@rubytech/create-maxy-code 0.1.419 → 0.1.427

package/payload/server/server.js

@@ -3006,6 +3006,22 @@ async function resolvePersonByPhone(accountId, phone) {
     await session.close();
   }
 }
+async function ensureManagerPerson(accountId, phone) {
+  const session = getSession2();
+  const normalized = normalizeE164(phone) || phone;
+  try {
+    const result = await session.run(
+      `MERGE (p:Person {accountId: $accountId, phone: $phone})
+       ON CREATE SET p.source = 'wa-passive-manager'
+       RETURN elementId(p) AS personId`,
+      { accountId, phone: normalized }
+    );
+    if (result.records.length === 0) return null;
+    return result.records[0].get("personId");
+  } finally {
+    await session.close();
+  }
+}
 async function enrolPerson(input) {
   const session = getSession2();
   const sliceToken = randomUUID2();
@@ -5894,8 +5910,8 @@ function webchatTurnTimeoutMs() {
   return Number(process.env.WEBCHAT_TURN_TIMEOUT_MS ?? String(2 * 6e4));
 }
 function createChatRoutes(deps) {
-  const app57 = new Hono();
-  app57.post("/", async (c) => {
+  const app61 = new Hono();
+  app61.post("/", async (c) => {
     console.log(`[chat-route] entered route=public method=POST`);
     const contentType = c.req.header("content-type") ?? "";
     const account = resolveAccount();
@@ -6158,7 +6174,7 @@ ${result.result.text}` : result.result.text;
       }
     });
   });
-  return app57;
+  return app61;
 }
 
 // app/lib/channel-pty-bridge/admin-session-id.ts
@@ -6173,14 +6189,28 @@ function adminSessionIdFor(accountId, senderId, personId) {
   return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20, 32)}`;
 }
 
+// app/lib/channel-pty-bridge/schedule-provenance.ts
+function parseScheduleProvenance(v) {
+  if (!v || typeof v !== "object") return void 0;
+  const o = v;
+  if (typeof o.accountId !== "string" || typeof o.eventId !== "string" || typeof o.dispatchedAt !== "string") {
+    return void 0;
+  }
+  if (!Array.isArray(o.authoredBy)) return void 0;
+  const authoredBy = o.authoredBy.filter((u) => typeof u === "string" && u.length > 0);
+  const createdByTool = typeof o.createdByTool === "string" && o.createdByTool.length > 0 ? o.createdByTool : null;
+  return { accountId: o.accountId, eventId: o.eventId, authoredBy, createdByTool, dispatchedAt: o.dispatchedAt };
+}
+
 // server/routes/channel/schedule-inject.ts
 var TAG16 = "[schedule-inject]";
+var UUID_V4 = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 function isLoopbackAddr(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
 function createScheduleInjectRoutes(deps) {
-  const app57 = new Hono();
-  app57.post("/", async (c) => {
+  const app61 = new Hono();
+  app61.post("/", async (c) => {
     const env = c.env;
     const remoteAddr = env?.incoming?.socket?.remoteAddress ?? "";
     if (!isLoopbackAddr(remoteAddr)) {
@@ -6206,6 +6236,8 @@ function createScheduleInjectRoutes(deps) {
     const destination = typeof body.destination === "string" ? body.destination : "";
     const prompt = typeof body.prompt === "string" ? body.prompt : "";
     const eventId = typeof body.eventId === "string" ? body.eventId : "";
+    const scheduleProvenance = parseScheduleProvenance(body.scheduleProvenance);
+    const overrideSessionId = typeof body.sessionId === "string" && UUID_V4.test(body.sessionId) ? body.sessionId : void 0;
     if (channel !== "whatsapp" && channel !== "telegram" || !destination || !prompt) {
       console.error(`${TAG16} reject reason=bad-request channel=${String(channel)} hasDestination=${Boolean(destination)} hasPrompt=${Boolean(prompt)}`);
       return c.json({ ok: false, error: "schedule-inject-bad-request" }, 400);
@@ -6224,7 +6256,7 @@ function createScheduleInjectRoutes(deps) {
         return c.json({ ok: false, error: "account-manager-unresolved" }, 403);
       }
       console.error(`${TAG16} op=effective-account eventId=${eventId} effectiveAccount=${effectiveAccount2}`);
-      const sessionId2 = adminSessionIdFor(effectiveAccount2, destination);
+      const sessionId2 = overrideSessionId ?? adminSessionIdFor(effectiveAccount2, destination);
       const reply2 = (text) => deps.sendWhatsAppText(houseAccountId, destination, text);
       try {
         await deps.waHandleInbound({
@@ -6241,6 +6273,8 @@ function createScheduleInjectRoutes(deps) {
           text: prompt,
           media: [],
           source: "schedule",
+          scheduleProvenance,
+          scheduledSessionId: overrideSessionId,
           reply: reply2
         });
       } catch (err) {
@@ -6258,7 +6292,7 @@ function createScheduleInjectRoutes(deps) {
       return c.json({ ok: false, error: "no-admin-bot-token" }, 400);
     }
     const chatId = Number(destination);
-    const sessionId = adminSessionIdFor(effectiveAccount, destination);
+    const sessionId = overrideSessionId ?? adminSessionIdFor(effectiveAccount, destination);
     const reply = (text) => deps.sendTelegramText(botToken, chatId, text);
     try {
       await deps.tgHandleInbound({
@@ -6269,6 +6303,8 @@ function createScheduleInjectRoutes(deps) {
         personId: null,
         text: prompt,
         source: "schedule",
+        scheduleProvenance,
+        scheduledSessionId: overrideSessionId,
         reply
       });
     } catch (err) {
@@ -6278,7 +6314,7 @@ function createScheduleInjectRoutes(deps) {
     console.error(`${TAG16} op=inject-spawn eventId=${eventId} sessionId=${sessionId} result=ok status=-`);
     return c.json({ ok: true }, 200);
   });
-  return app57;
+  return app61;
 }
 
 // server/index.ts
@@ -7288,9 +7324,124 @@ function reconcileCredsOnDisk(opts) {
   return entries;
 }
 
