head.appendChild(c)}
  const who=document.createElement("span");who.className="q-who";
@@ -43679,31 +45649,114 @@ function syncReviews(state){const revs=(state&&state.reviews)||{};
   rData[id]=rv;
   if(!lastState){rSeen[id]=true}
   else if(rv&&rv.ok&&!had&&briefDone&&!rSeen[id]){rOpen[id]=true;rSeen[id]=true}}}
+/* \u2500\u2500 One capability, for the open client (Jerry, 2026-09-05) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 */
+let capReads=null,capReadsFor="",capRun=null,capPoll=null;
+function capClients(state){return ROSTER.filter(c=>["client","sandbox"].includes(typeOf(state,c.locationId)))}
+function capActive(state){const cs=capClients(state);let act=(activeId&&cs.some(c=>c.locationId===activeId))?activeId:null;if(!act&&cs.length)act=cs[0].locationId;return cs.find(c=>c.locationId===act)||null}
+async function loadCapReads(id){capReadsFor=id;capReads=null;try{capReads=await(await fetch("/api/capability?key="+encodeURIComponent(CAP.key)+"&locationId="+encodeURIComponent(id))).json()}catch(e){capReads={ok:false,error:String(e)}}if(lastState)render(lastState,lastRun)}
+function renderCapability(m,state,run){
+ const c=capActive(state);
+ const head=document.createElement("div");head.className="eyebrow";head.textContent=CAP.groupLabel;m.appendChild(head);
+ m.appendChild(screenHead(CAP.label,CAP.what));
+ if(!c){const d=document.createElement("div");d.className="client";d.innerHTML="<h2>No client account is open</h2><p style='margin-top:.4rem'>Register one in GHL Command or <a href='/new'>build a client account</a>, then come back here.</p>";m.appendChild(d);return}
+ /* Who this is for */
+ const who=document.createElement("div");who.className="toolbar";
+ const lbl=document.createElement("span");lbl.className="q-who";lbl.textContent="For ";who.appendChild(lbl);
+ const sel=document.createElement("select");sel.className="capsel";for(const cl of capClients(state)){const o=document.createElement("option");o.value=cl.locationId;o.textContent=cl.name;if(cl.locationId===c.locationId)o.selected=true;sel.appendChild(o)}
+ sel.onchange=()=>{capReads=null;capReadsFor="";setActive(sel.value)};who.appendChild(sel);m.appendChild(who);
+ const sc=document.getElementById("side-client");if(sc)sc.textContent=c.name;
+ /* Already in this account */
+ const eb=document.createElement("div");eb.className="eyebrow";eb.textContent="Already in this account";m.appendChild(eb);
+ const card=document.createElement("div");card.className="card pad cap-reads";
+ if(!CAP.reads.length){card.innerHTML="<p class='muted'>Nothing here is read back yet; the page cannot tell you what this account already has for this job. Ask Claude with the words below and it reads it live.</p>"}
+ else if(capReadsFor!==c.locationId){card.innerHTML="<p class='muted'>Reading this account\u2026</p>";loadCapReads(c.locationId)}
+ else if(!capReads||!capReads.ok){card.innerHTML="<p class='muted'></p>";card.querySelector("p").textContent=(capReads&&capReads.error)?capReads.error:"Could not read this account."}
+ else{for(const r of capReads.reads){const row=document.createElement("div");row.className="cap-row";
+   const n=document.createElement("b");n.textContent=r.status==="ok"?(r.count+" "+r.label):r.label;row.appendChild(n);
+   const t=document.createElement("span");t.className="muted";t.textContent=r.status==="ok"?(r.names.length?": "+r.names.slice(0,8).join(" \xB7 ")+(r.names.length>8?" \u2026":""):(r.count?"":": none yet")):(" \u2014 could not read: "+(r.reason||"unavailable"));row.appendChild(t);card.appendChild(row)}
+   if(CAP.blueprint){const bp=document.createElement("p");bp.className="muted";bp.style.marginTop=".6rem";bp.textContent="A full Blueprint build sets up: "+CAP.blueprint;card.appendChild(bp)}}
+ m.appendChild(card);
+ /* Do it now */
+ const eb2=document.createElement("div");eb2.className="eyebrow";eb2.textContent="Do it now";m.appendChild(eb2);
+ const doc=document.createElement("div");doc.className="card pad";
+ const words=CAP.says.split("{client}").join(c.name);
+ const q=document.createElement("blockquote");q.className="cap-words";q.textContent=words;doc.appendChild(q);
+ const row=document.createElement("div");row.className="row wrap";row.style.gap=".6rem";row.style.marginTop=".7rem";
+ const bb=document.createElement("button");bb.className="runbtn";bb.textContent="Build this for "+c.name;
+ const busy=run&&run.running;if(busy)bb.disabled=true;
+ if(CAP.noBuild){bb.disabled=true;bb.title="This one messages a real person, so it runs from your own Claude with you watching."}
+ bb.onclick=async()=>{bb.disabled=true;bb.textContent="Starting\u2026";
+  const r=await(await fetch("/api/run-capability",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({locationId:c.locationId,key:CAP.key})})).json();
+  if(!r.ok){alert(r.error||"Could not start");bb.disabled=false;bb.textContent="Build this for "+c.name;return}
+  capRun={locationId:c.locationId};pollCap()};
+ row.appendChild(bb);
+ const cp=document.createElement("button");cp.className="intakebtn";cp.textContent="Copy the words";cp.onclick=async()=>{try{await navigator.clipboard.writeText(words);cp.textContent="Copied"}catch(e){cp.textContent="Select and copy the text above"}setTimeout(()=>{cp.textContent="Copy the words"},2000)};row.appendChild(cp);
+ if(CAP.hub){const h=document.createElement("a");h.className="intakebtn";h.href=HUB+CAP.hub;h.target="_blank";h.rel="noopener";h.textContent="Step by step in the hub \u2197";row.appendChild(h)}
+ doc.appendChild(row);
+ const note=document.createElement("p");note.className="muted small";note.style.marginTop=".6rem";
+ note.textContent=CAP.noBuild?"No button for this one on purpose: it messages a real person. Paste the words into your own Claude and watch it work.":busy?"Another run is in progress. This button wakes up when it finishes.":"Build this runs through your own Claude account, with only the tools this job needs: the words above and what it reads from this account go to Claude, and nowhere else. Workflows are left as drafts; nothing is sent, posted or deleted; every id is read from this account first. Or paste the words into your own Claude and watch it work.";
+ doc.appendChild(note);
+ /* The run, live */
+ if(run&&run.capability===CAP.key&&run.locationId===c.locationId){const pre=document.createElement("pre");pre.className="cap-log";pre.textContent=(run.lines||[]).slice(-40).join(String.fromCharCode(10))||"Starting\u2026";doc.appendChild(pre);
