@rubytech/create-maxy-code 0.1.485 → 0.1.486

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.485",
+  "version": "0.1.486",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/docs/superpowers/plans/2026-07-21-graph-caption-resolver.md

@@ -0,0 +1,124 @@
+# Graph Caption Resolver Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Make every top-level operator-entry graph label resolve to a human-readable caption instead of its bare type, and add a build-time gate that fails when a new styled label ships without a caption decision.
+
+**Architecture:** Add per-label caption branches to `pickShortLabel` and `pickDisplayName` in `platform/lib/graph-style/src/index.ts` for the first-class labels that currently fall through to `return primaryLabel`. Add a `caption-coverage.test.ts` that reconciles every `GRAPH_LABEL_COLOURS` key against a `CAPTION_COVERAGE` fixture, so registering a styled colour without deciding its caption is a red build.
+
+**Tech Stack:** TypeScript, vitest 4 (run via `platform/ui/node_modules/.bin/vitest`), no new dependencies.
+
+## Global Constraints
+
+- Do not touch `GRAPH_LABEL_COLOURS` or `LABEL_ICONS` — every label already has both.
+- `pickShortLabel` truncates to 24 chars (`slice(0, 24) + '…'`); `pickDisplayName` returns the untruncated value. New branches follow that per-function convention.
+- Caption source is a scalar property already written on the node itself; never an id that points at another node, never a composed value that needs a second node.
+- The UI parity test `platform/ui/app/graph/__tests__/display-helpers.test.ts` imports graph-style's **built** `dist/index.js`, so graph-style must be rebuilt (`tsc -p tsconfig.json`) before that test is rerun.
+- `SHAPE_BY_LABEL` assigns shapes by key order in `GRAPH_LABEL_COLOURS`; do not reorder or insert keys.
+
+---
+
+## Label classification (the crux)
+
+The resolver captions a node when: (1) its primary label has an explicit branch, or (2) the node carries one of the generic-fallback keys `name, title, summary, givenName, subject, text`, or (3) it is the `Conversation` special-case. Otherwise it returns the bare type.
+
+**Already captioned by an existing branch** (unchanged): `ToolCall, WorkflowRun, WorkflowStep, Person, Agent, Job, Quote, InboundInvoice, WhatsAppGroup, CashEntry, Message`, plus the `Conversation` `sessionId` special-case.
+
+**Already captioned by the generic fallback** (they declare a fallback key): `LocalBusiness, Service, Organization, Customer, Site, Asset, Part, PpmContract, DigitalDocument, Question, FAQPage, DefinedTerm, Task, Event, ImageObject` (via `name`); `CreativeWork, ConversationArchive, Objective, KeyResult, Decision, Source` (via `title`); `Note` (via `text`).
+
+**First-class fall-throughs that need a NEW branch** (top-level operator-entry per schema, no fallback key, no existing branch):
+
+| Label | Caption field(s) | Schema evidence |
+|-------|------------------|-----------------|
+| `Property` | `address` → `slug` | schema-estate-agent top-level; required `slug`, `address` |
+| `Listing` | `displayName` → `slug` | schema-estate-agent top-level; required `slug`, `displayName` |
+| `Viewing` | `date` | schema-estate-agent top-level; local scalar `date` |
+| `Offer` | `status` then `price` composed as `status £price` when both present, else whichever is present | schema-estate-agent top-level; local scalars `status`, `price` |
+| `Visit` | `purpose` → `status` | schema-construction top-level; local scalars `purpose`, `status` |
+| `PurchaseOrder` | `poNumber` | schema-construction top-level; natural key `poNumber` |
+| `Invoice` | `confirmationNumber` | schema-base first-class financial; `confirmationNumber` (mirror of the `InboundInvoice` branch's identity) |
+| `Risk` | `statement` | schema-knowledge-work; local `statement` |
+| `Finding` | `statement` | schema-knowledge-work; local `statement` |
+| `Hypothesis` | `statement` | schema-knowledge-work; local `statement` |
+
+**Grey allowlist — render as bare type by design** (child/specification/platform-plumbing labels, not first-class viewer entities): `PriceSpecification, OpeningHoursSpecification, Section, Chunk, Review, Preference, UserProfile, AdminUser, AccessGrant, StepResult`.
+
+**Empirically finalised during implementation** (their bucket depends on their actual write shape, decided by building a synthetic node from the label's real properties and observing `pickShortLabel`): `KnowledgeDocument, Project, Workflow, Email, EmailAccount, UserMessage, AssistantMessage, AdminConversation, PublicConversation`. Rule: if the label declares a fallback key (`name/title/summary/subject/text`) it goes in the captioned bucket with that field as `expected`; otherwise it is grey. Every one of these must land in exactly one bucket before Task 2 passes — none may be left undeclared.
