@rubytech/create-maxy-code 0.1.478 → 0.1.479

package/payload/server/server.js

@@ -652,7 +652,17 @@ var require_dist3 = __commonJS({
       Risk: "#C15B57",
       Source: "#2F8FA6",
       Finding: "#4FA389",
-      Hypothesis: "#9A8C3E"
+      Hypothesis: "#9A8C3E",
+      // Ledger cash movement (schema-base.md, added by 7b225f814). One movement
+      // of money attached to no invoice — operator-entry with no parent to drill
+      // down from, so it is a top-level chip. Burnished olive-gold sits in the
+      // money register beside Invoice's brown without colliding with it.
+      //
+      // Deliberately appended at the END rather than beside the ledger family:
+      // SHAPE_BY_LABEL assigns shapes by index position in ALL_GRAPH_LABELS
+      // (this object's key order), so a mid-table insert would silently change
+      // the rendered shape of every label after it.
+      CashEntry: "#7D5A2B"
     };
     exports.FALLBACK_LABEL_COLOUR = "#94A3B8";
     exports.ALL_GRAPH_LABELS = Object.freeze(Object.keys(exports.GRAPH_LABEL_COLOURS));
@@ -749,7 +759,8 @@ var require_dist3 = __commonJS({
       Risk: '<path d="m21.73 18-8-14a2 2 0 0 0-3.48 0l-8 14A2 2 0 0 0 4 21h16a2 2 0 0 0 1.73-3"></path><path d="M12 9v4"></path><path d="M12 17h.01"></path>',
       Source: '<path d="M12 7v14"></path><path d="M3 18a1 1 0 0 1-1-1V4a1 1 0 0 1 1-1h5a4 4 0 0 1 4 4 4 4 0 0 1 4-4h5a1 1 0 0 1 1 1v13a1 1 0 0 1-1 1h-6a3 3 0 0 0-3 3 3 3 0 0 0-3-3z"></path>',
       Finding: '<path d="M15 14c.2-1 .7-1.7 1.5-2.5 1-.9 1.5-2.2 1.5-3.5A6 6 0 0 0 6 8c0 1 .2 2.2 1.5 3.5.7.7 1.3 1.5 1.5 2.5"></path><path d="M9 18h6"></path><path d="M10 22h4"></path>',
-      Hypothesis: '<path d="M14 2v6a2 2 0 0 0 .245.96l5.51 10.08A2 2 0 0 1 18 22H6a2 2 0 0 1-1.755-2.96l5.51-10.08A2 2 0 0 0 10 8V2"></path><path d="M6.453 15h11.094"></path><path d="M8.5 2h7"></path>'
+      Hypothesis: '<path d="M14 2v6a2 2 0 0 0 .245.96l5.51 10.08A2 2 0 0 1 18 22H6a2 2 0 0 1-1.755-2.96l5.51-10.08A2 2 0 0 0 10 8V2"></path><path d="M6.453 15h11.094"></path><path d="M8.5 2h7"></path>',
+      CashEntry: '<rect width="20" height="12" x="2" y="6" rx="2"></rect><circle cx="12" cy="12" r="2"></circle><path d="M6 12h.01"></path><path d="M18 12h.01"></path>'
     };
     function iconForLabel2(label) {
       return Object.prototype.hasOwnProperty.call(LABEL_ICONS, label) ? LABEL_ICONS[label] : null;
@@ -845,6 +856,11 @@ var require_dist3 = __commonJS({
         if (clientName.length > 0) {
           return clientName.length > 24 ? clientName.slice(0, 24) + "\u2026" : clientName;
         }
+      } else if (primaryLabel2 === "CashEntry") {
+        const desc = typeof props.description === "string" ? props.description : "";
+        if (desc.length > 0) {
+          return desc.length > 24 ? desc.slice(0, 24) + "\u2026" : desc;
+        }
       } else if (primaryLabel2 === "Message") {
         const role = typeof props.role === "string" ? props.role : "";
         const roleShort = role === "user" ? "user" : role === "assistant" ? "asst" : role === "system" ? "sys" : role === "tool" ? "tool" : null;
@@ -918,6 +934,10 @@ var require_dist3 = __commonJS({
         const clientName = typeof props.clientName === "string" ? props.clientName : "";
         if (clientName.length > 0)
           return clientName;
+      } else if (primaryLabel2 === "CashEntry") {
+        const desc = typeof props.description === "string" ? props.description : "";
+        if (desc.length > 0)
+          return desc;
       }
       for (const k of ["name", "title", "summary", "givenName", "subject", "text"]) {
         const v = props[k];
@@ -1291,8 +1311,8 @@ var require_dist4 = __commonJS({
         let edgesCreated = 0;
         for (const rel of relationships) {
           const type = rel.type.replace(/`/g, "");
-          const q = rel.direction === "outgoing" ? `MATCH (a), (b) WHERE elementId(a) = $from AND elementId(b) = $to CREATE (a)-[:\`${type}\`]->(b)` : `MATCH (a), (b) WHERE elementId(a) = $from AND elementId(b) = $to CREATE (b)-[:\`${type}\`]->(a)`;
-          const r = await tx.run(q, { from: nodeId, to: rel.targetNodeId });
+          const q2 = rel.direction === "outgoing" ? `MATCH (a), (b) WHERE elementId(a) = $from AND elementId(b) = $to CREATE (a)-[:\`${type}\`]->(b)` : `MATCH (a), (b) WHERE elementId(a) = $from AND elementId(b) = $to CREATE (b)-[:\`${type}\`]->(a)`;
+          const r = await tx.run(q2, { from: nodeId, to: rel.targetNodeId });
           const created = r.summary.counters.updates().relationshipsCreated;
           if (created === 0) {
             process.stderr.write(`[graph-write] reject reason=unresolved-target-on-create labels=${labelCsv} agent=${agentLabel} relType=${rel.type} targetId=${rel.targetNodeId}
@@ -1540,10 +1560,10 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/index.ts
-import { readFileSync as readFileSync41, existsSync as existsSync38, watchFile, readdirSync as readdirSync26, statSync as statSync17 } from "fs";
+import { readFileSync as readFileSync42, existsSync as existsSync38, watchFile, readdirSync as readdirSync26, statSync as statSync17 } from "fs";
 import { spawn as spawn3 } from "child_process";
 import { createHash as createHash7 } from "crypto";
-import { resolve as resolve36, join as join42, basename as basename12 } from "path";
+import { resolve as resolve37, join as join44, basename as basename12 } from "path";
 import { homedir as homedir4 } from "os";
 import { monitorEventLoopDelay } from "perf_hooks";
 
@@ -1958,14 +1978,14 @@ function readAllConversationsCached(accountId) {
   for (const file of dir) {
     if (!file.endsWith(".jsonl")) continue;
     const path3 = join4(STORE_ROOT(), accountId, file);
-    let stat8;
+    let stat9;
     try {
-      stat8 = statSync3(path3);
+      stat9 = statSync3(path3);
     } catch {
       continue;
     }
     const hit = idCache.get(path3);
-    if (hit && hit.size === stat8.size && hit.mtimeMs === stat8.mtimeMs) {
+    if (hit && hit.size === stat9.size && hit.mtimeMs === stat9.mtimeMs) {
       out.set(file, hit.ids);
       continue;
     }
@@ -1982,7 +2002,7 @@ function readAllConversationsCached(accountId) {
     } catch {
       continue;
     }
-    idCache.set(path3, { size: stat8.size, mtimeMs: stat8.mtimeMs, ids: parsed });
+    idCache.set(path3, { size: stat9.size, mtimeMs: stat9.mtimeMs, ids: parsed });
     out.set(file, parsed);
   }
   return out;
@@ -2816,7 +2836,7 @@ var credsSaveQueue = Promise.resolve();
 async function drainCredsSaveQueue(timeoutMs = 5e3) {
   console.error(`${TAG6} draining credential save queue\u2026`);
   const timer = new Promise(
-    (resolve37) => setTimeout(() => resolve37("timeout"), timeoutMs)
+    (resolve38) => setTimeout(() => resolve38("timeout"), timeoutMs)
   );
   const result = await Promise.race([
     credsSaveQueue.then(() => "drained"),
@@ -2993,11 +3013,11 @@ async function createWaSocket(opts) {
   return sock;
 }
 async function waitForConnection(sock) {
-  return new Promise((resolve37, reject) => {
+  return new Promise((resolve38, reject) => {
     const handler = (update) => {
       if (update.connection === "open") {
         sock.ev.off("connection.update", handler);
-        resolve37();
+        resolve38();
       }
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
@@ -3105,7 +3125,7 @@ function isTimeoutError(err) {
   return Boolean(err?.__maxyTimeout);
 }
 function withTimeout(label, promise, timeoutMs) {
-  return new Promise((resolve37, reject) => {
+  return new Promise((resolve38, reject) => {
     const timer = setTimeout(() => {
       const err = new Error(`${label} timed out after ${timeoutMs}ms`);
       err.__maxyTimeout = true;
@@ -3115,7 +3135,7 @@ function withTimeout(label, promise, timeoutMs) {
     promise.then(
       (value) => {
         clearTimeout(timer);
-        resolve37(value);
+        resolve38(value);
       },
       (err) => {
         clearTimeout(timer);
@@ -4029,15 +4049,15 @@ function getChannelActivity(accountId) {
 
 // app/lib/whatsapp/outbound/send.ts
 var TAG10 = "[whatsapp:outbound]";
-function buildQuoted(q) {
+function buildQuoted(q2) {
   return {
     key: {
-      remoteJid: q.remoteJid,
-      id: q.id,
-      fromMe: q.fromMe,
-      ...q.participant ? { participant: q.participant } : {}
+      remoteJid: q2.remoteJid,
+      id: q2.id,
+      fromMe: q2.fromMe,
+      ...q2.participant ? { participant: q2.participant } : {}
     },
-    message: { conversation: q.body ?? "" }
+    message: { conversation: q2.body ?? "" }
   };
 }
 async function sendTextMessage(sock, to, text, opts) {
@@ -4155,8 +4175,8 @@ async function persistWhatsAppMessage(input) {
   const { givenName, familyName } = splitName(input.pushName);
   const prev = sessionWriteLocks.get(input.cacheKey);
   let release;
-  const mine = new Promise((resolve37) => {
-    release = resolve37;
+  const mine = new Promise((resolve38) => {
+    release = resolve38;
   });
   const chained = (prev ?? Promise.resolve()).then(() => mine);
   sessionWriteLocks.set(input.cacheKey, chained);
@@ -5860,11 +5880,11 @@ async function connectWithReconnect(conn) {
       console.error(
         `${TAG17} reconnecting account=${conn.accountId} in ${delay}ms (attempt ${decision.nextAttempts}/${maxAttempts})`
       );
-      await new Promise((resolve37) => {
-        const timer = setTimeout(resolve37, delay);
+      await new Promise((resolve38) => {
+        const timer = setTimeout(resolve38, delay);
         conn.abortController.signal.addEventListener("abort", () => {
           clearTimeout(timer);
-          resolve37();
+          resolve38();
         }, { once: true });
       });
     }
@@ -5872,16 +5892,16 @@ async function connectWithReconnect(conn) {
   }
 }
 function waitForDisconnectEvent(conn) {
-  return new Promise((resolve37) => {
+  return new Promise((resolve38) => {
     if (!conn.sock) {
-      resolve37();
+      resolve38();
       return;
     }
     const sock = conn.sock;
     const handler = (update) => {
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
-        resolve37();
+        resolve38();
       }
     };
     sock.ev.on("connection.update", handler);
@@ -6291,8 +6311,8 @@ async function handleInboundMessage(conn, msg) {
     const conversationKey = isGroup ? remoteJid : senderPhone;
     const debounceKey = `${conn.accountId}:${conversationKey}:${senderPhone}`;
     let resolvePending;
-    const sttPending = new Promise((resolve37) => {
-      resolvePending = resolve37;
+    const sttPending = new Promise((resolve38) => {
+      resolvePending = resolve38;
     });
     if (conn.debouncer) conn.debouncer.registerPending(debounceKey, sttPending);
     try {
@@ -6720,20 +6740,20 @@ function buildX11Env(chromiumWrapperPath, transport = "vnc") {
 
 // server/routes/health.ts
 function checkPort(port2, timeoutMs = 500) {
-  return new Promise((resolve37) => {
+  return new Promise((resolve38) => {
     const socket = createConnection2(port2, "127.0.0.1");
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => {
       socket.destroy();
-      resolve37(true);
+      resolve38(true);
     });
     socket.once("error", () => {
       socket.destroy();
-      resolve37(false);
+      resolve38(false);
     });
     socket.once("timeout", () => {
       socket.destroy();
-      resolve37(false);
+      resolve38(false);
     });
   });
 }
@@ -6988,8 +7008,8 @@ function webchatTurnTimeoutMs() {
   return Number(process.env.WEBCHAT_TURN_TIMEOUT_MS ?? String(2 * 6e4));
 }
 function createChatRoutes(deps) {
-  const app64 = new Hono();
-  app64.post("/", async (c) => {
+  const app65 = new Hono();
+  app65.post("/", async (c) => {
     console.log(`[chat-route] entered route=public method=POST`);
     const contentType = c.req.header("content-type") ?? "";
     const account = resolveAccount();
@@ -7253,7 +7273,7 @@ ${result.result.text}` : result.result.text;
       }
     });
   });
-  return app64;
+  return app65;
 }
 
 // app/lib/channel-pty-bridge/admin-session-id.ts
@@ -7287,8 +7307,8 @@ function isLoopbackAddr(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
 function createScheduleInjectRoutes(deps) {
-  const app64 = new Hono();
-  app64.post("/", async (c) => {
+  const app65 = new Hono();
+  app65.post("/", async (c) => {
     const env = c.env;
     const remoteAddr = env?.incoming?.socket?.remoteAddress ?? "";
     if (!isLoopbackAddr(remoteAddr)) {
@@ -7389,7 +7409,7 @@ function createScheduleInjectRoutes(deps) {
     console.error(`${TAG20} op=inject-spawn eventId=${eventId} sessionId=${sessionId} result=ok status=-`);
     return c.json({ ok: true }, 200);
   });
-  return app64;
+  return app65;
 }
 
 // server/index.ts
@@ -8022,8 +8042,8 @@ async function startLogin(opts) {
   await clearAuth(authDir);
   let resolveCode = null;
   let rejectCode = null;
-  const codePromise = new Promise((resolve37, reject) => {
-    resolveCode = resolve37;
+  const codePromise = new Promise((resolve38, reject) => {
+    resolveCode = resolve38;
     rejectCode = reject;
   });
   const codeTimer = setTimeout(
@@ -11337,12 +11357,12 @@ app5.get("/store-stream", requireAdminSession, (c) => {
       ...reactions && reactions.length > 0 ? { reactions } : {}
     };
     if (r.quotedId) {
-      const q = byMsgKeyId.get(r.quotedId);
+      const q2 = byMsgKeyId.get(r.quotedId);
       turn = {
         ...turn,
-        quoted: q ? { body: q.body, sender: q.senderName ?? (q.fromMe ? null : q.senderTelephone || null), fromMe: q.fromMe } : { body: "", sender: r.quotedSender, fromMe: false }
+        quoted: q2 ? { body: q2.body, sender: q2.senderName ?? (q2.fromMe ? null : q2.senderTelephone || null), fromMe: q2.fromMe } : { body: "", sender: r.quotedSender, fromMe: false }
       };
-      console.log(`[wa-reader] op=store-quote msgId=${r.msgKeyId} quoted=${!!q}`);
+      console.log(`[wa-reader] op=store-quote msgId=${r.msgKeyId} quoted=${!!q2}`);
     }
     if (r.attachmentId) {
       const meta = readAttachmentMeta(join19(uploadsBase, r.attachmentId));
@@ -12252,10 +12272,7 @@ function locateSidecar(sessionId) {
   }
   for (const slug of slugs) {
     const metaPath = join23(projectsRoot, slug, `${sessionId}.meta.json`);
-    if (existsSync15(metaPath)) {
-      const meta = readSidecarMeta(metaPath);
-      return { channel: meta.channel, adminUserId: meta.adminUserId, accountId: meta.accountId };
-    }
+    if (existsSync15(metaPath)) return readSidecarMeta(metaPath);
   }
   return null;
 }
@@ -12268,6 +12285,13 @@ function readTargetOwner(sessionId) {
   }
   return { found: false, owner: null };
 }
+function readSourceRowMeta(sessionId) {
+  const sidecar = locateSidecar(sessionId);
+  if (sidecar !== null) return sidecar;
+  const { projectDir } = locateSession(sessionId);
+  if (projectDir !== null) return readSidecarMeta(join23(projectDir, `${sessionId}.meta.json`));
+  return null;
+}
 function ownedByRequester(owner, requesterUserId, primaryUserId) {
   if (requesterUserId === null) return false;
   return owner === requesterUserId || owner === null && requesterUserId === primaryUserId;
@@ -12476,8 +12500,8 @@ async function reapplyLeversViaManager() {
 var WEBCHAT_SEND_TURN_WINDOW_MS = Number(process.env.WEBCHAT_SEND_TURN_WINDOW_MS ?? String(15e3));
 var sendSeq = 0;
 function createWebchatRoutes(deps) {
-  const app64 = new Hono();
-  app64.post("/send", requireAdminSession, async (c) => {
+  const app65 = new Hono();
+  app65.post("/send", requireAdminSession, async (c) => {
     let accountId;
     try {
       accountId = resolvePlatformAccountId();
@@ -12689,7 +12713,7 @@ ${note}` : note;
     if (turnTimer.unref) turnTimer.unref();
     return c.json({ ok: true });
   });
-  app64.post("/interrupt", requireAdminSession, async (c) => {
+  app65.post("/interrupt", requireAdminSession, async (c) => {
     const cacheKey = c.get("cacheKey");
     const requesterUserId = (cacheKey ? getUserIdForSession(cacheKey) : void 0) ?? null;
     const primaryUserId = resolvePrimaryAdminUserId();
@@ -12717,7 +12741,7 @@ ${note}` : note;
     }
     return c.json({ ok: true, stopped: outcome.stopped, intId: outcome.intId, deadChild: outcome.deadChild }, 200);
   });
-  app64.post("/settings", requireAdminSession, async (c) => {
+  app65.post("/settings", requireAdminSession, async (c) => {
     const body = await c.req.json().catch(() => null);
     const op = body?.op;
     const value = body?.value;
@@ -12757,7 +12781,7 @@ ${note}` : note;
     console.log(`[webchat:settings] op=${op} outcome=accepted value=${value} settingsApplied=${settingsApplied}`);
     return c.json({ ok: true, settingsApplied });
   });
-  app64.get("/session", requireAdminSession, async (c) => {
+  app65.get("/session", requireAdminSession, async (c) => {
     let accountId;
     try {
       accountId = resolvePlatformAccountId();
@@ -12835,7 +12859,7 @@ ${note}` : note;
     const indicators = await fetchComposerIndicators(sessionId);
     return c.json({ sessionId, projectDir, source, sizeBytes: jsonlSizeBytes(projectDir, sessionId), pendingPermissionPrompt: deps.pendingPromptFor?.(`session:${sessionId}`) ?? null, deliveryFailure: deps.deliveryFailureFor?.(`session:${sessionId}`) ?? null, ...indicators, ...readLevers(account) });
   });
-  app64.post("/permission-verdict", requireAdminSession, async (c) => {
+  app65.post("/permission-verdict", requireAdminSession, async (c) => {
     const body = await c.req.json().catch(() => null);
     const sessionId = body?.sessionId;
     const requestId = body?.request_id;
@@ -12852,7 +12876,7 @@ ${note}` : note;
     const ok = deps.resolvePermissionVerdict?.(`session:${sessionId}`, requestId, behavior) ?? false;
     return c.json({ ok });
   });
-  return app64;
+  return app65;
 }
 