+  if(run.running&&!capPoll)pollCap()}
+ const last=(state.capabilityRuns||{})[c.locationId+":"+CAP.key];
+ if(last){const l=document.createElement("p");l.className="muted small";l.style.marginTop=".5rem";l.textContent=(last.ok?"Last built ":"Last attempt ")+new Date(last.at).toLocaleString()+": "+(last.ok?"done. ":"did not finish. "+(last.error||"")+" ")+(last.summary||"")+(last.issues&&last.issues.length?" Waiting on a person: "+last.issues.join("; "):"");doc.appendChild(l)}
+ m.appendChild(doc)}
+function pollCap(){if(capPoll)return;capPoll=setInterval(async()=>{try{const r=await(await fetch("/api/run/status")).json();const s=await(await fetch("/api/state")).json();if(!r.running){clearInterval(capPoll);capPoll=null;capRun=null;capReads=null;capReadsFor=""}render(s,r)}catch(e){}},2000)}
+
+function screenHead(title,sub){const d=document.createElement("div");d.className="screen-head";d.innerHTML="<h1></h1><p class='lead'></p>";d.querySelector("h1").textContent=title;d.querySelector("p").textContent=sub;return d}
+/* The board's overview: where the work is waiting, in numbers, each one a door to its own page. */
+function homeBlock(state,run){const wrap=document.createElement("div");
+ wrap.appendChild(screenHead("Command OS","Everything here runs on this computer. Pick up where the work is waiting."));
+ const grid=document.createElement("div");grid.className="home";
+ const q=queueData&&queueData.ok?queueData:null;const you=q&&q.counts?(q.counts.you||0):0;const total=q?(q.items||[]).length:0;
+ const clients=ROSTER.filter(c=>["client","sandbox"].includes(typeOf(state,c.locationId)));
+ let act=(activeId&&clients.some(c=>c.locationId===activeId))?activeId:null;
+ if(!act&&run&&run.running&&clients.some(c=>c.locationId===run.locationId))act=run.locationId;if(!act&&clients.length)act=clients[0].locationId;
+ const actC=clients.find(c=>c.locationId===act);
+ let stage="";if(actC){const st=((state.clients||{})[actC.locationId]||{}).stages||[];const i=st.findIndex(s=>s!=="done");
+  stage=i<0?"Every stage is done":((run&&run.running&&run.locationId===actC.locationId)?"Building now: ":"Next: ")+(LABELS[i]||"")}
+ const tile=(eyebrow,big,text,href,cta)=>{const c=document.createElement("a");c.className="card tile";c.href=href;
+  c.innerHTML="<div class='eyebrow'></div><div class='big'></div><p></p><span class='go'></span>";
+  c.querySelector(".eyebrow").textContent=eyebrow;c.querySelector(".big").textContent=big;c.querySelector("p").textContent=text;c.querySelector(".go").textContent=cta;return c};
+ grid.appendChild(tile("Waiting on you",String(you),total?(total+" step"+(total===1?"":"s")+" in the queue, "+you+" need"+(you===1?"s":"")+" your hand"):"Nothing is waiting on you","/queue","Open the work queue \u2192"));
+ grid.appendChild(tile("Working on now",actC?actC.name:"\u2014",actC?stage:"No client account is open","/clients","Open client builds \u2192"));
+ grid.appendChild(tile("Client accounts",String(clients.length),clients.length===1?"One account on the board":"Accounts on the board, templates and hidden ones aside","/clients","See every account \u2192"));
+ grid.appendChild(tile("New client","+","Register the sub-account, then answer the intake","/new","Build a client account \u2192"));
+ wrap.appendChild(grid);return wrap}
 function render(state,run){syncReviews(state);lastState=state;lastRun=run;
  if(state&&state.protectedAccounts)PROTECTED=state.protectedAccounts;const m=document.getElementById("main");m.innerHTML="";
+ /* Four screens share this page's data and differ only in what they show. */
+ if(SCREEN==="new"){m.appendChild(screenHead("Build a client account","Register the sub-account, then answer the intake. The seven stages run from Client Builds."));
+  m.appendChild(newClientForm());
+  /* Step 2 on the same page: the intake for the client that is open, with the
+     document, link, transcript and recorder ways in (Jerry, 2026-09-05). */
+  const c0=capActive(state);
+  if(c0){const eb2=document.createElement("div");eb2.className="eyebrow";eb2.style.marginTop="1.4rem";eb2.textContent="Step 2 \u2014 the intake for "+c0.name;m.appendChild(eb2);
+   const pick=document.createElement("p");pick.className="small muted";pick.style.margin="0 0 .6rem";pick.textContent="A different client? Open it under Client Builds first.";m.appendChild(pick);
+   if(!iData[c0.locationId])iLoad(c0.locationId);
+   m.appendChild(intakeWorkspace(c0.locationId,c0.name))}
+  const ib=document.createElement("button");ib.className="intakebtn";ib.style.marginTop="1rem";ib.textContent=intakeOpen?"\xD7 Close the intake questions":"Intake questions";
+  ib.onclick=async()=>{intakeOpen=!intakeOpen;if(intakeOpen&&!intakeData)await loadIntake();else render(state,run)};m.appendChild(ib);
+  if(intakeOpen)m.appendChild(intakePanel());return}
+ if(SCREEN==="for"&&CAP){renderCapability(m,state,run);return}
  if(!ROSTER.length){const d=document.createElement("div");d.className="client";
-  d.innerHTML="<h2>No clients yet</h2><p style='margin-top:.4rem'>Register a sub-account in GHL Command and it appears here.</p>";m.appendChild(d);return}
+  d.innerHTML="<h2>No clients yet</h2><p style='margin-top:.4rem'>Register a sub-account in GHL Command and it appears here, or <a href='/new'>build a client account</a>.</p>";m.appendChild(d);return}
+ if(SCREEN==="board"){m.appendChild(homeBlock(state,run));return}
  const bar=document.createElement("div");bar.className="toolbar";
  const inp=document.createElement("input");inp.placeholder="Find a client\u2026";inp.value=query;
  inp.oninput=()=>{query=inp.value;render(state,run);const i2=document.querySelector(".toolbar input");i2.focus();i2.setSelectionRange(query.length,query.length)};
  bar.appendChild(inp);
- const nb=document.createElement("button");nb.className="newbtn";nb.textContent=showNew?"\xD7 Close":"\uFF0B New Client";
- nb.onclick=async()=>{showNew=!showNew;
-  if(showNew&&!snapshots){const r=await(await fetch("/api/snapshots")).json();snapshots=r.ok?r.snapshots:[]}
-  render(state,run)};
- bar.appendChild(nb);
- const sy=document.createElement("button");sy.className="intakebtn";sy.textContent="\u27F3 Sync";sy.title="Pull teammate updates from your GHL";
- sy.onclick=async()=>{sy.textContent="Syncing\u2026";const r=await(await fetch("/api/sync",{method:"POST",headers:{"Content-Type":"application/json"}})).json();
