@rubytech/create-maxy-code 0.1.470 → 0.1.472

package/payload/server/server.js

@@ -42,6 +42,7 @@ import {
   embed,
   emitMissingOnResolve,
   ensureConversation,
+  ensureSessionConversation,
   fetchAccountName,
   fetchBranding,
   findMissingPlugins,
@@ -111,7 +112,7 @@ import {
   vncLog,
   walkPremiumBundles,
   writeAdminUserAndPerson
-} from "./chunk-JRIBGO45.js";
+} from "./chunk-BSTIQX52.js";
 import {
   D1_MAX_SQL_STATEMENT_BYTES,
   D1_QUERY_MAX_BODY_BYTES,
@@ -1533,7 +1534,7 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/index.ts
-import { readFileSync as readFileSync39, existsSync as existsSync37, watchFile, readdirSync as readdirSync22, statSync as statSync14 } from "fs";
+import { readFileSync as readFileSync39, existsSync as existsSync37, watchFile, readdirSync as readdirSync23, statSync as statSync14 } from "fs";
 import { spawn as spawn3 } from "child_process";
 import { createHash as createHash7 } from "crypto";
 import { resolve as resolve36, join as join39, basename as basename12 } from "path";
@@ -6675,8 +6676,8 @@ function webchatTurnTimeoutMs() {
   return Number(process.env.WEBCHAT_TURN_TIMEOUT_MS ?? String(2 * 6e4));
 }
 function createChatRoutes(deps) {
-  const app63 = new Hono();
-  app63.post("/", async (c) => {
+  const app64 = new Hono();
+  app64.post("/", async (c) => {
     console.log(`[chat-route] entered route=public method=POST`);
     const contentType = c.req.header("content-type") ?? "";
     const account = resolveAccount();
@@ -6940,7 +6941,7 @@ ${result.result.text}` : result.result.text;
       }
     });
   });
-  return app63;
+  return app64;
 }
 
 // app/lib/channel-pty-bridge/admin-session-id.ts
@@ -6974,8 +6975,8 @@ function isLoopbackAddr(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
 function createScheduleInjectRoutes(deps) {
-  const app63 = new Hono();
-  app63.post("/", async (c) => {
+  const app64 = new Hono();
+  app64.post("/", async (c) => {
     const env = c.env;
     const remoteAddr = env?.incoming?.socket?.remoteAddress ?? "";
     if (!isLoopbackAddr(remoteAddr)) {
@@ -7076,11 +7077,11 @@ function createScheduleInjectRoutes(deps) {
     console.error(`${TAG17} op=inject-spawn eventId=${eventId} sessionId=${sessionId} result=ok status=-`);
     return c.json({ ok: true }, 200);
   });
-  return app63;
+  return app64;
 }
 
 // server/index.ts
-var import_dist9 = __toESM(require_dist(), 1);
+var import_dist10 = __toESM(require_dist(), 1);
 
 // app/lib/whatsapp/socket-resolution-error.ts
 function formatPresentKeys(presentKeys) {
@@ -12012,8 +12013,8 @@ async function reapplyLeversViaManager() {
 var WEBCHAT_SEND_TURN_WINDOW_MS = Number(process.env.WEBCHAT_SEND_TURN_WINDOW_MS ?? String(15e3));
 var sendSeq = 0;
 function createWebchatRoutes(deps) {
-  const app63 = new Hono();
-  app63.post("/send", requireAdminSession, async (c) => {
+  const app64 = new Hono();
+  app64.post("/send", requireAdminSession, async (c) => {
     let accountId;
     try {
       accountId = resolvePlatformAccountId();
@@ -12225,7 +12226,7 @@ ${note}` : note;
     if (turnTimer.unref) turnTimer.unref();
     return c.json({ ok: true });
   });
-  app63.post("/interrupt", requireAdminSession, async (c) => {
+  app64.post("/interrupt", requireAdminSession, async (c) => {
     const cacheKey = c.get("cacheKey");
     const requesterUserId = (cacheKey ? getUserIdForSession(cacheKey) : void 0) ?? null;
     const primaryUserId = resolvePrimaryAdminUserId();
@@ -12253,7 +12254,7 @@ ${note}` : note;
     }
     return c.json({ ok: true, stopped: outcome.stopped, intId: outcome.intId, deadChild: outcome.deadChild }, 200);
   });
-  app63.post("/settings", requireAdminSession, async (c) => {
+  app64.post("/settings", requireAdminSession, async (c) => {
     const body = await c.req.json().catch(() => null);
     const op = body?.op;
     const value = body?.value;
@@ -12293,7 +12294,7 @@ ${note}` : note;
     console.log(`[webchat:settings] op=${op} outcome=accepted value=${value} settingsApplied=${settingsApplied}`);
     return c.json({ ok: true, settingsApplied });
   });
-  app63.get("/session", requireAdminSession, async (c) => {
+  app64.get("/session", requireAdminSession, async (c) => {
     let accountId;
     try {
       accountId = resolvePlatformAccountId();
@@ -12371,7 +12372,7 @@ ${note}` : note;
     const indicators = await fetchComposerIndicators(sessionId);
     return c.json({ sessionId, projectDir, source, sizeBytes: jsonlSizeBytes(projectDir, sessionId), pendingPermissionPrompt: deps.pendingPromptFor?.(`session:${sessionId}`) ?? null, deliveryFailure: deps.deliveryFailureFor?.(`session:${sessionId}`) ?? null, ...indicators, ...readLevers(account) });
   });
-  app63.post("/permission-verdict", requireAdminSession, async (c) => {
+  app64.post("/permission-verdict", requireAdminSession, async (c) => {
     const body = await c.req.json().catch(() => null);
     const sessionId = body?.sessionId;
     const requestId = body?.request_id;
@@ -12388,7 +12389,7 @@ ${note}` : note;
     const ok = deps.resolvePermissionVerdict?.(`session:${sessionId}`, requestId, behavior) ?? false;
     return c.json({ ok });
   });
-  return app63;
+  return app64;
 }
 
 // server/routes/webchat-greeting.ts
@@ -12803,6 +12804,9 @@ function sanitizeAccountKey(key) {
 function secretsDir(accountsDir, accountId) {
   return join24(accountsDir, sanitizeAccountKey(accountId), "secrets", "google");
 }
+function buildRedirectUri(publicBase) {
+  return `${publicBase.replace(/\/+$/, "")}/api/google/oauth/callback`;
+}
 function esc(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
@@ -12909,20 +12913,26 @@ function createGoogleOAuthRoutes(platformRoot5, accountsDir) {
   routes.get("/oauth/callback", async (c) => {
     const code = c.req.query("code");
     const state = c.req.query("state");
-    const accountId = c.req.query("account");
-    if (!code || !state || !accountId) {
+    if (!code || !state) {
       console.error(`${TAG26} op=callback outcome=error error=missing-params`);
       return c.html(page2("Missing parameters", "Return to your chat and start again."), 400);
     }
+    const dot = state.lastIndexOf(".");
+    if (dot <= 0 || dot === state.length - 1) {
+      console.error(`${TAG26} op=callback outcome=error error=malformed-state`);
+      return c.html(page2("This link has expired", "Return to your chat and start again."), 400);
+    }
+    const accountId = state.slice(0, dot);
+    const nonce = state.slice(dot + 1);
     const held = readPending(accountsDir, accountId);
-    const stateMatch = held !== null && held.state === state;
-    console.error(`${TAG26} op=callback reg=${state} account=${accountId} state-match=${stateMatch}`);
+    const stateMatch = held !== null && held.state === nonce;
+    console.error(`${TAG26} op=callback reg=${nonce} account=${accountId} state-match=${stateMatch}`);
     if (!held || !stateMatch) {
       return c.html(page2("This link has expired", "Return to your chat and start again."), 400);
     }
     const ageMs = Date.now() - held.createdAt;
     if (ageMs > PENDING_LIFETIME_MS) {
-      console.error(`${TAG26} op=callback reg=${state} outcome=error error=pending-expired ageMs=${ageMs}`);
+      console.error(`${TAG26} op=callback reg=${nonce} outcome=error error=pending-expired ageMs=${ageMs}`);
       clearPending(accountsDir, accountId);
       return c.html(page2("This link has expired", "Return to your chat and start again."), 400);
     }
@@ -12932,15 +12942,15 @@ function createGoogleOAuthRoutes(platformRoot5, accountsDir) {
     };
     const creds = readHouseGoogleCreds(platformRoot5);
     if (!creds) {
-      console.error(`${TAG26} op=token-exchange reg=${state} outcome=error error=house-env-missing`);
+      console.error(`${TAG26} op=token-exchange reg=${nonce} outcome=error error=house-env-missing`);
       return failed("Not configured", "This install has no Google credentials yet.", 500);
     }
     const publicBase = (process.env.GOOGLE_PUBLIC_BASE ?? "").replace(/\/+$/, "");
     if (!publicBase) {
-      console.error(`${TAG26} op=callback reg=${state} outcome=error error=public-base-unset`);
+      console.error(`${TAG26} op=callback reg=${nonce} outcome=error error=public-base-unset`);
       return failed("Not configured", "This install has no public base configured.", 500);
     }
-    const redirectUri = `${publicBase}/api/google/oauth/callback?account=${encodeURIComponent(accountId)}`;
+    const redirectUri = buildRedirectUri(publicBase);
     try {
       const res = await fetch(TOKEN_URL, {
         method: "POST",
@@ -12956,21 +12966,21 @@ function createGoogleOAuthRoutes(platformRoot5, accountsDir) {
       });
       const text = await res.text();
       if (!res.ok) {
-        console.error(`${TAG26} op=token-exchange reg=${state} outcome=error status=${res.status} body=${text.slice(0, 300)}`);
+        console.error(`${TAG26} op=token-exchange reg=${nonce} outcome=error status=${res.status} body=${text.slice(0, 300)}`);
         return failed("Could not connect", `Google refused the exchange (${res.status}).`, 502);
       }
-      console.error(`${TAG26} op=token-exchange reg=${state} outcome=ok`);
+      console.error(`${TAG26} op=token-exchange reg=${nonce} outcome=ok`);
       const tok = JSON.parse(text);
       const calRes = await fetch(PRIMARY_CALENDAR_URL, {
         headers: { authorization: `Bearer ${tok.access_token}` }
       });
       const calText = await calRes.text();
       if (!calRes.ok) {
-        console.error(`${TAG26} op=identity reg=${state} outcome=error status=${calRes.status} body=${calText.slice(0, 300)}`);
+        console.error(`${TAG26} op=identity reg=${nonce} outcome=error status=${calRes.status} body=${calText.slice(0, 300)}`);
         return failed("Could not connect", "Connected, but the calendar identity could not be read.", 502);
       }
       const email = JSON.parse(calText).id;
-      console.error(`${TAG26} op=identity reg=${state} email=${email}`);
+      console.error(`${TAG26} op=identity reg=${nonce} email=${email}`);
       writeTokens(accountsDir, accountId, email, {
         accessToken: tok.access_token,
         refreshToken: tok.refresh_token ?? null,
@@ -12978,11 +12988,11 @@ function createGoogleOAuthRoutes(platformRoot5, accountsDir) {
         scopes: tok.scope ? tok.scope.split(" ") : []
       });
       console.error(
-        `${TAG26} op=tokens-write reg=${state} account=${accountId} refreshIssued=${tok.refresh_token ? "true" : "false"}`
+        `${TAG26} op=tokens-write reg=${nonce} account=${accountId} refreshIssued=${tok.refresh_token ? "true" : "false"}`
       );
       clearPending(accountsDir, accountId);
-      console.error(`${TAG26} op=pending-clear reg=${state} verified=${readPending(accountsDir, accountId) === null}`);
-      console.error(`${TAG26} op=registered reg=${state} account=${accountId} email=${email}`);
+      console.error(`${TAG26} op=pending-clear reg=${nonce} verified=${readPending(accountsDir, accountId) === null}`);
+      console.error(`${TAG26} op=registered reg=${nonce} account=${accountId} email=${email}`);
       return c.html(
         page2(
           "Calendar connected",
@@ -12991,7 +13001,7 @@ function createGoogleOAuthRoutes(platformRoot5, accountsDir) {
       );
     } catch (err) {
       const msg = err.message;
-      console.error(`${TAG26} op=token-exchange reg=${state} outcome=error error=${msg}`);
+      console.error(`${TAG26} op=token-exchange reg=${nonce} outcome=error error=${msg}`);
       return failed("Could not connect", "Something went wrong. Return to your chat and try again.", 502);
     }
   });
@@ -15679,18 +15689,18 @@ var ALLOWED_EVENTS = /* @__PURE__ */ new Set([
 ]);
 var app21 = new Hono();
 app21.post("/", async (c) => {
-  const TAG48 = "[admin:events]";
+  const TAG51 = "[admin:events]";
   let body;
   try {
     body = await c.req.json();
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG48} reject reason=body-not-json detail=${detail}`);
+    console.error(`${TAG51} reject reason=body-not-json detail=${detail}`);
     return c.json({ ok: false, detail: "Request body was not valid JSON" }, 400);
   }
   const event = typeof body.event === "string" ? body.event : "";
   if (!ALLOWED_EVENTS.has(event)) {
-    console.error(`${TAG48} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
+    console.error(`${TAG51} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
     return c.json({ ok: false, detail: `Event "${event}" is not allowed` }, 400);
   }
   const rawFields = body.fields && typeof body.fields === "object" ? body.fields : {};
@@ -22149,57 +22159,158 @@ app51.post("/", requireAdminSession, async (c) => {
 });
 var task_time_adjust_default = app51;
 
