@rubytech/create-maxy-code 0.1.488 → 0.1.490

package/payload/platform/plugins/cloudflare/skills/data-portal/template/portal.js

@@ -20,6 +20,7 @@
   var crumbsEl = document.getElementById('dp-crumbs');
   var entriesEl = document.getElementById('dp-entries');
   var upEl = document.getElementById('dp-up');
+  var refreshEl = document.getElementById('dp-refresh');
   var uploadOpenEl = document.getElementById('dp-upload-open');
   var modalEl = document.getElementById('dp-modal');
   var modalCloseEl = document.getElementById('dp-modal-close');
@@ -106,11 +107,23 @@
 
       var a = document.createElement('a');
       a.className = 'dp-file-name';
-      a.href = API + '/api/download?key=' + encodeURIComponent(f.objectKey);
+      var href = API + '/api/download?key=' + encodeURIComponent(f.objectKey);
+      a.href = href;
       // Full name on hover, since the middle of a long name is clipped away.
       a.title = f.filename;
       var p = nameParts(f.filename);
       a.appendChild(nameNode(p.main, p.ext));
+      // Drag out to the file system, the same affordance the device-published
+      // rows already have. An <a> is draggable by default but hands over its
+      // href as a link; DownloadURL is what makes the OS write real bytes.
+      a.addEventListener('dragstart', function (ev) {
+        var abs = new URL(href, location.href).href;
+        ev.dataTransfer.setData(
+          'DownloadURL',
+          'application/octet-stream:' + f.filename + ':' + abs
+        );
+        ev.dataTransfer.setData('text/uri-list', abs);
+      });
       li.appendChild(a);
 
       var del = document.createElement('button');
@@ -221,6 +234,28 @@
           openShared(e.relPath);
         }
       });
+      if (e.kind === 'directory') {
+        /* Drop a file straight onto the folder it belongs in. This is the
+           interaction the whole two-way exchange exists for: no modal, no
+           picker, no guessing where it went. The row highlights so the target
+           is unambiguous while the pointer is over it. */
+        li.addEventListener('dragover', function (ev) {
+          ev.preventDefault();
+          li.classList.add('dp-drop-target');
+        });
+        li.addEventListener('dragleave', function (ev) {
+          if (!li.contains(ev.relatedTarget)) { li.classList.remove('dp-drop-target'); }
+        });
+        li.addEventListener('drop', function (ev) {
+          ev.preventDefault();
+          // Marked so the listing's own handler does not ALSO upload it into
+          // the folder that is merely open — one drop is one upload.
+          ev.dpHandled = true;
+          li.classList.remove('dp-drop-target');
+          var dt = ev.dataTransfer;
+          if (dt && dt.files && dt.files.length) { uploadMany(dt.files, e.relPath); }
+        });
+      }
       if (e.kind !== 'directory') {
         b.draggable = true;
         b.addEventListener('dragstart', function (ev) {
@@ -269,13 +304,22 @@
       });
   }
 
+  /* Resolves true when the list was re-rendered, false when it was not. The
+     boolean exists for the refresh control: this function catches its own
+     failure, so the promise resolves either way, and a caller that cleared the
+     status on resolve would erase the message written a moment earlier. The
+     `!d.ok` branch used to return silently, which left a failed re-list
+     indistinguishable from an unchanged one. */
   function refresh() {
     return api('/api/files?prefix=' + encodeURIComponent(prefix))
       .then(function (r) {
         return r.json();
       })
       .then(function (d) {
-        if (!d.ok) return;
+        if (!d.ok) {
+          say('Could not load your files.');
+          return false;
+        }
         render(d.files || []);
         var entries = d.entries || [];
         // Hidden at the root only: once inside a folder the section stays put,
@@ -283,9 +327,11 @@
         // vanishing.
         sharedEl.hidden = prefix === '' && entries.length === 0;
         renderEntries(entries);
+        return true;
       })
       .catch(function () {
         say('Could not load your files.');
+        return false;
       });
   }
 
@@ -300,8 +346,15 @@
         return r.json();
       })
       .then(function (d) {
-        say(d.ok ? 'Deleted.' : 'Could not delete that.');
-        return refresh();
+        var done = d.ok ? 'Deleted.' : 'Could not delete that.';
+        say(done);
+        // refresh() writes its own failure text, which would otherwise bury what
+        // just happened to the file. Compose the two, so a list that did not
+        // reload is reported without the client losing the delete's outcome and
+        // reading a load error as though the delete itself had failed.
+        return refresh().then(function (ok) {
+          if (!ok) { say(done + ' The list could not be reloaded.'); }
+        });
       })
       .catch(function () {
         say('Could not delete that.');
@@ -370,12 +423,35 @@
     refresh();
   });
 