 // server/routes/webchat-greeting.ts
@@ -14208,15 +14232,15 @@ function operatorRoleFor(config, userId) {
 async function buildAccountOptionList(accounts, userId) {
   const houseAccount = accounts.find((a) => a.config.role === "house");
   console.log(`[admin-accounts] op=list count=${accounts.length} house=${houseAccount?.accountId ?? "none"}`);
-  const resolve37 = async (a) => {
+  const resolve38 = async (a) => {
     const businessName = await fetchAccountName(a.accountId) || void 0;
     return { accountId: a.accountId, businessName, role: operatorRoleFor(a.config, userId), isHouse: a.config.role === "house" };
   };
   const houseOptions = await Promise.all(
-    accounts.filter((a) => a.config.role === "house").map(resolve37)
+    accounts.filter((a) => a.config.role === "house").map(resolve38)
   );
   const nonHouseOptions = await Promise.all(
-    accounts.filter((a) => a.config.role !== "house").map(resolve37)
+    accounts.filter((a) => a.config.role !== "house").map(resolve38)
   );
   const sortKey = (o) => (o.businessName || o.accountId).toLowerCase();
   nonHouseOptions.sort((x, y) => {
@@ -15223,9 +15247,9 @@ app18.post("/:id/resume", async (c) => {
     if (healQueue.length > 0) {
       void (async () => {
         for (let i = 0; i < healQueue.length; i++) {
-          const q = healQueue[i];
+          const q2 = healQueue[i];
           try {
-            const healComponents = await Promise.all(q.components.map(async (c2) => {
+            const healComponents = await Promise.all(q2.components.map(async (c2) => {
               const base = {
                 componentId: c2.componentId,
                 name: c2.name,
@@ -15263,25 +15287,25 @@ app18.post("/:id/resume", async (c) => {
             }));
             const messageId = await persistMessage(
               sessionId,
-              q.role,
-              q.content,
+              q2.role,
+              q2.content,
               accountId,
               void 0,
-              q.createdAt,
+              q2.createdAt,
               void 0,
               healComponents,
               void 0
             );
             jsonlHealOk += 1;
             try {
-              streamLogPath.write(`[${(/* @__PURE__ */ new Date()).toISOString()}] [admin-persist-heal] convId=${sessionId.slice(0, 8)} turnIndex=${i} role=${q.role} outcome=ok messageId=${(messageId ?? "").slice(0, 8)}
+              streamLogPath.write(`[${(/* @__PURE__ */ new Date()).toISOString()}] [admin-persist-heal] convId=${sessionId.slice(0, 8)} turnIndex=${i} role=${q2.role} outcome=ok messageId=${(messageId ?? "").slice(0, 8)}
 `);
             } catch {
             }
           } catch (err) {
             jsonlHealFail += 1;
             try {
-              streamLogPath.write(`[${(/* @__PURE__ */ new Date()).toISOString()}] [admin-persist-heal] convId=${sessionId.slice(0, 8)} turnIndex=${i} role=${q.role} outcome=fail reason=${JSON.stringify((err instanceof Error ? err.message : String(err)).slice(0, 200))}
+              streamLogPath.write(`[${(/* @__PURE__ */ new Date()).toISOString()}] [admin-persist-heal] convId=${sessionId.slice(0, 8)} turnIndex=${i} role=${q2.role} outcome=fail reason=${JSON.stringify((err instanceof Error ? err.message : String(err)).slice(0, 200))}
 `);
             } catch {
             }
@@ -15606,10 +15630,10 @@ function computeSpecialistDomains(accountId) {
   const resolveDesc = (qualified) => {
     if (!qualified.startsWith("mcp__")) return void 0;
     const rest = qualified.slice(5);
-    const sep9 = rest.indexOf("__");
-    if (sep9 < 0) return void 0;
-    const plugin = rest.slice(0, sep9);
-    const tool = rest.slice(sep9 + 2);
+    const sep10 = rest.indexOf("__");
+    if (sep10 < 0) return void 0;
+    const plugin = rest.slice(0, sep10);
+    const tool = rest.slice(sep10 + 2);
     let map = descByPlugin.get(plugin);
     if (!map) {
       const dir = pluginDirs.get(plugin);
@@ -15912,18 +15936,18 @@ var ALLOWED_EVENTS = /* @__PURE__ */ new Set([
 ]);
 var app21 = new Hono();
 app21.post("/", async (c) => {
-  const TAG53 = "[admin:events]";
+  const TAG54 = "[admin:events]";
   let body;
   try {
     body = await c.req.json();
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG53} reject reason=body-not-json detail=${detail}`);
+    console.error(`${TAG54} reject reason=body-not-json detail=${detail}`);
     return c.json({ ok: false, detail: "Request body was not valid JSON" }, 400);
   }
   const event = typeof body.event === "string" ? body.event : "";
   if (!ALLOWED_EVENTS.has(event)) {
-    console.error(`${TAG53} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
+    console.error(`${TAG54} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
     return c.json({ ok: false, detail: `Event "${event}" is not allowed` }, 400);
   }
   const rawFields = body.fields && typeof body.fields === "object" ? body.fields : {};
@@ -18564,7 +18588,7 @@ var CONVERSATION_PARENT_LABELS = /* @__PURE__ */ new Set(["AdminConversation", "
 var app23 = new Hono();
 app23.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
-  const q = (c.req.query("q") ?? "").trim();
+  const q2 = (c.req.query("q") ?? "").trim();
   const rawLimit = c.req.query("limit");
   const rawLabels = c.req.query("labels");
   const rawThreshold = c.req.query("threshold");
@@ -18573,13 +18597,13 @@ app23.get("/", requireAdminSession, async (c) => {
     console.error(`[graph-search] auth-rejected endpoint="/api/admin/graph-search" reason="no account for session"`);
     return c.json({ error: "Account not found for session" }, 401);
   }
-  if (!q) return c.json({ error: "q (search query) required" }, 400);
+  if (!q2) return c.json({ error: "q (search query) required" }, 400);
   const labels = rawLabels ? rawLabels.split(",").map((s) => s.trim()).filter((s) => s.length > 0) : [];
   const wildcard = labels.includes("*");
   const noChips = labels.length === 0;
   const allLabels = wildcard || noChips;
   if (noChips && !wildcard) {
-    console.error(`[graph-search] op=labels-default applied=all query="${q}"`);
+    console.error(`[graph-search] op=labels-default applied=all query="${q2}"`);
   }
   const parsedLimit = rawLimit ? parseInt(rawLimit, 10) : DEFAULT_LIMIT;
   const limit = Number.isFinite(parsedLimit) && parsedLimit > 0 ? Math.min(parsedLimit, MAX_LIMIT) : DEFAULT_LIMIT;
@@ -18599,7 +18623,7 @@ app23.get("/", requireAdminSession, async (c) => {
   const session = getSession();
   try {
     const res = await hybrid(session, embed, {
-      query: q,
+      query: q2,
       accountId,
       labels: forwardedLabels,
       limit,
@@ -18609,7 +18633,7 @@ app23.get("/", requireAdminSession, async (c) => {
     const total = Date.now() - started;
     if (res.embedError) {
       console.error(`[graph-search] embed-unavailable err="${res.embedError}" \u2014 bm25-only`);
-      console.error(`[graph-search] embed-degraded query="${q}" results=${res.results.length}`);
+      console.error(`[graph-search] embed-degraded query="${q2}" results=${res.results.length}`);
     }
     let labelMatchCount = 0;
     let bodyFulltextCount = 0;
@@ -18660,16 +18684,16 @@ app23.get("/", requireAdminSession, async (c) => {
       }
       resolvedResults = Array.from(seen.values()).sort((a, b) => b.score - a.score);
       console.error(
-        `[graph-search] label-match query="${q}" hits=${labelMatchCount}`
+        `[graph-search] label-match query="${q2}" hits=${labelMatchCount}`
       );
       console.error(
-        `[graph-search] body-fulltext query="${q}" hits=${bodyFulltextCount} ms=${total}`
+        `[graph-search] body-fulltext query="${q2}" hits=${bodyFulltextCount} ms=${total}`
       );
     }
     const labelsToken = wildcard ? "*" : noChips ? "all" : labels.join(",");
     const expandedFlag = !wildcard && wantsBodyFulltext ? 1 : 0;
     console.error(
-      `[graph-search] query="${q}" labels=${labelsToken} expanded=${expandedFlag} limit=${limit} mode=${res.mode} raw-results=${res.results.length} resolved-results=${resolvedResults.length} expand-ms=${res.expandMs} total-ms=${total}`
+      `[graph-search] query="${q2}" labels=${labelsToken} expanded=${expandedFlag} limit=${limit} mode=${res.mode} raw-results=${res.results.length} resolved-results=${resolvedResults.length} expand-ms=${res.expandMs} total-ms=${total}`
     );
     console.error(
       `[graph-search] threshold=${res.threshold ?? "off"} raw-merged=${res.rawMerged} suppressed=${res.suppressed} rendered=${res.results.length} bm25-bypass=${res.bm25Bypass}`
@@ -18692,7 +18716,7 @@ app23.get("/", requireAdminSession, async (c) => {
   } catch (err) {
     const elapsed = Date.now() - started;
     const message = err instanceof Error ? err.message : String(err);
-    console.error(`[graph-search] neo4j-unreachable query="${q}" ms=${elapsed} err="${message}"`);
+    console.error(`[graph-search] neo4j-unreachable query="${q2}" ms=${elapsed} err="${message}"`);
     return c.json({ error: `Graph search unavailable: ${message}` }, 503);
   } finally {
     await session.close();
@@ -18759,7 +18783,11 @@ var FILTER_TOP_LEVEL_LABELS = Object.freeze(
     "Risk",
     "Source",
     "Finding",
-    "Hypothesis"
+    "Hypothesis",
+    // Base-schema ledger (schema-base.md, Task 1819). A cash movement
+    // attached to no invoice — its only edges are outbound, so nothing
+    // drills down to it and a chip is the sole way to reach it.
+    "CashEntry"
   ])
 );
 var AGENT_ACTION_LABELS = Object.freeze(
@@ -18810,6 +18838,17 @@ var STATIC_TOP_LEVEL_LABELS = Object.freeze(
     "Review",
     "ImageObject",
     "Invoice",
+    // Supplier invoice. Declared in schema-base.md's `## Node Types` table
+    // (promoted there from schema-construction.md's top-level table by
+    // 7b225f814), which this module never parses — so it is static, not
+    // derived. Top-level because it is operator-entry with a natural key
+    // (accountId, supplier, confirmationNumber), unlike its InvoiceLine /
+    // InvoicePayment / Credit children.
+    "InboundInvoice",
+    // Ledger cash movement, declared in schema-base.md. Operator-entry with
+    // a natural key (accountId, entryId) and no parent label, so it is
+    // reachable only as a chip.
+    "CashEntry",
     "Task",
     "Project",
     "Event",
@@ -18860,8 +18899,8 @@ function parseTopLevelLabels(content) {
     const line = lines[i];
     if (line.startsWith("## ")) return [];
     if (!line.includes("|")) continue;
-    const sep9 = lines[i + 1];
-    if (!/^\s*\|?[\s:|-]+\|?\s*$/.test(sep9) || !sep9.includes("-")) continue;
+    const sep10 = lines[i + 1];
+    if (!/^\s*\|?[\s:|-]+\|?\s*$/.test(sep10) || !sep10.includes("-")) continue;
     const headers = splitPipeRow(line).map((h) => stripBackticks(h).toLowerCase());
     const labelCol = headers.findIndex((h) => h === "neo4j label");
     if (labelCol === -1) return [];
@@ -19112,7 +19151,7 @@ async function handleNeighbourhood(c, accountId) {
   }
   const includeAgentActions = c.req.query("includeAgentActions") === "1";
   const agentActionLabels = includeAgentActions ? [] : [...AGENT_ACTION_LABELS];
-  const q = (c.req.query("q") ?? "").trim();
+  const q2 = (c.req.query("q") ?? "").trim();
   const rawLimit = c.req.query("limit");
   const parsedLimit = rawLimit ? parseInt(rawLimit, 10) : NEIGHBOURHOOD_SEARCH_DEFAULT_LIMIT;
   const searchLimit = Number.isFinite(parsedLimit) && parsedLimit > 0 ? Math.min(parsedLimit, NEIGHBOURHOOD_SEARCH_MAX_LIMIT) : NEIGHBOURHOOD_SEARCH_DEFAULT_LIMIT;
@@ -19120,9 +19159,9 @@ async function handleNeighbourhood(c, accountId) {
   const session = getSession();
   try {
     let allowedIds = null;
-    if (q) {
+    if (q2) {
       const searchRes = await hybrid(session, embed, {
-        query: q,
+        query: q2,
         accountId,
         labels: [],
         limit: searchLimit,
@@ -19205,7 +19244,7 @@ async function handleNeighbourhood(c, accountId) {
     }
     if (allowedIds !== null) {
       console.error(
-        `[graph-page] neighbourhood-search-intersect q="${q}" allowed=${allowedIds.length} root=${elementId} rendered=${nodes.length}`
+        `[graph-page] neighbourhood-search-intersect q="${q2}" allowed=${allowedIds.length} root=${elementId} rendered=${nodes.length}`
       );
     }
     return c.json({ nodes, edges });
@@ -20546,18 +20585,68 @@ var session_rc_spawn_default = app35;
 
