@rubytech/create-maxy-code 0.1.496 → 0.1.497

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.496",
+  "version": "0.1.497",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/docs/superpowers/plans/2026-07-24-task-1942-subaccount-switcher-brand-head.md

@@ -0,0 +1,327 @@
+# Task 1942 — Sub-account switcher to sidebar brand head — Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: superpowers:executing-plans. Steps use checkbox (`- [ ]`) syntax.
+
+**Goal:** Open the sub-account picker by clicking the sidebar brand head; remove it from the footer kebab.
+
+**Architecture:** `Sidebar.tsx` owns a `switcherOpen` state and renders the brand head as a button (icon + lockup + chevron) when the switcher is available, with `SubAccountPicker` + a full-screen scrim anchored beneath `.side-brand`. `AccountMenu.tsx` loses the switcher block, its five props, and the `SubAccountPicker` import. `globals.css` makes `.side-brand` a positioned anchor, re-anchors the panel left-aligned, and deletes the dead footer overrides.
+
+**Tech Stack:** React 18, TypeScript, vitest + jsdom (Node 22), lucide-react icons.
+
+## Global Constraints
+
+- Node 22 for the jsdom test run (`platform/ui` requirement).
+- Switcher availability gate is exactly `subAccounts.length > 1 && Boolean(onSwitchAccount)`; unchanged from today.
+- No new task-id leaks in shipped docs; docs edit at `platform/plugins/docs/references/admin-ui.md`.
+- All paths below are relative to the worktree's `maxy-code/platform/ui/`.
+
+---
+
+### Task 1: Strip the switcher out of AccountMenu
+
+**Files:**
+- Modify: `app/components/AccountMenu.tsx`
+- Test: `app/components/__tests__/AccountMenu.test.tsx`
+
+**Interfaces:**
+- Produces: `AccountMenuProps` with no `subAccounts`/`activeAccountId`/`switchingAccount`/`onSwitchAccount`/`refreshAccounts` fields.
+
+- [ ] **Step 1: Update the test to assert the switcher is gone**
+
+In `AccountMenu.test.tsx`, delete the two switcher tests (`renders no Switch account affordance with 0-1 sub-accounts` and `opens the sub-account picker and fires onSwitchAccount + refreshAccounts`, lines 56-88). Add one test:
+
+```tsx
+it('renders no Switch account affordance (relocated to sidebar brand head, Task 1942)', () => {
+  render(<AccountMenu {...baseProps} variant="admin" cacheKey="k" onOpenConversations={vi.fn()} />)
+  expect(screen.queryByRole('menuitem', { name: /switch account/i })).toBeNull()
+  expect(screen.queryByPlaceholderText(/search sub-accounts/i)).toBeNull()
+})
+```
+
+Remove `subAccounts`/`activeAccountId`/`switchingAccount`/`onSwitchAccount`/`refreshAccounts` from any remaining render in the file.
+
+- [ ] **Step 2: Run — expect fail (props still typed / item still renders)**
+
+Run: `npx vitest run app/components/__tests__/AccountMenu.test.tsx`
+Expected: FAIL (the Switch account menuitem still renders).
+
+- [ ] **Step 3: Remove the switcher from AccountMenu.tsx**
+
+- Delete the `import { SubAccountPicker } from './SubAccountPicker'` line.
+- In `AccountMenuProps`, delete the five switcher prop declarations and their doc comment block (`subAccounts?`, `activeAccountId?`, `switchingAccount?`, `onSwitchAccount?`, `refreshAccounts?`).
+- In the destructure, remove `subAccounts = []`, `activeAccountId = null`, `switchingAccount = false`, `onSwitchAccount`, `refreshAccounts`.
+- Delete the `switcherOpen` state and `switcherAvailable` const.
+- Delete the whole `{switcherAvailable && ( … <SubAccountPicker … /> … )}` JSX block.
+- Remove `UserRound` from the lucide-react import (it was used only by the deleted block; grep the file to confirm no other use).
+
+- [ ] **Step 4: Run — expect pass**
+
+Run: `npx vitest run app/components/__tests__/AccountMenu.test.tsx`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add maxy-code/platform/ui/app/components/AccountMenu.tsx maxy-code/platform/ui/app/components/__tests__/AccountMenu.test.tsx
+git commit -m "refactor(1942): remove sub-account switcher from AccountMenu"
+```
+
+---
+
+### Task 2: Brand head becomes the switcher trigger in Sidebar
+
+**Files:**
+- Modify: `app/Sidebar.tsx`
+- Test: `app/__tests__/Sidebar-subaccount-switcher.test.tsx` (create), `app/__tests__/Sidebar-user-footer.test.tsx`
+
+**Interfaces:**
+- Consumes: `SubAccountPicker` from `./components/SubAccountPicker`; `ChevronDown` from `lucide-react`; existing `subAccounts`/`activeAccountId`/`switchingAccount`/`onSwitchAccount`/`refreshAccounts` Sidebar props.
+
+- [ ] **Step 1: Write the failing test (new file)**
+
+Create `app/__tests__/Sidebar-subaccount-switcher.test.tsx`:
+
+```tsx
+import React from 'react'
+import { render, screen, fireEvent } from '@testing-library/react'
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { Sidebar } from '../Sidebar'
+
+function jsonResponse(body: unknown, status = 200): Response {
+  return new Response(JSON.stringify(body), { status, headers: { 'content-type': 'application/json' } }) as Response
+}
+function routedFetch() {
+  return vi.spyOn(global, 'fetch').mockImplementation((input: RequestInfo | URL) => {
+    const url = typeof input === 'string' ? input : input.toString()
+    if (url.includes('/api/admin/sidebar-sessions')) return Promise.resolve(jsonResponse({ accountId: 'acct', sessions: [] }))