+  /* Re-read the index in the folder that is already open. refresh() reads the
+     current prefix, so this does not reset to the root. The status clears only
+     on a reported success, otherwise refresh()'s own error text stays up.
+     refresh() returns false from its catch rather than rejecting, so the button
+     cannot be left stuck disabled and needs no catch here. `disabled` in flight
+     is what stops a double click issuing two reads. */
+  refreshEl.addEventListener('click', function () {
+    refreshEl.disabled = true;
+    say('Refreshing…');
+    refresh().then(function (ok) {
+      refreshEl.disabled = false;
+      if (ok) { say(''); }
+    });
+  });
+
   /* The upload modal. Hidden via the `hidden` attribute so
      [hidden]{display:none!important} stays authoritative over .dp-modal's
      display:flex. It dismisses three ways: the close button, a click on the
      backdrop (never the panel), and Escape while open. */
   function openModal() {
     modalEl.hidden = false;
+    // Name the destination rather than leaving it implicit. An upload whose
+    // folder the client has to infer is the defect this whole task removes.
+    var t = document.getElementById('dp-upload-target');
+    if (t) {
+      t.textContent = prefix
+        ? 'Uploading into ' + prefix
+        : 'Uploading into your own files. Open a folder first to send it there.';
+    }
     document.getElementById('dp-file').focus();
   }
   function closeModal() {
@@ -397,29 +473,151 @@
      not), so the picker is cleared only when a retry with the same selection is
      pointless; `ok` is true only on a kept upload, which is what closes the
      modal. A network error is { responded:false, ok:false }. */
-  function uploadFile(file) {
+  /* One part is 25 MiB, matching the server's per-part gate. A part is read
+     wholly into the Function's memory, so this is the isolate's bound, not a
+     preference. The whole-file cap is 1 GiB. */
+  var PART_BYTES = 25 * 1024 * 1024;
+  var MAX_TOTAL_BYTES = 1024 * 1024 * 1024;
+
+  /* Every failure used to read 'Upload failed.', which tells a client nothing
+     about whether to retry, sign in again, or pick a smaller file. */
+  function uploadFailureMessage(status) {
+    if (status === 401) return 'Your session expired. Sign in again.';
+    if (status === 403) return 'You cannot upload to that folder.';
+    if (status === 413) return 'That file is too large.';
+    if (status === 400) return 'That file could not be read.';
+    return 'Upload failed.';
+  }
+
+  function showProgress(fraction) {
+    var wrap = document.getElementById('dp-progress');
+    var bar = document.getElementById('dp-progress-bar');
+    if (!wrap || !bar) return;
+    if (fraction === null) { wrap.hidden = true; return; }
+    wrap.hidden = false;
+    bar.style.width = Math.round(fraction * 100) + '%';
+  }
+
+  /* Slice a large file across a multipart session. Three stages: open, send
+     each part, assemble. Anything at or below one part takes the single-request
+     path below, so the common case stays one round trip. */
+  function uploadLarge(file, target) {
+    var created;
     var fd = new FormData();
-    fd.append('file', file);
-    say('Uploading…');
+    fd.append('action', 'create');
+    fd.append('filename', file.name);
+    fd.append('targetPath', target);
+    fd.append('size', String(file.size));
     return api('/api/upload', { method: 'POST', body: fd })
-      .then(function (r) {
-        return r.json();
-      })
-      .then(function (d) {
-        say(d.ok ? 'Uploaded.' : 'Upload failed.');
-        return refresh().then(function () { return { responded: true, ok: !!d.ok }; });
+      .then(function (r) { return r.json().then(function (d) { return { s: r.status, d: d }; }); })
+      .then(function (res) {
+        if (!res.d.ok) { throw { status: res.s }; }
+        created = res.d;
+        var parts = [];
+        var total = Math.ceil(file.size / PART_BYTES);
+        var chain = Promise.resolve();
+        var _loop = function (i) {
+          chain = chain.then(function () {
+            var slice = file.slice(i * PART_BYTES, Math.min((i + 1) * PART_BYTES, file.size));
+            var pf = new FormData();
+            pf.append('action', 'part');
+            pf.append('key', created.key);
+            pf.append('r2UploadId', created.r2UploadId);
+            pf.append('partNumber', String(i + 1));
+            pf.append('part', slice);
+            say('Uploading ' + file.name + ' (' + (i + 1) + ' of ' + total + ')…');
+            showProgress(i / total);
+            return api('/api/upload', { method: 'POST', body: pf })
+              .then(function (r) { return r.json().then(function (d) { return { s: r.status, d: d }; }); })
+              .then(function (pr) {
+                if (!pr.d.ok) { throw { status: pr.s }; }
+                parts.push({ partNumber: pr.d.partNumber, etag: pr.d.etag, size: slice.size });
+              });
+          });
+        };
+        for (var i = 0; i < total; i++) { _loop(i); }
+        return chain.then(function () {
+          var cf = new FormData();
+          cf.append('action', 'complete');
+          cf.append('key', created.key);
+          cf.append('r2UploadId', created.r2UploadId);
+          cf.append('targetPath', target);
+          cf.append('parts', JSON.stringify(parts));
+          showProgress(1);
+          return api('/api/upload', { method: 'POST', body: cf })
+            .then(function (r) { return r.json().then(function (d) { return { s: r.status, d: d }; }); });
+        });
+      });
+  }
+
+  /* One upload path for Browse-and-Upload, for a dropped file, and for a file
+     dropped onto a folder row. `target` is the folder it should land in; '' is
+     the client's own uploads area. Resolves { responded, ok }. */
+  function uploadFile(file, target) {
+    target = target || '';
+    // Checked here as well as on the server: the browser should not spend
+    // minutes sending a gigabyte only to be told at the end.
+    if (file.size > MAX_TOTAL_BYTES) {
+      say(file.name + ' is larger than the 1 GB limit.');
+      return Promise.resolve({ responded: true, ok: false });
+    }
+
+    say('Uploading ' + file.name + '…');
+    var run;
+    if (file.size > PART_BYTES) {
+      run = uploadLarge(file, target);
+    } else {
+      var fd = new FormData();
+      fd.append('file', file);
+      fd.append('targetPath', target);
+      run = api('/api/upload', { method: 'POST', body: fd })
+        .then(function (r) { return r.json().then(function (d) { return { s: r.status, d: d }; }); });
+    }
+
+    return run
+      .then(function (res) {
+        showProgress(null);
+        var done = res.d.ok ? 'Uploaded ' + file.name + '.' : uploadFailureMessage(res.s);
+        say(done);
+        // Same composition as remove(): a list that did not reload must not cost
+        // the client the upload's own outcome.
+        return refresh().then(function (ok) {
+          if (!ok) { say(done + ' The list could not be reloaded.'); }
+          return { responded: true, ok: !!res.d.ok };
+        });
       })
-      .catch(function () {
-        say('Upload failed.');
-        return { responded: false, ok: false };
+      .catch(function (err) {
+        showProgress(null);
+        // A thrown {status} came from a multipart stage; anything else is the
+        // network. Both are distinguishable to the client, which is the point.
+        say(err && err.status ? uploadFailureMessage(err.status) : 'Could not reach the server.');
+        return { responded: !!(err && err.status), ok: false };
+      });
+  }
+
+  /* Files in sequence, not in parallel: the status line reports one at a time,
+     and a portal on a free plan should not open ten concurrent uploads. */
+  function uploadMany(files, target) {
+    var list = Array.prototype.slice.call(files);
+    var anyOk = false;
+    return list.reduce(function (chain, f) {
+      return chain.then(function () {
+        return uploadFile(f, target).then(function (r) {
+          if (r.ok) { anyOk = true; }
+        });
       });
+    }, Promise.resolve()).then(function () {
+      return { responded: true, ok: anyOk };
+    });
   }
 