+
+---
+
+## Task 1: Caption-coverage gate (Part B) — written first, RED
+
+**Files:**
+- Create: `platform/lib/graph-style/src/__tests__/caption-coverage.test.ts`
+
+**Interfaces:**
+- Consumes: `GRAPH_LABEL_COLOURS`, `pickShortLabel` from `../index`.
+- Produces: nothing consumed by later tasks; it is the verifier for Task 2.
+
+- [ ] **Step 1: Write the coverage test with the full fixture**
+
+The test owns `CAPTION_COVERAGE: Record<string, { node: GraphNodeLike; expected: string } | { fallbackGrey: true }>`, one entry per key of `GRAPH_LABEL_COLOURS`. Captioned entries carry a synthetic node built from the label's identity fields and the `expected` caption. Grey entries are `{ fallbackGrey: true }`. Seed from the classification table above.
+
+Assertions:
+1. **Completeness.** `Object.keys(GRAPH_LABEL_COLOURS)` and `Object.keys(CAPTION_COVERAGE)` are set-equal — every styled label has an entry, and no entry names an unstyled label.
+2. **Correctness.** For each non-grey entry, `pickShortLabel(entry.node) === entry.expected` and `pickShortLabel(entry.node) !== label`.
+
+- [ ] **Step 2: Run it — expect RED**
+
+Run: `cd platform/lib/graph-style && ./node_modules/.bin/vitest run src/__tests__/caption-coverage.test.ts`
+Expected: FAIL — the correctness assertion fails for `Property, Listing, Viewing, Offer, Visit, PurchaseOrder, Invoice, Risk, Finding, Hypothesis` (each still returns its bare type).
+
+- [ ] **Step 3: Commit the RED test**
+
+```bash
+git add platform/lib/graph-style/src/__tests__/caption-coverage.test.ts
+git commit -m "test(graph-style): caption-coverage gate (red)"
+```
+
+## Task 2: Caption branches (Part A) — turn it GREEN
+
+**Files:**
+- Modify: `platform/lib/graph-style/src/index.ts` — `pickShortLabel` (before the generic-fallback loop, ~line 494) and `pickDisplayName` (before its generic-fallback loop, ~line 560).
+
+**Interfaces:**
+- Consumes: the fixture from Task 1 as its pass condition.
+- Produces: caption branches for the ten fall-through labels; both functions keep their existing signatures.
+
+- [ ] **Step 1: Add the ten branches to `pickShortLabel`**
+
+Each branch reads the label's caption field(s) as `string`, returns the 24-char-truncated value when non-empty, and otherwise falls through to the next fallback. `Offer` composes `status` and `£price`. Placed in the existing `else if` chain before the `for (const k of [...])` loop.
+
+- [ ] **Step 2: Add the same ten branches to `pickDisplayName`, untruncated**
+
+Identical field logic, returning the full value (no `slice`), matching that function's convention.
+
+- [ ] **Step 3: Finalise the empirical bucket for the nine ambiguous labels**
+
+For `KnowledgeDocument, Project, Workflow, Email, EmailAccount, UserMessage, AssistantMessage, AdminConversation, PublicConversation`, build a synthetic node from the label's real write shape, run `pickShortLabel`, and place each in the captioned or grey bucket of `CAPTION_COVERAGE` per the rule. Add a branch only if the label is a first-class entity that falls through (none expected; if one appears, it joins Part A).
+
+- [ ] **Step 4: Run the coverage test — expect GREEN**
+
+Run: `cd platform/lib/graph-style && ./node_modules/.bin/vitest run`
+Expected: PASS — all graph-style tests including `caption-coverage.test.ts`.
+
+- [ ] **Step 5: Rebuild dist and run the UI parity test — expect GREEN**
+
+Run: `cd platform/lib/graph-style && ./node_modules/.bin/tsc -p tsconfig.json && cd ../../ui && ./node_modules/.bin/vitest run app/graph/__tests__/display-helpers.test.ts`
+Expected: PASS (77 tests) — parity between the canvas renderer and the live page holds.
+
+- [ ] **Step 6: Commit Part A**
+
+```bash
+git add platform/lib/graph-style/src/index.ts platform/lib/graph-style/src/__tests__/caption-coverage.test.ts
+git commit -m "fix(graph-style): caption branches for top-level fall-through labels"
+```
+
+---
+
+## Self-review
+
+- **Spec coverage.** Task file Part A (Property/Listing branches) → Task 2 Steps 1-2, expanded to all fall-throughs per the approved scope decision. Task file Part B (coverage gate) → Task 1. Verification section (reproduction check, parity, display-helpers) → Task 2 Steps 4-5.