-  sy.textContent=r.adopted?("\u27F3 "+r.adopted+" updated"):"\u27F3 Up to date";setTimeout(()=>{sy.textContent="\u27F3 Sync"},2500);load()};
- bar.appendChild(sy);
- const ib=document.createElement("button");ib.className="intakebtn";ib.textContent=intakeOpen?"\xD7 Intake":"Intake questions";
- ib.onclick=async()=>{intakeOpen=!intakeOpen;if(intakeOpen&&!intakeData)await loadIntake();else render(state,run)};
- bar.appendChild(ib);m.appendChild(bar);
- if(showNew)m.appendChild(newClientForm());
- if(intakeOpen)m.appendChild(intakePanel());
+ if(SCREEN==="clients"){
+  const nb=document.createElement("a");nb.className="newbtn";nb.href="/new";nb.textContent="\uFF0B New Client";bar.appendChild(nb);
+  const sy=document.createElement("button");sy.className="intakebtn";sy.textContent="\u27F3 Sync";sy.title="Pull teammate updates from your GHL";
+  sy.onclick=async()=>{sy.textContent="Syncing\u2026";const r=await(await fetch("/api/sync",{method:"POST",headers:{"Content-Type":"application/json"}})).json();
+   sy.textContent=r.adopted?("\u27F3 "+r.adopted+" updated"):"\u27F3 Up to date";setTimeout(()=>{sy.textContent="\u27F3 Sync"},2500);load()};
+  bar.appendChild(sy)}
+ m.appendChild(bar);
  const q=query.trim().toLowerCase();
  const match=(c)=>!q||c.name.toLowerCase().includes(q)||c.locationId.toLowerCase().includes(q);
- const qb=queueBlock(match);if(qb)m.appendChild(qb);
+ if(SCREEN==="queue"){const qb=queueBlock(match);if(qb)m.appendChild(qb);else{const d=document.createElement("div");d.className="client";d.innerHTML="<h2>Nothing is waiting on you</h2>";m.appendChild(d)}return}
  const sorted=[...ROSTER].sort((a,b)=>activityScore(state,b.locationId)-activityScore(state,a.locationId)||a.name.localeCompare(b.name));
  const board=sorted.filter(c=>match(c)&&["client","sandbox"].includes(typeOf(state,c.locationId)));
  const parked=sorted.filter(c=>match(c)&&["template","hidden"].includes(typeOf(state,c.locationId)));
@@ -43720,10 +45773,10 @@ function render(state,run){syncReviews(state);lastState=state;lastRun=run;
    const tx=document.createElement("span");tx.style.fontSize="var(--fs-sm)";tx.textContent=other.name+" \u2014 "+(LABELS[run.stage]||"")+" is running.";ban.appendChild(tx);
    const go2=document.createElement("button");go2.className="intakebtn";go2.style.marginLeft="auto";go2.textContent="Watch it";
    go2.onclick=()=>setActive(other.locationId);ban.appendChild(go2);m.appendChild(ban)}}
- if(actC){const eb=document.createElement("div");eb.className="eyebrow";eb.textContent="Working on now";m.appendChild(eb);
+ if(actC){const eb=document.createElement("div");eb.className="eyebrow";eb.id="clients";eb.textContent="Working on now";m.appendChild(eb);
   m.appendChild(actC.pending?pendingCard(actC,state):card(actC,state,run))}
  const rest=board.filter(c=>c.locationId!==act);
- if(rest.length){const eb2=document.createElement("div");eb2.className="eyebrow";eb2.textContent="Your other accounts";m.appendChild(eb2);
+ if(rest.length){const eb2=document.createElement("div");eb2.className="eyebrow";if(!actC)eb2.id="clients";eb2.textContent=actC?"Your other client accounts":"Your client accounts";m.appendChild(eb2);
   const list=document.createElement("div");list.className="card acct-list";
   for(const c of rest)list.appendChild(acctRow(c,state,run));
   m.appendChild(list);
@@ -43783,6 +45836,24 @@ function checkMutationGuard(req, port) {
   }
   return null;
 }
+function cockpitGate(req, seatToken, port) {
+  const denied = checkMutationGuard(req, port) ?? checkSeatToken(req, seatToken);
+  if (denied) return denied;
+  const pathname = (req.url ?? "/").split("?")[0];
+  if (SEAT_GUARDED_READS.includes(pathname)) return checkSeatToken({ method: "POST", headers: req.headers }, seatToken);
+  return null;
+}
+function guarded(seatToken, port, routes) {
+  return (req, res) => {
+    const denied = cockpitGate(req, seatToken, port);
+    if (denied) {
+      res.writeHead(denied.status, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ ok: false, error: denied.error }));
+      return;
+    }
+    routes(req, res);
+  };
+}
 async function runDashboard(argv) {
   const portArg = argv.find((a) => a.startsWith("--port="));
   const port = portArg ? Number(portArg.split("=")[1]) : 7300;
@@ -43834,6 +45905,7 @@ async function runDashboard(argv) {
     }
     return process.env.GHL_COMPANY_ID;
   };
+  currentRosterRef = () => currentRoster();
   const clientFor = (locationId2) => {
     const tok = registry2.getToken(locationId2);
     return tok?.apiKey ? new GHLClient({ apiKey: tok.apiKey, locationId: locationId2 }) : void 0;
@@ -43892,26 +45964,178 @@ async function runDashboard(argv) {
     const pend = Object.entries(readCockpitState().pending ?? {}).filter(([id]) => !ids.has(id)).map(([locationId2, p]) => ({ locationId: locationId2, name: p.name, pending: true }));
     return [...registered, ...pend];
   };
-  const server2 = http.createServer((req, res) => {
+  const server2 = http.createServer(guarded(seatToken, port, (req, res) => {
     const url = req.url || "/";
-    const denied = checkMutationGuard(req, port) ?? checkSeatToken(req, seatToken);
-    if (denied) {
-      res.writeHead(denied.status, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ ok: false, error: denied.error }));
+    if (req.method === "GET" && url.startsWith("/for/")) {
+      const cap = capabilityByKey(url.slice("/for/".length).replace(/\/$/, ""));
+      if (!cap) {
+        res.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
+        res.end("No such page. The sidebar lists every one.");
+        return;
+      }
+      res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+      res.end(html(currentRoster(), isLoopback(req) ? seatToken : "", "for", cap));
       return;
     }
-    if (req.method === "GET" && url === "/") {
-      res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-      res.end(html(currentRoster(), isLoopback(req) ? seatToken : ""));
+    if (req.method === "GET" && url.startsWith("/api/capability")) {
+      const u = new URL(req.url ?? "/", "http://127.0.0.1");
+      const cap = capabilityByKey(u.searchParams.get("key") ?? "");
+      const locationId2 = u.searchParams.get("locationId") ?? "";
+      const seat = checkSeatToken({ method: "POST", headers: req.headers }, seatToken);
+      if (seat) {
+        res.writeHead(seat.status, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: seat.error }));
+        return;
+      }