-// server/routes/admin/index.ts
+// server/routes/admin/activity.ts
+import { readdirSync as readdirSync22 } from "fs";
 var app52 = new Hono();
-app52.route("/session", session_default);
-app52.route("/accounts", accounts_default);
-app52.route("/logs", logs_default);
-app52.route("/claude-info", claude_info_default);
-app52.route("/attachment", attachment_default);
-app52.route("/agents", agents_default);
-app52.route("/sessions", sessions_default);
-app52.route("/claude-sessions", claude_sessions_default);
-app52.route("/log-ingest", log_ingest_default);
-app52.route("/events", events_default);
-app52.route("/files", files_default);
-app52.route("/graph-search", graph_search_default);
-app52.route("/graph-subgraph", graph_subgraph_default);
-app52.route("/graph-delete", graph_delete_default);
-app52.route("/graph-restore", graph_restore_default);
-app52.route("/graph-labels-in-graph", graph_labels_in_graph_default);
-app52.route("/graph-default-view", graph_default_view_default);
-app52.route("/sidebar-artefacts", sidebar_artefacts_default);
-app52.route("/sidebar-sessions", sidebar_sessions_default);
-app52.route("/session-delete", session_delete_default);
-app52.route("/session-stop", session_stop_default);
-app52.route("/session-archive", session_archive_default);
-app52.route("/session-rename", session_rename_default);
-app52.route("/session-usage", session_usage_default);
-app52.route("/browser", browser_default);
-app52.route("/session-rc-spawn", session_rc_spawn_default);
-app52.route("/session-reseat", session_reseat_default);
-app52.route("/system-stats", system_stats_default);
-app52.route("/health-brand", health_default2);
-app52.route("/linkedin-ingest", linkedin_ingest_default);
-app52.route("/post-turn-context", post_turn_context_default);
-app52.route("/public-session-context", public_session_context_default);
-app52.route("/public-session-exit", public_session_exit_default);
-app52.route("/access-session-evict", access_session_evict_default);
-app52.route("/enrol-person", enrol_person_default);
-app52.route("/calendar", calendar_default);
-app52.route("/tasks-list", tasks_list_default);
-app52.route("/task-timer-start", task_timer_start_default);
-app52.route("/task-timer-stop", task_timer_stop_default);
-app52.route("/task-complete", task_complete_default);
-app52.route("/task-time-adjust", task_time_adjust_default);
-var admin_default = app52;
+var TAG40 = "[activity]";
+function resolveHouseAccountId(accounts) {
+  const houses = accounts.filter((a) => a.config.role === "house");
+  if (houses.length === 1) return { accountId: houses[0].accountId, reason: "house" };
+  if (houses.length > 1) return { accountId: null, reason: "multiple-houses" };
+  if (accounts.length === 1) return { accountId: accounts[0].accountId, reason: "sole-account" };
+  return { accountId: null, reason: "no-house" };
+}
+function requestToken() {
+  return Math.random().toString(16).slice(2, 10);
+}
+var short = (id) => id ? id.slice(0, 8) : "unset";
+function countAccountDirsOnDisk() {
+  try {
+    return readdirSync22(ACCOUNTS_DIR, { withFileTypes: true }).filter(
+      (e) => e.isDirectory() && !e.name.startsWith(".")
+    ).length;
+  } catch {
+    return null;
+  }
+}
+app52.get("/", requireAdminSession, async (c) => {
+  const req = requestToken();
+  const cacheKey = c.var.cacheKey;
+  const caller2 = getAccountIdForSession(cacheKey) ?? null;
+  const valid = listValidAccounts();
+  const house = resolveHouseAccountId(valid);
+  const isHouse = caller2 !== null && house.accountId !== null && caller2 === house.accountId;
+  console.log(
+    `${TAG40} op=request req=${req} caller=${short(caller2)} house=${isHouse} houseVia=${house.reason}`
+  );
+  if (!isHouse) {
+    const reason = house.accountId === null ? house.reason : "not-house";
+    console.error(
+      `${TAG40} op=gate req=${req} decision=deny reason=${reason} caller=${short(caller2)} houseAcct=${short(house.accountId)} accounts=${valid.length}`
+    );
+    return c.json({ error: "house-only" }, 403);
+  }
+  console.log(`${TAG40} op=gate req=${req} decision=allow caller=${short(caller2)} via=${house.reason}`);
+  const onDisk = countAccountDirsOnDisk();
+  console.log(
+    `${TAG40} op=accounts req=${req} onDisk=${onDisk ?? "unknown"} valid=${valid.length} ids=${valid.map((a) => short(a.accountId)).join(",")}`
+  );
+  const start = Date.now();
+  let res;
+  try {
+    res = await fetch(`${managerBase("activity:wrapper")}/activity`, {
+      signal: AbortSignal.timeout(3e4)
+    });
+  } catch (err) {
+    console.error(
+      `${TAG40} op=manager-fail req=${req} reason=unreachable err=${err instanceof Error ? err.message : String(err)}`
+    );
+    return c.json({ error: "manager-unreachable" }, 502);
+  }
+  if (res.status !== 200) {
+    console.error(`${TAG40} op=manager-fail req=${req} reason=status status=${res.status}`);
+    return c.json({ error: `manager-status-${res.status}` }, 502);
+  }
+  const body = await res.json().catch(() => null);
+  if (!body || !Array.isArray(body.rows)) {
+    console.error(`${TAG40} op=manager-fail req=${req} reason=bad-json`);
+    return c.json({ error: "manager-bad-json" }, 502);
+  }
+  const rows = body.rows;
+  const census = body.census ?? null;
+  const untaggedCount = rows.filter((r) => r.accountId === null).length;
+  const meteringFailed = rows.filter((r) => r.meteringError !== null).length;
+  const censusAgeMs = census ? Date.now() - census.sampleAtMs : null;
+  console.log(
+    `${TAG40} op=census req=${req} ageMs=${censusAgeMs ?? "none"} live=${census?.live ?? "none"} cpuNull=${census?.cpuNull ?? "none"}`
+  );
+  console.log(
+    `${TAG40} op=response req=${req} rows=${rows.length} accounts=${valid.length} untagged=${untaggedCount} meteringFailed=${meteringFailed} ms=${Date.now() - start}`
+  );
+  const names = {};
+  await Promise.all(
+    valid.map(async (a) => {
+      const name = await fetchAccountName(a.accountId).catch(() => null);
+      if (name) names[a.accountId] = name;
+    })
+  );
+  return c.json({
+    rows,
+    census,
+    censusAgeMs,
+    accounts: {
+      onDisk,
+      valid: valid.length,
+      ids: valid.map((a) => a.accountId),
+      names,
+      untaggedCount
+    }
+  });
+});
+var activity_default = app52;
+
+// server/routes/admin/index.ts
+var app53 = new Hono();
+app53.route("/session", session_default);
+app53.route("/accounts", accounts_default);
+app53.route("/logs", logs_default);
+app53.route("/claude-info", claude_info_default);
+app53.route("/attachment", attachment_default);
+app53.route("/agents", agents_default);
+app53.route("/sessions", sessions_default);
+app53.route("/claude-sessions", claude_sessions_default);
+app53.route("/log-ingest", log_ingest_default);
+app53.route("/events", events_default);
+app53.route("/files", files_default);
+app53.route("/graph-search", graph_search_default);
+app53.route("/graph-subgraph", graph_subgraph_default);
+app53.route("/graph-delete", graph_delete_default);
+app53.route("/graph-restore", graph_restore_default);
+app53.route("/graph-labels-in-graph", graph_labels_in_graph_default);
+app53.route("/graph-default-view", graph_default_view_default);
+app53.route("/sidebar-artefacts", sidebar_artefacts_default);
+app53.route("/sidebar-sessions", sidebar_sessions_default);
+app53.route("/session-delete", session_delete_default);
+app53.route("/session-stop", session_stop_default);
+app53.route("/session-archive", session_archive_default);
+app53.route("/session-rename", session_rename_default);
+app53.route("/session-usage", session_usage_default);
+app53.route("/browser", browser_default);
+app53.route("/session-rc-spawn", session_rc_spawn_default);
+app53.route("/session-reseat", session_reseat_default);
+app53.route("/system-stats", system_stats_default);
+app53.route("/health-brand", health_default2);
+app53.route("/linkedin-ingest", linkedin_ingest_default);
+app53.route("/post-turn-context", post_turn_context_default);
+app53.route("/public-session-context", public_session_context_default);
+app53.route("/public-session-exit", public_session_exit_default);
+app53.route("/access-session-evict", access_session_evict_default);
+app53.route("/enrol-person", enrol_person_default);
+app53.route("/calendar", calendar_default);
+app53.route("/tasks-list", tasks_list_default);
+app53.route("/task-timer-start", task_timer_start_default);
+app53.route("/task-timer-stop", task_timer_stop_default);
+app53.route("/task-complete", task_complete_default);
+app53.route("/task-time-adjust", task_time_adjust_default);
+app53.route("/activity", activity_default);
+var admin_default = app53;
 