+// app/lib/whatsapp-reader/select-sessions.ts
+function isReaderChannelSession(role, channel) {
+  return role === "admin" && (channel === "whatsapp" || channel === "telegram") || role === "public" && (channel === "whatsapp" || channel === "webchat");
+}
+function selectReaderChannelSessions(rows) {
+  return rows.filter((r) => isReaderChannelSession(r.role, r.channel)).sort((a, b) => b.startedAt.localeCompare(a.startedAt)).map((r) => ({
+    sessionId: r.sessionId,
+    projectDir: r.projectDir,
+    title: r.title,
+    senderId: r.senderId,
+    startedAt: r.startedAt,
+    channel: r.channel,
+    role: r.role,
+    operatorName: null,
+    whatsappName: null,
+    lastMessageAt: r.lastMessageAt,
+    modelGated: r.modelGated,
+    model: r.model,
+    source: "session"
+  }));
+}
+function conversationCounterpartyPhone(remoteJid, earliestSenderTelephone) {
+  if (remoteJid.endsWith("@g.us")) return null;
+  if (remoteJid.endsWith("@s.whatsapp.net")) return jidToE164(remoteJid) ?? earliestSenderTelephone;
+  return earliestSenderTelephone;
+}
+function counterpartyBoundToSubAccount(managerPhones, counterpartyPhone) {
+  return counterpartyPhone != null && managerPhones.some((mp) => phonesMatch(mp, counterpartyPhone));
+}
+function buildStoreConversationRows(accountId, summaries) {
+  const rows = [];
+  for (const [remoteJid, { first, last, firstNamedSender }] of summaries) {
+    const scope = last.scope;
+    const senderTelephone = conversationCounterpartyPhone(remoteJid, first.senderTelephone);
+    rows.push({
+      sessionId: "",
+      projectDir: "",
+      title: remoteJid,
+      senderId: senderTelephone,
+      startedAt: first.dateSent,
+      channel: "whatsapp",
+      role: scope === "admin" ? "admin" : "public",
+      operatorName: null,
+      whatsappName: firstNamedSender,
+      lastMessageAt: last.dateSent,
+      modelGated: false,
+      model: null,
+      source: "store",
+      accountId,
+      remoteJid,
+      scope
+    });
+  }
+  return rows.sort((a, b) => (b.lastMessageAt ?? "").localeCompare(a.lastMessageAt ?? ""));
+}
+
+// app/lib/whatsapp/sub-account-recall.ts
+function resolveStoreProjection(params) {
+  const { requestedAccountId, houseId, validAccountIds, houseAccountManagers } = params;
+  const requestedIsValid = validAccountIds.includes(requestedAccountId);
+  const isSubAccount = houseId !== null && validAccountIds.length > 1 && requestedIsValid && requestedAccountId !== houseId;
+  if (!isSubAccount) return { storeAccountId: requestedAccountId, managerPhones: null };
+  return {
+    storeAccountId: houseId,
+    managerPhones: managerPhonesForAccount(houseAccountManagers, requestedAccountId)
+  };
+}
+function filterConversationsForSubAccount(conversations, managerPhones) {
+  const out = /* @__PURE__ */ new Map();
+  for (const [remoteJid, msgs] of conversations) {
+    const counterparty = conversationCounterpartyPhone(remoteJid, msgs[0]?.senderTelephone ?? "");
+    if (counterpartyBoundToSubAccount(managerPhones, counterparty)) out.set(remoteJid, msgs);
+  }
+  return out;
+}
+
+// app/lib/whatsapp/authorize-recall-read.ts
+function authorizeRecallRead(input) {
+  const { requestedAccountId } = input;
+  const callerAccountId = input.callerAccountId && input.callerAccountId.length > 0 ? input.callerAccountId : null;
+  const houseAdminScope = input.houseAdminScope && input.houseAdminScope.length > 0 ? input.houseAdminScope : null;
+  if (houseAdminScope) return { authorized: true };
+  if (callerAccountId && requestedAccountId === callerAccountId) return { authorized: true };
+  return {
+    authorized: false,
+    reason: `Not authorized to read WhatsApp history for account "${requestedAccountId}". This session may only read its own account.`
+  };
+}
+
 // server/routes/whatsapp.ts
 var TAG21 = "[whatsapp:api]";
 var PLATFORM_ROOT5 = process.env.MAXY_PLATFORM_ROOT || "";
+function projectionFor(requestedAccountId) {
+  const validAccounts = listValidAccounts();
+  if (validAccounts.length <= 1) return { storeAccountId: requestedAccountId, managerPhones: null };
+  let houseId = null;
+  try {
+    houseId = resolveHouseOrSoleAccountId(ACCOUNTS_DIR);
+  } catch {
+    houseId = null;
+  }
+  const houseAccount = houseId ? validAccounts.find((a) => a.accountId === houseId) : void 0;
+  const houseAccountManagers = houseAccount ? readAccountManagers(houseAccount.accountDir) : {};
+  return resolveStoreProjection({
+    requestedAccountId,
+    houseId,
+    validAccountIds: validAccounts.map((a) => a.accountId),
+    houseAccountManagers
+  });
+}
+function callerScopeDenial(c, requestedAccountId) {
+  const callerAccountId = c.req.header("x-maxy-caller-account")?.trim() || null;
+  const houseAdminScope = c.req.header("x-maxy-house-admin-scope")?.trim() || null;
+  const decision = authorizeRecallRead({ requestedAccountId, callerAccountId, houseAdminScope });
+  if (decision.authorized) return null;
+  console.error(`[whatsapp-read-tool] op=authz-deny requested=${requestedAccountId} caller=${callerAccountId ?? "none"} houseAdmin=${houseAdminScope ? "y" : "n"}`);
+  return c.json({ error: decision.reason }, 403);
+}
 var app2 = new Hono();
 app2.get("/status", (c) => {
   try {
@@ -7595,6 +7746,8 @@ app2.get("/activity", (c) => {
 app2.get("/conversations", (c) => {
   try {
     const accountId = validateAccountId(c.req.query("accountId") ?? null);
+    const denial = callerScopeDenial(c, accountId);
+    if (denial) return denial;
     const jids = listConversationJids(accountId);
     const conversations = jids.map((jid) => {
       const messages = getMessages(accountId, jid);
@@ -7617,6 +7770,8 @@ app2.get("/conversations", (c) => {
 app2.get("/messages", (c) => {
   try {
     const accountId = validateAccountId(c.req.query("accountId") ?? null);
+    const denial = callerScopeDenial(c, accountId);
+    if (denial) return denial;
     const jid = c.req.query("jid");
     if (!jid) {
       return c.json({ error: "Missing required parameter: jid" }, 400);
@@ -7638,9 +7793,14 @@ app2.get("/conversation-graph-state", async (c) => {
     const jid = c.req.query("jid");
     const accountIdQuery = c.req.query("accountId");
     const t0 = Date.now();
+    const denial = callerScopeDenial(c, validateAccountId(accountIdQuery ?? null));
+    if (denial) return denial;
     if (!directCacheKey && !jid) {
-      const accountId2 = validateAccountId(accountIdQuery ?? null);
-      const conversations = readAllConversations(accountId2);
+      const requestedAccountId = validateAccountId(accountIdQuery ?? null);
+      const projection2 = projectionFor(requestedAccountId);
+      const managerPhonesBound = projection2.managerPhones?.length ?? 0;
+      const allConversations = readAllConversations(projection2.storeAccountId);
+      const conversations = projection2.managerPhones ? filterConversationsForSubAccount(allConversations, projection2.managerPhones) : allConversations;
       const rows2 = [];
       const nameCache = /* @__PURE__ */ new Map();
       let unresolvedSenders = 0;
@@ -7652,7 +7812,7 @@ app2.get("/conversation-graph-state", async (c) => {
             if (!nameCache.has(m.senderTelephone)) {
               const result = await session.run(
                 `MATCH (p:Person {telephone: $telephone, accountId: $accountId}) RETURN p.givenName AS givenName, p.familyName AS familyName`,
-                { telephone: m.senderTelephone, accountId: accountId2 }
+                { telephone: m.senderTelephone, accountId: projection2.storeAccountId }
               );
               const rec = result.records[0];
               const resolved = rec ? [rec.get("givenName"), rec.get("familyName")].filter(Boolean).join(" ") || null : null;
@@ -7674,8 +7834,8 @@ app2.get("/conversation-graph-state", async (c) => {
         if (session) await session.close();
       }
       const ms2 = Date.now() - t0;
-      console.error(`[mcp:whatsapp] tool=whatsapp-conversation-graph-state mode=all-senders accountId=${accountId2} rows=${rows2.length} unresolvedSenders=${unresolvedSenders} ms=${ms2}`);
-      return c.json({ accountId: accountId2, rows: rows2, unresolvedSenders, ms: ms2 });
+      console.error(`[whatsapp-read-tool] op=query scope=${requestedAccountId} storeAccount=${projection2.storeAccountId} managerPhonesBound=${managerPhonesBound} resultCount=${rows2.length} unresolvedSenders=${unresolvedSenders} ms=${ms2}`);
+      return c.json({ accountId: requestedAccountId, rows: rows2, unresolvedSenders, ms: ms2, managerPhonesBound });
     }
     let remoteJid;
     let accountId;
@@ -7690,7 +7850,13 @@ app2.get("/conversation-graph-state", async (c) => {
     accountId = validateAccountId(accountIdQuery ?? null);
     remoteJid = jid;
     cacheKey = isGroupJid(remoteJid) ? deriveCacheKey({ agentType: "public", accountId, senderPhone: "", isGroup: true, groupJid: remoteJid }) : deriveCacheKey({ agentType: "public", accountId, senderPhone: remoteJid.replace(/^(\d+)(?::\d+)?@s\.whatsapp\.net$/i, "$1"), isGroup: false });
-    const messages = readConversation(accountId, remoteJid);
+    const projection = projectionFor(accountId);
+    const storeMessages = readConversation(projection.storeAccountId, remoteJid);
+    const counterpartyBound = projection.managerPhones == null || counterpartyBoundToSubAccount(
+      projection.managerPhones,
+      conversationCounterpartyPhone(remoteJid, storeMessages[0]?.senderTelephone ?? "")
+    );
+    const messages = counterpartyBound ? storeMessages : [];
     const sessionId = messages[0]?.sessionId ?? null;
     const rows = messages.map((m) => ({
       messageId: m.messageId,
@@ -7700,12 +7866,12 @@ app2.get("/conversation-graph-state", async (c) => {
       body: m.body
     }));
     const ms = Date.now() - t0;
-    console.error(`[mcp:whatsapp] tool=whatsapp-conversation-graph-state cacheKey=${cacheKey} graphRows=${rows.length} sessionId=${sessionId ?? "null"} ms=${ms}`);
+    console.error(`[whatsapp-read-tool] op=query mode=single scope=${accountId} storeAccount=${projection.storeAccountId} graphRows=${rows.length} sessionId=${sessionId ?? "null"} ms=${ms}`);
     return c.json({
       cacheKey,
       sessionId,
       graphRows: rows,
-      cypher: `on-disk read: ~/.<brand>/data/whatsapp-messages/${accountId}/${remoteJid}.jsonl`,
+      cypher: `on-disk read: ~/.<brand>/data/whatsapp-messages/${projection.storeAccountId}/${remoteJid}.jsonl`,
       ms
     });
   } catch (err) {
@@ -7755,57 +7921,6 @@ import { basename as basename5, dirname as dirname4, isAbsolute, join as join14,
 // server/routes/admin/sidebar-sessions.ts
 import { readdirSync as readdirSync5, readFileSync as readFileSync12, statSync as statSync3 } from "fs";
 import { basename as basename4, dirname as dirname3, join as join11, resolve as resolve11 } from "path";
-
-// app/lib/whatsapp-reader/select-sessions.ts
-function isReaderChannelSession(role, channel) {
-  return role === "admin" && (channel === "whatsapp" || channel === "telegram") || role === "public" && (channel === "whatsapp" || channel === "webchat");
-}
-function selectReaderChannelSessions(rows) {
-  return rows.filter((r) => isReaderChannelSession(r.role, r.channel)).sort((a, b) => b.startedAt.localeCompare(a.startedAt)).map((r) => ({
-    sessionId: r.sessionId,
-    projectDir: r.projectDir,
-    title: r.title,
-    senderId: r.senderId,
-    startedAt: r.startedAt,
-    channel: r.channel,
-    role: r.role,
-    operatorName: null,
-    whatsappName: null,
-    lastMessageAt: r.lastMessageAt,
-    modelGated: r.modelGated,
-    model: r.model,
-    source: "session"
-  }));
-}
-function buildStoreConversationRows(accountId, summaries) {
-  const rows = [];
-  for (const [remoteJid, { first, last, firstNamedSender }] of summaries) {
-    const scope = last.scope;
-    const isGroup = remoteJid.endsWith("@g.us");
-    const senderTelephone = isGroup ? null : remoteJid.endsWith("@s.whatsapp.net") ? jidToE164(remoteJid) ?? first.senderTelephone : first.senderTelephone;
-    rows.push({
-      sessionId: "",
-      projectDir: "",
-      title: remoteJid,
-      senderId: senderTelephone,
-      startedAt: first.dateSent,
-      channel: "whatsapp",
-      role: scope === "admin" ? "admin" : "public",
-      operatorName: null,
-      whatsappName: firstNamedSender,
-      lastMessageAt: last.dateSent,
-      modelGated: false,
-      model: null,
-      source: "store",
-      accountId,
-      remoteJid,
-      scope
-    });
-  }
-  return rows.sort((a, b) => (b.lastMessageAt ?? "").localeCompare(a.lastMessageAt ?? ""));
-}
-
-// server/routes/admin/sidebar-sessions.ts
 var SESSION_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.jsonl$/i;
 function lastAssistantModel(body) {
   const lines = body.split("\n");
@@ -8279,7 +8394,7 @@ function unwrapChannel(text) {
   }
   return source ? { text: inner, source } : { text: inner };
 }
-var COMPOSED_ADMIN_FRAME = /^## Context\n([\s\S]*)\n\n## Instruction\n[\s\S]*$/;
+var COMPOSED_ADMIN_FRAME = /^(?:## Standing rules\n[\s\S]*?\n\n)?## Context\n([\s\S]*)\n\n## Instruction\n[\s\S]*$/;
 var UPLOAD_ANNOTATION = /(?:\n\n)?\[The operator uploaded \d+ file\(s\): [\s\S]*\]$/;
 function rawFromComposedAdminFrame(text) {
   const context = text.match(COMPOSED_ADMIN_FRAME)?.[1];
@@ -8646,7 +8761,7 @@ app4.get("/conversations", requireAdminSession, async (c) => {
       managerPhonesBound = managerPhones.length;
       if (managerPhones.length > 0) {
         managedRows = buildStoreConversationRows(houseId, readConversationSummaries(houseId)).filter(
-          (r) => r.senderId != null && managerPhones.some((mp) => phonesMatch(mp, r.senderId))
+          (r) => counterpartyBoundToSubAccount(managerPhones, r.senderId)
         );
       }
     }
@@ -9874,8 +9989,8 @@ async function reapplyLeversViaManager() {
 var WEBCHAT_SEND_TURN_WINDOW_MS = Number(process.env.WEBCHAT_SEND_TURN_WINDOW_MS ?? String(15e3));
 var sendSeq = 0;
 function createWebchatRoutes(deps) {
-  const app57 = new Hono();
-  app57.post("/send", requireAdminSession, async (c) => {
+  const app61 = new Hono();
+  app61.post("/send", requireAdminSession, async (c) => {
     let accountId;
     try {
       accountId = resolvePlatformAccountId();
@@ -10075,7 +10190,7 @@ ${note}` : note;
     if (turnTimer.unref) turnTimer.unref();
     return c.json({ ok: true });
   });
-  app57.post("/interrupt", requireAdminSession, async (c) => {
+  app61.post("/interrupt", requireAdminSession, async (c) => {
     const cacheKey = c.get("cacheKey");
     const requesterUserId = (cacheKey ? getUserIdForSession(cacheKey) : void 0) ?? null;
     const primaryUserId = resolvePrimaryAdminUserId();
@@ -10103,7 +10218,7 @@ ${note}` : note;
     }
     return c.json({ ok: true, stopped: outcome.stopped, intId: outcome.intId, deadChild: outcome.deadChild }, 200);
   });
-  app57.post("/settings", requireAdminSession, async (c) => {
+  app61.post("/settings", requireAdminSession, async (c) => {
     const body = await c.req.json().catch(() => null);
     const op = body?.op;
     const value = body?.value;
@@ -10143,7 +10258,7 @@ ${note}` : note;
     console.log(`[webchat:settings] op=${op} outcome=accepted value=${value} settingsApplied=${settingsApplied}`);
     return c.json({ ok: true, settingsApplied });
   });
-  app57.get("/session", requireAdminSession, async (c) => {
+  app61.get("/session", requireAdminSession, async (c) => {
     let accountId;
     try {
       accountId = resolvePlatformAccountId();
@@ -10221,7 +10336,7 @@ ${note}` : note;
     const indicators = await fetchComposerIndicators(sessionId);
     return c.json({ sessionId, projectDir, sizeBytes: jsonlSizeBytes(projectDir, sessionId), pendingPermissionPrompt: deps.pendingPromptFor?.(`session:${sessionId}`) ?? null, deliveryFailure: deps.deliveryFailureFor?.(`session:${sessionId}`) ?? null, ...indicators, ...readLevers(account) });
   });
-  app57.post("/permission-verdict", requireAdminSession, async (c) => {
+  app61.post("/permission-verdict", requireAdminSession, async (c) => {
     const body = await c.req.json().catch(() => null);
     const sessionId = body?.sessionId;
     const requestId = body?.request_id;
@@ -10238,7 +10353,7 @@ ${note}` : note;
     const ok = deps.resolvePermissionVerdict?.(`session:${sessionId}`, requestId, behavior) ?? false;
     return c.json({ ok });
   });
-  return app57;
+  return app61;
 }
 
 // server/routes/webchat-greeting.ts
@@ -13275,18 +13390,18 @@ var ALLOWED_EVENTS = /* @__PURE__ */ new Set([
 ]);
 var app20 = new Hono();
 app20.post("/", async (c) => {
-  const TAG39 = "[admin:events]";
+  const TAG44 = "[admin:events]";
   let body;
   try {
     body = await c.req.json();
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG39} reject reason=body-not-json detail=${detail}`);
+    console.error(`${TAG44} reject reason=body-not-json detail=${detail}`);
     return c.json({ ok: false, detail: "Request body was not valid JSON" }, 400);
   }
   const event = typeof body.event === "string" ? body.event : "";
   if (!ALLOWED_EVENTS.has(event)) {
-    console.error(`${TAG39} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
+    console.error(`${TAG44} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
     return c.json({ ok: false, detail: `Event "${event}" is not allowed` }, 400);
   }
   const rawFields = body.fields && typeof body.fields === "object" ? body.fields : {};
@@ -19221,52 +19336,307 @@ app45.get("/booking-link", requireAdminSession, (c) => {
 });
 var calendar_default = app45;
 
