@rubytech/create-maxy-code 0.1.294 → 0.1.296

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.294",
+  "version": "0.1.296",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/lib/models/dist/index.d.ts

@@ -1,3 +1,4 @@
+export declare const FABLE_MODEL = "claude-fable-5[1m]";
 export declare const OPUS_MODEL = "claude-opus-4-8[1m]";
 export declare const SONNET_MODEL = "claude-sonnet-4-6";
 export declare const HAIKU_MODEL = "claude-haiku-4-5";

package/payload/platform/lib/models/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,UAAU,wBAAwB,CAAC;AAChD,eAAO,MAAM,YAAY,sBAAsB,CAAC;AAChD,eAAO,MAAM,WAAW,qBAAqB,CAAC;AAE9C,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAIvD,CAAC;AAEF,wEAAwE;AACxE,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,WAAW,uBAAuB,CAAC;AAChD,eAAO,MAAM,UAAU,wBAAwB,CAAC;AAChD,eAAO,MAAM,YAAY,sBAAsB,CAAC;AAChD,eAAO,MAAM,WAAW,qBAAqB,CAAC;AAE9C,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAKvD,CAAC;AAEF,wEAAwE;AACxE,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnD"}

package/payload/platform/lib/models/dist/index.js

@@ -3,15 +3,17 @@
 // Templates, docs, and skills reference these values as strings;
 // all TypeScript consumers import from here.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MODEL_CONTEXT_WINDOW = exports.HAIKU_MODEL = exports.SONNET_MODEL = exports.OPUS_MODEL = void 0;
+exports.MODEL_CONTEXT_WINDOW = exports.HAIKU_MODEL = exports.SONNET_MODEL = exports.OPUS_MODEL = exports.FABLE_MODEL = void 0;
 exports.contextWindow = contextWindow;
-// Opus defaults to the 1M-context variant ([1m] is Claude Code's
+// Fable and Opus default to the 1M-context variant ([1m] is Claude Code's
 // context-extension suffix, valid in settings.json "model" and agent
 // frontmatter); Sonnet/Haiku stay on the standard 200k window.
+exports.FABLE_MODEL = "claude-fable-5[1m]";
 exports.OPUS_MODEL = "claude-opus-4-8[1m]";
 exports.SONNET_MODEL = "claude-sonnet-4-6";
 exports.HAIKU_MODEL = "claude-haiku-4-5";
 exports.MODEL_CONTEXT_WINDOW = {
+    [exports.FABLE_MODEL]: 1_000_000,
     [exports.OPUS_MODEL]: 1_000_000,
     [exports.SONNET_MODEL]: 200_000,
     [exports.HAIKU_MODEL]: 200_000,

package/payload/platform/lib/models/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,0DAA0D;AAC1D,iEAAiE;AACjE,6CAA6C;;;AAgB7C,sCAEC;AAhBD,iEAAiE;AACjE,qEAAqE;AACrE,+DAA+D;AAClD,QAAA,UAAU,GAAG,qBAAqB,CAAC;AACnC,QAAA,YAAY,GAAG,mBAAmB,CAAC;AACnC,QAAA,WAAW,GAAG,kBAAkB,CAAC;AAEjC,QAAA,oBAAoB,GAA2B;IAC1D,CAAC,kBAAU,CAAC,EAAE,SAAS;IACvB,CAAC,oBAAY,CAAC,EAAE,OAAO;IACvB,CAAC,mBAAW,CAAC,EAAE,OAAO;CACvB,CAAC;AAEF,wEAAwE;AACxE,SAAgB,aAAa,CAAC,KAAa;IACzC,OAAO,4BAAoB,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC;AAChD,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,0DAA0D;AAC1D,iEAAiE;AACjE,6CAA6C;;;AAkB7C,sCAEC;AAlBD,0EAA0E;AAC1E,qEAAqE;AACrE,+DAA+D;AAClD,QAAA,WAAW,GAAG,oBAAoB,CAAC;AACnC,QAAA,UAAU,GAAG,qBAAqB,CAAC;AACnC,QAAA,YAAY,GAAG,mBAAmB,CAAC;AACnC,QAAA,WAAW,GAAG,kBAAkB,CAAC;AAEjC,QAAA,oBAAoB,GAA2B;IAC1D,CAAC,mBAAW,CAAC,EAAE,SAAS;IACxB,CAAC,kBAAU,CAAC,EAAE,SAAS;IACvB,CAAC,oBAAY,CAAC,EAAE,OAAO;IACvB,CAAC,mBAAW,CAAC,EAAE,OAAO;CACvB,CAAC;AAEF,wEAAwE;AACxE,SAAgB,aAAa,CAAC,KAAa;IACzC,OAAO,4BAAoB,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC;AAChD,CAAC"}

package/payload/platform/lib/models/src/index.ts

@@ -2,14 +2,16 @@
 // Templates, docs, and skills reference these values as strings;
 // all TypeScript consumers import from here.
 
-// Opus defaults to the 1M-context variant ([1m] is Claude Code's
+// Fable and Opus default to the 1M-context variant ([1m] is Claude Code's
 // context-extension suffix, valid in settings.json "model" and agent
 // frontmatter); Sonnet/Haiku stay on the standard 200k window.
+export const FABLE_MODEL = "claude-fable-5[1m]";
 export const OPUS_MODEL = "claude-opus-4-8[1m]";
 export const SONNET_MODEL = "claude-sonnet-4-6";
 export const HAIKU_MODEL = "claude-haiku-4-5";
 
 export const MODEL_CONTEXT_WINDOW: Record<string, number> = {
+  [FABLE_MODEL]: 1_000_000,
   [OPUS_MODEL]: 1_000_000,
   [SONNET_MODEL]: 200_000,
   [HAIKU_MODEL]: 200_000,

package/payload/platform/neo4j/schema.cypher

@@ -1409,8 +1409,16 @@ OPTIONS {
   }
 };
 
-CREATE CONSTRAINT inbound_invoice_account_supplier_num_unique IF NOT EXISTS
-FOR (ii:InboundInvoice) REQUIRE (ii.accountId, ii.supplier, ii.invoiceNumber) IS UNIQUE;
+// Task 802 renamed the key property invoiceNumber -> confirmationNumber
+// (Schema.org canonical). The constraint gets a NEW name because
+// CREATE ... IF NOT EXISTS matches by constraint name: re-using the old
+// name would silently skip creation on databases seeded before the rename,
+// leaving the key unprotected. The old-name DROP retires the stale
+// invoiceNumber constraint on those databases; both statements are
+// idempotent on fresh installs.
+DROP CONSTRAINT inbound_invoice_account_supplier_num_unique IF EXISTS;
+CREATE CONSTRAINT inbound_invoice_account_supplier_confirmation_unique IF NOT EXISTS
+FOR (ii:InboundInvoice) REQUIRE (ii.accountId, ii.supplier, ii.confirmationNumber) IS UNIQUE;
 
 CREATE INDEX inbound_invoice_account IF NOT EXISTS
 FOR (ii:InboundInvoice) ON (ii.accountId);

package/payload/platform/plugins/admin/hooks/__tests__/prompt-optimiser-compliance.test.sh

