@rubytech/create-maxy-code 0.1.477 → 0.1.479

package/payload/server/server.js

@@ -117,7 +117,7 @@ import {
   vncLog,
   walkPremiumBundles,
   writeAdminUserAndPerson
-} from "./chunk-JECAP3Z2.js";
+} from "./chunk-XGNRSM57.js";
 import {
   D1_MAX_SQL_STATEMENT_BYTES,
   D1_QUERY_MAX_BODY_BYTES,
@@ -129,10 +129,11 @@ import {
   listResources,
   makeHouseCfExec,
   makeHousePagesExec,
+  reconcileDataPortal,
   registerResource,
   resolveOwner,
   tooLargeMessage
-} from "./chunk-56WJMBQQ.js";
+} from "./chunk-3XLLTG6R.js";
 import {
   __commonJS,
   __toESM
@@ -651,7 +652,17 @@ var require_dist3 = __commonJS({
       Risk: "#C15B57",
       Source: "#2F8FA6",
       Finding: "#4FA389",
-      Hypothesis: "#9A8C3E"
+      Hypothesis: "#9A8C3E",
+      // Ledger cash movement (schema-base.md, added by 7b225f814). One movement
+      // of money attached to no invoice — operator-entry with no parent to drill
+      // down from, so it is a top-level chip. Burnished olive-gold sits in the
+      // money register beside Invoice's brown without colliding with it.
+      //
+      // Deliberately appended at the END rather than beside the ledger family:
+      // SHAPE_BY_LABEL assigns shapes by index position in ALL_GRAPH_LABELS
+      // (this object's key order), so a mid-table insert would silently change
+      // the rendered shape of every label after it.
+      CashEntry: "#7D5A2B"
     };
     exports.FALLBACK_LABEL_COLOUR = "#94A3B8";
     exports.ALL_GRAPH_LABELS = Object.freeze(Object.keys(exports.GRAPH_LABEL_COLOURS));
@@ -748,7 +759,8 @@ var require_dist3 = __commonJS({
       Risk: '<path d="m21.73 18-8-14a2 2 0 0 0-3.48 0l-8 14A2 2 0 0 0 4 21h16a2 2 0 0 0 1.73-3"></path><path d="M12 9v4"></path><path d="M12 17h.01"></path>',
       Source: '<path d="M12 7v14"></path><path d="M3 18a1 1 0 0 1-1-1V4a1 1 0 0 1 1-1h5a4 4 0 0 1 4 4 4 4 0 0 1 4-4h5a1 1 0 0 1 1 1v13a1 1 0 0 1-1 1h-6a3 3 0 0 0-3 3 3 3 0 0 0-3-3z"></path>',
       Finding: '<path d="M15 14c.2-1 .7-1.7 1.5-2.5 1-.9 1.5-2.2 1.5-3.5A6 6 0 0 0 6 8c0 1 .2 2.2 1.5 3.5.7.7 1.3 1.5 1.5 2.5"></path><path d="M9 18h6"></path><path d="M10 22h4"></path>',
-      Hypothesis: '<path d="M14 2v6a2 2 0 0 0 .245.96l5.51 10.08A2 2 0 0 1 18 22H6a2 2 0 0 1-1.755-2.96l5.51-10.08A2 2 0 0 0 10 8V2"></path><path d="M6.453 15h11.094"></path><path d="M8.5 2h7"></path>'
+      Hypothesis: '<path d="M14 2v6a2 2 0 0 0 .245.96l5.51 10.08A2 2 0 0 1 18 22H6a2 2 0 0 1-1.755-2.96l5.51-10.08A2 2 0 0 0 10 8V2"></path><path d="M6.453 15h11.094"></path><path d="M8.5 2h7"></path>',
+      CashEntry: '<rect width="20" height="12" x="2" y="6" rx="2"></rect><circle cx="12" cy="12" r="2"></circle><path d="M6 12h.01"></path><path d="M18 12h.01"></path>'
     };
     function iconForLabel2(label) {
       return Object.prototype.hasOwnProperty.call(LABEL_ICONS, label) ? LABEL_ICONS[label] : null;
@@ -844,6 +856,11 @@ var require_dist3 = __commonJS({
         if (clientName.length > 0) {
           return clientName.length > 24 ? clientName.slice(0, 24) + "\u2026" : clientName;
         }
+      } else if (primaryLabel2 === "CashEntry") {
+        const desc = typeof props.description === "string" ? props.description : "";
+        if (desc.length > 0) {
+          return desc.length > 24 ? desc.slice(0, 24) + "\u2026" : desc;
+        }
       } else if (primaryLabel2 === "Message") {
         const role = typeof props.role === "string" ? props.role : "";
         const roleShort = role === "user" ? "user" : role === "assistant" ? "asst" : role === "system" ? "sys" : role === "tool" ? "tool" : null;
@@ -917,6 +934,10 @@ var require_dist3 = __commonJS({
         const clientName = typeof props.clientName === "string" ? props.clientName : "";
         if (clientName.length > 0)
           return clientName;
+      } else if (primaryLabel2 === "CashEntry") {
+        const desc = typeof props.description === "string" ? props.description : "";
+        if (desc.length > 0)
+          return desc;
       }
       for (const k of ["name", "title", "summary", "givenName", "subject", "text"]) {
         const v = props[k];
@@ -1290,8 +1311,8 @@ var require_dist4 = __commonJS({
         let edgesCreated = 0;
         for (const rel of relationships) {
           const type = rel.type.replace(/`/g, "");
-          const q = rel.direction === "outgoing" ? `MATCH (a), (b) WHERE elementId(a) = $from AND elementId(b) = $to CREATE (a)-[:\`${type}\`]->(b)` : `MATCH (a), (b) WHERE elementId(a) = $from AND elementId(b) = $to CREATE (b)-[:\`${type}\`]->(a)`;
-          const r = await tx.run(q, { from: nodeId, to: rel.targetNodeId });
+          const q2 = rel.direction === "outgoing" ? `MATCH (a), (b) WHERE elementId(a) = $from AND elementId(b) = $to CREATE (a)-[:\`${type}\`]->(b)` : `MATCH (a), (b) WHERE elementId(a) = $from AND elementId(b) = $to CREATE (b)-[:\`${type}\`]->(a)`;
+          const r = await tx.run(q2, { from: nodeId, to: rel.targetNodeId });
           const created = r.summary.counters.updates().relationshipsCreated;
           if (created === 0) {
             process.stderr.write(`[graph-write] reject reason=unresolved-target-on-create labels=${labelCsv} agent=${agentLabel} relType=${rel.type} targetId=${rel.targetNodeId}
@@ -1539,10 +1560,10 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/index.ts
-import { readFileSync as readFileSync41, existsSync as existsSync38, watchFile, readdirSync as readdirSync26, statSync as statSync17 } from "fs";
+import { readFileSync as readFileSync42, existsSync as existsSync38, watchFile, readdirSync as readdirSync26, statSync as statSync17 } from "fs";
 import { spawn as spawn3 } from "child_process";
 import { createHash as createHash7 } from "crypto";
-import { resolve as resolve36, join as join42, basename as basename12 } from "path";
+import { resolve as resolve37, join as join44, basename as basename12 } from "path";
 import { homedir as homedir4 } from "os";
 import { monitorEventLoopDelay } from "perf_hooks";
 
@@ -1957,14 +1978,14 @@ function readAllConversationsCached(accountId) {
   for (const file of dir) {
     if (!file.endsWith(".jsonl")) continue;
     const path3 = join4(STORE_ROOT(), accountId, file);
-    let stat8;
+    let stat9;
     try {
-      stat8 = statSync3(path3);
+      stat9 = statSync3(path3);
     } catch {
       continue;
     }
     const hit = idCache.get(path3);
-    if (hit && hit.size === stat8.size && hit.mtimeMs === stat8.mtimeMs) {
+    if (hit && hit.size === stat9.size && hit.mtimeMs === stat9.mtimeMs) {
       out.set(file, hit.ids);
       continue;
     }
@@ -1981,7 +2002,7 @@ function readAllConversationsCached(accountId) {
     } catch {
       continue;
     }
-    idCache.set(path3, { size: stat8.size, mtimeMs: stat8.mtimeMs, ids: parsed });
+    idCache.set(path3, { size: stat9.size, mtimeMs: stat9.mtimeMs, ids: parsed });
     out.set(file, parsed);
   }
   return out;
@@ -2815,7 +2836,7 @@ var credsSaveQueue = Promise.resolve();
 async function drainCredsSaveQueue(timeoutMs = 5e3) {
   console.error(`${TAG6} draining credential save queue\u2026`);
   const timer = new Promise(
-    (resolve37) => setTimeout(() => resolve37("timeout"), timeoutMs)
+    (resolve38) => setTimeout(() => resolve38("timeout"), timeoutMs)
   );
   const result = await Promise.race([
     credsSaveQueue.then(() => "drained"),
@@ -2992,11 +3013,11 @@ async function createWaSocket(opts) {
   return sock;
 }
 async function waitForConnection(sock) {
-  return new Promise((resolve37, reject) => {
+  return new Promise((resolve38, reject) => {
     const handler = (update) => {
       if (update.connection === "open") {
         sock.ev.off("connection.update", handler);
-        resolve37();
+        resolve38();
       }
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
@@ -3104,7 +3125,7 @@ function isTimeoutError(err) {
   return Boolean(err?.__maxyTimeout);
 }
 function withTimeout(label, promise, timeoutMs) {
-  return new Promise((resolve37, reject) => {
+  return new Promise((resolve38, reject) => {
     const timer = setTimeout(() => {
       const err = new Error(`${label} timed out after ${timeoutMs}ms`);
       err.__maxyTimeout = true;
@@ -3114,7 +3135,7 @@ function withTimeout(label, promise, timeoutMs) {
     promise.then(
       (value) => {
         clearTimeout(timer);
-        resolve37(value);
+        resolve38(value);
       },
       (err) => {
         clearTimeout(timer);
@@ -4028,15 +4049,15 @@ function getChannelActivity(accountId) {
 
 // app/lib/whatsapp/outbound/send.ts
 var TAG10 = "[whatsapp:outbound]";
-function buildQuoted(q) {
+function buildQuoted(q2) {
   return {
     key: {
-      remoteJid: q.remoteJid,
-      id: q.id,
-      fromMe: q.fromMe,
-      ...q.participant ? { participant: q.participant } : {}
+      remoteJid: q2.remoteJid,
+      id: q2.id,
+      fromMe: q2.fromMe,
+      ...q2.participant ? { participant: q2.participant } : {}
     },
-    message: { conversation: q.body ?? "" }
+    message: { conversation: q2.body ?? "" }
   };
 }
 async function sendTextMessage(sock, to, text, opts) {
@@ -4154,8 +4175,8 @@ async function persistWhatsAppMessage(input) {
   const { givenName, familyName } = splitName(input.pushName);
   const prev = sessionWriteLocks.get(input.cacheKey);
   let release;
-  const mine = new Promise((resolve37) => {
-    release = resolve37;
+  const mine = new Promise((resolve38) => {
+    release = resolve38;
   });
   const chained = (prev ?? Promise.resolve()).then(() => mine);
   sessionWriteLocks.set(input.cacheKey, chained);
@@ -5859,11 +5880,11 @@ async function connectWithReconnect(conn) {
       console.error(
         `${TAG17} reconnecting account=${conn.accountId} in ${delay}ms (attempt ${decision.nextAttempts}/${maxAttempts})`
       );
-      await new Promise((resolve37) => {
-        const timer = setTimeout(resolve37, delay);
+      await new Promise((resolve38) => {
+        const timer = setTimeout(resolve38, delay);
         conn.abortController.signal.addEventListener("abort", () => {
           clearTimeout(timer);
-          resolve37();
+          resolve38();
         }, { once: true });
       });
     }
@@ -5871,16 +5892,16 @@ async function connectWithReconnect(conn) {
   }
 }
 function waitForDisconnectEvent(conn) {
-  return new Promise((resolve37) => {
+  return new Promise((resolve38) => {
     if (!conn.sock) {
-      resolve37();
+      resolve38();
       return;
     }
     const sock = conn.sock;
     const handler = (update) => {
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
-        resolve37();
+        resolve38();
       }
     };
     sock.ev.on("connection.update", handler);
@@ -6290,8 +6311,8 @@ async function handleInboundMessage(conn, msg) {
     const conversationKey = isGroup ? remoteJid : senderPhone;
     const debounceKey = `${conn.accountId}:${conversationKey}:${senderPhone}`;
     let resolvePending;
-    const sttPending = new Promise((resolve37) => {
-      resolvePending = resolve37;
+    const sttPending = new Promise((resolve38) => {
+      resolvePending = resolve38;
     });
     if (conn.debouncer) conn.debouncer.registerPending(debounceKey, sttPending);
     try {
@@ -6719,20 +6740,20 @@ function buildX11Env(chromiumWrapperPath, transport = "vnc") {
 
 // server/routes/health.ts
 function checkPort(port2, timeoutMs = 500) {
-  return new Promise((resolve37) => {
+  return new Promise((resolve38) => {
     const socket = createConnection2(port2, "127.0.0.1");
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => {
       socket.destroy();
-      resolve37(true);
+      resolve38(true);
     });
     socket.once("error", () => {
       socket.destroy();
-      resolve37(false);
+      resolve38(false);
     });
     socket.once("timeout", () => {
       socket.destroy();
-      resolve37(false);
+      resolve38(false);
     });
   });
 }
@@ -6987,8 +7008,8 @@ function webchatTurnTimeoutMs() {
   return Number(process.env.WEBCHAT_TURN_TIMEOUT_MS ?? String(2 * 6e4));
 }
 function createChatRoutes(deps) {
-  const app64 = new Hono();
-  app64.post("/", async (c) => {
+  const app65 = new Hono();
+  app65.post("/", async (c) => {
     console.log(`[chat-route] entered route=public method=POST`);
     const contentType = c.req.header("content-type") ?? "";
     const account = resolveAccount();
@@ -7252,7 +7273,7 @@ ${result.result.text}` : result.result.text;
       }
     });
   });
-  return app64;
+  return app65;
 }
 
 // app/lib/channel-pty-bridge/admin-session-id.ts
@@ -7286,8 +7307,8 @@ function isLoopbackAddr(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
 function createScheduleInjectRoutes(deps) {
-  const app64 = new Hono();
-  app64.post("/", async (c) => {
+  const app65 = new Hono();
+  app65.post("/", async (c) => {
     const env = c.env;
     const remoteAddr = env?.incoming?.socket?.remoteAddress ?? "";
     if (!isLoopbackAddr(remoteAddr)) {
@@ -7388,7 +7409,7 @@ function createScheduleInjectRoutes(deps) {
     console.error(`${TAG20} op=inject-spawn eventId=${eventId} sessionId=${sessionId} result=ok status=-`);
     return c.json({ ok: true }, 200);
   });
-  return app64;
+  return app65;
 }
 
 // server/index.ts
@@ -8021,8 +8042,8 @@ async function startLogin(opts) {
   await clearAuth(authDir);
   let resolveCode = null;
   let rejectCode = null;
-  const codePromise = new Promise((resolve37, reject) => {
-    resolveCode = resolve37;
+  const codePromise = new Promise((resolve38, reject) => {
+    resolveCode = resolve38;
     rejectCode = reject;
   });
   const codeTimer = setTimeout(
@@ -9637,7 +9658,7 @@ app3.post("/r2/object/delete", envelopeBodyLimit("write"), async (c) => {
 });
 var storage_broker_default = app3;
 async function runStorageAudit(root) {
-  const { reconcileStorage } = await import("./src-JYPKMWJR.js");
+  const { reconcileStorage } = await import("./src-XQ63FPRE.js");
   const cf = await makeHouseCfExec(root);
   const accountsDir = resolve11(root, "..", "data", "accounts");
   const strays = (await reconcileStorage({
@@ -9677,26 +9698,108 @@ async function runStorageAudit(root) {
   );
 }
 async function runPagesAudit(root) {
-  const { reconcilePages } = await import("./src-JYPKMWJR.js");
-  const session = getSession();
-  try {
-    const cf = await makeHousePagesExec(root);
-    const r = await reconcilePages({
-      cfProjects: async () => (await cf.pagesProjectList()).map((p) => p.name),
-      registeredProjects: async () => {
+  const { reconcilePages } = await import("./src-XQ63FPRE.js");
+  const cf = await makeHousePagesExec(root);
+  const r = await reconcilePages({
+    cfProjects: async () => (await cf.pagesProjectList()).map((p) => p.name),
+    // Its own session per invocation, same rule as runStorageAudit above and
+    // for the same reason. This previously held one session opened in the
+    // enclosing scope, which was safe only because reconcilePages issues
+    // exactly one registry query — a property of the library, not of this
+    // caller. A second read added there would have reproduced 1813 here
+    // verbatim. The old shape also held that session open across
+    // makeHousePagesExec's network I/O, which is a pooled connection parked
+    // for the length of a Cloudflare round trip.
+    registeredProjects: async () => {
+      const session = getSession();
+      try {
         const res = await session.run(
           "MATCH (r:StorageResource {kind: $kind}) RETURN r.name AS name",
           { kind: "pages" }
         );
         return res.records.map((rec) => rec.get("name"));
+      } finally {
+        await session.close();
       }
-    });
+    }
+  });
+  console.error(
+    `[pages-audit] projects=${r.projects} registered=${r.registered} orphan=${r.orphans.length} phantom=${r.phantoms.length}` + r.orphans.map((n) => ` orphan:${n}`).join("") + r.phantoms.map((n) => ` phantom:${n}`).join("")
+  );
+}
+function parseManifestRows(raw) {
+  const envelope = Array.isArray(raw) ? raw[0] : null;
+  const results = envelope?.results;
+  if (!Array.isArray(results)) {
+    throw new Error(`unexpected d1 payload: envelope carries no results array`);
+  }
+  return results.map((r, i) => {
+    const row = r;
+    const bad = ["objectKey", "ingested", "uploadedAt"].find(
+      (f) => f === "ingested" ? typeof row[f] !== "number" : typeof row[f] !== "string"
+    );
+    if (bad) throw new Error(`unexpected d1 row: index=${i} field=${bad} type=${typeof row[bad]}`);
+    return { objectKey: row.objectKey, ingested: row.ingested, uploadedAt: row.uploadedAt };
+  });
+}
+function auditErrorText(message) {
+  return message.split("\n")[0].replaceAll('"', "'").slice(0, 160);
+}
+function discoverPortalAccounts(accountsDir) {
+  if (!existsSync9(accountsDir)) return [];
+  const found = [];
+  for (const accountId of readdirSync8(accountsDir)) {
+    const configPath2 = join13(accountsDir, accountId, "data-portal.json");
+    if (!existsSync9(configPath2)) continue;
+    try {
+      const cfg = JSON.parse(readFileSync15(configPath2, "utf-8"));
+      if (typeof cfg.portalDbName === "string" && cfg.portalDbName.length > 0 && typeof cfg.bucketName === "string" && cfg.bucketName.length > 0) {
+        found.push({ accountId, portalDbName: cfg.portalDbName, bucketName: cfg.bucketName });
+      }
+    } catch {
+    }
+  }
+  return found;
+}
+async function runDataPortalAudit(root) {
+  const portals = discoverPortalAccounts(resolve11(root, "..", "data", "accounts"));
+  if (portals.length === 0) return "portals=0 degraded=0";
+  const cf = await makeHouseCfExec(root);
+  let degraded = 0;
+  for (const portal of portals) {
+    let rows = null;
+    let d1Error = null;
+    try {
+      rows = parseManifestRows(
+        await cf.d1Query(
+          portal.portalDbName,
+          "SELECT objectKey, ingested, uploadedAt FROM manifest"
+        )
+      );
+    } catch (err) {
+      d1Error = err.message;
+    }
+    let objects = null;
+    let r2Error = null;
+    try {
+      objects = await cf.r2ObjectList(portal.bucketName);
+    } catch (err) {
+      r2Error = err.message;
+    }
+    const nowMs = Date.now();
+    const reconciled = rows !== null && objects !== null ? reconcileDataPortal(objects, rows, nowMs) : null;
+    const ageHrs = rows === null ? null : reconcileDataPortal([], rows, nowMs).oldestUningestedHrs;
+    const degradation = [d1Error !== null ? "d1" : null, r2Error !== null ? "r2" : null].filter(Boolean).join("+");
+    if (degradation) degraded += 1;
+    const reasons = [
+      d1Error !== null ? `d1:${auditErrorText(d1Error)}` : null,
+      r2Error !== null ? `r2:${auditErrorText(r2Error)}` : null
+    ].filter(Boolean).join(" | ");
     console.error(
-      `[pages-audit] projects=${r.projects} registered=${r.registered} orphan=${r.orphans.length} phantom=${r.phantoms.length}` + r.orphans.map((n) => ` orphan:${n}`).join("") + r.phantoms.map((n) => ` phantom:${n}`).join("")
+      `[data-portal-audit] account=${portal.accountId} objects=${objects?.length ?? "na"} rows=${rows?.length ?? "na"} orphanObjects=${reconciled?.orphanObjects.length ?? "na"} phantomRows=${reconciled?.phantomRows.length ?? "na"} oldestUningestedHrs=${ageHrs?.toFixed(1) ?? "na"}` + (degradation ? ` degraded=${degradation} err="${reasons}"` : "")
     );
-  } finally {
-    await session.close();
   }
+  return `portals=${portals.length} degraded=${degraded}`;
 }
 