+- **Scope deviation from the task file.** The task named only Property and Listing for Part A; the coverage seed surfaced eight more first-class fall-throughs (`Viewing, Offer, Visit, PurchaseOrder, Invoice, Risk, Finding, Hypothesis`), and the operator chose to branch all of them now. This is a deliberate, approved expansion, recorded in Plan Conformity at land time.
+- **Correction to the task file.** The task listed `Note` as a grey example; `Note` declares `text`, a generic-fallback key, so it captions via `text` and is in the captioned bucket, not grey.
+- **No placeholders.** The nine empirically-finalised labels have an explicit decision rule and a hard requirement to land in one bucket; they are not left "TBD".

package/payload/platform/docs/superpowers/plans/2026-07-21-task-1877-bash-schema-enforcement.md

@@ -0,0 +1,107 @@
+# Task 1877 — Bash schema enforcement + standing reconcile — implementation plan
+
+Closes the Bash channel gap in account-dir schema enforcement. Two layers, per
+the approved task decision. No agent-tool narrowing, no command-string parsing,
+no auto-repair.
+
+## Layer A — immediate Bash stray detection (two hooks)
+
+Both live in `platform/plugins/admin/hooks/`, beside `fs-schema-guard.sh`. Both
+key off account-root state (`$PWD` is the account dir for these hooks), never off
+the command string.
+
+### `fs-schema-guard-bash-pre.sh` (PreToolUse, matcher `Bash`)
+- Read stdin envelope, extract `tool_name` and `session_id` (python3, matching
+  `fs-schema-guard.sh`'s `field()` helper and the session-id extraction in
+  `askuserquestion-channel-carrier-gate.sh`).
+- Non-`Bash` tool: `exit 0`.
+- Resolve `TMP_DIR` with the exact `TMPDIR:-TMP:-TEMP:-/tmp` order and trailing-
+  slash strip used by `askuserquestion-channel-carrier-gate.sh`; sanitise the
+  session id `[^A-Za-z0-9_-]` to `_`.
+- List the account root's immediate top-level entry names (one per line, python3
+  `os.listdir`) and write to `$TMP_DIR/maxy-fsguard-snapshot-<sid>.txt`.
+- Fail open on every error (no session id, no python3, unlistable dir, unwritable
+  tmp): `exit 0`, take no snapshot. A snapshot that cannot be taken must not
+  block the command.
+
+### `fs-schema-guard-bash-post.sh` (PostToolUse, matcher `Bash`)
+- Same envelope parse; non-`Bash`: `exit 0`.
+- Read the pre-snapshot for this session; missing snapshot: `exit 0` (fail open).
+- Parse `allowed-top-level` from `$PWD/SCHEMA.md` with the same awk extraction
+  `fs-schema-guard.sh` uses; empty/absent allowed set: `exit 0` (fail open — an
+  un-seeded legacy account must not have every Bash call blocked).
+- Re-list the account root now. Strays = entries **present now AND absent from
+  the pre-snapshot AND not in the allowed set**.
+- No strays: `exit 0` silent.
+- For each stray, log `[fs-guard-bash] stray path=<name> reason=top-level` to
+  stderr; then `exit 2` with a schema-citing message telling the agent to
+  relocate through the `data-manager` specialist. No filesystem mutation
+  (PostToolUse runs after the command; auto-repair is rejected).
+
+## Layer B — standing reconcile
+
+### `platform/services/claude-session-manager/src/account-dir-schema-reconcile.ts`
+Shape mirrors `rootless-client-audit.ts`: pure formatter (unit-tested) + impure
+collector + `create…Reconcile` start/stop factory with an unref'd `setInterval`.
+Purely filesystem: no Neo4j, no graph writes, no deletes.
+
+Per account under the accounts root, per run:
+- **Stray top-level:** any root entry not in that account's `allowed-top-level`
+  set (parsed from its `SCHEMA.md`). Accounts with no/empty allowed set are
+  skipped (fail open, like the hook).
+- **Over-deep:** under the depth-checked buckets only, mirroring
+  `fs-schema-guard.sh`'s `case` statement exactly — `projects`/`contacts` flat to
+  3 segments, `documents` to 3; every other (tool-owned) bucket is not walked.
+  This is the reuse of the guard's own encoding the task calls for, not a new
+  list.
+- **Quarantine, never repair:** move each stray top-level entry into the
+  account's `.quarantine/` with a `manifest.jsonl` line recording original path +
+  reason + timestamp. Over-deep files are counted only (not moved and not
+  manifest-logged): moving a file out of a flat bucket would orphan it from its
+  entity folder; re-filing is `data-manager`'s job.
+- **Control-plane safety belt:** the reconcile never quarantines the platform
+  control-plane entries (`.git`, `.claude`, `.quarantine`, `SCHEMA.md`,
+  `account.json`, `AGENTS.md`) regardless of the account's allowed set, so a
+  stale or hand-edited SCHEMA.md cannot drive it to move the account's git root,
+  hook settings, or identity file. This is a deliberate deviation from the task's
+  strict "any entry not in allowed" wording, chosen because a 5-minute auto-move
+  loop that can brick an account on a stale schema is an unacceptable foot-gun.