-// server/routes/admin/index.ts
+// app/lib/time-entry-format.ts
+function secondsBetween(startIso, endIso) {
+  const s = Date.parse(startIso);
+  const e = Date.parse(endIso);
+  if (!Number.isFinite(s) || !Number.isFinite(e)) return 0;
+  return Math.max(0, Math.round((e - s) / 1e3));
+}
+function toNum(v) {
+  if (v == null) return 0;
+  if (typeof v === "number") return v;
+  if (typeof v === "object" && typeof v.toNumber === "function") {
+    return v.toNumber();
+  }
+  const n = Number(v);
+  return Number.isFinite(n) ? n : 0;
+}
+
+// server/routes/admin/tasks-list.ts
+var TAG33 = "[task-timer]";
+var COMPLETED = /* @__PURE__ */ new Set(["completed"]);
+var HIDDEN_FROM_OPEN = /* @__PURE__ */ new Set(["completed", "cancelled"]);
 var app46 = new Hono();
-app46.route("/session", session_default);
-app46.route("/accounts", accounts_default);
-app46.route("/logs", logs_default);
-app46.route("/claude-info", claude_info_default);
-app46.route("/attachment", attachment_default);
-app46.route("/agents", agents_default);
-app46.route("/sessions", sessions_default);
-app46.route("/claude-sessions", claude_sessions_default);
-app46.route("/log-ingest", log_ingest_default);
-app46.route("/events", events_default);
-app46.route("/files", files_default);
-app46.route("/graph-search", graph_search_default);
-app46.route("/graph-subgraph", graph_subgraph_default);
-app46.route("/graph-delete", graph_delete_default);
-app46.route("/graph-restore", graph_restore_default);
-app46.route("/graph-labels-in-graph", graph_labels_in_graph_default);
-app46.route("/graph-default-view", graph_default_view_default);
-app46.route("/sidebar-artefacts", sidebar_artefacts_default);
-app46.route("/sidebar-sessions", sidebar_sessions_default);
-app46.route("/session-delete", session_delete_default);
-app46.route("/session-stop", session_stop_default);
-app46.route("/session-archive", session_archive_default);
-app46.route("/session-rename", session_rename_default);
-app46.route("/session-usage", session_usage_default);
-app46.route("/browser", browser_default);
-app46.route("/session-rc-spawn", session_rc_spawn_default);
-app46.route("/session-reseat", session_reseat_default);
-app46.route("/system-stats", system_stats_default);
-app46.route("/health-brand", health_default2);
-app46.route("/linkedin-ingest", linkedin_ingest_default);
-app46.route("/post-turn-context", post_turn_context_default);
-app46.route("/public-session-context", public_session_context_default);
-app46.route("/public-session-exit", public_session_exit_default);
-app46.route("/access-session-evict", access_session_evict_default);
-app46.route("/enrol-person", enrol_person_default);
-app46.route("/calendar", calendar_default);
-var admin_default = app46;
+app46.get("/", requireAdminSession, async (c) => {
+  const cacheKey = c.var.cacheKey;
+  const accountId = getAccountIdForSession(cacheKey);
+  if (!accountId) {
+    console.error(`${TAG33} op=list auth-rejected reason="no account for session"`);
+    return c.json({ error: "Account not found for session" }, 401);
+  }
+  const session = getSession();
+  try {
+    const result = await session.run(
+      `MATCH (t:Task {accountId: $accountId})
+       OPTIONAL MATCH (te:TimeEntry {taskId: t.taskId, accountId: $accountId})
+         WHERE te.endedAt IS NULL
+       WITH t, te ORDER BY te.startedAt
+       WITH t, head(collect(te)) AS openTe
+       RETURN t.taskId AS taskId, t.name AS name, t.clientName AS clientName,
+              t.propertyAddress AS propertyAddress, t.fee AS fee, t.status AS status,
+              coalesce(t.secondsLogged, 0) AS secondsLogged,
+              openTe.startedAt AS runningStartedAt
+       ORDER BY t.createdAt DESC`,
+      { accountId }
+    );
+    const open = [];
+    const completed = [];
+    for (const rec of result.records) {
+      const status = rec.get("status") ?? "pending";
+      const runningStartedAt = rec.get("runningStartedAt") ?? null;
+      const fee = rec.get("fee");
+      const row = {
+        taskId: rec.get("taskId"),
+        name: rec.get("name") ?? "",
+        clientName: rec.get("clientName") ?? null,
+        propertyAddress: rec.get("propertyAddress") ?? null,
+        fee: fee == null ? null : toNum(fee),
+        status,
+        secondsLogged: toNum(rec.get("secondsLogged")),
+        running: runningStartedAt !== null,
+        runningStartedAt
+      };
+      if (COMPLETED.has(status)) completed.push(row);
+      else if (!HIDDEN_FROM_OPEN.has(status)) open.push(row);
+    }
+    console.log(`${TAG33} op=list account=${accountId} open=${open.length} completed=${completed.length}`);
+    return c.json({ open, completed });
+  } catch (err) {
+    console.error(`${TAG33} op=list error="${err instanceof Error ? err.message : String(err)}"`);
+    return c.json({ error: "tasks-list-failed" }, 500);
+  } finally {
+    await session.close();
+  }
+});
+var tasks_list_default = app46;
+
+// server/routes/admin/task-timer-start.ts
+import { randomUUID as randomUUID13 } from "crypto";
+import neo4j5 from "neo4j-driver";
+var TAG34 = "[task-timer]";
+var app47 = new Hono();
+app47.post("/", requireAdminSession, async (c) => {
+  const cacheKey = c.var.cacheKey;
+  const accountId = getAccountIdForSession(cacheKey);
+  if (!accountId) return c.json({ error: "Account not found for session" }, 401);
+  let body;
+  try {
+    body = await c.req.json();
+  } catch {
+    return c.json({ error: "invalid-json" }, 400);
+  }
+  const taskId = typeof body.taskId === "string" ? body.taskId : "";
+  if (!taskId) return c.json({ error: "taskId required" }, 400);
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const session = getSession();
+  try {
+    const target = await session.run(
+      `MATCH (t:Task {taskId: $taskId, accountId: $accountId}) RETURN t.taskId AS taskId LIMIT 1`,
+      { taskId, accountId }
+    );
+    if (target.records.length === 0) {
+      console.error(`${TAG34} op=start taskId=${taskId} accountId=${accountId} result=task-not-found`);
+      return c.json({ error: "task-not-found" }, 404);
+    }
+    const open = await session.run(
+      `MATCH (te:TimeEntry {accountId: $accountId}) WHERE te.endedAt IS NULL
+       RETURN te.entryId AS entryId, te.taskId AS taskId, te.startedAt AS startedAt
+       ORDER BY te.startedAt LIMIT 1`,
+      { accountId }
+    );
+    const priorEntryId = open.records[0]?.get("entryId");
+    const priorTaskId = open.records[0]?.get("taskId");
+    const priorStartedAt = open.records[0]?.get("startedAt");
+    console.log(`${TAG34} op=start taskId=${taskId} accountId=${accountId} priorOpen=${priorTaskId ?? "none"}`);
+    if (priorEntryId && priorTaskId === taskId) {
+      return c.json({ ok: true, running: true, entryId: priorEntryId, startedAt: priorStartedAt });
+    }
+    if (priorEntryId && priorStartedAt && priorTaskId) {
+      const seconds = secondsBetween(priorStartedAt, now);
+      await session.run(
+        `MATCH (te:TimeEntry {entryId: $priorEntryId}) WHERE te.endedAt IS NULL
+         SET te.endedAt = $now, te.seconds = $seconds
+         WITH te
+         MATCH (t:Task {taskId: $priorTaskId, accountId: $accountId})
+         SET t.secondsLogged = coalesce(t.secondsLogged, 0) + $seconds`,
+        { priorEntryId, priorTaskId, accountId, now, seconds: neo4j5.int(seconds) }
+      );
+      console.log(`${TAG34} op=autostop taskId=${priorTaskId} entryId=${priorEntryId} seconds=${seconds}`);
+    }
+    const entryId = randomUUID13();
+    await session.run(
+      `MATCH (t:Task {taskId: $taskId, accountId: $accountId})
+       CREATE (te:TimeEntry {entryId: $entryId, taskId: $taskId, accountId: $accountId, startedAt: $now, endedAt: null})
+       CREATE (te)-[:LOGGED_AGAINST]->(t)`,
+      { taskId, accountId, entryId, now }
+    );
+    console.log(`${TAG34} op=opened taskId=${taskId} entryId=${entryId} startedAt=${now}`);
+    return c.json({ ok: true, running: true, entryId, startedAt: now });
+  } catch (err) {
+    console.error(`${TAG34} op=start error="${err instanceof Error ? err.message : String(err)}"`);
+    return c.json({ error: "task-timer-start-failed" }, 500);
+  } finally {
+    await session.close();
+  }
+});
+var task_timer_start_default = app47;
+
+// server/routes/admin/task-timer-stop.ts
+import neo4j6 from "neo4j-driver";
+var TAG35 = "[task-timer]";
+var app48 = new Hono();
+app48.post("/", requireAdminSession, async (c) => {
+  const cacheKey = c.var.cacheKey;
+  const accountId = getAccountIdForSession(cacheKey);
+  if (!accountId) return c.json({ error: "Account not found for session" }, 401);
+  let body;
+  try {
+    body = await c.req.json();
+  } catch {
+    return c.json({ error: "invalid-json" }, 400);
+  }
+  const taskId = typeof body.taskId === "string" ? body.taskId : "";
+  if (!taskId) return c.json({ error: "taskId required" }, 400);
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const session = getSession();
+  try {
+    const open = await session.run(
+      `MATCH (te:TimeEntry {taskId: $taskId, accountId: $accountId}) WHERE te.endedAt IS NULL
+       RETURN te.entryId AS entryId, te.startedAt AS startedAt
+       ORDER BY te.startedAt LIMIT 1`,
+      { taskId, accountId }
+    );
+    const entryId = open.records[0]?.get("entryId");
+    const startedAt = open.records[0]?.get("startedAt");
+    if (!entryId || !startedAt) {
+      const cur = await session.run(
+        `MATCH (t:Task {taskId: $taskId, accountId: $accountId})
+         RETURN coalesce(t.secondsLogged, 0) AS secondsLogged`,
+        { taskId, accountId }
+      );
+      const secondsLogged2 = toNum(cur.records[0]?.get("secondsLogged"));
+      console.log(`${TAG35} op=stop taskId=${taskId} entryId=none seconds=0 totalAfter=${secondsLogged2}`);
+      return c.json({ ok: true, running: false, seconds: 0, secondsLogged: secondsLogged2 });
+    }
+    const seconds = secondsBetween(startedAt, now);
+    await session.run(
+      `MATCH (te:TimeEntry {entryId: $entryId}) WHERE te.endedAt IS NULL
+       SET te.endedAt = $now, te.seconds = $seconds
+       WITH te
+       MATCH (t:Task {taskId: $taskId, accountId: $accountId})
+       SET t.secondsLogged = coalesce(t.secondsLogged, 0) + $seconds`,
+      { entryId, taskId, accountId, now, seconds: neo4j6.int(seconds) }
+    );
+    const verify = await session.run(
+      `MATCH (t:Task {taskId: $taskId, accountId: $accountId})
+       OPTIONAL MATCH (te:TimeEntry {taskId: $taskId, accountId: $accountId}) WHERE te.endedAt IS NOT NULL
+       RETURN coalesce(sum(te.seconds), 0) AS sumEntries, coalesce(t.secondsLogged, 0) AS secondsLogged`,
+      { taskId, accountId }
+    );
+    const sumEntries = toNum(verify.records[0]?.get("sumEntries"));
+    const secondsLogged = toNum(verify.records[0]?.get("secondsLogged"));
+    console.log(`${TAG35} op=stop taskId=${taskId} entryId=${entryId} seconds=${seconds} totalAfter=${secondsLogged}`);
+    console.log(`${TAG35} op=persisted taskId=${taskId} entryId=${entryId} sumEntries=${sumEntries} secondsLogged=${secondsLogged}`);
+    return c.json({ ok: true, running: false, seconds, secondsLogged });
+  } catch (err) {
+    console.error(`${TAG35} op=stop error="${err instanceof Error ? err.message : String(err)}"`);
+    return c.json({ error: "task-timer-stop-failed" }, 500);
+  } finally {
+    await session.close();
+  }
+});
+var task_timer_stop_default = app48;
+
+// server/routes/admin/task-complete.ts
+var TAG36 = "[task-timer]";
+var app49 = new Hono();
+app49.post("/", requireAdminSession, async (c) => {
+  const cacheKey = c.var.cacheKey;
+  const accountId = getAccountIdForSession(cacheKey);
+  if (!accountId) return c.json({ error: "Account not found for session" }, 401);
+  let body;
+  try {
+    body = await c.req.json();
+  } catch {
+    return c.json({ error: "invalid-json" }, 400);
+  }
+  const taskId = typeof body.taskId === "string" ? body.taskId : "";
+  if (!taskId) return c.json({ error: "taskId required" }, 400);
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const session = getSession();
+  try {
+    const result = await session.run(
+      `MATCH (t:Task {taskId: $taskId, accountId: $accountId})
+       SET t.status = 'completed', t.updatedAt = $now
+       RETURN t.taskId AS taskId, coalesce(t.secondsLogged, 0) AS secondsLogged`,
+      { taskId, accountId, now }
+    );
+    if (result.records.length === 0) {
+      return c.json({ error: "task-not-found" }, 404);
+    }
+    const secondsLogged = toNum(result.records[0].get("secondsLogged"));
+    console.log(`${TAG36} op=complete taskId=${taskId} status=completed secondsLogged=${secondsLogged}`);
+    return c.json({ ok: true, status: "completed", secondsLogged });
+  } catch (err) {
+    console.error(`${TAG36} op=complete error="${err instanceof Error ? err.message : String(err)}"`);
+    return c.json({ error: "task-complete-failed" }, 500);
+  } finally {
+    await session.close();
+  }
+});
+var task_complete_default = app49;
+
+// server/routes/admin/index.ts
+var app50 = new Hono();
+app50.route("/session", session_default);
+app50.route("/accounts", accounts_default);
+app50.route("/logs", logs_default);
+app50.route("/claude-info", claude_info_default);
+app50.route("/attachment", attachment_default);
+app50.route("/agents", agents_default);
+app50.route("/sessions", sessions_default);
+app50.route("/claude-sessions", claude_sessions_default);
+app50.route("/log-ingest", log_ingest_default);
+app50.route("/events", events_default);
+app50.route("/files", files_default);
+app50.route("/graph-search", graph_search_default);
+app50.route("/graph-subgraph", graph_subgraph_default);
+app50.route("/graph-delete", graph_delete_default);
+app50.route("/graph-restore", graph_restore_default);
+app50.route("/graph-labels-in-graph", graph_labels_in_graph_default);
+app50.route("/graph-default-view", graph_default_view_default);
+app50.route("/sidebar-artefacts", sidebar_artefacts_default);
+app50.route("/sidebar-sessions", sidebar_sessions_default);
+app50.route("/session-delete", session_delete_default);
+app50.route("/session-stop", session_stop_default);
+app50.route("/session-archive", session_archive_default);
+app50.route("/session-rename", session_rename_default);
+app50.route("/session-usage", session_usage_default);
+app50.route("/browser", browser_default);
+app50.route("/session-rc-spawn", session_rc_spawn_default);
+app50.route("/session-reseat", session_reseat_default);
+app50.route("/system-stats", system_stats_default);
+app50.route("/health-brand", health_default2);
+app50.route("/linkedin-ingest", linkedin_ingest_default);
+app50.route("/post-turn-context", post_turn_context_default);
+app50.route("/public-session-context", public_session_context_default);
+app50.route("/public-session-exit", public_session_exit_default);
+app50.route("/access-session-evict", access_session_evict_default);
+app50.route("/enrol-person", enrol_person_default);
+app50.route("/calendar", calendar_default);
+app50.route("/tasks-list", tasks_list_default);
+app50.route("/task-timer-start", task_timer_start_default);
+app50.route("/task-timer-stop", task_timer_stop_default);
+app50.route("/task-complete", task_complete_default);
+var admin_default = app50;
 