 // server/google-pending-audit.ts
@@ -11254,12 +11357,12 @@ app5.get("/store-stream", requireAdminSession, (c) => {
       ...reactions && reactions.length > 0 ? { reactions } : {}
     };
     if (r.quotedId) {
-      const q = byMsgKeyId.get(r.quotedId);
+      const q2 = byMsgKeyId.get(r.quotedId);
       turn = {
         ...turn,
-        quoted: q ? { body: q.body, sender: q.senderName ?? (q.fromMe ? null : q.senderTelephone || null), fromMe: q.fromMe } : { body: "", sender: r.quotedSender, fromMe: false }
+        quoted: q2 ? { body: q2.body, sender: q2.senderName ?? (q2.fromMe ? null : q2.senderTelephone || null), fromMe: q2.fromMe } : { body: "", sender: r.quotedSender, fromMe: false }
       };
-      console.log(`[wa-reader] op=store-quote msgId=${r.msgKeyId} quoted=${!!q}`);
+      console.log(`[wa-reader] op=store-quote msgId=${r.msgKeyId} quoted=${!!q2}`);
     }
     if (r.attachmentId) {
       const meta = readAttachmentMeta(join19(uploadsBase, r.attachmentId));
@@ -12169,10 +12272,7 @@ function locateSidecar(sessionId) {
   }
   for (const slug of slugs) {
     const metaPath = join23(projectsRoot, slug, `${sessionId}.meta.json`);
-    if (existsSync15(metaPath)) {
-      const meta = readSidecarMeta(metaPath);
-      return { channel: meta.channel, adminUserId: meta.adminUserId, accountId: meta.accountId };
-    }
+    if (existsSync15(metaPath)) return readSidecarMeta(metaPath);
   }
   return null;
 }
@@ -12185,6 +12285,13 @@ function readTargetOwner(sessionId) {
   }
   return { found: false, owner: null };
 }
+function readSourceRowMeta(sessionId) {
+  const sidecar = locateSidecar(sessionId);
+  if (sidecar !== null) return sidecar;
+  const { projectDir } = locateSession(sessionId);
+  if (projectDir !== null) return readSidecarMeta(join23(projectDir, `${sessionId}.meta.json`));
+  return null;
+}
 function ownedByRequester(owner, requesterUserId, primaryUserId) {
   if (requesterUserId === null) return false;
   return owner === requesterUserId || owner === null && requesterUserId === primaryUserId;
@@ -12393,8 +12500,8 @@ async function reapplyLeversViaManager() {
 var WEBCHAT_SEND_TURN_WINDOW_MS = Number(process.env.WEBCHAT_SEND_TURN_WINDOW_MS ?? String(15e3));
 var sendSeq = 0;
 function createWebchatRoutes(deps) {
-  const app64 = new Hono();
-  app64.post("/send", requireAdminSession, async (c) => {
+  const app65 = new Hono();
+  app65.post("/send", requireAdminSession, async (c) => {
     let accountId;
     try {
       accountId = resolvePlatformAccountId();
@@ -12606,7 +12713,7 @@ ${note}` : note;
     if (turnTimer.unref) turnTimer.unref();
     return c.json({ ok: true });
   });
-  app64.post("/interrupt", requireAdminSession, async (c) => {
+  app65.post("/interrupt", requireAdminSession, async (c) => {
     const cacheKey = c.get("cacheKey");
     const requesterUserId = (cacheKey ? getUserIdForSession(cacheKey) : void 0) ?? null;
     const primaryUserId = resolvePrimaryAdminUserId();
@@ -12634,7 +12741,7 @@ ${note}` : note;
     }
     return c.json({ ok: true, stopped: outcome.stopped, intId: outcome.intId, deadChild: outcome.deadChild }, 200);
   });
-  app64.post("/settings", requireAdminSession, async (c) => {
+  app65.post("/settings", requireAdminSession, async (c) => {
     const body = await c.req.json().catch(() => null);
     const op = body?.op;
     const value = body?.value;
@@ -12674,7 +12781,7 @@ ${note}` : note;
     console.log(`[webchat:settings] op=${op} outcome=accepted value=${value} settingsApplied=${settingsApplied}`);
     return c.json({ ok: true, settingsApplied });
   });
-  app64.get("/session", requireAdminSession, async (c) => {
+  app65.get("/session", requireAdminSession, async (c) => {
     let accountId;
     try {
       accountId = resolvePlatformAccountId();
@@ -12752,7 +12859,7 @@ ${note}` : note;
     const indicators = await fetchComposerIndicators(sessionId);
     return c.json({ sessionId, projectDir, source, sizeBytes: jsonlSizeBytes(projectDir, sessionId), pendingPermissionPrompt: deps.pendingPromptFor?.(`session:${sessionId}`) ?? null, deliveryFailure: deps.deliveryFailureFor?.(`session:${sessionId}`) ?? null, ...indicators, ...readLevers(account) });
   });
-  app64.post("/permission-verdict", requireAdminSession, async (c) => {
+  app65.post("/permission-verdict", requireAdminSession, async (c) => {
     const body = await c.req.json().catch(() => null);
     const sessionId = body?.sessionId;
     const requestId = body?.request_id;
@@ -12769,7 +12876,7 @@ ${note}` : note;
     const ok = deps.resolvePermissionVerdict?.(`session:${sessionId}`, requestId, behavior) ?? false;
     return c.json({ ok });
   });
-  return app64;
+  return app65;
 }
 
 // server/routes/webchat-greeting.ts
@@ -14125,15 +14232,15 @@ function operatorRoleFor(config, userId) {
 async function buildAccountOptionList(accounts, userId) {
   const houseAccount = accounts.find((a) => a.config.role === "house");
   console.log(`[admin-accounts] op=list count=${accounts.length} house=${houseAccount?.accountId ?? "none"}`);
-  const resolve37 = async (a) => {
+  const resolve38 = async (a) => {
     const businessName = await fetchAccountName(a.accountId) || void 0;
     return { accountId: a.accountId, businessName, role: operatorRoleFor(a.config, userId), isHouse: a.config.role === "house" };
   };
   const houseOptions = await Promise.all(
-    accounts.filter((a) => a.config.role === "house").map(resolve37)
+    accounts.filter((a) => a.config.role === "house").map(resolve38)
   );
   const nonHouseOptions = await Promise.all(
-    accounts.filter((a) => a.config.role !== "house").map(resolve37)
+    accounts.filter((a) => a.config.role !== "house").map(resolve38)
   );
   const sortKey = (o) => (o.businessName || o.accountId).toLowerCase();
   nonHouseOptions.sort((x, y) => {
@@ -15140,9 +15247,9 @@ app18.post("/:id/resume", async (c) => {
     if (healQueue.length > 0) {
       void (async () => {
         for (let i = 0; i < healQueue.length; i++) {
-          const q = healQueue[i];
+          const q2 = healQueue[i];
           try {
-            const healComponents = await Promise.all(q.components.map(async (c2) => {
+            const healComponents = await Promise.all(q2.components.map(async (c2) => {
               const base = {
                 componentId: c2.componentId,
                 name: c2.name,
@@ -15180,25 +15287,25 @@ app18.post("/:id/resume", async (c) => {
             }));
             const messageId = await persistMessage(
               sessionId,
-              q.role,
-              q.content,
+              q2.role,
+              q2.content,
               accountId,
               void 0,
-              q.createdAt,
+              q2.createdAt,
               void 0,
               healComponents,
               void 0
             );
             jsonlHealOk += 1;
             try {
-              streamLogPath.write(`[${(/* @__PURE__ */ new Date()).toISOString()}] [admin-persist-heal] convId=${sessionId.slice(0, 8)} turnIndex=${i} role=${q.role} outcome=ok messageId=${(messageId ?? "").slice(0, 8)}
+              streamLogPath.write(`[${(/* @__PURE__ */ new Date()).toISOString()}] [admin-persist-heal] convId=${sessionId.slice(0, 8)} turnIndex=${i} role=${q2.role} outcome=ok messageId=${(messageId ?? "").slice(0, 8)}
 `);
             } catch {
             }
           } catch (err) {
             jsonlHealFail += 1;
             try {
-              streamLogPath.write(`[${(/* @__PURE__ */ new Date()).toISOString()}] [admin-persist-heal] convId=${sessionId.slice(0, 8)} turnIndex=${i} role=${q.role} outcome=fail reason=${JSON.stringify((err instanceof Error ? err.message : String(err)).slice(0, 200))}
+              streamLogPath.write(`[${(/* @__PURE__ */ new Date()).toISOString()}] [admin-persist-heal] convId=${sessionId.slice(0, 8)} turnIndex=${i} role=${q2.role} outcome=fail reason=${JSON.stringify((err instanceof Error ? err.message : String(err)).slice(0, 200))}
 `);
             } catch {
             }
@@ -15523,10 +15630,10 @@ function computeSpecialistDomains(accountId) {
   const resolveDesc = (qualified) => {
     if (!qualified.startsWith("mcp__")) return void 0;
     const rest = qualified.slice(5);
-    const sep9 = rest.indexOf("__");
-    if (sep9 < 0) return void 0;
-    const plugin = rest.slice(0, sep9);
-    const tool = rest.slice(sep9 + 2);
+    const sep10 = rest.indexOf("__");
+    if (sep10 < 0) return void 0;
+    const plugin = rest.slice(0, sep10);
+    const tool = rest.slice(sep10 + 2);
     let map = descByPlugin.get(plugin);
     if (!map) {
       const dir = pluginDirs.get(plugin);
@@ -15829,18 +15936,18 @@ var ALLOWED_EVENTS = /* @__PURE__ */ new Set([
 ]);
 var app21 = new Hono();
 app21.post("/", async (c) => {
-  const TAG53 = "[admin:events]";
+  const TAG54 = "[admin:events]";
   let body;
   try {
     body = await c.req.json();
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG53} reject reason=body-not-json detail=${detail}`);
+    console.error(`${TAG54} reject reason=body-not-json detail=${detail}`);
     return c.json({ ok: false, detail: "Request body was not valid JSON" }, 400);
   }
   const event = typeof body.event === "string" ? body.event : "";
   if (!ALLOWED_EVENTS.has(event)) {
-    console.error(`${TAG53} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
+    console.error(`${TAG54} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
     return c.json({ ok: false, detail: `Event "${event}" is not allowed` }, 400);
   }
   const rawFields = body.fields && typeof body.fields === "object" ? body.fields : {};
@@ -18481,7 +18588,7 @@ var CONVERSATION_PARENT_LABELS = /* @__PURE__ */ new Set(["AdminConversation", "
 var app23 = new Hono();
 app23.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
-  const q = (c.req.query("q") ?? "").trim();
+  const q2 = (c.req.query("q") ?? "").trim();
   const rawLimit = c.req.query("limit");
   const rawLabels = c.req.query("labels");
   const rawThreshold = c.req.query("threshold");
@@ -18490,13 +18597,13 @@ app23.get("/", requireAdminSession, async (c) => {
     console.error(`[graph-search] auth-rejected endpoint="/api/admin/graph-search" reason="no account for session"`);
     return c.json({ error: "Account not found for session" }, 401);
   }
-  if (!q) return c.json({ error: "q (search query) required" }, 400);
+  if (!q2) return c.json({ error: "q (search query) required" }, 400);
   const labels = rawLabels ? rawLabels.split(",").map((s) => s.trim()).filter((s) => s.length > 0) : [];
   const wildcard = labels.includes("*");
   const noChips = labels.length === 0;
   const allLabels = wildcard || noChips;
   if (noChips && !wildcard) {
-    console.error(`[graph-search] op=labels-default applied=all query="${q}"`);
+    console.error(`[graph-search] op=labels-default applied=all query="${q2}"`);
   }
   const parsedLimit = rawLimit ? parseInt(rawLimit, 10) : DEFAULT_LIMIT;
   const limit = Number.isFinite(parsedLimit) && parsedLimit > 0 ? Math.min(parsedLimit, MAX_LIMIT) : DEFAULT_LIMIT;
@@ -18516,7 +18623,7 @@ app23.get("/", requireAdminSession, async (c) => {
   const session = getSession();
   try {
     const res = await hybrid(session, embed, {
-      query: q,
+      query: q2,
       accountId,
       labels: forwardedLabels,
       limit,
@@ -18526,7 +18633,7 @@ app23.get("/", requireAdminSession, async (c) => {
     const total = Date.now() - started;
     if (res.embedError) {
       console.error(`[graph-search] embed-unavailable err="${res.embedError}" \u2014 bm25-only`);
-      console.error(`[graph-search] embed-degraded query="${q}" results=${res.results.length}`);
+      console.error(`[graph-search] embed-degraded query="${q2}" results=${res.results.length}`);
     }
     let labelMatchCount = 0;
     let bodyFulltextCount = 0;
@@ -18577,16 +18684,16 @@ app23.get("/", requireAdminSession, async (c) => {
       }
       resolvedResults = Array.from(seen.values()).sort((a, b) => b.score - a.score);
       console.error(
-        `[graph-search] label-match query="${q}" hits=${labelMatchCount}`
+        `[graph-search] label-match query="${q2}" hits=${labelMatchCount}`
       );
       console.error(
-        `[graph-search] body-fulltext query="${q}" hits=${bodyFulltextCount} ms=${total}`
+        `[graph-search] body-fulltext query="${q2}" hits=${bodyFulltextCount} ms=${total}`
       );
     }
     const labelsToken = wildcard ? "*" : noChips ? "all" : labels.join(",");
     const expandedFlag = !wildcard && wantsBodyFulltext ? 1 : 0;
     console.error(
-      `[graph-search] query="${q}" labels=${labelsToken} expanded=${expandedFlag} limit=${limit} mode=${res.mode} raw-results=${res.results.length} resolved-results=${resolvedResults.length} expand-ms=${res.expandMs} total-ms=${total}`
+      `[graph-search] query="${q2}" labels=${labelsToken} expanded=${expandedFlag} limit=${limit} mode=${res.mode} raw-results=${res.results.length} resolved-results=${resolvedResults.length} expand-ms=${res.expandMs} total-ms=${total}`
     );
     console.error(
       `[graph-search] threshold=${res.threshold ?? "off"} raw-merged=${res.rawMerged} suppressed=${res.suppressed} rendered=${res.results.length} bm25-bypass=${res.bm25Bypass}`
@@ -18609,7 +18716,7 @@ app23.get("/", requireAdminSession, async (c) => {
   } catch (err) {
     const elapsed = Date.now() - started;
     const message = err instanceof Error ? err.message : String(err);
-    console.error(`[graph-search] neo4j-unreachable query="${q}" ms=${elapsed} err="${message}"`);
+    console.error(`[graph-search] neo4j-unreachable query="${q2}" ms=${elapsed} err="${message}"`);
     return c.json({ error: `Graph search unavailable: ${message}` }, 503);
   } finally {
     await session.close();
@@ -18676,7 +18783,11 @@ var FILTER_TOP_LEVEL_LABELS = Object.freeze(
     "Risk",
     "Source",
     "Finding",
-    "Hypothesis"
+    "Hypothesis",
+    // Base-schema ledger (schema-base.md, Task 1819). A cash movement
+    // attached to no invoice — its only edges are outbound, so nothing
+    // drills down to it and a chip is the sole way to reach it.
+    "CashEntry"
   ])
 );
 var AGENT_ACTION_LABELS = Object.freeze(
@@ -18727,6 +18838,17 @@ var STATIC_TOP_LEVEL_LABELS = Object.freeze(
     "Review",
     "ImageObject",
     "Invoice",
+    // Supplier invoice. Declared in schema-base.md's `## Node Types` table
+    // (promoted there from schema-construction.md's top-level table by
+    // 7b225f814), which this module never parses — so it is static, not
+    // derived. Top-level because it is operator-entry with a natural key
+    // (accountId, supplier, confirmationNumber), unlike its InvoiceLine /
+    // InvoicePayment / Credit children.
+    "InboundInvoice",
+    // Ledger cash movement, declared in schema-base.md. Operator-entry with
+    // a natural key (accountId, entryId) and no parent label, so it is
+    // reachable only as a chip.
+    "CashEntry",
     "Task",
     "Project",
     "Event",
@@ -18777,8 +18899,8 @@ function parseTopLevelLabels(content) {
     const line = lines[i];
     if (line.startsWith("## ")) return [];
     if (!line.includes("|")) continue;
-    const sep9 = lines[i + 1];
-    if (!/^\s*\|?[\s:|-]+\|?\s*$/.test(sep9) || !sep9.includes("-")) continue;
+    const sep10 = lines[i + 1];
+    if (!/^\s*\|?[\s:|-]+\|?\s*$/.test(sep10) || !sep10.includes("-")) continue;
     const headers = splitPipeRow(line).map((h) => stripBackticks(h).toLowerCase());
     const labelCol = headers.findIndex((h) => h === "neo4j label");
     if (labelCol === -1) return [];
@@ -19029,7 +19151,7 @@ async function handleNeighbourhood(c, accountId) {
   }
   const includeAgentActions = c.req.query("includeAgentActions") === "1";
   const agentActionLabels = includeAgentActions ? [] : [...AGENT_ACTION_LABELS];
-  const q = (c.req.query("q") ?? "").trim();
+  const q2 = (c.req.query("q") ?? "").trim();
   const rawLimit = c.req.query("limit");
   const parsedLimit = rawLimit ? parseInt(rawLimit, 10) : NEIGHBOURHOOD_SEARCH_DEFAULT_LIMIT;
   const searchLimit = Number.isFinite(parsedLimit) && parsedLimit > 0 ? Math.min(parsedLimit, NEIGHBOURHOOD_SEARCH_MAX_LIMIT) : NEIGHBOURHOOD_SEARCH_DEFAULT_LIMIT;
@@ -19037,9 +19159,9 @@ async function handleNeighbourhood(c, accountId) {
   const session = getSession();
   try {
     let allowedIds = null;
-    if (q) {
+    if (q2) {
       const searchRes = await hybrid(session, embed, {
-        query: q,
+        query: q2,
         accountId,
         labels: [],
         limit: searchLimit,
@@ -19122,7 +19244,7 @@ async function handleNeighbourhood(c, accountId) {
     }
     if (allowedIds !== null) {
       console.error(
-        `[graph-page] neighbourhood-search-intersect q="${q}" allowed=${allowedIds.length} root=${elementId} rendered=${nodes.length}`
+        `[graph-page] neighbourhood-search-intersect q="${q2}" allowed=${allowedIds.length} root=${elementId} rendered=${nodes.length}`
       );
     }
     return c.json({ nodes, edges });
@@ -20463,18 +20585,68 @@ var session_rc_spawn_default = app35;
 