+- Emit one line per run: `[fs-reconcile] stray-top-level=<n> over-deep=<m>
+  quarantined=<q>`.
+
+Timestamps come from an injected clock (the module never calls `Date.now()` at
+import; the factory passes `() => Date.now()`), so the pure formatter and
+collector stay deterministic under test.
+
+### Wiring
+- `index.ts`: construct `createAccountDirSchemaReconcile({ accountsRoot:
+  dirname(config.accountDir), logger: log, intervalMs: 300_000 })` beside the
+  sibling audits and call `.start()`.
+
+## Registration + seeding
+- `provision-account-dir.sh`: add `fs-schema-guard-bash-pre.sh` to the existing
+  PreToolUse `Bash` matcher (after `archive-ingest-surface-gate.sh`); add a new
+  PostToolUse `Bash` matcher carrying `fs-schema-guard-bash-post.sh`.
+- `templates/account-schema/SCHEMA.md`: add `.quarantine` to the
+  `allowed-top-level` block so the reconcile's own move never creates a stray.
+
+## Tests
+- `platform/plugins/admin/hooks/__tests__/fs-schema-guard-bash.test.sh` — pre
+  writes snapshot; post blocks a whim folder with the log line; allowed
+  top-level and nested-allowed produce no block; no-new-entry is silent; a
+  pre-existing stray is not re-flagged; fail-open on missing snapshot / empty
+  allowed set.
+- `platform/services/claude-session-manager/src/__tests__/account-dir-schema-reconcile.test.ts`
+  — formatter output; planted stray moved to `.quarantine/` with manifest;
+  allowed dir and tool-owned deep files untouched; over-deep counted not moved;
+  clean account logs zeros and moves nothing.
+
+## Verification surface
+Build (`tsc`), lint, the new + existing `fs-schema-guard` tests, the manager
+vitest suite. Installer publish awaits explicit operator command (sprint gating).
+
+## Out of scope (per task)
+Graph-reconcile/broken-refs passes (original 1092 graph half); auto-re-filing
+quarantined content; agent-tool narrowing; command-string parsing; `chattr`
+immutability; one-time cleanup of the existing backlog (a `data-manager`
+dispatch).

package/payload/platform/docs/superpowers/plans/2026-07-21-task-1887-reconcile-allowed-top-level.md

@@ -0,0 +1,205 @@
+# Task 1887 — Reconcile `allowed-top-level` to the ontology Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Make `merge()` in `account-schema-owned-dirs.py` rebuild the account's `allowed-top-level` list each run from `fixed-seed ∪ plugin-owned ∪ ontology-buckets`, pruning a stale entry only when its on-disk dir is empty or absent and keeping-and-logging it when it holds files.
+
+**Architecture:** `merge()` currently appends owned+domain dirs into the fenced `allowed-top-level` block and never removes. Replace the append with a reconcile: keep every current entry that is still in the target set, keep a stale entry that holds files (logged as `keptPopulated`), drop a stale entry that is empty/absent (logged as `removed`), then append newly-projected owned/domain dirs as before. A hardcoded fixed-seed set shields base template dirs from pruning.
+
+**Tech Stack:** Python 3 (stdlib only), bash test harness (`__tests__/*.test.sh`).
+
+## Global Constraints
+
+- Fixed seed set (prune-protection allowlist, verbatim from `platform/docs/superpowers/plans/2026-06-23-account-filesystem-schema.md:65-89`): `projects contacts documents url-get output generated extracted uploads agents specialists sites public cache secrets state logs tmp SCHEMA.md account.json AGENTS.md .claude .git .quarantine`. This is 23 entries and includes `url-get` (the task body's inline list dropped it; the operator confirmed the plan-doc list governs).
+- The seed set is prune-protection only. `merge()` never *adds* a missing seed entry; seed membership only prevents an entry already in the list from being flagged stale.
+- "Holds files" = at least one regular file exists anywhere under `account_dir/<entry>` (recursive), or `<entry>` is a non-empty regular file. Absent path, empty dir, or dir whose whole subtree contains no files → prunable. Strict reading: never silently drop a path that carries any file content.
+- Summary line format (single line, extends the existing one): `brand=<b> added=<…|none> domainBuckets=<…|none> removed=<…|none> keptPopulated=<…|none>`.
+- Idempotency is mandatory: two consecutive `merge()` runs produce a byte-identical `SCHEMA.md`.
+- Out of scope: `account-dir-schema-reconcile.ts` (1877), `fs-schema-guard.sh`, `schema-exposed-dirs.mjs`, and disposition of existing populated strays. Do not touch them.