   uploadForm.addEventListener('submit', function (e) {
     e.preventDefault();
     var input = document.getElementById('dp-file');
-    if (!input.files || !input.files[0]) return;
-    uploadFile(input.files[0]).then(function (res) {
+    if (!input.files || !input.files.length) return;
+    // The modal uploads into the folder currently open, which is what the
+    // target line under the form says. No hidden default.
+    uploadMany(input.files, prefix).then(function (res) {
       if (res.responded) { input.value = ''; }
       if (res.ok) { closeModal(); }
     });
@@ -440,11 +638,50 @@
     e.preventDefault();
     uploadForm.classList.remove('dp-dropping');
     var dt = e.dataTransfer;
-    if (dt && dt.files && dt.files[0]) {
-      // The drop target now lives inside the modal, so a kept drop closes it too.
-      uploadFile(dt.files[0]).then(function (res) {
+    if (dt && dt.files && dt.files.length) {
+      uploadMany(dt.files, prefix).then(function (res) {
         if (res.ok) { closeModal(); }
       });
     }
   });
+
+  /* Drop straight onto the open listing, which targets the folder currently
+     open. The modal is no longer the only way in: the whole point of the
+     exchange is that a client drags a file to where it belongs. */
+  entriesEl.addEventListener('dragover', function (e) {
+    e.preventDefault();
+    entriesEl.classList.add('dp-dropping');
+  });
+  entriesEl.addEventListener('dragleave', function (e) {
+    if (!entriesEl.contains(e.relatedTarget)) {
+      entriesEl.classList.remove('dp-dropping');
+    }
+  });
+  entriesEl.addEventListener('drop', function (e) {
+    // Only a drop that landed on the listing itself, not one that bubbled up
+    // from a folder row — that row has already handled it with its own target.
+    if (e.dpHandled) return;
+    e.preventDefault();
+    entriesEl.classList.remove('dp-dropping');
+    var dt = e.dataTransfer;
+    if (dt && dt.files && dt.files.length) { uploadMany(dt.files, prefix); }
+  });
+
+  /* Re-read on a timer while the tab is visible.
+
+     Polling was rejected in Tasks 1885 and 1900 on the explicit reasoning that
+     "a poll against an hourly tree is waste". That premise died with the hourly
+     push: the device now publishes every sixty seconds, so a poll at the same
+     cadence is what makes a device-side change appear without the client
+     clicking anything.
+
+     Gated on visibility so a forgotten background tab costs nothing, and
+     skipped while a read is already in flight so a slow response cannot stack
+     requests on a portal running on a free plan. */
+  var polling = false;
+  setInterval(function () {
+    if (document.hidden || panelEl.hidden || polling) return;
+    polling = true;
+    refresh().then(function () { polling = false; });
+  }, 60000);
 })();

package/payload/platform/plugins/docs/references/calendar-booking.md

@@ -49,10 +49,14 @@ This usually completes within a couple of minutes of the booking.
 Bookings are reconciled on a cycle and the system audits itself each run. In the device logs:
 