 // server/routes/admin/session-reseat.ts
 import { randomUUID as randomUUID12 } from "crypto";
-function resolveReseatPlan(body, mintId = randomUUID12, adminUserId, authenticatedName) {
+
+// server/channel-session-override.ts
+import { readFileSync as readFileSync34, writeFileSync as writeFileSync12, renameSync as renameSync9 } from "fs";
+import { join as join35 } from "path";
+var FILE2 = "channel-session-override.json";
+var UUID2 = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+function channelOverridePath(accountDir) {
+  return join35(accountDir, FILE2);
+}
+function senderKey(channel, senderId) {
+  return `${channel}:${senderId}`;
+}
+function readRaw2(accountDir) {
+  try {
+    return JSON.parse(readFileSync34(channelOverridePath(accountDir), "utf8"));
+  } catch {
+    return null;
+  }
+}
+function readChannelOverrideId(accountDir, channel, senderId) {
+  const raw = readRaw2(accountDir);
+  if (!raw || !raw.bySender || typeof raw.bySender !== "object") return null;
+  const v = raw.bySender[senderKey(channel, senderId)];
+  return typeof v === "string" && UUID2.test(v) ? v : null;
+}
+function writeChannelOverrideId(accountDir, channel, senderId, sessionId) {
+  const raw = readRaw2(accountDir);
+  const bySender = {};
+  if (raw?.bySender && typeof raw.bySender === "object") {
+    for (const [k, v] of Object.entries(raw.bySender)) {
+      if (typeof v === "string") bySender[k] = v;
+    }
+  }
+  bySender[senderKey(channel, senderId)] = sessionId;
+  const path3 = channelOverridePath(accountDir);
+  const tmp = `${path3}.${process.pid}.tmp`;
+  writeFileSync12(tmp, JSON.stringify({ bySender }, null, 2), "utf8");
+  renameSync9(tmp, path3);
+}
+
+// server/routes/admin/session-reseat.ts
+function isAdminChannelSource(source) {
+  return !!source && source.role === "admin" && (source.channel === "whatsapp" || source.channel === "telegram") && typeof source.senderId === "string" && source.senderId.length > 0;
+}
+function resolveReseatPlan(body, mintId = randomUUID12, adminUserId, authenticatedName, source) {
   const sessionId = mintId();
   const key = `session:${sessionId}`;
   const payload = {
     sessionId,
     forkFromSessionId: body.fromSessionId,
     model: body.model,
-    role: "admin",
-    channel: "webchat",
-    senderId: key,
-    webchatChannel: webchatChannelDescriptor(key)
+    role: "admin"
   };
+  if (isAdminChannelSource(source)) {
+    payload.channel = source.channel;
+    payload.senderId = source.senderId;
+    if (source.accountId) payload.targetAccountId = source.accountId;
+  } else {
+    payload.channel = "webchat";
+    payload.senderId = key;
+    payload.webchatChannel = webchatChannelDescriptor(key);
+  }
   if (body.name) payload.name = body.name;
   if (body.permissionMode) payload.permissionMode = body.permissionMode;
   if (body.effort) payload.effort = body.effort;
@@ -20598,14 +20687,18 @@ app36.post("/", requireAdminSession, async (c) => {
     }
     const accountId = cacheKey ? getAccountIdForSession(cacheKey) : void 0;
     const authenticatedName = accountId ? await resolveAuthenticatedName(accountId, adminUserId) : void 0;
+    const sourceMeta = readSourceRowMeta(fromSessionId);
+    const source = sourceMeta ? { channel: sourceMeta.channel, senderId: sourceMeta.senderId, role: sourceMeta.role, accountId: sourceMeta.accountId } : null;
     const plan = resolveReseatPlan(
       { fromSessionId, model, ...permissionMode ? { permissionMode } : {}, ...effort ? { effort } : {} },
       randomUUID12,
       adminUserId,
-      authenticatedName
+      authenticatedName,
+      source
     );
+    const isChannelFork = isAdminChannelSource(source);
     const reseatReqId = randomUUID12();
-    console.log(`[chat-reseat] op=request reseatReqId=${reseatReqId} from=${fromSessionId} to-model=${model} to-mode=${permissionMode ?? "none"} to-effort=${effort ?? "none"} new=${plan.sessionId}`);
+    console.log(`[chat-reseat] op=request reseatReqId=${reseatReqId} from=${fromSessionId} from-channel=${source?.channel ?? "none"} from-sender=${source?.senderId ?? "none"} to-model=${model} to-mode=${permissionMode ?? "none"} to-effort=${effort ?? "none"} new=${plan.sessionId}`);
     let res;
     try {
       res = await fetch(`${managerBase("session-reseat:wrapper")}/rc-spawn`, {
@@ -20645,6 +20738,23 @@ app36.post("/", requireAdminSession, async (c) => {
     } catch (err) {
       console.error(`[session-reseat] canonical-forward-failed err=${err instanceof Error ? err.message : String(err)}`);
     }
+    if (isChannelFork) {
+      const channel = plan.payload.channel;
+      const senderId = plan.payload.senderId;
+      try {
+        const provenance = source?.accountId ? "source-account" : "boot-account-fallback";
+        const dir = source?.accountId ? listValidAccounts().find((a) => a.accountId === source.accountId)?.accountDir ?? null : resolveAccount()?.accountDir ?? null;
+        if (dir) {
+          writeChannelOverrideId(dir, channel, senderId, plan.sessionId);
+          console.log(`[chat-reseat] op=channel-forward reseatReqId=${reseatReqId} senderId=${senderId} from=${fromSessionId} to=${plan.sessionId} keyedOn=${provenance}`);
+        } else {
+          console.error(`[session-reseat] channel-forward-failed reason=no-account-dir accountId=${source?.accountId ?? "none"} senderId=${senderId}`);
+        }
+      } catch (err) {
+        console.error(`[session-reseat] channel-forward-failed err=${err instanceof Error ? err.message : String(err)} senderId=${senderId}`);
+      }
+      console.log(`[chat-reseat] op=channel-fork-unbound reseatReqId=${reseatReqId} senderId=${senderId} session=${plan.sessionId} note=binds-on-next-inbound`);
+    }
     const target = `/chat?session=${plan.sessionId}`;
     console.log(`[chat-reseat] op=acquired reseatReqId=${reseatReqId} pid=${parsed?.spawnedPid ?? "none"} new=${plan.sessionId}`);
     console.log(`[chat-reseat] op=navigate reseatReqId=${reseatReqId} target=${target}`);
@@ -20779,14 +20889,14 @@ app37.get("/", async (c) => {
 var system_stats_default = app37;
 
 // server/routes/admin/health.ts
-import { existsSync as existsSync31, readFileSync as readFileSync34 } from "fs";
-import { resolve as resolve26, join as join35 } from "path";
+import { existsSync as existsSync31, readFileSync as readFileSync35 } from "fs";
+import { resolve as resolve26, join as join36 } from "path";
 var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve26(process.cwd(), "..");
 var brandHostname = "maxy";
-var brandJsonPath = join35(PLATFORM_ROOT6, "config", "brand.json");
+var brandJsonPath = join36(PLATFORM_ROOT6, "config", "brand.json");
 if (existsSync31(brandJsonPath)) {
   try {
-    const brand = JSON.parse(readFileSync34(brandJsonPath, "utf-8"));
+    const brand = JSON.parse(readFileSync35(brandJsonPath, "utf-8"));
     if (brand.hostname) brandHostname = brand.hostname;
   } catch {
   }
@@ -20796,7 +20906,7 @@ var PROCESS_STARTED_AT = (/* @__PURE__ */ new Date()).toISOString();
 var PROBE_TIMEOUT_MS = 1e3;
 function readVersion() {
   if (!existsSync31(VERSION_FILE)) return "unknown";
-  return readFileSync34(VERSION_FILE, "utf-8").trim() || "unknown";
+  return readFileSync35(VERSION_FILE, "utf-8").trim() || "unknown";
 }
 async function probeConversationDb() {
   let session;
@@ -20976,7 +21086,7 @@ function managerLogFollowUrl(sessionId, opts) {
 
 // server/routes/admin/linkedin-ingest.ts
 var TAG31 = "[linkedin-ingest-route]";
-var UUID2 = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+var UUID3 = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
 var ISO = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?(?:Z|[+-]\d{2}:\d{2})$/;
 var LINKEDIN_URL = /^https:\/\/www\.linkedin\.com\//;
 function rejectSchema(reason, missing = []) {
@@ -20990,7 +21100,7 @@ function validate(body) {
   if (b.kind !== "profile" && b.kind !== "thread") missing.push("kind");
   if (typeof b.capturedAt !== "string" || !ISO.test(b.capturedAt)) missing.push("capturedAt");
   if (typeof b.pageUrl !== "string" || !LINKEDIN_URL.test(b.pageUrl)) missing.push("pageUrl");
-  if (typeof b.dispatchId !== "string" || !UUID2.test(b.dispatchId)) missing.push("dispatchId");
+  if (typeof b.dispatchId !== "string" || !UUID3.test(b.dispatchId)) missing.push("dispatchId");
   if (missing.length) return rejectSchema("envelope", missing);
   if (b.kind === "profile") {
     const p = b.profile;
@@ -21573,7 +21683,7 @@ var browser_default = app45;
 
 // server/routes/admin/calendar.ts
 import { existsSync as existsSync32 } from "fs";
-import { join as join37 } from "path";
+import { join as join38 } from "path";
 
 // server/lib/calendar-ics.ts
 var CRLF = "\r\n";
@@ -21672,8 +21782,8 @@ function countVEvents(ics) {
 }
 
 // server/lib/calendar-availability.ts
-import { readFileSync as readFileSync35 } from "fs";
-import { join as join36 } from "path";
+import { readFileSync as readFileSync36 } from "fs";
+import { join as join37 } from "path";
 var AVAILABILITY_FILENAME = "calendar-availability.json";
 var REQUIRED_KEYS = [
   "timezone",
@@ -21682,10 +21792,10 @@ var REQUIRED_KEYS = [
   "weekly"
 ];
 function readAvailabilityConfig(accountDir) {
-  const path3 = join36(accountDir, AVAILABILITY_FILENAME);
+  const path3 = join37(accountDir, AVAILABILITY_FILENAME);
   let raw;
   try {
-    raw = readFileSync35(path3, "utf-8");
+    raw = readFileSync36(path3, "utf-8");
   } catch {
     throw new Error(`availability not configured: ${path3} not found`);
   }
@@ -22044,7 +22154,7 @@ app46.get("/booking-link", requireAdminSession, (c) => {
       console.error('[calendar] op=booking-link-fail err="no account configured"');
       return c.json({ bookingDomain: null });
     }
-    if (!existsSync32(join37(account.accountDir, AVAILABILITY_FILENAME))) {
+    if (!existsSync32(join38(account.accountDir, AVAILABILITY_FILENAME))) {
       console.log("[calendar] op=booking-link bookingDomain=none source=availability-config");
       return c.json({ bookingDomain: null });
     }
@@ -22847,7 +22957,7 @@ app56.route("/request-magic-link", request_magic_link_default);
 var access_default = app56;
 
 // server/routes/sites.ts
-import { existsSync as existsSync33, readFileSync as readFileSync36, realpathSync as realpathSync7, statSync as statSync14 } from "fs";
+import { existsSync as existsSync33, readFileSync as readFileSync37, realpathSync as realpathSync7, statSync as statSync14 } from "fs";
 import { resolve as resolve28 } from "path";
 var SAFE_SEG_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var MIME = {
@@ -22911,13 +23021,13 @@ app57.get("/:rel{.*}", (c) => {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
   }
-  let stat8;
+  let stat9;
   try {
-    stat8 = existsSync33(filePath) ? statSync14(filePath) : null;
+    stat9 = existsSync33(filePath) ? statSync14(filePath) : null;
   } catch {
-    stat8 = null;
+    stat9 = null;
   }
-  if (stat8?.isDirectory() && !reqPath.endsWith("/")) {
+  if (stat9?.isDirectory() && !reqPath.endsWith("/")) {
     const search = new URL(c.req.url).search;
     const target = `${reqPath}/${search}`;
     console.log(
@@ -22925,7 +23035,7 @@ app57.get("/:rel{.*}", (c) => {
     );
     return c.redirect(target, 301);
   }
-  if (stat8?.isDirectory()) {
+  if (stat9?.isDirectory()) {
     filePath = resolve28(filePath, "index.html");
   }
   if (!filePath.startsWith(rootDir + "/")) {
@@ -22951,7 +23061,7 @@ app57.get("/:rel{.*}", (c) => {
   }
   let body;
   try {
-    body = readFileSync36(realPath);
+    body = readFileSync37(realPath);
   } catch (err) {
     const code = err?.code;
     if (code === "EISDIR") {
@@ -22987,7 +23097,7 @@ var sites_default = app57;
 
 // app/lib/visitor-token.ts
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
-import { mkdirSync as mkdirSync8, readFileSync as readFileSync37, writeFileSync as writeFileSync12 } from "fs";
+import { mkdirSync as mkdirSync8, readFileSync as readFileSync38, writeFileSync as writeFileSync13 } from "fs";
 import { dirname as dirname12 } from "path";
 var TOKEN_PREFIX = "v1.";
 var SECRET_BYTES = 32;
@@ -22996,7 +23106,7 @@ var cachedSecret = null;
 function getSecret() {
   if (cachedSecret) return cachedSecret;
   try {
-    const hex2 = readFileSync37(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
+    const hex2 = readFileSync38(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
     if (hex2.length === SECRET_BYTES * 2) {
       cachedSecret = Buffer.from(hex2, "hex");
       return cachedSecret;
@@ -23006,11 +23116,11 @@ function getSecret() {
   const fresh = randomBytes(SECRET_BYTES).toString("hex");
   try {
     mkdirSync8(dirname12(VISITOR_TOKEN_SECRET_FILE), { recursive: true, mode: 448 });
-    writeFileSync12(VISITOR_TOKEN_SECRET_FILE, fresh, { mode: 384, flag: "wx" });
+    writeFileSync13(VISITOR_TOKEN_SECRET_FILE, fresh, { mode: 384, flag: "wx" });
     console.log(`[visitor-token] secret minted path=${VISITOR_TOKEN_SECRET_FILE}`);
   } catch {
   }
-  const hex = readFileSync37(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
+  const hex = readFileSync38(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
   cachedSecret = Buffer.from(hex, "hex");
   return cachedSecret;
 }
@@ -23063,8 +23173,8 @@ var VISITOR_COOKIE_NAME = "mxy_v";
 var VISITOR_COOKIE_MAX_AGE_SECONDS = Math.floor(DEFAULT_TTL_MS / 1e3);
 
 // app/lib/brand-config.ts
-import { existsSync as existsSync34, readFileSync as readFileSync38 } from "fs";
-import { join as join38 } from "path";
+import { existsSync as existsSync34, readFileSync as readFileSync39 } from "fs";
+import { join as join39 } from "path";
 var cached2 = null;
 var cachedAttempted = false;
 function readBrandConfig() {
@@ -23072,10 +23182,10 @@ function readBrandConfig() {
   cachedAttempted = true;
   const platformRoot5 = process.env.MAXY_PLATFORM_ROOT;
   if (!platformRoot5) return null;
-  const brandPath = join38(platformRoot5, "config", "brand.json");
+  const brandPath = join39(platformRoot5, "config", "brand.json");
   if (!existsSync34(brandPath)) return null;
   try {
-    cached2 = JSON.parse(readFileSync38(brandPath, "utf-8"));
+    cached2 = JSON.parse(readFileSync39(brandPath, "utf-8"));
     return cached2;
   } catch {
     return null;
@@ -23209,8 +23319,8 @@ function appendConsentParams(pageUrl, token) {
     const hashIdx = pageUrl.indexOf("#");
     const hash = hashIdx >= 0 ? pageUrl.slice(hashIdx) : "";
     const base = hashIdx >= 0 ? pageUrl.slice(0, hashIdx) : pageUrl;
-    const sep9 = base.indexOf("?") >= 0 ? "&" : "?";
-    return base + sep9 + `consent=needed&v=${encodeURIComponent(token)}` + hash;
+    const sep10 = base.indexOf("?") >= 0 ? "&" : "?";
+    return base + sep10 + `consent=needed&v=${encodeURIComponent(token)}` + hash;
   }
 }
 var SAFE_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,118}[a-z0-9])?$/;
@@ -23573,13 +23683,13 @@ var visitor_event_default = app60;
 
 // server/routes/session.ts
 import { resolve as resolve29 } from "path";
-import { existsSync as existsSync35, writeFileSync as writeFileSync13, mkdirSync as mkdirSync9 } from "fs";
+import { existsSync as existsSync35, writeFileSync as writeFileSync14, mkdirSync as mkdirSync9 } from "fs";
 var UUID_RE5 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function writeBrandingCache(accountId, agentSlug, branding) {
   try {
     const cacheDir = resolve29(MAXY_DIR, "branding-cache", accountId);
     mkdirSync9(cacheDir, { recursive: true });
-    writeFileSync13(resolve29(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
+    writeFileSync14(resolve29(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
   } catch (err) {
     console.error(`[branding] cache write failed: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -23904,8 +24014,205 @@ app62.get("/free-busy", async (c) => {
 });
 var calendar_public_default = app62;
 