+      res.writeHead(200, { "Content-Type": "application/json" });
+      if (!cap) {
+        res.end(JSON.stringify({ ok: false, error: "no such capability" }));
+        return;
+      }
+      if (!readableAccount(locationId2)) {
+        res.end(JSON.stringify({ ok: false, error: "That account is not on the board." }));
+        return;
+      }
+      const c = clientFor(locationId2);
+      if (!c) {
+        res.end(JSON.stringify({ ok: false, error: "No key on file for this account. Register it in GHL Command first." }));
+        return;
+      }
+      void (async () => {
+        const reads = await Promise.all(cap.reads.map(async (r) => {
+          const p = r.path.replace(/\{loc\}/g, locationId2);
+          const params = r.params ? Object.fromEntries(Object.entries(r.params).map(([k, v]) => [k, v.replace(/\{loc\}/g, locationId2)])) : void 0;
+          try {
+            const raw = await c.get(p, { ...params ? { params } : {}, ...r.version ? { version: r.version } : {} });
+            const items = findArray(raw, r.key);
+            if (!items) {
+              logQuietly(`capability read ${cap.key}/${r.label}: unrecognised shape from ${p}`);
+              return { label: r.label, status: "unavailable", count: 0, names: [], reason: "could not read: the answer had a shape this page does not know" };
+            }
+            return { label: r.label, status: "ok", count: items.length, names: items.map((i) => nameOf(i, r.nameField)).filter(Boolean) };
+          } catch (e) {
+            logQuietly(`capability read ${cap.key}/${r.label} on ${locationId2}: ${e instanceof Error ? e.message : String(e)}`);
+            return { label: r.label, status: "unavailable", count: 0, names: [], reason: readFailureText(e) };
+          }
+        }));
+        res.end(JSON.stringify({ ok: true, key: cap.key, locationId: locationId2, reads }));
+      })();
       return;
     }
-    if ((req.method === "GET" || req.method === "HEAD") && (url === "/assessment" || url === "/assessment.html")) {
-      const page = assessmentPagePath();
-      if (!page) {
-        res.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
-        res.end("The assessment page is not in this install. Update GHL Command and restart the cockpit.");
+    if (req.method === "POST" && url === "/api/run-capability") {
+      readBody(req, res, 1e4, (body) => {
+        res.writeHead(200, { "Content-Type": "application/json" });
+        try {
+          const { locationId: locationId2, key } = JSON.parse(body || "{}");
+          const cap = capabilityByKey(String(key ?? ""));
+          if (!cap) throw new Error("no such capability");
+          if (activeRun2?.running) throw new Error("a run is already in progress");
+          const st = readCockpitState();
+          const client = currentRoster().find((r) => r.locationId === locationId2);
+          if (!client) throw new Error("that account is not on the board");
+          const approvedAt = st.buildApproved?.[locationId2];
+          startRun(locationId2, -1, (ok, outcome) => {
+            try {
+              const now = readCockpitState();
+              const last = activeRun2;
+              const runs = { ...now.capabilityRuns ?? {} };
+              const done = (last?.lines ?? []).filter((l) => /^Done[:.]/.test(l)).pop() ?? "";
+              runs[`${locationId2}:${cap.key}`] = {
+                at: (/* @__PURE__ */ new Date()).toISOString(),
+                ok,
+                summary: outcome?.plain?.summary ?? outcome?.summary ?? done.replace(/^Done[:.]\s*/, ""),
+                issues: outcome?.plain?.issues ?? outcome?.issues ?? [],
+                error: ok ? void 0 : outcome?.error ?? "the run did not finish"
+              };
+              writeCockpitState({ ...now, capabilityRuns: runs });
+            } catch {
+            }
+          }, { name: client.name, approvedAt, spec: capabilitySpec(cap, client.name), capability: cap.key });
+          res.end(JSON.stringify({ ok: true }));
+        } catch (e) {
+          res.end(JSON.stringify({ ok: false, error: e instanceof Error ? e.message : String(e) }));
+        }
+      });
+      return;
+    }
+    if (req.method === "POST" && url === "/api/assessment-save") {
+      readBody(req, res, 2e6, (body) => {
+        void (async () => {
+          res.writeHead(200, { "Content-Type": "application/json" });
+          try {
+            const args = JSON.parse(body || "{}");
+            const locationId2 = String(args.locationId ?? "");
+            if (!currentRoster().some((r) => r.locationId === locationId2)) throw new Error("Pick which account this assessment belongs to first.");
+            const c = clientFor(locationId2);
+            if (!c) throw new Error("No key on file for that account. Register it in GHL Command first.");
+            const assessment = StateSchema.parse(args.assessment);
+            const out = await saveAssessment(c, locationId2, {
+              assessment,
+              contactName: args.contactName || void 0,
+              email: args.email || void 0,
+              phone: args.phone || void 0,
+              createPipeline: args.createPipeline === true
+            });
+            res.end(JSON.stringify({ ok: true, ...out }));
+          } catch (e) {
+            res.end(JSON.stringify({ ok: false, error: e instanceof Error ? e.message : String(e) }));
+          }
+        })();
+      });
+      return;
+    }
+    if (req.method === "GET" && url.startsWith("/api/intake-documents")) {
+      const u = new URL(req.url ?? "/", "http://127.0.0.1");
+      const seat = checkSeatToken({ method: "POST", headers: req.headers }, seatToken);
+      if (seat) {
+        res.writeHead(seat.status, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: seat.error }));
+        return;
+      }
+      res.writeHead(200, { "Content-Type": "application/json" });
+      const loc = u.searchParams.get("locationId") ?? "";
+      if (!readableAccount(loc)) {
+        res.end(JSON.stringify({ ok: false, error: "That account is not on the board." }));
         return;
       }
+      try {
+        res.end(JSON.stringify({ ok: true, files: listClientDocs(loc) }));
+      } catch (e) {
+        logQuietly(`list documents ${loc}: ${e instanceof Error ? e.message : String(e)}`);
+        res.end(JSON.stringify({ ok: false, error: "Could not list this client's documents." }));
+      }
+      return;