 - `[calendar-booking]` lines trace one booking through submit, write, notify, and done.
-- `[calendar-reconcile]` lines report three health numbers per account: `eligibleExamined` (bookings the check looked at), `pendingUnreconciled` (bookings captured but not yet turned into meetings) and `orphanMeetings` (booking meetings with no matching saved booking). Entries that only block out a slot are not counted — they are not bookings and never become meetings.
+- `[calendar-reconcile]` lines report four health numbers per account: `eligibleExamined` (bookings the check looked at), `pendingUnreconciled` (bookings captured but not yet turned into meetings), `pendingOldestAgeMin` (how many minutes the longest-waiting of those has been waiting) and `orphanMeetings` (booking meetings with no matching saved booking). Entries that only block out a slot are not counted — they are not bookings and never become meetings.
 
 A `pendingUnreconciled` number that stays above zero across several runs means those bookings are failing to turn into meetings, and the `attempt=` number on the matching `[calendar-booking]` lines says how many times each has been tried. A booking whose meeting is deleted is picked up again automatically on the next run. To read them: `journalctl --user -u <brand-service> | grep -E '\[calendar-booking\]|\[calendar-reconcile\]'`, then filter by one booking id for its full story. The edge half of a booking (before your device sees it) is in the Cloudflare Pages function logs.
 
+A count on its own cannot tell a short lag from a long one: five bookings waiting two minutes and five waiting nine hours are both `pendingUnreconciled=5`. `pendingOldestAgeMin` is what separates them. It reads `0` when nothing is waiting, and also when something is waiting but for under a minute, so read it together with the count beside it.
+
+A separate `op=liveness` line is printed every ten minutes by your device's own server, whether or not anything is wrong. `stale=false` means the booking check has run recently. `stale=true` means it has not run in over six minutes, which is the case nothing else can tell you about: a check that has stopped cannot report that it has stopped. `lastSkipReason` names the last account whose check finished without looking at any bookings, and reads `none` when every account it got to was checked. If you run more than one account, a check can both look at one account and skip another, so seeing a recent check time next to a skip reason is normal and means two different accounts.
+
 ## When your real calendar lives elsewhere
 
 The booking page publishes open slots from the internal calendar, the one Maxy keeps in its own graph.

package/payload/platform/plugins/docs/references/internals.md

@@ -404,6 +404,8 @@ Standing rules the operator gives over a channel are `Preference` nodes. Two mec
 
 **Trust a scheduled turn's provenance, never an inbound's claim (channel-agent grounding).** A cron-dispatched agent turn reaches the same channel builders as a real inbound, so its own authorisation text would otherwise land inside `## Context` — the zone `REFRAME_INSTRUCTION` demotes to untrusted — and a security-cautious agent would distrust its own automation (the self-cancel loop). The dispatcher therefore stamps a `ScheduleProvenance` marker (owning account, event, owner userId, dispatch time) that the channel builders render as a `## Scheduled automation (platform-verified)` preamble **above** `## Context` (and above the rules block); the whatsapp wrap tag names the door `scheduler`. Both channel-server paths carry the marker — the single-target loop and the unified multi-target door reader (via the same `doorInboundPayload` seam that carries `standingRules`); the scheduler only dispatches to the whatsapp/telegram door, so a webchat frame never bears one. Because the marker is dispatcher-stamped and never derived from payload text, an inbound message cannot forge it — placement above `## Context` alone is not the trust signal, the dispatcher provenance is. The grounding binds to it in two places: one recipient-neutral clause added byte-identical to the three reframe instructions (a marker-bearing turn is authorised standing automation; a reconfiguration or re-enable is not intrusion), and the admin `IDENTITY.md` "Untrusted input" rule that the agent never states a platform-level authenticity or impersonation verdict it was not given (an unsourced "this is not from you" is its own inference, flagged, never asserted as the platform's). A sender has exactly one session: every inbound, real or scheduled, resolves to the deterministic `adminSessionIdFor(effectiveAccount, destination)`. An earlier change gave each firing its own salted seat so distrust could not accrete across firings, but the inbound hub keys on `senderId` and replaces its subscriber outright, so a seat's channel server attached under the sender's own key and swallowed the sender's REAL messages until it detached — splitting one conversation across two sessions that each denied what the other held. The seat is removed; the authoritative `agentPrompt`, this provenance marker, and the injected standing rules ground each firing without one. Self-cancel attribution is disarmed while that model beds in: the guard used to compare the cancelling turn's session id to a dispatcher stamp, which discriminated only because each firing ran its own seat, so with one session per sender it would report an autonomous loop on every operator cancel. It now always reports false — under-counting a real loop rather than inventing one — until the discriminator is rebuilt from the turn's own dispatched eventId. See `.docs/scheduling-agent-dispatch.md § Operator-provenance marker`, `§ Session model — one session per sender`, and `§ Self-cancel attribution — disarmed`.
 