@@ -45,6 +45,17 @@ ASSISTANT_REPLY='{"type":"assistant","message":{"role":"assistant","content":[{"
 ASSISTANT_REPLYDOC='{"type":"assistant","message":{"role":"assistant","content":[{"type":"tool_use","name":"mcp__whatsapp-channel__reply-document","input":{}}]}}'
 ASSISTANT_SKILLLOAD='{"type":"assistant","message":{"role":"assistant","content":[{"type":"tool_use","name":"mcp__admin__skill-load","input":{}}]}}'
 ASSISTANT_TASK='{"type":"assistant","message":{"role":"assistant","content":[{"type":"tool_use","name":"Task","input":{}}]}}'
+ASSISTANT_BASH='{"type":"assistant","message":{"role":"assistant","content":[{"type":"tool_use","name":"Bash","input":{}}]}}'
+ASSISTANT_WRITE='{"type":"assistant","message":{"role":"assistant","content":[{"type":"tool_use","name":"Write","input":{}}]}}'
+# Task 805 — a production-shape reframe turn: channel-wrapped, isMeta, carrying
+# the composeAdminContent ## Context / ## Instruction sections. No directive
+# marker row accompanies it (the directive hook suppresses itself on channel
+# turns, Task 753), so the reframe itself must count as directive-equivalent.
+CHANNEL_REFRAME='{"type":"user","isMeta":true,"message":{"role":"user","content":"<channel source=\"whatsapp-channel\">## Context\nplease draft the works order PDF for order 926\n\n## Instruction\nChoose the installed specialist that owns this request and dispatch it with the Agent tool.</channel>"}}'
+# Same shape, one-word Context payload — the trivial filter must read the
+# payload, not the wrapper (the always-present instruction text would otherwise
+# make every reframed turn look non-trivial).
+CHANNEL_REFRAME_TRIVIAL='{"type":"user","isMeta":true,"message":{"role":"user","content":"<channel source=\"whatsapp-channel\">## Context\nyes\n\n## Instruction\nChoose the installed specialist that owns this request and dispatch it with the Agent tool.</channel>"}}'
 
 assert_flagged() {
   local name="$1" t="$2" out
@@ -147,6 +158,22 @@ assert_not_flagged "route then isMeta injections -> not flagged (slice not trunc
 assert_not_flagged "slash prompt then isMeta skill body -> not flagged" \
   "$(mk_transcript '{"type":"user","message":{"role":"user","content":"/insight"}}' "$DIRECTIVE_ATTACH" "$ASSISTANT_TEXT" "$META_SKILL")"
 
+# 16. Task 805 — reframed channel turn, no marker row, inline authoring tools
+# (the e48c2a5e freestyle shape) -> flagged. The reframe IS the directive.
+assert_flagged "reframe turn + inline authoring, no marker -> flagged" \
+  "$(mk_transcript "$CHANNEL_REFRAME" "$ASSISTANT_REPLY" "$ASSISTANT_BASH" "$ASSISTANT_WRITE")"
+# 17. Same reframed turn with an Agent dispatch -> not flagged.
+assert_not_flagged "reframe turn + Agent dispatch -> not flagged" \
+  "$(mk_transcript "$CHANNEL_REFRAME" "$ASSISTANT_REPLY" "$ASSISTANT_AGENT")"
+# 18. Reframed turn whose Context payload is one word -> trivial, not flagged,
+# even though the wrapper text is long.
+assert_not_flagged "reframe turn with one-word Context payload -> not flagged (trivial)" \
+  "$(mk_transcript "$CHANNEL_REFRAME_TRIVIAL" "$ASSISTANT_TEXT")"
+# 19. Channel-wrapped NON-reframe turn (no ## Instruction section — webchat
+# today, Task 776) with no marker -> not directive-equivalent, not flagged.
+assert_not_flagged "channel-wrapped non-reframe turn, no marker -> not flagged" \
+  "$(mk_transcript "$CHANNEL_PROMPT" "$ASSISTANT_TEXT")"
+
 # 11. Fail-open: missing transcript_path -> exit 0, no output.
 fo_out=$(printf '{"session_id":"x"}' | bash "$HOOK" 2>&1); fo_exit=$?
 if [[ "$fo_exit" -eq 0 && -z "$fo_out" ]]; then

package/payload/platform/plugins/admin/hooks/prompt-optimiser-compliance.sh

@@ -11,7 +11,10 @@
 #                     slice (robust to CC-version differences in how the
 #                     UserPromptSubmit additionalContext is recorded: a
 #                     type:"attachment"/hook_success on 2.1.x, a
-#                     type:"hook_additional_context" on the Pi).
+#                     type:"hook_additional_context" on the Pi), OR the prompt is
+#                     a <channel>-wrapped reframe turn (## Context/## Instruction
+#                     sections, Task 805) — the directive hook suppresses itself
+#                     on channel turns, so the reframe is directive-equivalent.
 #   route taken     = the turn contains a tool_use that is a genuine route:
 #                     Agent/Task dispatch, native Skill, or a *__skill-load MCP
 #                     tool. ToolSearch (a schema load) and the channel transport
@@ -126,23 +129,39 @@ if boundary is None:
 
 slice_rows = rows[boundary:]
 
-# Strip a leading <channel ...>...</channel> wrapper to reach the inner prompt for
-# the trivial check (WhatsApp/native-channel prompts arrive wrapped).
+# Strip a leading <channel ...>...</channel> wrapper to reach the inner prompt
+# (WhatsApp/native-channel prompts arrive wrapped).
 inner = prompt_text
+is_channel = False
 if inner.startswith("<channel"):
     end = inner.find(">")
     close = inner.rfind("</channel>")
     if end != -1 and close != -1 and close > end:
         inner = inner[end + 1:close].strip()
+        is_channel = True
+
+# Task 805 — a channel-wrapped reframe turn (the ## Context / ## Instruction
+# sections of composeAdminContent) is directive-equivalent: the directive hook suppresses
+# itself on channel turns (Task 753), so the reframe is the only routing
+# instruction the turn carries, and the marker check alone left every channel
+# turn unevaluated. A channel-wrapped turn WITHOUT the reframe (webchat today,
+# Task 776) is not directive-equivalent. For the trivial check the prompt is the
+# Context payload, not the wrapper — the always-present instruction text would
+# otherwise make a one-word confirmation look non-trivial.
+is_reframe = is_channel and inner.startswith("## Context\n") and "\n## Instruction\n" in inner
+if is_reframe:
+    head, _, _rest = inner.partition("\n## Instruction\n")
+    inner = head[len("## Context"):].strip()
 
 # Trivial-turn filter.
 is_slash = inner.startswith("/")
 tokens = inner.split()
 is_one_word = len(tokens) <= 1
 
-# Directive fired = marker present anywhere in the slice (any record shape).
+# Directive fired = marker present anywhere in the slice (any record shape) OR
+# the prompt is a channel-wrapped reframe turn (Task 805).
 marker = "PROMPT-OPTIMISER DIRECTIVE"
-directive_fired = any(marker in json.dumps(r, ensure_ascii=False) for r in slice_rows)
+directive_fired = is_reframe or any(marker in json.dumps(r, ensure_ascii=False) for r in slice_rows)
 