+    if (url.includes('/api/admin/system-stats')) return Promise.resolve(jsonResponse({ cpuPct: null, memUsedPct: 0.5, platform: 'darwin' }))
+    if (url.includes('/api/admin/version')) return Promise.resolve(jsonResponse({ installed: '1.0.0', latest: null, updateAvailable: false }))
+    return Promise.resolve(jsonResponse({}, 404))
+  })
+}
+const ACCOUNTS = [
+  { accountId: 'a1', businessName: 'House', role: 'admin', isHouse: true },
+  { accountId: 'a2', businessName: 'Client', role: 'admin', isHouse: false },
+]
+function baseProps(over: Record<string, unknown> = {}) {
+  return {
+    businessName: 'House', cacheKey: 'k', role: 'admin', userName: 'Ada Ops', userAvatar: null,
+    onSelectProjects: vi.fn(), onSelectTasks: vi.fn(), onCloseMobileDrawer: vi.fn(),
+    collapsed: false, mobileDrawerOpen: false, onSelectData: vi.fn(),
+    onLogout: vi.fn(), onDisconnect: vi.fn(async () => true), disconnecting: false, claudeConnected: true,
+    ...over,
+  }
+}
+beforeEach(() => { Object.defineProperty(document, 'hidden', { value: false, configurable: true }) })
+afterEach(() => { vi.restoreAllMocks() })
+
+describe('Sidebar sub-account switcher on the brand head (Task 1942)', () => {
+  it('brand head is a button that toggles the picker and fires refreshAccounts', () => {
+    routedFetch()
+    const refreshAccounts = vi.fn()
+    render(<Sidebar {...baseProps({ subAccounts: ACCOUNTS, activeAccountId: 'a1', switchingAccount: false, onSwitchAccount: vi.fn(), refreshAccounts })} />)
+    const head = screen.getByRole('button', { name: /switch sub-account/i })
+    expect(screen.queryByPlaceholderText(/search sub-accounts/i)).toBeNull()
+    fireEvent.click(head)
+    expect(screen.getByPlaceholderText(/search sub-accounts/i)).toBeInTheDocument()
+    expect(refreshAccounts).toHaveBeenCalledTimes(1)
+    fireEvent.click(head)
+    expect(screen.queryByPlaceholderText(/search sub-accounts/i)).toBeNull()
+  })
+
+  it('selecting a card calls onSwitchAccount and closes the picker', () => {
+    routedFetch()
+    const onSwitchAccount = vi.fn()
+    render(<Sidebar {...baseProps({ subAccounts: ACCOUNTS, activeAccountId: 'a1', switchingAccount: false, onSwitchAccount, refreshAccounts: vi.fn() })} />)
+    fireEvent.click(screen.getByRole('button', { name: /switch sub-account/i }))
+    fireEvent.click(screen.getByRole('button', { name: 'Client' }))
+    expect(onSwitchAccount).toHaveBeenCalledWith('a2')
+    expect(screen.queryByPlaceholderText(/search sub-accounts/i)).toBeNull()
+  })
+
+  it('single-account install: brand head is not a switcher button and no picker mounts', () => {
+    routedFetch()
+    render(<Sidebar {...baseProps({ subAccounts: [ACCOUNTS[0]], activeAccountId: 'a1', onSwitchAccount: vi.fn() })} />)
+    expect(screen.queryByRole('button', { name: /switch sub-account/i })).toBeNull()
+    expect(screen.queryByPlaceholderText(/search sub-accounts/i)).toBeNull()
+  })
+})
+```
+
+- [ ] **Step 2: Run — expect fail**
+
+Run: `npx vitest run app/__tests__/Sidebar-subaccount-switcher.test.tsx`
+Expected: FAIL (no button named "Switch sub-account").
+
+- [ ] **Step 3: Implement the trigger in Sidebar.tsx**
+
+Add imports: `SubAccountPicker` from `'./components/SubAccountPicker'`, and `ChevronDown` to the existing `lucide-react` import.
+
+Add state beside `footerMenuOpen`:
+
+```tsx
+const [switcherOpen, setSwitcherOpen] = useState(false)
+const switcherAvailable = (subAccounts?.length ?? 0) > 1 && Boolean(onSwitchAccount)
+```
+
+Replace the `<div className="side-brand">…</div>` block (icon + lockup) with:
+
+```tsx
+<div className="side-brand">
+  {switcherAvailable ? (
+    <button
+      type="button"
+      className="side-brand-trigger"
+      aria-haspopup="menu"
+      aria-expanded={switcherOpen}
+      aria-label="Switch sub-account"
+      onClick={() => {
+        const opening = !switcherOpen
+        setSwitcherOpen(opening)
+        if (opening) refreshAccounts?.()
+        console.info(`[admin-ui] op=subaccount-switcher-toggle anchor=brand-head open=${opening} available=true accounts=${subAccounts?.length ?? 0}`)
+      }}
+    >
+      <img className="side-brand-icon" src={brandIcon} alt="" aria-hidden="true" />
+      <span className="side-brand-lockup">
+        <span className="side-brand-business">{displayName}</span>
+        <span className="side-brand-product">{brand.productName}</span>
+      </span>
+      <ChevronDown size={14} className="side-brand-caret" aria-hidden="true" />
+    </button>
+  ) : (
+    <>
+      <img className="side-brand-icon" src={brandIcon} alt="" aria-hidden="true" />
+      <span className="side-brand-lockup">
+        <span className="side-brand-business">{displayName}</span>
+        <span className="side-brand-product">{brand.productName}</span>
+      </span>
+    </>
+  )}
+  {switcherOpen && (
+    <>
+      <div className="side-brand-scrim" aria-hidden="true" onClick={() => setSwitcherOpen(false)} />
+      <SubAccountPicker
+        open={switcherOpen}
+        accounts={subAccounts ?? []}
+        activeAccountId={activeAccountId ?? null}
+        switching={switchingAccount ?? false}
+        onSelect={(accountId) => onSwitchAccount?.(accountId)}
+        onClose={() => setSwitcherOpen(false)}
+      />
+    </>
+  )}
+</div>
+```
+