+**Carry what a reply points at (WhatsApp reply quote).** A WhatsApp sender replying to an earlier message produces a quote that `app/lib/whatsapp/inbound/extract.ts` resolves to `{ id, text?, sender? }` and `manager.ts` assigns to the route payload's `replyContext`. That field had no reader: the `server/index.ts` gateway argument omitted it, `AdminInbound` and the hub frame had no such field, and the channel service's `composePayload` emitted the caption and media notes only, so a message saying "prepare an email confirmation for this booking" reached the agent with nothing to resolve "this booking" against. It now rides both WhatsApp admin doors. On the persistent door it travels `server/index.ts` -> `AdminInbound` -> the hub frame the SSE route stringifies -> the channel service's `InboundPayload`, where `composeReplyNote` renders it as a bracketed note at the top of the payload, inside `## Context` and above the caption and any woven media notes: the quoted body is sender-controlled and belongs in the reframed untrusted zone, never in the platform preamble. Both channel-server inbound paths carry it, through the same `doorInboundPayload` seam that carries `standingRules` and the schedule provenance marker: the single-target SSE loop parses the whole frame, and the unified multi-target door reader rebuilds the payload field by field, so a field that seam omits is dropped on multi-target sessions alone. That seam is guarded by a test which reads the `InboundPayload` declaration and the rebuild function rather than a fixture, because the pre-existing byte-identity guard compared one hardcoded payload and so stayed green for every field added after it was written. On the passive account-manager door there is no channel server and no `## Context` frame, so the one-shot's whole initial prompt is read at face value; `composePassivePrompt` therefore puts the BARE sentence above the requirement and never the quoted body. The body arrives from the sender's own client and is never checked against the message store, so quoting it in a platform-voiced bracket on the door with no untrusted zone would let a modified client put words the agent never said into a `work-create` filing. The empty-text drop gate still tests the requirement alone, so a quote never rescues an inbound carrying no requirement of its own. The quoted body is capped at `QUOTED_TEXT_CAP` (500 characters, `…` appended when cut) because it is unbounded sender-controlled input, and the cut lands on whole characters so a body whose 500th boundary falls inside a surrogate pair cannot emit a lone surrogate at a position the sender chose. Only the channel service renders a body, so the cap lives there alone; platform/ui's `app/lib/whatsapp/reply-quote.ts` holds just the bare sentence for the passive door, and both packages hardcode that sentence in their own tests so the two doors cannot drift apart on the wording (the packages never cross-import, the same arrangement `REFRAME_INSTRUCTION` and `MediaRef` use). Telegram and webchat extract no quote at all, so neither carries one. `payloadBytes` measures the whole inner payload, so a reply carrying a quote produces a visibly larger `[reframe] op=applied … payloadBytes=<n>` than the same text without one, and a bare-text-length `payloadBytes` on an inbound whose store row has a non-null `quotedId` is the signature of this defect returning. Because the field is optional at every hop, dropping it from either `server/index.ts` argument would be silent (tsc stays green, and no unit test executes that wiring file), so the `check-reply-context-threaded` build gate asserts both argument sites.
+
 **Observability.** `[preference-write] op=reconcile … mode=<reinforce|update|contradict|new> similarity=…` — a stream of `mode=new` for subjects that already exist is the duplicate-minting signature. `[preference-inject] op=inject channel=<wa|tg|web> injected=<N> owner=<8> source=<owner|no-owner|owner-error|fetch-error>` — injection selects only the account owner's admin preferences, so `source=owner injected=0` is a genuinely empty owner, `source=no-owner` is an account with no seeded owner (injects nothing, a missed owner seeding), and `injected=0 source=owner` on an account whose owner holds rules is the write-only regression re-appearing. `[preference-audit] op=drift accountId=… storedActive=… injectedActive=… duplicateClusters=…` — the standing reconciliation audit (claude-session-manager, 5-minute tick) flags any account whose store holds more active rows than injection would surface, the no-event detector for drift.
 
 ---

package/payload/platform/plugins/memory/mcp/dist/lib/__tests__/schema-cypher-drift.test.js

