@rubytech/create-maxy-code 0.1.472 → 0.1.474

package/dist/__tests__/google-client-id-env.test.js

@@ -1,5 +1,6 @@
-// acceptance gate for GOOGLE_CLIENT_ID / GOOGLE_PUBLIC_BASE stamping in the
-// claude-session-manager systemd unit (Task 1761).
+// acceptance gate for GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET stamping in the
+// claude-session-manager systemd unit (Task 1761; Task 1791 replaced
+// GOOGLE_PUBLIC_BASE with GOOGLE_CLIENT_SECRET and asserts the former is gone).
 //
 // This test exists because the first fix stamped only the darwin `.env` mirror
 // and missed this Linux unit, so on the actual (Ubuntu) install the google
@@ -20,7 +21,7 @@ import assert from "node:assert/strict";
 import { buildClaudeSessionManagerUnitFile } from "../port-resolution.js";
 const ACCOUNT_ID = "12345678-9abc-def0-1234-56789abcdef0";
 const GOOGLE_ID = "1032860640027-p61l59fnog4mad5o7grginpaps9jnu8c.apps.googleusercontent.com";
-const PUBLIC_BASE = "https://public.sitedesk.online";
+const SECRET = "GOCSPX-test-value-not-real";
 const OUTLOOK_ID = "0fa68fe2-8bec-4007-a0c7-776636fbcf97";
 function build(opts) {
     return buildClaudeSessionManagerUnitFile({
@@ -36,20 +37,22 @@ function build(opts) {
         ...opts,
     });
 }
-test("both values present stamps both Environment lines", () => {
-    const unit = build({ googleClientId: GOOGLE_ID, googlePublicBase: PUBLIC_BASE });
+test("id and secret present stamps both Environment lines", () => {
+    const unit = build({ googleClientId: GOOGLE_ID, googleClientSecret: SECRET });
     assert.ok(unit.includes(`Environment=GOOGLE_CLIENT_ID=${GOOGLE_ID}`));
-    assert.ok(unit.includes(`Environment=GOOGLE_PUBLIC_BASE=${PUBLIC_BASE}`));
+    assert.ok(unit.includes(`Environment=GOOGLE_CLIENT_SECRET=${SECRET}`));
+    // The hosted callback is withdrawn (Task 1791); nothing consumes a public base.
+    assert.ok(!unit.includes("GOOGLE_PUBLIC_BASE"));
 });
-test("a client id with no public base stamps NEITHER line", () => {
+test("a client id with no secret stamps NEITHER line", () => {
     const unit = build({ googleClientId: GOOGLE_ID });
     assert.ok(!unit.includes("GOOGLE_CLIENT_ID"), "a half-stamp must not ship");
-    assert.ok(!unit.includes("GOOGLE_PUBLIC_BASE"));
+    assert.ok(!unit.includes("GOOGLE_CLIENT_SECRET"));
 });
-test("a public base with no client id stamps NEITHER line", () => {
-    const unit = build({ googlePublicBase: PUBLIC_BASE });
+test("a secret with no client id stamps NEITHER line", () => {
+    const unit = build({ googleClientSecret: SECRET });
     assert.ok(!unit.includes("GOOGLE_CLIENT_ID"));
-    assert.ok(!unit.includes("GOOGLE_PUBLIC_BASE"));
+    assert.ok(!unit.includes("GOOGLE_CLIENT_SECRET"));
 });
 test("a brand shipping no google app stamps neither line", () => {
     const unit = build({});
@@ -59,7 +62,7 @@ test("a brand shipping no google app stamps neither line", () => {
 test("google stamping leaves the outlook pair intact", () => {
     const unit = build({
         googleClientId: GOOGLE_ID,
-        googlePublicBase: PUBLIC_BASE,
+        googleClientSecret: SECRET,
         outlookClientId: OUTLOOK_ID,
     });
     assert.ok(unit.includes(`Environment=OUTLOOK_CLIENT_ID=${OUTLOOK_ID}`));

