@rubytech/create-maxy-code 0.1.477 → 0.1.479

package/payload/platform/lib/storage-broker/dist/audit.d.ts

@@ -3,9 +3,28 @@ export interface Stray {
     kind: StrayKind;
     detail: string;
 }
+/** CONCURRENCY CONTRACT — read before implementing these callbacks.
+ *
+ *  reconcileStorage invokes all five through ONE Promise.all. They overlap,
+ *  including the two registeredNames calls, which run at the same time as each
+ *  other. So no callback may share, with any other callback or with a second
+ *  invocation of itself, a resource that admits one operation at a time.
+ *
+ *  The resource that has actually caused this is a Neo4j session: it rejects a
+ *  query issued while one of its own is in flight. A caller that opened one
+ *  session in the enclosing scope and used it in registeredNames made the
+ *  second read reject, which left the standing storage audit reporting nothing
+ *  for 802 consecutive ticks on maxy-code and 295 on sitedesk-code (Task 1813).
+ *  Open the session inside the callback, one per invocation, and close it
+ *  there; driver sessions come from a pool, so this is cheap.
+ *
+ *  The contract is stated here rather than on reconcileStorage because this
+ *  interface is what a caller writing an implementation is looking at, and the
+ *  natural thing to write is the thing that breaks. */
 export interface AuditDeps {
     cfD1(): Promise<string[]>;
     cfR2(): Promise<string[]>;
+    /** Called twice, concurrently, once per kind. See the contract above. */
     registeredNames(kind: "d1" | "r2"): Promise<string[]>;
     accountSecretsFiles(): Promise<Array<{
         accountId: string;
@@ -16,6 +35,13 @@ export interface AuditDeps {
 export declare function reconcileStorage(deps: AuditDeps): Promise<{
     strays: Stray[];
 }>;
+/** Same concurrency contract as AuditDeps above: reconcilePages invokes both
+ *  callbacks through one Promise.all, so neither may share a single-operation
+ *  resource with the other.
+ *
+ *  That registeredProjects happens to issue exactly one query today is not the
+ *  property that makes a shared session safe here, and relying on it would put
+ *  the 1813 defect one added read away. */
 export interface PagesAuditDeps {
     cfProjects(): Promise<string[]>;
     registeredProjects(): Promise<string[]>;
@@ -27,4 +53,34 @@ export interface PagesReconcile {
     phantoms: string[];
 }
 export declare function reconcilePages(deps: PagesAuditDeps): Promise<PagesReconcile>;
+export interface DataPortalObject {
+    key: string;
+}
+export interface DataPortalRow {
+    objectKey: string;
+    ingested: number;
+    uploadedAt: string;
+}
+export interface DataPortalReconcile {
+    /** DISTINCT keys, which is not the same quantity as the length of the list
+     *  the read returned. The caller logs the lengths — "how many did I see" —
+     *  and these are "how many are distinct". They agree on a healthy store
+     *  (manifest.objectKey is UNIQUE and R2 keys are unique by construction), and
+     *  giving them one name would conflate two facts that diverge exactly when
+     *  the store is unhealthy, which is the case this audit is for. */
+    distinctObjects: number;
+    distinctRows: number;
+    orphanObjects: string[];
+    phantomRows: string[];
+    /** Null when nothing is uningested, or when no uningested row carries a
+     *  parseable timestamp. Rendered `na` by the caller. */
+    oldestUningestedHrs: number | null;
+}
+/** Pure over two lists and an injected clock, so the age arithmetic is
+ *  deterministic under test rather than dependent on when the suite runs.
+ *
+ *  Unlike its two siblings this takes lists rather than callbacks: both sides
+ *  are read per account by a caller that must catch each independently, so
+ *  there is no fan-out here to carry a concurrency contract. */
+export declare function reconcileDataPortal(objects: DataPortalObject[], rows: DataPortalRow[], nowMs: number): DataPortalReconcile;
 //# sourceMappingURL=audit.d.ts.map

package/payload/platform/lib/storage-broker/dist/audit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,SAAS,GAAG,iBAAiB,GAAG,iBAAiB,GAAG,oBAAoB,CAAC;AAErF,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAMD,MAAM,WAAW,SAAS;IACxB,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1B,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1B,eAAe,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACtD,mBAAmB,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;CAC9F;AAED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,KAAK,EAAE,CAAA;CAAE,CAAC,CA8BpF;AAmBD,MAAM,WAAW,cAAc;IAC7B,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAChC,kBAAkB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAclF"}
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,SAAS,GAAG,iBAAiB,GAAG,iBAAiB,GAAG,oBAAoB,CAAC;AAErF,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAMD;;;;;;;;;;;;;;;;;uDAiBuD;AACvD,MAAM,WAAW,SAAS;IACxB,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1B,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1B,yEAAyE;IACzE,eAAe,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACtD,mBAAmB,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;CAC9F;AAED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,KAAK,EAAE,CAAA;CAAE,CAAC,CA8BpF;AAmBD;;;;;;2CAM2C;AAC3C,MAAM,WAAW,cAAc;IAC7B,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAChC,kBAAkB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAclF;AAoBD,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;;uEAKmE;IACnE,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB;4DACwD;IACxD,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED;;;;;gEAKgE;AAChE,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,gBAAgB,EAAE,EAC3B,IAAI,EAAE,aAAa,EAAE,EACrB,KAAK,EAAE,MAAM,GACZ,mBAAmB,CA6BrB"}