 // server/routes/admin/session-reseat.ts
 import { randomUUID as randomUUID12 } from "crypto";
-function resolveReseatPlan(body, mintId = randomUUID12, adminUserId, authenticatedName) {
+
+// server/channel-session-override.ts
+import { readFileSync as readFileSync34, writeFileSync as writeFileSync12, renameSync as renameSync9 } from "fs";
+import { join as join35 } from "path";
+var FILE2 = "channel-session-override.json";
+var UUID2 = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+function channelOverridePath(accountDir) {
+  return join35(accountDir, FILE2);
+}
+function senderKey(channel, senderId) {
+  return `${channel}:${senderId}`;
+}
+function readRaw2(accountDir) {
+  try {
+    return JSON.parse(readFileSync34(channelOverridePath(accountDir), "utf8"));
+  } catch {
+    return null;
+  }
+}
+function readChannelOverrideId(accountDir, channel, senderId) {
+  const raw = readRaw2(accountDir);
+  if (!raw || !raw.bySender || typeof raw.bySender !== "object") return null;
+  const v = raw.bySender[senderKey(channel, senderId)];
+  return typeof v === "string" && UUID2.test(v) ? v : null;
+}
+function writeChannelOverrideId(accountDir, channel, senderId, sessionId) {
+  const raw = readRaw2(accountDir);
+  const bySender = {};
+  if (raw?.bySender && typeof raw.bySender === "object") {
+    for (const [k, v] of Object.entries(raw.bySender)) {
+      if (typeof v === "string") bySender[k] = v;
+    }
+  }
+  bySender[senderKey(channel, senderId)] = sessionId;
+  const path3 = channelOverridePath(accountDir);
+  const tmp = `${path3}.${process.pid}.tmp`;
+  writeFileSync12(tmp, JSON.stringify({ bySender }, null, 2), "utf8");
+  renameSync9(tmp, path3);
+}
+
+// server/routes/admin/session-reseat.ts
+function isAdminChannelSource(source) {
+  return !!source && source.role === "admin" && (source.channel === "whatsapp" || source.channel === "telegram") && typeof source.senderId === "string" && source.senderId.length > 0;
+}
+function resolveReseatPlan(body, mintId = randomUUID12, adminUserId, authenticatedName, source) {
   const sessionId = mintId();
   const key = `session:${sessionId}`;
   const payload = {
     sessionId,
     forkFromSessionId: body.fromSessionId,
     model: body.model,
-    role: "admin",
-    channel: "webchat",
-    senderId: key,
-    webchatChannel: webchatChannelDescriptor(key)
+    role: "admin"
   };
+  if (isAdminChannelSource(source)) {
+    payload.channel = source.channel;
+    payload.senderId = source.senderId;
+    if (source.accountId) payload.targetAccountId = source.accountId;
+  } else {
+    payload.channel = "webchat";
+    payload.senderId = key;
+    payload.webchatChannel = webchatChannelDescriptor(key);
+  }
   if (body.name) payload.name = body.name;
   if (body.permissionMode) payload.permissionMode = body.permissionMode;
   if (body.effort) payload.effort = body.effort;
@@ -20515,14 +20687,18 @@ app36.post("/", requireAdminSession, async (c) => {
     }
     const accountId = cacheKey ? getAccountIdForSession(cacheKey) : void 0;
     const authenticatedName = accountId ? await resolveAuthenticatedName(accountId, adminUserId) : void 0;
+    const sourceMeta = readSourceRowMeta(fromSessionId);
+    const source = sourceMeta ? { channel: sourceMeta.channel, senderId: sourceMeta.senderId, role: sourceMeta.role, accountId: sourceMeta.accountId } : null;
     const plan = resolveReseatPlan(
       { fromSessionId, model, ...permissionMode ? { permissionMode } : {}, ...effort ? { effort } : {} },
       randomUUID12,
       adminUserId,
-      authenticatedName
+      authenticatedName,
+      source
     );
+    const isChannelFork = isAdminChannelSource(source);
     const reseatReqId = randomUUID12();
-    console.log(`[chat-reseat] op=request reseatReqId=${reseatReqId} from=${fromSessionId} to-model=${model} to-mode=${permissionMode ?? "none"} to-effort=${effort ?? "none"} new=${plan.sessionId}`);
+    console.log(`[chat-reseat] op=request reseatReqId=${reseatReqId} from=${fromSessionId} from-channel=${source?.channel ?? "none"} from-sender=${source?.senderId ?? "none"} to-model=${model} to-mode=${permissionMode ?? "none"} to-effort=${effort ?? "none"} new=${plan.sessionId}`);
     let res;
     try {
       res = await fetch(`${managerBase("session-reseat:wrapper")}/rc-spawn`, {
@@ -20562,6 +20738,23 @@ app36.post("/", requireAdminSession, async (c) => {
     } catch (err) {
       console.error(`[session-reseat] canonical-forward-failed err=${err instanceof Error ? err.message : String(err)}`);
     }
+    if (isChannelFork) {
+      const channel = plan.payload.channel;
+      const senderId = plan.payload.senderId;
+      try {
+        const provenance = source?.accountId ? "source-account" : "boot-account-fallback";
+        const dir = source?.accountId ? listValidAccounts().find((a) => a.accountId === source.accountId)?.accountDir ?? null : resolveAccount()?.accountDir ?? null;
+        if (dir) {
+          writeChannelOverrideId(dir, channel, senderId, plan.sessionId);
+          console.log(`[chat-reseat] op=channel-forward reseatReqId=${reseatReqId} senderId=${senderId} from=${fromSessionId} to=${plan.sessionId} keyedOn=${provenance}`);
+        } else {
+          console.error(`[session-reseat] channel-forward-failed reason=no-account-dir accountId=${source?.accountId ?? "none"} senderId=${senderId}`);
+        }
+      } catch (err) {
+        console.error(`[session-reseat] channel-forward-failed err=${err instanceof Error ? err.message : String(err)} senderId=${senderId}`);
+      }
+      console.log(`[chat-reseat] op=channel-fork-unbound reseatReqId=${reseatReqId} senderId=${senderId} session=${plan.sessionId} note=binds-on-next-inbound`);
+    }
     const target = `/chat?session=${plan.sessionId}`;
     console.log(`[chat-reseat] op=acquired reseatReqId=${reseatReqId} pid=${parsed?.spawnedPid ?? "none"} new=${plan.sessionId}`);
     console.log(`[chat-reseat] op=navigate reseatReqId=${reseatReqId} target=${target}`);
@@ -20696,14 +20889,14 @@ app37.get("/", async (c) => {
 var system_stats_default = app37;
 
 // server/routes/admin/health.ts
-import { existsSync as existsSync31, readFileSync as readFileSync34 } from "fs";
-import { resolve as resolve26, join as join35 } from "path";
+import { existsSync as existsSync31, readFileSync as readFileSync35 } from "fs";
+import { resolve as resolve26, join as join36 } from "path";
 var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve26(process.cwd(), "..");
 var brandHostname = "maxy";
-var brandJsonPath = join35(PLATFORM_ROOT6, "config", "brand.json");
+var brandJsonPath = join36(PLATFORM_ROOT6, "config", "brand.json");
 if (existsSync31(brandJsonPath)) {
   try {
-    const brand = JSON.parse(readFileSync34(brandJsonPath, "utf-8"));
+    const brand = JSON.parse(readFileSync35(brandJsonPath, "utf-8"));
     if (brand.hostname) brandHostname = brand.hostname;
   } catch {
   }
@@ -20713,7 +20906,7 @@ var PROCESS_STARTED_AT = (/* @__PURE__ */ new Date()).toISOString();
 var PROBE_TIMEOUT_MS = 1e3;
 function readVersion() {
   if (!existsSync31(VERSION_FILE)) return "unknown";
-  return readFileSync34(VERSION_FILE, "utf-8").trim() || "unknown";
+  return readFileSync35(VERSION_FILE, "utf-8").trim() || "unknown";
 }
 async function probeConversationDb() {
   let session;
@@ -20893,7 +21086,7 @@ function managerLogFollowUrl(sessionId, opts) {
 
 // server/routes/admin/linkedin-ingest.ts
 var TAG31 = "[linkedin-ingest-route]";
-var UUID2 = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+var UUID3 = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
 var ISO = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?(?:Z|[+-]\d{2}:\d{2})$/;
 var LINKEDIN_URL = /^https:\/\/www\.linkedin\.com\//;
 function rejectSchema(reason, missing = []) {
@@ -20907,7 +21100,7 @@ function validate(body) {
   if (b.kind !== "profile" && b.kind !== "thread") missing.push("kind");
   if (typeof b.capturedAt !== "string" || !ISO.test(b.capturedAt)) missing.push("capturedAt");
   if (typeof b.pageUrl !== "string" || !LINKEDIN_URL.test(b.pageUrl)) missing.push("pageUrl");
-  if (typeof b.dispatchId !== "string" || !UUID2.test(b.dispatchId)) missing.push("dispatchId");
+  if (typeof b.dispatchId !== "string" || !UUID3.test(b.dispatchId)) missing.push("dispatchId");
   if (missing.length) return rejectSchema("envelope", missing);
   if (b.kind === "profile") {
     const p = b.profile;
@@ -21490,7 +21683,7 @@ var browser_default = app45;
 
 // server/routes/admin/calendar.ts
 import { existsSync as existsSync32 } from "fs";
-import { join as join37 } from "path";
+import { join as join38 } from "path";
 
 // server/lib/calendar-ics.ts
 var CRLF = "\r\n";
@@ -21589,8 +21782,8 @@ function countVEvents(ics) {
 }
 
 // server/lib/calendar-availability.ts
-import { readFileSync as readFileSync35 } from "fs";
-import { join as join36 } from "path";
+import { readFileSync as readFileSync36 } from "fs";
+import { join as join37 } from "path";
 var AVAILABILITY_FILENAME = "calendar-availability.json";
 var REQUIRED_KEYS = [
   "timezone",
@@ -21599,10 +21792,10 @@ var REQUIRED_KEYS = [
   "weekly"
 ];
 function readAvailabilityConfig(accountDir) {
-  const path3 = join36(accountDir, AVAILABILITY_FILENAME);
+  const path3 = join37(accountDir, AVAILABILITY_FILENAME);
   let raw;
   try {
-    raw = readFileSync35(path3, "utf-8");
+    raw = readFileSync36(path3, "utf-8");
   } catch {
     throw new Error(`availability not configured: ${path3} not found`);
   }
@@ -21961,7 +22154,7 @@ app46.get("/booking-link", requireAdminSession, (c) => {
       console.error('[calendar] op=booking-link-fail err="no account configured"');
       return c.json({ bookingDomain: null });
     }
-    if (!existsSync32(join37(account.accountDir, AVAILABILITY_FILENAME))) {
+    if (!existsSync32(join38(account.accountDir, AVAILABILITY_FILENAME))) {
       console.log("[calendar] op=booking-link bookingDomain=none source=availability-config");
       return c.json({ bookingDomain: null });
     }
@@ -22016,16 +22209,32 @@ app47.get("/", requireAdminSession, async (c) => {
          WHERE te.endedAt IS NULL
        WITH t, te ORDER BY te.startedAt
        WITH t, head(collect(te)) AS openTe
+       // OPTIONAL is load-bearing. Unassigned is the common state, so a plain
+       // MATCH would silently drop most of the list with nothing looking wrong.
+       OPTIONAL MATCH (t)-[:ASSIGNED_TO]->(a:AdminUser)
+       // head(collect(...)) for the same reason the TimeEntry match above uses
+       // it: a second ASSIGNED_TO edge would fan the row out, duplicating
+       // rowKey and double-counting the assignee.
+       WITH t, openTe, head(collect(a)) AS assignee
        RETURN t.taskId AS taskId, elementId(t) AS rowKey, t.name AS name, t.clientName AS clientName,
               t.propertyAddress AS propertyAddress, t.fee AS fee, t.status AS status,
               coalesce(t.secondsLogged, 0) AS secondsLogged,
-              openTe.startedAt AS runningStartedAt
+              openTe.startedAt AS runningStartedAt,
+              t.createdAt AS createdAt,
+              assignee.userId AS assigneeUserId, assignee.name AS assigneeName
        ORDER BY t.createdAt DESC`,
       { accountId }
     );
+    const totalResult = await session.run(
+      `MATCH (t:Task {accountId: $accountId}) RETURN count(t) AS total`,
+      { accountId }
+    );
+    const graphTotal = totalResult.records.length > 0 ? toNum(totalResult.records[0].get("total")) : 0;
     const open = [];
     const completed = [];
     let missingTaskId = 0;
+    let missingCreatedAt = 0;
+    let assigned = 0;
     for (const rec of result.records) {
       const status = rec.get("status") ?? "pending";
       const runningStartedAt = rec.get("runningStartedAt") ?? null;
@@ -22033,6 +22242,10 @@ app47.get("/", requireAdminSession, async (c) => {
       const rawTaskId = rec.get("taskId");
       const taskId = typeof rawTaskId === "string" && rawTaskId !== "" ? rawTaskId : null;
       if (taskId === null) missingTaskId++;
+      const createdAt = rec.get("createdAt") ?? null;
+      if (createdAt === null) missingCreatedAt++;
+      const assigneeUserId = rec.get("assigneeUserId") ?? null;
+      if (assigneeUserId !== null) assigned++;
       const row = {
         taskId,
         rowKey: rec.get("rowKey"),
@@ -22043,12 +22256,23 @@ app47.get("/", requireAdminSession, async (c) => {
         status,
         secondsLogged: toNum(rec.get("secondsLogged")),
         running: runningStartedAt !== null,
-        runningStartedAt
+        runningStartedAt,
+        createdAt,
+        assigneeUserId,
+        assigneeName: rec.get("assigneeName") ?? null
       };
       if (COMPLETED.has(status)) completed.push(row);
       else if (!HIDDEN_FROM_OPEN.has(status)) open.push(row);
     }
-    console.log(`${TAG37} op=list account=${accountId} open=${open.length} completed=${completed.length} missingTaskId=${missingTaskId}`);
+    const returned = result.records.length;
+    if (returned < graphTotal) {
+      console.error(
+        `${TAG37} op=list row-count-shortfall account=${accountId} returned=${returned} graphTotal=${graphTotal} missing=${graphTotal - returned}`
+      );
+    }
+    console.log(
+      `${TAG37} op=list account=${accountId} returned=${returned} graphTotal=${graphTotal} open=${open.length} completed=${completed.length} missingTaskId=${missingTaskId} missingCreatedAt=${missingCreatedAt} assigned=${assigned}`
+    );
     return c.json({ open, completed });
   } catch (err) {
     console.error(`${TAG37} op=list error="${err instanceof Error ? err.message : String(err)}"`);
@@ -22366,7 +22590,13 @@ app52.get("/", requireAdminSession, async (c) => {
   const start = Date.now();
   let res;
   try {
-    res = await fetch(`${managerBase("activity:wrapper")}/activity`, {
+    const qs = new URLSearchParams();
+    const from = c.req.query("from");
+    const to = c.req.query("to");
+    if (from) qs.set("from", from);
+    if (to) qs.set("to", to);
+    const suffix = qs.size > 0 ? `?${qs.toString()}` : "";
+    res = await fetch(`${managerBase("activity:wrapper")}/activity${suffix}`, {
       signal: AbortSignal.timeout(3e4)
     });
   } catch (err) {
@@ -22420,6 +22650,11 @@ app52.get("/", requireAdminSession, async (c) => {
     rows,
     census,
     censusAgeMs,
+    // `satisfies` and not a bare literal (Task 1825). LoopsPayload is what the
+    // activity page destructures; without the check, a key renamed or dropped
+    // here still compiles and the page reads undefined, which its own
+    // vocabulary renders as a dash meaning "not measured". The check runs both
+    // ways: a key the page does not know about fails as an excess property.
     loops: {
       armed: armed2,
       rows: loopRows,
@@ -22722,7 +22957,7 @@ app56.route("/request-magic-link", request_magic_link_default);
 var access_default = app56;
 