+In the footer `<AccountMenu … />`, delete the five props `subAccounts`, `activeAccountId`, `switchingAccount`, `onSwitchAccount`, `refreshAccounts` (the Sidebar keeps consuming them for the head). Leave `onOpenConversations` and the rest.
+
+- [ ] **Step 4: Run — expect pass**
+
+Run: `npx vitest run app/__tests__/Sidebar-subaccount-switcher.test.tsx`
+Expected: PASS.
+
+- [ ] **Step 5: Fix the footer test that asserted the switcher was in the kebab**
+
+In `app/__tests__/Sidebar-user-footer.test.tsx`, the test `threads the sub-account switcher and Conversations into the kebab menu` (lines 53-75) now asserts a false thing. Rewrite it to cover Conversations only:
+
+```tsx
+it('threads Conversations into the kebab menu (switcher moved to brand head, Task 1942)', async () => {
+  routedFetch({ cpuPct: null, memUsedPct: 0.5, platform: 'darwin' })
+  const onOpenConversations = vi.fn()
+  render(<Sidebar {...baseProps({ onOpenConversations })} />)
+  fireEvent.click(screen.getByRole('button', { name: 'Account menu' }))
+  expect(screen.queryByRole('menuitem', { name: /switch account/i })).toBeNull()
+  fireEvent.click(await screen.findByRole('menuitem', { name: /conversations/i }))
+  expect(onOpenConversations).toHaveBeenCalledTimes(1)
+})
+```
+
+- [ ] **Step 6: Run both Sidebar suites — expect pass**
+
+Run: `npx vitest run app/__tests__/Sidebar-subaccount-switcher.test.tsx app/__tests__/Sidebar-user-footer.test.tsx`
+Expected: PASS.
+
+- [ ] **Step 7: Commit**
+
+```bash
+git add maxy-code/platform/ui/app/Sidebar.tsx maxy-code/platform/ui/app/__tests__/Sidebar-subaccount-switcher.test.tsx maxy-code/platform/ui/app/__tests__/Sidebar-user-footer.test.tsx
+git commit -m "feat(1942): brand head opens the sub-account picker"
+```
+
+---
+
+### Task 3: CSS — anchor the panel under the head, style the trigger, drop dead overrides
+
+**Files:**
+- Modify: `app/globals.css`
+
+**Interfaces:** consumes class names `side-brand`, `side-brand-trigger`, `side-brand-caret`, `side-brand-scrim`, `sub-account-picker-panel` from Task 2.
+
+- [ ] **Step 1: Add `position: relative` to `.side-brand`**
+
+In the `.side-brand { … }` rule, add `position: relative;`.
+
+- [ ] **Step 2: Add the trigger, caret, and scrim rules** (place beside `.side-brand`)
+
+```css
+.side-brand-trigger {
+  display: flex; align-items: center; gap: 10px; flex: 1; min-width: 0;
+  background: none; border: 0; padding: 0; margin: 0;
+  font: inherit; color: inherit; text-align: left; cursor: pointer;
+}
+.side-brand-caret { flex: none; color: var(--text-tertiary); }
+.side-brand-trigger:hover .side-brand-caret { color: var(--text-secondary); }
+.platform.sidebar-collapsed .side-brand-caret { display: none; }
+.side-brand-scrim { position: fixed; inset: 0; z-index: 40; }
+.platform.sidebar-collapsed .side-brand-scrim { display: none; }
+```
+
+- [ ] **Step 3: Re-anchor `.sub-account-picker-panel` under the head**
+
+The brand head is now the only consumer. In `.sub-account-picker-panel`, remove `left: 50%;` and `transform: translateX(-50%);`, remove the `min-width` (if present), and set `left: 0; right: 0; margin-top: 8px; z-index: 41;` so the panel spans the head's inner width and sits above the scrim.
+
+- [ ] **Step 4: Delete the dead footer overrides**
+
+Delete the `.side-foot-menu .sub-account-picker-panel { … }` and `.side-foot-menu .sub-account-picker-list { … }` rules and the comment above them that describes the footer kebab anchoring.
+
+- [ ] **Step 5: Run the class-name CSS gate + the switcher suites**
+
+Run: `npm run -s check:classname-css 2>/dev/null || node scripts/check-classname-css.mjs`
+Then: `npx vitest run app/__tests__/Sidebar-subaccount-switcher.test.tsx`
+Expected: gate clean; tests PASS.
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add maxy-code/platform/ui/app/globals.css
+git commit -m "style(1942): anchor sub-account picker under the sidebar brand head"
+```
+
+---
+
+### Task 4: Docs
+
+**Files:**
+- Modify: `platform/plugins/docs/references/admin-ui.md`
+
+- [ ] **Step 1: Update the switcher location**
+
+Find the passage describing the sub-account switcher opening from the footer kebab / user-footer AccountMenu. Rewrite it to state the switcher opens by clicking the sidebar brand head (the account name), with the picker dropping beneath it; note the footer kebab no longer carries it. Keep it to the existing register; no task-id string in the shipped doc.
+
+- [ ] **Step 2: Commit**
+
+```bash
+git add maxy-code/platform/plugins/docs/references/admin-ui.md
+git commit -m "docs(1942): sub-account switcher now opens from the sidebar brand head"
+```
+
+## Self-Review
+
+- **Spec coverage:** brand-head trigger (T2), whole-head + chevron + scrim decisions (T2/T3), AccountMenu strip (T1), CSS re-anchor + dead-override delete (T3), observability toggle log (T2 Step 3), docs (T4), test updates incl. the footer-test fix (T2 Step 5). All spec items mapped.
+- **Placeholder scan:** none; every code step shows code.
+- **Type consistency:** `SubAccountPicker` prop names (`open`, `accounts`, `activeAccountId`, `switching`, `onSelect`, `onClose`) match its component signature; Sidebar prop names match the existing signature.
+
+## Known follow-ups
+
+None at plan time. Any code-review finding out of scope is filed as a new `.tasks/` file per the sprint rules.