 # Route taken = an assistant tool_use that is a genuine route: specialist
 # dispatch (Agent/Task) or skill load (native Skill, or the *__skill-load MCP

package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: platform-architecture
 description: Use when grounding any documented-surface claim about what Maxy ships — plugins, skills, specialists, install/deploy flows, internals. This is the install catalogue, not evidence of what is enabled on the current account. For install state on this account, call `capabilities-here`; for documented surface, cite the `Source:` URL inline.
-content-hash: sha256:516d6fb2a0a7f45c4e8799c5ae4b3bf1009793c296a8b0882d11ea2eff79245a
+content-hash: sha256:c39a9e28304fa49a4afee3aabc0507872065d868994c9ab14d56b2576f4ce636
 brand: maxy-code
 product-name: Maxy
 ---
@@ -153,7 +153,7 @@ Plugins are installed and managed through conversation. You can add marketplace
 
 ## Roles
 
-Maxy ships twelve roles it can dispatch for specific tasks — like members of your team. You don't need to configure or manage them — Maxy decides when to use each role and handles everything automatically. You may see activity like "Dispatching personal-assistant..." in the chat timeline when this happens.
+Maxy ships thirteen roles it can dispatch for specific tasks — like members of your team. You don't need to configure or manage them — Maxy decides when to use each role and handles everything automatically. You may see activity like "Dispatching personal-assistant..." in the chat timeline when this happens.
 
 The catalogue below is what the platform ships. It is not evidence of what is installed on the current account. For the live install set on this account, ask Maxy to call `capabilities-here`.
 
@@ -164,6 +164,7 @@ The catalogue below is what the platform ships. It is not evidence of what is in
 | Coding Assistant | Runs shell commands, drives git repositories, and reads or edits code on your behalf — the specialist you reach for when the work belongs in a developer terminal. |
 | Compiled Truth Rewriter | Recomputes a node's compiledTruth (and public twin where applicable) from its 90-day timeline plus optional operator hints. |
 | Content Producer | Produces visual output from your graph: generates images, renders pages to PDF, and hosts static websites you upload as a zip. |
+| Data Manager | Keeps the account data directory organised consistently with the graph ontology, pairing every file move with a database-operator reference update. |
 | Database Operator | Executes graph writes on admin's behalf when delegated via the Task tool — admin names each write, the specialist runs it. |
 | Librarian | Owns foreground ingest of documents, conversation transcripts, and external archives into the memory graph. |
 | Personal Assistant | Handles the operational tasks you'd give a personal assistant: scheduling meetings, managing your platform settings, connecting messaging channels, and completing browser-based tasks on your behalf. |
@@ -2280,7 +2281,9 @@ Task 500 — **admin session management moved entirely to claude's own interface
 
 **Row title resolution.** Both the sidebar (`/sidebar-sessions`) and the manager's own row payload resolve a row's title in the same order: operator rename → Claude Code `ai-title` → first non-CLI user message → 8-char sessionId prefix. The operator-rename tier is the on-disk `<accountDir>/session-titles.json` (the manager's `UserTitleStore`), keyed by the CC sessionId — the sidebar reads that same file, so a write to the store lights up both surfaces with one write.
 
-**Task 785 — `/chat` empty-state greeting panel.** While the admin webchat has no conversation JSONL yet (`GET /api/webchat/session` → `projectDir:null`), `app/chat/page.tsx` renders a "What's up next, {givenName}?" greeting (given name = first whitespace token of the admin session's `userName`) above two read-only lists from `GET /api/webchat/greeting` (`server/routes/webchat-greeting.ts`, `requireAdminSession`-gated, `accountId`-scoped): the next 5 upcoming `:Event` rows (`eventStatus IN ['scheduled','due']`, future `COALESCE(nextRun, startDate)`, soonest first) and the outstanding `:Task` rows (`status IN ['pending','active','running']`, 5 shown + `+N more`). Read failure returns HTTP 200 `{ ok: false }` and the page shows the headline alone — the panel never blocks the composer. Logs: `[webchat:greeting] op=read account=<id8> events=<n> tasks=<n> ms=<n>` / `op=read-failed reason=…`; client warns `[admin-ui] greeting-unavailable …`. The full webchat architecture lives in `.docs/admin-webchat-native-channel.md`.
+**Task 785 — `/chat` empty-state greeting panel.** While the admin webchat has no conversation JSONL yet (`GET /api/webchat/session` → `projectDir:null`), `app/chat/page.tsx` renders a "What's up next, {givenName}?" greeting (given name = first whitespace token of the admin session's `userName`) above two read-only lists from `GET /api/webchat/greeting` (`server/routes/webchat-greeting.ts`, `requireAdminSession`-gated, `accountId`-scoped): the next 5 upcoming `:Event` rows (`eventStatus IN ['scheduled','due']`, future `COALESCE(nextRun, startDate)`, soonest first) and the outstanding `:Task` rows (`status IN ['pending','active','running']`, 5 shown + `+N more`). Read failure returns HTTP 200 `{ ok: false }` and the page shows the headline alone — the panel never blocks the composer. **Task 792** adds a third section, **Your specialists**: the account's installed roster — every `*.md` under `data/accounts/<accountId>/specialists/agents/`, core and `--`-prefixed premium files alike — shown by frontmatter `name` + `summary` (fallback `description`), empty dir → "No specialists installed". The roster read (`app/lib/claude-agent/specialist-roster.ts`) is isolated from the graph fallback: malformed files are skipped (`op=specialist-skipped file=<name> reason=<…>`), a whole-roster failure degrades to `specialists: []` inside the `ok: true` payload (`op=specialists-read-failed`). Logs: `[webchat:greeting] op=read account=<id8> events=<n> tasks=<n> specialists=<n> ms=<n>` / `op=read-failed reason=…`; client warns `[admin-ui] greeting-unavailable …`. The full webchat architecture lives in `.docs/admin-webchat-native-channel.md`.
+
+**Task 799 — `/chat` Claude-desktop transcript presentation.** The admin webchat keeps the shared `Transcript` shell (stream, follow-tail) but injects a /chat-only item renderer via the component's optional `renderItems` prop: `renderChatTimeline` in `app/chat/transcript-render.tsx`. Presentation: operator turns render as a right-aligned grey bubble with only the message text (no label, no per-turn time); all agent output renders as plain prose (the reply-document filename line stays, as prose); a maximal consecutive run of `tool-call`/`tool-result` turns renders as one collapsed grey one-liner ("Used N tools ›") whose expansion shows every call and result payload — a lone call still gets the one-liner, and prose or a directive row ends a run. The WhatsApp reader (`/whatsapp`) omits the prop and keeps the default `renderTimeline`, so its rendering is unchanged; both presentations are test-pinned (`app/whatsapp/__tests__/Transcript-*.test.tsx` unmodified, `app/chat/__tests__/transcript-render.test.tsx` new).
 
 **Task 624 — maxy title for public sessions.** A `role=public` webchat spawn never produces a useful Claude Code `ai-title` (an anonymous one-line visitor turn), so every public row would otherwise read identically. The webchat route (`chat.ts`) composes a deterministic title — `Web · <senderId[:8]>[ · <personId>] · <UTC YYYY-MM-DD HH:mm>` (personId present only for gated visitors) — and threads it through the bridge (`dispatchOnce` → `managerSpawn`) to the manager `POST /spawn` body as `name`. `/spawn` validates it with `validateUserTitle` and, for `role=public` only, writes it into `UserTitleStore` so it occupies the operator-rename tier and wins over `ai-title`. Admin (`/rc-spawn`) and WhatsApp titling are unchanged. Observability: every public spawn logs `[spawn] role=public … title="…"` (or `title=missing`); the manager's row builder emits `[public-title] sessionId=… unexpected titleSource=<ai|null>` on the next list read for any public row that did not resolve from the user tier.
 