 // server/routes/access/verify-token.ts
-var TAG40 = "[access-verify]";
+var TAG41 = "[access-verify]";
 var MINT_TAG = "[access-session-mint]";
 var COOKIE_NAME = "__access_session";
-var app53 = new Hono();
-app53.post("/", async (c) => {
+var app54 = new Hono();
+app54.post("/", async (c) => {
   const ip = c.var.clientIp || "unknown";
   let body;
   try {
@@ -22214,39 +22325,39 @@ app53.post("/", async (c) => {
   }
   const rateMsg = checkAccessRateLimit(ip, agentSlug);
   if (rateMsg) {
-    console.error(`${TAG40} grantId=- agentSlug=${agentSlug} result=rate-limited ip=${ip}`);
+    console.error(`${TAG41} grantId=- agentSlug=${agentSlug} result=rate-limited ip=${ip}`);
     return c.json({ error: rateMsg }, 429);
   }
   const grant = await findGrantByMagicToken(token);
   if (!grant) {
     recordAccessFailedAttempt(ip, agentSlug);
-    console.error(`${TAG40} grantId=- agentSlug=${agentSlug} result=notfound ip=${ip}`);
+    console.error(`${TAG41} grantId=- agentSlug=${agentSlug} result=notfound ip=${ip}`);
     return c.json({ error: "invalid-or-expired-link" }, 401);
   }
   if (grant.agentSlug !== agentSlug) {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG40} grantId=${grant.grantId} agentSlug=${agentSlug} result=agent-mismatch grantAgent=${grant.agentSlug} ip=${ip}`
+      `${TAG41} grantId=${grant.grantId} agentSlug=${agentSlug} result=agent-mismatch grantAgent=${grant.agentSlug} ip=${ip}`
     );
     return c.json({ error: "invalid-or-expired-link" }, 401);
   }
   if (grant.status === "expired" || grant.status === "revoked") {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG40} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired status=${grant.status} ip=${ip}`
+      `${TAG41} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired status=${grant.status} ip=${ip}`
     );
     return c.json({ error: "access-no-longer-valid" }, 401);
   }
   if (grant.expiresAt !== null && grant.expiresAt < Date.now()) {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG40} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired reason=expiresAt-past ip=${ip}`
+      `${TAG41} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired reason=expiresAt-past ip=${ip}`
     );
     return c.json({ error: "access-no-longer-valid" }, 401);
   }
   if (!grant.sliceToken) {
     console.error(
-      `${TAG40} grantId=${grant.grantId} agentSlug=${agentSlug} result=no-slice-token reason=schema-violation`
+      `${TAG41} grantId=${grant.grantId} agentSlug=${agentSlug} result=no-slice-token reason=schema-violation`
     );
     return c.json({ error: "grant-misconfigured" }, 500);
   }
@@ -22262,12 +22373,12 @@ app53.post("/", async (c) => {
     await consumeMagicTokenAndActivate(grant.grantId);
   } catch (err) {
     console.error(
-      `${TAG40} grantId=${grant.grantId} agentSlug=${agentSlug} result=consume-failed err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG41} grantId=${grant.grantId} agentSlug=${agentSlug} result=consume-failed err="${err instanceof Error ? err.message : String(err)}"`
     );
     return c.json({ error: "verification-failed" }, 500);
   }
   clearAccessRateLimit(ip, agentSlug);
-  console.log(`${TAG40} grantId=${grant.grantId} agentSlug=${agentSlug} result=ok ip=${ip}`);
+  console.log(`${TAG41} grantId=${grant.grantId} agentSlug=${agentSlug} result=ok ip=${ip}`);
   console.log(
     `${MINT_TAG} grantId=${grant.grantId} sliceToken=${grant.sliceToken.slice(0, 8)} agentSlug=${agentSlug} personId=${grant.personId ?? "none"}`
   );
@@ -22281,7 +22392,7 @@ app53.post("/", async (c) => {
     displayName: grant.displayName
   });
 });
-var verify_token_default = app53;
+var verify_token_default = app54;
 
 // app/lib/access-email.ts
 import { spawn as spawn2 } from "child_process";
@@ -22343,10 +22454,10 @@ async function sendMagicLinkEmail(payload) {
 }
 
 // server/routes/access/request-magic-link.ts
-var TAG41 = "[access-request-link]";
-var app54 = new Hono();
+var TAG42 = "[access-request-link]";
+var app55 = new Hono();
 var VISITOR_MESSAGE = "If that email is on the invite list, a fresh link is on the way.";
-app54.post("/", async (c) => {
+app55.post("/", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -22360,18 +22471,18 @@ app54.post("/", async (c) => {
   }
   const rateMsg = checkRequestLinkRateLimit(contactValue);
   if (rateMsg) {
-    console.error(`${TAG41} contactValue=${maskContact(contactValue)} result=rate-limited`);
+    console.error(`${TAG42} contactValue=${maskContact(contactValue)} result=rate-limited`);
     return c.json({ error: rateMsg }, 429);
   }
   recordRequestLinkAttempt(contactValue);
   const accountId = process.env.ACCOUNT_ID ?? "";
   if (!accountId) {
-    console.error(`${TAG41} contactValue=${maskContact(contactValue)} result=no-account-id`);
+    console.error(`${TAG42} contactValue=${maskContact(contactValue)} result=no-account-id`);
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   const grant = await findActiveGrantByContact(contactValue, agentSlug, accountId);
   if (!grant) {
-    console.log(`${TAG41} contactValue=${maskContact(contactValue)} result=notfound`);
+    console.log(`${TAG42} contactValue=${maskContact(contactValue)} result=notfound`);
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   let token;
@@ -22379,7 +22490,7 @@ app54.post("/", async (c) => {
     token = await generateNewMagicToken(grant.grantId);
   } catch (err) {
     console.error(
-      `${TAG41} contactValue=${maskContact(contactValue)} result=mint-failed err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG42} contactValue=${maskContact(contactValue)} result=mint-failed err="${err instanceof Error ? err.message : String(err)}"`
     );
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
@@ -22411,22 +22522,22 @@ app54.post("/", async (c) => {
   });
   if (!sendResult.ok) {
     console.error(
-      `${TAG41} contactValue=${maskContact(contactValue)} result=send-failed err="${sendResult.error}"`
+      `${TAG42} contactValue=${maskContact(contactValue)} result=send-failed err="${sendResult.error}"`
     );
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   console.log(
-    `${TAG41} contactValue=${maskContact(contactValue)} result=ok messageId=${sendResult.messageId}`
+    `${TAG42} contactValue=${maskContact(contactValue)} result=ok messageId=${sendResult.messageId}`
   );
   return c.json({ message: VISITOR_MESSAGE }, 200);
 });
-var request_magic_link_default = app54;
+var request_magic_link_default = app55;
 
 // server/routes/access/index.ts
-var app55 = new Hono();
-app55.route("/verify-token", verify_token_default);
-app55.route("/request-magic-link", request_magic_link_default);
-var access_default = app55;
+var app56 = new Hono();
+app56.route("/verify-token", verify_token_default);
+app56.route("/request-magic-link", request_magic_link_default);
+var access_default = app56;
 
 // server/routes/sites.ts
 import { existsSync as existsSync32, readFileSync as readFileSync35, realpathSync as realpathSync7, statSync as statSync12 } from "fs";
@@ -22461,8 +22572,8 @@ function getExt(p) {
   if (idx < p.lastIndexOf("/")) return "";
   return p.slice(idx).toLowerCase();
 }
-var app56 = new Hono();
-app56.get("/:rel{.*}", (c) => {
+var app57 = new Hono();
+app57.get("/:rel{.*}", (c) => {
   const reqPath = c.req.path;
   const rawRel = c.req.param("rel") ?? "";
   const trimmed = rawRel.replace(/^\/+/, "").replace(/\/+$/, "");
@@ -22565,7 +22676,7 @@ app56.get("/:rel{.*}", (c) => {
     "X-Content-Type-Options": "nosniff"
   });
 });
-var sites_default = app56;
+var sites_default = app57;
 
 // app/lib/visitor-token.ts
 import { createHmac, randomBytes as randomBytes2, timingSafeEqual } from "crypto";
@@ -22665,7 +22776,7 @@ function readBrandConfig() {
 }
 
 // server/routes/visitor-consent.ts
-var app57 = new Hono();
+var app58 = new Hono();
 var CONSENT_COOKIE_NAME = "mxy_consent";
 var CONSENT_COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 365;
 var DEFAULT_CONSENT_COPY = {
@@ -22710,17 +22821,17 @@ function siteSlugFromReferer(referer) {
     return "";
   }
 }
-app57.options("/consent", (c) => {
+app58.options("/consent", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app57.options("/brand-config", (c) => {
+app58.options("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app57.post("/consent", async (c) => {
+app58.post("/consent", async (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   let raw;
@@ -22760,7 +22871,7 @@ app57.post("/consent", async (c) => {
   console.log(`[consent] ${parsed.decision} site=${site} brand=${brandName} tokenBound=${tokenBound}`);
   return c.body(null, 204);
 });
-app57.get("/brand-config", (c) => {
+app58.get("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   const brand = readBrandConfig();
@@ -22770,7 +22881,7 @@ app57.get("/brand-config", (c) => {
   c.header("Cache-Control", "public, max-age=300");
   return c.json({ consent: { copy, palette } });
 });
-var visitor_consent_default = app57;
+var visitor_consent_default = app58;
 
 // server/routes/listings.ts
 function getCookie(headerValue, name) {
@@ -22797,8 +22908,8 @@ function appendConsentParams(pageUrl, token) {
 }
 var SAFE_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,118}[a-z0-9])?$/;
 var CHAT_SESSION_KEY_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{7,127}$/;
-var app58 = new Hono();
-app58.get("/:slug/click", async (c) => {
+var app59 = new Hono();
+app59.get("/:slug/click", async (c) => {
   const slug = c.req.param("slug") ?? "";
   const rawSession = c.req.query("session") ?? "";
   const sessionKey = CHAT_SESSION_KEY_RE.test(rawSession) ? rawSession : "invalid";
@@ -22862,10 +22973,10 @@ app58.get("/:slug/click", async (c) => {
   console.log(`[property-card-click] sessionKey=${sessionKey} listingSlug=${slug} consent=${consentCookie ?? "absent"} ts=${(/* @__PURE__ */ new Date()).toISOString()}`);
   return c.redirect(redirectUrl, 302);
 });
-var listings_default = app58;
+var listings_default = app59;
 