 // server/routes/access/verify-token.ts
-var TAG33 = "[access-verify]";
+var TAG37 = "[access-verify]";
 var MINT_TAG = "[access-session-mint]";
 var COOKIE_NAME = "__access_session";
-var app47 = new Hono();
-app47.post("/", async (c) => {
+var app51 = new Hono();
+app51.post("/", async (c) => {
   const ip = c.var.clientIp || "unknown";
   let body;
   try {
@@ -19281,39 +19651,39 @@ app47.post("/", async (c) => {
   }
   const rateMsg = checkAccessRateLimit(ip, agentSlug);
   if (rateMsg) {
-    console.error(`${TAG33} grantId=- agentSlug=${agentSlug} result=rate-limited ip=${ip}`);
+    console.error(`${TAG37} grantId=- agentSlug=${agentSlug} result=rate-limited ip=${ip}`);
     return c.json({ error: rateMsg }, 429);
   }
   const grant = await findGrantByMagicToken(token);
   if (!grant) {
     recordAccessFailedAttempt(ip, agentSlug);
-    console.error(`${TAG33} grantId=- agentSlug=${agentSlug} result=notfound ip=${ip}`);
+    console.error(`${TAG37} grantId=- agentSlug=${agentSlug} result=notfound ip=${ip}`);
     return c.json({ error: "invalid-or-expired-link" }, 401);
   }
   if (grant.agentSlug !== agentSlug) {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG33} grantId=${grant.grantId} agentSlug=${agentSlug} result=agent-mismatch grantAgent=${grant.agentSlug} ip=${ip}`
+      `${TAG37} grantId=${grant.grantId} agentSlug=${agentSlug} result=agent-mismatch grantAgent=${grant.agentSlug} ip=${ip}`
     );
     return c.json({ error: "invalid-or-expired-link" }, 401);
   }
   if (grant.status === "expired" || grant.status === "revoked") {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG33} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired status=${grant.status} ip=${ip}`
+      `${TAG37} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired status=${grant.status} ip=${ip}`
     );
     return c.json({ error: "access-no-longer-valid" }, 401);
   }
   if (grant.expiresAt !== null && grant.expiresAt < Date.now()) {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG33} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired reason=expiresAt-past ip=${ip}`
+      `${TAG37} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired reason=expiresAt-past ip=${ip}`
     );
     return c.json({ error: "access-no-longer-valid" }, 401);
   }
   if (!grant.sliceToken) {
     console.error(
-      `${TAG33} grantId=${grant.grantId} agentSlug=${agentSlug} result=no-slice-token reason=schema-violation`
+      `${TAG37} grantId=${grant.grantId} agentSlug=${agentSlug} result=no-slice-token reason=schema-violation`
     );
     return c.json({ error: "grant-misconfigured" }, 500);
   }
@@ -19329,12 +19699,12 @@ app47.post("/", async (c) => {
     await consumeMagicTokenAndActivate(grant.grantId);
   } catch (err) {
     console.error(
-      `${TAG33} grantId=${grant.grantId} agentSlug=${agentSlug} result=consume-failed err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG37} grantId=${grant.grantId} agentSlug=${agentSlug} result=consume-failed err="${err instanceof Error ? err.message : String(err)}"`
     );
     return c.json({ error: "verification-failed" }, 500);
   }
   clearAccessRateLimit(ip, agentSlug);
-  console.log(`${TAG33} grantId=${grant.grantId} agentSlug=${agentSlug} result=ok ip=${ip}`);
+  console.log(`${TAG37} grantId=${grant.grantId} agentSlug=${agentSlug} result=ok ip=${ip}`);
   console.log(
     `${MINT_TAG} grantId=${grant.grantId} sliceToken=${grant.sliceToken.slice(0, 8)} agentSlug=${agentSlug} personId=${grant.personId ?? "none"}`
   );
@@ -19348,7 +19718,7 @@ app47.post("/", async (c) => {
     displayName: grant.displayName
   });
 });
-var verify_token_default = app47;
+var verify_token_default = app51;
 
 // app/lib/access-email.ts
 import { spawn as spawn2 } from "child_process";
@@ -19410,10 +19780,10 @@ async function sendMagicLinkEmail(payload) {
 }
 
 // server/routes/access/request-magic-link.ts
-var TAG34 = "[access-request-link]";
-var app48 = new Hono();
+var TAG38 = "[access-request-link]";
+var app52 = new Hono();
 var VISITOR_MESSAGE = "If that email is on the invite list, a fresh link is on the way.";
-app48.post("/", async (c) => {
+app52.post("/", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -19427,18 +19797,18 @@ app48.post("/", async (c) => {
   }
   const rateMsg = checkRequestLinkRateLimit(contactValue);
   if (rateMsg) {
-    console.error(`${TAG34} contactValue=${maskContact(contactValue)} result=rate-limited`);
+    console.error(`${TAG38} contactValue=${maskContact(contactValue)} result=rate-limited`);
     return c.json({ error: rateMsg }, 429);
   }
   recordRequestLinkAttempt(contactValue);
   const accountId = process.env.ACCOUNT_ID ?? "";
   if (!accountId) {
-    console.error(`${TAG34} contactValue=${maskContact(contactValue)} result=no-account-id`);
+    console.error(`${TAG38} contactValue=${maskContact(contactValue)} result=no-account-id`);
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   const grant = await findActiveGrantByContact(contactValue, agentSlug, accountId);
   if (!grant) {
-    console.log(`${TAG34} contactValue=${maskContact(contactValue)} result=notfound`);
+    console.log(`${TAG38} contactValue=${maskContact(contactValue)} result=notfound`);
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   let token;
@@ -19446,7 +19816,7 @@ app48.post("/", async (c) => {
     token = await generateNewMagicToken(grant.grantId);
   } catch (err) {
     console.error(
-      `${TAG34} contactValue=${maskContact(contactValue)} result=mint-failed err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG38} contactValue=${maskContact(contactValue)} result=mint-failed err="${err instanceof Error ? err.message : String(err)}"`
     );
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
@@ -19478,22 +19848,22 @@ app48.post("/", async (c) => {
   });
   if (!sendResult.ok) {
     console.error(
-      `${TAG34} contactValue=${maskContact(contactValue)} result=send-failed err="${sendResult.error}"`
+      `${TAG38} contactValue=${maskContact(contactValue)} result=send-failed err="${sendResult.error}"`
     );
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   console.log(
-    `${TAG34} contactValue=${maskContact(contactValue)} result=ok messageId=${sendResult.messageId}`
+    `${TAG38} contactValue=${maskContact(contactValue)} result=ok messageId=${sendResult.messageId}`
   );
   return c.json({ message: VISITOR_MESSAGE }, 200);
 });
-var request_magic_link_default = app48;
+var request_magic_link_default = app52;
 
 // server/routes/access/index.ts
-var app49 = new Hono();
-app49.route("/verify-token", verify_token_default);
-app49.route("/request-magic-link", request_magic_link_default);
-var access_default = app49;
+var app53 = new Hono();
+app53.route("/verify-token", verify_token_default);
+app53.route("/request-magic-link", request_magic_link_default);
+var access_default = app53;
 
 // server/routes/sites.ts
 import { existsSync as existsSync28, readFileSync as readFileSync31, realpathSync as realpathSync6, statSync as statSync12 } from "fs";
@@ -19528,8 +19898,8 @@ function getExt(p) {
   if (idx < p.lastIndexOf("/")) return "";
   return p.slice(idx).toLowerCase();
 }
-var app50 = new Hono();
-app50.get("/:rel{.*}", (c) => {
+var app54 = new Hono();
+app54.get("/:rel{.*}", (c) => {
   const reqPath = c.req.path;
   const rawRel = c.req.param("rel") ?? "";
   const trimmed = rawRel.replace(/^\/+/, "").replace(/\/+$/, "");
@@ -19632,7 +20002,7 @@ app50.get("/:rel{.*}", (c) => {
     "X-Content-Type-Options": "nosniff"
   });
 });
-var sites_default = app50;
+var sites_default = app54;
 