 // server/routes/sites.ts
-import { existsSync as existsSync33, readFileSync as readFileSync36, realpathSync as realpathSync7, statSync as statSync14 } from "fs";
+import { existsSync as existsSync33, readFileSync as readFileSync37, realpathSync as realpathSync7, statSync as statSync14 } from "fs";
 import { resolve as resolve28 } from "path";
 var SAFE_SEG_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var MIME = {
@@ -22786,13 +23021,13 @@ app57.get("/:rel{.*}", (c) => {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
   }
-  let stat8;
+  let stat9;
   try {
-    stat8 = existsSync33(filePath) ? statSync14(filePath) : null;
+    stat9 = existsSync33(filePath) ? statSync14(filePath) : null;
   } catch {
-    stat8 = null;
+    stat9 = null;
   }
-  if (stat8?.isDirectory() && !reqPath.endsWith("/")) {
+  if (stat9?.isDirectory() && !reqPath.endsWith("/")) {
     const search = new URL(c.req.url).search;
     const target = `${reqPath}/${search}`;
     console.log(
@@ -22800,7 +23035,7 @@ app57.get("/:rel{.*}", (c) => {
     );
     return c.redirect(target, 301);
   }
-  if (stat8?.isDirectory()) {
+  if (stat9?.isDirectory()) {
     filePath = resolve28(filePath, "index.html");
   }
   if (!filePath.startsWith(rootDir + "/")) {
@@ -22826,7 +23061,7 @@ app57.get("/:rel{.*}", (c) => {
   }
   let body;
   try {
-    body = readFileSync36(realPath);
+    body = readFileSync37(realPath);
   } catch (err) {
     const code = err?.code;
     if (code === "EISDIR") {
@@ -22862,7 +23097,7 @@ var sites_default = app57;
 
 // app/lib/visitor-token.ts
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
-import { mkdirSync as mkdirSync8, readFileSync as readFileSync37, writeFileSync as writeFileSync12 } from "fs";
+import { mkdirSync as mkdirSync8, readFileSync as readFileSync38, writeFileSync as writeFileSync13 } from "fs";
 import { dirname as dirname12 } from "path";
 var TOKEN_PREFIX = "v1.";
 var SECRET_BYTES = 32;
@@ -22871,7 +23106,7 @@ var cachedSecret = null;
 function getSecret() {
   if (cachedSecret) return cachedSecret;
   try {
-    const hex2 = readFileSync37(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
+    const hex2 = readFileSync38(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
     if (hex2.length === SECRET_BYTES * 2) {
       cachedSecret = Buffer.from(hex2, "hex");
       return cachedSecret;
@@ -22881,11 +23116,11 @@ function getSecret() {
   const fresh = randomBytes(SECRET_BYTES).toString("hex");
   try {
     mkdirSync8(dirname12(VISITOR_TOKEN_SECRET_FILE), { recursive: true, mode: 448 });
-    writeFileSync12(VISITOR_TOKEN_SECRET_FILE, fresh, { mode: 384, flag: "wx" });
+    writeFileSync13(VISITOR_TOKEN_SECRET_FILE, fresh, { mode: 384, flag: "wx" });
     console.log(`[visitor-token] secret minted path=${VISITOR_TOKEN_SECRET_FILE}`);
   } catch {
   }
-  const hex = readFileSync37(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
+  const hex = readFileSync38(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
   cachedSecret = Buffer.from(hex, "hex");
   return cachedSecret;
 }
@@ -22938,8 +23173,8 @@ var VISITOR_COOKIE_NAME = "mxy_v";
 var VISITOR_COOKIE_MAX_AGE_SECONDS = Math.floor(DEFAULT_TTL_MS / 1e3);
 
 // app/lib/brand-config.ts
-import { existsSync as existsSync34, readFileSync as readFileSync38 } from "fs";
-import { join as join38 } from "path";
+import { existsSync as existsSync34, readFileSync as readFileSync39 } from "fs";
+import { join as join39 } from "path";
 var cached2 = null;
 var cachedAttempted = false;
 function readBrandConfig() {
@@ -22947,10 +23182,10 @@ function readBrandConfig() {
   cachedAttempted = true;
   const platformRoot5 = process.env.MAXY_PLATFORM_ROOT;
   if (!platformRoot5) return null;
-  const brandPath = join38(platformRoot5, "config", "brand.json");
+  const brandPath = join39(platformRoot5, "config", "brand.json");
   if (!existsSync34(brandPath)) return null;
   try {
-    cached2 = JSON.parse(readFileSync38(brandPath, "utf-8"));
+    cached2 = JSON.parse(readFileSync39(brandPath, "utf-8"));
     return cached2;
   } catch {
     return null;
@@ -23084,8 +23319,8 @@ function appendConsentParams(pageUrl, token) {
     const hashIdx = pageUrl.indexOf("#");
     const hash = hashIdx >= 0 ? pageUrl.slice(hashIdx) : "";
     const base = hashIdx >= 0 ? pageUrl.slice(0, hashIdx) : pageUrl;
-    const sep9 = base.indexOf("?") >= 0 ? "&" : "?";
-    return base + sep9 + `consent=needed&v=${encodeURIComponent(token)}` + hash;
+    const sep10 = base.indexOf("?") >= 0 ? "&" : "?";
+    return base + sep10 + `consent=needed&v=${encodeURIComponent(token)}` + hash;
   }
 }
 var SAFE_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,118}[a-z0-9])?$/;
@@ -23448,13 +23683,13 @@ var visitor_event_default = app60;
 
 // server/routes/session.ts
 import { resolve as resolve29 } from "path";
-import { existsSync as existsSync35, writeFileSync as writeFileSync13, mkdirSync as mkdirSync9 } from "fs";
+import { existsSync as existsSync35, writeFileSync as writeFileSync14, mkdirSync as mkdirSync9 } from "fs";
 var UUID_RE5 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function writeBrandingCache(accountId, agentSlug, branding) {
   try {
     const cacheDir = resolve29(MAXY_DIR, "branding-cache", accountId);
     mkdirSync9(cacheDir, { recursive: true });
-    writeFileSync13(resolve29(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
+    writeFileSync14(resolve29(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
   } catch (err) {
     console.error(`[branding] cache write failed: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -23779,8 +24014,205 @@ app62.get("/free-busy", async (c) => {
 });
 var calendar_public_default = app62;
 
+// server/routes/portal-fetch.ts
+import { createReadStream as createReadStream3 } from "fs";
+import { stat as stat6, readFile as readFile6, realpath } from "fs/promises";
+import { join as join40, resolve as resolve30, sep as sep8 } from "path";
+import { Readable as Readable3 } from "stream";
+
+// ../plugins/cloudflare/bin/schema-exposed-dirs.mjs
+var ONT_START = "<!-- ontology-buckets:start -->";
+var ONT_END = "<!-- ontology-buckets:end -->";
+var OWNED_START = "<!-- plugin-owned-dirs:start -->";
+var OWNED_END = "<!-- plugin-owned-dirs:end -->";
+var ALWAYS_EXPOSED = "output";
+var DOMAIN_LINE = /^- `([^`/]+)\/` - one folder per /;
+var OWNED_LINE = /^- `([^`/]+)\/` — /;
+function region(text, start, end) {
+  const i = text.indexOf(start);
+  if (i === -1) return null;
+  const j = text.indexOf(end, i);
+  return text.slice(i, j === -1 ? text.length : j);
+}
+function allowedBlockOrNull(text) {
+  const lines = text.split("\n");
+  const start = lines.findIndex((l) => l.trim() === "```allowed-top-level");
+  if (start === -1) return null;
+  for (let j = start + 1; j < lines.length; j++) {
+    if (lines[j].trim() === "```") {
+      return lines.slice(start + 1, j).map((l) => l.trim()).filter(Boolean);
+    }
+  }
+  return null;
+}
+function resolveExposedDirs(schemaText) {
+  const empty = {
+    schemaPresent: false,
+    allowed: (
+      /** @type {string[]} */
+      []
+    ),
+    domainBuckets: (
+      /** @type {string[]} */
+      []
+    ),
+    pluginOwned: (
+      /** @type {string[]} */
+      []
+    ),
+    collisions: (
+      /** @type {string[]} */
+      []
+    ),
+    exposed: (
+      /** @type {string[]} */
+      []
+    )
+  };
+  if (typeof schemaText !== "string" || schemaText.length === 0) return empty;
+  const allowed = allowedBlockOrNull(schemaText);
+  if (allowed === null) return { ...empty, schemaPresent: true };
+  const ont = region(schemaText, ONT_START, ONT_END);
+  const owned = region(schemaText, OWNED_START, OWNED_END);
+  const dirsIn = (text, re) => {
+    if (!text) return [];
+    const out = [];
+    for (const line of text.split("\n")) {
+      const m = re.exec(line.trim());
+      if (m && !out.includes(m[1])) out.push(m[1]);
+    }
+    return out;
+  };
+  const domainBuckets = dirsIn(ont, DOMAIN_LINE);
+  const pluginOwned = dirsIn(owned, OWNED_LINE);
+  const collisions = domainBuckets.filter((d) => pluginOwned.includes(d));
+  const candidates = [ALWAYS_EXPOSED, ...domainBuckets.filter((d) => !collisions.includes(d))];
+  const exposed = [...new Set(candidates)].filter((d) => allowed.includes(d)).sort();
+  return { schemaPresent: true, allowed, domainBuckets, pluginOwned, collisions, exposed };
+}
+
+// server/routes/portal-fetch.ts
+var app63 = new Hono();
+var TAG45 = "[portal-fetch]";
+async function verifySignature(secret, accountId, relPath, expiresAtMs, signature, nowMs) {
+  if (!secret || !signature) return false;
+  if (!Number.isFinite(expiresAtMs) || expiresAtMs <= nowMs) return false;
+  const key = await crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const mac = await crypto.subtle.sign(
+    "HMAC",
+    key,
+    new TextEncoder().encode(`${accountId}
+${relPath}
+${expiresAtMs}`)
+  );
+  const expected = [...new Uint8Array(mac)].map((b) => b.toString(16).padStart(2, "0")).join("");
+  if (expected.length !== signature.length) return false;
+  let diff = 0;
+  for (let i = 0; i < expected.length; i++) diff |= expected.charCodeAt(i) ^ signature.charCodeAt(i);
+  return diff === 0;
+}
+async function readAccountSecret(accountId) {
+  const path3 = resolve30(DATA_ROOT, "accounts", accountId, "secrets", "data-portal.env");
+  let text;
+  try {
+    text = await readFile6(path3, "utf8");
+  } catch {
+    console.error(`${TAG45} op=no-secret account="${accountId}" path="${path3}"`);
+    return "";
+  }
+  for (const line of text.split("\n")) {
+    const m = line.match(/^PORTAL_FETCH_SECRET=(.*)$/);
+    if (m) return m[1].trim();
+  }
+  console.error(`${TAG45} op=no-secret account="${accountId}" reason=key-absent path="${path3}"`);
+  return "";
+}
+function isValidAccountId2(value) {
+  return /^[A-Za-z0-9-]+$/.test(value);
+}
+async function resolveFetchTarget(accountDir, relPath) {
+  let schemaText = null;
+  try {
+    schemaText = await readFile6(join40(accountDir, "SCHEMA.md"), "utf8");
+  } catch {
+    schemaText = null;
+  }
+  const { exposed } = resolveExposedDirs(schemaText);
+  if (exposed.length === 0) return { ok: false, reason: "not-exposed" };
+  const lexical = resolve30(accountDir, relPath);
+  let root;
+  let absolute;
+  try {
+    root = await realpath(accountDir);
+    absolute = await realpath(lexical);
+  } catch {
+    return { ok: false, reason: "enoent" };
+  }
+  if (absolute === root || !absolute.startsWith(root + sep8)) return { ok: false, reason: "not-exposed" };
+  const top = absolute.slice(root.length + 1).split(sep8)[0];
+  if (!exposed.includes(top)) return { ok: false, reason: "not-exposed" };
+  try {
+    const st = await stat6(absolute);
+    if (!st.isFile()) return { ok: false, reason: "enoent" };
+    return { ok: true, absolute, sizeBytes: st.size };
+  } catch {
+    return { ok: false, reason: "enoent" };
+  }
+}
+function q(value) {
+  return `"${value.replace(/[\\"]/g, "\\$&").replace(/[\r\n\t]/g, " ")}"`;
+}
+async function handle(c, headOnly) {
+  const accountId = c.req.query("accountId") ?? "";
+  const relPath = c.req.query("path") ?? "";
+  const exp = Number(c.req.query("exp") ?? "0");
+  const sig = c.req.query("sig") ?? "";
+  console.log(`${TAG45} op=request account=${q(accountId)} path=${q(relPath)} head=${headOnly}`);
+  if (!isValidAccountId2(accountId)) {
+    console.error(`${TAG45} op=denied account=${q(accountId)} reason=account-id`);
+    return c.json({ ok: false, error: "denied" }, 401);
+  }
+  const secret = await readAccountSecret(accountId);
+  if (!await verifySignature(secret, accountId, relPath, exp, sig, Date.now())) {
+    console.error(`${TAG45} op=denied account=${q(accountId)} reason=secret`);
+    return c.json({ ok: false, error: "denied" }, 401);
+  }
+  const target = await resolveFetchTarget(resolve30(DATA_ROOT, "accounts", accountId), relPath);
+  if (!target.ok) {
+    const op = target.reason === "enoent" ? "miss" : "denied";
+    console.error(`${TAG45} op=${op} account=${accountId} reason=${target.reason}`);
+    return c.json({ ok: false, error: "not found" }, 404);
+  }
+  if (headOnly) {
+    console.log(`${TAG45} op=served account=${accountId} bytes=${target.sizeBytes} head=true`);
+    return c.body(null, 200);
+  }
+  console.log(`${TAG45} op=served account=${accountId} bytes=${target.sizeBytes}`);
+  return new Response(Readable3.toWeb(createReadStream3(target.absolute)), {
+    status: 200,
+    headers: {
+      "content-type": detectMimeType(target.absolute),
+      // Percent-encoded per RFC 6266, so a name carrying a quote cannot break
+      // out of the form and CR/LF cannot reach the Headers constructor.
+      "content-disposition": `attachment; filename*=UTF-8''${encodeURIComponent(relPath.split("/").pop() ?? "file")}`,
+      "x-content-type-options": "nosniff",
+      // Private client documents: never let a browser or proxy cache one.
+      "cache-control": "private, no-store"
+    }
+  });
+}
+app63.get("/fetch", (c) => handle(c, false));
+app63.on("HEAD", "/fetch", (c) => handle(c, true));
+var portal_fetch_default = app63;
+
 // app/lib/timeentry-census.ts
-var TAG45 = "[timeentry-census]";
+var TAG46 = "[timeentry-census]";
 function reconcileTimeEntries(rows, now, horizonMs) {
   const openEntries = rows.openEntries.length;
   let oldestOpenAgeMs = 0;
@@ -23820,12 +24252,12 @@ async function runTimeEntryCensusOnce(session, now, horizonMs) {
       sumAdjustments: toNum(r.get("sumAdjustments"))
     }));
     const finding = reconcileTimeEntries({ openEntries, taskSums }, now, horizonMs);
-    const line = `${TAG45} openEntries=${finding.openEntries} oldestOpenAgeMin=${finding.oldestOpenAgeMin} maxOpenPerAccount=${finding.maxOpenPerAccount} driftTasks=${finding.driftTasks}`;
+    const line = `${TAG46} openEntries=${finding.openEntries} oldestOpenAgeMin=${finding.oldestOpenAgeMin} maxOpenPerAccount=${finding.maxOpenPerAccount} driftTasks=${finding.driftTasks}`;
     if (finding.alarm) console.error(`${line} alarm=true`);
     else console.log(line);
     return finding;
   } catch (err) {
-    console.error(`${TAG45} error="${err instanceof Error ? err.message : String(err)}"`);
+    console.error(`${TAG46} error="${err instanceof Error ? err.message : String(err)}"`);
     return null;
   }
 }
@@ -23839,13 +24271,13 @@ function startTimeEntryCensus(openSession, opts = {}) {
     try {
       session = openSession();
     } catch (err) {
-      console.error(`${TAG45} open-session-failed error="${err instanceof Error ? err.message : String(err)}"`);
+      console.error(`${TAG46} open-session-failed error="${err instanceof Error ? err.message : String(err)}"`);
       return;
     }
     try {
       await runTimeEntryCensusOnce(session, Date.now(), horizonMs);
     } catch (err) {
-      console.error(`${TAG45} tick-failed error="${err instanceof Error ? err.message : String(err)}"`);
+      console.error(`${TAG46} tick-failed error="${err instanceof Error ? err.message : String(err)}"`);
     } finally {
       try {
         await session.close();
@@ -23862,8 +24294,8 @@ function startTimeEntryCensus(openSession, opts = {}) {
 }
 
 // app/lib/ledger-census.ts
-import { readdirSync as readdirSync25, readFileSync as readFileSync39, statSync as statSync15 } from "fs";
-import { join as join39 } from "path";
+import { readdirSync as readdirSync25, readFileSync as readFileSync40, statSync as statSync15 } from "fs";
+import { join as join41 } from "path";
 
 // ../lib/ledger-core/dist/reconcile.js
 var LEDGER_INDEX_NAMES = [
@@ -23906,7 +24338,7 @@ function formatCensusLine(f) {
 }
 
 // app/lib/ledger-census.ts
-var TAG46 = "[ledger-census]";
+var TAG47 = "[ledger-census]";
 var DAY_MS = 864e5;
 function countWriteRejects24h(logDir, now) {
   let entries;
@@ -23917,10 +24349,10 @@ function countWriteRejects24h(logDir, now) {
   }
   let total = 0;
   for (const name of entries) {
-    const path3 = join39(logDir, name);
+    const path3 = join41(logDir, name);
     try {
       if (now - statSync15(path3).mtimeMs > DAY_MS) continue;
-      for (const line of readFileSync39(path3, "utf8").split("\n")) {
+      for (const line of readFileSync40(path3, "utf8").split("\n")) {
         if (line.includes("[graph-write] reject")) total += 1;
       }
     } catch {
@@ -23982,7 +24414,7 @@ async function runLedgerCensusOnce(session, now) {
     else console.log(line);
     return finding;
   } catch (err) {
-    console.error(`${TAG46} error="${err instanceof Error ? err.message : String(err)}"`);
+    console.error(`${TAG47} error="${err instanceof Error ? err.message : String(err)}"`);
     return null;
   }
 }
@@ -23995,7 +24427,7 @@ function startLedgerCensus(openSession, opts = {}) {
       session = openSession();
     } catch (err) {
       console.error(
-        `${TAG46} open-session-failed error="${err instanceof Error ? err.message : String(err)}"`
+        `${TAG47} open-session-failed error="${err instanceof Error ? err.message : String(err)}"`
       );
       return;
     }
@@ -24003,7 +24435,7 @@ function startLedgerCensus(openSession, opts = {}) {
       await runLedgerCensusOnce(session, Date.now());
     } catch (err) {
       console.error(
-        `${TAG46} tick-failed error="${err instanceof Error ? err.message : String(err)}"`
+        `${TAG47} tick-failed error="${err instanceof Error ? err.message : String(err)}"`
       );
     } finally {
       try {
@@ -24021,7 +24453,7 @@ function startLedgerCensus(openSession, opts = {}) {
 }
 