+// server/routes/portal-fetch.ts
+import { createReadStream as createReadStream3 } from "fs";
+import { stat as stat6, readFile as readFile6, realpath } from "fs/promises";
+import { join as join40, resolve as resolve30, sep as sep8 } from "path";
+import { Readable as Readable3 } from "stream";
+
+// ../plugins/cloudflare/bin/schema-exposed-dirs.mjs
+var ONT_START = "<!-- ontology-buckets:start -->";
+var ONT_END = "<!-- ontology-buckets:end -->";
+var OWNED_START = "<!-- plugin-owned-dirs:start -->";
+var OWNED_END = "<!-- plugin-owned-dirs:end -->";
+var ALWAYS_EXPOSED = "output";
+var DOMAIN_LINE = /^- `([^`/]+)\/` - one folder per /;
+var OWNED_LINE = /^- `([^`/]+)\/` — /;
+function region(text, start, end) {
+  const i = text.indexOf(start);
+  if (i === -1) return null;
+  const j = text.indexOf(end, i);
+  return text.slice(i, j === -1 ? text.length : j);
+}
+function allowedBlockOrNull(text) {
+  const lines = text.split("\n");
+  const start = lines.findIndex((l) => l.trim() === "```allowed-top-level");
+  if (start === -1) return null;
+  for (let j = start + 1; j < lines.length; j++) {
+    if (lines[j].trim() === "```") {
+      return lines.slice(start + 1, j).map((l) => l.trim()).filter(Boolean);
+    }
+  }
+  return null;
+}
+function resolveExposedDirs(schemaText) {
+  const empty = {
+    schemaPresent: false,
+    allowed: (
+      /** @type {string[]} */
+      []
+    ),
+    domainBuckets: (
+      /** @type {string[]} */
+      []
+    ),
+    pluginOwned: (
+      /** @type {string[]} */
+      []
+    ),
+    collisions: (
+      /** @type {string[]} */
+      []
+    ),
+    exposed: (
+      /** @type {string[]} */
+      []
+    )
+  };
+  if (typeof schemaText !== "string" || schemaText.length === 0) return empty;
+  const allowed = allowedBlockOrNull(schemaText);
+  if (allowed === null) return { ...empty, schemaPresent: true };
+  const ont = region(schemaText, ONT_START, ONT_END);
+  const owned = region(schemaText, OWNED_START, OWNED_END);
+  const dirsIn = (text, re) => {
+    if (!text) return [];
+    const out = [];
+    for (const line of text.split("\n")) {
+      const m = re.exec(line.trim());
+      if (m && !out.includes(m[1])) out.push(m[1]);
+    }
+    return out;
+  };
+  const domainBuckets = dirsIn(ont, DOMAIN_LINE);
+  const pluginOwned = dirsIn(owned, OWNED_LINE);
+  const collisions = domainBuckets.filter((d) => pluginOwned.includes(d));
+  const candidates = [ALWAYS_EXPOSED, ...domainBuckets.filter((d) => !collisions.includes(d))];
+  const exposed = [...new Set(candidates)].filter((d) => allowed.includes(d)).sort();
+  return { schemaPresent: true, allowed, domainBuckets, pluginOwned, collisions, exposed };
+}
+
+// server/routes/portal-fetch.ts
+var app63 = new Hono();
+var TAG45 = "[portal-fetch]";
+async function verifySignature(secret, accountId, relPath, expiresAtMs, signature, nowMs) {
+  if (!secret || !signature) return false;
+  if (!Number.isFinite(expiresAtMs) || expiresAtMs <= nowMs) return false;
+  const key = await crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const mac = await crypto.subtle.sign(
+    "HMAC",
+    key,
+    new TextEncoder().encode(`${accountId}
+${relPath}
+${expiresAtMs}`)
+  );
+  const expected = [...new Uint8Array(mac)].map((b) => b.toString(16).padStart(2, "0")).join("");
+  if (expected.length !== signature.length) return false;
+  let diff = 0;
+  for (let i = 0; i < expected.length; i++) diff |= expected.charCodeAt(i) ^ signature.charCodeAt(i);
+  return diff === 0;
+}
+async function readAccountSecret(accountId) {
+  const path3 = resolve30(DATA_ROOT, "accounts", accountId, "secrets", "data-portal.env");
+  let text;
+  try {
+    text = await readFile6(path3, "utf8");
+  } catch {
+    console.error(`${TAG45} op=no-secret account="${accountId}" path="${path3}"`);
+    return "";
+  }
+  for (const line of text.split("\n")) {
+    const m = line.match(/^PORTAL_FETCH_SECRET=(.*)$/);
+    if (m) return m[1].trim();
+  }
+  console.error(`${TAG45} op=no-secret account="${accountId}" reason=key-absent path="${path3}"`);
+  return "";
+}
+function isValidAccountId2(value) {
+  return /^[A-Za-z0-9-]+$/.test(value);
+}
+async function resolveFetchTarget(accountDir, relPath) {
+  let schemaText = null;
+  try {
+    schemaText = await readFile6(join40(accountDir, "SCHEMA.md"), "utf8");
+  } catch {
+    schemaText = null;
+  }
+  const { exposed } = resolveExposedDirs(schemaText);
+  if (exposed.length === 0) return { ok: false, reason: "not-exposed" };
+  const lexical = resolve30(accountDir, relPath);
+  let root;
+  let absolute;
+  try {
+    root = await realpath(accountDir);
+    absolute = await realpath(lexical);
+  } catch {
+    return { ok: false, reason: "enoent" };
+  }
+  if (absolute === root || !absolute.startsWith(root + sep8)) return { ok: false, reason: "not-exposed" };
+  const top = absolute.slice(root.length + 1).split(sep8)[0];
+  if (!exposed.includes(top)) return { ok: false, reason: "not-exposed" };
+  try {
+    const st = await stat6(absolute);
+    if (!st.isFile()) return { ok: false, reason: "enoent" };
+    return { ok: true, absolute, sizeBytes: st.size };
+  } catch {
+    return { ok: false, reason: "enoent" };
+  }
+}
+function q(value) {
+  return `"${value.replace(/[\\"]/g, "\\$&").replace(/[\r\n\t]/g, " ")}"`;
+}
+async function handle(c, headOnly) {
+  const accountId = c.req.query("accountId") ?? "";
+  const relPath = c.req.query("path") ?? "";
+  const exp = Number(c.req.query("exp") ?? "0");
+  const sig = c.req.query("sig") ?? "";
+  console.log(`${TAG45} op=request account=${q(accountId)} path=${q(relPath)} head=${headOnly}`);
+  if (!isValidAccountId2(accountId)) {
+    console.error(`${TAG45} op=denied account=${q(accountId)} reason=account-id`);
+    return c.json({ ok: false, error: "denied" }, 401);
+  }
+  const secret = await readAccountSecret(accountId);
+  if (!await verifySignature(secret, accountId, relPath, exp, sig, Date.now())) {
+    console.error(`${TAG45} op=denied account=${q(accountId)} reason=secret`);
+    return c.json({ ok: false, error: "denied" }, 401);
+  }
+  const target = await resolveFetchTarget(resolve30(DATA_ROOT, "accounts", accountId), relPath);
+  if (!target.ok) {
+    const op = target.reason === "enoent" ? "miss" : "denied";
+    console.error(`${TAG45} op=${op} account=${accountId} reason=${target.reason}`);
+    return c.json({ ok: false, error: "not found" }, 404);
+  }
+  if (headOnly) {
+    console.log(`${TAG45} op=served account=${accountId} bytes=${target.sizeBytes} head=true`);
+    return c.body(null, 200);
+  }
+  console.log(`${TAG45} op=served account=${accountId} bytes=${target.sizeBytes}`);
+  return new Response(Readable3.toWeb(createReadStream3(target.absolute)), {
+    status: 200,
+    headers: {
+      "content-type": detectMimeType(target.absolute),
+      // Percent-encoded per RFC 6266, so a name carrying a quote cannot break
+      // out of the form and CR/LF cannot reach the Headers constructor.
+      "content-disposition": `attachment; filename*=UTF-8''${encodeURIComponent(relPath.split("/").pop() ?? "file")}`,
+      "x-content-type-options": "nosniff",
+      // Private client documents: never let a browser or proxy cache one.
+      "cache-control": "private, no-store"
+    }
+  });
+}
+app63.get("/fetch", (c) => handle(c, false));
+app63.on("HEAD", "/fetch", (c) => handle(c, true));
+var portal_fetch_default = app63;
+
 // app/lib/timeentry-census.ts
-var TAG45 = "[timeentry-census]";
+var TAG46 = "[timeentry-census]";
 function reconcileTimeEntries(rows, now, horizonMs) {
   const openEntries = rows.openEntries.length;
   let oldestOpenAgeMs = 0;
@@ -23945,12 +24252,12 @@ async function runTimeEntryCensusOnce(session, now, horizonMs) {
       sumAdjustments: toNum(r.get("sumAdjustments"))
     }));
     const finding = reconcileTimeEntries({ openEntries, taskSums }, now, horizonMs);
-    const line = `${TAG45} openEntries=${finding.openEntries} oldestOpenAgeMin=${finding.oldestOpenAgeMin} maxOpenPerAccount=${finding.maxOpenPerAccount} driftTasks=${finding.driftTasks}`;
+    const line = `${TAG46} openEntries=${finding.openEntries} oldestOpenAgeMin=${finding.oldestOpenAgeMin} maxOpenPerAccount=${finding.maxOpenPerAccount} driftTasks=${finding.driftTasks}`;
     if (finding.alarm) console.error(`${line} alarm=true`);
     else console.log(line);
     return finding;
   } catch (err) {
-    console.error(`${TAG45} error="${err instanceof Error ? err.message : String(err)}"`);
+    console.error(`${TAG46} error="${err instanceof Error ? err.message : String(err)}"`);
     return null;
   }
 }
@@ -23964,13 +24271,13 @@ function startTimeEntryCensus(openSession, opts = {}) {
     try {
       session = openSession();
     } catch (err) {
-      console.error(`${TAG45} open-session-failed error="${err instanceof Error ? err.message : String(err)}"`);
+      console.error(`${TAG46} open-session-failed error="${err instanceof Error ? err.message : String(err)}"`);
       return;
     }
     try {
       await runTimeEntryCensusOnce(session, Date.now(), horizonMs);
     } catch (err) {
-      console.error(`${TAG45} tick-failed error="${err instanceof Error ? err.message : String(err)}"`);
+      console.error(`${TAG46} tick-failed error="${err instanceof Error ? err.message : String(err)}"`);
     } finally {
       try {
         await session.close();
@@ -23987,8 +24294,8 @@ function startTimeEntryCensus(openSession, opts = {}) {
 }
 
 // app/lib/ledger-census.ts
-import { readdirSync as readdirSync25, readFileSync as readFileSync39, statSync as statSync15 } from "fs";
-import { join as join39 } from "path";
+import { readdirSync as readdirSync25, readFileSync as readFileSync40, statSync as statSync15 } from "fs";
+import { join as join41 } from "path";
 
 // ../lib/ledger-core/dist/reconcile.js
 var LEDGER_INDEX_NAMES = [
@@ -24031,7 +24338,7 @@ function formatCensusLine(f) {
 }
 
 // app/lib/ledger-census.ts
-var TAG46 = "[ledger-census]";
+var TAG47 = "[ledger-census]";
 var DAY_MS = 864e5;
 function countWriteRejects24h(logDir, now) {
   let entries;
@@ -24042,10 +24349,10 @@ function countWriteRejects24h(logDir, now) {
   }
   let total = 0;
   for (const name of entries) {
-    const path3 = join39(logDir, name);
+    const path3 = join41(logDir, name);
     try {
       if (now - statSync15(path3).mtimeMs > DAY_MS) continue;
-      for (const line of readFileSync39(path3, "utf8").split("\n")) {
+      for (const line of readFileSync40(path3, "utf8").split("\n")) {
         if (line.includes("[graph-write] reject")) total += 1;
       }
     } catch {
@@ -24107,7 +24414,7 @@ async function runLedgerCensusOnce(session, now) {
     else console.log(line);
     return finding;
   } catch (err) {
-    console.error(`${TAG46} error="${err instanceof Error ? err.message : String(err)}"`);
+    console.error(`${TAG47} error="${err instanceof Error ? err.message : String(err)}"`);
     return null;
   }
 }
@@ -24120,7 +24427,7 @@ function startLedgerCensus(openSession, opts = {}) {
       session = openSession();
     } catch (err) {
       console.error(
-        `${TAG46} open-session-failed error="${err instanceof Error ? err.message : String(err)}"`
+        `${TAG47} open-session-failed error="${err instanceof Error ? err.message : String(err)}"`
       );
       return;
     }
@@ -24128,7 +24435,7 @@ function startLedgerCensus(openSession, opts = {}) {
       await runLedgerCensusOnce(session, Date.now());
     } catch (err) {
       console.error(
-        `${TAG46} tick-failed error="${err instanceof Error ? err.message : String(err)}"`
+        `${TAG47} tick-failed error="${err instanceof Error ? err.message : String(err)}"`
       );
     } finally {
       try {
@@ -24146,7 +24453,7 @@ function startLedgerCensus(openSession, opts = {}) {
 }
 
 // app/lib/conversation-audit.ts
-var TAG47 = "[conversation-audit]";
+var TAG48 = "[conversation-audit]";
 async function runConversationAudit() {
   const session = getSession();
   try {
@@ -24172,12 +24479,12 @@ async function runConversationAudit() {
       unpairable: Number(rec?.get("unpairable") ?? 0)
     };
     console.error(
-      `${TAG47} channel=whatsapp total=${result.total} unreconciled=${result.unreconciled} unpairable=${result.unpairable}`
+      `${TAG48} channel=whatsapp total=${result.total} unreconciled=${result.unreconciled} unpairable=${result.unpairable}`
     );
     return result;
   } catch (err) {
     const reason = err instanceof Error ? `${err.name}:${err.message.slice(0, 200)}` : String(err).slice(0, 200);
-    console.error(`${TAG47} op=failed reason=${reason}`);
+    console.error(`${TAG48} op=failed reason=${reason}`);
     return null;
   } finally {
     await session.close();
@@ -24303,13 +24610,13 @@ function startGraphHealthTimer() {
 
 // app/lib/file-watcher.ts
 import * as fsp2 from "fs/promises";
-import { resolve as resolve30, sep as sep8 } from "path";
+import { resolve as resolve31, sep as sep9 } from "path";
 var ACCOUNT_UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var DEFAULT_COALESCE_MS = 500;
 var ROOTS = ["accounts"];
 function _routeEvent(rootName, filename) {
   if (!filename) return null;
-  const segs = filename.split(sep8).filter(Boolean);
+  const segs = filename.split(sep9).filter(Boolean);
   if (segs.length < 2) return null;
   const accountId = segs[0];
   if (!ACCOUNT_UUID_RE4.test(accountId)) return null;
@@ -24322,7 +24629,7 @@ async function startFileWatcher(opts = {}) {
   const dropFn = opts.drop ?? dropFileIndex;
   for (const r of ROOTS) {
     try {
-      await fsp2.mkdir(resolve30(dataRoot, r), { recursive: true });
+      await fsp2.mkdir(resolve31(dataRoot, r), { recursive: true });
     } catch (err) {
       console.error(
         `[file-watcher] start-failed root="${r}" err="${err.message}" \u2014 index will be maintained by the 5-min reconcile backstop only`
@@ -24343,7 +24650,7 @@ async function startFileWatcher(opts = {}) {
     timers.set(relativePath, t);
   }
   async function runHook(relativePath, accountId) {
-    const absolute = resolve30(dataRoot, relativePath);
+    const absolute = resolve31(dataRoot, relativePath);
     let exists = false;
     try {
       const st = await fsp2.stat(absolute);
@@ -24367,7 +24674,7 @@ async function startFileWatcher(opts = {}) {
     }
   }
   async function watchRoot(rootName) {
-    const absRoot = resolve30(dataRoot, rootName);
+    const absRoot = resolve31(dataRoot, rootName);
     try {
       const iter = fsp2.watch(absRoot, { recursive: true, signal: controller.signal });
       for await (const event of iter) {
@@ -24406,7 +24713,7 @@ async function startFileWatcher(opts = {}) {
 
 // app/lib/migrate-uploads.ts
 import { mkdir as mkdir5, readdir as readdir5, rename as rename2, rm as rm3 } from "fs/promises";
-import { dirname as dirname13, relative as relative6, resolve as resolve31 } from "path";
+import { dirname as dirname13, relative as relative6, resolve as resolve32 } from "path";
 var ACCOUNT_UUID_RE5 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function walkFiles(dir) {
   const out = [];
@@ -24417,7 +24724,7 @@ async function walkFiles(dir) {
     return out;
   }
   for (const e of entries) {
-    const abs = resolve31(dir, e.name);
+    const abs = resolve32(dir, e.name);
     if (e.isDirectory()) {
       out.push(...await walkFiles(abs));
     } else if (e.isFile()) {
@@ -24437,7 +24744,7 @@ async function relocateTree(srcDir, destDir, dataRoot, accountId, session) {
   let moved = 0;
   for (const oldAbs of files) {
     const suffix = relative6(srcDir, oldAbs);
-    const newAbs = resolve31(destDir, suffix);
+    const newAbs = resolve32(destDir, suffix);
     await mkdir5(dirname13(newAbs), { recursive: true });
     await rename2(oldAbs, newAbs);
     moved++;
@@ -24464,7 +24771,7 @@ async function relocateTree(srcDir, destDir, dataRoot, accountId, session) {
 }
 async function migrateUploads(opts = {}) {
   const dataRoot = opts.dataRoot ?? DATA_ROOT;
-  const oldRoot = resolve31(dataRoot, "uploads");
+  const oldRoot = resolve32(dataRoot, "uploads");
   let topEntries;
   try {
     topEntries = await readdir5(oldRoot, { withFileTypes: true });
@@ -24485,8 +24792,8 @@ async function migrateUploads(opts = {}) {
       const name = entry.name;
       if (ACCOUNT_UUID_RE5.test(name)) {
         moved += await relocateTree(
-          resolve31(oldRoot, name),
-          resolve31(dataRoot, "accounts", name, "uploads"),
+          resolve32(oldRoot, name),
+          resolve32(dataRoot, "accounts", name, "uploads"),
           dataRoot,
           name,
           session
@@ -24498,8 +24805,8 @@ async function migrateUploads(opts = {}) {
           continue;
         }
         moved += await relocateTree(
-          resolve31(oldRoot, "public"),
-          resolve31(dataRoot, "accounts", installAccountId, "uploads", "public"),
+          resolve32(oldRoot, "public"),
+          resolve32(dataRoot, "accounts", installAccountId, "uploads", "public"),
           dataRoot,
           null,
           // public uploads carry no graph nodes
@@ -24528,9 +24835,9 @@ async function migrateUploads(opts = {}) {
 }
 