package/dist/index.js

@@ -51,26 +51,6 @@ catch (err) {
 }
 const INSTALL_DIR = resolve(process.env.HOME ?? "/root", BRAND.installDir);
 const PERSIST_DIR = resolve(process.env.HOME ?? "/root", BRAND.configDir);
-// Task 1761 — GOOGLE_PUBLIC_BASE is the https origin Google redirects back to
-// after consent. It is a property of THIS INSTALL's tunnel, not of the brand,
-// so it is read from the same cloudflared/tunnel.state the uninstaller reads.
-// Defined once here because BOTH env paths need it: the darwin .env mirror and
-// the Linux systemd unit. Absent tunnel → unset, and google-account-register
-// refuses with an actionable message rather than minting a consent URL whose
-// redirect_uri Google will reject on its byte-for-byte comparison.
-const googlePublicBase = (() => {
-    try {
-        const tunnelState = join(PERSIST_DIR, "cloudflared/tunnel.state");
-        if (!existsSync(tunnelState))
-            return "";
-        const parsed = JSON.parse(readFileSync(tunnelState, "utf-8"));
-        return parsed.domain ? `https://public.${parsed.domain}` : "";
-    }
-    catch {
-        // Unreadable tunnel state is not fatal to the install; the value stays unset.
-        return "";
-    }
-})();
 const LOG_DIR = join(PERSIST_DIR, "logs");
 const LOG_FILE = join(LOG_DIR, `install-${new Date().toISOString().replace(/[:.]/g, "-")}.log`);
 // every `claude plugin` shellout must read/write the per-brand
@@ -3741,13 +3721,10 @@ function installServiceDarwin() {
         }
         logFile(`  [installer] op=outlook-client-id brand=${BRAND.hostname} stamped=${BRAND.outlookClientId ? "true" : "false"}`);
         // Task 1761 — same upsert/strip discipline for the Google vendor app.
-        // GOOGLE_PUBLIC_BASE is the https origin the consent redirect returns to;
-        // it must match the authorized redirect URI on the vendor app byte-for-byte,
-        // so it is derived from the brand's public host, not guessed at call time.
-        if (BRAND.googleClientId) {
+        if (BRAND.googleClientId && BRAND.googleClientSecret) {
             for (const [key, value] of [
                 ["GOOGLE_CLIENT_ID", BRAND.googleClientId],
-                ["GOOGLE_PUBLIC_BASE", googlePublicBase],
+                ["GOOGLE_CLIENT_SECRET", BRAND.googleClientSecret],
             ]) {
                 const re = new RegExp(`^${key}=.*$`, "m");
                 if (re.test(envContent))
@@ -3757,11 +3734,11 @@ function installServiceDarwin() {
             }
         }
         else {
-            for (const key of ["GOOGLE_CLIENT_ID", "GOOGLE_PUBLIC_BASE"]) {
+            for (const key of ["GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET"]) {
                 envContent = envContent.replace(new RegExp(`^${key}=.*\\n?`, "m"), "");
             }
         }
-        logFile(`  [installer] op=google-client-id brand=${BRAND.hostname} stamped=${BRAND.googleClientId ? "true" : "false"} publicBase=${googlePublicBase || "unset"}`);
+        logFile(`  [installer] op=google-client-id brand=${BRAND.hostname} stamped=${BRAND.googleClientId && BRAND.googleClientSecret ? "true" : "false"} clientId=${BRAND.googleClientId ? "set" : "unset"} secret=${BRAND.googleClientSecret ? "set" : "unset"}`);
         writeFileSync(envPath, envContent);
         logFile(`  .env: DISPLAY_MODE=${DISPLAY_MODE}, EMBED_MODEL=${EMBED_MODEL}, EMBED_DIMENSIONS=${EMBED_DIMS}, NEO4J_URI=bolt://localhost:${NEO4J_PORT}, PORT=${PORT}, MAXY_UI_INTERNAL_PORT=${PORT} (darwin-collapsed), CLAUDE_SESSION_MANAGER_PORT=${BRAND.claudeSessionManagerPort}, HOSTNAME=0.0.0.0, ACCOUNT_ID=${installAccountId.slice(0, 8)}…, CLAUDE_CONFIG_DIR=${persistDir}/.claude, CLAUDE_BIN=${canonicalClaude ?? "unresolved(PATH)"}, NODE_BIN=${nodeBin}, PATH=${darwinServiceEnvPath}`);
     }
@@ -4386,7 +4363,7 @@ function installService() {
         cdpPort: CDP_PORT_BRAND,
         outlookClientId: BRAND.outlookClientId,
         googleClientId: BRAND.googleClientId,
-        googlePublicBase: googlePublicBase || undefined,
+        googleClientSecret: BRAND.googleClientSecret,
     });
     writeFileSync(join(serviceDir, claudeSessionManagerUnitName), claudeSessionManagerUnit);
     logFile(`  ${claudeSessionManagerUnitName}: CLAUDE_SESSION_MANAGER_PORT=${CLAUDE_SESSION_MANAGER_PORT_BRAND} MAXY_UI_INTERNAL_PORT=${MAXY_UI_INTERNAL_PORT}`);
@@ -4397,7 +4374,7 @@ function installService() {
     // Task 1761 — the same standing signal for the Google vendor app. Both parts
     // are reported because a client id without a public base stamps NEITHER: a
     // consent URL built without the redirect origin is one Google rejects.
-    logFile(`  [installer] op=google-client-id brand=${BRAND.hostname} stamped=${BRAND.googleClientId && googlePublicBase ? "true" : "false"} clientId=${BRAND.googleClientId ? "set" : "unset"} publicBase=${googlePublicBase || "unset"}`);
+    logFile(`  [installer] op=google-client-id brand=${BRAND.hostname} stamped=${BRAND.googleClientId && BRAND.googleClientSecret ? "true" : "false"} clientId=${BRAND.googleClientId ? "set" : "unset"} secret=${BRAND.googleClientSecret ? "set" : "unset"}`);
     // Task 250 — write the brand-agnostic `claude-ptys.slice` unit. Every
     // brand's session manager drops its per-spawn scope units under this
     // slice. Writing it once per install is idempotent (the content is

package/dist/port-resolution.js

@@ -135,11 +135,11 @@ export function buildClaudeSessionManagerUnitFile(o) {
     const outlookEnv = o.outlookClientId
         ? `\nEnvironment=OUTLOOK_CLIENT_ID=${o.outlookClientId}\nEnvironment=OUTLOOK_TENANT_ID=common`
         : "";
-    // Task 1761 — same contract for the Google vendor app. The client id and the
-    // install's public base land together: a client id without a redirect origin
-    // produces a consent URL Google rejects, so a half-stamp is worse than none.
-    const googleEnv = o.googleClientId && o.googlePublicBase
-        ? `\nEnvironment=GOOGLE_CLIENT_ID=${o.googleClientId}\nEnvironment=GOOGLE_PUBLIC_BASE=${o.googlePublicBase}`
+    // Task 1791 — id and secret land together. A client id without its secret
+    // produces a consent URL the user can complete but an exchange that cannot,
+    // which fails later and less legibly than not offering the flow at all.
+    const googleEnv = o.googleClientId && o.googleClientSecret
+        ? `\nEnvironment=GOOGLE_CLIENT_ID=${o.googleClientId}\nEnvironment=GOOGLE_CLIENT_SECRET=${o.googleClientSecret}`
         : "";
     return `[Unit]
 Description=${o.productName} Claude Session Manager

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.472",
+  "version": "0.1.474",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/config/brand.json

@@ -16,6 +16,7 @@
   "claudeSessionManagerPort": 19400,
   "outlookClientId": "",
   "googleClientId": "",
+  "googleClientSecret": "",
   "commercialMode": false,
   "vertical": "schema-knowledge-work",
   "shipsPremiumBundles": ["venture-studio", "writer-craft", "teaching", "management-consulting"],

package/payload/platform/docs/superpowers/plans/2026-07-18-ledger-write-path-fix.md