package/payload/platform/lib/storage-broker/dist/audit.js

@@ -7,6 +7,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.reconcileStorage = reconcileStorage;
 exports.reconcilePages = reconcilePages;
+exports.reconcileDataPortal = reconcileDataPortal;
 // Keys that must never remain in a sub-account's cloudflare.env after
 // remediation. Each is an account-wide capability.
 const ACCOUNT_WIDE_KEYS = ["CLOUDFLARE_API_TOKEN", "CF_PAGES_D1_TOKEN", "CF_PAGES_TOKEN"];
@@ -54,4 +55,37 @@ async function reconcilePages(deps) {
         phantoms: [...regSet].filter((name) => !cfSet.has(name)),
     };
 }
+/** Pure over two lists and an injected clock, so the age arithmetic is
+ *  deterministic under test rather than dependent on when the suite runs.
+ *
+ *  Unlike its two siblings this takes lists rather than callbacks: both sides
+ *  are read per account by a caller that must catch each independently, so
+ *  there is no fan-out here to carry a concurrency contract. */
+function reconcileDataPortal(objects, rows, nowMs) {
+    const objectKeys = new Set(objects.map((o) => o.key));
+    const rowKeys = new Set(rows.map((r) => r.objectKey));
+    // Date.parse of a truthy non-ISO value is NaN, which slips past a `??` guard
+    // and renders as `oldestUningestedHrs=NaN` — the defect the availability
+    // loop's snapshotAgeMs already had to fix. Unparseable rows are excluded from
+    // the minimum; if that leaves none, the answer is null, never NaN.
+    const uningestedMs = rows
+        .filter((r) => r.ingested === 0)
+        .map((r) => Date.parse(r.uploadedAt))
+        .filter((ms) => !Number.isNaN(ms));
+    // Reduced, never `Math.min(...uningestedMs)`. A spread passes one argument per
+    // element and blows the call stack — measured: fine at 125k, RangeError at
+    // 130k. One element per uningested row, and an ingestion sweep that has
+    // stalled accumulates those without bound. A stalled sweep is one of the three
+    // conditions this audit exists to reveal, so the arithmetic must not be what
+    // goes dark once the backlog it is watching grows large. The throw would also
+    // escape the caller's per-side catches and cost every later account its line.
+    const oldestMs = uningestedMs.reduce((min, ms) => (ms < min ? ms : min), Infinity);
+    return {
+        distinctObjects: objectKeys.size,
+        distinctRows: rowKeys.size,
+        orphanObjects: [...objectKeys].filter((k) => !rowKeys.has(k)),
+        phantomRows: [...rowKeys].filter((k) => !objectKeys.has(k)),
+        oldestUningestedHrs: uningestedMs.length === 0 ? null : (nowMs - oldestMs) / 3_600_000,
+    };
+}
 //# sourceMappingURL=audit.js.map

package/payload/platform/lib/storage-broker/dist/audit.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit.js","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":";AAAA,+EAA+E;AAC/E,+EAA+E;AAC/E,8EAA8E;AAC9E,gFAAgF;AAChF,0DAA0D;;AAoB1D,4CA8BC;AA+BD,wCAcC;AAtFD,sEAAsE;AACtE,mDAAmD;AACnD,MAAM,iBAAiB,GAAG,CAAC,sBAAsB,EAAE,mBAAmB,EAAE,gBAAgB,CAAC,CAAC;AASnF,KAAK,UAAU,gBAAgB,CAAC,IAAe;IACpD,MAAM,MAAM,GAAY,EAAE,CAAC;IAE3B,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACjE,IAAI,CAAC,IAAI,EAAE;QACX,IAAI,CAAC,IAAI,EAAE;QACX,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;QAC1B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;QAC1B,IAAI,CAAC,mBAAmB,EAAE;KAC3B,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,+BAA+B,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC7D,IAAI,GAAG,IAAI,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3C,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;YAClF,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,CAAC;AACpB,CAAC;AA+BM,KAAK,UAAU,cAAc,CAAC,IAAoB;IACvD,4EAA4E;IAC5E,0EAA0E;IAC1E,8EAA8E;IAC9E,+CAA+C;IAC/C,MAAM,CAAC,EAAE,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC;IAC3F,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;IAC1B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IACnC,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,IAAI;QACpB,UAAU,EAAE,MAAM,CAAC,IAAI;QACvB,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvD,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;KACzD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":";AAAA,+EAA+E;AAC/E,+EAA+E;AAC/E,8EAA8E;AAC9E,gFAAgF;AAChF,0DAA0D;;AAuC1D,4CA8BC;AAsCD,wCAcC;AAoDD,kDAiCC;AArMD,sEAAsE;AACtE,mDAAmD;AACnD,MAAM,iBAAiB,GAAG,CAAC,sBAAsB,EAAE,mBAAmB,EAAE,gBAAgB,CAAC,CAAC;AA4BnF,KAAK,UAAU,gBAAgB,CAAC,IAAe;IACpD,MAAM,MAAM,GAAY,EAAE,CAAC;IAE3B,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACjE,IAAI,CAAC,IAAI,EAAE;QACX,IAAI,CAAC,IAAI,EAAE;QACX,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;QAC1B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;QAC1B,IAAI,CAAC,mBAAmB,EAAE;KAC3B,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,+BAA+B,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC7D,IAAI,GAAG,IAAI,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3C,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;YAClF,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,CAAC;AACpB,CAAC;AAsCM,KAAK,UAAU,cAAc,CAAC,IAAoB;IACvD,4EAA4E;IAC5E,0EAA0E;IAC1E,8EAA8E;IAC9E,+CAA+C;IAC/C,MAAM,CAAC,EAAE,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC;IAC3F,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;IAC1B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IACnC,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,IAAI;QACpB,UAAU,EAAE,MAAM,CAAC,IAAI;QACvB,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvD,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;KACzD,CAAC;AACJ,CAAC;AA8CD;;;;;gEAKgE;AAChE,SAAgB,mBAAmB,CACjC,OAA2B,EAC3B,IAAqB,EACrB,KAAa;IAEb,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAEtD,6EAA6E;IAC7E,yEAAyE;IACzE,8EAA8E;IAC9E,mEAAmE;IACnE,MAAM,YAAY,GAAG,IAAI;SACtB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC;SAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;SACpC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAErC,+EAA+E;IAC/E,2EAA2E;IAC3E,wEAAwE;IACxE,+EAA+E;IAC/E,6EAA6E;IAC7E,8EAA8E;IAC9E,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;IAEnF,OAAO;QACL,eAAe,EAAE,UAAU,CAAC,IAAI;QAChC,YAAY,EAAE,OAAO,CAAC,IAAI;QAC1B,aAAa,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC7D,WAAW,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC3D,mBAAmB,EAAE,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,QAAQ,CAAC,GAAG,SAAS;KACvF,CAAC;AACJ,CAAC"}