@@ -2331,6 +2334,21 @@ snapping back to the data root; the hash never reaches the server and `/data`
 has no client router, so the channel is isolated. `path=` is cleared at the
 root for a clean URL.
 
+**`/data` search — locate-in-files link and clear button (Task 791).** Every
+search hit is a `:FileArtifact` backed by a physical file, so each result card
+whose `relativePath` is a non-empty string carries a **locate link** (folder
+icon + containing folder; root-level files show `data`). Clicking it clears the
+active search (query, results, error, chip) and navigates the file browser to
+that folder via the same `path` state + `#path=` hash contract above, so the
+file appears among its siblings and a reload restores the place. The link is a
+sibling of the clickable card, so it never triggers the row's download. Hits
+without a usable `relativePath` render no link; one
+`console.warn('[data-search] op=locate-link-missing nodeId=…')` per result set
+surfaces the index gap, and each click logs
+`[data-search] op=locate nodeId=… folder=…`. The search bar shows an **× clear
+button** while it holds text — clicking empties the input, clears results
+(restoring the file-browser body), and refocuses the input.
+
 ### Browser / device-browser
 
 | Mount | Purpose |
@@ -2444,7 +2462,7 @@ authoritative. This section names the surfaces and what backs each.
 | `+ New session` button | Opens `NewSessionModal`, which POSTs `{channel, permissionMode, model, initialMessage}` to `/api/admin/claude-sessions`. | `claude-sessions.ts` |
 | Mode trigger | Per-`(accountId, userId)` `SpawnPreference` for `permissionMode` and `model`; persists across reload, tab, device. | `session-defaults.ts` |
 | Nav rows (Chat / People / Agents / Projects / Tasks / Artefacts) | People, Agents, Tasks open the artefact-pane Graph filtered to the matching label. Chat selects the active conversation. Artefacts swaps the list to editable documents. | `graph-search.ts`, `graph-subgraph.ts`, `sidebar-artefacts.ts` |
-| Sessions list (Active / Archived / All) | Live row store driven by SSE; manual reconcile button on the segmented control re-fetches the full id set. | `/claude-sessions/events`, `/claude-sessions` |
+| Sessions list (Active / Archived / All) | Live row store driven by SSE; manual reconcile button on the segmented control re-fetches the full id set. Every resumable row (not `resumable === false` public rows) carries two launch actions (Task 800): the claude.ai/code resume (`ExternalLink`) and a chat-launch (`MessageSquare`) that opens `/chat?session=<full sessionId>` — the admin webchat pointed at that exact session; sending there resumes a stopped session with the webchat channel bound to that id (see `admin-webchat-native-channel.md`, "Session-targeted mode"). At the ≤720 px drawer breakpoint each row stacks into two lines — dot + title + id/stamp, then the action icons — with a divider between rows and actions at full opacity (the desktop hover-gated 0.5 opacity never resolves on touch). | `/claude-sessions/events`, `/claude-sessions` |
 | Channel reader nav rows (WhatsApp / Telegram) | One conditional nav row **per interactive channel that has ≥1 admin session** (Task 738). Each row carries its brand glyph (WhatsApp `#25D366`, Telegram `#229ED9`); a channel with no admin session shows no row, and no install ever shows an always-empty "No conversations" row. The channel list loads **once on sidebar mount** (the per-channel counts must be known before the nav renders), so a failed load shows one muted, non-clickable line instead of channel rows. Clicking a channel row lists that channel's admin conversations; each conversation row shows a **display name** resolved by precedence `operatorName ?? whatsappName ?? senderId ?? title` (Task 747): the bound `Person givenName familyName` when a `senderId`→`userId` binding exists, else the persisted WhatsApp display name (`pushName`, read from the latest `:Message:WhatsAppMessage.senderName`), else the raw `senderId`, else the agent title; the agent session title is the hover tooltip only. Under the name each row shows a **last-message-time breadcrumb** (`conv-timestamp`, same markup as the Sessions rows) formatted from the row's `lastMessageAt` (the last parseable turn's `ts`); a session with no parseable turn shows no time, never "Invalid Date". A click on a conversation **opens its transcript on the home surface**: on `/` it selects in place, and from any other route (`/graph`, `/data`, `/browser`) it navigates to `/?wa=<sessionId>&projectDir=<dir>`, which the root shell hydrates on mount (then strips the query so a later refresh does not re-pin a closed conversation). Server logs `[wa-reader] op=operator-name-fallback senderId=… source=whatsapp-pushname` when the pushName fallback fires and `[wa-reader] op=conversations count=<n> withTimestamp=<m>` per list build; the client logs `[admin-ui] wa-open route=… via=<in-place\|navigate> …` and `[admin-ui] wa-hydrate route=/ …`. | `/whatsapp-reader/conversations` |
 | Channel transcript (`<Transcript>`) | Reads one session's JSONL over SSE (`/whatsapp-reader/stream`) and renders both sides plus tool calls — the turns claude.ai/code hides because channel inbound is stamped `isMeta`. Every turn shows its time-of-day (HH:MM from the turn's `ts`; a null/unparseable `ts` shows no time, never "Invalid Date"). `tool-call`/`tool-result` turns render as **collapsed cards** (chevron + label + time, default collapsed, expandable per card; one card's state never affects another) so the human↔agent text is not buried in JSON; the three conversation kinds always render in full. The thread **follows the tail**: it opens at the newest turn and pins to the bottom on each live append **only while the operator is already within 32 px of the bottom** — a scroll up suppresses the jump so reading history is never yanked. While the operator is scrolled up a **jump-to-bottom control** (`.wa-jump`, bottom-right of the viewport) appears; clicking it scrolls to the newest turn and re-arms follow-tail, and it hides again at the bottom (Task 747). The thread scrolls inside its grid cell (header/sidebar/footer fixed). The stream sends a 20 s heartbeat so an idle Cloudflare tunnel does not idle-drop, tags each frame with a byte-offset `id:`, and resumes from the client's `Last-Event-ID` on reconnect (no duplicate backlog); the client clears the "Stream disconnected" banner on reopen and latches it only on a terminal CLOSED state. The thread also interleaves a collapsed `⚙ directive injected (N B)` row per turn (Task 746), sorted by timestamp just before the turn it informed; expanding one fetches the exact stored `prompt-optimiser-directive` bytes for that turn. The entries are listed by `GET /whatsapp-reader/directives?sessionId=` and the bytes served by `GET /whatsapp-reader/directive?sessionId=&name=`, both admin-gated and account-scoped; a missing store degrades to no rows. | `/whatsapp-reader/stream`, `/whatsapp-reader/directives`, `/whatsapp-reader/directive` |
 | Conversations row hover actions | Inline rename, archive, delete, JSONL view / download per row. The historical `.conversations-modal` CSS block exists in `globals.css` but is no longer mounted from any TSX — Sidebar.tsx now owns every per-row affordance directly. | `claude-sessions.ts` |

package/payload/platform/plugins/docs/references/admin-ui.md

@@ -53,7 +53,9 @@ Task 500 — **admin session management moved entirely to claude's own interface
 
 **Row title resolution.** Both the sidebar (`/sidebar-sessions`) and the manager's own row payload resolve a row's title in the same order: operator rename → Claude Code `ai-title` → first non-CLI user message → 8-char sessionId prefix. The operator-rename tier is the on-disk `<accountDir>/session-titles.json` (the manager's `UserTitleStore`), keyed by the CC sessionId — the sidebar reads that same file, so a write to the store lights up both surfaces with one write.
 