@@ -0,0 +1,109 @@
+# Ledger write path fix — implementation plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax.
+
+**Goal:** Every ledger write tool successfully creates its node, because relationships carry the element id `writeNodeWithEdges` actually requires.
+
+**Architecture:** Delete the ledger's invented `GraphRelationship` and the cast that forced it past the type checker; import the real type so the shape becomes a compile-time constraint. Resolve each relationship target to an element id before writing. Add a census counter so a dead write path can no longer read as a healthy empty ledger.
+
+**Spec:** [`.tasks/1788-...md`](../../../../.tasks/1788-ledger-write-tools-pass-an-invented-relationship-shape-so-every-write-is-rejected.md). No separate design doc; the task carries the decisions.
+
+## Global constraints
+
+- Node 22. Never `npm install` in this worktree; deps are symlinked from the parent.
+- Build and test from `maxy-code/platform`.
+- The four write tools must not be tested with a stubbed `write`. That stub is why the bug shipped.
+- Do not touch `lib/ledger-core`'s arithmetic (money, balance, ageing) — only `reconcile.ts` gains a counter.
+- Baseline before changes: 56 ledger tests, 508 memory-plugin tests.
+
+---
+
+### Task 1: Make the wrong shape a compile error
+
+**Files:** `plugins/ledger/mcp/src/lib/types.ts`, `plugins/ledger/mcp/src/index.ts`
+
+**Produces:** the real `GraphRelationship { type, direction, targetNodeId }` in scope for every tool.
+
+- [ ] **Step 1: Prove the current code is wrong at the type level.** In `types.ts`, delete the local `GraphRelationship` and re-export the real one:
+
+```ts
+export type { GraphRelationship } from "../../../../../lib/graph-write/dist/index.js";
+```
+
+- [ ] **Step 2: Delete the cast in `index.ts`.** Replace the `writeNodeWithEdges as unknown as (...)` wrapper with a direct reference. Run `tsc -p plugins/ledger/mcp/tsconfig.json` and record every error. Expect failures in `invoice-record.ts`, `payment-record.ts`, `cash-record.ts` on `targetLabel`/`targetProps`. **Those errors are the bug** — they are what the cast was hiding.
+
+- [ ] **Step 3: Fix the attribution while here.** `createdBy` becomes `{ agent: agentSlug, session: sessionId, tool, source: "ledger" }` with no `?? ""`, so `graph-write:254`'s `agent ?? source ?? "unknown"` chain can work.
+
+- [ ] **Step 4: Commit** once the remaining errors are only the three tool files.
+
+---
+
+### Task 2: Resolve targets to element ids
+
+**Files:** `plugins/ledger/mcp/src/lib/read.ts`, `tools/{invoice-record,payment-record,cash-record}.ts`, `index.ts`, `PLUGIN.md`
+
+**Consumes:** the real type from Task 1.
+
+- [ ] **Step 1: `readInvoice` returns the node's id.** Add `nodeId: string` to `InvoiceRead`; add `elementId(i) AS nodeId` to the Cypher and map it.
+
+- [ ] **Step 2: Write the failing tests first.** For each of the three tools, assert the relationship carries a `targetNodeId` equal to the id supplied or resolved, and that no relationship carries `targetLabel`:
+
+```ts
+it('targets the counterparty by element id', async () => {
+  const write = okWrite()
+  await invoiceRecord({ ...base, counterpartyNodeId: '4:abc:12', session: {} as never, write })
+  const rel = write.mock.calls[0]![0].relationships[0]
+  expect(rel.targetNodeId).toBe('4:abc:12')
+  expect(rel).not.toHaveProperty('targetLabel')
+})
+```
+
+- [ ] **Step 3: Implement.** `invoice-record` and `cash-record` take a required `counterpartyNodeId`. `payment-record` and `credit-record` use `invoice.nodeId` from the read. Each `zod` schema gains the field with a description telling the agent to look the organisation up first.
+
+- [ ] **Step 4: Reject a blank id** before writing, with `op=reject reason=missing-counterparty`, so the failure names the cause rather than surfacing as `unresolved-target`.
+
+- [ ] **Step 5: `tsc` clean, ledger tests green, commit.**
+
+---
+
+### Task 3: The test that would have caught it
+
+**Files:** `plugins/ledger/mcp/src/tools/__tests__/write-contract.test.ts` (new)
+
+One integration test per write tool that calls the **real** `writeNodeWithEdges` against a fake `Session` (`run` + `close`), asserting the issued Cypher carries the resolved target id and that no `unresolved-target` rejection occurs.
+
+- [ ] **Step 1: Write it against the current code and watch it fail** if Tasks 1 and 2 were somehow incomplete.
+- [ ] **Step 2: Confirm it passes.**
+- [ ] **Step 3: Prove it is load-bearing.** Temporarily reintroduce `targetLabel` in one tool; the build must fail. Revert.
+- [ ] **Step 4: Commit.**
+
+---
+
+### Task 4: Make a dead write path visible
+
+**Files:** `lib/ledger-core/src/reconcile.ts`, `plugins/ledger/mcp/src/lib/read.ts`, `tools/reconcile.ts`, `ui/app/lib/ledger-census.ts`, tests
+
+`[ledger-census]` currently prints `invoices=0 payments=0` identically whether the ledger is healthy-and-empty or wholly broken. That is why this bug ran all day unseen.
+
+- [ ] **Step 1: Failing test.** `reconcileLedger` alarms when `writeRejects24h > 0`.
+- [ ] **Step 2: Implement.** Add `writeRejects24h` to `LedgerCensusRows`, `LedgerCensusFinding`, the alarm condition, and `formatCensusLine`.
+- [ ] **Step 3: Source the count.** Both the census and the reconcile tool count `[graph-write] reject` lines in `<LOG_DIR>/mcp-ledger-*.log` with a timestamp inside the trailing 24 hours.
+- [ ] **Step 4: Tests green, commit.**
+
+---
+
+### Task 5: Docs
+
+**Files:** `plugins/ledger/PLUGIN.md`, `plugins/docs/references/ledger.md`
+
+State that the counterparty must be looked up first and passed by id, that the ledger never creates organisations, and what `writeRejects24h` means. Keep the shipped reference free of em-dashes.
+
+- [ ] Commit.
+
+---
+
+## Self-review
+
+**Spec coverage.** Type import and cast removal: Task 1. Attribution: Task 1 step 3. Element-id resolution for all four write tools: Task 2. The banned-stub integration test: Task 3. Census counter: Task 4. Docs: Task 5. Out-of-scope items (duplicate-org matching, `:InvoiceLine`, read tools, ledger-core arithmetic) are untouched.
+
+**Risk.** Task 2 changes the tool signatures, so any agent prompt or skill that calls `ledger-invoice-record` with a bare counterparty name breaks. Nothing calls these tools yet except live agent turns, and they have never succeeded, so there is no working caller to regress.