 // app/lib/conversation-audit.ts
-var TAG47 = "[conversation-audit]";
+var TAG48 = "[conversation-audit]";
 async function runConversationAudit() {
   const session = getSession();
   try {
@@ -24047,12 +24479,12 @@ async function runConversationAudit() {
       unpairable: Number(rec?.get("unpairable") ?? 0)
     };
     console.error(
-      `${TAG47} channel=whatsapp total=${result.total} unreconciled=${result.unreconciled} unpairable=${result.unpairable}`
+      `${TAG48} channel=whatsapp total=${result.total} unreconciled=${result.unreconciled} unpairable=${result.unpairable}`
     );
     return result;
   } catch (err) {
     const reason = err instanceof Error ? `${err.name}:${err.message.slice(0, 200)}` : String(err).slice(0, 200);
-    console.error(`${TAG47} op=failed reason=${reason}`);
+    console.error(`${TAG48} op=failed reason=${reason}`);
     return null;
   } finally {
     await session.close();
@@ -24178,13 +24610,13 @@ function startGraphHealthTimer() {
 
 // app/lib/file-watcher.ts
 import * as fsp2 from "fs/promises";
-import { resolve as resolve30, sep as sep8 } from "path";
+import { resolve as resolve31, sep as sep9 } from "path";
 var ACCOUNT_UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var DEFAULT_COALESCE_MS = 500;
 var ROOTS = ["accounts"];
 function _routeEvent(rootName, filename) {
   if (!filename) return null;
-  const segs = filename.split(sep8).filter(Boolean);
+  const segs = filename.split(sep9).filter(Boolean);
   if (segs.length < 2) return null;
   const accountId = segs[0];
   if (!ACCOUNT_UUID_RE4.test(accountId)) return null;
@@ -24197,7 +24629,7 @@ async function startFileWatcher(opts = {}) {
   const dropFn = opts.drop ?? dropFileIndex;
   for (const r of ROOTS) {
     try {
-      await fsp2.mkdir(resolve30(dataRoot, r), { recursive: true });
+      await fsp2.mkdir(resolve31(dataRoot, r), { recursive: true });
     } catch (err) {
       console.error(
         `[file-watcher] start-failed root="${r}" err="${err.message}" \u2014 index will be maintained by the 5-min reconcile backstop only`
@@ -24218,7 +24650,7 @@ async function startFileWatcher(opts = {}) {
     timers.set(relativePath, t);
   }
   async function runHook(relativePath, accountId) {
-    const absolute = resolve30(dataRoot, relativePath);
+    const absolute = resolve31(dataRoot, relativePath);
     let exists = false;
     try {
       const st = await fsp2.stat(absolute);
@@ -24242,7 +24674,7 @@ async function startFileWatcher(opts = {}) {
     }
   }
   async function watchRoot(rootName) {
-    const absRoot = resolve30(dataRoot, rootName);
+    const absRoot = resolve31(dataRoot, rootName);
     try {
       const iter = fsp2.watch(absRoot, { recursive: true, signal: controller.signal });
       for await (const event of iter) {
@@ -24281,7 +24713,7 @@ async function startFileWatcher(opts = {}) {
 
 // app/lib/migrate-uploads.ts
 import { mkdir as mkdir5, readdir as readdir5, rename as rename2, rm as rm3 } from "fs/promises";
-import { dirname as dirname13, relative as relative6, resolve as resolve31 } from "path";
+import { dirname as dirname13, relative as relative6, resolve as resolve32 } from "path";
 var ACCOUNT_UUID_RE5 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function walkFiles(dir) {
   const out = [];
@@ -24292,7 +24724,7 @@ async function walkFiles(dir) {
     return out;
   }
   for (const e of entries) {
-    const abs = resolve31(dir, e.name);
+    const abs = resolve32(dir, e.name);
     if (e.isDirectory()) {
       out.push(...await walkFiles(abs));
     } else if (e.isFile()) {
@@ -24312,7 +24744,7 @@ async function relocateTree(srcDir, destDir, dataRoot, accountId, session) {
   let moved = 0;
   for (const oldAbs of files) {
     const suffix = relative6(srcDir, oldAbs);
-    const newAbs = resolve31(destDir, suffix);
+    const newAbs = resolve32(destDir, suffix);
     await mkdir5(dirname13(newAbs), { recursive: true });
     await rename2(oldAbs, newAbs);
     moved++;
@@ -24339,7 +24771,7 @@ async function relocateTree(srcDir, destDir, dataRoot, accountId, session) {
 }
 async function migrateUploads(opts = {}) {
   const dataRoot = opts.dataRoot ?? DATA_ROOT;
-  const oldRoot = resolve31(dataRoot, "uploads");
+  const oldRoot = resolve32(dataRoot, "uploads");
   let topEntries;
   try {
     topEntries = await readdir5(oldRoot, { withFileTypes: true });
@@ -24360,8 +24792,8 @@ async function migrateUploads(opts = {}) {
       const name = entry.name;
       if (ACCOUNT_UUID_RE5.test(name)) {
         moved += await relocateTree(
-          resolve31(oldRoot, name),
-          resolve31(dataRoot, "accounts", name, "uploads"),
+          resolve32(oldRoot, name),
+          resolve32(dataRoot, "accounts", name, "uploads"),
           dataRoot,
           name,
           session
@@ -24373,8 +24805,8 @@ async function migrateUploads(opts = {}) {
           continue;
         }
         moved += await relocateTree(
-          resolve31(oldRoot, "public"),
-          resolve31(dataRoot, "accounts", installAccountId, "uploads", "public"),
+          resolve32(oldRoot, "public"),
+          resolve32(dataRoot, "accounts", installAccountId, "uploads", "public"),
           dataRoot,
           null,
           // public uploads carry no graph nodes
@@ -24403,9 +24835,9 @@ async function migrateUploads(opts = {}) {
 }
 
 // app/lib/migrate-admin-webchat-sidecars.ts
-import { readdir as readdir6, readFile as readFile6, rename as rename3, writeFile as writeFile4, unlink as unlink3 } from "fs/promises";
+import { readdir as readdir6, readFile as readFile7, rename as rename3, writeFile as writeFile4, unlink as unlink3 } from "fs/promises";
 import { existsSync as existsSync36 } from "fs";
-import { join as join40 } from "path";
+import { join as join42 } from "path";
 var ADMIN_ROLE2 = "admin";
 var WEBCHAT_CHANNEL2 = "webchat";
 var SESSION_META_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.meta\.json$/i;
@@ -24413,10 +24845,10 @@ var defaultResolveName = async (_accountId, userId) => {
   const res = await loadAdminUserName(userId);
   return res.source === "neo4j" && res.joined.length > 0 ? res.joined : null;
 };
-async function readRaw2(path3) {
+async function readRaw3(path3) {
   let raw;
   try {
-    raw = await readFile6(path3, "utf8");
+    raw = await readFile7(path3, "utf8");
   } catch {
     return null;
   }
@@ -24450,7 +24882,7 @@ async function collectLiveSidecars(projectsRoot) {
   }
   for (const slug of slugs) {
     if (!slug.isDirectory()) continue;
-    const slugDir = join40(projectsRoot, slug.name);
+    const slugDir = join42(projectsRoot, slug.name);
     let entries;
     try {
       entries = await readdir6(slugDir, { withFileTypes: true });
@@ -24459,9 +24891,9 @@ async function collectLiveSidecars(projectsRoot) {
     }
     for (const entry of entries) {
       if (entry.isFile() && SESSION_META_RE.test(entry.name)) {
-        out.push(join40(slugDir, entry.name));
+        out.push(join42(slugDir, entry.name));
       } else if (entry.isDirectory() && entry.name === "subagents") {
-        const subDir = join40(slugDir, entry.name);
+        const subDir = join42(slugDir, entry.name);
         let subs;
         try {
           subs = await readdir6(subDir, { withFileTypes: true });
@@ -24469,7 +24901,7 @@ async function collectLiveSidecars(projectsRoot) {
           continue;
         }
         for (const s of subs) {
-          if (s.isFile() && SESSION_META_RE.test(s.name)) out.push(join40(subDir, s.name));
+          if (s.isFile() && SESSION_META_RE.test(s.name)) out.push(join42(subDir, s.name));
         }
       }
     }
@@ -24481,7 +24913,7 @@ function shortId(path3) {
   return base.slice(0, 8);
 }
 async function migrateAdminWebchatSidecars(opts = {}) {
-  const projectsRoot = opts.projectsRoot ?? (process.env.CLAUDE_CONFIG_DIR ? join40(process.env.CLAUDE_CONFIG_DIR, "projects") : null) ?? "";
+  const projectsRoot = opts.projectsRoot ?? (process.env.CLAUDE_CONFIG_DIR ? join42(process.env.CLAUDE_CONFIG_DIR, "projects") : null) ?? "";
   const usersFile = opts.usersFile ?? USERS_FILE;
   const accountId = opts.accountId ?? resolveAccount()?.accountId ?? null;
   const resolveName = opts.resolveName ?? defaultResolveName;
@@ -24521,7 +24953,7 @@ async function migrateAdminWebchatSidecars(opts = {}) {
   };
   const sidecars = await collectLiveSidecars(projectsRoot);
   for (const path3 of sidecars) {
-    const raw = await readRaw2(path3);
+    const raw = await readRaw3(path3);
     if (!raw) continue;
     if (raw.role !== ADMIN_ROLE2 || raw.channel !== WEBCHAT_CHANNEL2) continue;
     result.scanned++;
@@ -24539,7 +24971,7 @@ async function migrateAdminWebchatSidecars(opts = {}) {
     await writeRaw(path3, raw);
     result.backfilled++;
     await resolveAdminName();
-    const back = await readRaw2(path3);
+    const back = await readRaw3(path3);
     const wrote = back && back.adminUserId === soleAdminUserId;
     if (wrote && resolvedNameForAdmin) {
       result.resolvedName++;
@@ -24826,8 +25258,8 @@ var streamSSE = (c, cb, onError) => {
 
 // app/lib/whatsapp/gateway/routes.ts
 function createWaChannelRoutes(deps) {
-  const app64 = new Hono();
-  app64.get("/wa-channel/inbound", (c) => {
+  const app65 = new Hono();
+  app65.get("/wa-channel/inbound", (c) => {
     const senderId = c.req.query("senderId");
     if (!senderId) return c.json({ error: "senderId required" }, 400);
     return streamSSE(c, async (stream2) => {
@@ -24835,9 +25267,11 @@ function createWaChannelRoutes(deps) {
         void stream2.writeSSE({ data: JSON.stringify(payload) });
       });
       console.error(`[whatsapp-native] op=channel-attached senderId=${senderId}`);
+      deps.onAttached?.(senderId);
       stream2.onAbort(() => {
         deps.hub.detach(senderId);
         console.error(`[whatsapp-native] op=channel-detached senderId=${senderId}`);
+        deps.onDetached?.(senderId);
       });
       while (!stream2.aborted) {
         await stream2.sleep(15e3);
@@ -24845,7 +25279,7 @@ function createWaChannelRoutes(deps) {
       }
     });
   });
-  app64.post("/wa-channel/reply", async (c) => {
+  app65.post("/wa-channel/reply", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const text = body?.text;
@@ -24866,7 +25300,7 @@ function createWaChannelRoutes(deps) {
     console.error(`[whatsapp-native] op=reply-dispatch senderId=${senderId} bytes=${bytes}`);
     return c.json({ ok: true });
   });
-  app64.post("/wa-channel/reply-document", async (c) => {
+  app65.post("/wa-channel/reply-document", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const files = body?.files;
@@ -24905,7 +25339,7 @@ function createWaChannelRoutes(deps) {
     }
     return c.json({ ok: true, results });
   });
-  app64.post("/wa-channel/ready", async (c) => {
+  app65.post("/wa-channel/ready", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     if (typeof senderId !== "string") {
@@ -24914,7 +25348,7 @@ function createWaChannelRoutes(deps) {
     deps.onReady?.(senderId);
     return c.json({ ok: true });
   });
-  app64.post("/wa-channel/received", async (c) => {
+  app65.post("/wa-channel/received", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const waMessageId = body?.waMessageId;
@@ -24924,7 +25358,7 @@ function createWaChannelRoutes(deps) {
     deps.onReceived?.(senderId, waMessageId);
     return c.json({ ok: true });
   });
-  app64.post("/wa-channel/turn-end", async (c) => {
+  app65.post("/wa-channel/turn-end", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const sessionId = body?.sessionId;
@@ -24957,7 +25391,7 @@ function createWaChannelRoutes(deps) {
     console.error(`[whatsapp-native] op=turn-end sessionId=${sid} replied=no delivered=none`);
     return c.json({ ok: true, delivered: "none" });
   });
-  return app64;
+  return app65;
 }
 
 // app/lib/whatsapp/gateway/wa-gateway.ts
@@ -24979,9 +25413,30 @@ var WaGateway = class {
   spawning = /* @__PURE__ */ new Set();
   seq = 0;
   /** Hono sub-app exposing the loopback channel routes; mount on the UI app. */
+  /** Task 1789 — senderId -> the ms at which its channel server last detached,
+   *  cleared on attach. The standing audit reads this; nothing else does. */
+  detachedAt = /* @__PURE__ */ new Map();
+  /** Seat lost. `atMs` is injected so the audit's accounting is testable. */
+  recordDetached(senderId, atMs) {
+    this.detachedAt.set(senderId, atMs);
+  }
+  /** Seat regained — the sender is no longer unseated. */
+  recordAttached(senderId) {
+    this.detachedAt.delete(senderId);
+  }
+  /** Senders with no channel server for longer than `olderThanMs`. */
+  unseatedSenders(nowMs, olderThanMs) {
+    const out = [];
+    for (const [senderId, sinceMs] of this.detachedAt) {
+      if (nowMs - sinceMs > olderThanMs) out.push({ senderId, sinceMs });
+    }
+    return out.sort((a, b) => a.senderId.localeCompare(b.senderId));
+  }
   routes() {
     return createWaChannelRoutes({
       hub: this.hub,
+      onAttached: (senderId) => this.recordAttached(senderId),
+      onDetached: (senderId) => this.recordDetached(senderId, Date.now()),
       sendOutbound: (senderId, text) => this.sendOutbound(senderId, text),
       sendDocument: (senderId, filePath, caption) => this.sendDocument(senderId, filePath, caption),
       onReady: (senderId) => {
@@ -25092,7 +25547,7 @@ var WaGateway = class {
       },
       Date.now()
     );
-    const resolvedSessionId = adminSessionIdFor(
+    const resolvedSessionId = (input.role === "admin" ? this.deps.resolveSessionOverride?.(input.effectiveAccountId, senderId) : null) || adminSessionIdFor(
       input.effectiveAccountId,
       senderId,
       input.role === "public" && input.personId ? input.personId : void 0
@@ -25160,17 +25615,28 @@ function logDuplicateSenderGroups(groups) {
     );
   }
 }
+function logUnseatedSenders(entries, nowMs) {
+  for (const e of entries) {
+    const secs = Math.round((nowMs - e.sinceMs) / 1e3);
+    console.error(`[whatsapp-native] op=sender-unseated senderId=${e.senderId} since=${new Date(e.sinceMs).toISOString()} forSeconds=${secs}`);
+  }
+}
 
 // app/lib/whatsapp/gateway/spawn-request.ts
 function buildWaSpawnRequest(input) {
   const personId = input.role === "public" && input.personId ? input.personId : void 0;
   return {
-    // Task 1746 — the deterministic per-sender id is the ONLY id a sender's
-    // session ever has. Task 1526's per-firing seat override used to replace it
-    // on a scheduled cold start, which spawned a second session for the sender;
-    // that session then attached under the sender's own hub key and swallowed
-    // their real messages until it detached, splitting the conversation in two.
-    sessionId: adminSessionIdFor(input.accountId, input.senderId, personId),
+    // Task 1746 — the deterministic per-sender id is the DEFAULT id a sender's
+    // session has. Task 1526's per-firing seat override used to replace it on a
+    // scheduled cold start, which spawned a second session per firing; that
+    // session then attached under the sender's own hub key and swallowed their
+    // real messages until it detached, splitting the conversation in two.
+    //
+    // Task 1789's override is not that. It is a stable per-sender forward
+    // pointer written once by an operator re-seat and resolving identically for
+    // every subsequent inbound, so it can never yield a second id for a sender.
+    // Do not remove it without reading server/channel-session-override.ts.
+    sessionId: input.overrideSessionId || adminSessionIdFor(input.accountId, input.senderId, personId),
     role: input.role,
     channel: "whatsapp",
     personId,
@@ -25354,8 +25820,8 @@ var import_dist7 = __toESM(require_dist(), 1);
 
 // app/lib/webchat/gateway/routes.ts
 function createWebchatChannelRoutes(deps) {
-  const app64 = new Hono();
-  app64.get("/webchat-channel/inbound", (c) => {
+  const app65 = new Hono();
+  app65.get("/webchat-channel/inbound", (c) => {
     const key = c.req.query("key");
     if (!key) return c.json({ error: "key required" }, 400);
     return streamSSE(c, async (stream2) => {
@@ -25373,7 +25839,7 @@ function createWebchatChannelRoutes(deps) {
       }
     });
   });
-  app64.post("/webchat-channel/reply", async (c) => {
+  app65.post("/webchat-channel/reply", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const text = body?.text;
@@ -25383,7 +25849,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onReply?.(key, text);
     return c.json({ ok: true });
   });
-  app64.post("/webchat-channel/connector-auth", async (c) => {
+  app65.post("/webchat-channel/connector-auth", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const sessionId = body?.sessionId;
@@ -25396,7 +25862,7 @@ function createWebchatChannelRoutes(deps) {
     const result = await deps.onConnectorAuth({ key, sessionId, name, completed });
     return c.json(result);
   });
-  app64.post("/webchat-channel/ready", async (c) => {
+  app65.post("/webchat-channel/ready", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     if (typeof key !== "string") {
@@ -25405,7 +25871,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onReady?.(key);
     return c.json({ ok: true });
   });
-  app64.post("/webchat-channel/permission-request", async (c) => {
+  app65.post("/webchat-channel/permission-request", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const requestId = body?.request_id;
@@ -25419,7 +25885,7 @@ function createWebchatChannelRoutes(deps) {
     const verdict = await deps.awaitPermissionVerdict({ key, requestId, toolName, description, inputPreview });
     return c.json(verdict);
   });
-  app64.post("/webchat-channel/received", async (c) => {
+  app65.post("/webchat-channel/received", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const messageId = body?.messageId;
@@ -25429,7 +25895,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onReceived?.(key, messageId);
     return c.json({ ok: true });
   });
-  app64.post("/webchat-channel/turn-end", async (c) => {
+  app65.post("/webchat-channel/turn-end", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const sessionId = body?.sessionId;
@@ -25452,7 +25918,7 @@ function createWebchatChannelRoutes(deps) {
     console.error(`[webchat-native] op=turn-end channel=webchat key=${k} sessionId=${sid} replied=no delivered=none`);
     return c.json({ ok: true, delivered: "none" });
   });
-  return app64;
+  return app65;
 }
 