 // server/routes/visitor-event.ts
-var app59 = new Hono();
+var app60 = new Hono();
 var BOT_UA_RE = /\b(bot|crawl|spider|slurp|headlesschrome|phantomjs|googlebot|bingbot|yandex|baiduspider|ahrefsbot|semrushbot|mj12bot|dotbot|petalbot)\b/i;
 var buckets = /* @__PURE__ */ new Map();
 var RATE_LIMIT = 60;
@@ -22932,12 +23043,12 @@ function originAllowed(origin, allowlist) {
     return false;
   }
 }
-app59.options("/event", (c) => {
+app60.options("/event", (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   return c.body(null, 204);
 });
-app59.post("/event", async (c) => {
+app60.post("/event", async (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   const ua = c.req.header("user-agent") ?? "";
@@ -23142,7 +23253,7 @@ async function writeEvent(opts) {
     );
   }
 }
-var visitor_event_default = app59;
+var visitor_event_default = app60;
 
 // server/routes/session.ts
 import { resolve as resolve29 } from "path";
@@ -23188,8 +23299,8 @@ function withVisitorCookie(response, visitorId) {
     headers
   });
 }
-var app60 = new Hono();
-app60.post("/", async (c) => {
+var app61 = new Hono();
+app61.post("/", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -23336,7 +23447,7 @@ app60.post("/", async (c) => {
     newVisitorId
   );
 });
-var session_default2 = app60;
+var session_default2 = app61;
 
 // server/lib/calendar-slots.ts
 var WEEKDAYS = ["sun", "mon", "tue", "wed", "thu", "fri", "sat"];
@@ -23419,17 +23530,17 @@ function computeOpenSlots(config, busy, fromISO, toISO) {
 }
 
 // server/routes/calendar-public.ts
-var app61 = new Hono();
+var app62 = new Hono();
 function setCors(c) {
   c.header("Access-Control-Allow-Origin", "*");
   c.header("Access-Control-Allow-Methods", "GET, OPTIONS");
   c.header("Access-Control-Allow-Headers", "content-type");
 }
-app61.options("/free-busy", (c) => {
+app62.options("/free-busy", (c) => {
   setCors(c);
   return c.body(null, 204);
 });
-app61.get("/free-busy", async (c) => {
+app62.get("/free-busy", async (c) => {
   setCors(c);
   const from = c.req.query("from");
   const to = c.req.query("to");
@@ -23475,10 +23586,10 @@ app61.get("/free-busy", async (c) => {
     await session.close();
   }
 });
-var calendar_public_default = app61;
+var calendar_public_default = app62;
 
 // app/lib/timeentry-census.ts
-var TAG42 = "[timeentry-census]";
+var TAG43 = "[timeentry-census]";
 function reconcileTimeEntries(rows, now, horizonMs) {
   const openEntries = rows.openEntries.length;
   let oldestOpenAgeMs = 0;
@@ -23518,12 +23629,12 @@ async function runTimeEntryCensusOnce(session, now, horizonMs) {
       sumAdjustments: toNum(r.get("sumAdjustments"))
     }));
     const finding = reconcileTimeEntries({ openEntries, taskSums }, now, horizonMs);
-    const line = `${TAG42} openEntries=${finding.openEntries} oldestOpenAgeMin=${finding.oldestOpenAgeMin} maxOpenPerAccount=${finding.maxOpenPerAccount} driftTasks=${finding.driftTasks}`;
+    const line = `${TAG43} openEntries=${finding.openEntries} oldestOpenAgeMin=${finding.oldestOpenAgeMin} maxOpenPerAccount=${finding.maxOpenPerAccount} driftTasks=${finding.driftTasks}`;
     if (finding.alarm) console.error(`${line} alarm=true`);
     else console.log(line);
     return finding;
   } catch (err) {
-    console.error(`${TAG42} error="${err instanceof Error ? err.message : String(err)}"`);
+    console.error(`${TAG43} error="${err instanceof Error ? err.message : String(err)}"`);
     return null;
   }
 }
@@ -23537,13 +23648,13 @@ function startTimeEntryCensus(openSession, opts = {}) {
     try {
       session = openSession();
     } catch (err) {
-      console.error(`${TAG42} open-session-failed error="${err instanceof Error ? err.message : String(err)}"`);
+      console.error(`${TAG43} open-session-failed error="${err instanceof Error ? err.message : String(err)}"`);
       return;
     }
     try {
       await runTimeEntryCensusOnce(session, Date.now(), horizonMs);
     } catch (err) {
-      console.error(`${TAG42} tick-failed error="${err instanceof Error ? err.message : String(err)}"`);
+      console.error(`${TAG43} tick-failed error="${err instanceof Error ? err.message : String(err)}"`);
     } finally {
       try {
         await session.close();
@@ -23561,8 +23672,181 @@ function startTimeEntryCensus(openSession, opts = {}) {
   return () => clearInterval(id);
 }
 
+// ../lib/ledger-core/dist/reconcile.js
+var LEDGER_INDEX_NAMES = [
+  "invoice_account_confirmation_unique",
+  "cash_entry_account_entryid_unique",
+  "cash_entry_account",
+  "invoice_line_account",
+  "invoice_payment_account",
+  "credit_account"
+];
+function countSuspectDuplicates(keys) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const k of keys) {
+    const composite = `${k.invoiceId}|${k.amount}|${k.date}`;
+    const ids = groups.get(composite) ?? /* @__PURE__ */ new Set();
+    ids.add(k.paymentId);
+    groups.set(composite, ids);
+  }
+  let total = 0;
+  for (const ids of groups.values())
+    total += Math.max(0, ids.size - 1);
+  return total;
+}
+function reconcileLedger(rows, _now) {
+  const suspectDuplicates = countSuspectDuplicates(rows.paymentKeys);
+  const alarm = rows.orphanPayments > 0 || rows.storedBalanceProps > 0 || suspectDuplicates > 0 || rows.declaredNotLive.length > 0;
+  return {
+    invoices: rows.invoices,
+    payments: rows.payments,
+    orphanPayments: rows.orphanPayments,
+    storedBalanceProps: rows.storedBalanceProps,
+    suspectDuplicates,
+    declaredNotLive: rows.declaredNotLive,
+    alarm
+  };
+}
+function formatCensusLine(f) {
+  return `[ledger-census] invoices=${f.invoices} payments=${f.payments} orphanPayments=${f.orphanPayments} storedBalanceProps=${f.storedBalanceProps} suspectDuplicates=${f.suspectDuplicates} declaredNotLive=${f.declaredNotLive.length === 0 ? "none" : f.declaredNotLive.join(",")}`;
+}
+
+// app/lib/ledger-census.ts
+var TAG44 = "[ledger-census]";
+function toNum2(v) {
+  if (typeof v === "number") return v;
+  if (v && typeof v === "object" && "toNumber" in v) {
+    return v.toNumber();
+  }
+  return 0;
+}
+async function runLedgerCensusOnce(session, now) {
+  try {
+    const counts = await session.run(
+      `MATCH (i:Invoice|InboundInvoice) WITH count(i) AS invoices
+       OPTIONAL MATCH (p:InvoicePayment)
+       RETURN invoices, count(p) AS payments`
+    );
+    const orphans = await session.run(
+      `MATCH (p:InvoicePayment)
+       WHERE NOT ( (:Invoice|InboundInvoice)-[:HAS_PAYMENT]->(p) )
+       RETURN count(p) AS orphanPayments`
+    );
+    const stored = await session.run(
+      `MATCH (i:Invoice|InboundInvoice)
+       WHERE i.outstanding IS NOT NULL OR i.balance IS NOT NULL OR i.amountPaid IS NOT NULL
+       RETURN count(i) AS storedBalanceProps`
+    );
+    const keys = await session.run(
+      `MATCH (i:Invoice|InboundInvoice)-[:HAS_PAYMENT]->(p:InvoicePayment)
+       RETURN i.confirmationNumber AS invoiceId, p.paymentId AS paymentId,
+              p.amount AS amount, p.date AS date`
+    );
+    const indexes = await session.run(`SHOW INDEXES YIELD name RETURN collect(name) AS names`);
+    const live = new Set(indexes.records[0]?.get("names") ?? []);
+    const finding = reconcileLedger(
+      {
+        invoices: toNum2(counts.records[0]?.get("invoices")),
+        payments: toNum2(counts.records[0]?.get("payments")),
+        orphanPayments: toNum2(orphans.records[0]?.get("orphanPayments")),
+        storedBalanceProps: toNum2(stored.records[0]?.get("storedBalanceProps")),
+        paymentKeys: keys.records.map((r) => ({
+          invoiceId: r.get("invoiceId") ?? "",
+          paymentId: r.get("paymentId") ?? "",
+          amount: toNum2(r.get("amount")),
+          date: r.get("date") ?? ""
+        })),
+        declaredNotLive: LEDGER_INDEX_NAMES.filter((n) => !live.has(n))
+      },
+      now
+    );
+    const line = formatCensusLine(finding);
+    if (finding.alarm) console.error(`${line} alarm=true`);
+    else console.log(line);
+    return finding;
+  } catch (err) {
+    console.error(`${TAG44} error="${err instanceof Error ? err.message : String(err)}"`);
+    return null;
+  }
+}
+var DEFAULT_INTERVAL_MS2 = 15 * 60 * 1e3;
+function startLedgerCensus(openSession, opts = {}) {
+  const intervalMs = opts.intervalMs ?? DEFAULT_INTERVAL_MS2;
+  const tick = async () => {
+    let session;
+    try {
+      session = openSession();
+    } catch (err) {
+      console.error(
+        `${TAG44} open-session-failed error="${err instanceof Error ? err.message : String(err)}"`
+      );
+      return;
+    }
+    try {
+      await runLedgerCensusOnce(session, Date.now());
+    } catch (err) {
+      console.error(
+        `${TAG44} tick-failed error="${err instanceof Error ? err.message : String(err)}"`
+      );
+    } finally {
+      try {
+        await session.close();
+      } catch {
+      }
+    }
+  };
+  void tick();
+  const id = setInterval(() => {
+    void tick();
+  }, intervalMs);
+  if (typeof id.unref === "function") {
+    ;
+    id.unref();
+  }
+  return () => clearInterval(id);
+}
+
+// app/lib/conversation-audit.ts
+var TAG45 = "[conversation-audit]";
+async function runConversationAudit() {
+  const session = getSession();
+  try {
+    const res = await session.run(
+      `MATCH (a:Conversation {channel: 'whatsapp'})
+       WHERE a.channelAddress =~ '[0-9]+'
+       WITH collect(a.channelAddress) AS anchored
+       MATCH (c:Conversation {channel: 'whatsapp'})
+       WITH anchored,
+            count(*) AS total,
+            sum(CASE WHEN c.channelAddress = 'default' THEN 1 ELSE 0 END) AS unpairable,
+            collect(CASE WHEN c.channelAddress =~ 'default:[0-9]+'
+                         THEN substring(c.channelAddress, 8) END) AS forensic
+       RETURN total,
+              unpairable,
+              size([p IN forensic WHERE p IS NOT NULL AND NOT p IN anchored]) AS unreconciled`,
+      {}
+    );
+    const rec = res.records[0];
+    const result = {
+      total: Number(rec?.get("total") ?? 0),
+      unreconciled: Number(rec?.get("unreconciled") ?? 0),
+      unpairable: Number(rec?.get("unpairable") ?? 0)
+    };
+    console.error(
+      `${TAG45} channel=whatsapp total=${result.total} unreconciled=${result.unreconciled} unpairable=${result.unpairable}`
+    );
+    return result;
+  } catch (err) {
+    const reason = err instanceof Error ? `${err.name}:${err.message.slice(0, 200)}` : String(err).slice(0, 200);
+    console.error(`${TAG45} op=failed reason=${reason}`);
+    return null;
+  } finally {
+    await session.close();
+  }
+}
+
 // app/lib/graph-health.ts
-var import_dist4 = __toESM(require_dist4(), 1);
+var import_dist5 = __toESM(require_dist4(), 1);
 var HOUR_MS = 60 * 60 * 1e3;
 function renderLabelTop(rows) {
   return rows.map((b) => {
@@ -23607,7 +23891,7 @@ async function runGraphHealthTick() {
     console.error(
       `[graph-health] userprofile-multi accounts=${upAccounts} top=${upTop.length > 0 ? upTop.join(",") : "none"}`
     );
-    const indexed = [...import_dist4.VECTOR_INDEXED_LABELS];
+    const indexed = [...import_dist5.VECTOR_INDEXED_LABELS];
     const embCount = await session.run(
       `MATCH (n) WHERE n.embedding IS NULL AND any(l IN labels(n) WHERE l IN $indexed)
        RETURN count(n) AS total`,
@@ -24175,7 +24459,7 @@ var InboundHub = class {
 };
 