package/payload/platform/lib/ledger-core/dist/reconcile.d.ts

@@ -31,6 +31,12 @@ export interface LedgerCensusRows {
     storedBalanceProps: number;
     paymentKeys: readonly PaymentKey[];
     declaredNotLive: readonly string[];
+    /** Count of `[graph-write] reject` lines from the ledger's MCP logs in the
+     *  trailing 24 hours. Without it the census cannot tell a healthy empty
+     *  ledger from one whose write path is wholly dead: both print
+     *  `invoices=0 payments=0`. Task 1788, after exactly that went unseen for a
+     *  day. */
+    writeRejects24h: number;
 }
 export interface LedgerCensusFinding {
     invoices: number;
@@ -39,6 +45,7 @@ export interface LedgerCensusFinding {
     storedBalanceProps: number;
     suspectDuplicates: number;
     declaredNotLive: readonly string[];
+    writeRejects24h: number;
     alarm: boolean;
 }
 export declare function reconcileLedger(rows: LedgerCensusRows, _now: number): LedgerCensusFinding;

package/payload/platform/lib/ledger-core/dist/reconcile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reconcile.d.ts","sourceRoot":"","sources":["../src/reconcile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;;;;mEAImE;AACnE,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAO/C,CAAA;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,cAAc,EAAE,MAAM,CAAA;IACtB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,WAAW,EAAE,SAAS,UAAU,EAAE,CAAA;IAClC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAA;CACnC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,cAAc,EAAE,MAAM,CAAA;IACtB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,iBAAiB,EAAE,MAAM,CAAA;IACzB,eAAe,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,KAAK,EAAE,OAAO,CAAA;CACf;AAwBD,wBAAgB,eAAe,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,GAAG,mBAAmB,CAiBzF;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,mBAAmB,GAAG,MAAM,CAO/D"}
+{"version":3,"file":"reconcile.d.ts","sourceRoot":"","sources":["../src/reconcile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;;;;mEAImE;AACnE,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAO/C,CAAA;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,cAAc,EAAE,MAAM,CAAA;IACtB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,WAAW,EAAE,SAAS,UAAU,EAAE,CAAA;IAClC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC;;;;eAIW;IACX,eAAe,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,cAAc,EAAE,MAAM,CAAA;IACtB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,iBAAiB,EAAE,MAAM,CAAA;IACzB,eAAe,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,eAAe,EAAE,MAAM,CAAA;IACvB,KAAK,EAAE,OAAO,CAAA;CACf;AAwBD,wBAAgB,eAAe,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,GAAG,mBAAmB,CAmBzF;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,mBAAmB,GAAG,MAAM,CAQ/D"}

package/payload/platform/lib/ledger-core/dist/reconcile.js

@@ -52,7 +52,8 @@ export function reconcileLedger(rows, _now) {
     const alarm = rows.orphanPayments > 0 ||
         rows.storedBalanceProps > 0 ||
         suspectDuplicates > 0 ||
-        rows.declaredNotLive.length > 0;
+        rows.declaredNotLive.length > 0 ||
+        rows.writeRejects24h > 0;
     return {
         invoices: rows.invoices,
         payments: rows.payments,
@@ -60,6 +61,7 @@ export function reconcileLedger(rows, _now) {
         storedBalanceProps: rows.storedBalanceProps,
         suspectDuplicates,
         declaredNotLive: rows.declaredNotLive,
+        writeRejects24h: rows.writeRejects24h,
         alarm,
     };
 }
@@ -72,6 +74,7 @@ export function formatCensusLine(f) {
     return (`[ledger-census] invoices=${f.invoices} payments=${f.payments} ` +
         `orphanPayments=${f.orphanPayments} storedBalanceProps=${f.storedBalanceProps} ` +
         `suspectDuplicates=${f.suspectDuplicates} ` +
-        `declaredNotLive=${f.declaredNotLive.length === 0 ? "none" : f.declaredNotLive.join(",")}`);
+        `declaredNotLive=${f.declaredNotLive.length === 0 ? "none" : f.declaredNotLive.join(",")} ` +
+        `writeRejects24h=${f.writeRejects24h}`);
 }
 //# sourceMappingURL=reconcile.js.map

package/payload/platform/lib/ledger-core/dist/reconcile.js.map

@@ -1 +1 @@
-{"version":3,"file":"reconcile.js","sourceRoot":"","sources":["../src/reconcile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;;;;mEAImE;AACnE,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,qCAAqC;IACrC,mCAAmC;IACnC,oBAAoB;IACpB,sBAAsB;IACtB,yBAAyB;IACzB,gBAAgB;CACjB,CAAA;AA4BD;;;;;;;;GAQG;AACH,SAAS,sBAAsB,CAAC,IAA2B;IACzD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAA;IAC7C,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,SAAS,GAAG,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,CAAA;QACxD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,GAAG,EAAU,CAAA;QACtD,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QACpB,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;IAC5B,CAAC;IACD,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE;QAAE,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAA;IACrE,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAsB,EAAE,IAAY;IAClE,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IAClE,MAAM,KAAK,GACT,IAAI,CAAC,cAAc,GAAG,CAAC;QACvB,IAAI,CAAC,kBAAkB,GAAG,CAAC;QAC3B,iBAAiB,GAAG,CAAC;QACrB,IAAI,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAA;IAEjC,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,iBAAiB;QACjB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,KAAK;KACN,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,CAAsB;IACrD,OAAO,CACL,4BAA4B,CAAC,CAAC,QAAQ,aAAa,CAAC,CAAC,QAAQ,GAAG;QAChE,kBAAkB,CAAC,CAAC,cAAc,uBAAuB,CAAC,CAAC,kBAAkB,GAAG;QAChF,qBAAqB,CAAC,CAAC,iBAAiB,GAAG;QAC3C,mBAAmB,CAAC,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAC3F,CAAA;AACH,CAAC"}
+{"version":3,"file":"reconcile.js","sourceRoot":"","sources":["../src/reconcile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;;;;mEAImE;AACnE,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,qCAAqC;IACrC,mCAAmC;IACnC,oBAAoB;IACpB,sBAAsB;IACtB,yBAAyB;IACzB,gBAAgB;CACjB,CAAA;AAmCD;;;;;;;;GAQG;AACH,SAAS,sBAAsB,CAAC,IAA2B;IACzD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAA;IAC7C,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,SAAS,GAAG,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,CAAA;QACxD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,GAAG,EAAU,CAAA;QACtD,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QACpB,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;IAC5B,CAAC;IACD,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE;QAAE,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAA;IACrE,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAsB,EAAE,IAAY;IAClE,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IAClE,MAAM,KAAK,GACT,IAAI,CAAC,cAAc,GAAG,CAAC;QACvB,IAAI,CAAC,kBAAkB,GAAG,CAAC;QAC3B,iBAAiB,GAAG,CAAC;QACrB,IAAI,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC;QAC/B,IAAI,CAAC,eAAe,GAAG,CAAC,CAAA;IAE1B,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,iBAAiB;QACjB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,KAAK;KACN,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,CAAsB;IACrD,OAAO,CACL,4BAA4B,CAAC,CAAC,QAAQ,aAAa,CAAC,CAAC,QAAQ,GAAG;QAChE,kBAAkB,CAAC,CAAC,cAAc,uBAAuB,CAAC,CAAC,kBAAkB,GAAG;QAChF,qBAAqB,CAAC,CAAC,iBAAiB,GAAG;QAC3C,mBAAmB,CAAC,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG;QAC3F,mBAAmB,CAAC,CAAC,eAAe,EAAE,CACvC,CAAA;AACH,CAAC"}

package/payload/platform/lib/ledger-core/src/__tests__/reconcile.test.ts

@@ -8,6 +8,7 @@ const clean = {
   storedBalanceProps: 0,
   paymentKeys: [],
   declaredNotLive: [],
+  writeRejects24h: 0,
 }
 const NOW = Date.parse('2026-07-18T00:00:00Z')
 