-**Task 785 — `/chat` empty-state greeting panel.** While the admin webchat has no conversation JSONL yet (`GET /api/webchat/session` → `projectDir:null`), `app/chat/page.tsx` renders a "What's up next, {givenName}?" greeting (given name = first whitespace token of the admin session's `userName`) above two read-only lists from `GET /api/webchat/greeting` (`server/routes/webchat-greeting.ts`, `requireAdminSession`-gated, `accountId`-scoped): the next 5 upcoming `:Event` rows (`eventStatus IN ['scheduled','due']`, future `COALESCE(nextRun, startDate)`, soonest first) and the outstanding `:Task` rows (`status IN ['pending','active','running']`, 5 shown + `+N more`). Read failure returns HTTP 200 `{ ok: false }` and the page shows the headline alone — the panel never blocks the composer. Logs: `[webchat:greeting] op=read account=<id8> events=<n> tasks=<n> ms=<n>` / `op=read-failed reason=…`; client warns `[admin-ui] greeting-unavailable …`. The full webchat architecture lives in `.docs/admin-webchat-native-channel.md`.
+**Task 785 — `/chat` empty-state greeting panel.** While the admin webchat has no conversation JSONL yet (`GET /api/webchat/session` → `projectDir:null`), `app/chat/page.tsx` renders a "What's up next, {givenName}?" greeting (given name = first whitespace token of the admin session's `userName`) above two read-only lists from `GET /api/webchat/greeting` (`server/routes/webchat-greeting.ts`, `requireAdminSession`-gated, `accountId`-scoped): the next 5 upcoming `:Event` rows (`eventStatus IN ['scheduled','due']`, future `COALESCE(nextRun, startDate)`, soonest first) and the outstanding `:Task` rows (`status IN ['pending','active','running']`, 5 shown + `+N more`). Read failure returns HTTP 200 `{ ok: false }` and the page shows the headline alone — the panel never blocks the composer. **Task 792** adds a third section, **Your specialists**: the account's installed roster — every `*.md` under `data/accounts/<accountId>/specialists/agents/`, core and `--`-prefixed premium files alike — shown by frontmatter `name` + `summary` (fallback `description`), empty dir → "No specialists installed". The roster read (`app/lib/claude-agent/specialist-roster.ts`) is isolated from the graph fallback: malformed files are skipped (`op=specialist-skipped file=<name> reason=<…>`), a whole-roster failure degrades to `specialists: []` inside the `ok: true` payload (`op=specialists-read-failed`). Logs: `[webchat:greeting] op=read account=<id8> events=<n> tasks=<n> specialists=<n> ms=<n>` / `op=read-failed reason=…`; client warns `[admin-ui] greeting-unavailable …`. The full webchat architecture lives in `.docs/admin-webchat-native-channel.md`.
+
+**Task 799 — `/chat` Claude-desktop transcript presentation.** The admin webchat keeps the shared `Transcript` shell (stream, follow-tail) but injects a /chat-only item renderer via the component's optional `renderItems` prop: `renderChatTimeline` in `app/chat/transcript-render.tsx`. Presentation: operator turns render as a right-aligned grey bubble with only the message text (no label, no per-turn time); all agent output renders as plain prose (the reply-document filename line stays, as prose); a maximal consecutive run of `tool-call`/`tool-result` turns renders as one collapsed grey one-liner ("Used N tools ›") whose expansion shows every call and result payload — a lone call still gets the one-liner, and prose or a directive row ends a run. The WhatsApp reader (`/whatsapp`) omits the prop and keeps the default `renderTimeline`, so its rendering is unchanged; both presentations are test-pinned (`app/whatsapp/__tests__/Transcript-*.test.tsx` unmodified, `app/chat/__tests__/transcript-render.test.tsx` new).
 
 **Task 624 — maxy title for public sessions.** A `role=public` webchat spawn never produces a useful Claude Code `ai-title` (an anonymous one-line visitor turn), so every public row would otherwise read identically. The webchat route (`chat.ts`) composes a deterministic title — `Web · <senderId[:8]>[ · <personId>] · <UTC YYYY-MM-DD HH:mm>` (personId present only for gated visitors) — and threads it through the bridge (`dispatchOnce` → `managerSpawn`) to the manager `POST /spawn` body as `name`. `/spawn` validates it with `validateUserTitle` and, for `role=public` only, writes it into `UserTitleStore` so it occupies the operator-rename tier and wins over `ai-title`. Admin (`/rc-spawn`) and WhatsApp titling are unchanged. Observability: every public spawn logs `[spawn] role=public … title="…"` (or `title=missing`); the manager's row builder emits `[public-title] sessionId=… unexpected titleSource=<ai|null>` on the next list read for any public row that did not resolve from the user tier.
 
@@ -104,6 +106,21 @@ snapping back to the data root; the hash never reaches the server and `/data`
 has no client router, so the channel is isolated. `path=` is cleared at the
 root for a clean URL.
 
+**`/data` search — locate-in-files link and clear button (Task 791).** Every
+search hit is a `:FileArtifact` backed by a physical file, so each result card
+whose `relativePath` is a non-empty string carries a **locate link** (folder
+icon + containing folder; root-level files show `data`). Clicking it clears the
+active search (query, results, error, chip) and navigates the file browser to
+that folder via the same `path` state + `#path=` hash contract above, so the
+file appears among its siblings and a reload restores the place. The link is a
+sibling of the clickable card, so it never triggers the row's download. Hits
+without a usable `relativePath` render no link; one
+`console.warn('[data-search] op=locate-link-missing nodeId=…')` per result set
+surfaces the index gap, and each click logs
+`[data-search] op=locate nodeId=… folder=…`. The search bar shows an **× clear
+button** while it holds text — clicking empties the input, clears results
+(restoring the file-browser body), and refocuses the input.
+
 ### Browser / device-browser
 