+
+---
+
+### Task 1: Reconcile in `merge()` + extended log
+
+**Files:**
+- Modify: `platform/scripts/lib/account-schema-owned-dirs.py` (add `FIXED_SEED`, add `_dir_holds_files`, rewrite the block-mutation part of `merge()`, extend the summary `print`)
+- Test: `platform/scripts/__tests__/account-schema-owned-dirs.test.sh` (append new cases)
+
+**Interfaces:**
+- Consumes: existing `resolve(project_dir) -> [{dir, description, plugin}]`, `resolve_domain_buckets(project_dir) -> [{dir, label}]`, `_allowed_block(text) -> (entries, start, end)`, `_read_brand`, `_strip_region`.
+- Produces: `FIXED_SEED` (frozenset of 23 str), `_dir_holds_files(account_dir, name) -> bool`, and a `merge()` whose summary line carries `removed=` and `keptPopulated=`.
+
+- [ ] **Step 1: Write the failing tests**
+
+Append to `platform/scripts/__tests__/account-schema-owned-dirs.test.sh`, before the final `echo "PASS=$PASS FAIL=$FAIL"` line. Helper to inject a stray line inside the fenced block:
+
+```bash
+# insert_stray <schema_path> <name>: add <name> as the first entry inside the
+# allowed-top-level fence (simulates an account whose list carries a bucket no
+# longer in the ontology).
+insert_stray() {
+  awk -v n="$2" '{print} /^```allowed-top-level$/{print n}' "$1" > "$1.tmp" && mv "$1.tmp" "$1"
+}
+
+# --- prune: stale bucket, absent on disk -> removed from list + logged ---
+A_PRUNE="$(make_vertical_tree '["sitedesk"]' 'schema-construction')"
+A_P="$(make_account "$A_PRUNE")"; export PROJECT_DIR="$A_PRUNE/platform"
+insert_stray "$A_P/SCHEMA.md" "inbound-invoices"
+OUT_P="$(merge_owned_dirs_into_schema "$A_P")"
+ALLOWED_P="$(awk '/^```allowed-top-level$/{f=1;next} /^```$/{f=0} f' "$A_P/SCHEMA.md")"
+assert_nogrep "inbound-invoices" "$ALLOWED_P" "prune-empty-removed-from-list"
+assert_grep "removed=inbound-invoices" "$OUT_P" "prune-empty-logged"
+
+# --- keep: stale bucket that holds files -> retained + keptPopulated ---
+A_KEEP="$(make_vertical_tree '["sitedesk"]' 'schema-construction')"
+A_K="$(make_account "$A_KEEP")"; export PROJECT_DIR="$A_KEEP/platform"
+insert_stray "$A_K/SCHEMA.md" "inbound-invoices"
+mkdir -p "$A_K/inbound-invoices"; echo "stamp" > "$A_K/inbound-invoices/stamp_invoice.py"
+OUT_K="$(merge_owned_dirs_into_schema "$A_K")"
+ALLOWED_K="$(awk '/^```allowed-top-level$/{f=1;next} /^```$/{f=0} f' "$A_K/SCHEMA.md")"
+assert_grep "inbound-invoices" "$ALLOWED_K" "keep-populated-retained"
+assert_grep "keptPopulated=inbound-invoices" "$OUT_K" "keep-populated-logged"
+assert_nogrep "removed=inbound-invoices" "$OUT_K" "keep-populated-not-in-removed"
+
+# --- fixed-seed survival: empty base dir is never pruned ---
+A_SEED="$(make_tree '[]')"; A_S="$(make_account "$A_SEED")"; export PROJECT_DIR="$A_SEED/platform"
+OUT_S="$(merge_owned_dirs_into_schema "$A_S")"
+ALLOWED_S="$(awk '/^```allowed-top-level$/{f=1;next} /^```$/{f=0} f' "$A_S/SCHEMA.md")"
+for d in documents url-get .git output; do
+  assert_grep "$d" "$ALLOWED_S" "seed-survives-$d"
+done
+assert_grep "removed=none" "$OUT_S" "seed-nothing-removed"
+
+# --- idempotency after a prune: second run byte-identical ---
+B_P="$(shasum "$A_P/SCHEMA.md" | awk '{print $1}')"
+merge_owned_dirs_into_schema "$A_P" >/dev/null
+assert_eq "$(shasum "$A_P/SCHEMA.md" | awk '{print $1}')" "$B_P" "prune-idempotent"
+```
+
+- [ ] **Step 2: Run the suite to verify the new cases fail**
+
+Run: `bash platform/scripts/__tests__/account-schema-owned-dirs.test.sh`
+Expected: FAIL — `removed=`/`keptPopulated=` absent from output; `inbound-invoices` still in `ALLOWED_P`.