 // app/lib/webchat/gateway/webchat-gateway.ts
@@ -25510,16 +25976,16 @@ var WebchatGateway = class _WebchatGateway {
    *  The public /api/chat route awaits this to return the reply on the same SSE
    *  response, preserving the pre-756 POST→single-blob browser contract. */
   awaitReply(key, timeoutMs) {
-    return new Promise((resolve37) => {
+    return new Promise((resolve38) => {
       const timer = setTimeout(() => {
         this.replyAwaiters.delete(key);
-        resolve37({ timeout: true });
+        resolve38({ timeout: true });
       }, timeoutMs);
       if (timer.unref) timer.unref();
       this.replyAwaiters.set(key, (r) => {
         clearTimeout(timer);
         this.replyAwaiters.delete(key);
-        resolve37(r);
+        resolve38(r);
       });
     });
   }
@@ -25530,11 +25996,11 @@ var WebchatGateway = class _WebchatGateway {
    *  terminal dialog stays answerable). */
   awaitPermissionVerdict(p, timeoutMs) {
     const k = _WebchatGateway.promptKey(p.key, p.requestId);
-    return new Promise((resolve37) => {
+    return new Promise((resolve38) => {
       this.pendingPrompts.get(k)?.resolve({ timeout: true });
       const timer = setTimeout(() => {
         this.pendingPrompts.delete(k);
-        resolve37({ timeout: true });
+        resolve38({ timeout: true });
       }, timeoutMs);
       if (timer.unref) timer.unref();
       this.pendingPrompts.set(k, {
@@ -25543,7 +26009,7 @@ var WebchatGateway = class _WebchatGateway {
         resolve: (r) => {
           clearTimeout(timer);
           this.pendingPrompts.delete(k);
-          resolve37(r);
+          resolve38(r);
         }
       });
       console.error(`[webchat:perm] op=open key=${keyDisplay(p.key)} id=${p.requestId} tool=${p.toolName}`);
@@ -26108,7 +26574,7 @@ async function fanOut(subscribers, text, onError, tag) {
 
 // app/lib/webchat/file-delivery.ts
 import { realpathSync as realpathSync8 } from "fs";
-import { resolve as resolve32 } from "path";
+import { resolve as resolve33 } from "path";
 
 // app/lib/channel-pty-bridge/file-delivery.ts
 var SEND_USER_FILE = "SendUserFile";
@@ -26199,29 +26665,29 @@ function makeFileDelivery(opts) {
 }
 
 // app/lib/webchat/file-delivery.ts
-var TAG48 = "[webchat-adaptor]";
+var TAG49 = "[webchat-adaptor]";
 function platformRoot2() {
   return process.env.MAXY_PLATFORM_ROOT || "";
 }
 function makeWebchatSendFile(entry) {
   return async (filePath) => {
     if (!entry.accountId) {
-      console.error(`${TAG48} file-delivery reject reason=no-account sender=${entry.senderId}`);
+      console.error(`${TAG49} file-delivery reject reason=no-account sender=${entry.senderId}`);
       return { ok: false, error: "no-account" };
     }
-    const accountDir = resolve32(platformRoot2(), "..", "data/accounts", entry.accountId);
+    const accountDir = resolve33(platformRoot2(), "..", "data/accounts", entry.accountId);
     try {
       const resolved = realpathSync8(filePath);
       const accountResolved = realpathSync8(accountDir);
       if (!resolved.startsWith(accountResolved + "/")) {
-        console.error(`${TAG48} file-delivery reject reason=outside_account_directory sender=${entry.senderId}`);
+        console.error(`${TAG49} file-delivery reject reason=outside_account_directory sender=${entry.senderId}`);
         return { ok: false, error: "outside-account" };
       }
       return { ok: true };
     } catch (err) {
       const code = err.code;
       console.error(
-        `${TAG48} file-delivery reject reason=${code === "ENOENT" ? "not-found" : "path-error"} sender=${entry.senderId}`
+        `${TAG49} file-delivery reject reason=${code === "ENOENT" ? "not-found" : "path-error"} sender=${entry.senderId}`
       );
       return { ok: false, error: code === "ENOENT" ? "not-found" : "path-error" };
     }
@@ -26230,7 +26696,7 @@ function makeWebchatSendFile(entry) {
 function makeWebchatFileDelivery(entry) {
   return makeFileDelivery({
     entry,
-    tag: TAG48,
+    tag: TAG49,
     channel: "webchat",
     sendFile: makeWebchatSendFile(entry),
     deferUntilVerdict: true
@@ -26292,7 +26758,7 @@ function buildPublicWebchatSpawnRequest(input) {
 }
 
 // app/lib/whatsapp/inbound/file-delivery-bridge.ts
-var TAG49 = "[whatsapp-adaptor]";
+var TAG50 = "[whatsapp-adaptor]";
 var SEND_USER_FILE2 = "SendUserFile";
 var WHATSAPP_SEND_DOCUMENT = "whatsapp-send-document";
 function platformRoot3() {
@@ -26310,7 +26776,7 @@ function makeWhatsAppSendFile(entry, maxyAccountId) {
     });
     if (result.ok) return { ok: true };
     console.error(
-      `${TAG49} file-delivery reject reason=send-failed sender=${entry.senderId} status=${result.status} message=${result.error}`
+      `${TAG50} file-delivery reject reason=send-failed sender=${entry.senderId} status=${result.status} message=${result.error}`
     );
     return { ok: false, error: result.error };
   };
@@ -26318,7 +26784,7 @@ function makeWhatsAppSendFile(entry, maxyAccountId) {
 function makeWhatsAppFileDelivery(entry, maxyAccountId) {
   const shared = makeFileDelivery({
     entry,
-    tag: TAG49,
+    tag: TAG50,
     channel: "whatsapp",
     sendFile: makeWhatsAppSendFile(entry, maxyAccountId)
   });
@@ -26353,7 +26819,7 @@ function makeWhatsAppFileDelivery(entry, maxyAccountId) {
         if (!delivered) {
           const fileField = call.filePath !== void 0 ? ` file=${call.filePath}` : "";
           console.error(
-            `${TAG49} file-delivery-unreconciled sender=${entry.senderId} sessionId=${sid} tool=${WHATSAPP_SEND_DOCUMENT}${fileField}`
+            `${TAG50} file-delivery-unreconciled sender=${entry.senderId} sessionId=${sid} tool=${WHATSAPP_SEND_DOCUMENT}${fileField}`
           );
         }
       }
@@ -26539,8 +27005,8 @@ var import_dist8 = __toESM(require_dist(), 1);
 
 // app/lib/telegram/gateway/routes.ts
 function createTelegramChannelRoutes(deps) {
-  const app64 = new Hono();
-  app64.get("/tg-channel/inbound", (c) => {
+  const app65 = new Hono();
+  app65.get("/tg-channel/inbound", (c) => {
     const key = c.req.query("key");
     if (!key) return c.json({ error: "key required" }, 400);
     return streamSSE(c, async (stream2) => {
@@ -26558,7 +27024,7 @@ function createTelegramChannelRoutes(deps) {
       }
     });
   });
-  app64.post("/tg-channel/reply", async (c) => {
+  app65.post("/tg-channel/reply", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const text = body?.text;
@@ -26574,7 +27040,7 @@ function createTelegramChannelRoutes(deps) {
     console.error(`[telegram-native] op=reply key=${key} bytes=${Buffer.byteLength(text, "utf8")}`);
     return c.json({ ok: true });
   });
-  app64.post("/tg-channel/ready", async (c) => {
+  app65.post("/tg-channel/ready", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     if (typeof key !== "string") {
@@ -26583,7 +27049,7 @@ function createTelegramChannelRoutes(deps) {
     deps.onReady?.(key);
     return c.json({ ok: true });
   });
-  app64.post("/tg-channel/received", async (c) => {
+  app65.post("/tg-channel/received", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const messageId = body?.messageId;
@@ -26593,7 +27059,7 @@ function createTelegramChannelRoutes(deps) {
     deps.onReceived?.(key, messageId);
     return c.json({ ok: true });
   });
-  app64.post("/tg-channel/turn-end", async (c) => {
+  app65.post("/tg-channel/turn-end", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const sessionId = body?.sessionId;
@@ -26626,7 +27092,7 @@ function createTelegramChannelRoutes(deps) {
     console.error(`[telegram-native] op=turn-end key=${key} sessionId=${sid} replied=no delivered=none`);
     return c.json({ ok: true, delivered: "none" });
   });
-  return app64;
+  return app65;
 }
 
 // app/lib/telegram/gateway/telegram-gateway.ts
@@ -26717,7 +27183,7 @@ var TelegramGateway = class {
       { key: input.senderId, text: input.text, messageId: `tg-${++this.seq}`, source, standingRules, scheduleProvenance: input.scheduleProvenance },
       Date.now()
     );
-    const resolvedSessionId = adminSessionIdFor(
+    const resolvedSessionId = (input.role === "admin" ? this.deps.resolveSessionOverride?.(input.accountId, input.senderId) : null) || adminSessionIdFor(
       input.accountId,
       input.senderId,
       input.role === "public" && input.personId ? input.personId : void 0
@@ -26754,10 +27220,11 @@ var TelegramGateway = class {
 function buildTelegramSpawnRequest(input) {
   const personId = input.role === "public" && input.personId ? input.personId : void 0;
   return {
-    // Task 1746 — the deterministic per-sender id is the ONLY id a sender's
-    // session ever has. Mirror of the WhatsApp builder; see its comment for why
-    // Task 1526's per-firing override was removed.
-    sessionId: adminSessionIdFor(input.accountId, input.senderId, personId),
+    // Task 1746 / 1789 — the deterministic per-sender id is the DEFAULT; an
+    // operator re-seat sets a stable per-sender forward pointer that wins here.
+    // Mirror of the WhatsApp builder; see its comment for the full distinction
+    // between this pointer and Task 1526's removed per-firing seat.
+    sessionId: input.overrideSessionId || adminSessionIdFor(input.accountId, input.senderId, personId),
     role: input.role,
     channel: "telegram",
     personId,
@@ -26774,9 +27241,9 @@ function buildTelegramSpawnRequest(input) {
 
 // app/lib/telegram/outbound/send-document.ts
 import { realpathSync as realpathSync9 } from "fs";
-import { readFile as readFile7, stat as stat7 } from "fs/promises";
-import { resolve as resolve33, basename as basename11 } from "path";
-var TAG50 = "[telegram:outbound]";
+import { readFile as readFile8, stat as stat8 } from "fs/promises";
+import { resolve as resolve34, basename as basename11 } from "path";
+var TAG51 = "[telegram:outbound]";
 var TELEGRAM_DOCUMENT_MAX_BYTES = 50 * 1024 * 1024;
 async function sendTelegramDocument(input) {
   const { botToken, chatId, filePath, caption, maxyAccountId, platformRoot: platformRoot5 } = input;
@@ -26786,25 +27253,25 @@ async function sendTelegramDocument(input) {
   if (!maxyAccountId || !platformRoot5) {
     return { ok: false, status: 400, error: "Cannot validate file path: missing account or platform context" };
   }
-  const accountDir = resolve33(platformRoot5, "..", "data/accounts", maxyAccountId);
+  const accountDir = resolve34(platformRoot5, "..", "data/accounts", maxyAccountId);
   let resolvedPath;
   try {
     resolvedPath = realpathSync9(filePath);
     const accountResolved = realpathSync9(accountDir);
     if (!resolvedPath.startsWith(accountResolved + "/")) {
-      console.error(`${TAG50} document REJECTED reason=outside_account_directory maxyAccountId=${maxyAccountId}`);
+      console.error(`${TAG51} document REJECTED reason=outside_account_directory maxyAccountId=${maxyAccountId}`);
       return { ok: false, status: 403, error: "Access denied: file is outside the account directory" };
     }
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
-      console.error(`${TAG50} document ENOENT path=${filePath}`);
+      console.error(`${TAG51} document ENOENT path=${filePath}`);
       return { ok: false, status: 404, error: `File not found: ${filePath}` };
     }
-    console.error(`${TAG50} document path error: ${String(err)}`);
+    console.error(`${TAG51} document path error: ${String(err)}`);
     return { ok: false, status: 500, error: String(err) };
   }
-  const fileStat = await stat7(resolvedPath);
+  const fileStat = await stat8(resolvedPath);
   if (fileStat.size > TELEGRAM_DOCUMENT_MAX_BYTES) {
     return {
       ok: false,
@@ -26813,7 +27280,7 @@ async function sendTelegramDocument(input) {
     };
   }
   const filename = basename11(resolvedPath);
-  const buffer = Buffer.from(await readFile7(resolvedPath));
+  const buffer = Buffer.from(await readFile8(resolvedPath));
   const form = new FormData();
   form.append("chat_id", String(chatId));
   if (caption) form.append("caption", caption);
@@ -26834,13 +27301,13 @@ async function sendTelegramDocument(input) {
     error = e instanceof Error ? e.message : String(e);
   }
   console.error(
-    `${TAG50} sent document to=${chatId} file=${filename} bytes=${fileStat.size} ok=${ok}` + (messageId !== void 0 ? ` id=${messageId}` : "")
+    `${TAG51} sent document to=${chatId} file=${filename} bytes=${fileStat.size} ok=${ok}` + (messageId !== void 0 ? ` id=${messageId}` : "")
   );
   return ok ? { ok: true, messageId } : { ok: false, status: 500, error };
 }
 
 // app/lib/telegram/outbound/file-delivery.ts
-var TAG51 = "[telegram:outbound]";
+var TAG52 = "[telegram:outbound]";
 function platformRoot4() {
   return process.env.MAXY_PLATFORM_ROOT || "";
 }
@@ -26852,11 +27319,11 @@ function makeTelegramSendFile(entry) {
       botToken = (entry.role === "admin" ? tg?.adminBotToken : tg?.publicBotToken) ?? null;
     }
     if (!botToken) {
-      console.error(`${TAG51} file-delivery reject reason=no-bot-token sender=${entry.senderId} role=${entry.role}`);
+      console.error(`${TAG52} file-delivery reject reason=no-bot-token sender=${entry.senderId} role=${entry.role}`);
       return { ok: false, error: "no-bot-token" };
     }
     if (entry.replyTarget == null) {
-      console.error(`${TAG51} file-delivery reject reason=no-reply-target sender=${entry.senderId} role=${entry.role}`);
+      console.error(`${TAG52} file-delivery reject reason=no-reply-target sender=${entry.senderId} role=${entry.role}`);
       return { ok: false, error: "no-reply-target" };
     }
     const result = await sendTelegramDocument({
@@ -26873,7 +27340,7 @@ function makeTelegramSendFile(entry) {
 function makeTelegramFileDelivery(entry) {
   return makeFileDelivery({
     entry,
-    tag: TAG51,
+    tag: TAG52,
     channel: "telegram",
     sendFile: makeTelegramSendFile(entry)
   });
@@ -26913,17 +27380,17 @@ function startTelegramNativeFileFollower(input) {
 }
 
 // server/telegram-descriptor.ts
-import { resolve as resolve34, join as join41 } from "path";
+import { resolve as resolve35, join as join43 } from "path";
 function telegramGatewayUrl() {
   return `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`;
 }
 function telegramServerPath() {
-  return process.env.MAXY_TELEGRAM_CHANNEL_SERVER_PATH ?? resolve34(process.env.MAXY_PLATFORM_ROOT ?? join41(__dirname, ".."), "services/telegram-channel/dist/server.js");
+  return process.env.MAXY_TELEGRAM_CHANNEL_SERVER_PATH ?? resolve35(process.env.MAXY_PLATFORM_ROOT ?? join43(__dirname, ".."), "services/telegram-channel/dist/server.js");
 }
 
 // app/lib/channel-pty-bridge/public-session-end-review.ts
 import { randomUUID as randomUUID16 } from "crypto";
-var TAG52 = "[public-session-review]";
+var TAG53 = "[public-session-review]";
 var CONSUMED_CAP = 500;
 var consumed = /* @__PURE__ */ new Set();
 function consumeOnce(sessionId) {
@@ -26950,7 +27417,7 @@ async function fetchJsonl(sessionId) {
     return await res.text();
   } catch (err) {
     console.error(
-      `${TAG52} jsonl-fetch-failed sessionId=${sessionId} err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG53} jsonl-fetch-failed sessionId=${sessionId} err="${err instanceof Error ? err.message : String(err)}"`
     );
     return null;
   }
@@ -26974,7 +27441,7 @@ async function fetchPriorWrites(sliceToken, accountId) {
     const res = await fetch(url);
     if (!res.ok) {
       console.error(
-        `${TAG52} prior-writes-fetch-failed sliceToken=${sliceToken.slice(0, 8)} status=${res.status}`
+        `${TAG53} prior-writes-fetch-failed sliceToken=${sliceToken.slice(0, 8)} status=${res.status}`
       );
       return [];
     }
@@ -26982,7 +27449,7 @@ async function fetchPriorWrites(sliceToken, accountId) {
     return Array.isArray(body.writes) ? body.writes : [];
   } catch (err) {
     console.error(
-      `${TAG52} prior-writes-fetch-threw sliceToken=${sliceToken.slice(0, 8)} err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG53} prior-writes-fetch-threw sliceToken=${sliceToken.slice(0, 8)} err="${err instanceof Error ? err.message : String(err)}"`
     );
     return [];
   }
@@ -27011,7 +27478,7 @@ function composeInitialMessage(input) {
 }
 async function dispatchReviewer(input, initialMessage) {
   const sessionId = randomUUID16();
-  console.log(`${TAG52} route target=rc-spawn sessionId=${sessionId.slice(0, 8)} sourceSession=${input.sessionId.slice(0, 8)}`);
+  console.log(`${TAG53} route target=rc-spawn sessionId=${sessionId.slice(0, 8)} sourceSession=${input.sessionId.slice(0, 8)}`);
   const spawned = await managerRcSpawn({
     sessionId,
     initialMessage,
@@ -27031,21 +27498,21 @@ async function firePublicSessionEndReview(input) {
   const dispatchedAt = Date.now();
   if (consumed.has(input.sessionId)) {
     console.log(
-      `${TAG52} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
+      `${TAG53} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
     );
     return;
   }
   const jsonl = await fetchJsonl(input.sessionId);
   if (!jsonl) {
     console.log(
-      `${TAG52} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-jsonl-missing`
+      `${TAG53} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-jsonl-missing`
     );
     return;
   }
   const operatorTurns = countOperatorTurns(jsonl);
   if (operatorTurns === 0) {
     console.log(
-      `${TAG52} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-no-turns`
+      `${TAG53} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-no-turns`
     );
     return;
   }
@@ -27059,19 +27526,19 @@ async function firePublicSessionEndReview(input) {
   });
   if (!consumeOnce(input.sessionId)) {
     console.log(
-      `${TAG52} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
+      `${TAG53} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
     );
     return;
   }
   const dispatched = await dispatchReviewer(input, initialMessage);
   if (!dispatched.ok) {
     console.error(
-      `${TAG52} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-spawn-failed reason=${dispatched.reason}`
+      `${TAG53} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-spawn-failed reason=${dispatched.reason}`
     );
     return;
   }
   console.log(
-    `${TAG52} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=dispatched managerSessionId=${dispatched.managerSessionId} operatorTurns=${operatorTurns} priorWrites=${priorWrites.length} ms=${Date.now() - dispatchedAt}`
+    `${TAG53} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=dispatched managerSessionId=${dispatched.managerSessionId} operatorTurns=${operatorTurns} priorWrites=${priorWrites.length} ms=${Date.now() - dispatchedAt}`
   );
 }
 