@@ -2,6 +2,11 @@ import { test, expect } from "vitest";
 import { readFileSync, readdirSync } from "node:fs";
 import { resolve, join } from "node:path";
 import { parseLabelsFromSchemaCypher } from "../../../../../../lib/graph-mcp/dist/schema-cypher-parser.js";
+import { ADDITIONAL_BASE_LABELS } from "../../../../../../lib/graph-style/dist/index.js";
+// Same package, so the markdown row splitter is imported rather than copied.
+// The UI server carries its own copy only because it is a separate build in a
+// separate process; inside this package a second copy would be pure drift.
+import { splitPipeRow } from "../schema-loader.js";
 // Task 358 — schema-doc / schema-cypher drift guard.
 //
 // Every label declared in prose by an ontology doc under
@@ -15,56 +20,81 @@ import { parseLabelsFromSchemaCypher } from "../../../../../../lib/graph-mcp/dis
 // task, and Task 352 before it).
 const REFERENCES_DIR = resolve(import.meta.dirname, "../../../../references");
 const SCHEMA_CYPHER_PATH = resolve(import.meta.dirname, "../../../../../../neo4j/schema.cypher");
-// Labels named in prose that are deliberately NOT first-class graph
-// nodes — they are sub-labels stacked on a base node by the writer, or
-// schema.org aliases that never reach the graph as their own label.
-// Adding to this set is an intentional exception, not a silent omission.
-const PROSE_ONLY_LABELS = new Set([
-    // schema-estate-agent.md treats Applicant as an additional label on a
-    // base :Person node; there is no standalone :Applicant.
-    "Applicant",
-    // schema-construction.md treats Engineer as an additional label on a base
-    // :Person node (the field-engineer / CIS worker-pay model); there is no
-    // standalone :Engineer, so it carries no constraint/index of its own.
-    "Engineer",
-    // schema-construction.md treats Supplier as an additional label on a base
-    // :Organization node (the supplier-invoice model); there is no standalone
-    // :Supplier, so it carries no constraint/index of its own.
-    "Supplier",
-    // Email is retired: Task 321 folded threads onto :KnowledgeDocument
-    // {source:'email'}, Task 426 then moved them onto :ConversationArchive
-    // {source:'email'}. The :Email label never reaches the graph; it is
-    // referenced in schema-base.md only for historical orientation.
-    "Email",
-]);
-function backtickedLabels(text) {
+// Labels declared in a node-type table that are deliberately NOT first-class
+// graph nodes, so they carry no constraint or index of their own.
+//
+// The additional-label members come from the single shared declaration in
+// graph-style (Task 1893) — the same set the /graph chip allowlist excludes, so
+// the two cannot drift apart. `Email` is local and stays local: it is exempt
+// because the label is retired (Task 321 folded threads onto
+// :KnowledgeDocument {source:'email'}, Task 426 moved them to
+// :ConversationArchive {source:'email'}), not because it stacks on a base node.
+// Folding it into the shared set would make that set mean two different things.
+const EXEMPT_LABELS = new Set([...ADDITIONAL_BASE_LABELS, "Email"]);
+const stripBackticks = (s) => s.replace(/`/g, "").trim();
+// Every label in the `Neo4j Label` column of any node-type table in the doc.
+//
+// This replaces the previous scan for the backticked `:Label` prose form
+// (Task 1893). That form matched only labels an author happened to write with a
+// colon, so whole verticals went unchecked; widening it to bare backticks was
+// measured and rejected, because it also matches relationship types (CITES),
+// status values (Paid, InProgress), compass directions (North), contract clause
+// kinds (Severability) and the `Owner` column header — 99 hits, ~90 of them not
+// labels. The table column is the structured declaration, so it carries no such
+// noise, and it is the same source the /graph top-level derivation reads.
+function tableDeclaredLabels(text) {
     const labels = new Set();
-    // Match `:Label` inside backticks — the convention used by every
-    // schema-*.md prose doc to name a Neo4j label.
-    for (const match of text.matchAll(/`:([A-Z][A-Za-z0-9]*)`/g)) {
-        labels.add(match[1]);
+    const lines = text.split(/\r?\n/);
+    for (let i = 0; i < lines.length - 1; i++) {
+        if (!lines[i].includes("|"))
+            continue;
+        const sep = lines[i + 1];
+        if (!/^\s*\|?[\s:|-]+\|?\s*$/.test(sep) || !sep.includes("-"))
+            continue;
+        const headers = splitPipeRow(lines[i]).map((h) => stripBackticks(h).toLowerCase());
+        const labelCol = headers.findIndex((h) => h === "neo4j label");
+        if (labelCol === -1)
+            continue;
+        for (let j = i + 2; j < lines.length; j++) {
+            const row = lines[j];
+            if (!row.trim() || !row.includes("|"))
+                break;
+            const label = stripBackticks(splitPipeRow(row)[labelCol] ?? "");
+            if (/^[A-Z][A-Za-z0-9]*$/.test(label))
+                labels.add(label);
+        }
     }
     return labels;
 }
-test("schema-*.md prose labels all appear in schema.cypher", () => {
+test("schema-*.md node-type table labels all appear in schema.cypher", () => {
     const declared = new Set(parseLabelsFromSchemaCypher(readFileSync(SCHEMA_CYPHER_PATH, "utf-8")));
     const files = readdirSync(REFERENCES_DIR).filter((name) => name.startsWith("schema-") && name.endsWith(".md"));
     expect(files.length).toBeGreaterThan(0);
     const missing = [];
     for (const file of files) {
         const text = readFileSync(join(REFERENCES_DIR, file), "utf-8");
-        for (const label of backtickedLabels(text)) {
-            if (PROSE_ONLY_LABELS.has(label))
+        for (const label of tableDeclaredLabels(text)) {
+            if (EXEMPT_LABELS.has(label))
                 continue;
             if (!declared.has(label)) {
                 missing.push({ label, file });
             }
         }
     }
-    expect(missing, `Labels named in prose but missing from schema.cypher (add a CREATE CONSTRAINT or CREATE INDEX FOR (x:Label) line, or add to PROSE_ONLY_LABELS with a justification):\n${missing
+    expect(missing, `Labels declared in a schema-*.md node-type table but missing from schema.cypher (add a CREATE CONSTRAINT or CREATE INDEX FOR (x:Label) line, or — if it is an additional label on a base node — add it to ADDITIONAL_BASE_LABELS in platform/lib/graph-style):\n${missing
         .map((m) => `  :${m.label} (${m.file})`)
         .join("\n")}`).toEqual([]);
 });
+test("the additional-label exemptions come from the shared declaration", () => {
+    // Task 1893: this guard and the /graph chip allowlist read one set. If this
+    // fails, someone re-introduced a local copy.
+    for (const label of ADDITIONAL_BASE_LABELS) {
+        expect(EXEMPT_LABELS.has(label), `:${label} should be exempt`).toBe(true);
+    }
+    // Email is the only exemption that is NOT an additional label.
+    const extra = [...EXEMPT_LABELS].filter((l) => !ADDITIONAL_BASE_LABELS.has(l));
+    expect(extra).toEqual(["Email"]);
+});
 test("estate-agent labels are declared in schema.cypher", () => {
     // Task 358 acceptance — explicit assertion against regression.
     const declared = new Set(parseLabelsFromSchemaCypher(readFileSync(SCHEMA_CYPHER_PATH, "utf-8")));