+    }
+    if (req.method === "POST" && url === "/api/intake-document") {
+      readBody(req, res, Math.ceil(DOC_MAX_BYTES * 1.4), (body) => {
+        res.writeHead(200, { "Content-Type": "application/json" });
+        try {
+          const args = JSON.parse(body || "{}");
+          if (!readableAccount(String(args.locationId ?? ""))) throw new Error("That account is not on the board.");
+          const name = safeDocName(args.name);
+          const bytes = Buffer.from(String(args.base64 ?? ""), "base64");
+          if (!bytes.length) throw new Error("that file is empty");
+          if (bytes.length > DOC_MAX_BYTES) throw new Error("that file is over 20 MB");
+          const dir = clientDocsDir(args.locationId);
+          fs32.mkdirSync(dir, { recursive: true, mode: 448 });
+          if (!insideDir(path31.join(appDataDir(), "clients"), dir)) throw new Error("This client's documents folder is not where it should be, so nothing was saved.");
+          const saved = writeDocAtomically(dir, name, bytes);
+          res.end(JSON.stringify({ ok: true, name: saved, files: listClientDocs(args.locationId) }));
+        } catch (e) {
+          logQuietly(`save document: ${e instanceof Error ? e.message : String(e)}`);
+          const msg3 = e instanceof Error ? e.message : String(e);
+          res.end(JSON.stringify({ ok: false, error: /\/|\\/.test(msg3) ? "That file could not be saved." : msg3 }));
+        }
+      });
+      return;
+    }
+    const boardScreen = BOARD_ROUTES[url];
+    if (req.method === "GET" && boardScreen) {
+      res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+      res.end(html(currentRoster(), isLoopback(req) ? seatToken : "", boardScreen));
+      return;
+    }
+    if ((req.method === "GET" || req.method === "HEAD") && (url === "/assessment" || url === "/assessment.html")) {
       res.writeHead(200, {
         "Content-Type": "text/html; charset=utf-8",
         // It holds another business's revenue and close rate the moment it is
@@ -43919,23 +46143,33 @@ async function runDashboard(argv) {
         "Cache-Control": "no-store",
         "X-Robots-Tag": "noindex, nofollow"
       });
-      res.end(req.method === "HEAD" ? void 0 : withCockpitShell(fs32.readFileSync(page, "utf8"), "assessment"));
+      const roster2 = currentRoster().map((r) => ({ locationId: r.locationId, name: r.name }));
+      const clientsTag = `<script>window.COMMAND_OS_CLIENTS=${scriptJson(roster2)};window.COMMAND_OS_SEAT=${scriptJson(isLoopback(req) ? seatToken : "")};</script>`;
+      res.end(req.method === "HEAD" ? void 0 : withCockpitShell(ASSESSMENT_HTML, "assessment", assessmentAgencyTag() + clientsTag));
       return;
     }
     if (req.method === "GET" && url === "/api/snapshots") {
+      const seat = checkSeatToken({ method: "POST", headers: req.headers }, seatToken);
+      if (seat) {
+        res.writeHead(seat.status, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: seat.error }));
+        return;
+      }
       (async () => {
         try {
           const agencyKey = registry2.getAgencyKey();
           const companyId = agencyCompanyId();
-          if (!agencyKey || !companyId) throw new Error("agency key or company id missing \u2014 run register_agency_key");
+          if (!agencyKey || !companyId) throw new Error(NEEDS_AGENCY_KEY);
           const agencyClient = new GHLClient({ apiKey: agencyKey });
           const raw = await agencyClient.get("/snapshots/", { params: { companyId } });
           const snaps = (raw.snapshots ?? []).sort((a, b) => (a.type === "own" ? 0 : 1) - (b.type === "own" ? 0 : 1) || a.name.localeCompare(b.name));
           res.writeHead(200, { "Content-Type": "application/json" });
           res.end(JSON.stringify({ ok: true, snapshots: snaps }));
         } catch (e) {
-          res.writeHead(500, { "Content-Type": "application/json" });
-          res.end(JSON.stringify({ ok: false, error: e instanceof Error ? e.message : "snapshot list failed" }));
+          const shown = memberFacingError(e, [NEEDS_AGENCY_KEY]);
+          logQuietly(`snapshot list: ${e instanceof Error ? e.message : String(e)}`);
+          res.writeHead(shown === NEEDS_AGENCY_KEY ? 400 : 500, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: false, error: shown === NEEDS_AGENCY_KEY ? shown : `Could not list your snapshots: ${shown}.` }));
         }
       })();
       return;
@@ -43963,12 +46197,7 @@ async function runDashboard(argv) {
       return;
     }
     if (req.method === "POST" && url === "/api/run") {
-      let body = "";
-      req.on("data", (c) => {
-        body += c;
-        if (body.length > 1e4) req.destroy();
-      });
-      req.on("end", () => {
+      readBody(req, res, 1e4, (body) => {
         try {
           const { locationId: locationId2, stage } = JSON.parse(body);
           if (activeRun2?.running) throw new Error("a run is already in progress");
@@ -44014,12 +46243,7 @@ async function runDashboard(argv) {
       return;
     }
     if (req.method === "POST" && url === "/api/overlay") {
-      let body = "";
-      req.on("data", (c) => {
-        body += c;
-        if (body.length > 1e5) req.destroy();
-      });
-      req.on("end", () => {
+      readBody(req, res, 1e5, (body) => {
         try {
           const layer = JSON.parse(body);
           if (typeof layer !== "object" || layer === null) throw new Error("bad overlay");
@@ -44037,6 +46261,13 @@ async function runDashboard(argv) {
       (async () => {
         try {
           const locationId2 = new URL(url, "http://x").searchParams.get("locationId") || "";
+          const seat = checkSeatToken({ method: "POST", headers: req.headers }, seatToken);
+          if (seat) {
+            res.writeHead(seat.status, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ ok: false, error: seat.error }));
+            return;
+          }
+          if (!readableAccount(locationId2)) throw new Error("That account is not on the board.");
           const c = clientFor(locationId2);
           if (!c) throw new Error("this client isn't connected yet \u2014 paste its key first");
           const st = readCockpitState();
@@ -44047,18 +46278,14 @@ async function runDashboard(argv) {
           res.end(JSON.stringify({ ok: true, ...snap, questions }));
         } catch (e) {
           res.writeHead(400, { "Content-Type": "application/json" });