@@ -84,4 +85,23 @@ describe('reconcileLedger', () => {
     expect(LEDGER_INDEX_NAMES).toHaveLength(6)
     expect(LEDGER_INDEX_NAMES).toContain('cash_entry_account_entryid_unique')
   })
+
+  it('alarms when the write path is rejecting', () => {
+    // The case this counter exists for: on 2026-07-18 every ledger write was
+    // rejected all day while the census printed invoices=0 payments=0, which
+    // is byte-identical to a healthy ledger nobody has used yet.
+    const f = reconcileLedger({ ...clean, writeRejects24h: 4 }, NOW)
+    expect(f.alarm).toBe(true)
+    expect(formatCensusLine(f)).toContain('writeRejects24h=4')
+  })
+
+  it('a healthy empty ledger is distinguishable from a broken one', () => {
+    const empty = { ...clean, invoices: 0, payments: 0 }
+    const broken = { ...empty, writeRejects24h: 4 }
+    expect(formatCensusLine(reconcileLedger(empty, NOW))).not.toEqual(
+      formatCensusLine(reconcileLedger(broken, NOW)),
+    )
+    expect(reconcileLedger(empty, NOW).alarm).toBe(false)
+    expect(reconcileLedger(broken, NOW).alarm).toBe(true)
+  })
 })

package/payload/platform/lib/ledger-core/src/reconcile.ts

@@ -41,6 +41,12 @@ export interface LedgerCensusRows {
   storedBalanceProps: number
   paymentKeys: readonly PaymentKey[]
   declaredNotLive: readonly string[]
+  /** Count of `[graph-write] reject` lines from the ledger's MCP logs in the
+   *  trailing 24 hours. Without it the census cannot tell a healthy empty
+   *  ledger from one whose write path is wholly dead: both print
+   *  `invoices=0 payments=0`. Task 1788, after exactly that went unseen for a
+   *  day. */
+  writeRejects24h: number
 }
 
 export interface LedgerCensusFinding {
@@ -50,6 +56,7 @@ export interface LedgerCensusFinding {
   storedBalanceProps: number
   suspectDuplicates: number
   declaredNotLive: readonly string[]
+  writeRejects24h: number
   alarm: boolean
 }
 
@@ -81,7 +88,8 @@ export function reconcileLedger(rows: LedgerCensusRows, _now: number): LedgerCen
     rows.orphanPayments > 0 ||
     rows.storedBalanceProps > 0 ||
     suspectDuplicates > 0 ||
-    rows.declaredNotLive.length > 0
+    rows.declaredNotLive.length > 0 ||
+    rows.writeRejects24h > 0
 
   return {
     invoices: rows.invoices,
@@ -90,6 +98,7 @@ export function reconcileLedger(rows: LedgerCensusRows, _now: number): LedgerCen
     storedBalanceProps: rows.storedBalanceProps,
     suspectDuplicates,
     declaredNotLive: rows.declaredNotLive,
+    writeRejects24h: rows.writeRejects24h,
     alarm,
   }
 }
@@ -104,6 +113,7 @@ export function formatCensusLine(f: LedgerCensusFinding): string {
     `[ledger-census] invoices=${f.invoices} payments=${f.payments} ` +
     `orphanPayments=${f.orphanPayments} storedBalanceProps=${f.storedBalanceProps} ` +
     `suspectDuplicates=${f.suspectDuplicates} ` +
-    `declaredNotLive=${f.declaredNotLive.length === 0 ? "none" : f.declaredNotLive.join(",")}`
+    `declaredNotLive=${f.declaredNotLive.length === 0 ? "none" : f.declaredNotLive.join(",")} ` +
+    `writeRejects24h=${f.writeRejects24h}`
   )
 }

package/payload/platform/neo4j/schema.cypher

@@ -1655,7 +1655,10 @@ FOR (cr:Credit) ON (cr.accountId);
 // ----------------------------------------------------------
 // :VoiceProfile holds the distilled style card for one (AdminUser, format).
 // Task 462: one profile per (accountId, userId, format); format ∈
-// {text, email, social-post, article, marketing-copy, note}.
+// {formal, informal, text, email, social-post, article, marketing-copy, note}.
+// Task 1795 added the broad `formal`/`informal` buckets. No constraint or
+// index change was needed — they resolve through the same `n.format =
+// $format` equality, and the uniqueness constraint already admits them.
 // The old (accountId, adminUserId) unique constraint is dropped and replaced.
 //
 // :VoiceEdit captures operator edits on agent drafts as feedback,

package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: platform-architecture
 description: Use when grounding any documented-surface claim about what Maxy ships — plugins, skills, specialists, install/deploy flows, internals. This is the install catalogue, not evidence of what is enabled on the current account. For install state on this account, call `capabilities-here`; for documented surface, cite the `Source:` URL inline.
-content-hash: sha256:46e07a18921b711849e53f63b8c29b72f3324f91bc682eb5be585ccd64c98971
+content-hash: sha256:87a32054a533d5a60538763ef209f3b3e9d64d70f677d91507dbada9d1006609
 brand: maxy-code
 product-name: Maxy
 ---
@@ -636,6 +636,12 @@ If you need statutory accounts, this is not that. It is the answer to "who owes
 
 **Ask for a statement.** Everything owed to you and everything you owe, sorted into 0-30, 31-60, 61-90 and 90+ days overdue, plus net cash.
 