+
+- [ ] **Step 3: Add `FIXED_SEED` and `_dir_holds_files`**
+
+Insert after the `ONT_END` constant (line 25) region:
+
+```python
+FIXED_SEED = frozenset({
+    "projects", "contacts", "documents", "url-get", "output", "generated",
+    "extracted", "uploads", "agents", "specialists", "sites", "public",
+    "cache", "secrets", "state", "logs", "tmp", "SCHEMA.md", "account.json",
+    "AGENTS.md", ".claude", ".git", ".quarantine",
+})
+
+
+def _dir_holds_files(account_dir, name):
+    """True iff account_dir/<name> carries file content: a non-empty regular
+    file, or a directory whose subtree contains at least one regular file.
+    Absent path, empty dir, or a dir tree with no files -> False (prunable)."""
+    path = os.path.join(account_dir, name)
+    if not os.path.exists(path):
+        return False
+    if os.path.isfile(path):
+        return os.path.getsize(path) > 0
+    for _root, _dirs, files in os.walk(path):
+        if files:
+            return True
+    return False
+```
+
+- [ ] **Step 4: Rewrite the block-mutation section of `merge()`**
+
+Replace the current block (lines 256-270, the `if entries is not None:` … `text = "\n".join(lines)` section) with:
+
+```python
+    removed = []
+    kept_populated = []
+    if entries is not None:
+        present = set(entries)
+        owned_dirs = {e["dir"] for e in owned}
+        domain_dirs = {b["dir"] for b in domain}
+        target = FIXED_SEED | owned_dirs | domain_dirs
+        # Reconcile existing entries: keep in-target; keep populated strays
+        # (logged); drop empty/absent strays (logged).
+        new_entries = []
+        for entry in entries:
+            if entry in target:
+                new_entries.append(entry)
+            elif _dir_holds_files(account_dir, entry):
+                new_entries.append(entry)
+                kept_populated.append(entry)
+            else:
+                removed.append(entry)
+        # Append newly-projected owned then domain dirs not already present.
+        insert = []
+        for e in owned:
+            if e["dir"] not in present and e["dir"] not in insert:
+                insert.append(e["dir"])
+                added.append(e["dir"])
+        for b in domain:
+            if b["dir"] not in present and b["dir"] not in insert:
+                insert.append(b["dir"])
+                added_domain.append(b["dir"])
+        new_entries.extend(insert)
+        lines = text.split("\n")
+        lines[start + 1:end] = new_entries
+        text = "\n".join(lines)
+```
+
+- [ ] **Step 5: Extend the summary `print`**
+
+Replace the final `print(...)` of `merge()` (lines 299-300) with:
+
+```python
+    print(f"brand={brand} added={','.join(added) if added else 'none'} "
+          f"domainBuckets={','.join(added_domain) if added_domain else 'none'} "
+          f"removed={','.join(removed) if removed else 'none'} "
+          f"keptPopulated={','.join(kept_populated) if kept_populated else 'none'}")
+```
+
+Also update the early-return `print` (line 249, the no-SCHEMA.md branch) to keep the log shape uniform:
+
+```python
+        print(f"brand={brand} added=none domainBuckets=none removed=none keptPopulated=none")
+```
+
+- [ ] **Step 6: Run the full suite to verify all pass**
+
+Run: `bash platform/scripts/__tests__/account-schema-owned-dirs.test.sh`
+Expected: `PASS=<n> FAIL=0` (n = prior 38 + new assertions).
+
+- [ ] **Step 7: Commit**
+
+```bash
+git add platform/scripts/lib/account-schema-owned-dirs.py platform/scripts/__tests__/account-schema-owned-dirs.test.sh
+git commit -m "feat(admin): reconcile account allowed-top-level to ontology, empty-only prune (Task 1887)"
+```
+
+---
+
+### Task 2: Document the projection + empty-only prune rule
+
+**Files:**
+- Modify: `.docs/data-portal-folder-index.md` (add a short section stating the reconcile rule)
+
+- [ ] **Step 1: Add the rule to the living reference**
+
+Append a section after the "Three details that fail silently" block explaining: `allowed-top-level` is reconciled each `merge()` to `fixed-seed ∪ plugin-owned ∪ ontology-buckets`; a stale entry (in the list, not in that union) is pruned only when its on-disk dir is empty or absent, and kept-and-logged (`keptPopulated=`) when it holds files, so the write-guard list tracks the ontology without ever orphaning live data into the 1877 quarantine reconcile.
+
+- [ ] **Step 2: Commit**
+
+```bash
+git add .docs/data-portal-folder-index.md
+git commit -m "docs: account allowed-top-level projection + empty-only prune rule (Task 1887)"
+```
+
+---
+
+## Self-Review
+
+- **Spec coverage:** `merge()` reconcile (Task 1 Step 4), empty-only prune (Step 3 `_dir_holds_files` + Step 4), fixed-seed survival (Step 3 `FIXED_SEED` in `target`), logging `removed`/`keptPopulated` (Step 5), tests for prune-empty / keep-populated / seed-survival / idempotency (Step 1), `.docs` update (Task 2). New-ontology-bucket-add and collision cases stay covered by the existing untouched assertions.