package/payload/platform/lib/storage-broker/src/__tests__/audit.test.ts

@@ -1,6 +1,6 @@
 import test from "node:test";
 import assert from "node:assert/strict";
-import { reconcileStorage, reconcilePages, type AuditDeps } from "../audit.js";
+import { reconcileStorage, reconcilePages, reconcileDataPortal, type AuditDeps } from "../audit.js";
 
 const clean: AuditDeps = {
   cfD1: async () => ["gls-leads"],
@@ -78,3 +78,72 @@ test("reconcilePages is clean when every live project has exactly one owner", as
   assert.deepEqual(r.orphans, []);
   assert.deepEqual(r.phantoms, []);
 });
+
+// --- Data portal reconcile (Task 1704) ------------------------------------
+
+const row = (objectKey: string, ingested: number, uploadedAt: string) => ({
+  objectKey,
+  ingested,
+  uploadedAt,
+});
+
+test("reconcileDataPortal counts an object with no row as an orphan", () => {
+  const r = reconcileDataPortal([{ key: "alice/a.pdf" }], [], 0);
+  assert.deepEqual(r.orphanObjects, ["alice/a.pdf"]);
+  assert.deepEqual(r.phantomRows, []);
+  assert.equal(r.distinctObjects, 1);
+  assert.equal(r.distinctRows, 0);
+});
+
+test("reconcileDataPortal counts a row with no object as a phantom", () => {
+  const r = reconcileDataPortal([], [row("alice/a.pdf", 1, "2026-07-20T00:00:00Z")], 0);
+  assert.deepEqual(r.phantomRows, ["alice/a.pdf"]);
+  assert.deepEqual(r.orphanObjects, []);
+});
+
+test("reconcileDataPortal counts a matched pair as neither", () => {
+  const r = reconcileDataPortal(
+    [{ key: "alice/a.pdf" }],
+    [row("alice/a.pdf", 1, "2026-07-20T00:00:00Z")],
+    0,
+  );
+  assert.deepEqual(r.orphanObjects, []);
+  assert.deepEqual(r.phantomRows, []);
+});
+
+test("oldestUningestedHrs comes from the oldest ingested=0 row", () => {
+  const now = Date.parse("2026-07-20T12:00:00Z");
+  const r = reconcileDataPortal(
+    [],
+    [row("a", 0, "2026-07-20T09:00:00Z"), row("b", 0, "2026-07-20T11:00:00Z")],
+    now,
+  );
+  assert.equal(r.oldestUningestedHrs, 3);
+});
+
+test("an ingested row is excluded from the backlog age", () => {
+  const now = Date.parse("2026-07-20T12:00:00Z");
+  const r = reconcileDataPortal(
+    [],
+    [row("a", 1, "2026-07-01T00:00:00Z"), row("b", 0, "2026-07-20T11:00:00Z")],
+    now,
+  );
+  assert.equal(r.oldestUningestedHrs, 1);
+});
+
+test("oldestUningestedHrs is null when nothing is uningested", () => {
+  const r = reconcileDataPortal([], [row("a", 1, "2026-07-20T00:00:00Z")], 0);
+  assert.equal(r.oldestUningestedHrs, null);
+});
+
+test("an unparseable uploadedAt never yields NaN", () => {
+  const now = Date.parse("2026-07-20T12:00:00Z");
+  const only = reconcileDataPortal([], [row("a", 0, "not-a-date")], now);
+  assert.equal(only.oldestUningestedHrs, null);
+  const mixed = reconcileDataPortal(
+    [],
+    [row("a", 0, "not-a-date"), row("b", 0, "2026-07-20T11:00:00Z")],
+    now,
+  );
+  assert.equal(mixed.oldestUningestedHrs, 1);
+});

package/payload/platform/lib/storage-broker/src/audit.ts

@@ -15,9 +15,28 @@ export interface Stray {
 // remediation. Each is an account-wide capability.
 const ACCOUNT_WIDE_KEYS = ["CLOUDFLARE_API_TOKEN", "CF_PAGES_D1_TOKEN", "CF_PAGES_TOKEN"];
 