-          res.end(JSON.stringify({ ok: false, error: e instanceof Error ? e.message : "failed" }));
+          logQuietly(`client-intake ${new URL(url, "http://x").searchParams.get("locationId") || ""}: ${e instanceof Error ? e.message : String(e)}`);
+          res.end(JSON.stringify({ ok: false, error: memberFacingError(e, INTAKE_OWN_MESSAGES) }));
         }
       })();
       return;
     }
     if (req.method === "POST" && url === "/api/intake-prefill-url") {
-      let body = "";
-      req.on("data", (c) => {
-        body += c;
-        if (body.length > 2e5) req.destroy();
-      });
-      req.on("end", async () => {
+      readBody(req, res, 2e5, async (body) => {
         try {
           const args = JSON.parse(body);
           const c = clientFor(args.locationId);
@@ -44076,18 +46303,22 @@ async function runDashboard(argv) {
       return;
     }
     if (req.method === "POST" && (url === "/api/intake-submit" || url === "/api/intake-send" || url === "/api/intake-prefill")) {
-      let body = "";
-      req.on("data", (c) => {
-        body += c;
-        if (body.length > 4e5) req.destroy();
-      });
-      req.on("end", async () => {
+      readBody(req, res, 4e5, async (body) => {
         try {
           const args = JSON.parse(body);
           const c = clientFor(args.locationId);
           if (!c) throw new Error("this client isn't connected yet");
           if (url === "/api/intake-prefill") {
-            const source = args.url ? { kind: "url", url: String(args.url) } : args.instruction ? { kind: "recorder", instruction: String(args.instruction) } : { kind: "text", text: String(args.transcript ?? "") };
+            let fileSource = null;
+            if (args.file) {
+              const name = safeDocName(args.file);
+              const dir = clientDocsDir(args.locationId);
+              const p = path31.join(dir, name);
+              if (!fs32.existsSync(p)) throw new Error("that document is not saved for this client");
+              if (fs32.lstatSync(p).isSymbolicLink() || !insideDir(dir, p)) throw new Error("that document is not saved for this client");
+              fileSource = { kind: "file", path: p, name };
+            }
+            const source = fileSource ? fileSource : args.url ? { kind: "url", url: String(args.url) } : args.instruction ? { kind: "recorder", instruction: String(args.instruction) } : { kind: "text", text: String(args.transcript ?? "") };
             let recorderPatterns = [];
             if (source.kind === "recorder") {
               recorderPatterns = await new Promise((resolve11) => {
@@ -44195,12 +46426,7 @@ async function runDashboard(argv) {
       return;
     }
     if (req.method === "POST" && url === "/api/design/run") {
-      let body = "";
-      req.on("data", (c) => {
-        body += c;
-        if (body.length > 6e4) req.destroy();
-      });
-      req.on("end", () => {
+      readBody(req, res, 6e4, (body) => {
         try {
           const checked = validateRunRequest(JSON.parse(body || "{}"));
           if (!checked.ok) {
@@ -44226,12 +46452,7 @@ async function runDashboard(argv) {
       return;
     }
     if (req.method === "POST" && url === "/api/design/cancel") {
-      let body = "";
-      req.on("data", (c) => {
-        body += c;
-        if (body.length > 4e3) req.destroy();
-      });
-      req.on("end", () => {
+      readBody(req, res, 4e3, (body) => {
         const id = (() => {
           try {
             return String(JSON.parse(body || "{}").id ?? "");
@@ -44246,12 +46467,7 @@ async function runDashboard(argv) {
       return;
     }
     if (req.method === "POST" && (url === "/api/brand/extract" || url === "/api/brand/import-look" || url === "/api/brand/set")) {
-      let body = "";
-      req.on("data", (c) => {
-        body += c;
-        if (body.length > 12e4) req.destroy();
-      });
-      req.on("end", () => {
+      readBody(req, res, 12e4, (body) => {
         void (async () => {
           try {
             const a = JSON.parse(body || "{}");
@@ -44310,8 +46526,11 @@ async function runDashboard(argv) {
             }
             let logoSvg;
             if (typeof a.logoSvg === "string" && a.logoSvg.trim()) {
-              if (!/^\s*<svg[\s\S]*<\/svg>\s*$/i.test(a.logoSvg) || a.logoSvg.length > 6e4) throw new Error("The logo must be one <svg>\u2026</svg> under 60 KB. Nothing was changed.");
-              logoSvg = a.logoSvg.trim();
+              try {
+                logoSvg = sanitizeSvg(a.logoSvg);
+              } catch (e) {
+                throw new Error(`${e.message} Nothing was changed.`);
+              }
               d.logo = { inlineSvg: logoSvg, whiteFillFixed: false, source: `set by ${stamp}`, rights: "declared" };
               d.provenance.evidence["logo"] = `set by ${stamp}`;
             }
@@ -44336,12 +46555,7 @@ async function runDashboard(argv) {
       return;
     }
     if (req.method === "POST" && url === "/api/client-engagement") {
-      let body = "";
-      req.on("data", (c) => {
-        body += c;
-        if (body.length > 2e4) req.destroy();
-      });
-      req.on("end", () => {
+      readBody(req, res, 2e4, (body) => {
         try {
           const { locationId: locationId2, ...patch } = JSON.parse(body);
           const savedAll = writeClientEngagement(String(locationId2 ?? ""), patch);
@@ -44379,12 +46593,7 @@ async function runDashboard(argv) {
       return;
     }
     if (req.method === "POST" && url === "/api/build-approval") {
-      let body = "";
-      req.on("data", (c) => {
-        body += c;
-        if (body.length > 5e3) req.destroy();
-      });
-      req.on("end", () => {
+      readBody(req, res, 5e3, (body) => {
         try {
           const { locationId: locationId2, confirmName, revoke } = JSON.parse(body);
           const entry = currentRoster().find((r) => r.locationId === locationId2);
@@ -44404,12 +46613,7 @@ async function runDashboard(argv) {
       return;
     }
     if (req.method === "POST" && url === "/api/protect") {
-      let body = "";
-      req.on("data", (c) => {
-        body += c;
-        if (body.length > 5e3) req.destroy();
-      });
-      req.on("end", () => {
+      readBody(req, res, 5e3, (body) => {
         try {
           const { locationId: locationId2, protect, confirmName } = JSON.parse(body);
           const entry = currentRoster().find((r) => r.locationId === locationId2);
@@ -44433,12 +46637,7 @@ async function runDashboard(argv) {