 // app/lib/migrate-admin-webchat-sidecars.ts
-import { readdir as readdir6, readFile as readFile6, rename as rename3, writeFile as writeFile4, unlink as unlink3 } from "fs/promises";
+import { readdir as readdir6, readFile as readFile7, rename as rename3, writeFile as writeFile4, unlink as unlink3 } from "fs/promises";
 import { existsSync as existsSync36 } from "fs";
-import { join as join40 } from "path";
+import { join as join42 } from "path";
 var ADMIN_ROLE2 = "admin";
 var WEBCHAT_CHANNEL2 = "webchat";
 var SESSION_META_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.meta\.json$/i;
@@ -24538,10 +24845,10 @@ var defaultResolveName = async (_accountId, userId) => {
   const res = await loadAdminUserName(userId);
   return res.source === "neo4j" && res.joined.length > 0 ? res.joined : null;
 };
-async function readRaw2(path3) {
+async function readRaw3(path3) {
   let raw;
   try {
-    raw = await readFile6(path3, "utf8");
+    raw = await readFile7(path3, "utf8");
   } catch {
     return null;
   }
@@ -24575,7 +24882,7 @@ async function collectLiveSidecars(projectsRoot) {
   }
   for (const slug of slugs) {
     if (!slug.isDirectory()) continue;
-    const slugDir = join40(projectsRoot, slug.name);
+    const slugDir = join42(projectsRoot, slug.name);
     let entries;
     try {
       entries = await readdir6(slugDir, { withFileTypes: true });
@@ -24584,9 +24891,9 @@ async function collectLiveSidecars(projectsRoot) {
     }
     for (const entry of entries) {
       if (entry.isFile() && SESSION_META_RE.test(entry.name)) {
-        out.push(join40(slugDir, entry.name));
+        out.push(join42(slugDir, entry.name));
       } else if (entry.isDirectory() && entry.name === "subagents") {
-        const subDir = join40(slugDir, entry.name);
+        const subDir = join42(slugDir, entry.name);
         let subs;
         try {
           subs = await readdir6(subDir, { withFileTypes: true });
@@ -24594,7 +24901,7 @@ async function collectLiveSidecars(projectsRoot) {
           continue;
         }
         for (const s of subs) {
-          if (s.isFile() && SESSION_META_RE.test(s.name)) out.push(join40(subDir, s.name));
+          if (s.isFile() && SESSION_META_RE.test(s.name)) out.push(join42(subDir, s.name));
         }
       }
     }
@@ -24606,7 +24913,7 @@ function shortId(path3) {
   return base.slice(0, 8);
 }
 async function migrateAdminWebchatSidecars(opts = {}) {
-  const projectsRoot = opts.projectsRoot ?? (process.env.CLAUDE_CONFIG_DIR ? join40(process.env.CLAUDE_CONFIG_DIR, "projects") : null) ?? "";
+  const projectsRoot = opts.projectsRoot ?? (process.env.CLAUDE_CONFIG_DIR ? join42(process.env.CLAUDE_CONFIG_DIR, "projects") : null) ?? "";
   const usersFile = opts.usersFile ?? USERS_FILE;
   const accountId = opts.accountId ?? resolveAccount()?.accountId ?? null;
   const resolveName = opts.resolveName ?? defaultResolveName;
@@ -24646,7 +24953,7 @@ async function migrateAdminWebchatSidecars(opts = {}) {
   };
   const sidecars = await collectLiveSidecars(projectsRoot);
   for (const path3 of sidecars) {
-    const raw = await readRaw2(path3);
+    const raw = await readRaw3(path3);
     if (!raw) continue;
     if (raw.role !== ADMIN_ROLE2 || raw.channel !== WEBCHAT_CHANNEL2) continue;
     result.scanned++;
@@ -24664,7 +24971,7 @@ async function migrateAdminWebchatSidecars(opts = {}) {
     await writeRaw(path3, raw);
     result.backfilled++;
     await resolveAdminName();
-    const back = await readRaw2(path3);
+    const back = await readRaw3(path3);
     const wrote = back && back.adminUserId === soleAdminUserId;
     if (wrote && resolvedNameForAdmin) {
       result.resolvedName++;
@@ -24951,8 +25258,8 @@ var streamSSE = (c, cb, onError) => {
 
 // app/lib/whatsapp/gateway/routes.ts
 function createWaChannelRoutes(deps) {
-  const app64 = new Hono();
-  app64.get("/wa-channel/inbound", (c) => {
+  const app65 = new Hono();
+  app65.get("/wa-channel/inbound", (c) => {
     const senderId = c.req.query("senderId");
     if (!senderId) return c.json({ error: "senderId required" }, 400);
     return streamSSE(c, async (stream2) => {
@@ -24960,9 +25267,11 @@ function createWaChannelRoutes(deps) {
         void stream2.writeSSE({ data: JSON.stringify(payload) });
       });
       console.error(`[whatsapp-native] op=channel-attached senderId=${senderId}`);
+      deps.onAttached?.(senderId);
       stream2.onAbort(() => {
         deps.hub.detach(senderId);
         console.error(`[whatsapp-native] op=channel-detached senderId=${senderId}`);
+        deps.onDetached?.(senderId);
       });
       while (!stream2.aborted) {
         await stream2.sleep(15e3);
@@ -24970,7 +25279,7 @@ function createWaChannelRoutes(deps) {
       }
     });
   });
-  app64.post("/wa-channel/reply", async (c) => {
+  app65.post("/wa-channel/reply", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const text = body?.text;
@@ -24991,7 +25300,7 @@ function createWaChannelRoutes(deps) {
     console.error(`[whatsapp-native] op=reply-dispatch senderId=${senderId} bytes=${bytes}`);
     return c.json({ ok: true });
   });
-  app64.post("/wa-channel/reply-document", async (c) => {
+  app65.post("/wa-channel/reply-document", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const files = body?.files;
@@ -25030,7 +25339,7 @@ function createWaChannelRoutes(deps) {
     }
     return c.json({ ok: true, results });
   });
-  app64.post("/wa-channel/ready", async (c) => {
+  app65.post("/wa-channel/ready", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     if (typeof senderId !== "string") {
@@ -25039,7 +25348,7 @@ function createWaChannelRoutes(deps) {
     deps.onReady?.(senderId);
     return c.json({ ok: true });
   });
-  app64.post("/wa-channel/received", async (c) => {
+  app65.post("/wa-channel/received", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const waMessageId = body?.waMessageId;
@@ -25049,7 +25358,7 @@ function createWaChannelRoutes(deps) {
     deps.onReceived?.(senderId, waMessageId);
     return c.json({ ok: true });
   });
-  app64.post("/wa-channel/turn-end", async (c) => {
+  app65.post("/wa-channel/turn-end", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const sessionId = body?.sessionId;
@@ -25082,7 +25391,7 @@ function createWaChannelRoutes(deps) {
     console.error(`[whatsapp-native] op=turn-end sessionId=${sid} replied=no delivered=none`);
     return c.json({ ok: true, delivered: "none" });
   });
-  return app64;
+  return app65;
 }
 
 // app/lib/whatsapp/gateway/wa-gateway.ts
@@ -25104,9 +25413,30 @@ var WaGateway = class {
   spawning = /* @__PURE__ */ new Set();
   seq = 0;
   /** Hono sub-app exposing the loopback channel routes; mount on the UI app. */
+  /** Task 1789 — senderId -> the ms at which its channel server last detached,
+   *  cleared on attach. The standing audit reads this; nothing else does. */
+  detachedAt = /* @__PURE__ */ new Map();
+  /** Seat lost. `atMs` is injected so the audit's accounting is testable. */
+  recordDetached(senderId, atMs) {
+    this.detachedAt.set(senderId, atMs);
+  }
+  /** Seat regained — the sender is no longer unseated. */
+  recordAttached(senderId) {
+    this.detachedAt.delete(senderId);
+  }
+  /** Senders with no channel server for longer than `olderThanMs`. */
+  unseatedSenders(nowMs, olderThanMs) {
+    const out = [];
+    for (const [senderId, sinceMs] of this.detachedAt) {
+      if (nowMs - sinceMs > olderThanMs) out.push({ senderId, sinceMs });
+    }
+    return out.sort((a, b) => a.senderId.localeCompare(b.senderId));
+  }
   routes() {
     return createWaChannelRoutes({
       hub: this.hub,
+      onAttached: (senderId) => this.recordAttached(senderId),
+      onDetached: (senderId) => this.recordDetached(senderId, Date.now()),
       sendOutbound: (senderId, text) => this.sendOutbound(senderId, text),
       sendDocument: (senderId, filePath, caption) => this.sendDocument(senderId, filePath, caption),
       onReady: (senderId) => {
@@ -25217,7 +25547,7 @@ var WaGateway = class {
       },
       Date.now()
     );
-    const resolvedSessionId = adminSessionIdFor(
+    const resolvedSessionId = (input.role === "admin" ? this.deps.resolveSessionOverride?.(input.effectiveAccountId, senderId) : null) || adminSessionIdFor(
       input.effectiveAccountId,
       senderId,
       input.role === "public" && input.personId ? input.personId : void 0
@@ -25285,17 +25615,28 @@ function logDuplicateSenderGroups(groups) {
     );
   }
 }
+function logUnseatedSenders(entries, nowMs) {
+  for (const e of entries) {
+    const secs = Math.round((nowMs - e.sinceMs) / 1e3);
+    console.error(`[whatsapp-native] op=sender-unseated senderId=${e.senderId} since=${new Date(e.sinceMs).toISOString()} forSeconds=${secs}`);
+  }
+}
 
 // app/lib/whatsapp/gateway/spawn-request.ts
 function buildWaSpawnRequest(input) {
   const personId = input.role === "public" && input.personId ? input.personId : void 0;
   return {
-    // Task 1746 — the deterministic per-sender id is the ONLY id a sender's
-    // session ever has. Task 1526's per-firing seat override used to replace it
-    // on a scheduled cold start, which spawned a second session for the sender;
-    // that session then attached under the sender's own hub key and swallowed
-    // their real messages until it detached, splitting the conversation in two.
-    sessionId: adminSessionIdFor(input.accountId, input.senderId, personId),
+    // Task 1746 — the deterministic per-sender id is the DEFAULT id a sender's
+    // session has. Task 1526's per-firing seat override used to replace it on a
+    // scheduled cold start, which spawned a second session per firing; that
+    // session then attached under the sender's own hub key and swallowed their
+    // real messages until it detached, splitting the conversation in two.
+    //
+    // Task 1789's override is not that. It is a stable per-sender forward
+    // pointer written once by an operator re-seat and resolving identically for
+    // every subsequent inbound, so it can never yield a second id for a sender.
+    // Do not remove it without reading server/channel-session-override.ts.
+    sessionId: input.overrideSessionId || adminSessionIdFor(input.accountId, input.senderId, personId),
     role: input.role,
     channel: "whatsapp",
     personId,
@@ -25479,8 +25820,8 @@ var import_dist7 = __toESM(require_dist(), 1);
 
 // app/lib/webchat/gateway/routes.ts
 function createWebchatChannelRoutes(deps) {
-  const app64 = new Hono();
-  app64.get("/webchat-channel/inbound", (c) => {
+  const app65 = new Hono();
+  app65.get("/webchat-channel/inbound", (c) => {
     const key = c.req.query("key");
     if (!key) return c.json({ error: "key required" }, 400);
     return streamSSE(c, async (stream2) => {
@@ -25498,7 +25839,7 @@ function createWebchatChannelRoutes(deps) {
       }
     });
   });
-  app64.post("/webchat-channel/reply", async (c) => {
+  app65.post("/webchat-channel/reply", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const text = body?.text;
@@ -25508,7 +25849,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onReply?.(key, text);
     return c.json({ ok: true });
   });
-  app64.post("/webchat-channel/connector-auth", async (c) => {
+  app65.post("/webchat-channel/connector-auth", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const sessionId = body?.sessionId;
@@ -25521,7 +25862,7 @@ function createWebchatChannelRoutes(deps) {
     const result = await deps.onConnectorAuth({ key, sessionId, name, completed });
     return c.json(result);
   });
-  app64.post("/webchat-channel/ready", async (c) => {
+  app65.post("/webchat-channel/ready", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     if (typeof key !== "string") {
@@ -25530,7 +25871,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onReady?.(key);
     return c.json({ ok: true });
   });
-  app64.post("/webchat-channel/permission-request", async (c) => {
+  app65.post("/webchat-channel/permission-request", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const requestId = body?.request_id;
@@ -25544,7 +25885,7 @@ function createWebchatChannelRoutes(deps) {
     const verdict = await deps.awaitPermissionVerdict({ key, requestId, toolName, description, inputPreview });
     return c.json(verdict);
   });
-  app64.post("/webchat-channel/received", async (c) => {
+  app65.post("/webchat-channel/received", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const messageId = body?.messageId;
@@ -25554,7 +25895,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onReceived?.(key, messageId);
     return c.json({ ok: true });
   });
-  app64.post("/webchat-channel/turn-end", async (c) => {
+  app65.post("/webchat-channel/turn-end", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const sessionId = body?.sessionId;
@@ -25577,7 +25918,7 @@ function createWebchatChannelRoutes(deps) {
     console.error(`[webchat-native] op=turn-end channel=webchat key=${k} sessionId=${sid} replied=no delivered=none`);
     return c.json({ ok: true, delivered: "none" });
   });
-  return app64;
+  return app65;
 }
 
 // app/lib/webchat/gateway/webchat-gateway.ts
@@ -25635,16 +25976,16 @@ var WebchatGateway = class _WebchatGateway {
    *  The public /api/chat route awaits this to return the reply on the same SSE
    *  response, preserving the pre-756 POST→single-blob browser contract. */
   awaitReply(key, timeoutMs) {
-    return new Promise((resolve37) => {
+    return new Promise((resolve38) => {
       const timer = setTimeout(() => {
         this.replyAwaiters.delete(key);
-        resolve37({ timeout: true });
+        resolve38({ timeout: true });
       }, timeoutMs);
       if (timer.unref) timer.unref();
       this.replyAwaiters.set(key, (r) => {
         clearTimeout(timer);
         this.replyAwaiters.delete(key);
-        resolve37(r);
+        resolve38(r);
       });
     });
   }
@@ -25655,11 +25996,11 @@ var WebchatGateway = class _WebchatGateway {
    *  terminal dialog stays answerable). */
   awaitPermissionVerdict(p, timeoutMs) {
     const k = _WebchatGateway.promptKey(p.key, p.requestId);
-    return new Promise((resolve37) => {
+    return new Promise((resolve38) => {
       this.pendingPrompts.get(k)?.resolve({ timeout: true });
       const timer = setTimeout(() => {
         this.pendingPrompts.delete(k);
-        resolve37({ timeout: true });
+        resolve38({ timeout: true });
       }, timeoutMs);
       if (timer.unref) timer.unref();
       this.pendingPrompts.set(k, {
@@ -25668,7 +26009,7 @@ var WebchatGateway = class _WebchatGateway {
         resolve: (r) => {
           clearTimeout(timer);
           this.pendingPrompts.delete(k);
-          resolve37(r);
+          resolve38(r);
         }
       });
       console.error(`[webchat:perm] op=open key=${keyDisplay(p.key)} id=${p.requestId} tool=${p.toolName}`);
@@ -26233,7 +26574,7 @@ async function fanOut(subscribers, text, onError, tag) {
 
 // app/lib/webchat/file-delivery.ts
 import { realpathSync as realpathSync8 } from "fs";
-import { resolve as resolve32 } from "path";
+import { resolve as resolve33 } from "path";
 
 // app/lib/channel-pty-bridge/file-delivery.ts
 var SEND_USER_FILE = "SendUserFile";
@@ -26324,29 +26665,29 @@ function makeFileDelivery(opts) {
 }
 
 // app/lib/webchat/file-delivery.ts
-var TAG48 = "[webchat-adaptor]";
+var TAG49 = "[webchat-adaptor]";
 function platformRoot2() {
   return process.env.MAXY_PLATFORM_ROOT || "";
 }
 function makeWebchatSendFile(entry) {
   return async (filePath) => {
     if (!entry.accountId) {
-      console.error(`${TAG48} file-delivery reject reason=no-account sender=${entry.senderId}`);
+      console.error(`${TAG49} file-delivery reject reason=no-account sender=${entry.senderId}`);
       return { ok: false, error: "no-account" };
     }
-    const accountDir = resolve32(platformRoot2(), "..", "data/accounts", entry.accountId);
+    const accountDir = resolve33(platformRoot2(), "..", "data/accounts", entry.accountId);
     try {
       const resolved = realpathSync8(filePath);
       const accountResolved = realpathSync8(accountDir);
       if (!resolved.startsWith(accountResolved + "/")) {
-        console.error(`${TAG48} file-delivery reject reason=outside_account_directory sender=${entry.senderId}`);
+        console.error(`${TAG49} file-delivery reject reason=outside_account_directory sender=${entry.senderId}`);
         return { ok: false, error: "outside-account" };
       }
       return { ok: true };
     } catch (err) {
       const code = err.code;
       console.error(
-        `${TAG48} file-delivery reject reason=${code === "ENOENT" ? "not-found" : "path-error"} sender=${entry.senderId}`
+        `${TAG49} file-delivery reject reason=${code === "ENOENT" ? "not-found" : "path-error"} sender=${entry.senderId}`
       );
       return { ok: false, error: code === "ENOENT" ? "not-found" : "path-error" };
     }
@@ -26355,7 +26696,7 @@ function makeWebchatSendFile(entry) {
 function makeWebchatFileDelivery(entry) {
   return makeFileDelivery({
     entry,
-    tag: TAG48,
+    tag: TAG49,
     channel: "webchat",
     sendFile: makeWebchatSendFile(entry),
     deferUntilVerdict: true
@@ -26417,7 +26758,7 @@ function buildPublicWebchatSpawnRequest(input) {
 }
 