+/** CONCURRENCY CONTRACT — read before implementing these callbacks.
+ *
+ *  reconcileStorage invokes all five through ONE Promise.all. They overlap,
+ *  including the two registeredNames calls, which run at the same time as each
+ *  other. So no callback may share, with any other callback or with a second
+ *  invocation of itself, a resource that admits one operation at a time.
+ *
+ *  The resource that has actually caused this is a Neo4j session: it rejects a
+ *  query issued while one of its own is in flight. A caller that opened one
+ *  session in the enclosing scope and used it in registeredNames made the
+ *  second read reject, which left the standing storage audit reporting nothing
+ *  for 802 consecutive ticks on maxy-code and 295 on sitedesk-code (Task 1813).
+ *  Open the session inside the callback, one per invocation, and close it
+ *  there; driver sessions come from a pool, so this is cheap.
+ *
+ *  The contract is stated here rather than on reconcileStorage because this
+ *  interface is what a caller writing an implementation is looking at, and the
+ *  natural thing to write is the thing that breaks. */
 export interface AuditDeps {
   cfD1(): Promise<string[]>;
   cfR2(): Promise<string[]>;
+  /** Called twice, concurrently, once per kind. See the contract above. */
   registeredNames(kind: "d1" | "r2"): Promise<string[]>;
   accountSecretsFiles(): Promise<Array<{ accountId: string; path: string; contents: string }>>;
 }
@@ -71,6 +90,13 @@ export async function reconcileStorage(deps: AuditDeps): Promise<{ strays: Stray
 // Names are reported, not just counted: a count tells an operator something is
 // wrong, the name tells them what to adopt.
 
+/** Same concurrency contract as AuditDeps above: reconcilePages invokes both
+ *  callbacks through one Promise.all, so neither may share a single-operation
+ *  resource with the other.
+ *
+ *  That registeredProjects happens to issue exactly one query today is not the
+ *  property that makes a shared session safe here, and relying on it would put
+ *  the 1813 defect one added read away. */
 export interface PagesAuditDeps {
   cfProjects(): Promise<string[]>;
   registeredProjects(): Promise<string[]>;
@@ -98,3 +124,88 @@ export async function reconcilePages(deps: PagesAuditDeps): Promise<PagesReconci
     phantoms: [...regSet].filter((name) => !cfSet.has(name)),
   };
 }
+
+// --- Data portal reconcile (Task 1704) -------------------------------------
+//
+// Third instance of the same no-event argument, one level down from the two
+// above: those reconcile ownership records, this reconciles the objects
+// themselves against the manifest rows that make them ingestible.
+//
+//   orphan object — an object in R2 with no manifest row. The upload returned
+//                   200, the file is stored, and ingestion will never see it.
+//   phantom row   — a manifest row whose object is absent. Ingestion will pull
+//                   a missing file, and nothing says so until it runs.
+//
+// Keys are returned rather than only counted so the arithmetic is testable and
+// a future caller has them, but the standing audit logs COUNTS ONLY: a key here
+// is `<ownerId>/<filename>`, a real person's filename, and the brand journal is
+// not where those belong. That is the same ownership discipline the in-process
+// audit path owes for holding the account-wide credential and bypassing
+// objectGate entirely.
+
+export interface DataPortalObject {
+  key: string;
+}
+
+export interface DataPortalRow {
+  objectKey: string;
+  ingested: number;
+  uploadedAt: string;
+}
+
+export interface DataPortalReconcile {
+  /** DISTINCT keys, which is not the same quantity as the length of the list
+   *  the read returned. The caller logs the lengths — "how many did I see" —
+   *  and these are "how many are distinct". They agree on a healthy store
+   *  (manifest.objectKey is UNIQUE and R2 keys are unique by construction), and
+   *  giving them one name would conflate two facts that diverge exactly when
+   *  the store is unhealthy, which is the case this audit is for. */
+  distinctObjects: number;
+  distinctRows: number;
+  orphanObjects: string[];
+  phantomRows: string[];
+  /** Null when nothing is uningested, or when no uningested row carries a
+   *  parseable timestamp. Rendered `na` by the caller. */
+  oldestUningestedHrs: number | null;
+}
+
+/** Pure over two lists and an injected clock, so the age arithmetic is
+ *  deterministic under test rather than dependent on when the suite runs.
+ *
+ *  Unlike its two siblings this takes lists rather than callbacks: both sides
+ *  are read per account by a caller that must catch each independently, so
+ *  there is no fan-out here to carry a concurrency contract. */
+export function reconcileDataPortal(
+  objects: DataPortalObject[],
+  rows: DataPortalRow[],
+  nowMs: number,
+): DataPortalReconcile {
+  const objectKeys = new Set(objects.map((o) => o.key));
+  const rowKeys = new Set(rows.map((r) => r.objectKey));
+
+  // Date.parse of a truthy non-ISO value is NaN, which slips past a `??` guard
+  // and renders as `oldestUningestedHrs=NaN` — the defect the availability
+  // loop's snapshotAgeMs already had to fix. Unparseable rows are excluded from
+  // the minimum; if that leaves none, the answer is null, never NaN.
+  const uningestedMs = rows
+    .filter((r) => r.ingested === 0)
+    .map((r) => Date.parse(r.uploadedAt))
+    .filter((ms) => !Number.isNaN(ms));
+
+  // Reduced, never `Math.min(...uningestedMs)`. A spread passes one argument per
+  // element and blows the call stack — measured: fine at 125k, RangeError at
+  // 130k. One element per uningested row, and an ingestion sweep that has
+  // stalled accumulates those without bound. A stalled sweep is one of the three
+  // conditions this audit exists to reveal, so the arithmetic must not be what
+  // goes dark once the backlog it is watching grows large. The throw would also
+  // escape the caller's per-side catches and cost every later account its line.
+  const oldestMs = uningestedMs.reduce((min, ms) => (ms < min ? ms : min), Infinity);
+
+  return {
+    distinctObjects: objectKeys.size,
+    distinctRows: rowKeys.size,
+    orphanObjects: [...objectKeys].filter((k) => !rowKeys.has(k)),
+    phantomRows: [...rowKeys].filter((k) => !objectKeys.has(k)),
+    oldestUningestedHrs: uningestedMs.length === 0 ? null : (nowMs - oldestMs) / 3_600_000,
+  };
+}