package/payload/platform/docs/superpowers/specs/2026-07-24-task-1942-subaccount-switcher-brand-head-design.md

@@ -0,0 +1,35 @@
+# Task 1942 — Sub-account switcher moves to the sidebar brand head
+
+Design doc. Source task: `.tasks/1942-subaccount-switcher-moves-to-sidebar-brand-head.md`.
+
+## Goal
+
+Open the sub-account picker by clicking the account name at the top of the sidebar, not from the footer kebab. Remove the switcher from the footer menu.
+
+## Resolved decisions (brainstorm)
+
+1. **Click target:** the whole brand head (`side-brand`: icon + two-line lockup) becomes one button when the switcher is available.
+2. **Affordance:** a small down-chevron renders after the business name to signal the dropdown.
+3. **Close:** re-clicking the head toggles it shut, and a transparent full-screen scrim behind the panel closes it on any outside click. Mirrors the footer-menu scrim it replaces.
+
+## Availability gate (unchanged from today)
+
+Switcher is available only when `subAccounts.length > 1 && Boolean(onSwitchAccount)`. Unavailable → the head stays a plain non-interactive `<div>`, no chevron, no picker. This is the current `switcherAvailable` gate, moved from `AccountMenu` to `Sidebar`.
+
+## Components and flow
+
+- **`Sidebar.tsx`** owns `switcherOpen` state. The brand head renders as `<button aria-haspopup="menu" aria-expanded={switcherOpen}>` when available, else the current `<div>`. Click toggles `switcherOpen`; the closed→open transition fires `refreshAccounts?.()` and emits `[admin-ui] op=subaccount-switcher-toggle anchor=brand-head open=<bool> available=<bool> accounts=<N>`. `SubAccountPicker` renders inside `.side-brand`, anchored beneath it, with a sibling scrim that closes on click.
+- **`AccountMenu.tsx`** loses the `switcherAvailable`/`switcherOpen` block, the `SubAccountPicker` import, and the five switcher props. `UserRound` import dropped if otherwise unused.
+- **`globals.css`** gives `.side-brand` `position: relative` and re-anchors `.sub-account-picker-panel` left-aligned under the head (drop the retired header-title `translateX(-50%)` centering). Adds `.side-brand` button-reset styling (transparent, inherit, pointer) and the chevron. Deletes the dead `.side-foot-menu .sub-account-picker-panel` / `-list` overrides.
+
+## Collapsed rail (edge, in scope to not break)
+
+When `sidebar-collapsed`, existing CSS hides `.side-brand-lockup` (name + chevron), leaving only the icon. The head-button still functions on the icon, but no new collapsed affordance is added (per task out-of-scope). The picker anchors under `.side-brand` in both states.
+
+## Testing
+
+vitest + jsdom (Node 22). New `Sidebar` test: available → head is a button, click mounts the picker and fires `refreshAccounts`, re-click closes; unavailable → not a button, no picker. `AccountMenu.test.tsx`: no "Switch account", switcher props dropped. `SubAccountPicker.test.tsx` unchanged.
+
+## Out of scope
+
+`SubAccountPicker` internals, the switch mechanism, other `AccountMenu` items, a dedicated collapsed-rail affordance, maxy-lite, Task 1940's mobile lite tab bar.

package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: platform-architecture
 description: Use when grounding any documented-surface claim about what Maxy ships — plugins, skills, specialists, install/deploy flows, internals. This is the install catalogue, not evidence of what is enabled on the current account. For install state on this account, call `capabilities-here`; for documented surface, cite the `Source:` URL inline.
-content-hash: sha256:019a4f941c1466cfb0a9490c7c92f2eccbba4e67e57df48ddcb28f7b1ef5d835
+content-hash: sha256:5db8891dfc1b60b2180597591dcad1b7ca9e89612f488314dd07e7dd73e5c119
 brand: maxy-code
 product-name: Maxy
 ---
@@ -2123,6 +2123,7 @@ The `outlook` plugin gives the admin agent access to Microsoft 365 / Outlook.com
 | `outlook-mail-attachment` | List or download any message's attachments — received or draft. With `messageId` alone, LISTS them (`id`, `name`, `contentType`, `size`, `isInline`, and a `kind` of file/item/reference) via `GET /me/messages/{id}/attachments` and `$select` (no bytes). A draft is a message in the same collection, so passing a draftId lists what that draft carries; the returned `name`/`id` is what `outlook-draft-edit`'s `removeAttachments` takes. With `messageId`+`attachmentId`, DOWNLOADS one file attachment: its bytes are written to `{accountDir}/uploads/outlook/<messageHash>/<bytesHash>-<name>` at `0o600` and the saved path is returned, ready for the Read tool, `SendUserFile`, or an `outlook-mail-reply` attachment. Only file attachments download — item/reference kinds, empty payloads, and anything over 25 MB are refused with nothing written. `outlook-mail-list` / `outlook-mail-search` / `outlook-mail-fetch-body` report `hasAttachments` so the agent knows when to call this. Needs `Mail.Read`. |
 | `outlook-mail-reply` | Reply in-thread (`createReply` / `createReplyAll` + send). Threads natively via conversationId. `replyAll`, added cc/bcc, and account-scoped file attachments (up to 25 MB per file; files over Graph's ~3 MB inline limit use a chunked upload session). Body is plain text, prepended above the quote. Needs `Mail.ReadWrite` + `Mail.Send`. |
 | `outlook-mail-delete` | Move messages to Deleted Items (`POST /me/messages/{id}/move`). Recoverable — never hard-deletes. An id already gone is counted not-moved. Needs `Mail.ReadWrite`. |
+| `outlook-mail-ingest` | Write operator-reviewed messages into the business graph as `:ConversationArchive {source:'email'}` threads (the analogue of the IMAP `email-ingest`). Input `decisions`: one `{messageId, disposition:'ingest'\|'discard'}` per listed message. Each `ingest` message's full body + envelope is fetched, threads group by Graph `conversationId`, and participants resolve closed-set against Neo4j (`:Person`/`:AdminUser` by `accountId`); an unresolved From/To/Cc address skips its whole thread and is returned to the operator (no `:Person` auto-create). Resolvable threads dispatch through the shared `conversation-archive-ingest.sh --source email`. Human-in-the-loop: nothing lands without an explicit per-message decision. The plugin's only Neo4j coupling. Needs `Mail.Read`. |
 | `outlook-mail-otp-extract` | Poll the inbox for a one-time code from a sender (domain). Reads full bodies to extract it; optional subject regex and timeout (default 60 s). |
 | `outlook-calendar-list` | Calendar events in next rangeDays days (default 7, max 365). |
 | `outlook-calendar-event` | Full detail of a single event by id. |
@@ -2159,6 +2160,9 @@ All log lines start with `[outlook-mcp]` and write to `server.log`. They are key
 | Refresh failed | `token-refresh-failed account=<id> reason=<err>` (terminal) |
 | Mail list | `mail-list op=resolve account=<id> folderIn=<name> folderResolved=<token> asRawId=<bool> count=<N> elapsedMs=<N>` (on error, `error=<msg>` replaces `count`) |
 | Mail search | `mail-search account=<id> query=<trunc-32> count=<N> elapsedMs=<N>` |
+| Mail ingest (per message) | `mail-ingest op=ingest id=<id> conversationId=<id> disposition=ingest` |
+| Mail ingest (per thread) | `mail-ingest op=thread-dispatched root=<key> messages=<N> participants=<N>` (or `op=thread-failed root=<key> status=<N> err=<msg>`; `status=null` with a non-`none` `err` is a spawn launch failure, not a script rejection) |
+| Mail ingest (summary) | `mail-ingest op=summary ingested=<N> discarded=<N> threadsDispatched=<N> threadsSkipped=<N> unresolved=<N>` — one per call; `threadsSkipped` with `unresolved>0` is the closed-set resolution refusing an unknown participant, not a failure |
 | Calendar list | `calendar-list account=<id> rangeDays=<N> count=<N> elapsedMs=<N>` |
 | Calendar event | `calendar-event account=<id> eventId=<trunc-12> elapsedMs=<N>` |
 | Event created | `cal-create-request account=<id> subj=<trunc-64>` then `event-created account=<id> eventId=<trunc-16> status=201`. A non-201 logs `event-create-failed ... status=<N>` and throws. A 201 whose body carried no readable id logs `event-created-id-unknown account=<id> status=201` and returns a created-but-id-unknown result (the event exists; do not retry) rather than a failure. |
@@ -2218,7 +2222,7 @@ Latency triage: `mail-list count=0 elapsedMs<200` consistent → permissions iss
 