 // app/lib/visitor-token.ts
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
@@ -19732,7 +20102,7 @@ function readBrandConfig() {
 }
 
 // server/routes/visitor-consent.ts
-var app51 = new Hono();
+var app55 = new Hono();
 var CONSENT_COOKIE_NAME = "mxy_consent";
 var CONSENT_COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 365;
 var DEFAULT_CONSENT_COPY = {
@@ -19777,17 +20147,17 @@ function siteSlugFromReferer(referer) {
     return "";
   }
 }
-app51.options("/consent", (c) => {
+app55.options("/consent", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app51.options("/brand-config", (c) => {
+app55.options("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app51.post("/consent", async (c) => {
+app55.post("/consent", async (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   let raw;
@@ -19827,7 +20197,7 @@ app51.post("/consent", async (c) => {
   console.log(`[consent] ${parsed.decision} site=${site} brand=${brandName} tokenBound=${tokenBound}`);
   return c.body(null, 204);
 });
-app51.get("/brand-config", (c) => {
+app55.get("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   const brand = readBrandConfig();
@@ -19837,7 +20207,7 @@ app51.get("/brand-config", (c) => {
   c.header("Cache-Control", "public, max-age=300");
   return c.json({ consent: { copy, palette } });
 });
-var visitor_consent_default = app51;
+var visitor_consent_default = app55;
 
 // server/routes/listings.ts
 function getCookie(headerValue, name) {
@@ -19864,8 +20234,8 @@ function appendConsentParams(pageUrl, token) {
 }
 var SAFE_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,118}[a-z0-9])?$/;
 var CHAT_SESSION_KEY_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{7,127}$/;
-var app52 = new Hono();
-app52.get("/:slug/click", async (c) => {
+var app56 = new Hono();
+app56.get("/:slug/click", async (c) => {
   const slug = c.req.param("slug") ?? "";
   const rawSession = c.req.query("session") ?? "";
   const sessionKey = CHAT_SESSION_KEY_RE.test(rawSession) ? rawSession : "invalid";
@@ -19929,10 +20299,10 @@ app52.get("/:slug/click", async (c) => {
   console.log(`[property-card-click] sessionKey=${sessionKey} listingSlug=${slug} consent=${consentCookie ?? "absent"} ts=${(/* @__PURE__ */ new Date()).toISOString()}`);
   return c.redirect(redirectUrl, 302);
 });
-var listings_default = app52;
+var listings_default = app56;
 
 // server/routes/visitor-event.ts
-var app53 = new Hono();
+var app57 = new Hono();
 var BOT_UA_RE = /\b(bot|crawl|spider|slurp|headlesschrome|phantomjs|googlebot|bingbot|yandex|baiduspider|ahrefsbot|semrushbot|mj12bot|dotbot|petalbot)\b/i;
 var buckets = /* @__PURE__ */ new Map();
 var RATE_LIMIT = 60;
@@ -19999,12 +20369,12 @@ function originAllowed(origin, allowlist) {
     return false;
   }
 }
-app53.options("/event", (c) => {
+app57.options("/event", (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   return c.body(null, 204);
 });
-app53.post("/event", async (c) => {
+app57.post("/event", async (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   const ua = c.req.header("user-agent") ?? "";
@@ -20209,7 +20579,7 @@ async function writeEvent(opts) {
     );
   }
 }
-var visitor_event_default = app53;
+var visitor_event_default = app57;
 
 // server/routes/session.ts
 import { resolve as resolve27 } from "path";
@@ -20255,8 +20625,8 @@ function withVisitorCookie(response, visitorId) {
     headers
   });
 }
-var app54 = new Hono();
-app54.post("/", async (c) => {
+var app58 = new Hono();
+app58.post("/", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -20403,7 +20773,7 @@ app54.post("/", async (c) => {
     newVisitorId
   );
 });
-var session_default2 = app54;
+var session_default2 = app58;
 
 // server/lib/calendar-slots.ts
 var WEEKDAYS = ["sun", "mon", "tue", "wed", "thu", "fri", "sat"];
@@ -20486,17 +20856,17 @@ function computeOpenSlots(config, busy, fromISO, toISO) {
 }
 
 // server/routes/calendar-public.ts
-var app55 = new Hono();
+var app59 = new Hono();
 function setCors(c) {
   c.header("Access-Control-Allow-Origin", "*");
   c.header("Access-Control-Allow-Methods", "GET, OPTIONS");
   c.header("Access-Control-Allow-Headers", "content-type");
 }
-app55.options("/free-busy", (c) => {
+app59.options("/free-busy", (c) => {
   setCors(c);
   return c.body(null, 204);
 });
-app55.get("/free-busy", async (c) => {
+app59.get("/free-busy", async (c) => {
   setCors(c);
   const from = c.req.query("from");
   const to = c.req.query("to");
@@ -20538,7 +20908,79 @@ app55.get("/free-busy", async (c) => {
     await session.close();
   }
 });
-var calendar_public_default = app55;
+var calendar_public_default = app59;
+
+// app/lib/timeentry-census.ts
+var TAG39 = "[timeentry-census]";
+function reconcileTimeEntries(rows, now, horizonMs) {
+  const openEntries = rows.openEntries.length;
+  let oldestOpenAgeMs = 0;
+  const perAccount = /* @__PURE__ */ new Map();
+  for (const e of rows.openEntries) {
+    oldestOpenAgeMs = Math.max(oldestOpenAgeMs, now - e.startedAtMs);
+    perAccount.set(e.accountId, (perAccount.get(e.accountId) ?? 0) + 1);
+  }
+  const maxOpenPerAccount = perAccount.size === 0 ? 0 : Math.max(...perAccount.values());
+  const driftTasks = rows.taskSums.filter((t) => t.secondsLogged !== t.sumEntries).length;
+  const oldestOpenAgeMin = Math.floor(oldestOpenAgeMs / 6e4);
+  const alarm = oldestOpenAgeMs > horizonMs || maxOpenPerAccount > 1 || driftTasks > 0;
+  return { openEntries, oldestOpenAgeMin, maxOpenPerAccount, driftTasks, alarm };
+}
+async function runTimeEntryCensusOnce(session, now, horizonMs) {
+  try {
+    const openRes = await session.run(
+      `MATCH (te:TimeEntry) WHERE te.endedAt IS NULL
+       RETURN te.accountId AS accountId, te.startedAt AS startedAt`
+    );
+    const openEntries = openRes.records.map((r) => ({
+      accountId: r.get("accountId") ?? "unknown",
+      startedAtMs: Date.parse(r.get("startedAt") ?? "") || now
+    }));
+    const sumRes = await session.run(
+      `MATCH (t:Task) WHERE t.secondsLogged IS NOT NULL
+       OPTIONAL MATCH (te:TimeEntry {taskId: t.taskId}) WHERE te.endedAt IS NOT NULL
+       RETURN t.taskId AS taskId, coalesce(t.secondsLogged, 0) AS secondsLogged, coalesce(sum(te.seconds), 0) AS sumEntries`
+    );
+    const taskSums = sumRes.records.map((r) => ({
+      taskId: r.get("taskId") ?? "",
+      secondsLogged: toNum(r.get("secondsLogged")),
+      sumEntries: toNum(r.get("sumEntries"))
+    }));
+    const finding = reconcileTimeEntries({ openEntries, taskSums }, now, horizonMs);
+    const line = `${TAG39} openEntries=${finding.openEntries} oldestOpenAgeMin=${finding.oldestOpenAgeMin} maxOpenPerAccount=${finding.maxOpenPerAccount} driftTasks=${finding.driftTasks}`;
+    if (finding.alarm) console.error(`${line} alarm=true`);
+    else console.log(line);
+    return finding;
+  } catch (err) {
+    console.error(`${TAG39} error="${err instanceof Error ? err.message : String(err)}"`);
+    return null;
+  }
+}
+var DEFAULT_INTERVAL_MS = 15 * 60 * 1e3;
+var DEFAULT_HORIZON_MS = 8 * 60 * 60 * 1e3;
+function startTimeEntryCensus(openSession, opts = {}) {
+  const intervalMs = opts.intervalMs ?? DEFAULT_INTERVAL_MS;
+  const horizonMs = opts.horizonMs ?? DEFAULT_HORIZON_MS;
+  const tick = async () => {
+    const session = openSession();
+    try {
+      await runTimeEntryCensusOnce(session, Date.now(), horizonMs);
+    } finally {
+      try {
+        await session.close();
+      } catch {
+      }
+    }
+  };
+  void tick();
+  const id = setInterval(() => {
+    void tick();
+  }, intervalMs);
+  if (typeof id.unref === "function") {
+    id.unref();
+  }
+  return () => clearInterval(id);
+}
 
 // app/lib/graph-health.ts
 var import_dist4 = __toESM(require_dist4(), 1);
@@ -21307,8 +21749,8 @@ var streamSSE = (c, cb, onError) => {
 
 // app/lib/whatsapp/gateway/routes.ts
 function createWaChannelRoutes(deps) {
-  const app57 = new Hono();
-  app57.get("/wa-channel/inbound", (c) => {
+  const app61 = new Hono();
+  app61.get("/wa-channel/inbound", (c) => {
     const senderId = c.req.query("senderId");
     if (!senderId) return c.json({ error: "senderId required" }, 400);
     return streamSSE(c, async (stream2) => {
@@ -21326,7 +21768,7 @@ function createWaChannelRoutes(deps) {
       }
     });
   });
-  app57.post("/wa-channel/reply", async (c) => {
+  app61.post("/wa-channel/reply", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const text = body?.text;
@@ -21347,7 +21789,7 @@ function createWaChannelRoutes(deps) {
     console.error(`[whatsapp-native] op=reply-dispatch senderId=${senderId} bytes=${bytes}`);
     return c.json({ ok: true });
   });
-  app57.post("/wa-channel/reply-document", async (c) => {
+  app61.post("/wa-channel/reply-document", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const files = body?.files;
@@ -21386,7 +21828,7 @@ function createWaChannelRoutes(deps) {
     }
     return c.json({ ok: true, results });
   });
-  app57.post("/wa-channel/ready", async (c) => {
+  app61.post("/wa-channel/ready", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     if (typeof senderId !== "string") {
@@ -21395,7 +21837,7 @@ function createWaChannelRoutes(deps) {
     deps.onReady?.(senderId);
     return c.json({ ok: true });
   });
-  app57.post("/wa-channel/received", async (c) => {
+  app61.post("/wa-channel/received", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const waMessageId = body?.waMessageId;
@@ -21405,7 +21847,7 @@ function createWaChannelRoutes(deps) {
     deps.onReceived?.(senderId, waMessageId);
     return c.json({ ok: true });
   });
-  app57.post("/wa-channel/turn-end", async (c) => {
+  app61.post("/wa-channel/turn-end", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const sessionId = body?.sessionId;
@@ -21421,7 +21863,7 @@ function createWaChannelRoutes(deps) {
     console.error(`[whatsapp-native] op=turn-end sessionId=${sid} replied=no delivered=none`);
     return c.json({ ok: true, delivered: "none" });
   });
-  return app57;
+  return app61;
 }
 
 // app/lib/whatsapp/gateway/wa-gateway.ts
@@ -21526,7 +21968,8 @@ var WaGateway = class {
         waMessageId: `wa-${++this.seq}`,
         media: input.media,
         source,
-        standingRules
+        standingRules,
+        scheduleProvenance: input.scheduleProvenance
       },
       Date.now()
     );
@@ -21544,7 +21987,9 @@ var WaGateway = class {
           role: input.role ?? "admin",
           personId: input.personId ?? null,
           gatewayUrl: this.deps.gatewayUrl,
-          serverPath: this.deps.serverPath
+          serverPath: this.deps.serverPath,
+          // Task 1526 — a scheduled firing's per-firing seat id; absent on real inbound.
+          sessionIdOverride: input.scheduledSessionId
         });
       } finally {
         this.spawning.delete(input.senderId);
@@ -21570,7 +22015,7 @@ var WaGateway = class {
 function buildWaSpawnRequest(input) {
   const personId = input.role === "public" && input.personId ? input.personId : void 0;
   return {
-    sessionId: adminSessionIdFor(input.accountId, input.senderId, personId),
+    sessionId: input.sessionIdOverride && input.sessionIdOverride.length > 0 ? input.sessionIdOverride : adminSessionIdFor(input.accountId, input.senderId, personId),
     role: input.role,
     channel: "whatsapp",
     personId,
@@ -21754,8 +22199,8 @@ var import_dist6 = __toESM(require_dist(), 1);
 