+## You look the customer up first
+
+When you record an invoice or a cash movement, the agent finds the company or person in your records first, then attaches the money to that exact record. It will not create a new company for you, and the name that appears on the invoice is taken from the record it attached to, so the two can never disagree.
+
+That is on purpose. Deciding whether "Beagle Direct Ltd" is the same firm as an existing "Beagle Direct" is a judgement about your records, not a bookkeeping step, and getting it wrong quietly splits one customer's payment history across two entries.
+
 ## Three behaviours worth knowing about
 
 **What is outstanding is never stored.** It is worked out from the payments each time you ask. This means the figure cannot fall out of step with the payments behind it. If it were stored, a payment recorded by any route that forgot to update it would leave the invoice quietly reporting a wrong number, and nothing would fail.
@@ -648,7 +654,9 @@ If you need statutory accounts, this is not that. It is the answer to "who owes
 
 Some ways this can go wrong announce themselves. Others do not: a payment that ends up attached to no invoice, a stale balance field reappearing, or the same payment recorded twice under two different ids. None of those produce an error at the time, because nothing goes wrong at the moment they happen.
 
-So there is a check that runs by itself every fifteen minutes and writes one line to the log beginning `[ledger-census]`. When it is healthy the counters are all zero. When something is wrong the line ends with `alarm=true` and says which of the four it found.
+So there is a check that runs by itself every fifteen minutes and writes one line to the log beginning `[ledger-census]`. When it is healthy the counters are all zero. When something is wrong the line ends with `alarm=true` and says which of them it found.
+
+One of those counters is the number of writes that were refused in the last day. It is there because of a real failure: for a whole day every attempt to record money was refused, and the check still read as healthy, because a ledger nobody has used and a ledger that cannot be written to both show nothing.
 
 You can also ask for that check on demand at any time, and it reports the same thing in plain words.
 
@@ -2207,7 +2215,7 @@ Source: https://docs.getmaxy.com/google-guide.md
 # Google Calendar
 
 Live Google Calendar for one account: read the user's real events, and create,
-update, cancel, respond to and check availability against them. Eleven tools,
+update, cancel, respond to and check availability against them. Twelve tools,
 admin agent only.
 
 There is deliberately no Gmail surface here. Mail runs on the `email` plugin's
@@ -2218,9 +2226,16 @@ force Google's annual third-party security assessment. Calendar is only a
 ## Connecting an account
 
 `google-account-register` returns a consent URL. Relay it to the user: they open
-it on any device, sign in, and approve. Google redirects to this install's
-public host at `/api/google/oauth/callback`, which exchanges the code and stores
-encrypted tokens. `google-account-register-poll` then reports the outcome.
+it on any device, sign in, and approve.
+
+Their browser then lands on a page that **fails to load**. That is expected, not
+a fault — the vendor app is a Desktop client, so Google redirects to a loopback
+address on the user's own device where nothing is listening. The address bar
+carries the code. Ask them to copy it and pass it to
+`google-account-register-submit`, which completes the connection.
+
+If they paste the whole `code=...` fragment, or a value containing `%2F`, the
+tool handles it. `google-account-register-poll` reports the outcome at any point.
 
 The register tool does not block and does not wait. A second register while one
 is already live is refused rather than overwriting it; that refusal names how
@@ -2256,9 +2271,12 @@ granted.
 
 ## When something is wrong
 
-**"GOOGLE_CLIENT_ID is not configured"** — this brand has no Google vendor app
-yet. Nothing the operator does on the device fixes it; the brand needs its own
-Google Cloud OAuth client. See `platform/plugins/google/references/auth.md`.
+**"GOOGLE_CLIENT_ID is not configured"**, or the same for
+`GOOGLE_CLIENT_SECRET` — this brand has no Google vendor app yet. Nothing the
+operator does on the device fixes it, and no file placed on the device fixes it
+either: the id and secret ship in the brand's `brand.json` and reach the device
+through an installer publish. The brand needs its own Google Cloud Desktop OAuth
+client. See `platform/plugins/google/references/auth.md`.
 
 **A 403 naming insufficient scope** — the connected account approved something
 narrower than the full calendar scope. Re-run `google-account-register` so they
@@ -2270,8 +2288,9 @@ Testing, where Google caps refresh tokens at seven days and limits the app to
 property of the vendor app, not a fault in the connection.
 
 **A registration never completes** — the consent URL was opened but not
-approved, or the callback could not be reached. `google-account-register-poll`
-reports `expired` once the pending entry outlives Google's code lifetime.
+approved, or the code was never copied back to
+`google-account-register-submit`. `google-account-register-poll` reports
+`expired` once the pending entry outlives Google's code lifetime.
 
 ---
 # QuickBooks Online
@@ -2802,7 +2821,7 @@ In the admin chat, ask: **"Start the voice-mirror backfill."**
 Maxy asks which stream to backfill first — discrete documents (emails, posts, PDFs) or chat archives (WhatsApp, Telegram, etc.). **Pick chat archives first if you have any imported.** Chat is where your unguarded voice lives; email is the same voice in dress clothes.
 
 - **Chat archives** — tag a whole conversation in one click. Maxy doesn't ask about individual messages because chunks within a conversation almost always share the same voice. Options per conversation: yours, mixed (multiple authors on your side — rare), or not yours (e.g. a Slack channel where you only forwarded other people's messages).
-- **Documents and posts** — paginated 10 at a time. Maxy shows each item with its detected format (email, article, note, social-post). Tag the whole batch, a subset by number, or per-item if you want a precise label like `human-led-agent-assisted` (you wrote the content, Maxy polished). Override the detected format if one is wrong.
+- **Documents and posts** — paginated 10 at a time. Maxy shows each item with its source, date, recipient or topic, and a one-line preview. You name the format on every command — Maxy never guesses it. Reach for the broad buckets, `formal` or `informal`, unless a narrower one (`email`, `article`, `note`, `social-post`, `marketing-copy`, `text`) genuinely fits. Tag the whole batch, a subset by number, or per-item if you want a precise label like `human-led-agent-assisted` (you wrote the content, Maxy polished).
 
 Skip a batch if none qualify, or stop at any time — the next session resumes where you left off.
 