 // app/lib/whatsapp/gateway/wa-gateway.ts
-var import_dist5 = __toESM(require_dist(), 1);
+var import_dist6 = __toESM(require_dist(), 1);
 
 // node_modules/hono/dist/utils/stream.js
 var StreamingApi = class {
@@ -24328,8 +24612,8 @@ var streamSSE = (c, cb, onError) => {
 
 // app/lib/whatsapp/gateway/routes.ts
 function createWaChannelRoutes(deps) {
-  const app63 = new Hono();
-  app63.get("/wa-channel/inbound", (c) => {
+  const app64 = new Hono();
+  app64.get("/wa-channel/inbound", (c) => {
     const senderId = c.req.query("senderId");
     if (!senderId) return c.json({ error: "senderId required" }, 400);
     return streamSSE(c, async (stream2) => {
@@ -24347,7 +24631,7 @@ function createWaChannelRoutes(deps) {
       }
     });
   });
-  app63.post("/wa-channel/reply", async (c) => {
+  app64.post("/wa-channel/reply", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const text = body?.text;
@@ -24368,7 +24652,7 @@ function createWaChannelRoutes(deps) {
     console.error(`[whatsapp-native] op=reply-dispatch senderId=${senderId} bytes=${bytes}`);
     return c.json({ ok: true });
   });
-  app63.post("/wa-channel/reply-document", async (c) => {
+  app64.post("/wa-channel/reply-document", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const files = body?.files;
@@ -24407,7 +24691,7 @@ function createWaChannelRoutes(deps) {
     }
     return c.json({ ok: true, results });
   });
-  app63.post("/wa-channel/ready", async (c) => {
+  app64.post("/wa-channel/ready", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     if (typeof senderId !== "string") {
@@ -24416,7 +24700,7 @@ function createWaChannelRoutes(deps) {
     deps.onReady?.(senderId);
     return c.json({ ok: true });
   });
-  app63.post("/wa-channel/received", async (c) => {
+  app64.post("/wa-channel/received", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const waMessageId = body?.waMessageId;
@@ -24426,7 +24710,7 @@ function createWaChannelRoutes(deps) {
     deps.onReceived?.(senderId, waMessageId);
     return c.json({ ok: true });
   });
-  app63.post("/wa-channel/turn-end", async (c) => {
+  app64.post("/wa-channel/turn-end", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const sessionId = body?.sessionId;
@@ -24459,7 +24743,7 @@ function createWaChannelRoutes(deps) {
     console.error(`[whatsapp-native] op=turn-end sessionId=${sid} replied=no delivered=none`);
     return c.json({ ok: true, delivered: "none" });
   });
-  return app63;
+  return app64;
 }
 
 // app/lib/whatsapp/gateway/wa-gateway.ts
@@ -24561,7 +24845,7 @@ var WaGateway = class {
       const injected = res.block ? (res.block.match(/^- /gm) ?? []).length : 0;
       const owner8 = res.ownerUserId ? res.ownerUserId.slice(0, 8) : "-";
       console.error(
-        `[preference-inject] op=inject channel=wa accountId=${input.effectiveAccountId} injected=${injected} owner=${owner8} source=${res.source} capped=${injected >= import_dist5.INJECTION_RULE_CAP}`
+        `[preference-inject] op=inject channel=wa accountId=${input.effectiveAccountId} injected=${injected} owner=${owner8} source=${res.source} capped=${injected >= import_dist6.INJECTION_RULE_CAP}`
       );
     }
     this.hub.deliver(
@@ -24834,12 +25118,12 @@ var InboundHub2 = class {
 };
 
 // app/lib/webchat/gateway/webchat-gateway.ts
-var import_dist6 = __toESM(require_dist(), 1);
+var import_dist7 = __toESM(require_dist(), 1);
 
 // app/lib/webchat/gateway/routes.ts
 function createWebchatChannelRoutes(deps) {
-  const app63 = new Hono();
-  app63.get("/webchat-channel/inbound", (c) => {
+  const app64 = new Hono();
+  app64.get("/webchat-channel/inbound", (c) => {
     const key = c.req.query("key");
     if (!key) return c.json({ error: "key required" }, 400);
     return streamSSE(c, async (stream2) => {
@@ -24857,7 +25141,7 @@ function createWebchatChannelRoutes(deps) {
       }
     });
   });
-  app63.post("/webchat-channel/reply", async (c) => {
+  app64.post("/webchat-channel/reply", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const text = body?.text;
@@ -24867,7 +25151,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onReply?.(key, text);
     return c.json({ ok: true });
   });
-  app63.post("/webchat-channel/connector-auth", async (c) => {
+  app64.post("/webchat-channel/connector-auth", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const sessionId = body?.sessionId;
@@ -24880,7 +25164,7 @@ function createWebchatChannelRoutes(deps) {
     const result = await deps.onConnectorAuth({ key, sessionId, name, completed });
     return c.json(result);
   });
-  app63.post("/webchat-channel/ready", async (c) => {
+  app64.post("/webchat-channel/ready", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     if (typeof key !== "string") {
@@ -24889,7 +25173,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onReady?.(key);
     return c.json({ ok: true });
   });
-  app63.post("/webchat-channel/permission-request", async (c) => {
+  app64.post("/webchat-channel/permission-request", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const requestId = body?.request_id;
@@ -24903,7 +25187,7 @@ function createWebchatChannelRoutes(deps) {
     const verdict = await deps.awaitPermissionVerdict({ key, requestId, toolName, description, inputPreview });
     return c.json(verdict);
   });
-  app63.post("/webchat-channel/received", async (c) => {
+  app64.post("/webchat-channel/received", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const messageId = body?.messageId;
@@ -24913,7 +25197,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onReceived?.(key, messageId);
     return c.json({ ok: true });
   });
-  app63.post("/webchat-channel/turn-end", async (c) => {
+  app64.post("/webchat-channel/turn-end", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const sessionId = body?.sessionId;
@@ -24936,7 +25220,7 @@ function createWebchatChannelRoutes(deps) {
     console.error(`[webchat-native] op=turn-end channel=webchat key=${k} sessionId=${sid} replied=no delivered=none`);
     return c.json({ ok: true, delivered: "none" });
   });
-  return app63;
+  return app64;
 }
 
 // app/lib/webchat/gateway/webchat-gateway.ts
@@ -25282,7 +25566,7 @@ var WebchatGateway = class _WebchatGateway {
       const injected = res.block ? (res.block.match(/^- /gm) ?? []).length : 0;
       const owner8 = res.ownerUserId ? res.ownerUserId.slice(0, 8) : "-";
       console.error(
-        `[preference-inject] op=inject channel=web accountId=${input.accountId} injected=${injected} owner=${owner8} source=${res.source} capped=${injected >= import_dist6.INJECTION_RULE_CAP}`
+        `[preference-inject] op=inject channel=web accountId=${input.accountId} injected=${injected} owner=${owner8} source=${res.source} capped=${injected >= import_dist7.INJECTION_RULE_CAP}`
       );
     }
     this.hub.deliver(
@@ -25651,14 +25935,14 @@ function makeFileDelivery(opts) {
 }
 
 // app/lib/webchat/file-delivery.ts
-var TAG43 = "[webchat-adaptor]";
+var TAG46 = "[webchat-adaptor]";
 function platformRoot2() {
   return process.env.MAXY_PLATFORM_ROOT || "";
 }
 function makeWebchatSendFile(entry) {
   return async (filePath) => {
     if (!entry.accountId) {
-      console.error(`${TAG43} file-delivery reject reason=no-account sender=${entry.senderId}`);
+      console.error(`${TAG46} file-delivery reject reason=no-account sender=${entry.senderId}`);
       return { ok: false, error: "no-account" };
     }
     const accountDir = resolve32(platformRoot2(), "..", "data/accounts", entry.accountId);
@@ -25666,14 +25950,14 @@ function makeWebchatSendFile(entry) {
       const resolved = realpathSync8(filePath);
       const accountResolved = realpathSync8(accountDir);
       if (!resolved.startsWith(accountResolved + "/")) {
-        console.error(`${TAG43} file-delivery reject reason=outside_account_directory sender=${entry.senderId}`);
+        console.error(`${TAG46} file-delivery reject reason=outside_account_directory sender=${entry.senderId}`);
         return { ok: false, error: "outside-account" };
       }
       return { ok: true };
     } catch (err) {
       const code = err.code;
       console.error(
-        `${TAG43} file-delivery reject reason=${code === "ENOENT" ? "not-found" : "path-error"} sender=${entry.senderId}`
+        `${TAG46} file-delivery reject reason=${code === "ENOENT" ? "not-found" : "path-error"} sender=${entry.senderId}`
       );
       return { ok: false, error: code === "ENOENT" ? "not-found" : "path-error" };
     }
@@ -25682,7 +25966,7 @@ function makeWebchatSendFile(entry) {
 function makeWebchatFileDelivery(entry) {
   return makeFileDelivery({
     entry,
-    tag: TAG43,
+    tag: TAG46,
     channel: "webchat",
     sendFile: makeWebchatSendFile(entry),
     deferUntilVerdict: true
@@ -25744,7 +26028,7 @@ function buildPublicWebchatSpawnRequest(input) {
 }
 