 // app/lib/webchat/gateway/routes.ts
 function createWebchatChannelRoutes(deps) {
-  const app57 = new Hono();
-  app57.get("/webchat-channel/inbound", (c) => {
+  const app61 = new Hono();
+  app61.get("/webchat-channel/inbound", (c) => {
     const key = c.req.query("key");
     if (!key) return c.json({ error: "key required" }, 400);
     return streamSSE(c, async (stream2) => {
@@ -21773,7 +22218,7 @@ function createWebchatChannelRoutes(deps) {
       }
     });
   });
-  app57.post("/webchat-channel/reply", async (c) => {
+  app61.post("/webchat-channel/reply", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const text = body?.text;
@@ -21783,7 +22228,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onReply?.(key, text);
     return c.json({ ok: true });
   });
-  app57.post("/webchat-channel/connector-auth", async (c) => {
+  app61.post("/webchat-channel/connector-auth", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const sessionId = body?.sessionId;
@@ -21796,7 +22241,7 @@ function createWebchatChannelRoutes(deps) {
     const result = await deps.onConnectorAuth({ key, sessionId, name, completed });
     return c.json(result);
   });
-  app57.post("/webchat-channel/ready", async (c) => {
+  app61.post("/webchat-channel/ready", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     if (typeof key !== "string") {
@@ -21805,7 +22250,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onReady?.(key);
     return c.json({ ok: true });
   });
-  app57.post("/webchat-channel/permission-request", async (c) => {
+  app61.post("/webchat-channel/permission-request", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const requestId = body?.request_id;
@@ -21819,7 +22264,7 @@ function createWebchatChannelRoutes(deps) {
     const verdict = await deps.awaitPermissionVerdict({ key, requestId, toolName, description, inputPreview });
     return c.json(verdict);
   });
-  app57.post("/webchat-channel/received", async (c) => {
+  app61.post("/webchat-channel/received", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const messageId = body?.messageId;
@@ -21829,7 +22274,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onReceived?.(key, messageId);
     return c.json({ ok: true });
   });
-  app57.post("/webchat-channel/turn-end", async (c) => {
+  app61.post("/webchat-channel/turn-end", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const sessionId = body?.sessionId;
@@ -21849,7 +22294,7 @@ function createWebchatChannelRoutes(deps) {
     console.error(`[webchat-native] op=turn-undelivered channel=webchat key=${k} sessionId=${sid} bytes=${finalBytes}`);
     return c.json({ ok: true, delivered: "undelivered" });
   });
-  return app57;
+  return app61;
 }
 
 // app/lib/webchat/gateway/webchat-gateway.ts
@@ -22480,7 +22925,7 @@ function makeFileDelivery(opts) {
 }
 
 // app/lib/whatsapp/inbound/file-delivery-bridge.ts
-var TAG35 = "[whatsapp-adaptor]";
+var TAG40 = "[whatsapp-adaptor]";
 var SEND_USER_FILE2 = "SendUserFile";
 var WHATSAPP_SEND_DOCUMENT = "whatsapp-send-document";
 function platformRoot() {
@@ -22498,7 +22943,7 @@ function makeWhatsAppSendFile(entry, maxyAccountId) {
     });
     if (result.ok) return { ok: true };
     console.error(
-      `${TAG35} file-delivery reject reason=send-failed sender=${entry.senderId} status=${result.status} message=${result.error}`
+      `${TAG40} file-delivery reject reason=send-failed sender=${entry.senderId} status=${result.status} message=${result.error}`
     );
     return { ok: false, error: result.error };
   };
@@ -22506,7 +22951,7 @@ function makeWhatsAppSendFile(entry, maxyAccountId) {
 function makeWhatsAppFileDelivery(entry, maxyAccountId) {
   const shared = makeFileDelivery({
     entry,
-    tag: TAG35,
+    tag: TAG40,
     channel: "whatsapp",
     sendFile: makeWhatsAppSendFile(entry, maxyAccountId)
   });
@@ -22541,7 +22986,7 @@ function makeWhatsAppFileDelivery(entry, maxyAccountId) {
         if (!delivered) {
           const fileField = call.filePath !== void 0 ? ` file=${call.filePath}` : "";
           console.error(
-            `${TAG35} file-delivery-unreconciled sender=${entry.senderId} sessionId=${sid} tool=${WHATSAPP_SEND_DOCUMENT}${fileField}`
+            `${TAG40} file-delivery-unreconciled sender=${entry.senderId} sessionId=${sid} tool=${WHATSAPP_SEND_DOCUMENT}${fileField}`
           );
         }
       }
@@ -22718,8 +23163,8 @@ var import_dist7 = __toESM(require_dist(), 1);
 
 // app/lib/telegram/gateway/routes.ts
 function createTelegramChannelRoutes(deps) {
-  const app57 = new Hono();
-  app57.get("/tg-channel/inbound", (c) => {
+  const app61 = new Hono();
+  app61.get("/tg-channel/inbound", (c) => {
     const key = c.req.query("key");
     if (!key) return c.json({ error: "key required" }, 400);
     return streamSSE(c, async (stream2) => {
@@ -22737,7 +23182,7 @@ function createTelegramChannelRoutes(deps) {
       }
     });
   });
-  app57.post("/tg-channel/reply", async (c) => {
+  app61.post("/tg-channel/reply", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const text = body?.text;
@@ -22753,7 +23198,7 @@ function createTelegramChannelRoutes(deps) {
     console.error(`[telegram-native] op=reply key=${key} bytes=${Buffer.byteLength(text, "utf8")}`);
     return c.json({ ok: true });
   });
-  app57.post("/tg-channel/ready", async (c) => {
+  app61.post("/tg-channel/ready", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     if (typeof key !== "string") {
@@ -22762,7 +23207,7 @@ function createTelegramChannelRoutes(deps) {
     deps.onReady?.(key);
     return c.json({ ok: true });
   });
-  app57.post("/tg-channel/received", async (c) => {
+  app61.post("/tg-channel/received", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const messageId = body?.messageId;
@@ -22772,7 +23217,7 @@ function createTelegramChannelRoutes(deps) {
     deps.onReceived?.(key, messageId);
     return c.json({ ok: true });
   });
-  app57.post("/tg-channel/turn-end", async (c) => {
+  app61.post("/tg-channel/turn-end", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const sessionId = body?.sessionId;
@@ -22788,7 +23233,7 @@ function createTelegramChannelRoutes(deps) {
     console.error(`[telegram-native] op=turn-end key=${key} sessionId=${sid} replied=no delivered=none`);
     return c.json({ ok: true, delivered: "none" });
   });
-  return app57;
+  return app61;
 }
 
 // app/lib/telegram/gateway/telegram-gateway.ts
@@ -22855,7 +23300,7 @@ var TelegramGateway = class {
       );
     }
     this.hub.deliver(
-      { key: input.senderId, text: input.text, messageId: `tg-${++this.seq}`, source, standingRules },
+      { key: input.senderId, text: input.text, messageId: `tg-${++this.seq}`, source, standingRules, scheduleProvenance: input.scheduleProvenance },
       Date.now()
     );
     console.error(
@@ -22872,7 +23317,9 @@ var TelegramGateway = class {
           personId: input.personId ?? null,
           chatId: input.chatId,
           gatewayUrl: this.deps.gatewayUrl,
-          serverPath: this.deps.serverPath
+          serverPath: this.deps.serverPath,
+          // Task 1526 — a scheduled firing's per-firing seat id; absent on real inbound.
+          sessionIdOverride: input.scheduledSessionId
         });
       } finally {
         this.spawning.delete(input.senderId);
@@ -22890,7 +23337,7 @@ var TelegramGateway = class {
 function buildTelegramSpawnRequest(input) {
   const personId = input.role === "public" && input.personId ? input.personId : void 0;
   return {
-    sessionId: adminSessionIdFor(input.accountId, input.senderId, personId),
+    sessionId: input.sessionIdOverride && input.sessionIdOverride.length > 0 ? input.sessionIdOverride : adminSessionIdFor(input.accountId, input.senderId, personId),
     role: input.role,
     channel: "telegram",
     personId,
@@ -22909,7 +23356,7 @@ function buildTelegramSpawnRequest(input) {
 import { realpathSync as realpathSync7 } from "fs";
 import { readFile as readFile7, stat as stat7 } from "fs/promises";
 import { resolve as resolve30, basename as basename12 } from "path";
-var TAG36 = "[telegram:outbound]";
+var TAG41 = "[telegram:outbound]";
 var TELEGRAM_DOCUMENT_MAX_BYTES = 50 * 1024 * 1024;
 async function sendTelegramDocument(input) {
   const { botToken, chatId, filePath, caption, maxyAccountId, platformRoot: platformRoot3 } = input;
@@ -22925,16 +23372,16 @@ async function sendTelegramDocument(input) {
     resolvedPath = realpathSync7(filePath);
     const accountResolved = realpathSync7(accountDir);
     if (!resolvedPath.startsWith(accountResolved + "/")) {
-      console.error(`${TAG36} document REJECTED reason=outside_account_directory maxyAccountId=${maxyAccountId}`);
+      console.error(`${TAG41} document REJECTED reason=outside_account_directory maxyAccountId=${maxyAccountId}`);
       return { ok: false, status: 403, error: "Access denied: file is outside the account directory" };
     }
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
-      console.error(`${TAG36} document ENOENT path=${filePath}`);
+      console.error(`${TAG41} document ENOENT path=${filePath}`);
       return { ok: false, status: 404, error: `File not found: ${filePath}` };
     }
-    console.error(`${TAG36} document path error: ${String(err)}`);
+    console.error(`${TAG41} document path error: ${String(err)}`);
     return { ok: false, status: 500, error: String(err) };
   }
   const fileStat = await stat7(resolvedPath);
@@ -22967,13 +23414,13 @@ async function sendTelegramDocument(input) {
     error = e instanceof Error ? e.message : String(e);
   }
   console.error(
-    `${TAG36} sent document to=${chatId} file=${filename} bytes=${fileStat.size} ok=${ok}` + (messageId !== void 0 ? ` id=${messageId}` : "")
+    `${TAG41} sent document to=${chatId} file=${filename} bytes=${fileStat.size} ok=${ok}` + (messageId !== void 0 ? ` id=${messageId}` : "")
   );
   return ok ? { ok: true, messageId } : { ok: false, status: 500, error };
 }
 
 // app/lib/telegram/outbound/file-delivery.ts
-var TAG37 = "[telegram:outbound]";
+var TAG42 = "[telegram:outbound]";
 function platformRoot2() {
   return process.env.MAXY_PLATFORM_ROOT || "";
 }
@@ -22985,11 +23432,11 @@ function makeTelegramSendFile(entry) {
       botToken = (entry.role === "admin" ? tg?.adminBotToken : tg?.publicBotToken) ?? null;
     }
     if (!botToken) {
-      console.error(`${TAG37} file-delivery reject reason=no-bot-token sender=${entry.senderId} role=${entry.role}`);
+      console.error(`${TAG42} file-delivery reject reason=no-bot-token sender=${entry.senderId} role=${entry.role}`);
       return { ok: false, error: "no-bot-token" };
     }
     if (entry.replyTarget == null) {
-      console.error(`${TAG37} file-delivery reject reason=no-reply-target sender=${entry.senderId} role=${entry.role}`);
+      console.error(`${TAG42} file-delivery reject reason=no-reply-target sender=${entry.senderId} role=${entry.role}`);
       return { ok: false, error: "no-reply-target" };
     }
     const result = await sendTelegramDocument({
@@ -23006,7 +23453,7 @@ function makeTelegramSendFile(entry) {
 function makeTelegramFileDelivery(entry) {
   return makeFileDelivery({
     entry,
-    tag: TAG37,
+    tag: TAG42,
     channel: "telegram",
     sendFile: makeTelegramSendFile(entry)
   });
@@ -23055,8 +23502,8 @@ function telegramServerPath() {
 }
 