package/payload/platform/plugins/admin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "admin",
-  "description": "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), admin-hostname (the admin-host twin of public-hostname — resolves the host that serves /calendar and the rest of the admin shell behind sign-in from the same ingress + alias + operator files, so agents point the operator at the admin /calendar URL instead of the public host that 404s it), publish-site (move an extracted static-site tree under <accountDir>/sites/<slug>/, emit one canonical path slug, and refresh llms.txt at the site root — typed refusal taxonomy replaces the prior skill-prose contract), brand-settings, account-manage, capabilities-here (deterministic install-introspection — returns enabledPlugins, tier, models, installed platform + premium specialists, registered Claude Code agent types, and the brand block as a single JSON object; the canonical tool for grounding any claim about what is enabled on the current account), account-update, the multi-account managed-service lifecycle tools (account_list, account_create, account_delete, account_purge, account_channel_routing, account_channel_routing_set — one Rubytech operator hosting N client accounts on one house install; create/delete/purge are operator-only and purge is two-step with a typed confirmation; account_create requires the client business owner's real name (ownerName), refusing a blank or the placeholder \"Owner\" and seeding it onto the sub-account's owner AdminUser and owner Person, and requires the owner's IANA timezone (timezone) — refusing a blank or a non-IANA value — seeding it onto the owner UserProfile marked owner-set so scheduling reads the owner's real zone from the start rather than the box's server default, while a managing house admin (its userId) is optional — when supplied it is validated as a live house admin and recorded as the sub-account's managingAdminUserId, and when omitted the sub-account is unmanaged and its passive-intake tasks route to the install's primary admin; account_reassign_admin repoints a client sub-account's managing admin to another live house admin (the repair path for a dangling managingAdminUserId, or to record one on an unmanaged account); account_roster is the canonical per-account identity view — one row per sub-account giving business name, role, the managing house admin resolved to a name with status (assigned/absent/dangling), the business owner from the graph with status (named/nameless), and the WhatsApp account-manager binding if any, each field carrying what it means and does not (managing admin is the responsible house team member not the owner; account manager is WhatsApp routing only with no admin rights), so the agent never stitches admin-list + account.json + whatsapp-config; account_set_owner_name names (or corrects) a client sub-account's business owner by writing the owned Person — the canonical name source — refusing a blank or the placeholder \"Owner\", the guarded repair for a nameless owner (the standing identity-audit op=nameless-owned-person detector); account_channel_routing_set repoints the install's single WhatsApp/Telegram inbound stream to a different sub-account), admin-add (refuses on a client sub-account, where admin access is already install-wide so a per-operator seat grants nothing — the sub-account's one identity, its business owner, is set at account creation; the house account, where operators hold PIN logins and admins[] rows, is unchanged), admin-remove (refuses to remove a house admin who still manages one or more client sub-accounts, naming them so the operator reassigns each with account_reassign_admin first — never silently orphans them), admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), skill-search (free-text intent → skill resolver: ranks every plugin skill's SKILL.md name+description against a query and returns the top owners with their canonical skills/<slug>/ path, so intent→skill mapping survives the available-skills menu leaving context after a compaction), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, wifi, and action-approval tools (action-pending, action-approve, action-reject, action-edit) for managing the Maxy platform.",
+  "description": "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), admin-hostname (the admin-host twin of public-hostname — resolves the host that serves /calendar and the rest of the admin shell behind sign-in from the same ingress + alias + operator files, so agents point the operator at the admin /calendar URL instead of the public host that 404s it), publish-site (move an extracted static-site tree under <accountDir>/sites/<slug>/, emit one canonical path slug, and refresh llms.txt at the site root — typed refusal taxonomy replaces the prior skill-prose contract), brand-settings, account-manage, capabilities-here (deterministic install-introspection — returns enabledPlugins, tier, models, installed platform + premium specialists, registered Claude Code agent types, and the brand block as a single JSON object; the canonical tool for grounding any claim about what is enabled on the current account), account-update, the multi-account managed-service lifecycle tools (account_list, account_create, account_delete, account_purge, account_channel_routing, account_channel_routing_set — one Rubytech operator hosting N client accounts on one house install; create/delete/purge are operator-only and purge is two-step with a typed confirmation; account_create requires the client business owner's real name (ownerName), refusing a blank or the placeholder \"Owner\" and seeding it onto the sub-account's owner AdminUser and owner Person, and requires the owner's IANA timezone (timezone) — refusing a blank or a non-IANA value — seeding it onto the owner UserProfile marked owner-set so scheduling reads the owner's real zone from the start rather than the box's server default, while a managing house admin (its userId) is optional — when supplied it is validated as a live house admin and recorded as the sub-account's managingAdminUserId, and when omitted the sub-account is unmanaged and its passive-intake tasks route to the install's primary admin; account_reassign_admin repoints a client sub-account's managing admin to another live house admin (the repair path for a dangling managingAdminUserId, or to record one on an unmanaged account); account_roster is the canonical per-account identity view — one row per sub-account giving business name, role, the managing house admin resolved to a name with status (assigned/absent/dangling), the business owner from the graph with status (named/nameless), and the WhatsApp account-manager binding if any, each field carrying what it means and does not (managing admin is the responsible house team member not the owner; account manager is WhatsApp routing only with no admin rights), so the agent never stitches admin-list + account.json + whatsapp-config; account_set_owner_name names (or corrects) a client sub-account's business owner by writing the owned Person — the canonical name source — refusing a blank or the placeholder \"Owner\", the guarded repair for a nameless owner (the standing identity-audit op=nameless-owned-person detector); account_channel_routing_set repoints the install's single WhatsApp/Telegram inbound stream to a different sub-account), admin-add (refuses on a client sub-account, where admin access is already install-wide so a per-operator seat grants nothing — the sub-account's one identity, its business owner, is set at account creation; the house account, where operators hold PIN logins and admins[] rows, is unchanged), admin-remove (refuses to remove a house admin who still manages one or more client sub-accounts, naming them so the operator reassigns each with account_reassign_admin first — never silently orphans them), admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, cpu-triage-start and cpu-triage-read (the two-call device CPU diagnostic — start spawns a detached sampling run across at least one full 120s reconcile cycle and returns a run handle immediately, read returns running/complete/failed with the per-core distribution; no admin tool blocks through a sampling window, and no spot reading is obtainable), plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), skill-search (free-text intent → skill resolver: ranks every plugin skill's SKILL.md name+description against a query and returns the top owners with their canonical skills/<slug>/ path, so intent→skill mapping survives the available-skills menu leaving context after a compaction), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, wifi, and action-approval tools (action-pending, action-approve, action-reject, action-edit) for managing the Maxy platform.",
   "version": "0.1.0",
   "author": {
     "name": "Rubytech LLC"