 ## Out of scope
 
-Mail move to arbitrary folders / flag, hard (permanent) delete, removing an attachment from a **sent** message (Graph forbids it), ingesting reviewed mail into the business graph (the `email-ingest` analogue), contacts write, recurring-series occurrence editing, the `scheduling` Neo4j calendar and any auto-sync with it, OneDrive / Files, push notifications, on-premises Exchange, M365 admin scopes (`User.Read.All`, `AuditLog.Read.All`), public-agent exposure, multi-tenant federation. Mail read, full-body read, inbound attachment list/download, reply, delete (to Deleted Items), and compose — all four outbound paths carrying attachments, with a draft's attachments editable in place (add, remove, replace) — are supported (`outlook-mail-fetch-body`, `outlook-mail-attachment`, `outlook-mail-reply`, `outlook-mail-delete`, `outlook-mail-otp-extract`, `outlook-mail-send`, `outlook-draft`, `outlook-draft-edit`, `outlook-draft-send`), and the calendar is read plus control. See `platform/plugins/outlook/PLUGIN.md` for the full out-of-scope list.
+Mail move to arbitrary folders / flag, hard (permanent) delete, removing an attachment from a **sent** message (Graph forbids it), attachment-byte archival into the graph (`outlook-mail-ingest` lands text threads only; the IMAP `:DigitalDocument` archival is a separate concern), contacts write, recurring-series occurrence editing, the `scheduling` Neo4j calendar and any auto-sync with it, OneDrive / Files, push notifications, on-premises Exchange, M365 admin scopes (`User.Read.All`, `AuditLog.Read.All`), public-agent exposure, multi-tenant federation. Mail read, full-body read, inbound attachment list/download, reply, delete (to Deleted Items), and compose — all four outbound paths carrying attachments, with a draft's attachments editable in place (add, remove, replace) — are supported (`outlook-mail-fetch-body`, `outlook-mail-attachment`, `outlook-mail-reply`, `outlook-mail-delete`, `outlook-mail-ingest`, `outlook-mail-otp-extract`, `outlook-mail-send`, `outlook-draft`, `outlook-draft-edit`, `outlook-draft-send`), and the calendar is read plus control. See `platform/plugins/outlook/PLUGIN.md` for the full out-of-scope list.
 
 ---
 # Google Calendar
@@ -3312,10 +3316,20 @@ authoritative. This section names the surfaces and what backs each.
 >   the sidebar collapse toggle, the page title, and a Claude status pill on the
 >   right (Connected / Connect, driven by `/api/health`). The pill replaces the
 >   retired burger Disconnect visibility and footer strip.
-> - **Account kebab.** The version / Connect-Disconnect / Change PIN / Switch
->   account / Log out items moved from the burger onto a kebab on the sidebar user
->   footer (`AccountMenu`, extracted from the old `HeaderMenu`; the operator
->   variant still mounts `AccountMenu` for its reduced set).
+> - **Account kebab.** The version / Connect-Disconnect / Change PIN / Log out
+>   items moved from the burger onto a kebab on the sidebar user footer
+>   (`AccountMenu`, extracted from the old `HeaderMenu`; the operator variant
+>   still mounts `AccountMenu` for its reduced set).
+> - **Sub-account switcher on the brand head.** The head at the top of the sidebar
+>   splits into two controls when the install has more than one sub-account: the
+>   brand icon jumps straight to the house account, and the name plus chevron
+>   opens the `SubAccountPicker` directly beneath the head (an outside click or a
+>   second click on the name closes it). Clicking the icon while already on the
+>   house account does nothing. A single-account install shows the same head as a
+>   plain, non-interactive lockup, and the collapsed rail hides both controls. The
+>   switcher used to sit in the account kebab; it no longer does. The switch
+>   navigation itself (`useSubAccountSwitcher`, dropping the `?session=` param) is
+>   unchanged.
 > - **Mobile (< 720px).** The sidebar opens as a drawer from a 44x44 header menu
 >   button, and a fixed bottom tab bar (Home, Chat, Tasks, Data, Calendar) sits
 >   under the content; Graph, Activity, and Browser stay reachable through the