 // app/lib/whatsapp/inbound/file-delivery-bridge.ts
-var TAG44 = "[whatsapp-adaptor]";
+var TAG47 = "[whatsapp-adaptor]";
 var SEND_USER_FILE2 = "SendUserFile";
 var WHATSAPP_SEND_DOCUMENT = "whatsapp-send-document";
 function platformRoot3() {
@@ -25762,7 +26046,7 @@ function makeWhatsAppSendFile(entry, maxyAccountId) {
     });
     if (result.ok) return { ok: true };
     console.error(
-      `${TAG44} file-delivery reject reason=send-failed sender=${entry.senderId} status=${result.status} message=${result.error}`
+      `${TAG47} file-delivery reject reason=send-failed sender=${entry.senderId} status=${result.status} message=${result.error}`
     );
     return { ok: false, error: result.error };
   };
@@ -25770,7 +26054,7 @@ function makeWhatsAppSendFile(entry, maxyAccountId) {
 function makeWhatsAppFileDelivery(entry, maxyAccountId) {
   const shared = makeFileDelivery({
     entry,
-    tag: TAG44,
+    tag: TAG47,
     channel: "whatsapp",
     sendFile: makeWhatsAppSendFile(entry, maxyAccountId)
   });
@@ -25805,7 +26089,7 @@ function makeWhatsAppFileDelivery(entry, maxyAccountId) {
         if (!delivered) {
           const fileField = call.filePath !== void 0 ? ` file=${call.filePath}` : "";
           console.error(
-            `${TAG44} file-delivery-unreconciled sender=${entry.senderId} sessionId=${sid} tool=${WHATSAPP_SEND_DOCUMENT}${fileField}`
+            `${TAG47} file-delivery-unreconciled sender=${entry.senderId} sessionId=${sid} tool=${WHATSAPP_SEND_DOCUMENT}${fileField}`
           );
         }
       }
@@ -25987,12 +26271,12 @@ var InboundHub3 = class {
 };
 
 // app/lib/telegram/gateway/telegram-gateway.ts
-var import_dist7 = __toESM(require_dist(), 1);
+var import_dist8 = __toESM(require_dist(), 1);
 
 // app/lib/telegram/gateway/routes.ts
 function createTelegramChannelRoutes(deps) {
-  const app63 = new Hono();
-  app63.get("/tg-channel/inbound", (c) => {
+  const app64 = new Hono();
+  app64.get("/tg-channel/inbound", (c) => {
     const key = c.req.query("key");
     if (!key) return c.json({ error: "key required" }, 400);
     return streamSSE(c, async (stream2) => {
@@ -26010,7 +26294,7 @@ function createTelegramChannelRoutes(deps) {
       }
     });
   });
-  app63.post("/tg-channel/reply", async (c) => {
+  app64.post("/tg-channel/reply", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const text = body?.text;
@@ -26026,7 +26310,7 @@ function createTelegramChannelRoutes(deps) {
     console.error(`[telegram-native] op=reply key=${key} bytes=${Buffer.byteLength(text, "utf8")}`);
     return c.json({ ok: true });
   });
-  app63.post("/tg-channel/ready", async (c) => {
+  app64.post("/tg-channel/ready", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     if (typeof key !== "string") {
@@ -26035,7 +26319,7 @@ function createTelegramChannelRoutes(deps) {
     deps.onReady?.(key);
     return c.json({ ok: true });
   });
-  app63.post("/tg-channel/received", async (c) => {
+  app64.post("/tg-channel/received", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const messageId = body?.messageId;
@@ -26045,7 +26329,7 @@ function createTelegramChannelRoutes(deps) {
     deps.onReceived?.(key, messageId);
     return c.json({ ok: true });
   });
-  app63.post("/tg-channel/turn-end", async (c) => {
+  app64.post("/tg-channel/turn-end", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const sessionId = body?.sessionId;
@@ -26078,7 +26362,7 @@ function createTelegramChannelRoutes(deps) {
     console.error(`[telegram-native] op=turn-end key=${key} sessionId=${sid} replied=no delivered=none`);
     return c.json({ ok: true, delivered: "none" });
   });
-  return app63;
+  return app64;
 }
 
 // app/lib/telegram/gateway/telegram-gateway.ts
@@ -26143,7 +26427,7 @@ var TelegramGateway = class {
       const injected = res.block ? (res.block.match(/^- /gm) ?? []).length : 0;
       const owner8 = res.ownerUserId ? res.ownerUserId.slice(0, 8) : "-";
       console.error(
-        `[preference-inject] op=inject channel=tg accountId=${input.accountId} injected=${injected} owner=${owner8} source=${res.source} capped=${injected >= import_dist7.INJECTION_RULE_CAP}`
+        `[preference-inject] op=inject channel=tg accountId=${input.accountId} injected=${injected} owner=${owner8} source=${res.source} capped=${injected >= import_dist8.INJECTION_RULE_CAP}`
       );
     }
     this.hub.deliver(
@@ -26209,7 +26493,7 @@ function buildTelegramSpawnRequest(input) {
 import { realpathSync as realpathSync9 } from "fs";
 import { readFile as readFile7, stat as stat7 } from "fs/promises";
 import { resolve as resolve33, basename as basename11 } from "path";
-var TAG45 = "[telegram:outbound]";
+var TAG48 = "[telegram:outbound]";
 var TELEGRAM_DOCUMENT_MAX_BYTES = 50 * 1024 * 1024;
 async function sendTelegramDocument(input) {
   const { botToken, chatId, filePath, caption, maxyAccountId, platformRoot: platformRoot5 } = input;
@@ -26225,16 +26509,16 @@ async function sendTelegramDocument(input) {
     resolvedPath = realpathSync9(filePath);
     const accountResolved = realpathSync9(accountDir);
     if (!resolvedPath.startsWith(accountResolved + "/")) {
-      console.error(`${TAG45} document REJECTED reason=outside_account_directory maxyAccountId=${maxyAccountId}`);
+      console.error(`${TAG48} document REJECTED reason=outside_account_directory maxyAccountId=${maxyAccountId}`);
       return { ok: false, status: 403, error: "Access denied: file is outside the account directory" };
     }
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
-      console.error(`${TAG45} document ENOENT path=${filePath}`);
+      console.error(`${TAG48} document ENOENT path=${filePath}`);
       return { ok: false, status: 404, error: `File not found: ${filePath}` };
     }
-    console.error(`${TAG45} document path error: ${String(err)}`);
+    console.error(`${TAG48} document path error: ${String(err)}`);
     return { ok: false, status: 500, error: String(err) };
   }
   const fileStat = await stat7(resolvedPath);
@@ -26267,13 +26551,13 @@ async function sendTelegramDocument(input) {
     error = e instanceof Error ? e.message : String(e);
   }
   console.error(
-    `${TAG45} sent document to=${chatId} file=${filename} bytes=${fileStat.size} ok=${ok}` + (messageId !== void 0 ? ` id=${messageId}` : "")
+    `${TAG48} sent document to=${chatId} file=${filename} bytes=${fileStat.size} ok=${ok}` + (messageId !== void 0 ? ` id=${messageId}` : "")
   );
   return ok ? { ok: true, messageId } : { ok: false, status: 500, error };
 }
 
 // app/lib/telegram/outbound/file-delivery.ts
-var TAG46 = "[telegram:outbound]";
+var TAG49 = "[telegram:outbound]";
 function platformRoot4() {
   return process.env.MAXY_PLATFORM_ROOT || "";
 }
@@ -26285,11 +26569,11 @@ function makeTelegramSendFile(entry) {
       botToken = (entry.role === "admin" ? tg?.adminBotToken : tg?.publicBotToken) ?? null;
     }
     if (!botToken) {
-      console.error(`${TAG46} file-delivery reject reason=no-bot-token sender=${entry.senderId} role=${entry.role}`);
+      console.error(`${TAG49} file-delivery reject reason=no-bot-token sender=${entry.senderId} role=${entry.role}`);
       return { ok: false, error: "no-bot-token" };
     }
     if (entry.replyTarget == null) {
-      console.error(`${TAG46} file-delivery reject reason=no-reply-target sender=${entry.senderId} role=${entry.role}`);
+      console.error(`${TAG49} file-delivery reject reason=no-reply-target sender=${entry.senderId} role=${entry.role}`);
       return { ok: false, error: "no-reply-target" };
     }
     const result = await sendTelegramDocument({
@@ -26306,7 +26590,7 @@ function makeTelegramSendFile(entry) {
 function makeTelegramFileDelivery(entry) {
   return makeFileDelivery({
     entry,
-    tag: TAG46,
+    tag: TAG49,
     channel: "telegram",
     sendFile: makeTelegramSendFile(entry)
   });
@@ -26356,7 +26640,7 @@ function telegramServerPath() {
 