       return;
     }
     if (req.method === "POST" && url === "/api/manual-task") {
-      let body = "";
-      req.on("data", (c) => {
-        body += c;
-        if (body.length > 5e3) req.destroy();
-      });
-      req.on("end", () => {
+      readBody(req, res, 5e3, (body) => {
         try {
           const { locationId: locationId2, id, claimed } = JSON.parse(body);
           if (!currentRoster().some((r) => r.locationId === locationId2)) throw new Error("unknown client");
@@ -44469,12 +46668,7 @@ async function runDashboard(argv) {
       return;
     }
     if (req.method === "POST" && url === "/api/anthropic-key") {
-      let body = "";
-      req.on("data", (c) => {
-        body += c;
-        if (body.length > 8e3) req.destroy();
-      });
-      req.on("end", () => {
+      readBody(req, res, 8e3, (body) => {
         anthropicKeyWrites = anthropicKeyWrites.then(async () => {
           try {
             let parsed;
@@ -44538,12 +46732,7 @@ async function runDashboard(argv) {
       return;
     }
     if (req.method === "POST" && url === "/api/agency-profile") {
-      let body = "";
-      req.on("data", (c) => {
-        body += c;
-        if (body.length > 4e4) req.destroy();
-      });
-      req.on("end", () => {
+      readBody(req, res, 4e4, (body) => {
         try {
           const saved = writeAgencyProfile(JSON.parse(body));
           const st = readCockpitState();
@@ -44558,12 +46747,7 @@ async function runDashboard(argv) {
       return;
     }
     if (req.method === "POST" && url === "/api/branding") {
-      let body = "";
-      req.on("data", (c) => {
-        body += c;
-        if (body.length > 5e3) req.destroy();
-      });
-      req.on("end", () => {
+      readBody(req, res, 5e3, (body) => {
         try {
           const { agencyName, agencyAccent } = JSON.parse(body);
           const st = readCockpitState();
@@ -44579,12 +46763,7 @@ async function runDashboard(argv) {
       return;
     }
     if (req.method === "POST" && url === "/api/review") {
-      let body = "";
-      req.on("data", (c) => {
-        body += c;
-        if (body.length > 2e4) req.destroy();
-      });
-      req.on("end", async () => {
+      readBody(req, res, 2e4, async (body) => {
         try {
           const { locationId: locationId2, clientName } = JSON.parse(body);
           const review = await writeReviewFor(locationId2, clientName || locationId2);
@@ -44600,12 +46779,7 @@ async function runDashboard(argv) {
       return;
     }
     if (req.method === "POST" && url === "/api/new-client") {
-      let body = "";
-      req.on("data", (c) => {
-        body += c;
-        if (body.length > 2e4) req.destroy();
-      });
-      req.on("end", async () => {
+      readBody(req, res, 2e4, async (body) => {
         try {
           const args = JSON.parse(body);
           if (!args.name || typeof args.name !== "string") throw new Error("business name is required");
@@ -44637,12 +46811,7 @@ async function runDashboard(argv) {
       return;
     }
     if (req.method === "POST" && url === "/api/register-location") {
-      let body = "";
-      req.on("data", (c) => {
-        body += c;
-        if (body.length > 1e4) req.destroy();
-      });
-      req.on("end", async () => {
+      readBody(req, res, 1e4, async (body) => {
         try {
           const { locationId: locationId2, apiKey: apiKey2 } = JSON.parse(body);
           const pendingEntry = readCockpitState().pending?.[locationId2];
@@ -44662,12 +46831,7 @@ async function runDashboard(argv) {
       return;
     }
     if (req.method === "POST" && url === "/api/pending-remove") {
-      let body = "";
-      req.on("data", (c) => {
-        body += c;
-        if (body.length > 1e4) req.destroy();
-      });
-      req.on("end", () => {
+      readBody(req, res, 1e4, (body) => {
         try {
           const { locationId: locationId2 } = JSON.parse(body);
           writeCockpitState(clearPending(readCockpitState(), locationId2));
@@ -44689,12 +46853,7 @@ async function runDashboard(argv) {
       return;
     }
     if (req.method === "POST" && url === "/api/industry") {
-      let body = "";
-      req.on("data", (c) => {
-        body += c;
-        if (body.length > 1e4) req.destroy();
-      });
-      req.on("end", () => {
+      readBody(req, res, 1e4, (body) => {
         try {
           const { locationId: locationId2, industry } = JSON.parse(body);
           if (!currentRoster().some((r) => r.locationId === locationId2)) throw new Error("unknown client");
@@ -44709,12 +46868,7 @@ async function runDashboard(argv) {
       return;
     }
     if (req.method === "POST" && url === "/api/account") {
-      let body = "";
-      req.on("data", (c) => {
-        body += c;
-        if (body.length > 1e4) req.destroy();
-      });
-      req.on("end", () => {
+      readBody(req, res, 1e4, (body) => {
         try {
           const { locationId: locationId2, type } = JSON.parse(body);
           if (!currentRoster().some((r) => r.locationId === locationId2)) throw new Error("unknown client");
@@ -44729,12 +46883,7 @@ async function runDashboard(argv) {
       return;
     }
     if (req.method === "POST" && url === "/api/stage") {
-      let body = "";
-      req.on("data", (c) => {
-        body += c;
-        if (body.length > 1e4) req.destroy();
-      });
-      req.on("end", () => {
+      readBody(req, res, 1e4, (body) => {
         try {
           const { locationId: locationId2, stage, status, by } = JSON.parse(body);
           if (!currentRoster().some((r) => r.locationId === locationId2)) throw new Error("unknown client");
@@ -44773,7 +46922,7 @@ async function runDashboard(argv) {
     }
     res.writeHead(404);
     res.end();
-  });
+  }));
   try {
     await new Promise((resolve11, reject) => {
       server2.once("error", reject);
@@ -44809,7 +46958,7 @@ async function runDashboard(argv) {
     process.on("SIGTERM", stop);
   });
 }
-var fs32, path31, http, import_child_process5, import_child_process6, osmod, STAGES2, ACCOUNT_TYPES, activeRun2, UPGRADE_MSG, anthropicKeyWrites, SEAT_TOKEN_HEADER, NOT_SIGNED_IN_MSG;
+var fs32, path31, http, import_child_process5, import_child_process6, osmod, STAGES2, ACCOUNT_TYPES, activeRun2, UPGRADE_MSG, DOC_EXTS, DOC_MAX_BYTES, NEEDS_AGENCY_KEY, INTAKE_OWN_MESSAGES, currentRosterRef, BOARD_ROUTES, BOARD_TITLES, anthropicKeyWrites, SEAT_TOKEN_HEADER, NOT_SIGNED_IN_MSG, SEAT_GUARDED_READS;