package/payload/platform/plugins/docs/references/admin-ui.md

@@ -411,10 +411,20 @@ authoritative. This section names the surfaces and what backs each.
 >   the sidebar collapse toggle, the page title, and a Claude status pill on the
 >   right (Connected / Connect, driven by `/api/health`). The pill replaces the
 >   retired burger Disconnect visibility and footer strip.
-> - **Account kebab.** The version / Connect-Disconnect / Change PIN / Switch
->   account / Log out items moved from the burger onto a kebab on the sidebar user
->   footer (`AccountMenu`, extracted from the old `HeaderMenu`; the operator
->   variant still mounts `AccountMenu` for its reduced set).
+> - **Account kebab.** The version / Connect-Disconnect / Change PIN / Log out
+>   items moved from the burger onto a kebab on the sidebar user footer
+>   (`AccountMenu`, extracted from the old `HeaderMenu`; the operator variant
+>   still mounts `AccountMenu` for its reduced set).
+> - **Sub-account switcher on the brand head.** The head at the top of the sidebar
+>   splits into two controls when the install has more than one sub-account: the
+>   brand icon jumps straight to the house account, and the name plus chevron
+>   opens the `SubAccountPicker` directly beneath the head (an outside click or a
+>   second click on the name closes it). Clicking the icon while already on the
+>   house account does nothing. A single-account install shows the same head as a
+>   plain, non-interactive lockup, and the collapsed rail hides both controls. The
+>   switcher used to sit in the account kebab; it no longer does. The switch
+>   navigation itself (`useSubAccountSwitcher`, dropping the `?session=` param) is
+>   unchanged.
 > - **Mobile (< 720px).** The sidebar opens as a drawer from a 44x44 header menu
 >   button, and a fixed bottom tab bar (Home, Chat, Tasks, Data, Calendar) sits
 >   under the content; Graph, Activity, and Browser stay reachable through the

package/payload/platform/plugins/docs/references/outlook-guide.md

@@ -22,6 +22,7 @@ The `outlook` plugin gives the admin agent access to Microsoft 365 / Outlook.com
 | `outlook-mail-attachment` | List or download any message's attachments — received or draft. With `messageId` alone, LISTS them (`id`, `name`, `contentType`, `size`, `isInline`, and a `kind` of file/item/reference) via `GET /me/messages/{id}/attachments` and `$select` (no bytes). A draft is a message in the same collection, so passing a draftId lists what that draft carries; the returned `name`/`id` is what `outlook-draft-edit`'s `removeAttachments` takes. With `messageId`+`attachmentId`, DOWNLOADS one file attachment: its bytes are written to `{accountDir}/uploads/outlook/<messageHash>/<bytesHash>-<name>` at `0o600` and the saved path is returned, ready for the Read tool, `SendUserFile`, or an `outlook-mail-reply` attachment. Only file attachments download — item/reference kinds, empty payloads, and anything over 25 MB are refused with nothing written. `outlook-mail-list` / `outlook-mail-search` / `outlook-mail-fetch-body` report `hasAttachments` so the agent knows when to call this. Needs `Mail.Read`. |
 | `outlook-mail-reply` | Reply in-thread (`createReply` / `createReplyAll` + send). Threads natively via conversationId. `replyAll`, added cc/bcc, and account-scoped file attachments (up to 25 MB per file; files over Graph's ~3 MB inline limit use a chunked upload session). Body is plain text, prepended above the quote. Needs `Mail.ReadWrite` + `Mail.Send`. |
 | `outlook-mail-delete` | Move messages to Deleted Items (`POST /me/messages/{id}/move`). Recoverable — never hard-deletes. An id already gone is counted not-moved. Needs `Mail.ReadWrite`. |
+| `outlook-mail-ingest` | Write operator-reviewed messages into the business graph as `:ConversationArchive {source:'email'}` threads (the analogue of the IMAP `email-ingest`). Input `decisions`: one `{messageId, disposition:'ingest'\|'discard'}` per listed message. Each `ingest` message's full body + envelope is fetched, threads group by Graph `conversationId`, and participants resolve closed-set against Neo4j (`:Person`/`:AdminUser` by `accountId`); an unresolved From/To/Cc address skips its whole thread and is returned to the operator (no `:Person` auto-create). Resolvable threads dispatch through the shared `conversation-archive-ingest.sh --source email`. Human-in-the-loop: nothing lands without an explicit per-message decision. The plugin's only Neo4j coupling. Needs `Mail.Read`. |
 | `outlook-mail-otp-extract` | Poll the inbox for a one-time code from a sender (domain). Reads full bodies to extract it; optional subject regex and timeout (default 60 s). |
 | `outlook-calendar-list` | Calendar events in next rangeDays days (default 7, max 365). |
 | `outlook-calendar-event` | Full detail of a single event by id. |
@@ -58,6 +59,9 @@ All log lines start with `[outlook-mcp]` and write to `server.log`. They are key
 | Refresh failed | `token-refresh-failed account=<id> reason=<err>` (terminal) |
 | Mail list | `mail-list op=resolve account=<id> folderIn=<name> folderResolved=<token> asRawId=<bool> count=<N> elapsedMs=<N>` (on error, `error=<msg>` replaces `count`) |
 | Mail search | `mail-search account=<id> query=<trunc-32> count=<N> elapsedMs=<N>` |
+| Mail ingest (per message) | `mail-ingest op=ingest id=<id> conversationId=<id> disposition=ingest` |
+| Mail ingest (per thread) | `mail-ingest op=thread-dispatched root=<key> messages=<N> participants=<N>` (or `op=thread-failed root=<key> status=<N> err=<msg>`; `status=null` with a non-`none` `err` is a spawn launch failure, not a script rejection) |
+| Mail ingest (summary) | `mail-ingest op=summary ingested=<N> discarded=<N> threadsDispatched=<N> threadsSkipped=<N> unresolved=<N>` — one per call; `threadsSkipped` with `unresolved>0` is the closed-set resolution refusing an unknown participant, not a failure |
 | Calendar list | `calendar-list account=<id> rangeDays=<N> count=<N> elapsedMs=<N>` |
 | Calendar event | `calendar-event account=<id> eventId=<trunc-12> elapsedMs=<N>` |
 | Event created | `cal-create-request account=<id> subj=<trunc-64>` then `event-created account=<id> eventId=<trunc-16> status=201`. A non-201 logs `event-create-failed ... status=<N>` and throws. A 201 whose body carried no readable id logs `event-created-id-unknown account=<id> status=201` and returns a created-but-id-unknown result (the event exists; do not retry) rather than a failure. |
@@ -117,4 +121,4 @@ Latency triage: `mail-list count=0 elapsedMs<200` consistent → permissions iss
 