package/payload/platform/plugins/memory/mcp/dist/lib/__tests__/schema-cypher-drift.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema-cypher-drift.test.js","sourceRoot":"","sources":["../../../src/lib/__tests__/schema-cypher-drift.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,2BAA2B,EAAE,MAAM,8DAA8D,CAAC;AAE3G,qDAAqD;AACrD,EAAE;AACF,yDAAyD;AACzD,uEAAuE;AACvE,0CAA0C;AAC1C,sEAAsE;AACtE,0EAA0E;AAC1E,uEAAuE;AACvE,oEAAoE;AACpE,qEAAqE;AACrE,iCAAiC;AAEjC,MAAM,cAAc,GAAG,OAAO,CAC5B,MAAM,CAAC,IAAI,CAAC,OAAO,EACnB,wBAAwB,CACzB,CAAC;AACF,MAAM,kBAAkB,GAAG,OAAO,CAChC,MAAM,CAAC,IAAI,CAAC,OAAO,EACnB,uCAAuC,CACxC,CAAC;AAEF,oEAAoE;AACpE,uEAAuE;AACvE,oEAAoE;AACpE,yEAAyE;AACzE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAS;IACxC,sEAAsE;IACtE,wDAAwD;IACxD,WAAW;IACX,0EAA0E;IAC1E,wEAAwE;IACxE,sEAAsE;IACtE,UAAU;IACV,0EAA0E;IAC1E,0EAA0E;IAC1E,2DAA2D;IAC3D,UAAU;IACV,oEAAoE;IACpE,uEAAuE;IACvE,oEAAoE;IACpE,gEAAgE;IAChE,OAAO;CACR,CAAC,CAAC;AAEH,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,iEAAiE;IACjE,+CAA+C;IAC/C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,yBAAyB,CAAC,EAAE,CAAC;QAC7D,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,IAAI,CAAC,sDAAsD,EAAE,GAAG,EAAE;IAChE,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,2BAA2B,CAAC,YAAY,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC,CACvE,CAAC;IACF,MAAM,KAAK,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC,MAAM,CAC9C,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAC7D,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAExC,MAAM,OAAO,GAA2C,EAAE,CAAC;IAC3D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;QAC/D,KAAK,MAAM,KAAK,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3C,IAAI,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,SAAS;YAC3C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,CACJ,OAAO,EACP,yKAAyK,OAAO;SAC7K,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC;SACvC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAChB,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,mDAAmD,EAAE,GAAG,EAAE;IAC7D,+DAA+D;IAC/D,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,2BAA2B,CAAC,YAAY,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC,CACvE,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,CAAC,EAAE,CAAC;QAC/E,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,aAAa,KAAK,mBAAmB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChF,CAAC;AACH,CAAC,CAAC,CAAC"}
+{"version":3,"file":"schema-cypher-drift.test.js","sourceRoot":"","sources":["../../../src/lib/__tests__/schema-cypher-drift.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,2BAA2B,EAAE,MAAM,8DAA8D,CAAC;AAC3G,OAAO,EAAE,sBAAsB,EAAE,MAAM,iDAAiD,CAAC;AACzF,6EAA6E;AAC7E,8EAA8E;AAC9E,2EAA2E;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,qDAAqD;AACrD,EAAE;AACF,yDAAyD;AACzD,uEAAuE;AACvE,0CAA0C;AAC1C,sEAAsE;AACtE,0EAA0E;AAC1E,uEAAuE;AACvE,oEAAoE;AACpE,qEAAqE;AACrE,iCAAiC;AAEjC,MAAM,cAAc,GAAG,OAAO,CAC5B,MAAM,CAAC,IAAI,CAAC,OAAO,EACnB,wBAAwB,CACzB,CAAC;AACF,MAAM,kBAAkB,GAAG,OAAO,CAChC,MAAM,CAAC,IAAI,CAAC,OAAO,EACnB,uCAAuC,CACxC,CAAC;AAEF,6EAA6E;AAC7E,kEAAkE;AAClE,EAAE;AACF,0EAA0E;AAC1E,gFAAgF;AAChF,6EAA6E;AAC7E,6DAA6D;AAC7D,8DAA8D;AAC9D,gFAAgF;AAChF,gFAAgF;AAChF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,sBAAsB,EAAE,OAAO,CAAC,CAAC,CAAC;AAE5E,MAAM,cAAc,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAEzE,6EAA6E;AAC7E,EAAE;AACF,yEAAyE;AACzE,gFAAgF;AAChF,8EAA8E;AAC9E,6EAA6E;AAC7E,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAChF,0EAA0E;AAC1E,SAAS,mBAAmB,CAAC,IAAY;IACvC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS;QACtC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS;QACxE,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC/C,cAAc,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAChC,CAAC;QACF,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC;QAC/D,IAAI,QAAQ,KAAK,CAAC,CAAC;YAAE,SAAS;QAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACrB,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,MAAM;YAC7C,MAAM,KAAK,GAAG,cAAc,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YAChE,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,IAAI,CAAC,gEAAgE,EAAE,GAAG,EAAE;IAC1E,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,2BAA2B,CAAC,YAAY,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC,CACvE,CAAC;IACF,MAAM,KAAK,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC,MAAM,CAC9C,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAC7D,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAExC,MAAM,OAAO,GAA2C,EAAE,CAAC;IAC3D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;QAC/D,KAAK,MAAM,KAAK,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9C,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,SAAS;YACvC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,CACJ,OAAO,EACP,mQAAmQ,OAAO;SACvQ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC;SACvC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAChB,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,kEAAkE,EAAE,GAAG,EAAE;IAC5E,4EAA4E;IAC5E,6CAA6C;IAC7C,KAAK,MAAM,KAAK,IAAI,sBAAsB,EAAE,CAAC;QAC3C,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,mBAAmB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5E,CAAC;IACD,+DAA+D;IAC/D,MAAM,KAAK,GAAG,CAAC,GAAG,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/E,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;AACnC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,mDAAmD,EAAE,GAAG,EAAE;IAC7D,+DAA+D;IAC/D,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,2BAA2B,CAAC,YAAY,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC,CACvE,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,CAAC,EAAE,CAAC;QAC/E,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,aAAa,KAAK,mBAAmB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChF,CAAC;AACH,CAAC,CAAC,CAAC"}