 | Mount | Purpose |
@@ -217,7 +234,7 @@ authoritative. This section names the surfaces and what backs each.
 | `+ New session` button | Opens `NewSessionModal`, which POSTs `{channel, permissionMode, model, initialMessage}` to `/api/admin/claude-sessions`. | `claude-sessions.ts` |
 | Mode trigger | Per-`(accountId, userId)` `SpawnPreference` for `permissionMode` and `model`; persists across reload, tab, device. | `session-defaults.ts` |
 | Nav rows (Chat / People / Agents / Projects / Tasks / Artefacts) | People, Agents, Tasks open the artefact-pane Graph filtered to the matching label. Chat selects the active conversation. Artefacts swaps the list to editable documents. | `graph-search.ts`, `graph-subgraph.ts`, `sidebar-artefacts.ts` |
-| Sessions list (Active / Archived / All) | Live row store driven by SSE; manual reconcile button on the segmented control re-fetches the full id set. | `/claude-sessions/events`, `/claude-sessions` |
+| Sessions list (Active / Archived / All) | Live row store driven by SSE; manual reconcile button on the segmented control re-fetches the full id set. Every resumable row (not `resumable === false` public rows) carries two launch actions (Task 800): the claude.ai/code resume (`ExternalLink`) and a chat-launch (`MessageSquare`) that opens `/chat?session=<full sessionId>` — the admin webchat pointed at that exact session; sending there resumes a stopped session with the webchat channel bound to that id (see `admin-webchat-native-channel.md`, "Session-targeted mode"). At the ≤720 px drawer breakpoint each row stacks into two lines — dot + title + id/stamp, then the action icons — with a divider between rows and actions at full opacity (the desktop hover-gated 0.5 opacity never resolves on touch). | `/claude-sessions/events`, `/claude-sessions` |
 | Channel reader nav rows (WhatsApp / Telegram) | One conditional nav row **per interactive channel that has ≥1 admin session** (Task 738). Each row carries its brand glyph (WhatsApp `#25D366`, Telegram `#229ED9`); a channel with no admin session shows no row, and no install ever shows an always-empty "No conversations" row. The channel list loads **once on sidebar mount** (the per-channel counts must be known before the nav renders), so a failed load shows one muted, non-clickable line instead of channel rows. Clicking a channel row lists that channel's admin conversations; each conversation row shows a **display name** resolved by precedence `operatorName ?? whatsappName ?? senderId ?? title` (Task 747): the bound `Person givenName familyName` when a `senderId`→`userId` binding exists, else the persisted WhatsApp display name (`pushName`, read from the latest `:Message:WhatsAppMessage.senderName`), else the raw `senderId`, else the agent title; the agent session title is the hover tooltip only. Under the name each row shows a **last-message-time breadcrumb** (`conv-timestamp`, same markup as the Sessions rows) formatted from the row's `lastMessageAt` (the last parseable turn's `ts`); a session with no parseable turn shows no time, never "Invalid Date". A click on a conversation **opens its transcript on the home surface**: on `/` it selects in place, and from any other route (`/graph`, `/data`, `/browser`) it navigates to `/?wa=<sessionId>&projectDir=<dir>`, which the root shell hydrates on mount (then strips the query so a later refresh does not re-pin a closed conversation). Server logs `[wa-reader] op=operator-name-fallback senderId=… source=whatsapp-pushname` when the pushName fallback fires and `[wa-reader] op=conversations count=<n> withTimestamp=<m>` per list build; the client logs `[admin-ui] wa-open route=… via=<in-place\|navigate> …` and `[admin-ui] wa-hydrate route=/ …`. | `/whatsapp-reader/conversations` |
 | Channel transcript (`<Transcript>`) | Reads one session's JSONL over SSE (`/whatsapp-reader/stream`) and renders both sides plus tool calls — the turns claude.ai/code hides because channel inbound is stamped `isMeta`. Every turn shows its time-of-day (HH:MM from the turn's `ts`; a null/unparseable `ts` shows no time, never "Invalid Date"). `tool-call`/`tool-result` turns render as **collapsed cards** (chevron + label + time, default collapsed, expandable per card; one card's state never affects another) so the human↔agent text is not buried in JSON; the three conversation kinds always render in full. The thread **follows the tail**: it opens at the newest turn and pins to the bottom on each live append **only while the operator is already within 32 px of the bottom** — a scroll up suppresses the jump so reading history is never yanked. While the operator is scrolled up a **jump-to-bottom control** (`.wa-jump`, bottom-right of the viewport) appears; clicking it scrolls to the newest turn and re-arms follow-tail, and it hides again at the bottom (Task 747). The thread scrolls inside its grid cell (header/sidebar/footer fixed). The stream sends a 20 s heartbeat so an idle Cloudflare tunnel does not idle-drop, tags each frame with a byte-offset `id:`, and resumes from the client's `Last-Event-ID` on reconnect (no duplicate backlog); the client clears the "Stream disconnected" banner on reopen and latches it only on a terminal CLOSED state. The thread also interleaves a collapsed `⚙ directive injected (N B)` row per turn (Task 746), sorted by timestamp just before the turn it informed; expanding one fetches the exact stored `prompt-optimiser-directive` bytes for that turn. The entries are listed by `GET /whatsapp-reader/directives?sessionId=` and the bytes served by `GET /whatsapp-reader/directive?sessionId=&name=`, both admin-gated and account-scoped; a missing store degrades to no rows. | `/whatsapp-reader/stream`, `/whatsapp-reader/directives`, `/whatsapp-reader/directive` |
 | Conversations row hover actions | Inline rename, archive, delete, JSONL view / download per row. The historical `.conversations-modal` CSS block exists in `globals.css` but is no longer mounted from any TSX — Sidebar.tsx now owns every per-row affordance directly. | `claude-sessions.ts` |

package/payload/platform/plugins/docs/references/platform.md

@@ -39,7 +39,7 @@ Plugins are installed and managed through conversation. You can add marketplace
 
 ## Roles
 
-{{productName}} ships twelve roles it can dispatch for specific tasks — like members of your team. You don't need to configure or manage them — {{productName}} decides when to use each role and handles everything automatically. You may see activity like "Dispatching personal-assistant..." in the chat timeline when this happens.
+{{productName}} ships thirteen roles it can dispatch for specific tasks — like members of your team. You don't need to configure or manage them — {{productName}} decides when to use each role and handles everything automatically. You may see activity like "Dispatching personal-assistant..." in the chat timeline when this happens.
 
 The catalogue below is what the platform ships. It is not evidence of what is installed on the current account. For the live install set on this account, ask {{productName}} to call `capabilities-here`.
 
@@ -50,6 +50,7 @@ The catalogue below is what the platform ships. It is not evidence of what is in
 | Coding Assistant | Runs shell commands, drives git repositories, and reads or edits code on your behalf — the specialist you reach for when the work belongs in a developer terminal. |
 | Compiled Truth Rewriter | Recomputes a node's compiledTruth (and public twin where applicable) from its 90-day timeline plus optional operator hints. |
 | Content Producer | Produces visual output from your graph: generates images, renders pages to PDF, and hosts static websites you upload as a zip. |
+| Data Manager | Keeps the account data directory organised consistently with the graph ontology, pairing every file move with a database-operator reference update. |
 | Database Operator | Executes graph writes on admin's behalf when delegated via the Task tool — admin names each write, the specialist runs it. |
 | Librarian | Owns foreground ingest of documents, conversation transcripts, and external archives into the memory graph. |
 | Personal Assistant | Handles the operational tasks you'd give a personal assistant: scheduling meetings, managing your platform settings, connecting messaging channels, and completing browser-based tasks on your behalf. |

package/payload/platform/plugins/memory/mcp/dist/lib/__tests__/schema-doc-contradictions.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=schema-doc-contradictions.test.d.ts.map

package/payload/platform/plugins/memory/mcp/dist/lib/__tests__/schema-doc-contradictions.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-doc-contradictions.test.d.ts","sourceRoot":"","sources":["../../../src/lib/__tests__/schema-doc-contradictions.test.ts"],"names":[],"mappings":""}

package/payload/platform/plugins/memory/mcp/dist/lib/__tests__/schema-doc-contradictions.test.js