 ## Out of scope
 
-Mail move to arbitrary folders / flag, hard (permanent) delete, removing an attachment from a **sent** message (Graph forbids it), ingesting reviewed mail into the business graph (the `email-ingest` analogue), contacts write, recurring-series occurrence editing, the `scheduling` Neo4j calendar and any auto-sync with it, OneDrive / Files, push notifications, on-premises Exchange, M365 admin scopes (`User.Read.All`, `AuditLog.Read.All`), public-agent exposure, multi-tenant federation. Mail read, full-body read, inbound attachment list/download, reply, delete (to Deleted Items), and compose — all four outbound paths carrying attachments, with a draft's attachments editable in place (add, remove, replace) — are supported (`outlook-mail-fetch-body`, `outlook-mail-attachment`, `outlook-mail-reply`, `outlook-mail-delete`, `outlook-mail-otp-extract`, `outlook-mail-send`, `outlook-draft`, `outlook-draft-edit`, `outlook-draft-send`), and the calendar is read plus control. See `platform/plugins/outlook/PLUGIN.md` for the full out-of-scope list.
+Mail move to arbitrary folders / flag, hard (permanent) delete, removing an attachment from a **sent** message (Graph forbids it), attachment-byte archival into the graph (`outlook-mail-ingest` lands text threads only; the IMAP `:DigitalDocument` archival is a separate concern), contacts write, recurring-series occurrence editing, the `scheduling` Neo4j calendar and any auto-sync with it, OneDrive / Files, push notifications, on-premises Exchange, M365 admin scopes (`User.Read.All`, `AuditLog.Read.All`), public-agent exposure, multi-tenant federation. Mail read, full-body read, inbound attachment list/download, reply, delete (to Deleted Items), and compose — all four outbound paths carrying attachments, with a draft's attachments editable in place (add, remove, replace) — are supported (`outlook-mail-fetch-body`, `outlook-mail-attachment`, `outlook-mail-reply`, `outlook-mail-delete`, `outlook-mail-ingest`, `outlook-mail-otp-extract`, `outlook-mail-send`, `outlook-draft`, `outlook-draft-edit`, `outlook-draft-send`), and the calendar is read plus control. See `platform/plugins/outlook/PLUGIN.md` for the full out-of-scope list.

package/payload/platform/plugins/outlook/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "outlook",
-  "description": "Microsoft 365 / Outlook.com via Microsoft Graph. Mail is read (list, search, full-body), reply, delete, and compose (draft, draft-edit, send); contacts are read-only; calendar is read + control. Per-account OAuth device-code flow; no client secret. One account can hold several mailboxes at once; every operational tool takes an optional mailbox selector (email or graphUserId) and refuses ambiguously when two or more are attached and none is named. Tools — outlook-account-register / outlook-account-register-poll: device-code register (start + poll); outlook-mail-list / outlook-mail-search: inbox triage (~255-char preview) with a date window (list) or KQL from:/subject: filters (search) and a nextCursor for paging beyond the newest page; outlook-mail-fetch-body: full body of one message by id; outlook-mail-attachment: list any message's attachments (received or draft), or download one file attachment's bytes to the account uploads folder; outlook-mail-reply: in-thread reply (replyAll, cc/bcc, attachments); outlook-mail-delete: move to Deleted Items (recoverable); outlook-mail-otp-extract: poll for a one-time code; outlook-mail-send / outlook-draft / outlook-draft-edit / outlook-draft-send: compose, edit, and send, all with attachments — outlook-draft takes an optional replyToMessageId to draft a threaded reply, unsent, under the original conversation; outlook-calendar-list / outlook-calendar-event: read calendar; outlook-calendar-create / outlook-calendar-update / outlook-calendar-cancel / outlook-calendar-respond / outlook-calendar-freebusy: control calendar; outlook-contacts-list: contacts; outlook-mailbox-info: auth state + folder count for one mailbox; outlook-mailbox-list: every connected mailbox.",
+  "description": "Microsoft 365 / Outlook.com via Microsoft Graph. Mail is read (list, search, full-body), reply, delete, and compose (draft, draft-edit, send); contacts are read-only; calendar is read + control. Per-account OAuth device-code flow; no client secret. One account can hold several mailboxes at once; every operational tool takes an optional mailbox selector (email or graphUserId) and refuses ambiguously when two or more are attached and none is named. Tools — outlook-account-register / outlook-account-register-poll: device-code register (start + poll); outlook-mail-list / outlook-mail-search: inbox triage (~255-char preview) with a date window (list) or KQL from:/subject: filters (search) and a nextCursor for paging beyond the newest page; outlook-mail-fetch-body: full body of one message by id; outlook-mail-attachment: list any message's attachments (received or draft), or download one file attachment's bytes to the account uploads folder; outlook-mail-reply: in-thread reply (replyAll, cc/bcc, attachments); outlook-mail-delete: move to Deleted Items (recoverable); outlook-mail-ingest: write operator-reviewed messages into the business graph as :ConversationArchive threads (per-message ingest/discard, conversationId threading, closed-set participant resolution); outlook-mail-otp-extract: poll for a one-time code; outlook-mail-send / outlook-draft / outlook-draft-edit / outlook-draft-send: compose, edit, and send, all with attachments — outlook-draft takes an optional replyToMessageId to draft a threaded reply, unsent, under the original conversation; outlook-calendar-list / outlook-calendar-event: read calendar; outlook-calendar-create / outlook-calendar-update / outlook-calendar-cancel / outlook-calendar-respond / outlook-calendar-freebusy: control calendar; outlook-contacts-list: contacts; outlook-mailbox-info: auth state + folder count for one mailbox; outlook-mailbox-list: every connected mailbox.",
   "version": "0.1.0",
   "author": {
     "name": "Rubytech LLC"