+- **Placeholder scan:** none — every step carries the literal code or command.
+- **Type consistency:** `FIXED_SEED` frozenset of str; `_dir_holds_files(account_dir, name)->bool`; `removed`/`kept_populated` lists of str consumed only by the summary `print`. `owned`/`domain` element shapes match `resolve`/`resolve_domain_buckets` (`e["dir"]`, `b["dir"]`).
+- **Regression boundary:** `lines[start+1:end] = new_entries` replaces only the fence body; the wholesale regeneration of the two descriptive regions (lines 272-296) is unchanged, so the em-dash/hyphen separator contract and portal exposure are untouched.

package/payload/platform/lib/graph-style/dist/index.d.ts

@@ -90,7 +90,10 @@ export declare function formatMessageTimestamp(iso: string): string | null;
  * Person givenName+familyName compose, Agent displayName/slug, Job
  * client+#jobId compose, Quote ref, InboundInvoice
  * supplier+#confirmationNumber compose, WhatsAppGroup clientName,
- * Message role+timestamp), then a generic
+ * Message role+timestamp, Property address/slug, Listing displayName/slug,
+ * Viewing date, Offer status+price, Visit purpose/status, PurchaseOrder
+ * poNumber, Invoice confirmationNumber, Risk/Finding/Hypothesis statement),
+ * then a generic
  * fallthrough across curated keys
  * (name, title, summary, givenName, subject, text) — :ConversationArchive
  * rows (Task 397) carry a stable `title` written by the writer so they pick

package/payload/platform/lib/graph-style/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAqItD,CAAA;AAED,eAAO,MAAM,qBAAqB,YAAY,CAAA;AAE9C,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAE7C,CAAA;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAOzE;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpD;AAiBD,eAAO,MAAM,qBAAqB,sFAQxB,CAAA;AAEV,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAA;AAEnE,eAAO,MAAM,oBAAoB,EAAE,cAAsB,CAAA;AAUzD,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,CAE3D;AA8ED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIzD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAY7D;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,eAAe,EAAE,MAAM,CAAA;CACxB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,kBAAkB,CAU/E;AASD;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACpC;AAKD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI7D;AAED,iEAAiE;AACjE,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIjE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CA2F1D;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CA0D3D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAqItD,CAAA;AAED,eAAO,MAAM,qBAAqB,YAAY,CAAA;AAE9C,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAE7C,CAAA;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAOzE;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpD;AAiBD,eAAO,MAAM,qBAAqB,sFAQxB,CAAA;AAEV,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAA;AAEnE,eAAO,MAAM,oBAAoB,EAAE,cAAsB,CAAA;AAUzD,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,CAE3D;AA8ED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIzD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAY7D;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,eAAe,EAAE,MAAM,CAAA;CACxB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,kBAAkB,CAU/E;AASD;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACpC;AAKD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI7D;AAED,iEAAiE;AACjE,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIjE;AA2BD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAqH1D;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAoF3D"}

package/payload/platform/lib/graph-style/dist/index.js

@@ -356,13 +356,37 @@ function formatMessageTimestamp(iso) {
         return null;
     return m[1];
 }
+// Estate-agent caption sources. :Property and :Listing carry no `name`; their
+// identity lives in address/displayName with slug as the always-present natural
+// key. Shared by pickShortLabel (truncated) and pickDisplayName (untruncated).
+function estateAddress(props) {
+    const address = typeof props.address === 'string' ? props.address : '';
+    const slug = typeof props.slug === 'string' ? props.slug : '';
+    return address.length > 0 ? address : slug;
+}
+function estateListingName(props) {
+    const displayName = typeof props.displayName === 'string' ? props.displayName : '';
+    const slug = typeof props.slug === 'string' ? props.slug : '';
+    return displayName.length > 0 ? displayName : slug;
+}
+// :Offer carries no single human label; compose status with the offered price.