@@ -2842,7 +2861,7 @@ Voice mirror is on by default for every drafting skill. To opt out for one, set
 
 ## Status
 
-Voice mirror is live end-to-end. Six corpus formats (text, email, social-post, article, note, marketing-copy), five tools (`voice-tag-content`, `voice-distil-profile`, `voice-retrieve-conditioning`, `voice-record-feedback`, `voice-ingest-session-text`), on-demand session-turn capture, and wiring into the three live drafting surfaces (email composition, property brochures, investor data room) are all live. When no voice profile exists on the account for a given format, every drafting skill degrades gracefully — the output matches what it was before voice mirror was installed.
+Voice mirror is live end-to-end. Eight corpus formats (the broad buckets `formal` and `informal`, plus the narrower `text`, `email`, `social-post`, `article`, `note`, `marketing-copy`), five tools (`voice-tag-content`, `voice-distil-profile`, `voice-retrieve-conditioning`, `voice-record-feedback`, `voice-ingest-session-text`), on-demand session-turn capture, and wiring into the three live drafting surfaces (email composition, property brochures, investor data room) are all live. When no voice profile exists on the account for a given format, every drafting skill degrades gracefully — the output matches what it was before voice mirror was installed.
 
 ---
 # Admin UI Reference
@@ -2906,7 +2925,7 @@ either is a regression.
 |---|---|---|
 | `/session` | Admin cookie session: PIN-gated mint, validate, rotate. | `GET /`, `POST /` |
 | `/sessions` | Legacy admin-server conversation routes. No UI consumer remains after the ConversationsModal was retired; the surviving handlers are deletion candidates and not described here. | (legacy, no live caller) |
-| `/sidebar-sessions` | Sole data path for the sidebar Sessions list. One JSONL on disk equals one row. The row's delete button is the only way a row disappears. Each row carries `sessionId`, `title`, `startedAt`, `live`, `isSubagent`, `pid: number \| null` (basename of the matched `sessions/<pid>.json`), and `projectDir` (the directory holding the JSONL — consumed by the delete route). The payload also carries top-level `accountId` so the pane renders the full UUID label whose first ~8 chars prefix-match the truncated Remote Control daemon entry in claude.ai/code. The legacy `rcUrl` field is gone — the row's external-link affordance now POSTs `/session-rc-spawn` to start a fresh local `claude --remote-control <name> --session-id <sid>` PTY on every click. **WhatsApp and Telegram sessions (admin + public) appear in this list**, colour-coded by channel (WhatsApp green `#25D366`, Telegram blue `#229ED9`, via a `conv-channel-*` left accent bar) and carrying the standard row kebab (Usage & cost, Reset/re-seat, Rename, Archive, Delete) so the operator can inspect and re-seat a channel session's params. Each row's `channel` is the authoritative `.meta.json` sidecar value (`whatsapp`/`telegram`/`webchat`/`browser`/null), not the JSONL-envelope channel. Each row also carries its sidecar `senderId`. For a WhatsApp/Telegram row with a `senderId` and no operator rename or ai-title (`titleSource:'prefix'`), the route resolves a contact `personName` and the sidebar renders the reader panel's `"<name>  <number>"` label via the shared `operatorConvName`, degrading to the number alone then the stripped title on a miss, so a Sessions row and that conversation's reader-panel row read identically. The name comes from the shared `resolveOperatorNamesBySender` helper the WhatsApp reader also calls, so the two surfaces cannot drift; a renamed or ai-titled channel row keeps its own title. The only role/channel excluded from the list is `public`+`webchat` (its dedicated reader is the sole surface); the exclusion predicate is `isSessionListExcluded`, decoupled from the reader's inclusion predicate `isReaderChannelSession` (unchanged), so the WhatsApp/Telegram reader panels are unaffected — a store-only WhatsApp conversation with no session JSONL stays reader-only. Observability rides `[admin-sessions-list] … channelInList=whatsapp:<n>,telegram:<n>,webchat:<n> channelNameCandidates=<n> channelNamesResolved=<n> unknownChannel=<n> excludedPublicWebchat=<n>`, and each unresolved channel name logs one `[admin-sessions-list] op=channel-name-unresolved sessionId=<id8> channel=<whatsapp\|telegram> senderId=<id> reason=<no-senderId\|classify-miss\|neo4j-down>` line so a persistent `channelNamesResolved` shortfall is never silent. | `GET /` |
+| `/sidebar-sessions` | Sole data path for the sidebar Sessions list. One JSONL on disk equals one row. The row's delete button is the only way a row disappears. Each row carries `sessionId`, `title`, `startedAt`, `live`, `isSubagent`, `pid: number \| null` (basename of the matched `sessions/<pid>.json`), and `projectDir` (the directory holding the JSONL — consumed by the delete route). The payload also carries top-level `accountId` so the pane renders the full UUID label whose first ~8 chars prefix-match the truncated Remote Control daemon entry in claude.ai/code. The legacy `rcUrl` field is gone — the row's external-link affordance now POSTs `/session-rc-spawn` to start a fresh local `claude --remote-control <name> --session-id <sid>` PTY on every click. **WhatsApp and Telegram sessions (admin + public) appear in this list**, colour-coded by channel (WhatsApp green `#25D366`, Telegram blue `#229ED9`, via a `conv-channel-*` left accent bar) and carrying the standard row kebab (Usage & cost, Reset/re-seat, Rename, Archive, Delete) so the operator can inspect and re-seat a channel session's params. Each row's `channel` is the authoritative `.meta.json` sidecar value (`whatsapp`/`telegram`/`webchat`/`browser`/null), not the JSONL-envelope channel. Each row also carries its sidecar `senderId`. For a WhatsApp/Telegram row with a `senderId` and no operator rename or ai-title (`titleSource:'prefix'`), the route resolves a contact `personName` and the sidebar renders the reader panel's `"<name>  <number>"` label via the shared `operatorConvName`, degrading to the number alone then the stripped title on a miss, so a Sessions row and that conversation's reader-panel row read identically. A channel row name has two sources, in precedence order. First the shared `resolveOperatorNamesBySender` helper the WhatsApp reader also calls, which matches the sender phone against the account's admins — that names an admin WhatsApp session and every Telegram session. Second, for a `whatsapp` row only, the WhatsApp pushName from the account's on-disk message store (`storePushNamesBySender` over `readConversationSummaries`, keyed by `normalizeE164` of the counterparty phone so a `+44 7…` sender matches a `447…` store key). The store is consulted only when the resolver reports **no binding** for that sender. That is typically a public WhatsApp customer, the case this exists for — such a sender has no admin record and so can only be named by the store, and without it those rows degraded to the bare number while the reader panel named them — though an admin missing from `users.json` qualifies too. A resolver miss caused by Neo4j being unreachable deliberately does NOT qualify: that is an outage rather than an absent binding, so the row degrades to the number and still logs `reason=neo4j-down`, keeping the outage signal intact. Telegram has no message store and is never looked up. The store read is guarded: a corrupt or absent store degrades to no pushName and logs `op=store-unreadable`, never 500s the list. Both sources are the ones the reader itself uses, so the two surfaces cannot drift; a renamed or ai-titled channel row keeps its own title. The Sessions list reads the viewed account's own store only. An account-manager's thread persists under the house account rather than the sub-account it manages, so on a multi-account install viewing a sub-account that row is not named here even though the reader panel names it — the reader additionally consults the house store, filtered to manager phones bound to that sub. The only role/channel excluded from the list is `public`+`webchat` (its dedicated reader is the sole surface); the exclusion predicate is `isSessionListExcluded`, decoupled from the reader's inclusion predicate `isReaderChannelSession` (unchanged), so the WhatsApp/Telegram reader panels are unaffected — a store-only WhatsApp conversation with no session JSONL stays reader-only. Observability rides `[admin-sessions-list] … channelInList=whatsapp:<n>,telegram:<n>,webchat:<n> channelNameCandidates=<n> channelNamesResolved=<n> (operator=<n> store=<n>) unknownChannel=<n> excludedPublicWebchat=<n>`, and each unresolved channel name logs one `[admin-sessions-list] op=channel-name-unresolved sessionId=<id8> channel=<whatsapp\|telegram> senderId=<id> reason=<no-senderId\|classify-miss\|neo4j-down>` line — emitted only when **both** sources miss, so a residual shortfall means a genuinely nameless sender rather than the expected public-customer floor, and the `operator=`/`store=` split says which source is carrying the names. | `GET /` |
 | `/session-delete` | POST `{ sessionId }`. Thin proxy over the manager: POST `/:id/stop` (idempotent) then DELETE `/:id`. Sends **no** accountId. The manager resolves the session by scanning every slug under `projects/` for its JSONL (`slugForExistingJsonl`, covering `archive/`), exactly as the sidebar list enumerates rows, and gates on file existence alone — so any session the operator can see is deletable. This replaces the earlier accountId-derived slug and the `!row` term, which narrowed resolution below the list and left a session under a non-house slug with no watcher row (e.g. a legacy `-home-admin` session on a single-account install) listed yet un-deletable. Account scope is a view filter, not a delete gate — admin access is install-wide, so there is nothing to scope against. The sibling `/session-stop` (the standalone End control) resolves identically and also forwards no accountId. | `POST /` |
 | `/session-rc-spawn` | POST `{ sessionId?, name? }`. Fire-and-forget `claude --remote-control [name] [--session-id <sid>]`. Present `sessionId` resumes; absent starts a fresh session (also used by the sidebar's "New session" button — it no longer opens claude.ai/code directly). Proxies to the manager's `/rc-spawn`, which waits up to **60 s** (raised from 12 s) for the spawned PTY to bind and returns `{ spawnedPid, sessionId, bridgeSessionId, slug, outcome, reason }`. For a webchat-bound spawn (every admin-gated host's "New session", returning a same-origin `/chat?session=<id>` target — `resolveRcSpawnOutcome` → `sameOrigin:true`) the Sidebar navigates the **current** tab via `window.location.assign`, replacing the dashboard in place (back returns to it); only a claude.ai/code slug (`sameOrigin:false`, the bare-admin resume bridge, never a new-session outcome) navigates a separately-opened tab. On `timeout` or `spawn-failed` it shows an error modal (reason + sessionId) and **never** opens a bare claude.ai/code tab. The new process registers itself as its own Remote Control entry in claude.ai/code. | `POST /` |
 | `/claude-sessions` | **Spawn surface only**. `POST /` is the Sidebar new-session-with-prompt path, cookie-auth only (the recorder loopback caller was removed; LinkedIn ingest moved to `/rc-spawn`). The former UI-facing handlers (SSE row feed, list, resume, stop, rename, archive, delete, `/:id/meta`, `/:id/input`, `/:id/log`) were removed — the maxy dashboard no longer manages or displays sessions. | `POST /` |
@@ -4891,6 +4910,10 @@ To deliberately disconnect the wrong account, use the header menu's **Disconnect
 3. `grep '\[auth-health\]' ~/.${brand}/logs/server.log | tail -n 5` — the heartbeat fires every five minutes. `status=dead expiresIn=...` means the refresh token is gone; only a re-login fixes it. `status=ok` heartbeats with no spawns in between mean the credentials file is healthy and the failure lives elsewhere.
 4. The spawn-failure surface now carries `reason=auth-refresh-failed` (with `authStatus` in the JSON body) instead of generic `pid-file-timeout` whenever the credentials file is in `dead` or `expired` state at the moment of failure — visible in `grep '\[spawn-failed\]'` on server.log.
 