 var init_dashboard = __esm({
   "src/dashboard.ts"() {
     "use strict";
@@ -44839,6 +46988,7 @@ var init_dashboard = __esm({
     init_agency_profile_page();
     init_cockpit_shell();
     init_anthropic_key();
+    init_app_html();
     init_cli();
     init_brand_page();
     init_store();
@@ -44855,9 +47005,14 @@ var init_dashboard = __esm({
     init_stage_runner();
     import_child_process6 = require("child_process");
     init_ghl_client();
+    init_client_capabilities();
+    init_capability_runs();
+    init_assessment();
     init_shared_brain();
     init_work_queue();
     osmod = __toESM(require("os"));
+    init_script_json();
+    init_svg_sanitize();
     STAGES2 = [
       "Intake",
       "Brief",
@@ -44870,9 +47025,22 @@ var init_dashboard = __esm({
     ACCOUNT_TYPES = ["client", "sandbox", "template", "hidden"];
     activeRun2 = null;
     UPGRADE_MSG = "\n  The cockpit is not included in this licence, so it did not start.\n  Nothing was changed.\n\n";
+    DOC_EXTS = /* @__PURE__ */ new Set([".pdf", ".docx", ".doc", ".md", ".txt", ".rtf", ".csv"]);
+    DOC_MAX_BYTES = 20 * 1024 * 1024;
+    NEEDS_AGENCY_KEY = "No agency key on file. Run register_agency_key in GHL Command first.";
+    INTAKE_OWN_MESSAGES = ["That account is not on the board.", "this client isn't connected yet \u2014 paste its key first"];
+    currentRosterRef = () => [];
+    BOARD_ROUTES = { "/": "board", "/new": "new", "/queue": "queue", "/clients": "clients" };
+    BOARD_TITLES = {
+      board: "Command OS \u2014 GHL Command",
+      new: "Build a Client Account \u2014 Command OS",
+      queue: "Work Queue \u2014 Command OS",
+      clients: "Client Builds \u2014 Command OS"
+    };
     anthropicKeyWrites = Promise.resolve();
     SEAT_TOKEN_HEADER = "x-command-os-seat";
     NOT_SIGNED_IN_MSG = "This browser isn't signed in to Command OS on this computer. Open Command OS on the machine it runs on, and use the page it opens for you.";
+    SEAT_GUARDED_READS = ["/api/capability", "/api/client-intake", "/api/intake-documents", "/api/snapshots"];
   }
 });
 
@@ -45432,7 +47600,7 @@ function preflightWritable() {
   }
 }
 function restartReminder() {
-  errLine("Note: if the MCP server is currently running, restart it to pick up this change");
+  errLine("Note: if GHL Command is currently running, restart it to pick up this change");
   errLine("(registry writes are last-writer-wins across processes \u2014 seed stopped, or restart after).");
 }
 function confirmSaved(registry2) {
@@ -45741,7 +47909,7 @@ Subcommands:
   list-locations             Print registered locations / companies (never prints keys)
 
 Exit codes: 0 ok, 2 usage, 3 validation failed, 4 filesystem write failed.
-Seed while the MCP server is stopped, or restart it afterwards.`;
+Seed while GHL Command is stopped, or restart it afterwards.`;
   }
 });
 
@@ -45750,7 +47918,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@elitedcs/ghl-mcp",
-      version: "3.81.0",
+      version: "3.82.0",
       mcpName: "io.github.drjerryrelth/ghl-command",
       description: "GoHighLevel MCP Server for Claude. 250 tools \u2014 full CRM, automation, marketing control, account-wide workflow audit, live funnel-capture verification, and the only programmatic GHL workflow builder, now multi-tenant across client accounts.",
       main: "dist/index.js",
@@ -45774,7 +47942,7 @@ var require_package = __commonJS({
         "!skills/blueprint/presets/clinic-launch-a2p.md"
       ],
       scripts: {
-        build: "esbuild src/index.ts --bundle --platform=node --target=node20 --format=cjs --outfile=dist/index.js --packages=external && esbuild src/capture-helper.ts --bundle --platform=node --target=node20 --format=cjs --outfile=dist/capture-helper.js --packages=external && node src/command-os/assessment/build-app.mjs && cp src/command-os/assessment/app.html dist/assessment.html",
+        build: "node src/command-os/assessment/build-app.mjs && esbuild src/index.ts --bundle --platform=node --target=node20 --format=cjs --outfile=dist/index.js --packages=external && esbuild src/capture-helper.ts --bundle --platform=node --target=node20 --format=cjs --outfile=dist/capture-helper.js --packages=external",
         setup: "node setup-wizard.mjs",
         catalogue: "node scripts/export-command-os-catalogue.mjs",
         "manifest:write": "node scripts/write-package-manifest.mjs",
@@ -45828,6 +47996,7 @@ var require_package = __commonJS({
         "@clack/prompts": "^1.1.0",
         "@types/node": "^26.2.0",
         esbuild: "^0.28.1",
+        "happy-dom": "^20.14.0",
         open: "^11.0.0",
         typescript: "^7.0.2",
         vitest: "^4.1.6"
@@ -46218,6 +48387,11 @@ function agencyPrimer(p) {
   if (staff.length) lines.push(`Their team: ${staff.join("; ")}.`);
   const sops = (p.delivery?.sops ?? []).filter(Boolean);
   if (sops.length) lines.push(`How they deliver, in their words: ${sops.map((s) => `"${s}"`).join(" ")}`);
+  const os7 = p.agencyOs;
+  if (os7?.method) lines.push(`Their method: ${os7.method}`);
+  if (os7?.voice) lines.push(`How they sound, and how you should sound for them: ${os7.voice}`);
+  if (os7?.ica?.who) lines.push(`Who they serve: ${os7.ica.who}`);
+  if (os7?.offer?.name || os7?.offer?.promise) lines.push(`Their core offer: ${[os7.offer?.name, os7.offer?.promise].filter(Boolean).join(" \u2014 ")}`);
   if (!lines.length) return void 0;
   lines.push("These are the agency's own details, not any client's. Client-by-client records are a tool call away, not in here.");
   const text = lines.join("\n");
@@ -46241,7 +48415,7 @@ init_version_check();
 function registerMetaTools(server2, installedVersion) {
   server2.tool(
     "get_mcp_version",
-    "Check the installed version of GHL Command (the GoHighLevel MCP server) against the latest version published to npm. Use this to confirm an upgrade landed after restarting Claude. Returns installed version, latest version, whether up-to-date, and the one-line restart instruction if not.",
+    "Check the installed version of GHL Command against the latest version published to npm. Use this to confirm an upgrade landed after restarting Claude. Returns installed version, latest version, whether up-to-date, and the one-line restart instruction if not.",
     {},
     async () => {
       const status = await getVersionStatus(installedVersion);