package/payload/platform/plugins/admin/PLUGIN.md

@@ -1,7 +1,7 @@
 ---
 name: admin
 surface: platform
-description: "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), admin-hostname (the admin-host twin of public-hostname — resolves the host that serves /calendar and the rest of the admin shell behind sign-in from the same ingress + alias + operator files, so agents point the operator at the admin /calendar URL instead of the public host that 404s it), publish-site (move an extracted static-site tree under <accountDir>/sites/<slug>/, emit one canonical path slug, and refresh llms.txt at the site root — typed refusal taxonomy replaces the prior skill-prose contract), brand-settings, account-manage, capabilities-here (deterministic install-introspection — returns enabledPlugins, tier, models, installed platform + premium specialists, registered Claude Code agent types, and the brand block as a single JSON object; the canonical tool for grounding any claim about what is enabled on the current account), account-update, the multi-account managed-service lifecycle tools (account_list, account_create, account_delete, account_purge, account_channel_routing, account_channel_routing_set — one Rubytech operator hosting N client accounts on one house install; create/delete/purge are operator-only and purge is two-step with a typed confirmation; account_create requires the client business owner's real name (ownerName), refusing a blank or the placeholder "Owner" and seeding it onto the sub-account's owner AdminUser and owner Person, and requires the owner's IANA timezone (timezone) — refusing a blank or a non-IANA value — seeding it onto the owner UserProfile marked owner-set so scheduling reads the owner's real zone from the start rather than the box's server default, while a managing house admin (its userId) is optional — when supplied it is validated as a live house admin and recorded as the sub-account's managingAdminUserId, and when omitted the sub-account is unmanaged and its passive-intake tasks route to the install's primary admin; account_reassign_admin repoints a client sub-account's managing admin to another live house admin (the repair path for a dangling managingAdminUserId, or to record one on an unmanaged account); account_roster is the canonical per-account identity view — one row per sub-account giving business name, role, the managing house admin resolved to a name with status (assigned/absent/dangling), the business owner from the graph with status (named/nameless), and the WhatsApp account-manager binding if any, each field carrying what it means and does not (managing admin is the responsible house team member not the owner; account manager is WhatsApp routing only with no admin rights), so the agent never stitches admin-list + account.json + whatsapp-config; account_set_owner_name names (or corrects) a client sub-account's business owner by writing the owned Person — the canonical name source — refusing a blank or the placeholder "Owner", the guarded repair for a nameless owner (the standing identity-audit op=nameless-owned-person detector); account_channel_routing_set repoints the install's single WhatsApp/Telegram inbound stream to a different sub-account), admin-add (refuses on a client sub-account, where admin access is already install-wide so a per-operator seat grants nothing — the sub-account's one identity, its business owner, is set at account creation; the house account, where operators hold PIN logins and admins[] rows, is unchanged), admin-remove (refuses to remove a house admin who still manages one or more client sub-accounts, naming them so the operator reassigns each with account_reassign_admin first — never silently orphans them), admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), skill-search (free-text intent → skill resolver: ranks every plugin skill's SKILL.md name+description against a query and returns the top owners with their canonical skills/<slug>/ path, so intent→skill mapping survives the available-skills menu leaving context after a compaction), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, wifi, and action-approval tools (action-pending, action-approve, action-reject, action-edit) for managing the Maxy platform."