 // app/lib/channel-pty-bridge/public-session-end-review.ts
-import { randomUUID as randomUUID13 } from "crypto";
-var TAG38 = "[public-session-review]";
+import { randomUUID as randomUUID14 } from "crypto";
+var TAG43 = "[public-session-review]";
 var CONSUMED_CAP = 500;
 var consumed = /* @__PURE__ */ new Set();
 function consumeOnce(sessionId) {
@@ -23083,7 +23530,7 @@ async function fetchJsonl(sessionId) {
     return await res.text();
   } catch (err) {
     console.error(
-      `${TAG38} jsonl-fetch-failed sessionId=${sessionId} err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG43} jsonl-fetch-failed sessionId=${sessionId} err="${err instanceof Error ? err.message : String(err)}"`
     );
     return null;
   }
@@ -23107,7 +23554,7 @@ async function fetchPriorWrites(sliceToken, accountId) {
     const res = await fetch(url);
     if (!res.ok) {
       console.error(
-        `${TAG38} prior-writes-fetch-failed sliceToken=${sliceToken.slice(0, 8)} status=${res.status}`
+        `${TAG43} prior-writes-fetch-failed sliceToken=${sliceToken.slice(0, 8)} status=${res.status}`
       );
       return [];
     }
@@ -23115,7 +23562,7 @@ async function fetchPriorWrites(sliceToken, accountId) {
     return Array.isArray(body.writes) ? body.writes : [];
   } catch (err) {
     console.error(
-      `${TAG38} prior-writes-fetch-threw sliceToken=${sliceToken.slice(0, 8)} err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG43} prior-writes-fetch-threw sliceToken=${sliceToken.slice(0, 8)} err="${err instanceof Error ? err.message : String(err)}"`
     );
     return [];
   }
@@ -23143,8 +23590,8 @@ function composeInitialMessage(input) {
   ].join("\n");
 }
 async function dispatchReviewer(input, initialMessage) {
-  const sessionId = randomUUID13();
-  console.log(`${TAG38} route target=rc-spawn sessionId=${sessionId.slice(0, 8)} sourceSession=${input.sessionId.slice(0, 8)}`);
+  const sessionId = randomUUID14();
+  console.log(`${TAG43} route target=rc-spawn sessionId=${sessionId.slice(0, 8)} sourceSession=${input.sessionId.slice(0, 8)}`);
   const spawned = await managerRcSpawn({
     sessionId,
     initialMessage,
@@ -23164,21 +23611,21 @@ async function firePublicSessionEndReview(input) {
   const dispatchedAt = Date.now();
   if (consumed.has(input.sessionId)) {
     console.log(
-      `${TAG38} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
+      `${TAG43} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
     );
     return;
   }
   const jsonl = await fetchJsonl(input.sessionId);
   if (!jsonl) {
     console.log(
-      `${TAG38} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-jsonl-missing`
+      `${TAG43} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-jsonl-missing`
     );
     return;
   }
   const operatorTurns = countOperatorTurns(jsonl);
   if (operatorTurns === 0) {
     console.log(
-      `${TAG38} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-no-turns`
+      `${TAG43} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-no-turns`
     );
     return;
   }
@@ -23192,19 +23639,19 @@ async function firePublicSessionEndReview(input) {
   });
   if (!consumeOnce(input.sessionId)) {
     console.log(
-      `${TAG38} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
+      `${TAG43} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
     );
     return;
   }
   const dispatched = await dispatchReviewer(input, initialMessage);
   if (!dispatched.ok) {
     console.error(
-      `${TAG38} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-spawn-failed reason=${dispatched.reason}`
+      `${TAG43} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-spawn-failed reason=${dispatched.reason}`
     );
     return;
   }
   console.log(
-    `${TAG38} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=dispatched managerSessionId=${dispatched.managerSessionId} operatorTurns=${operatorTurns} priorWrites=${priorWrites.length} ms=${Date.now() - dispatchedAt}`
+    `${TAG43} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=dispatched managerSessionId=${dispatched.managerSessionId} operatorTurns=${operatorTurns} priorWrites=${priorWrites.length} ms=${Date.now() - dispatchedAt}`
   );
 }
 