@@ -27205,8 +27672,8 @@ function broadcastAdminShutdown(reason) {
 
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash6, verify as cryptoVerify } from "crypto";
-import { existsSync as existsSync37, readFileSync as readFileSync40, statSync as statSync16 } from "fs";
-import { resolve as resolve35 } from "path";
+import { existsSync as existsSync37, readFileSync as readFileSync41, statSync as statSync16 } from "fs";
+import { resolve as resolve36 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
 function canonicalize(value) {
@@ -27241,7 +27708,7 @@ var PUBKEY_SHA256 = "8eee6bcb33545fd13b16d3199a5735ca5db5062834c7b49dfe4f23801d9
 var GRACE_DAYS = 7;
 var GRACE_MS = GRACE_DAYS * 24 * 60 * 60 * 1e3;
 function pubkeyPath(brand) {
-  return resolve35(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
+  return resolve36(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
 }
 var memo = null;
 function memoKey(mtimeMs, account) {
@@ -27253,12 +27720,12 @@ function resolveEntitlement(brand, account) {
   if (brand.commercialMode !== true) {
     return logResolved(implicitTrust(account), null);
   }
-  const entitlementPath = resolve35(brand.configDir, "entitlement.json");
+  const entitlementPath = resolve36(brand.configDir, "entitlement.json");
   if (!existsSync37(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
-  const stat8 = statSync16(entitlementPath);
-  const key = memoKey(stat8.mtimeMs, account);
+  const stat9 = statSync16(entitlementPath);
+  const key = memoKey(stat9.mtimeMs, account);
   if (memo && memo.key === key) {
     return memo.result;
   }
@@ -27269,7 +27736,7 @@ function resolveEntitlement(brand, account) {
 function verifyAndResolve(brand, entitlementPath, account) {
   let pubkeyPem;
   try {
-    pubkeyPem = readFileSync40(pubkeyPath(brand), "utf-8");
+    pubkeyPem = readFileSync41(pubkeyPath(brand), "utf-8");
   } catch (err) {
     return logResolved(anonymousFallback("pubkey-missing"), {
       reason: "pubkey-missing"
@@ -27283,7 +27750,7 @@ function verifyAndResolve(brand, entitlementPath, account) {
   }
   let envelope;
   try {
-    envelope = JSON.parse(readFileSync40(entitlementPath, "utf-8"));
+    envelope = JSON.parse(readFileSync41(entitlementPath, "utf-8"));
   } catch {
     return logResolved(anonymousFallback("malformed"), { reason: "malformed" });
   }
@@ -27445,14 +27912,14 @@ function clientFrom(c) {
 }
 installMediaDownloadGuard();
 var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT || "";
-var BRAND_JSON_PATH = PLATFORM_ROOT8 ? join42(PLATFORM_ROOT8, "config", "brand.json") : "";
+var BRAND_JSON_PATH = PLATFORM_ROOT8 ? join44(PLATFORM_ROOT8, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", marketingUrl: "https://getmaxy.com" };
 if (BRAND_JSON_PATH && !existsSync38(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
 }
 if (BRAND_JSON_PATH && existsSync38(BRAND_JSON_PATH)) {
   try {
-    const parsed = JSON.parse(readFileSync41(BRAND_JSON_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync42(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
   } catch (err) {
     console.error(`[brand] Failed to parse brand.json: ${err.message}`);
@@ -27484,11 +27951,11 @@ var brandLoginOpts = {
   appleTouchIconPath: brandAppIcon512Path,
   themeColor: BRAND.defaultColors?.primary
 };
-var ALIAS_DOMAINS_PATH = join42(homedir4(), BRAND.configDir, "alias-domains.json");
+var ALIAS_DOMAINS_PATH = join44(homedir4(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
     if (!existsSync38(ALIAS_DOMAINS_PATH)) return null;
-    const parsed = JSON.parse(readFileSync41(ALIAS_DOMAINS_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync42(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
       return null;
@@ -27512,7 +27979,15 @@ watchFile(ALIAS_DOMAINS_PATH, { interval: 2e3 }, () => {
 function isPublicHost(host) {
   return host.startsWith("public.") || aliasDomains.has(host);
 }
-var app63 = new Hono();
+var app64 = new Hono();
+function resolveChannelOverride(accountId, channel, senderId) {
+  try {
+    const dir = listValidAccounts().find((a) => a.accountId === accountId)?.accountDir;
+    return dir ? readChannelOverrideId(dir, channel, senderId) : null;
+  } catch {
+    return null;
+  }
+}
 var nativeFileFollowers = /* @__PURE__ */ new Map();
 var webchatFileFollowers = /* @__PURE__ */ new Map();
 async function fetchAccountStandingRules(accountId) {
@@ -27551,8 +28026,9 @@ async function recordPassiveDispatch(input) {
 }
 var waGateway = new WaGateway({
   fetchStandingRules: fetchAccountStandingRules,
+  resolveSessionOverride: (accountId, senderId) => resolveChannelOverride(accountId, "whatsapp", senderId),
   gatewayUrl: `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`,
-  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve36(process.env.MAXY_PLATFORM_ROOT ?? join42(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
+  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve37(process.env.MAXY_PLATFORM_ROOT ?? join44(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
   // Task 751 / 1390 — file delivery on the native channel. `maxyAccountId` (the
   // path-validation scope) is the sender's effective SESSION account, resolved
   // once at the inbound gate and threaded here via the gateway's per-sender doc
@@ -27567,7 +28043,7 @@ var waGateway = new WaGateway({
       caption,
       accountId,
       maxyAccountId,
-      platformRoot: resolve36(process.env.MAXY_PLATFORM_ROOT ?? join42(__dirname, ".."))
+      platformRoot: resolve37(process.env.MAXY_PLATFORM_ROOT ?? join44(__dirname, ".."))
     });
     return result.ok ? { ok: true, messageId: result.messageId } : { ok: false, error: result.error };
   },
@@ -27619,7 +28095,17 @@ var waGateway = new WaGateway({
       const managesAccount = effectiveAccountId !== accountId ? effectiveAccountId : "none";
       console.error(`[whatsapp-native] op=account-manager-route senderId=${senderId} managesAccount=${managesAccount} effectiveAccount=${effectiveAccountId} source=gate`);
     }
-    const req = buildWaSpawnRequest({ accountId: effectiveAccountId, senderId, role, personId, gatewayUrl, serverPath });
+    const req = buildWaSpawnRequest({
+      accountId: effectiveAccountId,
+      senderId,
+      role,
+      personId,
+      gatewayUrl,
+      serverPath,
+      // Task 1789 — admin rows only: a public session's id keys on personId as
+      // well as senderId, so the per-sender pointer is not applicable to it.
+      overrideSessionId: role === "admin" ? resolveChannelOverride(effectiveAccountId, "whatsapp", senderId) : null
+    });
     await ensureSessionConversation({
       accountId: effectiveAccountId,
       sessionId: req.sessionId,
@@ -27665,13 +28151,13 @@ var waGateway = new WaGateway({
     nativeFileFollowers.set(senderId, ac);
   }
 });
-app63.route("/", waGateway.routes());
+app64.route("/", waGateway.routes());
 waGateway.startSweeper();
 function runDuplicateSenderAudit() {
   try {
     const configDir2 = process.env.CLAUDE_CONFIG_DIR;
     if (!configDir2) return;
-    const projectsRoot = join42(configDir2, "projects");
+    const projectsRoot = join44(configDir2, "projects");
     const records = [];
     for (const { path: jsonlPath, isSubagent, archived } of enumerateJsonls(projectsRoot)) {
       if (isSubagent || archived) continue;
@@ -27681,6 +28167,8 @@ function runDuplicateSenderAudit() {
       records.push({ sessionId, channel: meta.channel, senderId: meta.senderId, accountId: meta.accountId });
     }
     logDuplicateSenderGroups(findDuplicateSenderGroups(records));
+    const now = Date.now();
+    logUnseatedSenders(waGateway.unseatedSenders(now, 15 * 6e4), now);
   } catch (err) {
     console.error(`[whatsapp-native] op=duplicate-sender-audit-error error=${err instanceof Error ? err.message : String(err)}`);
   }
@@ -27787,16 +28275,26 @@ var webchatGateway = new WebchatGateway({
   firePublicSessionEndReview: (input) => firePublicSessionEndReview(input)
 });
 setWebchatGateway(webchatGateway);
-app63.route("/", webchatGateway.routes());
+app64.route("/", webchatGateway.routes());
 webchatGateway.startSweeper();
 webchatGateway.startPublicReaper();
 var telegramFileFollowers = /* @__PURE__ */ new Map();
 var telegramGateway = new TelegramGateway({
   fetchStandingRules: fetchAccountStandingRules,
+  resolveSessionOverride: (accountId, senderId) => resolveChannelOverride(accountId, "telegram", senderId),
   gatewayUrl: telegramGatewayUrl(),
   serverPath: telegramServerPath(),
   ensureChannelSession: async ({ accountId, senderId, role, personId, chatId, gatewayUrl, serverPath }) => {
-    const req = buildTelegramSpawnRequest({ accountId, senderId, role, personId, gatewayUrl, serverPath });
+    const req = buildTelegramSpawnRequest({
+      accountId,
+      senderId,
+      role,
+      personId,
+      gatewayUrl,
+      serverPath,
+      // Task 1789 — admin rows only; see the WhatsApp twin.
+      overrideSessionId: role === "admin" ? resolveChannelOverride(accountId, "telegram", senderId) : null
+    });
     const result = await managerRcSpawn(req);
     if ("error" in result) {
       console.error(`[telegram-native] spawn-failed senderId=${senderId} role=${role} error=${result.error} status=${result.status}`);
@@ -27821,7 +28319,7 @@ var telegramGateway = new TelegramGateway({
   }
 });
 setTelegramGateway(telegramGateway);
-app63.route("/", telegramGateway.routes());
+app64.route("/", telegramGateway.routes());
 telegramGateway.startSweeper();
 var chatRoutes = createChatRoutes({
   handleInbound: (input) => webchatGateway.handleInbound(input),
@@ -27855,19 +28353,19 @@ var scheduleInjectRoutes = createScheduleInjectRoutes({
     return managed.account;
   }
 });
-app63.route("/api/channel/schedule-inject", scheduleInjectRoutes);
-app63.use("*", clientIpMiddleware);
+app64.route("/api/channel/schedule-inject", scheduleInjectRoutes);
+app64.use("*", clientIpMiddleware);
 function allowsSameOriginFraming(path3) {
   return path3 === "/vnc-viewer.html" || path3.startsWith("/api/admin/attachment/") || path3.startsWith("/api/public-reader/attachment/") || path3 === "/api/admin/files/download";
 }
-app63.use("*", async (c, next) => {
+app64.use("*", async (c, next) => {
   await next();
   c.header("X-Content-Type-Options", "nosniff");
   c.header("Referrer-Policy", "strict-origin-when-cross-origin");
   c.header("X-Frame-Options", allowsSameOriginFraming(c.req.path) ? "SAMEORIGIN" : "DENY");
 });
 var HTTP_LOG_PATHS = /* @__PURE__ */ new Set(["/vnc-viewer.html", "/vnc-popout.html"]);
-app63.use("*", async (c, next) => {
+app64.use("*", async (c, next) => {
   if (!HTTP_LOG_PATHS.has(c.req.path)) {
     await next();
     return;
@@ -27885,7 +28383,7 @@ app63.use("*", async (c, next) => {
     });
   }
 });
-app63.use("*", async (c, next) => {
+app64.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isOperatorHost(host, getOperatorDomains()) || !isPublicHost(host)) {
     await next();
@@ -27923,7 +28421,7 @@ function resolveRemoteAuthOpts(c) {
   return { ...brandLoginOpts, origin };
 }
 var MAX_LOGIN_BODY = 8 * 1024;
-app63.post("/__remote-auth/login", async (c) => {
+app64.post("/__remote-auth/login", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   if (!requestIsTlsTerminated(c)) {
@@ -27968,7 +28466,7 @@ app63.post("/__remote-auth/login", async (c) => {
     }
   });
 });
-app63.get("/__remote-auth/logout", (c) => {
+app64.get("/__remote-auth/logout", (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   console.error(`[remote-auth] logout ip=${clientIp}`);
@@ -27981,7 +28479,7 @@ app63.get("/__remote-auth/logout", (c) => {
     }
   });
 });
-app63.post("/__remote-auth/change-password", async (c) => {
+app64.post("/__remote-auth/change-password", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   const rateLimited = checkRateLimit(client);
@@ -28040,13 +28538,13 @@ app63.post("/__remote-auth/change-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), mode: "change", changeError: "Failed to save password", redirect }), 200);
   }
 });
-app63.get("/__remote-auth/setup", (c) => {
+app64.get("/__remote-auth/setup", (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), mode: "setup" }), 200);
 });
-app63.post("/__remote-auth/set-initial-password", async (c) => {
+app64.post("/__remote-auth/set-initial-password", async (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
@@ -28084,10 +28582,10 @@ app63.post("/__remote-auth/set-initial-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), mode: "setup", setupError: "Failed to save password. Please try again." }), 200);
   }
 });
-app63.get("/api/remote-auth/status", (c) => {
+app64.get("/api/remote-auth/status", (c) => {
   return c.json({ configured: isRemoteAuthConfigured() });
 });
-app63.post("/api/remote-auth/set-password", async (c) => {
+app64.post("/api/remote-auth/set-password", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -28126,10 +28624,10 @@ app63.post("/api/remote-auth/set-password", async (c) => {
     return c.json({ error: "Failed to save password" }, 500);
   }
 });
-app63.route("/api/_client-error", client_error_default);
+app64.route("/api/_client-error", client_error_default);
 console.log("[client-error-route] mounted");
 var PWA_PUBLIC_PATHS = /* @__PURE__ */ new Set(["/sw.js", ...PWA_SURFACES.map((s) => s.manifestPath)]);
-app63.use("*", async (c, next) => {
+app64.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path3 = c.req.path;
   if (path3 === "/favicon.ico" || path3.startsWith("/assets/") || path3.startsWith("/brand/") || // Public free/busy is read by the booking page (a separate Cloudflare Pages
@@ -28173,27 +28671,28 @@ app63.use("*", async (c, next) => {
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), redirect: path3 }), 200);
 });
-app63.route("/api/health", health_default);
-app63.route("/api/chat", chatRoutes);
-app63.route("/api/whatsapp", whatsapp_default);
-app63.route("/api/storage", storage_broker_default);
-app63.route("/api/whatsapp-reader", whatsapp_reader_default);
-app63.route("/api/public-reader", public_reader_default);
-app63.route("/api/webchat", createWebchatRoutes({
+app64.route("/api/health", health_default);
+app64.route("/api/chat", chatRoutes);
+app64.route("/api/whatsapp", whatsapp_default);
+app64.route("/api/storage", storage_broker_default);
+app64.route("/api/whatsapp-reader", whatsapp_reader_default);
+app64.route("/api/public-reader", public_reader_default);
+app64.route("/api/webchat", createWebchatRoutes({
   handleInbound: (input) => webchatGateway.handleInbound(input),
   // Task 940 — the permission relay's pointer read + verdict write.
   pendingPromptFor: (key) => webchatGateway.pendingPromptFor(key),
   deliveryFailureFor: (key) => webchatGateway.deliveryFailureFor(key),
   resolvePermissionVerdict: (key, requestId, behavior) => webchatGateway.resolvePermissionVerdict(key, requestId, behavior)
 }));
-app63.route("/api/webchat/greeting", webchat_greeting_default);
-app63.route("/api/telegram", telegram_default);
-app63.route("/api/quickbooks", quickbooks_default);
-app63.route("/api/onboarding", onboarding_default);
-app63.route("/api/admin", admin_default);
-app63.route("/api/access", access_default);
-app63.route("/api/session", session_default2);
-app63.route("/api/calendar", calendar_public_default);
+app64.route("/api/webchat/greeting", webchat_greeting_default);
+app64.route("/api/telegram", telegram_default);
+app64.route("/api/quickbooks", quickbooks_default);
+app64.route("/api/onboarding", onboarding_default);
+app64.route("/api/admin", admin_default);
+app64.route("/api/access", access_default);
+app64.route("/api/session", session_default2);
+app64.route("/api/calendar", calendar_public_default);
+app64.route("/api/portal", portal_fetch_default);
 var SAFE_SLUG_RE2 = /^[a-z][a-z0-9-]{2,49}$/;
 var SAFE_FILENAME_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var IMAGE_MIME = {
@@ -28205,7 +28704,7 @@ var IMAGE_MIME = {
   ".svg": "image/svg+xml",
   ".ico": "image/x-icon"
 };
-app63.get("/agent-assets/:slug/:filename", (c) => {
+app64.get("/agent-assets/:slug/:filename", (c) => {
   const slug = c.req.param("slug");
   const filename = c.req.param("filename");
   if (!SAFE_SLUG_RE2.test(slug)) {
@@ -28221,8 +28720,8 @@ app63.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] no-account slug=${slug} file=${filename}`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve36(account.accountDir, "agents", slug, "assets", filename);
-  const expectedDir = resolve36(account.accountDir, "agents", slug, "assets");
+  const filePath = resolve37(account.accountDir, "agents", slug, "assets", filename);
+  const expectedDir = resolve37(account.accountDir, "agents", slug, "assets");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
@@ -28234,13 +28733,13 @@ app63.get("/agent-assets/:slug/:filename", (c) => {
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[agent-assets] serve slug=${slug} file=${filename} status=200`);
-  const body = readFileSync41(filePath);
+  const body = readFileSync42(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=3600"
   });
 });
-app63.get("/generated/:filename", (c) => {
+app64.get("/generated/:filename", (c) => {
   const filename = c.req.param("filename");
   if (!SAFE_FILENAME_RE.test(filename) || filename.includes("..")) {
     console.error(`[generated] serve file=${filename} status=403`);
@@ -28251,8 +28750,8 @@ app63.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve36(account.accountDir, "generated", filename);
-  const expectedDir = resolve36(account.accountDir, "generated");
+  const filePath = resolve37(account.accountDir, "generated", filename);
+  const expectedDir = resolve37(account.accountDir, "generated");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