+description: "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), admin-hostname (the admin-host twin of public-hostname — resolves the host that serves /calendar and the rest of the admin shell behind sign-in from the same ingress + alias + operator files, so agents point the operator at the admin /calendar URL instead of the public host that 404s it), publish-site (move an extracted static-site tree under <accountDir>/sites/<slug>/, emit one canonical path slug, and refresh llms.txt at the site root — typed refusal taxonomy replaces the prior skill-prose contract), brand-settings, account-manage, capabilities-here (deterministic install-introspection — returns enabledPlugins, tier, models, installed platform + premium specialists, registered Claude Code agent types, and the brand block as a single JSON object; the canonical tool for grounding any claim about what is enabled on the current account), account-update, the multi-account managed-service lifecycle tools (account_list, account_create, account_delete, account_purge, account_channel_routing, account_channel_routing_set — one Rubytech operator hosting N client accounts on one house install; create/delete/purge are operator-only and purge is two-step with a typed confirmation; account_create requires the client business owner's real name (ownerName), refusing a blank or the placeholder "Owner" and seeding it onto the sub-account's owner AdminUser and owner Person, and requires the owner's IANA timezone (timezone) — refusing a blank or a non-IANA value — seeding it onto the owner UserProfile marked owner-set so scheduling reads the owner's real zone from the start rather than the box's server default, while a managing house admin (its userId) is optional — when supplied it is validated as a live house admin and recorded as the sub-account's managingAdminUserId, and when omitted the sub-account is unmanaged and its passive-intake tasks route to the install's primary admin; account_reassign_admin repoints a client sub-account's managing admin to another live house admin (the repair path for a dangling managingAdminUserId, or to record one on an unmanaged account); account_roster is the canonical per-account identity view — one row per sub-account giving business name, role, the managing house admin resolved to a name with status (assigned/absent/dangling), the business owner from the graph with status (named/nameless), and the WhatsApp account-manager binding if any, each field carrying what it means and does not (managing admin is the responsible house team member not the owner; account manager is WhatsApp routing only with no admin rights), so the agent never stitches admin-list + account.json + whatsapp-config; account_set_owner_name names (or corrects) a client sub-account's business owner by writing the owned Person — the canonical name source — refusing a blank or the placeholder "Owner", the guarded repair for a nameless owner (the standing identity-audit op=nameless-owned-person detector); account_channel_routing_set repoints the install's single WhatsApp/Telegram inbound stream to a different sub-account), admin-add (refuses on a client sub-account, where admin access is already install-wide so a per-operator seat grants nothing — the sub-account's one identity, its business owner, is set at account creation; the house account, where operators hold PIN logins and admins[] rows, is unchanged), admin-remove (refuses to remove a house admin who still manages one or more client sub-accounts, naming them so the operator reassigns each with account_reassign_admin first — never silently orphans them), admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, cpu-triage-start and cpu-triage-read (the two-call device CPU diagnostic — start spawns a detached sampling run across at least one full 120s reconcile cycle and returns a run handle immediately, read returns running/complete/failed with the per-core distribution; no admin tool blocks through a sampling window, and no spot reading is obtainable), plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), skill-search (free-text intent → skill resolver: ranks every plugin skill's SKILL.md name+description against a query and returns the top owners with their canonical skills/<slug>/ path, so intent→skill mapping survives the available-skills menu leaving context after a compaction), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, wifi, and action-approval tools (action-pending, action-approve, action-reject, action-edit) for managing the Maxy platform."
 tools:
   - name: system-status
     publicAllowlist: false
@@ -75,6 +75,12 @@ tools:
   - name: logs-read
     publicAllowlist: false
     adminAllowlist: false
+  - name: cpu-triage-start
+    publicAllowlist: false
+    adminAllowlist: true
+  - name: cpu-triage-read
+    publicAllowlist: false
+    adminAllowlist: true
   - name: plugin-read
     publicAllowlist: false
     adminAllowlist: false