@@ -0,0 +1,214 @@
+import { test, expect, vi } from "vitest";
+import { mkdtempSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { loadSchema, detectContradictions } from "../schema-loader.js";
+const expectEqual = (actual, wanted) => expect(actual).toBe(wanted);
+const expectDeepEqual = (actual, wanted) => expect(actual).toEqual(wanted);
+// ---------------------------------------------------------------------------
+// Task 802 — schema docs must never prescribe a property name that the
+// loaded synonym (wrongToCorrect) map bans in the same scope. A label whose
+// required cell contains a banned token is structurally unwritable: the
+// banned name trips the synonym rejection, the canonical name trips the
+// missing-required check.
+// ---------------------------------------------------------------------------
+const BASE_WITH_AMOUNT_BAN = `# Base
+
+## Property Naming Rules
+
+| Correct | Wrong |
+|---------|-------|
+| \`totalPaymentDue\` | \`amount\`, \`total\` |
+| \`postalCode\` | \`postcode\` |
+`;
+function writeFixtureDir(files) {
+    const dir = mkdtempSync(join(tmpdir(), "schema-contradictions-"));
+    for (const [name, content] of Object.entries(files)) {
+        writeFileSync(join(dir, name), content, "utf-8");
+    }
+    return dir;
+}
+test("detectContradictions: required token banned by base file is reported", () => {
+    const dir = writeFixtureDir({
+        "schema-base.md": BASE_WITH_AMOUNT_BAN,
+        "schema-vert.md": `# Vert
+
+## Node Types
+
+| Entity | Neo4j Label | Required Properties |
+|--------|-------------|---------------------|
+| Foo | \`Foo\` | \`accountId\`, \`amount\`, \`status\` |
+`,
+    });
+    const schema = loadSchema({ referencesDir: dir });
+    const hits = detectContradictions(schema);
+    expectEqual(hits.length, 1);
+    expectDeepEqual(hits[0], {
+        file: "schema-vert.md",
+        label: "Foo",
+        property: "amount",
+        correct: "totalPaymentDue",
+    });
+});
+test("detectContradictions: clean required cell yields no contradictions", () => {
+    const dir = writeFixtureDir({
+        "schema-base.md": BASE_WITH_AMOUNT_BAN,
+        "schema-vert.md": `# Vert
+
+## Node Types
+
+| Entity | Neo4j Label | Required Properties |
+|--------|-------------|---------------------|
+| Foo | \`Foo\` | \`accountId\`, \`totalPaymentDue\`, \`status\` |
+`,
+    });
+    const hits = detectContradictions(loadSchema({ referencesDir: dir }));
+    expectDeepEqual(hits, []);
+});
+test("detectContradictions: documented-canonical bullet banned by base is reported with heading label", () => {
+    const dir = writeFixtureDir({
+        "schema-base.md": BASE_WITH_AMOUNT_BAN,
+        "schema-vert.md": `# Vert
+
+## Node Types
+
+| Entity | Neo4j Label | Required Properties |
+|--------|-------------|---------------------|
+| Bar | \`Bar\` | \`accountId\` |
+
+### Bar — full property set
+
+- \`slug\` — URL-safe identifier
+- \`postcode\` — UK postcode
+- \`town\`
+`,
+    });
+    const hits = detectContradictions(loadSchema({ referencesDir: dir }));
+    expectEqual(hits.length, 1);
+    expectDeepEqual(hits[0], {
+        file: "schema-vert.md",
+        label: "Bar",
+        property: "postcode",
+        correct: "postalCode",
+    });
+});
+test("detectContradictions: vertical-file ban only applies to labels in the same file", () => {
+    const vertTable = (label) => `# Vert
+
+## Node Types
+
+| Entity | Neo4j Label | Required Properties |
+|--------|-------------|---------------------|
+| ${label} | \`${label}\` | \`accountId\`, \`widgetCount\` |
+`;
+    const banTable = `
+## Property Naming Rules
+
+| Correct | Wrong |
+|---------|-------|
+| \`numberOfItems\` | \`widgetCount\` |
+`;
+    // Ban declared in schema-aaa.md; schema-bbb.md requires the banned token.
+    // Out of scope (different vertical) -> not a contradiction.
+    const crossDir = writeFixtureDir({
+        "schema-base.md": "# Base\n",
+        "schema-aaa.md": `# A\n${banTable}`,
+        "schema-bbb.md": vertTable("Bee"),
+    });
+    expectDeepEqual(detectContradictions(loadSchema({ referencesDir: crossDir })), []);
+    // Same file declares the ban AND requires the banned token -> contradiction.
+    const sameDir = writeFixtureDir({
+        "schema-base.md": "# Base\n",
+        "schema-aaa.md": `${vertTable("Aye")}\n${banTable}`,
+    });
+    const hits = detectContradictions(loadSchema({ referencesDir: sameDir }));
+    expectEqual(hits.length, 1);
+    expectEqual(hits[0].label, "Aye");
+    expectEqual(hits[0].property, "widgetCount");
+});
+// ---------------------------------------------------------------------------
+// Boot standing check: loadSchema() emits one structured stderr line per
+// contradiction at every MCP boot, so a drifted or field-edited schema file
+// is visible in the memory plugin's stderr log without any write attempted.
+// It logs only — MCP module init must never throw.
+// ---------------------------------------------------------------------------
+test("loadSchema: emits op=contradiction line per hit at boot, none when clean", () => {
+    const contradictingDir = writeFixtureDir({
+        "schema-base.md": BASE_WITH_AMOUNT_BAN,
+        "schema-vert.md": `# Vert
+
+## Node Types
+
+| Entity | Neo4j Label | Required Properties |
+|--------|-------------|---------------------|
+| Foo | \`Foo\` | \`accountId\`, \`amount\` |
+`,
+    });
+    const spy = vi
+        .spyOn(process.stderr, "write")
+        .mockImplementation(() => true);
+    try {
+        loadSchema({ referencesDir: contradictingDir });
+        const lines = spy.mock.calls
+            .map((c) => String(c[0]))
+            .filter((l) => l.includes("op=contradiction"));
+        expectDeepEqual(lines, [
+            "[schema-loader] op=contradiction file=schema-vert.md label=Foo property=amount correct=totalPaymentDue\n",
+        ]);
+        spy.mockClear();
+        const cleanDir = writeFixtureDir({
+            "schema-base.md": BASE_WITH_AMOUNT_BAN,
+            "schema-vert.md": `# Vert
+
+## Node Types
+
+| Entity | Neo4j Label | Required Properties |
+|--------|-------------|---------------------|
+| Foo | \`Foo\` | \`accountId\`, \`totalPaymentDue\` |
+`,
+        });
+        loadSchema({ referencesDir: cleanDir });
+        const cleanLines = spy.mock.calls
+            .map((c) => String(c[0]))
+            .filter((l) => l.includes("op=contradiction"));
+        expectDeepEqual(cleanLines, []);
+    }
+    finally {
+        spy.mockRestore();
+    }
+});
+// ---------------------------------------------------------------------------
+// The gate: the shipped schema files must carry zero contradictions. The
+// failure message lists every offending file/label/property so the fix is
+// a doc edit away.
+// ---------------------------------------------------------------------------
+test("gate: shipped schema files carry no required-vs-banned contradictions", () => {
+    const hits = detectContradictions(loadSchema());
+    const rendered = hits
+        .map((h) => `${h.file} ${h.label}.${h.property} (use ${h.correct})`)
+        .join("\n");
+    expect(hits, `schema docs prescribe banned property names:\n${rendered}`)
+        .toEqual([]);
+});
+test("detectContradictions: qualified '(on ...)' wrong tokens are not bans", () => {
+    const dir = writeFixtureDir({
+        "schema-base.md": `# Base
+
+## Property Naming Rules
+
+| Correct | Wrong |
+|---------|-------|
+| \`postalCode\` | \`postcode\` (on PostalAddress nodes) |
+`,
+        "schema-vert.md": `# Vert
+
+## Node Types
+
+| Entity | Neo4j Label | Required Properties |
+|--------|-------------|---------------------|
+| Foo | \`Foo\` | \`accountId\`, \`postcode\` |
+`,
+    });
+    expectDeepEqual(detectContradictions(loadSchema({ referencesDir: dir })), []);
+});
+//# sourceMappingURL=schema-doc-contradictions.test.js.map