package/payload/platform/plugins/scheduling/PLUGIN.md

@@ -188,7 +188,7 @@ It is **armed by the always-running `platform/ui` server on an interval**, becau
 
 Env: `PLATFORM_ROOT`, `NEO4J_URI` (and `NEO4J_PASSWORD` or `config/.neo4j-password`). Per account it reads `data/accounts/<id>/calendar-availability.json` (for `bookingDbName`). The Cloudflare credential is read house-only from `config/cloudflare-house.env`; that credential is a minter, so the calendar mints a `calendar-d1` (D1-only) token from it via `cf-token.sh` and shells `wrangler` for the D1 reads/writes on that scoped token, never the minter directly.
 
-Observability: one `[calendar-booking]` line per step keyed by `bookingId` (`reconcile-claim`, `meeting-write`, `notify`, `booked`), and one `[calendar-reconcile] account=… eligibleExamined=… pendingUnreconciled=… orphanMeetings=…` audit line per account per run. `eligibleExamined` separates "nothing to do" from "verified clean". A `pendingUnreconciled` that persists across runs means those rows are failing to become meetings rather than merely lagging — the `attempt=` count on the claim and failure lines says how many times each has been tried. `orphanMeetings` means a booking meeting has no backing eligible D1 row.
+Observability: one `[calendar-booking]` line per step keyed by `bookingId` (`reconcile-claim`, `meeting-write`, `notify`, `booked`), and one `[calendar-reconcile] account=… eligibleExamined=… pendingUnreconciled=… pendingOldestAgeMin=… orphanMeetings=…` audit line per account per run. `eligibleExamined` separates "nothing to do" from "verified clean". A `pendingUnreconciled` that persists across runs means those rows are failing to become meetings rather than merely lagging — the `attempt=` count on the claim and failure lines says how many times each has been tried. `orphanMeetings` means a booking meeting has no backing eligible D1 row. `pendingOldestAgeMin` ages that backlog: a count cannot separate a short lag from a nine-hour one. The companion `[calendar-reconcile] op=liveness lastRunAgeMin=… lastAuditAgeMin=… lastSkipReason=… stale=<bool>` line is emitted every ten minutes by the platform/ui server rather than by this script, because the failure it detects is this script not reporting at all. `op=liveness-write-failed` is the one case where that record could not be written; it carries the error body and never stops the run, because a run that worked must not be reported as failed for losing its own bookkeeping.
 
 ## Ingesting calendar archives (.ics → graph)
 

package/payload/platform/plugins/scheduling/mcp/dist/index.js

@@ -42,8 +42,8 @@ function refuseNoAccount(toolName) {
 // read. NOT boot-throw on missing — the silent-compaction path
 // (compaction.ts:53) intentionally spawns this MCP without USER_ID for
 // summary-only turns that don't invoke scheduling tools. The lib's
-// per-call MissingUserIdError handles the actual bug class (caller forgot
-// to thread userId on a real tool invocation).
+// per-call MissingUserIdError handles the actual bug class (Task 1895: no
+// resolvable identity — no owner AdminUser and no acting userId).
 const userId = process.env.USER_ID || "";
 const sessionId = process.env.SESSION_ID || undefined;
 const agentSlug = process.env.AGENT_SLUG || undefined;