@@ -28264,22 +28763,22 @@ app63.get("/generated/:filename", (c) => {
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[generated] serve file=${filename} status=200`);
-  const body = readFileSync41(filePath);
+  const body = readFileSync42(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=86400"
   });
 });
-app63.route("/sites", sites_default);
-app63.route("/listings", listings_default);
-app63.route("/v", visitor_event_default);
-app63.route("/v", visitor_consent_default);
+app64.route("/sites", sites_default);
+app64.route("/listings", listings_default);
+app64.route("/v", visitor_event_default);
+app64.route("/v", visitor_consent_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
 if (BRAND_JSON_PATH && existsSync38(BRAND_JSON_PATH)) {
   try {
-    const fullBrand = JSON.parse(readFileSync41(BRAND_JSON_PATH, "utf-8"));
+    const fullBrand = JSON.parse(readFileSync42(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
     brandIconPath = fullBrand.assets?.icon ? `/brand/${fullBrand.assets.icon}` : brandLogoPath;
   } catch {
@@ -28306,11 +28805,11 @@ var brandScript = `<script>window.__BRAND__=${JSON.stringify({
 var brandThemeColor = BRAND.defaultColors?.primary ?? "#000000";
 var brandBackgroundColor = BRAND.defaultColors?.background ?? "#ffffff";
 var brandAppIconsExist = [brandAppIcon192Path, brandAppIcon512Path, brandMaskableIconPath].every(
-  (p) => existsSync38(resolve36(process.cwd(), "public", p.replace(/^\//, "")))
+  (p) => existsSync38(resolve37(process.cwd(), "public", p.replace(/^\//, "")))
 );
 var SW_SOURCE = (() => {
   try {
-    return readFileSync41(resolve36(process.cwd(), "public", "sw.js"), "utf-8");
+    return readFileSync42(resolve37(process.cwd(), "public", "sw.js"), "utf-8");
   } catch {
     return null;
   }
@@ -28318,9 +28817,9 @@ var SW_SOURCE = (() => {
 function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT8) return "unknown";
-    const versionFile = join42(PLATFORM_ROOT8, "config", `.${BRAND.hostname}-version`);
+    const versionFile = join44(PLATFORM_ROOT8, "config", `.${BRAND.hostname}-version`);
     if (!existsSync38(versionFile)) return "unknown";
-    const content = readFileSync41(versionFile, "utf-8").trim();
+    const content = readFileSync42(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
     return "unknown";
@@ -28361,7 +28860,7 @@ var clientErrorReporterScript = `<script>
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync41(resolve36(process.cwd(), "public", file), "utf-8");
+    html = readFileSync42(resolve37(process.cwd(), "public", file), "utf-8");
     const productNameEsc = escapeHtml(BRAND.productName);
     html = html.replace(/<title>([^<]*)<\/title>/, (_match, inner) => `<title>${escapeHtml(inner).replace(/Maxy/g, productNameEsc)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
@@ -28378,13 +28877,13 @@ ${clientErrorReporterScript}
   return html;
 }
 function loadBrandingCache(agentSlug) {
-  const configDir2 = join42(homedir4(), BRAND.configDir);
+  const configDir2 = join44(homedir4(), BRAND.configDir);
   try {
     const accountId = getDefaultAccountId();
     if (!accountId) return null;
-    const cachePath = join42(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
+    const cachePath = join44(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
     if (!existsSync38(cachePath)) return null;
-    return JSON.parse(readFileSync41(cachePath, "utf-8"));
+    return JSON.parse(readFileSync42(cachePath, "utf-8"));
   } catch {
     return null;
   }
@@ -28428,7 +28927,7 @@ function brandedPublicHtml(agentSlug) {
 function agentUnavailableHtml() {
   return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${escapeHtml(BRAND.productName)}</title></head><body style="font-family:system-ui,sans-serif;max-width:32rem;margin:4rem auto;padding:0 1.5rem;color:#222"><h1 style="font-size:1.25rem">Agent unavailable</h1><p>This agent isn't available right now. If you reached this page from a saved link, the agent may have been turned off.</p></body></html>`;
 }
-app63.get("/", (c) => {
+app64.get("/", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const klass = classifyHost(host, getOperatorDomains(), isPublicHost);
   if (klass === "operator") {
@@ -28450,12 +28949,12 @@ app63.get("/", (c) => {
   console.log(`[host-class] host=${host} class=admin served=index.html`);
   return c.html(cachedHtml("index.html"));
 });
-app63.get("/public", (c) => {
+app64.get("/public", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
 });
-app63.get("/public-chat", (c) => {
+app64.get("/public-chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
@@ -28474,12 +28973,12 @@ async function logViewerFetch(c, next) {
     duration_ms: Date.now() - start
   });
 }
-app63.use("/vnc-viewer.html", logViewerFetch);
-app63.use("/vnc-popout.html", logViewerFetch);
-app63.get("/vnc-popout.html", (c) => {
+app64.use("/vnc-viewer.html", logViewerFetch);
+app64.use("/vnc-popout.html", logViewerFetch);
+app64.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync41(resolve36(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync42(resolve37(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -28489,7 +28988,7 @@ app63.get("/vnc-popout.html", (c) => {
   }
   return c.html(html);
 });
-app63.post("/api/vnc/client-event", async (c) => {
+app64.post("/api/vnc/client-event", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -28510,11 +29009,11 @@ app63.post("/api/vnc/client-event", async (c) => {
   });
   return c.json({ ok: true });
 });
-app63.get("/g/:slug", (c) => {
+app64.get("/g/:slug", (c) => {
   return c.html(brandedPublicHtml(resolveDefaultSlug() ?? void 0));
 });
 for (const pwa of PWA_SURFACES) {
-  app63.get(pwa.manifestPath, (c) => {
+  app64.get(pwa.manifestPath, (c) => {
     const manifest = buildManifest(pwa, {
       productName: BRAND.productName,
       appIcon192: brandAppIcon192Path,
@@ -28530,7 +29029,7 @@ for (const pwa of PWA_SURFACES) {
     return c.body(JSON.stringify(manifest));
   });
 }
-app63.get("/sw.js", (c) => {
+app64.get("/sw.js", (c) => {
   if (SW_SOURCE == null) {
     console.error("[pwa] op=sw status=500 reason=sw-source-missing");
     return c.text("Service worker unavailable", 500);
@@ -28539,12 +29038,12 @@ app63.get("/sw.js", (c) => {
   console.log(`[pwa] op=sw status=200 ct=${SW_CONTENT_TYPE}`);
   return c.body(SW_SOURCE);
 });
-app63.get("/graph", (c) => {
+app64.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host) || isOperatorHost(host, getOperatorDomains())) return c.text("Not found", 404);
   return c.html(cachedHtml("graph.html"));
 });
-app63.get("/chat", (c) => {
+app64.get("/chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isOperatorHost(host, getOperatorDomains())) {
     console.log(`[host-class] host=${host} class=operator served=operator.html`);
@@ -28553,32 +29052,32 @@ app63.get("/chat", (c) => {
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("chat.html"));
 });
-app63.get("/data", (c) => {
+app64.get("/data", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("data.html"));
 });
-app63.get("/tasks", (c) => {
+app64.get("/tasks", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("tasks.html"));
 });
-app63.get("/activity", (c) => {
+app64.get("/activity", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("activity.html"));
 });
-app63.get("/calendar", (c) => {
+app64.get("/calendar", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("calendar.html"));
 });
-app63.get("/browser", (c) => {
+app64.get("/browser", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host) || isOperatorHost(host, getOperatorDomains())) return c.text("Not found", 404);
   return c.html(cachedHtml("browser.html"));
 });
-app63.get("/:slug", async (c, next) => {
+app64.get("/:slug", async (c, next) => {
   const slug = c.req.param("slug");
   if (AGENT_SLUG_PATTERN.test(`/${slug}`)) {
     const account = resolveAccount();
@@ -28593,13 +29092,13 @@ app63.get("/:slug", async (c, next) => {
   await next();
 });
 if (brandFaviconPath !== "/favicon.ico") {
-  app63.get("/favicon.ico", (c) => {
+  app64.get("/favicon.ico", (c) => {
     c.header("Cache-Control", "public, max-age=300");
     return c.redirect(brandFaviconPath, 302);
   });
 }
-app63.use("/*", serveStatic({ root: "./public" }));
-app63.all("*", (c) => {
+app64.use("/*", serveStatic({ root: "./public" }));
+app64.all("*", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path3 = c.req.path;
   if (isPublicHost(host)) {
@@ -28613,11 +29112,11 @@ app63.all("*", (c) => {
 });
 var port = requirePortEnv("MAXY_UI_INTERNAL_PORT", { tag: "ui-server" });
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
-var httpServer = serve({ fetch: app63.fetch, port, hostname });
+var httpServer = serve({ fetch: app64.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
-  const reconcilePlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join42(__dirname, "..");
-  const reconcileScript = resolve36(reconcilePlatformRoot, "plugins/scheduling/mcp/dist/scripts/reconcile-bookings.js");
+  const reconcilePlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join44(__dirname, "..");
+  const reconcileScript = resolve37(reconcilePlatformRoot, "plugins/scheduling/mcp/dist/scripts/reconcile-bookings.js");
   const RECONCILE_INTERVAL_MS = 12e4;
   const runReconcile = (ctx) => {
     if (!existsSync38(reconcileScript)) return;
@@ -28642,8 +29141,8 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const outlookPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join42(__dirname, "..");
-  const outlookScript = resolve36(outlookPlatformRoot, "plugins/outlook/mcp/dist/scripts/complete-registration.js");
+  const outlookPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join44(__dirname, "..");
+  const outlookScript = resolve37(outlookPlatformRoot, "plugins/outlook/mcp/dist/scripts/complete-registration.js");
   const OUTLOOK_COMPLETE_INTERVAL_MS = 3e4;
   const runOutlookComplete = (ctx) => {
     if (!existsSync38(outlookScript)) return;
@@ -28668,8 +29167,8 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const auditRoot = process.env.MAXY_PLATFORM_ROOT ?? join42(__dirname, "..");
-  const strandedAccountsDir = resolve36(auditRoot, "..", "data/accounts");
+  const auditRoot = process.env.MAXY_PLATFORM_ROOT ?? join44(__dirname, "..");
+  const strandedAccountsDir = resolve37(auditRoot, "..", "data/accounts");
   const STRANDED_AUDIT_INTERVAL_MS = 3e5;
   const STRANDED_AGE_MS = 16 * 6e4;
   const STRANDED_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
@@ -28679,7 +29178,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
       const now = Date.now();
       for (const name of readdirSync26(strandedAccountsDir)) {
         if (!STRANDED_UUID_RE.test(name)) continue;
-        const pendingPath2 = resolve36(strandedAccountsDir, name, "secrets/outlook/pending-devicecode.enc");
+        const pendingPath2 = resolve37(strandedAccountsDir, name, "secrets/outlook/pending-devicecode.enc");
         if (!existsSync38(pendingPath2)) continue;
         const ageMs = now - statSync17(pendingPath2).mtimeMs;
         if (ageMs > STRANDED_AGE_MS) {
@@ -28698,8 +29197,8 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const googleRoot = process.env.MAXY_PLATFORM_ROOT ?? join42(__dirname, "..");
-  const googleAccountsDir = resolve36(googleRoot, "..", "data/accounts");
+  const googleRoot = process.env.MAXY_PLATFORM_ROOT ?? join44(__dirname, "..");
+  const googleAccountsDir = resolve37(googleRoot, "..", "data/accounts");
   const GOOGLE_PENDING_AUDIT_INTERVAL_MS = 3e5;
   const runGooglePendingAuditSafe = () => {
     try {
@@ -28714,7 +29213,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     firstRunDelayMs: 27e3,
     run: runGooglePendingAuditSafe
   });
-  const googleAuditScript = resolve36(googleRoot, "plugins/google/mcp/dist/scripts/account-audit.js");
+  const googleAuditScript = resolve37(googleRoot, "plugins/google/mcp/dist/scripts/account-audit.js");
   const GOOGLE_ACCOUNT_AUDIT_INTERVAL_MS = 36e5;
   const runGoogleAccountAudit = (ctx) => {
     if (!existsSync38(googleAuditScript)) return;
@@ -28742,7 +29241,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join42(__dirname, "..");
+  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join44(__dirname, "..");
   const STORAGE_AUDIT_INTERVAL_MS = 3e5;
   const runStorageAuditSafe = () => runStorageAudit(auditPlatformRoot).catch((err) => {
     console.error(`[storage-audit] error="${err.message}"`);
@@ -28764,10 +29263,20 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     firstRunDelayMs: 35e3,
     run: runPagesAuditSafe
   });
+  const runDataPortalAuditSafe = () => runDataPortalAudit(auditPlatformRoot).catch((err) => {
+    console.error(`[data-portal-audit] error="${err.message}"`);
+    throw err;
+  });
+  registerLoop({
+    name: "data-portal-audit",
+    intervalMs: STORAGE_AUDIT_INTERVAL_MS,
+    firstRunDelayMs: 5e4,
+    run: runDataPortalAuditSafe
+  });
 }
 {
-  const publishPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join42(__dirname, "..");
-  const publishScript = resolve36(publishPlatformRoot, "plugins/scheduling/mcp/dist/scripts/publish-availability.js");
+  const publishPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join44(__dirname, "..");
+  const publishScript = resolve37(publishPlatformRoot, "plugins/scheduling/mcp/dist/scripts/publish-availability.js");
   const PUBLISH_INTERVAL_MS = 3e5;
   const currentAccount = () => {
     try {
@@ -28797,21 +29306,21 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     }
   };
   const auditSnapshotAge = (account) => {
-    const availPath = resolve36(account.accountDir, "calendar-availability.json");
+    const availPath = resolve37(account.accountDir, "calendar-availability.json");
     let hasBookingSite = false;
     try {
       if (existsSync38(availPath)) {
-        const cfg = JSON.parse(readFileSync41(availPath, "utf-8"));
+        const cfg = JSON.parse(readFileSync42(availPath, "utf-8"));
         hasBookingSite = typeof cfg.bookingDbName === "string" && cfg.bookingDbName.length > 0;
       }
     } catch {
     }
     if (!hasBookingSite) return;
-    const statePath = resolve36(account.accountDir, "state", "booking-availability", "last-publish.json");
+    const statePath = resolve37(account.accountDir, "state", "booking-availability", "last-publish.json");
     let lastSuccessAt = null;
     if (existsSync38(statePath)) {
       try {
-        const rec = JSON.parse(readFileSync41(statePath, "utf-8"));
+        const rec = JSON.parse(readFileSync42(statePath, "utf-8"));
         lastSuccessAt = rec.lastSuccessAt ?? null;
       } catch {
         console.error(`[calendar-availability] op=audit accountId=${account.accountId} snapshotAgeMs=na reason=bad-state-file`);
@@ -28839,8 +29348,8 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 startTimeEntryCensus(() => getSession());
 startLedgerCensus(() => getSession());
 {
-  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join42(__dirname, "..");
-  const auditScript = resolve36(auditPlatformRoot, "plugins/connector/mcp/dist/scripts/audit-connectors.js");
+  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join44(__dirname, "..");
+  const auditScript = resolve37(auditPlatformRoot, "plugins/connector/mcp/dist/scripts/audit-connectors.js");
   const auditLogDir = process.env.LOG_DIR ?? LOG_DIR;
   const CONNECTOR_AUDIT_INTERVAL_MS = 3e5;
   const runConnectorAudit = (ctx) => {
@@ -28912,6 +29421,7 @@ var SUBAPP_MANIFEST = [
   { prefix: "/api/access", file: "server/routes/access/index.ts", subapp: access_default },
   { prefix: "/api/session", file: "server/routes/session.ts", subapp: session_default2 },
   { prefix: "/api/calendar", file: "server/routes/calendar-public.ts", subapp: calendar_public_default },
+  { prefix: "/api/portal", file: "server/routes/portal-fetch.ts", subapp: portal_fetch_default },
   { prefix: "/api/_client-error", file: "server/routes/client-error.ts", subapp: client_error_default },
   { prefix: "/listings", file: "server/routes/listings.ts", subapp: listings_default },
   { prefix: "/v", file: "server/routes/visitor-event.ts", subapp: visitor_event_default },
@@ -28923,7 +29433,7 @@ for (const m of SUBAPP_MANIFEST) {
 }
 try {
   const registered = [];
-  for (const r of app63.routes ?? []) {
+  for (const r of app64.routes ?? []) {
     if (typeof r.path !== "string" || r.path.includes(":") || r.path.includes("*")) continue;
     if (AGENT_SLUG_PATTERN.test(r.path)) {
       registered.push({ method: (r.method ?? "ALL").toUpperCase(), path: r.path });
@@ -28967,7 +29477,7 @@ async function runAdminUserReconcileTick() {
       console.error("[adminuser-self-heal] skip reason=no-users-file");
       return;
     }
-    const usersRaw = readFileSync41(USERS_FILE, "utf-8").trim();
+    const usersRaw = readFileSync42(USERS_FILE, "utf-8").trim();
     if (!usersRaw) {
       console.error("[adminuser-self-heal] skip reason=empty-users-file");
       return;
@@ -29015,7 +29525,7 @@ registerLoop({
 var USERS_RECONCILE_INTERVAL_MS = 60 * 60 * 1e3;
 function countUsersRows() {
   if (!existsSync38(USERS_FILE)) return 0;
-  const raw = readFileSync41(USERS_FILE, "utf-8").trim();
+  const raw = readFileSync42(USERS_FILE, "utf-8").trim();
   if (!raw) return 0;
   const users = JSON.parse(raw);
   return users.filter((u) => typeof u.userId === "string").length;
@@ -29148,7 +29658,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve36(process.env.MAXY_PLATFORM_ROOT ?? join42(__dirname, "..")),
+  platformRoot: resolve37(process.env.MAXY_PLATFORM_ROOT ?? join44(__dirname, "..")),
   accountConfig: bootAccountConfig,
   onMessage: async (msg) => {
     if (msg.isOwnerMirror) {