package/payload/platform/plugins/memory/mcp/dist/lib/__tests__/schema-doc-contradictions.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-doc-contradictions.test.js","sourceRoot":"","sources":["../../../src/lib/__tests__/schema-doc-contradictions.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEvE,MAAM,WAAW,GAAG,CAAC,MAAe,EAAE,MAAe,EAAE,EAAE,CACvD,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC9B,MAAM,eAAe,GAAG,CAAC,MAAe,EAAE,MAAe,EAAE,EAAE,CAC3D,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;AAEjC,8EAA8E;AAC9E,uEAAuE;AACvE,4EAA4E;AAC5E,wEAAwE;AACxE,wEAAwE;AACxE,0BAA0B;AAC1B,8EAA8E;AAE9E,MAAM,oBAAoB,GAAG;;;;;;;;CAQ5B,CAAC;AAEF,SAAS,eAAe,CAAC,KAA6B;IACpD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAClE,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,IAAI,CAAC,sEAAsE,EAAE,GAAG,EAAE;IAChF,MAAM,GAAG,GAAG,eAAe,CAAC;QAC1B,gBAAgB,EAAE,oBAAoB;QACtC,gBAAgB,EAAE;;;;;;;CAOrB;KACE,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC1C,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC5B,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;QACvB,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,iBAAiB;KAC3B,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,oEAAoE,EAAE,GAAG,EAAE;IAC9E,MAAM,GAAG,GAAG,eAAe,CAAC;QAC1B,gBAAgB,EAAE,oBAAoB;QACtC,gBAAgB,EAAE;;;;;;;CAOrB;KACE,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,oBAAoB,CAAC,UAAU,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACtE,eAAe,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AAC5B,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iGAAiG,EAAE,GAAG,EAAE;IAC3G,MAAM,GAAG,GAAG,eAAe,CAAC;QAC1B,gBAAgB,EAAE,oBAAoB;QACtC,gBAAgB,EAAE;;;;;;;;;;;;;CAarB;KACE,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,oBAAoB,CAAC,UAAU,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACtE,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC5B,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;QACvB,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,YAAY;KACtB,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iFAAiF,EAAE,GAAG,EAAE;IAC3F,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC;;;;;;IAMnC,KAAK,QAAQ,KAAK;CACrB,CAAC;IACA,MAAM,QAAQ,GAAG;;;;;;CAMlB,CAAC;IACA,0EAA0E;IAC1E,4DAA4D;IAC5D,MAAM,QAAQ,GAAG,eAAe,CAAC;QAC/B,gBAAgB,EAAE,UAAU;QAC5B,eAAe,EAAE,QAAQ,QAAQ,EAAE;QACnC,eAAe,EAAE,SAAS,CAAC,KAAK,CAAC;KAClC,CAAC,CAAC;IACH,eAAe,CACb,oBAAoB,CAAC,UAAU,CAAC,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,CAAC,EAC7D,EAAE,CACH,CAAC;IAEF,6EAA6E;IAC7E,MAAM,OAAO,GAAG,eAAe,CAAC;QAC9B,gBAAgB,EAAE,UAAU;QAC5B,eAAe,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE;KACpD,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,oBAAoB,CAAC,UAAU,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAC1E,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC5B,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAClC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;AAC/C,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,yEAAyE;AACzE,4EAA4E;AAC5E,4EAA4E;AAC5E,mDAAmD;AACnD,8EAA8E;AAE9E,IAAI,CAAC,0EAA0E,EAAE,GAAG,EAAE;IACpF,MAAM,gBAAgB,GAAG,eAAe,CAAC;QACvC,gBAAgB,EAAE,oBAAoB;QACtC,gBAAgB,EAAE;;;;;;;CAOrB;KACE,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,EAAE;SACX,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC;SAC9B,kBAAkB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC;QACH,UAAU,CAAC,EAAE,aAAa,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK;aACzB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aACxB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACjD,eAAe,CAAC,KAAK,EAAE;YACrB,0GAA0G;SAC3G,CAAC,CAAC;QAEH,GAAG,CAAC,SAAS,EAAE,CAAC;QAChB,MAAM,QAAQ,GAAG,eAAe,CAAC;YAC/B,gBAAgB,EAAE,oBAAoB;YACtC,gBAAgB,EAAE;;;;;;;CAOvB;SACI,CAAC,CAAC;QACH,UAAU,CAAC,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxC,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK;aAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aACxB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACjD,eAAe,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAClC,CAAC;YAAS,CAAC;QACT,GAAG,CAAC,WAAW,EAAE,CAAC;IACpB,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,yEAAyE;AACzE,0EAA0E;AAC1E,mBAAmB;AACnB,8EAA8E;AAE9E,IAAI,CAAC,uEAAuE,EAAE,GAAG,EAAE;IACjF,MAAM,IAAI,GAAG,oBAAoB,CAAC,UAAU,EAAE,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,IAAI;SAClB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,QAAQ,SAAS,CAAC,CAAC,OAAO,GAAG,CAAC;SACnE,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,CAAC,IAAI,EAAE,iDAAiD,QAAQ,EAAE,CAAC;SACtE,OAAO,CAAC,EAAE,CAAC,CAAC;AACjB,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sEAAsE,EAAE,GAAG,EAAE;IAChF,MAAM,GAAG,GAAG,eAAe,CAAC;QAC1B,gBAAgB,EAAE;;;;;;;CAOrB;QACG,gBAAgB,EAAE;;;;;;;CAOrB;KACE,CAAC,CAAC;IACH,eAAe,CACb,oBAAoB,CAAC,UAAU,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC,EACxD,EAAE,CACH,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/payload/platform/plugins/memory/mcp/dist/lib/__tests__/schema-validator.test.js

@@ -38,6 +38,7 @@ function makeSchema(opts) {
         markdownLabels,
         wrongToCorrect,
         forbiddenByLabel,
+        documentedCanonicals: [],
         sourceFiles: ["schema-base.md"],
         brandVertical: opts.brandVertical ?? null,
     };