+**A WhatsApp message you can see on your phone never appears in the app.** First check whether it was ever stored, rather than assuming it routed elsewhere: ask Maxy for the most recent ingest reconcile, or `grep '\[wa-ingest-audit\]' ~/.${brand}/logs/server.log | tail -1`. A healthy line reads `op=reconcile … unpersisted=0 inFlight=0 guard=installed`. If `unpersisted` is above zero, the `ids=` field names the exact message ids that arrived at the wire and were never written to the store — those messages are genuinely lost to the platform, not hidden in another workspace or sub-account, and they cannot be re-fetched because WhatsApp only delivers an acked message once. Forward the message from your phone to get it back in; it re-enters as a new message through the normal path.
+
+The audit runs every 15 minutes and holds a stanza for 10 minutes before judging it, so a message can take up to 25 minutes to be reported. The wait is deliberate: a large batch of photos arriving at once can take several minutes to finish storing, and a false "a message was lost" alarm would make the real one easy to ignore. Three classes are resolved rather than reported, each counted separately: `skippedStatus` (status broadcasts, never stored), `skippedReaction` (reactions, stored under the message they react to rather than under their own id — a consequence being that a lost *reaction* is not detectable), and `declined` (messages carrying neither text nor a file, such as a shared contact card, a poll, or a delete-for-everyone, which are dropped by design). `oldestUnpersistedMin` tells you whether a reported loss is new or one you have already seen, since the same id is re-reported every 15 minutes for a day. `guard=absent` or `inFlight` stuck above zero on an idle install are both faults worth surfacing to support: the first means the media-download crash guard failed to install at boot, the second means its counter leaked. `contained` counts crashes the guard prevented — a number that climbs while media traffic stays flat is also worth reporting.
+
 ---
 
 ## Memory Not Working