 // app/lib/channel-pty-bridge/public-session-end-review.ts
 import { randomUUID as randomUUID16 } from "crypto";
-var TAG47 = "[public-session-review]";
+var TAG50 = "[public-session-review]";
 var CONSUMED_CAP = 500;
 var consumed = /* @__PURE__ */ new Set();
 function consumeOnce(sessionId) {
@@ -26383,7 +26667,7 @@ async function fetchJsonl(sessionId) {
     return await res.text();
   } catch (err) {
     console.error(
-      `${TAG47} jsonl-fetch-failed sessionId=${sessionId} err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG50} jsonl-fetch-failed sessionId=${sessionId} err="${err instanceof Error ? err.message : String(err)}"`
     );
     return null;
   }
@@ -26407,7 +26691,7 @@ async function fetchPriorWrites(sliceToken, accountId) {
     const res = await fetch(url);
     if (!res.ok) {
       console.error(
-        `${TAG47} prior-writes-fetch-failed sliceToken=${sliceToken.slice(0, 8)} status=${res.status}`
+        `${TAG50} prior-writes-fetch-failed sliceToken=${sliceToken.slice(0, 8)} status=${res.status}`
       );
       return [];
     }
@@ -26415,7 +26699,7 @@ async function fetchPriorWrites(sliceToken, accountId) {
     return Array.isArray(body.writes) ? body.writes : [];
   } catch (err) {
     console.error(
-      `${TAG47} prior-writes-fetch-threw sliceToken=${sliceToken.slice(0, 8)} err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG50} prior-writes-fetch-threw sliceToken=${sliceToken.slice(0, 8)} err="${err instanceof Error ? err.message : String(err)}"`
     );
     return [];
   }
@@ -26444,7 +26728,7 @@ function composeInitialMessage(input) {
 }
 async function dispatchReviewer(input, initialMessage) {
   const sessionId = randomUUID16();
-  console.log(`${TAG47} route target=rc-spawn sessionId=${sessionId.slice(0, 8)} sourceSession=${input.sessionId.slice(0, 8)}`);
+  console.log(`${TAG50} route target=rc-spawn sessionId=${sessionId.slice(0, 8)} sourceSession=${input.sessionId.slice(0, 8)}`);
   const spawned = await managerRcSpawn({
     sessionId,
     initialMessage,
@@ -26464,21 +26748,21 @@ async function firePublicSessionEndReview(input) {
   const dispatchedAt = Date.now();
   if (consumed.has(input.sessionId)) {
     console.log(
-      `${TAG47} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
+      `${TAG50} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
     );
     return;
   }
   const jsonl = await fetchJsonl(input.sessionId);
   if (!jsonl) {
     console.log(
-      `${TAG47} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-jsonl-missing`
+      `${TAG50} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-jsonl-missing`
     );
     return;
   }
   const operatorTurns = countOperatorTurns(jsonl);
   if (operatorTurns === 0) {
     console.log(
-      `${TAG47} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-no-turns`
+      `${TAG50} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-no-turns`
     );
     return;
   }
@@ -26492,28 +26776,28 @@ async function firePublicSessionEndReview(input) {
   });
   if (!consumeOnce(input.sessionId)) {
     console.log(
-      `${TAG47} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
+      `${TAG50} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
     );
     return;
   }
   const dispatched = await dispatchReviewer(input, initialMessage);
   if (!dispatched.ok) {
     console.error(
-      `${TAG47} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-spawn-failed reason=${dispatched.reason}`
+      `${TAG50} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-spawn-failed reason=${dispatched.reason}`
     );
     return;
   }
   console.log(
-    `${TAG47} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=dispatched managerSessionId=${dispatched.managerSessionId} operatorTurns=${operatorTurns} priorWrites=${priorWrites.length} ms=${Date.now() - dispatchedAt}`
+    `${TAG50} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=dispatched managerSessionId=${dispatched.managerSessionId} operatorTurns=${operatorTurns} priorWrites=${priorWrites.length} ms=${Date.now() - dispatchedAt}`
   );
 }
 