package/payload/platform/plugins/admin/mcp/dist/index.js

@@ -24,6 +24,7 @@ import { resolvePublicHostname } from "./lib/public-hostname.js";
 import { resolveAdminHostname } from "./lib/admin-hostname.js";
 import { publishSite } from "./tools/publish-site.js";
 import { resolveCapabilitiesHere } from "./tools/capabilities-here.js";
+import { startCpuTriage, readCpuTriage } from "./tools/cpu-triage.js";
 import { runCatalogueCensus } from "./lib/catalogue-census.js";
 import { lifelineTool } from "../../../../lib/mcp-lifeline/dist/index.js";
 import { listAccountsFromDir, isHouseAccount, archiveAccountDir, provisionClientAccount, findHouseAccount, getChannelRoutingAccountId, setChannelRoutingAccountId, seedAccountGraphRoot, isPlaceholderOwnerName, isBlankBusinessName, isValidTimeZone, refuseClientAdminAdd, readHouseAdminUserIds, setManagingAdmin, findClientAccountsManagedBy, reassignManagingAdmin, ACCOUNT_NODE_COUNT_CYPHER, ACCOUNT_PURGE_CYPHER, classifyManagingAdmin, ownerNameStatus, readManagingAdminUserId, setOwnerName, } from "./tools/account-lifecycle.js";
@@ -1736,6 +1737,77 @@ eagerTool(server, "logs-read", "Read recent logs. Stream logs (type=agent-stream
         return { content: [{ type: "text", text: `Failed to read logs: ${err instanceof Error ? err.message : String(err)}` }] };
     }
 });
+// ---------------------------------------------------------------------------
+// cpu-triage — device CPU diagnostic, split across two calls.
+//
+// The measurement is only trustworthy across at least one full 120s reconcile
+// cycle: the same process measured 0.2% in three consecutive 25s windows and
+// 10.8% in a 20s window, all correct, because the load is a sawtooth. Every
+// other admin tool completes inside 12s, so the run is detached and the caller
+// polls rather than blocking through a sampling window.
+//
+// What comes back is a DISTRIBUTION — per-core mean, peak, and share of the
+// window above threshold. There is deliberately no way to obtain a single
+// spot reading from these tools; that shape produced a session of
+// contradictory answers on 2026-07-20.
+// ---------------------------------------------------------------------------
+const CPU_TRIAGE_PATHS = {
+    scriptPath: resolve(PLATFORM_ROOT, "scripts", "cpu-triage.sh"),
+    runnerPath: resolve(PLATFORM_ROOT, "scripts", "cpu-triage-run.sh"),
+    logsDir: resolve(CONFIG_DIR, "logs"),
+    serverLog: resolve(CONFIG_DIR, "logs", "server.log"),
+};
+eagerTool(server, "cpu-triage-start", "Start a device CPU triage run and return immediately with a run handle. THIS DOES NOT RETURN A MEASUREMENT — " +
+    "call cpu-triage-read after `expectedCompleteAt` to get the report. " +
+    "Answers 'which cores are busy and what is on them' for the box this install runs on. " +
+    "Samples across at least one full 120s reconcile cycle and reports a distribution (per-core mean, peak, " +
+    "share of window above threshold, plus per-process and per-service deltas), never a spot reading — " +
+    "shorter samples on this platform contradict each other. " +
+    "`control` names a peer brand known to be on the PREVIOUS build: the single most valuable input to this " +
+    "measurement, because a peer that did not get the change beats any before/after inference. " +
+    "Measures the local box only; there is no remote targeting.", {
+    windowSec: z.number().int().min(120).optional().describe("Total sampling window in seconds (default 300, minimum 120 — one reconcile cycle)"),
+    intervalSec: z.number().int().min(1).optional().describe("Sample cadence in seconds (default 10)"),
+    thresholdPct: z.number().int().min(1).max(100).optional().describe("Per-core busy %% treated as hot (default 15)"),
+    control: z.string().optional().describe("A peer brand on the previous build, for like-for-like comparison"),
+}, async ({ windowSec, intervalSec, thresholdPct, control }) => {
+    const out = startCpuTriage(CPU_TRIAGE_PATHS, { windowSec, intervalSec, thresholdPct, control });
+    if (!out.ok) {
+        return {
+            content: [{ type: "text", text: JSON.stringify({ refused: out.reason, detail: out.detail }, null, 2) }],
+            isError: out.fault,
+        };
+    }
+    return {
+        content: [{
+                type: "text",
+                text: JSON.stringify({
+                    runId: out.runId,
+                    startedAt: out.startedAt,
+                    expectedCompleteAt: out.expectedCompleteAt,
+                    windowSec: out.windowSec,
+                    resultPath: out.resultPath,
+                    next: `Sampling for ${out.windowSec}s. Call cpu-triage-read after ${out.expectedCompleteAt}. Reading earlier returns status=running, which is not a failure.`,
+                }, null, 2),
+            }],
+    };
+});
+eagerTool(server, "cpu-triage-read", "Read a cpu-triage run started by cpu-triage-start. Defaults to the most recent run, so a later session can " +
+    "read a run it did not start. Returns one of three states: `running` (still sampling — NOT a failure, and NOT " +
+    "a reason to start another run), `complete` (the parsed report; exitCode 1 means one or more cores were " +
+    "sustained above threshold and the finding is in the report, exitCode 0 means clean), or `failed` (the run hit " +
+    "a precondition failure, with its exit code and stderr).", {
+    runId: z.string().optional().describe("Run to read (default: most recent)"),
+}, async ({ runId }) => {
+    const out = readCpuTriage(CPU_TRIAGE_PATHS, { runId });
+    if (!out.ok) {
+        return {
+            content: [{ type: "text", text: JSON.stringify({ refused: out.reason, detail: out.detail }, null, 2) }],
+            isError: out.fault,
+        };
+    }
+    return { content: [{ type: "text", text: JSON.stringify(out, null, 2) }] };
+});
 // operator-authored skills are written to disk as a plugin so the
 // existing plugin-manifest loader picks them up (parsePluginFrontmatter +
 // assemblePublicPluginContent + loadEmbeddedPlugins all read from