@@ -23619,7 +24066,7 @@ watchFile(ALIAS_DOMAINS_PATH, { interval: 2e3 }, () => {
 function isPublicHost(host) {
   return host.startsWith("public.") || aliasDomains.has(host);
 }
-var app56 = new Hono();
+var app60 = new Hono();
 var nativeFileFollowers = /* @__PURE__ */ new Map();
 async function fetchAccountStandingRules(accountId) {
   const session = getSession();
@@ -23635,6 +24082,26 @@ async function fetchAccountStandingRules(accountId) {
     await session.close();
   }
 }
+async function recordPassiveDispatch(input) {
+  const session = getSession();
+  try {
+    await session.run(
+      `CREATE (d:PassiveDispatch {
+         accountId: $accountId,
+         sessionId: $sessionId,
+         msgId: $msgId,
+         dispatchedAt: $dispatchedAt
+       })`,
+      { ...input, dispatchedAt: (/* @__PURE__ */ new Date()).toISOString() }
+    );
+  } catch (err) {
+    console.error(
+      `[wa-passive] op=ledger-write-failed account=${input.accountId} sessionId=${input.sessionId} error=${err instanceof Error ? err.message : String(err)}`
+    );
+  } finally {
+    await session.close();
+  }
+}
 var waGateway = new WaGateway({
   fetchStandingRules: fetchAccountStandingRules,
   gatewayUrl: `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`,
@@ -23657,7 +24124,7 @@ var waGateway = new WaGateway({
     });
     return result.ok ? { ok: true, messageId: result.messageId } : { ok: false, error: result.error };
   },
-  ensureChannelSession: async ({ accountId, effectiveAccountId, senderId, role, personId, gatewayUrl, serverPath, passive, text, msgId }) => {
+  ensureChannelSession: async ({ accountId, effectiveAccountId, senderId, role, personId, gatewayUrl, serverPath, passive, text, msgId, sessionIdOverride }) => {
     if (passive) {
       const phoneHash = createHash6("sha256").update(senderId).digest("hex").slice(0, 12);
       const prompt = (text ?? "").trim();
@@ -23665,7 +24132,17 @@ var waGateway = new WaGateway({
         console.error(`[wa-passive] op=dropped account=${effectiveAccountId} phoneHash=${phoneHash} msgId=${msgId ?? "none"} reason=empty-text`);
         return;
       }
-      console.error(`[wa-passive] op=dispatch account=${effectiveAccountId} phoneHash=${phoneHash} msgId=${msgId ?? "none"}`);
+      let raisedByPersonId;
+      try {
+        raisedByPersonId = await ensureManagerPerson(effectiveAccountId, senderId) ?? void 0;
+      } catch (err) {
+        console.error(`[wa-passive] op=raised-by-error account=${effectiveAccountId} phoneHash=${phoneHash} msgId=${msgId ?? "none"} error=${err instanceof Error ? err.message : String(err)}`);
+      }
+      if (!raisedByPersonId) {
+        console.error(`[wa-passive] op=dropped account=${effectiveAccountId} phoneHash=${phoneHash} msgId=${msgId ?? "none"} reason=raised-by-unresolved`);
+        return;
+      }
+      console.error(`[wa-passive] op=dispatch account=${effectiveAccountId} phoneHash=${phoneHash} msgId=${msgId ?? "none"} raisedBy=${raisedByPersonId}`);
       const result2 = await managerSpawn({
         senderId,
         role: "public",
@@ -23674,18 +24151,28 @@ var waGateway = new WaGateway({
         targetAccountId: effectiveAccountId,
         agentSlug: "passive",
         initialMessage: prompt,
-        passive: true
+        passive: true,
+        // Task 1493 — the manager's elementId rides the personId field
+        // end-to-end (managerSpawn → /public-spawn → spawn args → work env as
+        // RAISED_BY_PERSON_ID). It is also this passive session's identity.
+        personId: raisedByPersonId
       });
       if ("error" in result2) {
         console.error(`[wa-passive] op=dispatch-failed account=${effectiveAccountId} msgId=${msgId ?? "none"} error=${result2.error}`);
+        return;
       }
+      await recordPassiveDispatch({
+        accountId: effectiveAccountId,
+        sessionId: result2.sessionId,
+        msgId: msgId ?? ""
+      });
       return;
     }
     if (role === "admin") {
       const managesAccount = effectiveAccountId !== accountId ? effectiveAccountId : "none";
       console.error(`[whatsapp-native] op=account-manager-route senderId=${senderId} managesAccount=${managesAccount} effectiveAccount=${effectiveAccountId} source=gate`);
     }
-    const req = buildWaSpawnRequest({ accountId: effectiveAccountId, senderId, role, personId, gatewayUrl, serverPath });
+    const req = buildWaSpawnRequest({ accountId: effectiveAccountId, senderId, role, personId, gatewayUrl, serverPath, sessionIdOverride });
     const userId = role === "admin" ? resolveAdminUserId({ accountId: effectiveAccountId, senderPhone: senderId }) ?? void 0 : void 0;
     if (role === "admin") {
       console.error(`[whatsapp-native] op=admin-identity senderId=${senderId} userId=${userId ?? "owner-fallback"}`);
@@ -23714,7 +24201,7 @@ var waGateway = new WaGateway({
     nativeFileFollowers.set(senderId, ac);
   }
 });
-app56.route("/", waGateway.routes());
+app60.route("/", waGateway.routes());
 waGateway.startSweeper();
 var webchatGateway = new WebchatGateway({
   fetchStandingRules: fetchAccountStandingRules,
@@ -23798,7 +24285,7 @@ var webchatGateway = new WebchatGateway({
   firePublicSessionEndReview: (input) => firePublicSessionEndReview(input)
 });
 setWebchatGateway(webchatGateway);
-app56.route("/", webchatGateway.routes());
+app60.route("/", webchatGateway.routes());
 webchatGateway.startSweeper();
 webchatGateway.startPublicReaper();
 var telegramFileFollowers = /* @__PURE__ */ new Map();
@@ -23806,8 +24293,8 @@ var telegramGateway = new TelegramGateway({
   fetchStandingRules: fetchAccountStandingRules,
   gatewayUrl: telegramGatewayUrl(),
   serverPath: telegramServerPath(),
-  ensureChannelSession: async ({ accountId, senderId, role, personId, chatId, gatewayUrl, serverPath }) => {
-    const req = buildTelegramSpawnRequest({ accountId, senderId, role, personId, gatewayUrl, serverPath });
+  ensureChannelSession: async ({ accountId, senderId, role, personId, chatId, gatewayUrl, serverPath, sessionIdOverride }) => {
+    const req = buildTelegramSpawnRequest({ accountId, senderId, role, personId, gatewayUrl, serverPath, sessionIdOverride });
     const result = await managerRcSpawn(req);
     if ("error" in result) {
       console.error(`[telegram-native] spawn-failed senderId=${senderId} role=${role} error=${result.error} status=${result.status}`);
@@ -23832,7 +24319,7 @@ var telegramGateway = new TelegramGateway({
   }
 });
 setTelegramGateway(telegramGateway);
-app56.route("/", telegramGateway.routes());
+app60.route("/", telegramGateway.routes());
 telegramGateway.startSweeper();
 var chatRoutes = createChatRoutes({
   handleInbound: (input) => webchatGateway.handleInbound(input),
@@ -23865,19 +24352,19 @@ var scheduleInjectRoutes = createScheduleInjectRoutes({
     return managed.account;
   }
 });
-app56.route("/api/channel/schedule-inject", scheduleInjectRoutes);
-app56.use("*", clientIpMiddleware);
+app60.route("/api/channel/schedule-inject", scheduleInjectRoutes);
+app60.use("*", clientIpMiddleware);
 function allowsSameOriginFraming(path2) {
   return path2 === "/vnc-viewer.html" || path2.startsWith("/api/admin/attachment/") || path2.startsWith("/api/public-reader/attachment/") || path2 === "/api/admin/files/download";
 }
-app56.use("*", async (c, next) => {
+app60.use("*", async (c, next) => {
   await next();
   c.header("X-Content-Type-Options", "nosniff");
   c.header("Referrer-Policy", "strict-origin-when-cross-origin");
   c.header("X-Frame-Options", allowsSameOriginFraming(c.req.path) ? "SAMEORIGIN" : "DENY");
 });
 var HTTP_LOG_PATHS = /* @__PURE__ */ new Set(["/vnc-viewer.html", "/vnc-popout.html"]);
-app56.use("*", async (c, next) => {
+app60.use("*", async (c, next) => {
   if (!HTTP_LOG_PATHS.has(c.req.path)) {
     await next();
     return;
@@ -23895,7 +24382,7 @@ app56.use("*", async (c, next) => {
     });
   }
 });
-app56.use("*", async (c, next) => {
+app60.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isOperatorHost(host, getOperatorDomains()) || !isPublicHost(host)) {
     await next();
@@ -23933,7 +24420,7 @@ function resolveRemoteAuthOpts(c) {
   return { ...brandLoginOpts, origin };
 }
 var MAX_LOGIN_BODY = 8 * 1024;
-app56.post("/__remote-auth/login", async (c) => {
+app60.post("/__remote-auth/login", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   if (!requestIsTlsTerminated(c)) {
@@ -23978,7 +24465,7 @@ app56.post("/__remote-auth/login", async (c) => {
     }
   });
 });
-app56.get("/__remote-auth/logout", (c) => {
+app60.get("/__remote-auth/logout", (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   console.error(`[remote-auth] logout ip=${clientIp}`);
@@ -23991,7 +24478,7 @@ app56.get("/__remote-auth/logout", (c) => {
     }
   });
 });
-app56.post("/__remote-auth/change-password", async (c) => {
+app60.post("/__remote-auth/change-password", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   const rateLimited = checkRateLimit(client);
@@ -24050,13 +24537,13 @@ app56.post("/__remote-auth/change-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), mode: "change", changeError: "Failed to save password", redirect }), 200);
   }
 });
-app56.get("/__remote-auth/setup", (c) => {
+app60.get("/__remote-auth/setup", (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), mode: "setup" }), 200);
 });
-app56.post("/__remote-auth/set-initial-password", async (c) => {
+app60.post("/__remote-auth/set-initial-password", async (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
@@ -24094,10 +24581,10 @@ app56.post("/__remote-auth/set-initial-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), mode: "setup", setupError: "Failed to save password. Please try again." }), 200);
   }
 });
-app56.get("/api/remote-auth/status", (c) => {
+app60.get("/api/remote-auth/status", (c) => {
   return c.json({ configured: isRemoteAuthConfigured() });
 });
-app56.post("/api/remote-auth/set-password", async (c) => {
+app60.post("/api/remote-auth/set-password", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -24136,10 +24623,10 @@ app56.post("/api/remote-auth/set-password", async (c) => {
     return c.json({ error: "Failed to save password" }, 500);
   }
 });
-app56.route("/api/_client-error", client_error_default);
+app60.route("/api/_client-error", client_error_default);
 console.log("[client-error-route] mounted");
 var PWA_PUBLIC_PATHS = /* @__PURE__ */ new Set(["/sw.js", ...PWA_SURFACES.map((s) => s.manifestPath)]);
-app56.use("*", async (c, next) => {
+app60.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
   if (path2 === "/favicon.ico" || path2.startsWith("/assets/") || path2.startsWith("/brand/") || // Public free/busy is read by the booking page (a separate Cloudflare Pages
@@ -24183,26 +24670,26 @@ app56.use("*", async (c, next) => {
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), redirect: path2 }), 200);
 });
-app56.route("/api/health", health_default);
-app56.route("/api/chat", chatRoutes);
-app56.route("/api/whatsapp", whatsapp_default);
-app56.route("/api/whatsapp-reader", whatsapp_reader_default);
-app56.route("/api/public-reader", public_reader_default);
-app56.route("/api/webchat", createWebchatRoutes({
+app60.route("/api/health", health_default);
+app60.route("/api/chat", chatRoutes);
+app60.route("/api/whatsapp", whatsapp_default);
+app60.route("/api/whatsapp-reader", whatsapp_reader_default);
+app60.route("/api/public-reader", public_reader_default);
+app60.route("/api/webchat", createWebchatRoutes({
   handleInbound: (input) => webchatGateway.handleInbound(input),
   // Task 940 — the permission relay's pointer read + verdict write.
   pendingPromptFor: (key) => webchatGateway.pendingPromptFor(key),
   deliveryFailureFor: (key) => webchatGateway.deliveryFailureFor(key),
   resolvePermissionVerdict: (key, requestId, behavior) => webchatGateway.resolvePermissionVerdict(key, requestId, behavior)
 }));
-app56.route("/api/webchat/greeting", webchat_greeting_default);
-app56.route("/api/telegram", telegram_default);
-app56.route("/api/quickbooks", quickbooks_default);
-app56.route("/api/onboarding", onboarding_default);
-app56.route("/api/admin", admin_default);
-app56.route("/api/access", access_default);
-app56.route("/api/session", session_default2);
-app56.route("/api/calendar", calendar_public_default);
+app60.route("/api/webchat/greeting", webchat_greeting_default);
+app60.route("/api/telegram", telegram_default);
+app60.route("/api/quickbooks", quickbooks_default);
+app60.route("/api/onboarding", onboarding_default);
+app60.route("/api/admin", admin_default);
+app60.route("/api/access", access_default);
+app60.route("/api/session", session_default2);
+app60.route("/api/calendar", calendar_public_default);
 var SAFE_SLUG_RE2 = /^[a-z][a-z0-9-]{2,49}$/;
 var SAFE_FILENAME_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var IMAGE_MIME = {
@@ -24214,7 +24701,7 @@ var IMAGE_MIME = {
   ".svg": "image/svg+xml",
   ".ico": "image/x-icon"
 };
-app56.get("/agent-assets/:slug/:filename", (c) => {
+app60.get("/agent-assets/:slug/:filename", (c) => {
   const slug = c.req.param("slug");
   const filename = c.req.param("filename");
   if (!SAFE_SLUG_RE2.test(slug)) {
@@ -24249,7 +24736,7 @@ app56.get("/agent-assets/:slug/:filename", (c) => {
     "Cache-Control": "public, max-age=3600"
   });
 });
-app56.get("/generated/:filename", (c) => {
+app60.get("/generated/:filename", (c) => {
   const filename = c.req.param("filename");
   if (!SAFE_FILENAME_RE.test(filename) || filename.includes("..")) {
     console.error(`[generated] serve file=${filename} status=403`);
@@ -24279,10 +24766,10 @@ app56.get("/generated/:filename", (c) => {
     "Cache-Control": "public, max-age=86400"
   });
 });
-app56.route("/sites", sites_default);
-app56.route("/listings", listings_default);
-app56.route("/v", visitor_event_default);
-app56.route("/v", visitor_consent_default);
+app60.route("/sites", sites_default);
+app60.route("/listings", listings_default);
+app60.route("/v", visitor_event_default);
+app60.route("/v", visitor_consent_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
@@ -24437,7 +24924,7 @@ function brandedPublicHtml(agentSlug) {
 function agentUnavailableHtml() {
   return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${escapeHtml(BRAND.productName)}</title></head><body style="font-family:system-ui,sans-serif;max-width:32rem;margin:4rem auto;padding:0 1.5rem;color:#222"><h1 style="font-size:1.25rem">Agent unavailable</h1><p>This agent isn't available right now. If you reached this page from a saved link, the agent may have been turned off.</p></body></html>`;
 }
-app56.get("/", (c) => {
+app60.get("/", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const klass = classifyHost(host, getOperatorDomains(), isPublicHost);
   if (klass === "operator") {
@@ -24459,12 +24946,12 @@ app56.get("/", (c) => {
   console.log(`[host-class] host=${host} class=admin served=index.html`);
   return c.html(cachedHtml("index.html"));
 });
-app56.get("/public", (c) => {
+app60.get("/public", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
 });
-app56.get("/public-chat", (c) => {
+app60.get("/public-chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
@@ -24483,9 +24970,9 @@ async function logViewerFetch(c, next) {
     duration_ms: Date.now() - start
   });
 }
-app56.use("/vnc-viewer.html", logViewerFetch);
-app56.use("/vnc-popout.html", logViewerFetch);
-app56.get("/vnc-popout.html", (c) => {
+app60.use("/vnc-viewer.html", logViewerFetch);
+app60.use("/vnc-popout.html", logViewerFetch);
+app60.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
     html = readFileSync35(resolve33(process.cwd(), "public", "vnc-popout.html"), "utf-8");
@@ -24498,7 +24985,7 @@ app56.get("/vnc-popout.html", (c) => {
   }
   return c.html(html);
 });
-app56.post("/api/vnc/client-event", async (c) => {
+app60.post("/api/vnc/client-event", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -24519,11 +25006,11 @@ app56.post("/api/vnc/client-event", async (c) => {
   });
   return c.json({ ok: true });
 });
-app56.get("/g/:slug", (c) => {
+app60.get("/g/:slug", (c) => {
   return c.html(brandedPublicHtml(resolveDefaultSlug() ?? void 0));
 });
 for (const pwa of PWA_SURFACES) {
-  app56.get(pwa.manifestPath, (c) => {
+  app60.get(pwa.manifestPath, (c) => {
     const manifest = buildManifest(pwa, {
       productName: BRAND.productName,
       appIcon192: brandAppIcon192Path,
@@ -24539,7 +25026,7 @@ for (const pwa of PWA_SURFACES) {
     return c.body(JSON.stringify(manifest));
   });
 }
-app56.get("/sw.js", (c) => {
+app60.get("/sw.js", (c) => {
   if (SW_SOURCE == null) {
     console.error("[pwa] op=sw status=500 reason=sw-source-missing");
     return c.text("Service worker unavailable", 500);
@@ -24548,12 +25035,12 @@ app56.get("/sw.js", (c) => {
   console.log(`[pwa] op=sw status=200 ct=${SW_CONTENT_TYPE}`);
   return c.body(SW_SOURCE);
 });
-app56.get("/graph", (c) => {
+app60.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host) || isOperatorHost(host, getOperatorDomains())) return c.text("Not found", 404);
   return c.html(cachedHtml("graph.html"));
 });
-app56.get("/chat", (c) => {
+app60.get("/chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isOperatorHost(host, getOperatorDomains())) {
     console.log(`[host-class] host=${host} class=operator served=operator.html`);
@@ -24562,22 +25049,22 @@ app56.get("/chat", (c) => {
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("chat.html"));
 });
-app56.get("/data", (c) => {
+app60.get("/data", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("data.html"));
 });
-app56.get("/calendar", (c) => {
+app60.get("/calendar", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("calendar.html"));
 });
-app56.get("/browser", (c) => {
+app60.get("/browser", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host) || isOperatorHost(host, getOperatorDomains())) return c.text("Not found", 404);
   return c.html(cachedHtml("browser.html"));
 });
-app56.get("/:slug", async (c, next) => {
+app60.get("/:slug", async (c, next) => {
   const slug = c.req.param("slug");
   if (AGENT_SLUG_PATTERN.test(`/${slug}`)) {
     const account = resolveAccount();
@@ -24592,13 +25079,13 @@ app56.get("/:slug", async (c, next) => {
   await next();
 });
 if (brandFaviconPath !== "/favicon.ico") {
-  app56.get("/favicon.ico", (c) => {
+  app60.get("/favicon.ico", (c) => {
     c.header("Cache-Control", "public, max-age=300");
     return c.redirect(brandFaviconPath, 302);
   });
 }
-app56.use("/*", serveStatic({ root: "./public" }));
-app56.all("*", (c) => {
+app60.use("/*", serveStatic({ root: "./public" }));
+app60.all("*", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
   if (isPublicHost(host)) {
@@ -24612,7 +25099,7 @@ app56.all("*", (c) => {
 });
 var port = requirePortEnv("MAXY_UI_INTERNAL_PORT", { tag: "ui-server" });
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
-var httpServer = serve({ fetch: app56.fetch, port, hostname });
+var httpServer = serve({ fetch: app60.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
   const reconcilePlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join35(__dirname, "..");
@@ -24636,6 +25123,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   const loop = setInterval(runReconcile, RECONCILE_INTERVAL_MS);
   loop.unref();
 }
+startTimeEntryCensus(() => getSession());
 {
   const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join35(__dirname, "..");
   const auditScript = resolve33(auditPlatformRoot, "plugins/connector/mcp/dist/scripts/audit-connectors.js");
@@ -24712,7 +25200,7 @@ for (const m of SUBAPP_MANIFEST) {
 }
 try {
   const registered = [];
-  for (const r of app56.routes ?? []) {
+  for (const r of app60.routes ?? []) {
     if (typeof r.path !== "string" || r.path.includes(":") || r.path.includes("*")) continue;
     if (AGENT_SLUG_PATTERN.test(r.path)) {
       registered.push({ method: (r.method ?? "ALL").toUpperCase(), path: r.path });