+function offerCaption(props) {
+    const status = typeof props.status === 'string' ? props.status : '';
+    const price = typeof props.price === 'number' ? `£${props.price}`
+        : typeof props.price === 'string' && props.price.length > 0 ? `£${props.price}`
+            : '';
+    return [status, price].filter((s) => s.length > 0).join(' ');
+}
 /**
  * 24-char canvas label for a node. Label precedence per label family
  * (ToolCall.toolName, WorkflowRun startedAt formatted, WorkflowStep.label,
  * Person givenName+familyName compose, Agent displayName/slug, Job
  * client+#jobId compose, Quote ref, InboundInvoice
  * supplier+#confirmationNumber compose, WhatsAppGroup clientName,
- * Message role+timestamp), then a generic
+ * Message role+timestamp, Property address/slug, Listing displayName/slug,
+ * Viewing date, Offer status+price, Visit purpose/status, PurchaseOrder
+ * poNumber, Invoice confirmationNumber, Risk/Finding/Hypothesis statement),
+ * then a generic
  * fallthrough across curated keys
  * (name, title, summary, givenName, subject, text) — :ConversationArchive
  * rows (Task 397) carry a stable `title` written by the writer so they pick
@@ -461,6 +485,48 @@ function pickShortLabel(node) {
                 return `${roleShort} ${ts}`;
         }
     }
+    else if (primaryLabel === 'Property') {
+        const v = estateAddress(props);
+        if (v.length > 0)
+            return v.length > 24 ? v.slice(0, 24) + '…' : v;
+    }
+    else if (primaryLabel === 'Listing') {
+        const v = estateListingName(props);
+        if (v.length > 0)
+            return v.length > 24 ? v.slice(0, 24) + '…' : v;
+    }
+    else if (primaryLabel === 'Viewing') {
+        const v = typeof props.date === 'string' ? props.date : '';
+        if (v.length > 0)
+            return v.length > 24 ? v.slice(0, 24) + '…' : v;
+    }
+    else if (primaryLabel === 'Offer') {
+        const v = offerCaption(props);
+        if (v.length > 0)
+            return v.length > 24 ? v.slice(0, 24) + '…' : v;
+    }
+    else if (primaryLabel === 'Visit') {
+        const purpose = typeof props.purpose === 'string' ? props.purpose : '';
+        const status = typeof props.status === 'string' ? props.status : '';
+        const v = purpose.length > 0 ? purpose : status;
+        if (v.length > 0)
+            return v.length > 24 ? v.slice(0, 24) + '…' : v;
+    }
+    else if (primaryLabel === 'PurchaseOrder') {
+        const v = typeof props.poNumber === 'string' ? props.poNumber : '';
+        if (v.length > 0)
+            return v.length > 24 ? v.slice(0, 24) + '…' : v;
+    }
+    else if (primaryLabel === 'Invoice') {
+        const v = typeof props.confirmationNumber === 'string' ? props.confirmationNumber : '';
+        if (v.length > 0)
+            return v.length > 24 ? v.slice(0, 24) + '…' : v;
+    }
+    else if (primaryLabel === 'Risk' || primaryLabel === 'Finding' || primaryLabel === 'Hypothesis') {
+        const v = typeof props.statement === 'string' ? props.statement : '';
+        if (v.length > 0)
+            return v.length > 24 ? v.slice(0, 24) + '…' : v;
+    }
     for (const k of ['name', 'title', 'summary', 'givenName', 'subject', 'text']) {
         const v = props[k];
         if (typeof v === 'string' && v.length > 0) {
@@ -546,6 +612,48 @@ function pickDisplayName(node) {
         if (desc.length > 0)
             return desc;
     }
+    else if (primaryLabel === 'Property') {
+        const v = estateAddress(props);
+        if (v.length > 0)
+            return v;
+    }
+    else if (primaryLabel === 'Listing') {
+        const v = estateListingName(props);
+        if (v.length > 0)
+            return v;
+    }
+    else if (primaryLabel === 'Viewing') {
+        const v = typeof props.date === 'string' ? props.date : '';
+        if (v.length > 0)
+            return v;
+    }
+    else if (primaryLabel === 'Offer') {
+        const v = offerCaption(props);
+        if (v.length > 0)
+            return v;
+    }
+    else if (primaryLabel === 'Visit') {
+        const purpose = typeof props.purpose === 'string' ? props.purpose : '';
+        const status = typeof props.status === 'string' ? props.status : '';
+        const v = purpose.length > 0 ? purpose : status;
+        if (v.length > 0)
+            return v;
+    }
+    else if (primaryLabel === 'PurchaseOrder') {
+        const v = typeof props.poNumber === 'string' ? props.poNumber : '';
+        if (v.length > 0)
+            return v;
+    }
+    else if (primaryLabel === 'Invoice') {
+        const v = typeof props.confirmationNumber === 'string' ? props.confirmationNumber : '';
+        if (v.length > 0)
+            return v;
+    }
+    else if (primaryLabel === 'Risk' || primaryLabel === 'Finding' || primaryLabel === 'Hypothesis') {
+        const v = typeof props.statement === 'string' ? props.statement : '';
+        if (v.length > 0)
+            return v;
+    }
     for (const k of ['name', 'title', 'summary', 'givenName', 'subject', 'text']) {
         const v = props[k];
         if (typeof v === 'string' && v.length > 0)