 // app/lib/whatsapp/inbound/file-delivery-bridge.ts
-var TAG49 = "[whatsapp-adaptor]";
+var TAG50 = "[whatsapp-adaptor]";
 var SEND_USER_FILE2 = "SendUserFile";
 var WHATSAPP_SEND_DOCUMENT = "whatsapp-send-document";
 function platformRoot3() {
@@ -26435,7 +26776,7 @@ function makeWhatsAppSendFile(entry, maxyAccountId) {
     });
     if (result.ok) return { ok: true };
     console.error(
-      `${TAG49} file-delivery reject reason=send-failed sender=${entry.senderId} status=${result.status} message=${result.error}`
+      `${TAG50} file-delivery reject reason=send-failed sender=${entry.senderId} status=${result.status} message=${result.error}`
     );
     return { ok: false, error: result.error };
   };
@@ -26443,7 +26784,7 @@ function makeWhatsAppSendFile(entry, maxyAccountId) {
 function makeWhatsAppFileDelivery(entry, maxyAccountId) {
   const shared = makeFileDelivery({
     entry,
-    tag: TAG49,
+    tag: TAG50,
     channel: "whatsapp",
     sendFile: makeWhatsAppSendFile(entry, maxyAccountId)
   });
@@ -26478,7 +26819,7 @@ function makeWhatsAppFileDelivery(entry, maxyAccountId) {
         if (!delivered) {
           const fileField = call.filePath !== void 0 ? ` file=${call.filePath}` : "";
           console.error(
-            `${TAG49} file-delivery-unreconciled sender=${entry.senderId} sessionId=${sid} tool=${WHATSAPP_SEND_DOCUMENT}${fileField}`
+            `${TAG50} file-delivery-unreconciled sender=${entry.senderId} sessionId=${sid} tool=${WHATSAPP_SEND_DOCUMENT}${fileField}`
           );
         }
       }
@@ -26664,8 +27005,8 @@ var import_dist8 = __toESM(require_dist(), 1);
 
 // app/lib/telegram/gateway/routes.ts
 function createTelegramChannelRoutes(deps) {
-  const app64 = new Hono();
-  app64.get("/tg-channel/inbound", (c) => {
+  const app65 = new Hono();
+  app65.get("/tg-channel/inbound", (c) => {
     const key = c.req.query("key");
     if (!key) return c.json({ error: "key required" }, 400);
     return streamSSE(c, async (stream2) => {
@@ -26683,7 +27024,7 @@ function createTelegramChannelRoutes(deps) {
       }
     });
   });
-  app64.post("/tg-channel/reply", async (c) => {
+  app65.post("/tg-channel/reply", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const text = body?.text;
@@ -26699,7 +27040,7 @@ function createTelegramChannelRoutes(deps) {
     console.error(`[telegram-native] op=reply key=${key} bytes=${Buffer.byteLength(text, "utf8")}`);
     return c.json({ ok: true });
   });
-  app64.post("/tg-channel/ready", async (c) => {
+  app65.post("/tg-channel/ready", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     if (typeof key !== "string") {
@@ -26708,7 +27049,7 @@ function createTelegramChannelRoutes(deps) {
     deps.onReady?.(key);
     return c.json({ ok: true });
   });
-  app64.post("/tg-channel/received", async (c) => {
+  app65.post("/tg-channel/received", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const messageId = body?.messageId;
@@ -26718,7 +27059,7 @@ function createTelegramChannelRoutes(deps) {
     deps.onReceived?.(key, messageId);
     return c.json({ ok: true });
   });
-  app64.post("/tg-channel/turn-end", async (c) => {
+  app65.post("/tg-channel/turn-end", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const sessionId = body?.sessionId;
@@ -26751,7 +27092,7 @@ function createTelegramChannelRoutes(deps) {
     console.error(`[telegram-native] op=turn-end key=${key} sessionId=${sid} replied=no delivered=none`);
     return c.json({ ok: true, delivered: "none" });
   });
-  return app64;
+  return app65;
 }
 
 // app/lib/telegram/gateway/telegram-gateway.ts
@@ -26842,7 +27183,7 @@ var TelegramGateway = class {
       { key: input.senderId, text: input.text, messageId: `tg-${++this.seq}`, source, standingRules, scheduleProvenance: input.scheduleProvenance },
       Date.now()
     );
-    const resolvedSessionId = adminSessionIdFor(
+    const resolvedSessionId = (input.role === "admin" ? this.deps.resolveSessionOverride?.(input.accountId, input.senderId) : null) || adminSessionIdFor(
       input.accountId,
       input.senderId,
       input.role === "public" && input.personId ? input.personId : void 0
@@ -26879,10 +27220,11 @@ var TelegramGateway = class {
 function buildTelegramSpawnRequest(input) {
   const personId = input.role === "public" && input.personId ? input.personId : void 0;
   return {
-    // Task 1746 — the deterministic per-sender id is the ONLY id a sender's
-    // session ever has. Mirror of the WhatsApp builder; see its comment for why
-    // Task 1526's per-firing override was removed.
-    sessionId: adminSessionIdFor(input.accountId, input.senderId, personId),
+    // Task 1746 / 1789 — the deterministic per-sender id is the DEFAULT; an
+    // operator re-seat sets a stable per-sender forward pointer that wins here.
+    // Mirror of the WhatsApp builder; see its comment for the full distinction
+    // between this pointer and Task 1526's removed per-firing seat.
+    sessionId: input.overrideSessionId || adminSessionIdFor(input.accountId, input.senderId, personId),
     role: input.role,
     channel: "telegram",
     personId,
@@ -26899,9 +27241,9 @@ function buildTelegramSpawnRequest(input) {
 
 // app/lib/telegram/outbound/send-document.ts
 import { realpathSync as realpathSync9 } from "fs";
-import { readFile as readFile7, stat as stat7 } from "fs/promises";
-import { resolve as resolve33, basename as basename11 } from "path";
-var TAG50 = "[telegram:outbound]";
+import { readFile as readFile8, stat as stat8 } from "fs/promises";
+import { resolve as resolve34, basename as basename11 } from "path";
+var TAG51 = "[telegram:outbound]";
 var TELEGRAM_DOCUMENT_MAX_BYTES = 50 * 1024 * 1024;
 async function sendTelegramDocument(input) {
   const { botToken, chatId, filePath, caption, maxyAccountId, platformRoot: platformRoot5 } = input;
@@ -26911,25 +27253,25 @@ async function sendTelegramDocument(input) {
   if (!maxyAccountId || !platformRoot5) {
     return { ok: false, status: 400, error: "Cannot validate file path: missing account or platform context" };
   }
-  const accountDir = resolve33(platformRoot5, "..", "data/accounts", maxyAccountId);
+  const accountDir = resolve34(platformRoot5, "..", "data/accounts", maxyAccountId);
   let resolvedPath;
   try {
     resolvedPath = realpathSync9(filePath);
     const accountResolved = realpathSync9(accountDir);
     if (!resolvedPath.startsWith(accountResolved + "/")) {
-      console.error(`${TAG50} document REJECTED reason=outside_account_directory maxyAccountId=${maxyAccountId}`);
+      console.error(`${TAG51} document REJECTED reason=outside_account_directory maxyAccountId=${maxyAccountId}`);
       return { ok: false, status: 403, error: "Access denied: file is outside the account directory" };
     }
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
-      console.error(`${TAG50} document ENOENT path=${filePath}`);
+      console.error(`${TAG51} document ENOENT path=${filePath}`);
       return { ok: false, status: 404, error: `File not found: ${filePath}` };
     }
-    console.error(`${TAG50} document path error: ${String(err)}`);
+    console.error(`${TAG51} document path error: ${String(err)}`);
     return { ok: false, status: 500, error: String(err) };
   }
-  const fileStat = await stat7(resolvedPath);
+  const fileStat = await stat8(resolvedPath);
   if (fileStat.size > TELEGRAM_DOCUMENT_MAX_BYTES) {
     return {
       ok: false,
@@ -26938,7 +27280,7 @@ async function sendTelegramDocument(input) {
     };
   }
   const filename = basename11(resolvedPath);
-  const buffer = Buffer.from(await readFile7(resolvedPath));
+  const buffer = Buffer.from(await readFile8(resolvedPath));
   const form = new FormData();
   form.append("chat_id", String(chatId));
   if (caption) form.append("caption", caption);
@@ -26959,13 +27301,13 @@ async function sendTelegramDocument(input) {
     error = e instanceof Error ? e.message : String(e);
   }
   console.error(
-    `${TAG50} sent document to=${chatId} file=${filename} bytes=${fileStat.size} ok=${ok}` + (messageId !== void 0 ? ` id=${messageId}` : "")
+    `${TAG51} sent document to=${chatId} file=${filename} bytes=${fileStat.size} ok=${ok}` + (messageId !== void 0 ? ` id=${messageId}` : "")
   );
   return ok ? { ok: true, messageId } : { ok: false, status: 500, error };
 }
 
 // app/lib/telegram/outbound/file-delivery.ts
-var TAG51 = "[telegram:outbound]";
+var TAG52 = "[telegram:outbound]";
 function platformRoot4() {
   return process.env.MAXY_PLATFORM_ROOT || "";
 }
@@ -26977,11 +27319,11 @@ function makeTelegramSendFile(entry) {
       botToken = (entry.role === "admin" ? tg?.adminBotToken : tg?.publicBotToken) ?? null;
     }
     if (!botToken) {
-      console.error(`${TAG51} file-delivery reject reason=no-bot-token sender=${entry.senderId} role=${entry.role}`);
+      console.error(`${TAG52} file-delivery reject reason=no-bot-token sender=${entry.senderId} role=${entry.role}`);
       return { ok: false, error: "no-bot-token" };
     }
     if (entry.replyTarget == null) {
-      console.error(`${TAG51} file-delivery reject reason=no-reply-target sender=${entry.senderId} role=${entry.role}`);
+      console.error(`${TAG52} file-delivery reject reason=no-reply-target sender=${entry.senderId} role=${entry.role}`);
       return { ok: false, error: "no-reply-target" };
     }
     const result = await sendTelegramDocument({
@@ -26998,7 +27340,7 @@ function makeTelegramSendFile(entry) {
 function makeTelegramFileDelivery(entry) {
   return makeFileDelivery({
     entry,
-    tag: TAG51,
+    tag: TAG52,
     channel: "telegram",
     sendFile: makeTelegramSendFile(entry)
   });
@@ -27038,17 +27380,17 @@ function startTelegramNativeFileFollower(input) {
 }
 
 // server/telegram-descriptor.ts
-import { resolve as resolve34, join as join41 } from "path";
+import { resolve as resolve35, join as join43 } from "path";
 function telegramGatewayUrl() {
   return `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`;
 }
 function telegramServerPath() {
-  return process.env.MAXY_TELEGRAM_CHANNEL_SERVER_PATH ?? resolve34(process.env.MAXY_PLATFORM_ROOT ?? join41(__dirname, ".."), "services/telegram-channel/dist/server.js");
+  return process.env.MAXY_TELEGRAM_CHANNEL_SERVER_PATH ?? resolve35(process.env.MAXY_PLATFORM_ROOT ?? join43(__dirname, ".."), "services/telegram-channel/dist/server.js");
 }
 
 // app/lib/channel-pty-bridge/public-session-end-review.ts
 import { randomUUID as randomUUID16 } from "crypto";
-var TAG52 = "[public-session-review]";
+var TAG53 = "[public-session-review]";
 var CONSUMED_CAP = 500;
 var consumed = /* @__PURE__ */ new Set();
 function consumeOnce(sessionId) {
@@ -27075,7 +27417,7 @@ async function fetchJsonl(sessionId) {
     return await res.text();
   } catch (err) {
     console.error(
-      `${TAG52} jsonl-fetch-failed sessionId=${sessionId} err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG53} jsonl-fetch-failed sessionId=${sessionId} err="${err instanceof Error ? err.message : String(err)}"`
     );
     return null;
   }
@@ -27099,7 +27441,7 @@ async function fetchPriorWrites(sliceToken, accountId) {
     const res = await fetch(url);
     if (!res.ok) {
       console.error(
-        `${TAG52} prior-writes-fetch-failed sliceToken=${sliceToken.slice(0, 8)} status=${res.status}`
+        `${TAG53} prior-writes-fetch-failed sliceToken=${sliceToken.slice(0, 8)} status=${res.status}`
       );
       return [];
     }
@@ -27107,7 +27449,7 @@ async function fetchPriorWrites(sliceToken, accountId) {
     return Array.isArray(body.writes) ? body.writes : [];
   } catch (err) {
     console.error(
-      `${TAG52} prior-writes-fetch-threw sliceToken=${sliceToken.slice(0, 8)} err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG53} prior-writes-fetch-threw sliceToken=${sliceToken.slice(0, 8)} err="${err instanceof Error ? err.message : String(err)}"`
     );
     return [];
   }
@@ -27136,7 +27478,7 @@ function composeInitialMessage(input) {
 }
 async function dispatchReviewer(input, initialMessage) {
   const sessionId = randomUUID16();
-  console.log(`${TAG52} route target=rc-spawn sessionId=${sessionId.slice(0, 8)} sourceSession=${input.sessionId.slice(0, 8)}`);
+  console.log(`${TAG53} route target=rc-spawn sessionId=${sessionId.slice(0, 8)} sourceSession=${input.sessionId.slice(0, 8)}`);
   const spawned = await managerRcSpawn({
     sessionId,
     initialMessage,
@@ -27156,21 +27498,21 @@ async function firePublicSessionEndReview(input) {
   const dispatchedAt = Date.now();
   if (consumed.has(input.sessionId)) {
     console.log(
-      `${TAG52} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
+      `${TAG53} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
     );
     return;
   }
   const jsonl = await fetchJsonl(input.sessionId);
   if (!jsonl) {
     console.log(
-      `${TAG52} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-jsonl-missing`
+      `${TAG53} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-jsonl-missing`
     );
     return;
   }
   const operatorTurns = countOperatorTurns(jsonl);
   if (operatorTurns === 0) {
     console.log(
-      `${TAG52} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-no-turns`
+      `${TAG53} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-no-turns`
     );
     return;
   }
@@ -27184,19 +27526,19 @@ async function firePublicSessionEndReview(input) {
   });
   if (!consumeOnce(input.sessionId)) {
     console.log(
-      `${TAG52} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
+      `${TAG53} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
     );
     return;
   }
   const dispatched = await dispatchReviewer(input, initialMessage);
   if (!dispatched.ok) {
     console.error(
-      `${TAG52} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-spawn-failed reason=${dispatched.reason}`
+      `${TAG53} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-spawn-failed reason=${dispatched.reason}`
     );
     return;
   }
   console.log(
-    `${TAG52} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=dispatched managerSessionId=${dispatched.managerSessionId} operatorTurns=${operatorTurns} priorWrites=${priorWrites.length} ms=${Date.now() - dispatchedAt}`
+    `${TAG53} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=dispatched managerSessionId=${dispatched.managerSessionId} operatorTurns=${operatorTurns} priorWrites=${priorWrites.length} ms=${Date.now() - dispatchedAt}`
   );
 }
 