 // app/lib/whatsapp/inbound/resolve-client-graph-owner.ts
-var import_dist8 = __toESM(require_dist(), 1);
+var import_dist9 = __toESM(require_dist(), 1);
 async function resolveClientOwnerUserId(accountId, deps = {}) {
   const listAccounts = deps.listAccounts ?? listValidAccounts;
   const getSession4 = deps.getSession ?? getSession;
-  const resolveOwner2 = deps.resolveOwner ?? import_dist8.resolveOwnerUserId;
+  const resolveOwner2 = deps.resolveOwner ?? import_dist9.resolveOwnerUserId;
   const role = listAccounts().find((a) => a.accountId === accountId)?.config.role;
   if (role !== "client") return null;
   const session = getSession4();
@@ -26944,14 +27228,14 @@ watchFile(ALIAS_DOMAINS_PATH, { interval: 2e3 }, () => {
 function isPublicHost(host) {
   return host.startsWith("public.") || aliasDomains.has(host);
 }
-var app62 = new Hono();
+var app63 = new Hono();
 var nativeFileFollowers = /* @__PURE__ */ new Map();
 var webchatFileFollowers = /* @__PURE__ */ new Map();
 async function fetchAccountStandingRules(accountId) {
   const session = getSession();
   try {
-    const res = await (0, import_dist9.resolveActiveRules)(session, accountId);
-    return { block: (0, import_dist9.formatStandingRulesBlock)(res.rules), ownerUserId: res.ownerUserId, source: res.source };
+    const res = await (0, import_dist10.resolveActiveRules)(session, accountId);
+    return { block: (0, import_dist10.formatStandingRulesBlock)(res.rules), ownerUserId: res.ownerUserId, source: res.source };
   } catch (err) {
     console.error(
       `[preference-inject] op=fetch-failed accountId=${accountId} error=${err instanceof Error ? err.message : String(err)}`
@@ -27052,6 +27336,13 @@ var waGateway = new WaGateway({
       console.error(`[whatsapp-native] op=account-manager-route senderId=${senderId} managesAccount=${managesAccount} effectiveAccount=${effectiveAccountId} source=gate`);
     }
     const req = buildWaSpawnRequest({ accountId: effectiveAccountId, senderId, role, personId, gatewayUrl, serverPath });
+    await ensureSessionConversation({
+      accountId: effectiveAccountId,
+      sessionId: req.sessionId,
+      channel: "whatsapp",
+      channelAddress: senderId,
+      agentType: role === "admin" ? "admin" : "public"
+    });
     let userId = role === "admin" ? resolveAdminUserId({ accountId: effectiveAccountId, senderPhone: senderId }) ?? (ownerSelfPhone ? resolveOwnerUserId(effectiveAccountId) ?? void 0 : void 0) : void 0;
     let graphOwnerResolved = false;
     if (role === "admin" && userId === void 0) {
@@ -27090,7 +27381,7 @@ var waGateway = new WaGateway({
     nativeFileFollowers.set(senderId, ac);
   }
 });
-app62.route("/", waGateway.routes());
+app63.route("/", waGateway.routes());
 waGateway.startSweeper();
 function runDuplicateSenderAudit() {
   try {
@@ -27208,7 +27499,7 @@ var webchatGateway = new WebchatGateway({
   firePublicSessionEndReview: (input) => firePublicSessionEndReview(input)
 });
 setWebchatGateway(webchatGateway);
-app62.route("/", webchatGateway.routes());
+app63.route("/", webchatGateway.routes());
 webchatGateway.startSweeper();
 webchatGateway.startPublicReaper();
 var telegramFileFollowers = /* @__PURE__ */ new Map();
@@ -27242,7 +27533,7 @@ var telegramGateway = new TelegramGateway({
   }
 });
 setTelegramGateway(telegramGateway);
-app62.route("/", telegramGateway.routes());
+app63.route("/", telegramGateway.routes());
 telegramGateway.startSweeper();
 var chatRoutes = createChatRoutes({
   handleInbound: (input) => webchatGateway.handleInbound(input),
@@ -27276,19 +27567,19 @@ var scheduleInjectRoutes = createScheduleInjectRoutes({
     return managed.account;
   }
 });
-app62.route("/api/channel/schedule-inject", scheduleInjectRoutes);
-app62.use("*", clientIpMiddleware);
+app63.route("/api/channel/schedule-inject", scheduleInjectRoutes);
+app63.use("*", clientIpMiddleware);
 function allowsSameOriginFraming(path3) {
   return path3 === "/vnc-viewer.html" || path3.startsWith("/api/admin/attachment/") || path3.startsWith("/api/public-reader/attachment/") || path3 === "/api/admin/files/download";
 }
-app62.use("*", async (c, next) => {
+app63.use("*", async (c, next) => {
   await next();
   c.header("X-Content-Type-Options", "nosniff");
   c.header("Referrer-Policy", "strict-origin-when-cross-origin");
   c.header("X-Frame-Options", allowsSameOriginFraming(c.req.path) ? "SAMEORIGIN" : "DENY");
 });
 var HTTP_LOG_PATHS = /* @__PURE__ */ new Set(["/vnc-viewer.html", "/vnc-popout.html"]);
-app62.use("*", async (c, next) => {
+app63.use("*", async (c, next) => {
   if (!HTTP_LOG_PATHS.has(c.req.path)) {
     await next();
     return;
@@ -27306,7 +27597,7 @@ app62.use("*", async (c, next) => {
     });
   }
 });
-app62.use("*", async (c, next) => {
+app63.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isOperatorHost(host, getOperatorDomains()) || !isPublicHost(host)) {
     await next();
@@ -27344,7 +27635,7 @@ function resolveRemoteAuthOpts(c) {
   return { ...brandLoginOpts, origin };
 }
 var MAX_LOGIN_BODY = 8 * 1024;
-app62.post("/__remote-auth/login", async (c) => {
+app63.post("/__remote-auth/login", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   if (!requestIsTlsTerminated(c)) {
@@ -27389,7 +27680,7 @@ app62.post("/__remote-auth/login", async (c) => {
     }
   });
 });
-app62.get("/__remote-auth/logout", (c) => {
+app63.get("/__remote-auth/logout", (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   console.error(`[remote-auth] logout ip=${clientIp}`);
@@ -27402,7 +27693,7 @@ app62.get("/__remote-auth/logout", (c) => {
     }
   });
 });
-app62.post("/__remote-auth/change-password", async (c) => {
+app63.post("/__remote-auth/change-password", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   const rateLimited = checkRateLimit(client);
@@ -27461,13 +27752,13 @@ app62.post("/__remote-auth/change-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), mode: "change", changeError: "Failed to save password", redirect }), 200);
   }
 });
-app62.get("/__remote-auth/setup", (c) => {
+app63.get("/__remote-auth/setup", (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), mode: "setup" }), 200);
 });
-app62.post("/__remote-auth/set-initial-password", async (c) => {
+app63.post("/__remote-auth/set-initial-password", async (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
@@ -27505,10 +27796,10 @@ app62.post("/__remote-auth/set-initial-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), mode: "setup", setupError: "Failed to save password. Please try again." }), 200);
   }
 });
-app62.get("/api/remote-auth/status", (c) => {
+app63.get("/api/remote-auth/status", (c) => {
   return c.json({ configured: isRemoteAuthConfigured() });
 });
-app62.post("/api/remote-auth/set-password", async (c) => {
+app63.post("/api/remote-auth/set-password", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -27547,10 +27838,10 @@ app62.post("/api/remote-auth/set-password", async (c) => {
     return c.json({ error: "Failed to save password" }, 500);
   }
 });
-app62.route("/api/_client-error", client_error_default);
+app63.route("/api/_client-error", client_error_default);
 console.log("[client-error-route] mounted");
 var PWA_PUBLIC_PATHS = /* @__PURE__ */ new Set(["/sw.js", ...PWA_SURFACES.map((s) => s.manifestPath)]);
-app62.use("*", async (c, next) => {
+app63.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path3 = c.req.path;
   if (path3 === "/favicon.ico" || path3.startsWith("/assets/") || path3.startsWith("/brand/") || // Public free/busy is read by the booking page (a separate Cloudflare Pages
@@ -27594,34 +27885,34 @@ app62.use("*", async (c, next) => {
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), redirect: path3 }), 200);
 });
-app62.route("/api/health", health_default);
-app62.route("/api/chat", chatRoutes);
-app62.route("/api/whatsapp", whatsapp_default);
-app62.route("/api/storage", storage_broker_default);
-app62.route("/api/whatsapp-reader", whatsapp_reader_default);
-app62.route("/api/public-reader", public_reader_default);
-app62.route("/api/webchat", createWebchatRoutes({
+app63.route("/api/health", health_default);
+app63.route("/api/chat", chatRoutes);
+app63.route("/api/whatsapp", whatsapp_default);
+app63.route("/api/storage", storage_broker_default);
+app63.route("/api/whatsapp-reader", whatsapp_reader_default);
+app63.route("/api/public-reader", public_reader_default);
+app63.route("/api/webchat", createWebchatRoutes({
   handleInbound: (input) => webchatGateway.handleInbound(input),
   // Task 940 — the permission relay's pointer read + verdict write.
   pendingPromptFor: (key) => webchatGateway.pendingPromptFor(key),
   deliveryFailureFor: (key) => webchatGateway.deliveryFailureFor(key),
   resolvePermissionVerdict: (key, requestId, behavior) => webchatGateway.resolvePermissionVerdict(key, requestId, behavior)
 }));
-app62.route("/api/webchat/greeting", webchat_greeting_default);
-app62.route("/api/telegram", telegram_default);
-app62.route("/api/quickbooks", quickbooks_default);
-app62.route(
+app63.route("/api/webchat/greeting", webchat_greeting_default);
+app63.route("/api/telegram", telegram_default);
+app63.route("/api/quickbooks", quickbooks_default);
+app63.route(
   "/api/google",
   createGoogleOAuthRoutes(
     resolve36(process.env.MAXY_PLATFORM_ROOT ?? join39(__dirname, "..")),
     resolve36(process.env.MAXY_PLATFORM_ROOT ?? join39(__dirname, ".."), "..", "data/accounts")
   )
 );
-app62.route("/api/onboarding", onboarding_default);
-app62.route("/api/admin", admin_default);
-app62.route("/api/access", access_default);
-app62.route("/api/session", session_default2);
-app62.route("/api/calendar", calendar_public_default);
+app63.route("/api/onboarding", onboarding_default);
+app63.route("/api/admin", admin_default);
+app63.route("/api/access", access_default);
+app63.route("/api/session", session_default2);
+app63.route("/api/calendar", calendar_public_default);
 var SAFE_SLUG_RE2 = /^[a-z][a-z0-9-]{2,49}$/;
 var SAFE_FILENAME_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var IMAGE_MIME = {
@@ -27633,7 +27924,7 @@ var IMAGE_MIME = {
   ".svg": "image/svg+xml",
   ".ico": "image/x-icon"
 };
-app62.get("/agent-assets/:slug/:filename", (c) => {
+app63.get("/agent-assets/:slug/:filename", (c) => {
   const slug = c.req.param("slug");
   const filename = c.req.param("filename");
   if (!SAFE_SLUG_RE2.test(slug)) {
@@ -27668,7 +27959,7 @@ app62.get("/agent-assets/:slug/:filename", (c) => {
     "Cache-Control": "public, max-age=3600"
   });
 });
-app62.get("/generated/:filename", (c) => {
+app63.get("/generated/:filename", (c) => {
   const filename = c.req.param("filename");
   if (!SAFE_FILENAME_RE.test(filename) || filename.includes("..")) {
     console.error(`[generated] serve file=${filename} status=403`);
@@ -27698,10 +27989,10 @@ app62.get("/generated/:filename", (c) => {
     "Cache-Control": "public, max-age=86400"
   });
 });
-app62.route("/sites", sites_default);
-app62.route("/listings", listings_default);
-app62.route("/v", visitor_event_default);
-app62.route("/v", visitor_consent_default);
+app63.route("/sites", sites_default);
+app63.route("/listings", listings_default);
+app63.route("/v", visitor_event_default);
+app63.route("/v", visitor_consent_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
@@ -27856,7 +28147,7 @@ function brandedPublicHtml(agentSlug) {
 function agentUnavailableHtml() {
   return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${escapeHtml(BRAND.productName)}</title></head><body style="font-family:system-ui,sans-serif;max-width:32rem;margin:4rem auto;padding:0 1.5rem;color:#222"><h1 style="font-size:1.25rem">Agent unavailable</h1><p>This agent isn't available right now. If you reached this page from a saved link, the agent may have been turned off.</p></body></html>`;
 }
-app62.get("/", (c) => {
+app63.get("/", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const klass = classifyHost(host, getOperatorDomains(), isPublicHost);
   if (klass === "operator") {
@@ -27878,12 +28169,12 @@ app62.get("/", (c) => {
   console.log(`[host-class] host=${host} class=admin served=index.html`);
   return c.html(cachedHtml("index.html"));
 });
-app62.get("/public", (c) => {
+app63.get("/public", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
 });
-app62.get("/public-chat", (c) => {
+app63.get("/public-chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
@@ -27902,9 +28193,9 @@ async function logViewerFetch(c, next) {
     duration_ms: Date.now() - start
   });
 }
-app62.use("/vnc-viewer.html", logViewerFetch);
-app62.use("/vnc-popout.html", logViewerFetch);
-app62.get("/vnc-popout.html", (c) => {
+app63.use("/vnc-viewer.html", logViewerFetch);
+app63.use("/vnc-popout.html", logViewerFetch);
+app63.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
     html = readFileSync39(resolve36(process.cwd(), "public", "vnc-popout.html"), "utf-8");
@@ -27917,7 +28208,7 @@ app62.get("/vnc-popout.html", (c) => {
   }
   return c.html(html);
 });
-app62.post("/api/vnc/client-event", async (c) => {
+app63.post("/api/vnc/client-event", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -27938,11 +28229,11 @@ app62.post("/api/vnc/client-event", async (c) => {
   });
   return c.json({ ok: true });
 });
-app62.get("/g/:slug", (c) => {
+app63.get("/g/:slug", (c) => {
   return c.html(brandedPublicHtml(resolveDefaultSlug() ?? void 0));
 });
 for (const pwa of PWA_SURFACES) {
-  app62.get(pwa.manifestPath, (c) => {
+  app63.get(pwa.manifestPath, (c) => {
     const manifest = buildManifest(pwa, {
       productName: BRAND.productName,
       appIcon192: brandAppIcon192Path,
@@ -27958,7 +28249,7 @@ for (const pwa of PWA_SURFACES) {
     return c.body(JSON.stringify(manifest));
   });
 }
-app62.get("/sw.js", (c) => {
+app63.get("/sw.js", (c) => {
   if (SW_SOURCE == null) {
     console.error("[pwa] op=sw status=500 reason=sw-source-missing");
     return c.text("Service worker unavailable", 500);
@@ -27967,12 +28258,12 @@ app62.get("/sw.js", (c) => {
   console.log(`[pwa] op=sw status=200 ct=${SW_CONTENT_TYPE}`);
   return c.body(SW_SOURCE);
 });
-app62.get("/graph", (c) => {
+app63.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host) || isOperatorHost(host, getOperatorDomains())) return c.text("Not found", 404);
   return c.html(cachedHtml("graph.html"));
 });
-app62.get("/chat", (c) => {
+app63.get("/chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isOperatorHost(host, getOperatorDomains())) {
     console.log(`[host-class] host=${host} class=operator served=operator.html`);
@@ -27981,27 +28272,32 @@ app62.get("/chat", (c) => {
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("chat.html"));
 });
-app62.get("/data", (c) => {
+app63.get("/data", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("data.html"));
 });
-app62.get("/tasks", (c) => {
+app63.get("/tasks", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("tasks.html"));
 });
-app62.get("/calendar", (c) => {
+app63.get("/activity", (c) => {
+  const host = (c.req.header("host") ?? "").split(":")[0];
+  if (isPublicHost(host)) return c.text("Not found", 404);
+  return c.html(cachedHtml("activity.html"));
+});
+app63.get("/calendar", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("calendar.html"));
 });
-app62.get("/browser", (c) => {
+app63.get("/browser", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host) || isOperatorHost(host, getOperatorDomains())) return c.text("Not found", 404);
   return c.html(cachedHtml("browser.html"));
 });
-app62.get("/:slug", async (c, next) => {
+app63.get("/:slug", async (c, next) => {
   const slug = c.req.param("slug");
   if (AGENT_SLUG_PATTERN.test(`/${slug}`)) {
     const account = resolveAccount();
@@ -28016,13 +28312,13 @@ app62.get("/:slug", async (c, next) => {
   await next();
 });
 if (brandFaviconPath !== "/favicon.ico") {
-  app62.get("/favicon.ico", (c) => {
+  app63.get("/favicon.ico", (c) => {
     c.header("Cache-Control", "public, max-age=300");
     return c.redirect(brandFaviconPath, 302);
   });
 }
-app62.use("/*", serveStatic({ root: "./public" }));
-app62.all("*", (c) => {
+app63.use("/*", serveStatic({ root: "./public" }));
+app63.all("*", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path3 = c.req.path;
   if (isPublicHost(host)) {
@@ -28036,7 +28332,7 @@ app62.all("*", (c) => {
 });
 var port = requirePortEnv("MAXY_UI_INTERNAL_PORT", { tag: "ui-server" });
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
-var httpServer = serve({ fetch: app62.fetch, port, hostname });
+var httpServer = serve({ fetch: app63.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
   const reconcilePlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join39(__dirname, "..");
@@ -28092,7 +28388,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     try {
       if (!existsSync37(strandedAccountsDir)) return;
       const now = Date.now();
-      for (const name of readdirSync22(strandedAccountsDir)) {
+      for (const name of readdirSync23(strandedAccountsDir)) {
         if (!STRANDED_UUID_RE.test(name)) continue;
         const pendingPath2 = resolve36(strandedAccountsDir, name, "secrets/outlook/pending-devicecode.enc");
         if (!existsSync37(pendingPath2)) continue;
@@ -28200,6 +28496,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   publishLoop.unref();
 }
 startTimeEntryCensus(() => getSession());
+startLedgerCensus(() => getSession());
 {
   const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join39(__dirname, "..");
   const auditScript = resolve36(auditPlatformRoot, "plugins/connector/mcp/dist/scripts/audit-connectors.js");
@@ -28277,7 +28574,7 @@ for (const m of SUBAPP_MANIFEST) {
 }
 try {
   const registered = [];
-  for (const r of app62.routes ?? []) {
+  for (const r of app63.routes ?? []) {
     if (typeof r.path !== "string" || r.path.includes(":") || r.path.includes("*")) continue;
     if (AGENT_SLUG_PATTERN.test(r.path)) {
       registered.push({ method: (r.method ?? "ALL").toUpperCase(), path: r.path });
@@ -28339,6 +28636,7 @@ async function runAdminUserReconcileTick() {
     }
     await runAdminUserSelfHeal({ userId, accountId: account.accountId });
     await runUserProfileReconcile();
+    await runConversationAudit();
   } catch (err) {
     console.error(`[adminuser-self-heal] rejected: ${err instanceof Error ? err.message : String(err)}`);
   }