@@ -27330,8 +27672,8 @@ function broadcastAdminShutdown(reason) {
 
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash6, verify as cryptoVerify } from "crypto";
-import { existsSync as existsSync37, readFileSync as readFileSync40, statSync as statSync16 } from "fs";
-import { resolve as resolve35 } from "path";
+import { existsSync as existsSync37, readFileSync as readFileSync41, statSync as statSync16 } from "fs";
+import { resolve as resolve36 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
 function canonicalize(value) {
@@ -27366,7 +27708,7 @@ var PUBKEY_SHA256 = "8eee6bcb33545fd13b16d3199a5735ca5db5062834c7b49dfe4f23801d9
 var GRACE_DAYS = 7;
 var GRACE_MS = GRACE_DAYS * 24 * 60 * 60 * 1e3;
 function pubkeyPath(brand) {
-  return resolve35(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
+  return resolve36(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
 }
 var memo = null;
 function memoKey(mtimeMs, account) {
@@ -27378,12 +27720,12 @@ function resolveEntitlement(brand, account) {
   if (brand.commercialMode !== true) {
     return logResolved(implicitTrust(account), null);
   }
-  const entitlementPath = resolve35(brand.configDir, "entitlement.json");
+  const entitlementPath = resolve36(brand.configDir, "entitlement.json");
   if (!existsSync37(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
-  const stat8 = statSync16(entitlementPath);
-  const key = memoKey(stat8.mtimeMs, account);
+  const stat9 = statSync16(entitlementPath);
+  const key = memoKey(stat9.mtimeMs, account);
   if (memo && memo.key === key) {
     return memo.result;
   }
@@ -27394,7 +27736,7 @@ function resolveEntitlement(brand, account) {
 function verifyAndResolve(brand, entitlementPath, account) {
   let pubkeyPem;
   try {
-    pubkeyPem = readFileSync40(pubkeyPath(brand), "utf-8");
+    pubkeyPem = readFileSync41(pubkeyPath(brand), "utf-8");
   } catch (err) {
     return logResolved(anonymousFallback("pubkey-missing"), {
       reason: "pubkey-missing"
@@ -27408,7 +27750,7 @@ function verifyAndResolve(brand, entitlementPath, account) {
   }
   let envelope;
   try {
-    envelope = JSON.parse(readFileSync40(entitlementPath, "utf-8"));
+    envelope = JSON.parse(readFileSync41(entitlementPath, "utf-8"));
   } catch {
     return logResolved(anonymousFallback("malformed"), { reason: "malformed" });
   }
@@ -27570,14 +27912,14 @@ function clientFrom(c) {
 }
 installMediaDownloadGuard();
 var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT || "";
-var BRAND_JSON_PATH = PLATFORM_ROOT8 ? join42(PLATFORM_ROOT8, "config", "brand.json") : "";
+var BRAND_JSON_PATH = PLATFORM_ROOT8 ? join44(PLATFORM_ROOT8, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", marketingUrl: "https://getmaxy.com" };
 if (BRAND_JSON_PATH && !existsSync38(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
 }
 if (BRAND_JSON_PATH && existsSync38(BRAND_JSON_PATH)) {
   try {
-    const parsed = JSON.parse(readFileSync41(BRAND_JSON_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync42(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
   } catch (err) {
     console.error(`[brand] Failed to parse brand.json: ${err.message}`);
@@ -27609,11 +27951,11 @@ var brandLoginOpts = {
   appleTouchIconPath: brandAppIcon512Path,
   themeColor: BRAND.defaultColors?.primary
 };
-var ALIAS_DOMAINS_PATH = join42(homedir4(), BRAND.configDir, "alias-domains.json");
+var ALIAS_DOMAINS_PATH = join44(homedir4(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
     if (!existsSync38(ALIAS_DOMAINS_PATH)) return null;
-    const parsed = JSON.parse(readFileSync41(ALIAS_DOMAINS_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync42(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
       return null;
@@ -27637,7 +27979,15 @@ watchFile(ALIAS_DOMAINS_PATH, { interval: 2e3 }, () => {
 function isPublicHost(host) {
   return host.startsWith("public.") || aliasDomains.has(host);
 }
-var app63 = new Hono();
+var app64 = new Hono();
+function resolveChannelOverride(accountId, channel, senderId) {
+  try {
+    const dir = listValidAccounts().find((a) => a.accountId === accountId)?.accountDir;
+    return dir ? readChannelOverrideId(dir, channel, senderId) : null;
+  } catch {
+    return null;
+  }
+}
 var nativeFileFollowers = /* @__PURE__ */ new Map();
 var webchatFileFollowers = /* @__PURE__ */ new Map();
 async function fetchAccountStandingRules(accountId) {
@@ -27676,8 +28026,9 @@ async function recordPassiveDispatch(input) {
 }
 var waGateway = new WaGateway({
   fetchStandingRules: fetchAccountStandingRules,
+  resolveSessionOverride: (accountId, senderId) => resolveChannelOverride(accountId, "whatsapp", senderId),
   gatewayUrl: `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`,
-  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve36(process.env.MAXY_PLATFORM_ROOT ?? join42(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
+  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve37(process.env.MAXY_PLATFORM_ROOT ?? join44(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
   // Task 751 / 1390 — file delivery on the native channel. `maxyAccountId` (the
   // path-validation scope) is the sender's effective SESSION account, resolved
   // once at the inbound gate and threaded here via the gateway's per-sender doc
@@ -27692,7 +28043,7 @@ var waGateway = new WaGateway({
       caption,
       accountId,
       maxyAccountId,
-      platformRoot: resolve36(process.env.MAXY_PLATFORM_ROOT ?? join42(__dirname, ".."))
+      platformRoot: resolve37(process.env.MAXY_PLATFORM_ROOT ?? join44(__dirname, ".."))
     });
     return result.ok ? { ok: true, messageId: result.messageId } : { ok: false, error: result.error };
   },
@@ -27744,7 +28095,17 @@ var waGateway = new WaGateway({
       const managesAccount = effectiveAccountId !== accountId ? effectiveAccountId : "none";
       console.error(`[whatsapp-native] op=account-manager-route senderId=${senderId} managesAccount=${managesAccount} effectiveAccount=${effectiveAccountId} source=gate`);
     }
-    const req = buildWaSpawnRequest({ accountId: effectiveAccountId, senderId, role, personId, gatewayUrl, serverPath });
+    const req = buildWaSpawnRequest({
+      accountId: effectiveAccountId,
+      senderId,
+      role,
+      personId,
+      gatewayUrl,
+      serverPath,
+      // Task 1789 — admin rows only: a public session's id keys on personId as
+      // well as senderId, so the per-sender pointer is not applicable to it.
+      overrideSessionId: role === "admin" ? resolveChannelOverride(effectiveAccountId, "whatsapp", senderId) : null
+    });
     await ensureSessionConversation({
       accountId: effectiveAccountId,
       sessionId: req.sessionId,
@@ -27790,13 +28151,13 @@ var waGateway = new WaGateway({
     nativeFileFollowers.set(senderId, ac);
   }
 });
-app63.route("/", waGateway.routes());
+app64.route("/", waGateway.routes());
 waGateway.startSweeper();
 function runDuplicateSenderAudit() {
   try {
     const configDir2 = process.env.CLAUDE_CONFIG_DIR;
     if (!configDir2) return;
-    const projectsRoot = join42(configDir2, "projects");
+    const projectsRoot = join44(configDir2, "projects");
     const records = [];
     for (const { path: jsonlPath, isSubagent, archived } of enumerateJsonls(projectsRoot)) {
       if (isSubagent || archived) continue;
@@ -27806,6 +28167,8 @@ function runDuplicateSenderAudit() {
       records.push({ sessionId, channel: meta.channel, senderId: meta.senderId, accountId: meta.accountId });
     }
     logDuplicateSenderGroups(findDuplicateSenderGroups(records));
+    const now = Date.now();
+    logUnseatedSenders(waGateway.unseatedSenders(now, 15 * 6e4), now);
   } catch (err) {
     console.error(`[whatsapp-native] op=duplicate-sender-audit-error error=${err instanceof Error ? err.message : String(err)}`);
   }
@@ -27912,16 +28275,26 @@ var webchatGateway = new WebchatGateway({
   firePublicSessionEndReview: (input) => firePublicSessionEndReview(input)
 });
 setWebchatGateway(webchatGateway);
-app63.route("/", webchatGateway.routes());
+app64.route("/", webchatGateway.routes());
 webchatGateway.startSweeper();
 webchatGateway.startPublicReaper();
 var telegramFileFollowers = /* @__PURE__ */ new Map();
 var telegramGateway = new TelegramGateway({
   fetchStandingRules: fetchAccountStandingRules,
+  resolveSessionOverride: (accountId, senderId) => resolveChannelOverride(accountId, "telegram", senderId),
   gatewayUrl: telegramGatewayUrl(),
   serverPath: telegramServerPath(),
   ensureChannelSession: async ({ accountId, senderId, role, personId, chatId, gatewayUrl, serverPath }) => {
-    const req = buildTelegramSpawnRequest({ accountId, senderId, role, personId, gatewayUrl, serverPath });
+    const req = buildTelegramSpawnRequest({
+      accountId,
+      senderId,
+      role,
+      personId,
+      gatewayUrl,
+      serverPath,
+      // Task 1789 — admin rows only; see the WhatsApp twin.
+      overrideSessionId: role === "admin" ? resolveChannelOverride(accountId, "telegram", senderId) : null
+    });
     const result = await managerRcSpawn(req);
     if ("error" in result) {
       console.error(`[telegram-native] spawn-failed senderId=${senderId} role=${role} error=${result.error} status=${result.status}`);
@@ -27946,7 +28319,7 @@ var telegramGateway = new TelegramGateway({
   }
 });
 setTelegramGateway(telegramGateway);
-app63.route("/", telegramGateway.routes());
+app64.route("/", telegramGateway.routes());
 telegramGateway.startSweeper();
 var chatRoutes = createChatRoutes({
   handleInbound: (input) => webchatGateway.handleInbound(input),
@@ -27980,19 +28353,19 @@ var scheduleInjectRoutes = createScheduleInjectRoutes({
     return managed.account;
   }
 });
-app63.route("/api/channel/schedule-inject", scheduleInjectRoutes);
-app63.use("*", clientIpMiddleware);
+app64.route("/api/channel/schedule-inject", scheduleInjectRoutes);
+app64.use("*", clientIpMiddleware);
 function allowsSameOriginFraming(path3) {
   return path3 === "/vnc-viewer.html" || path3.startsWith("/api/admin/attachment/") || path3.startsWith("/api/public-reader/attachment/") || path3 === "/api/admin/files/download";
 }
-app63.use("*", async (c, next) => {
+app64.use("*", async (c, next) => {
   await next();
   c.header("X-Content-Type-Options", "nosniff");
   c.header("Referrer-Policy", "strict-origin-when-cross-origin");
   c.header("X-Frame-Options", allowsSameOriginFraming(c.req.path) ? "SAMEORIGIN" : "DENY");
 });
 var HTTP_LOG_PATHS = /* @__PURE__ */ new Set(["/vnc-viewer.html", "/vnc-popout.html"]);
-app63.use("*", async (c, next) => {
+app64.use("*", async (c, next) => {
   if (!HTTP_LOG_PATHS.has(c.req.path)) {
     await next();
     return;
@@ -28010,7 +28383,7 @@ app63.use("*", async (c, next) => {
     });
   }
 });
-app63.use("*", async (c, next) => {
+app64.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isOperatorHost(host, getOperatorDomains()) || !isPublicHost(host)) {
     await next();
@@ -28048,7 +28421,7 @@ function resolveRemoteAuthOpts(c) {
   return { ...brandLoginOpts, origin };
 }
 var MAX_LOGIN_BODY = 8 * 1024;
-app63.post("/__remote-auth/login", async (c) => {
+app64.post("/__remote-auth/login", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   if (!requestIsTlsTerminated(c)) {
@@ -28093,7 +28466,7 @@ app63.post("/__remote-auth/login", async (c) => {
     }
   });
 });
-app63.get("/__remote-auth/logout", (c) => {
+app64.get("/__remote-auth/logout", (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   console.error(`[remote-auth] logout ip=${clientIp}`);
@@ -28106,7 +28479,7 @@ app63.get("/__remote-auth/logout", (c) => {
     }
   });
 });
-app63.post("/__remote-auth/change-password", async (c) => {
+app64.post("/__remote-auth/change-password", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   const rateLimited = checkRateLimit(client);
@@ -28165,13 +28538,13 @@ app63.post("/__remote-auth/change-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), mode: "change", changeError: "Failed to save password", redirect }), 200);
   }
 });
-app63.get("/__remote-auth/setup", (c) => {
+app64.get("/__remote-auth/setup", (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), mode: "setup" }), 200);
 });
-app63.post("/__remote-auth/set-initial-password", async (c) => {
+app64.post("/__remote-auth/set-initial-password", async (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
@@ -28209,10 +28582,10 @@ app63.post("/__remote-auth/set-initial-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), mode: "setup", setupError: "Failed to save password. Please try again." }), 200);
   }
 });
-app63.get("/api/remote-auth/status", (c) => {
+app64.get("/api/remote-auth/status", (c) => {
   return c.json({ configured: isRemoteAuthConfigured() });
 });
-app63.post("/api/remote-auth/set-password", async (c) => {
+app64.post("/api/remote-auth/set-password", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -28251,10 +28624,10 @@ app63.post("/api/remote-auth/set-password", async (c) => {
     return c.json({ error: "Failed to save password" }, 500);
   }
 });
-app63.route("/api/_client-error", client_error_default);
+app64.route("/api/_client-error", client_error_default);
 console.log("[client-error-route] mounted");
 var PWA_PUBLIC_PATHS = /* @__PURE__ */ new Set(["/sw.js", ...PWA_SURFACES.map((s) => s.manifestPath)]);
-app63.use("*", async (c, next) => {
+app64.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path3 = c.req.path;
   if (path3 === "/favicon.ico" || path3.startsWith("/assets/") || path3.startsWith("/brand/") || // Public free/busy is read by the booking page (a separate Cloudflare Pages
@@ -28298,27 +28671,28 @@ app63.use("*", async (c, next) => {
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), redirect: path3 }), 200);
 });
-app63.route("/api/health", health_default);
-app63.route("/api/chat", chatRoutes);
-app63.route("/api/whatsapp", whatsapp_default);
-app63.route("/api/storage", storage_broker_default);
-app63.route("/api/whatsapp-reader", whatsapp_reader_default);
-app63.route("/api/public-reader", public_reader_default);
-app63.route("/api/webchat", createWebchatRoutes({
+app64.route("/api/health", health_default);
+app64.route("/api/chat", chatRoutes);
+app64.route("/api/whatsapp", whatsapp_default);
+app64.route("/api/storage", storage_broker_default);
+app64.route("/api/whatsapp-reader", whatsapp_reader_default);
+app64.route("/api/public-reader", public_reader_default);
+app64.route("/api/webchat", createWebchatRoutes({
   handleInbound: (input) => webchatGateway.handleInbound(input),
   // Task 940 — the permission relay's pointer read + verdict write.
   pendingPromptFor: (key) => webchatGateway.pendingPromptFor(key),
   deliveryFailureFor: (key) => webchatGateway.deliveryFailureFor(key),
   resolvePermissionVerdict: (key, requestId, behavior) => webchatGateway.resolvePermissionVerdict(key, requestId, behavior)
 }));
-app63.route("/api/webchat/greeting", webchat_greeting_default);
-app63.route("/api/telegram", telegram_default);
-app63.route("/api/quickbooks", quickbooks_default);
-app63.route("/api/onboarding", onboarding_default);
-app63.route("/api/admin", admin_default);
-app63.route("/api/access", access_default);
-app63.route("/api/session", session_default2);
-app63.route("/api/calendar", calendar_public_default);
+app64.route("/api/webchat/greeting", webchat_greeting_default);
+app64.route("/api/telegram", telegram_default);
+app64.route("/api/quickbooks", quickbooks_default);
+app64.route("/api/onboarding", onboarding_default);
+app64.route("/api/admin", admin_default);
+app64.route("/api/access", access_default);
+app64.route("/api/session", session_default2);
+app64.route("/api/calendar", calendar_public_default);
+app64.route("/api/portal", portal_fetch_default);
 var SAFE_SLUG_RE2 = /^[a-z][a-z0-9-]{2,49}$/;
 var SAFE_FILENAME_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var IMAGE_MIME = {
@@ -28330,7 +28704,7 @@ var IMAGE_MIME = {
   ".svg": "image/svg+xml",
   ".ico": "image/x-icon"
 };
-app63.get("/agent-assets/:slug/:filename", (c) => {
+app64.get("/agent-assets/:slug/:filename", (c) => {
   const slug = c.req.param("slug");
   const filename = c.req.param("filename");
   if (!SAFE_SLUG_RE2.test(slug)) {
@@ -28346,8 +28720,8 @@ app63.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] no-account slug=${slug} file=${filename}`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve36(account.accountDir, "agents", slug, "assets", filename);
-  const expectedDir = resolve36(account.accountDir, "agents", slug, "assets");
+  const filePath = resolve37(account.accountDir, "agents", slug, "assets", filename);
+  const expectedDir = resolve37(account.accountDir, "agents", slug, "assets");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
@@ -28359,13 +28733,13 @@ app63.get("/agent-assets/:slug/:filename", (c) => {
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[agent-assets] serve slug=${slug} file=${filename} status=200`);
-  const body = readFileSync41(filePath);
+  const body = readFileSync42(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=3600"
   });
 });
-app63.get("/generated/:filename", (c) => {
+app64.get("/generated/:filename", (c) => {
   const filename = c.req.param("filename");
   if (!SAFE_FILENAME_RE.test(filename) || filename.includes("..")) {
     console.error(`[generated] serve file=${filename} status=403`);
@@ -28376,8 +28750,8 @@ app63.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve36(account.accountDir, "generated", filename);
-  const expectedDir = resolve36(account.accountDir, "generated");
+  const filePath = resolve37(account.accountDir, "generated", filename);
+  const expectedDir = resolve37(account.accountDir, "generated");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
@@ -28389,22 +28763,22 @@ app63.get("/generated/:filename", (c) => {
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[generated] serve file=${filename} status=200`);
-  const body = readFileSync41(filePath);
+  const body = readFileSync42(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=86400"
   });
 });
-app63.route("/sites", sites_default);
-app63.route("/listings", listings_default);
-app63.route("/v", visitor_event_default);
-app63.route("/v", visitor_consent_default);
+app64.route("/sites", sites_default);
+app64.route("/listings", listings_default);
+app64.route("/v", visitor_event_default);
+app64.route("/v", visitor_consent_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
 if (BRAND_JSON_PATH && existsSync38(BRAND_JSON_PATH)) {
   try {
-    const fullBrand = JSON.parse(readFileSync41(BRAND_JSON_PATH, "utf-8"));
+    const fullBrand = JSON.parse(readFileSync42(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
     brandIconPath = fullBrand.assets?.icon ? `/brand/${fullBrand.assets.icon}` : brandLogoPath;
   } catch {
@@ -28431,11 +28805,11 @@ var brandScript = `<script>window.__BRAND__=${JSON.stringify({
 var brandThemeColor = BRAND.defaultColors?.primary ?? "#000000";
 var brandBackgroundColor = BRAND.defaultColors?.background ?? "#ffffff";
 var brandAppIconsExist = [brandAppIcon192Path, brandAppIcon512Path, brandMaskableIconPath].every(
-  (p) => existsSync38(resolve36(process.cwd(), "public", p.replace(/^\//, "")))
+  (p) => existsSync38(resolve37(process.cwd(), "public", p.replace(/^\//, "")))
 );
 var SW_SOURCE = (() => {
   try {
-    return readFileSync41(resolve36(process.cwd(), "public", "sw.js"), "utf-8");
+    return readFileSync42(resolve37(process.cwd(), "public", "sw.js"), "utf-8");
   } catch {
     return null;
   }
@@ -28443,9 +28817,9 @@ var SW_SOURCE = (() => {
 function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT8) return "unknown";
-    const versionFile = join42(PLATFORM_ROOT8, "config", `.${BRAND.hostname}-version`);
+    const versionFile = join44(PLATFORM_ROOT8, "config", `.${BRAND.hostname}-version`);
     if (!existsSync38(versionFile)) return "unknown";
-    const content = readFileSync41(versionFile, "utf-8").trim();
+    const content = readFileSync42(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
     return "unknown";
@@ -28486,7 +28860,7 @@ var clientErrorReporterScript = `<script>
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync41(resolve36(process.cwd(), "public", file), "utf-8");
+    html = readFileSync42(resolve37(process.cwd(), "public", file), "utf-8");
     const productNameEsc = escapeHtml(BRAND.productName);
     html = html.replace(/<title>([^<]*)<\/title>/, (_match, inner) => `<title>${escapeHtml(inner).replace(/Maxy/g, productNameEsc)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
@@ -28503,13 +28877,13 @@ ${clientErrorReporterScript}
   return html;
 }
 function loadBrandingCache(agentSlug) {
-  const configDir2 = join42(homedir4(), BRAND.configDir);
+  const configDir2 = join44(homedir4(), BRAND.configDir);
   try {
     const accountId = getDefaultAccountId();
     if (!accountId) return null;
-    const cachePath = join42(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
+    const cachePath = join44(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
     if (!existsSync38(cachePath)) return null;
-    return JSON.parse(readFileSync41(cachePath, "utf-8"));
+    return JSON.parse(readFileSync42(cachePath, "utf-8"));
   } catch {
     return null;
   }
@@ -28553,7 +28927,7 @@ function brandedPublicHtml(agentSlug) {
 function agentUnavailableHtml() {
   return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${escapeHtml(BRAND.productName)}</title></head><body style="font-family:system-ui,sans-serif;max-width:32rem;margin:4rem auto;padding:0 1.5rem;color:#222"><h1 style="font-size:1.25rem">Agent unavailable</h1><p>This agent isn't available right now. If you reached this page from a saved link, the agent may have been turned off.</p></body></html>`;
 }
-app63.get("/", (c) => {
+app64.get("/", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const klass = classifyHost(host, getOperatorDomains(), isPublicHost);
   if (klass === "operator") {
@@ -28575,12 +28949,12 @@ app63.get("/", (c) => {
   console.log(`[host-class] host=${host} class=admin served=index.html`);
   return c.html(cachedHtml("index.html"));
 });
-app63.get("/public", (c) => {
+app64.get("/public", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
 });
-app63.get("/public-chat", (c) => {
+app64.get("/public-chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
@@ -28599,12 +28973,12 @@ async function logViewerFetch(c, next) {
     duration_ms: Date.now() - start
   });
 }
-app63.use("/vnc-viewer.html", logViewerFetch);
-app63.use("/vnc-popout.html", logViewerFetch);
-app63.get("/vnc-popout.html", (c) => {
+app64.use("/vnc-viewer.html", logViewerFetch);
+app64.use("/vnc-popout.html", logViewerFetch);
+app64.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync41(resolve36(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync42(resolve37(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -28614,7 +28988,7 @@ app63.get("/vnc-popout.html", (c) => {
   }
   return c.html(html);
 });
-app63.post("/api/vnc/client-event", async (c) => {
+app64.post("/api/vnc/client-event", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -28635,11 +29009,11 @@ app63.post("/api/vnc/client-event", async (c) => {
   });
   return c.json({ ok: true });
 });
-app63.get("/g/:slug", (c) => {
+app64.get("/g/:slug", (c) => {
   return c.html(brandedPublicHtml(resolveDefaultSlug() ?? void 0));
 });
 for (const pwa of PWA_SURFACES) {
-  app63.get(pwa.manifestPath, (c) => {
+  app64.get(pwa.manifestPath, (c) => {
     const manifest = buildManifest(pwa, {
       productName: BRAND.productName,
       appIcon192: brandAppIcon192Path,
@@ -28655,7 +29029,7 @@ for (const pwa of PWA_SURFACES) {
     return c.body(JSON.stringify(manifest));
   });
 }
-app63.get("/sw.js", (c) => {
+app64.get("/sw.js", (c) => {
   if (SW_SOURCE == null) {
     console.error("[pwa] op=sw status=500 reason=sw-source-missing");
     return c.text("Service worker unavailable", 500);
@@ -28664,12 +29038,12 @@ app63.get("/sw.js", (c) => {
   console.log(`[pwa] op=sw status=200 ct=${SW_CONTENT_TYPE}`);
   return c.body(SW_SOURCE);
 });
-app63.get("/graph", (c) => {
+app64.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host) || isOperatorHost(host, getOperatorDomains())) return c.text("Not found", 404);
   return c.html(cachedHtml("graph.html"));
 });
-app63.get("/chat", (c) => {
+app64.get("/chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isOperatorHost(host, getOperatorDomains())) {
     console.log(`[host-class] host=${host} class=operator served=operator.html`);
@@ -28678,32 +29052,32 @@ app63.get("/chat", (c) => {
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("chat.html"));
 });
-app63.get("/data", (c) => {
+app64.get("/data", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("data.html"));
 });
-app63.get("/tasks", (c) => {
+app64.get("/tasks", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("tasks.html"));
 });
-app63.get("/activity", (c) => {
+app64.get("/activity", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("activity.html"));
 });
-app63.get("/calendar", (c) => {
+app64.get("/calendar", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("calendar.html"));
 });
-app63.get("/browser", (c) => {
+app64.get("/browser", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host) || isOperatorHost(host, getOperatorDomains())) return c.text("Not found", 404);
   return c.html(cachedHtml("browser.html"));
 });
-app63.get("/:slug", async (c, next) => {
+app64.get("/:slug", async (c, next) => {
   const slug = c.req.param("slug");
   if (AGENT_SLUG_PATTERN.test(`/${slug}`)) {
     const account = resolveAccount();
@@ -28718,13 +29092,13 @@ app63.get("/:slug", async (c, next) => {
   await next();
 });
 if (brandFaviconPath !== "/favicon.ico") {
-  app63.get("/favicon.ico", (c) => {
+  app64.get("/favicon.ico", (c) => {
     c.header("Cache-Control", "public, max-age=300");
     return c.redirect(brandFaviconPath, 302);
   });
 }
-app63.use("/*", serveStatic({ root: "./public" }));
-app63.all("*", (c) => {
+app64.use("/*", serveStatic({ root: "./public" }));
+app64.all("*", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path3 = c.req.path;
   if (isPublicHost(host)) {
@@ -28738,11 +29112,11 @@ app63.all("*", (c) => {
 });
 var port = requirePortEnv("MAXY_UI_INTERNAL_PORT", { tag: "ui-server" });
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
-var httpServer = serve({ fetch: app63.fetch, port, hostname });
+var httpServer = serve({ fetch: app64.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
-  const reconcilePlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join42(__dirname, "..");
-  const reconcileScript = resolve36(reconcilePlatformRoot, "plugins/scheduling/mcp/dist/scripts/reconcile-bookings.js");
+  const reconcilePlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join44(__dirname, "..");
+  const reconcileScript = resolve37(reconcilePlatformRoot, "plugins/scheduling/mcp/dist/scripts/reconcile-bookings.js");
   const RECONCILE_INTERVAL_MS = 12e4;
   const runReconcile = (ctx) => {
     if (!existsSync38(reconcileScript)) return;
@@ -28767,8 +29141,8 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const outlookPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join42(__dirname, "..");
-  const outlookScript = resolve36(outlookPlatformRoot, "plugins/outlook/mcp/dist/scripts/complete-registration.js");
+  const outlookPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join44(__dirname, "..");
+  const outlookScript = resolve37(outlookPlatformRoot, "plugins/outlook/mcp/dist/scripts/complete-registration.js");
   const OUTLOOK_COMPLETE_INTERVAL_MS = 3e4;
   const runOutlookComplete = (ctx) => {
     if (!existsSync38(outlookScript)) return;
@@ -28793,8 +29167,8 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const auditRoot = process.env.MAXY_PLATFORM_ROOT ?? join42(__dirname, "..");
-  const strandedAccountsDir = resolve36(auditRoot, "..", "data/accounts");
+  const auditRoot = process.env.MAXY_PLATFORM_ROOT ?? join44(__dirname, "..");
+  const strandedAccountsDir = resolve37(auditRoot, "..", "data/accounts");
   const STRANDED_AUDIT_INTERVAL_MS = 3e5;
   const STRANDED_AGE_MS = 16 * 6e4;
   const STRANDED_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
@@ -28804,7 +29178,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
       const now = Date.now();
       for (const name of readdirSync26(strandedAccountsDir)) {
         if (!STRANDED_UUID_RE.test(name)) continue;
-        const pendingPath2 = resolve36(strandedAccountsDir, name, "secrets/outlook/pending-devicecode.enc");
+        const pendingPath2 = resolve37(strandedAccountsDir, name, "secrets/outlook/pending-devicecode.enc");
         if (!existsSync38(pendingPath2)) continue;
         const ageMs = now - statSync17(pendingPath2).mtimeMs;
         if (ageMs > STRANDED_AGE_MS) {
@@ -28823,8 +29197,8 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const googleRoot = process.env.MAXY_PLATFORM_ROOT ?? join42(__dirname, "..");
-  const googleAccountsDir = resolve36(googleRoot, "..", "data/accounts");
+  const googleRoot = process.env.MAXY_PLATFORM_ROOT ?? join44(__dirname, "..");
+  const googleAccountsDir = resolve37(googleRoot, "..", "data/accounts");
   const GOOGLE_PENDING_AUDIT_INTERVAL_MS = 3e5;
   const runGooglePendingAuditSafe = () => {
     try {
@@ -28839,7 +29213,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     firstRunDelayMs: 27e3,
     run: runGooglePendingAuditSafe
   });
-  const googleAuditScript = resolve36(googleRoot, "plugins/google/mcp/dist/scripts/account-audit.js");
+  const googleAuditScript = resolve37(googleRoot, "plugins/google/mcp/dist/scripts/account-audit.js");
   const GOOGLE_ACCOUNT_AUDIT_INTERVAL_MS = 36e5;
   const runGoogleAccountAudit = (ctx) => {
     if (!existsSync38(googleAuditScript)) return;
@@ -28867,7 +29241,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join42(__dirname, "..");
+  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join44(__dirname, "..");
   const STORAGE_AUDIT_INTERVAL_MS = 3e5;
   const runStorageAuditSafe = () => runStorageAudit(auditPlatformRoot).catch((err) => {
     console.error(`[storage-audit] error="${err.message}"`);
@@ -28901,8 +29275,8 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const publishPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join42(__dirname, "..");
-  const publishScript = resolve36(publishPlatformRoot, "plugins/scheduling/mcp/dist/scripts/publish-availability.js");
+  const publishPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join44(__dirname, "..");
+  const publishScript = resolve37(publishPlatformRoot, "plugins/scheduling/mcp/dist/scripts/publish-availability.js");
   const PUBLISH_INTERVAL_MS = 3e5;
   const currentAccount = () => {
     try {
@@ -28932,21 +29306,21 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     }
   };
   const auditSnapshotAge = (account) => {
-    const availPath = resolve36(account.accountDir, "calendar-availability.json");
+    const availPath = resolve37(account.accountDir, "calendar-availability.json");
     let hasBookingSite = false;
     try {
       if (existsSync38(availPath)) {
-        const cfg = JSON.parse(readFileSync41(availPath, "utf-8"));
+        const cfg = JSON.parse(readFileSync42(availPath, "utf-8"));
         hasBookingSite = typeof cfg.bookingDbName === "string" && cfg.bookingDbName.length > 0;
       }
     } catch {
     }
     if (!hasBookingSite) return;
-    const statePath = resolve36(account.accountDir, "state", "booking-availability", "last-publish.json");
+    const statePath = resolve37(account.accountDir, "state", "booking-availability", "last-publish.json");
     let lastSuccessAt = null;
     if (existsSync38(statePath)) {
       try {
-        const rec = JSON.parse(readFileSync41(statePath, "utf-8"));
+        const rec = JSON.parse(readFileSync42(statePath, "utf-8"));
         lastSuccessAt = rec.lastSuccessAt ?? null;
       } catch {
         console.error(`[calendar-availability] op=audit accountId=${account.accountId} snapshotAgeMs=na reason=bad-state-file`);
@@ -28974,8 +29348,8 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 startTimeEntryCensus(() => getSession());
 startLedgerCensus(() => getSession());
 {
-  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join42(__dirname, "..");
-  const auditScript = resolve36(auditPlatformRoot, "plugins/connector/mcp/dist/scripts/audit-connectors.js");
+  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join44(__dirname, "..");
+  const auditScript = resolve37(auditPlatformRoot, "plugins/connector/mcp/dist/scripts/audit-connectors.js");
   const auditLogDir = process.env.LOG_DIR ?? LOG_DIR;
   const CONNECTOR_AUDIT_INTERVAL_MS = 3e5;
   const runConnectorAudit = (ctx) => {
@@ -29047,6 +29421,7 @@ var SUBAPP_MANIFEST = [
   { prefix: "/api/access", file: "server/routes/access/index.ts", subapp: access_default },
   { prefix: "/api/session", file: "server/routes/session.ts", subapp: session_default2 },
   { prefix: "/api/calendar", file: "server/routes/calendar-public.ts", subapp: calendar_public_default },
+  { prefix: "/api/portal", file: "server/routes/portal-fetch.ts", subapp: portal_fetch_default },
   { prefix: "/api/_client-error", file: "server/routes/client-error.ts", subapp: client_error_default },
   { prefix: "/listings", file: "server/routes/listings.ts", subapp: listings_default },
   { prefix: "/v", file: "server/routes/visitor-event.ts", subapp: visitor_event_default },
@@ -29058,7 +29433,7 @@ for (const m of SUBAPP_MANIFEST) {
 }
 try {
   const registered = [];
-  for (const r of app63.routes ?? []) {
+  for (const r of app64.routes ?? []) {
     if (typeof r.path !== "string" || r.path.includes(":") || r.path.includes("*")) continue;
     if (AGENT_SLUG_PATTERN.test(r.path)) {
       registered.push({ method: (r.method ?? "ALL").toUpperCase(), path: r.path });
@@ -29102,7 +29477,7 @@ async function runAdminUserReconcileTick() {
       console.error("[adminuser-self-heal] skip reason=no-users-file");
       return;
     }
-    const usersRaw = readFileSync41(USERS_FILE, "utf-8").trim();
+    const usersRaw = readFileSync42(USERS_FILE, "utf-8").trim();
     if (!usersRaw) {
       console.error("[adminuser-self-heal] skip reason=empty-users-file");
       return;
@@ -29150,7 +29525,7 @@ registerLoop({
 var USERS_RECONCILE_INTERVAL_MS = 60 * 60 * 1e3;
 function countUsersRows() {
   if (!existsSync38(USERS_FILE)) return 0;
-  const raw = readFileSync41(USERS_FILE, "utf-8").trim();
+  const raw = readFileSync42(USERS_FILE, "utf-8").trim();
   if (!raw) return 0;
   const users = JSON.parse(raw);
   return users.filter((u) => typeof u.userId === "string").length;
@@ -29283,7 +29658,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve36(process.env.MAXY_PLATFORM_ROOT ?? join42(__dirname, "..")),
+  platformRoot: resolve37(process.env.MAXY_PLATFORM_ROOT ?? join44(__dirname, "..")),
   accountConfig: bootAccountConfig,
   onMessage: async (msg) => {
     if (msg.isOwnerMirror) {