package/payload/platform/plugins/outlook/PLUGIN.md

@@ -1,6 +1,6 @@
 ---
 name: outlook
-description: Microsoft 365 / Outlook.com via Microsoft Graph. Mail is read (list, search, full-body), reply, delete, and compose (draft, draft-edit, send); contacts are read-only; calendar is read + control. Per-account OAuth device-code flow; no client secret. One account can hold several mailboxes at once; every operational tool takes an optional mailbox selector (email or graphUserId) and refuses ambiguously when two or more are attached and none is named. Tools — outlook-account-register / outlook-account-register-poll: device-code register (start + poll); outlook-mail-list / outlook-mail-search: inbox triage (~255-char preview) with a date window (list) or KQL from:/subject: filters (search) and a nextCursor for paging beyond the newest page; outlook-mail-fetch-body: full body of one message by id; outlook-mail-attachment: list any message's attachments (received or draft), or download one file attachment's bytes to the account uploads folder; outlook-mail-reply: in-thread reply (replyAll, cc/bcc, attachments); outlook-mail-delete: move to Deleted Items (recoverable); outlook-mail-otp-extract: poll for a one-time code; outlook-mail-send / outlook-draft / outlook-draft-edit / outlook-draft-send: compose, edit, and send, all with attachments — outlook-draft takes an optional replyToMessageId to draft a threaded reply, unsent, under the original conversation; outlook-calendar-list / outlook-calendar-event: read calendar; outlook-calendar-create / outlook-calendar-update / outlook-calendar-cancel / outlook-calendar-respond / outlook-calendar-freebusy: control calendar; outlook-contacts-list: contacts; outlook-mailbox-info: auth state + folder count for one mailbox; outlook-mailbox-list: every connected mailbox.
+description: Microsoft 365 / Outlook.com via Microsoft Graph. Mail is read (list, search, full-body), reply, delete, and compose (draft, draft-edit, send); contacts are read-only; calendar is read + control. Per-account OAuth device-code flow; no client secret. One account can hold several mailboxes at once; every operational tool takes an optional mailbox selector (email or graphUserId) and refuses ambiguously when two or more are attached and none is named. Tools — outlook-account-register / outlook-account-register-poll: device-code register (start + poll); outlook-mail-list / outlook-mail-search: inbox triage (~255-char preview) with a date window (list) or KQL from:/subject: filters (search) and a nextCursor for paging beyond the newest page; outlook-mail-fetch-body: full body of one message by id; outlook-mail-attachment: list any message's attachments (received or draft), or download one file attachment's bytes to the account uploads folder; outlook-mail-reply: in-thread reply (replyAll, cc/bcc, attachments); outlook-mail-delete: move to Deleted Items (recoverable); outlook-mail-ingest: write operator-reviewed messages into the business graph as :ConversationArchive threads (per-message ingest/discard, conversationId threading, closed-set participant resolution); outlook-mail-otp-extract: poll for a one-time code; outlook-mail-send / outlook-draft / outlook-draft-edit / outlook-draft-send: compose, edit, and send, all with attachments — outlook-draft takes an optional replyToMessageId to draft a threaded reply, unsent, under the original conversation; outlook-calendar-list / outlook-calendar-event: read calendar; outlook-calendar-create / outlook-calendar-update / outlook-calendar-cancel / outlook-calendar-respond / outlook-calendar-freebusy: control calendar; outlook-contacts-list: contacts; outlook-mailbox-info: auth state + folder count for one mailbox; outlook-mailbox-list: every connected mailbox.
 tools:
   - name: outlook-account-register
     publicAllowlist: false
@@ -26,6 +26,9 @@ tools:
   - name: outlook-mail-delete
     publicAllowlist: false
     adminAllowlist: false
+  - name: outlook-mail-ingest
+    publicAllowlist: false
+    adminAllowlist: false
   - name: outlook-mail-otp-extract
     publicAllowlist: false
     adminAllowlist: false
@@ -99,6 +102,7 @@ Microsoft Graph access for Outlook.com / Microsoft 365 mailboxes. Mail is read (
 - **Mail (read):** `outlook-mail-list` returns messages newest-first with an optional `since`/`before` date window, and `outlook-mail-search` runs a Graph `$search` (KQL) query where `from:`/`to:`/`subject:`/`received>=` filters live — both return Microsoft's short `bodyPreview` (~255 chars) for cheap triage and a `nextCursor` for paging beyond the 250-per-page window (the cursor is an opaque `@odata.nextLink`; pass it back as `cursor`). Graph forbids `$search`+`$filter`, so the strict date window is on the list tool and sender/subject filtering is on the search tool. `outlook-mail-fetch-body` reads the COMPLETE body of one message by id (HTML decoded to text, no preview cap) — the full-read path. All three read tools report `hasAttachments` per message, so the agent knows to reach for the attachment tool.
 - **Mail (attachments):** `outlook-mail-attachment` lists or downloads any message's attachments — received or draft. Called with `messageId` alone it LISTS them (`id`, `name`, `contentType`, `size`, `isInline`, and a `kind` of `file`/`item`/`reference`) via `GET /me/messages/{id}/attachments` with `$select` (no bytes); a draft is a message in the same collection, so passing a draftId lists what that draft carries, and the returned `name`/`id` is the handle `outlook-draft-edit`'s `removeAttachments` takes. Called with `messageId`+`attachmentId` it DOWNLOADS one file attachment: the bytes are written to `{accountDir}/uploads/outlook/<messageHash>/<bytesHash>-<name>` at `0o600` and the saved absolute path is returned, ready for the Read tool, `SendUserFile`, or an `outlook-mail-reply` attachment. Only file attachments download — `item` (embedded message/event) and `reference` (cloud-drive link) kinds are refused, as are empty payloads and anything over the 25 MB cap; in each case nothing is written. Requires `Mail.Read`.
 - **Mail (reply / delete):** `outlook-mail-reply` replies in-thread (native `conversationId` threading) with `replyAll`, added cc/bcc, and account-scoped file attachments (up to 25 MB per file — files over Graph's ~3 MB inline limit stream through a chunked upload session); the body is prepended above the quoted original. `outlook-mail-delete` moves messages to Deleted Items (recoverable — never hard-deletes). Both require `Mail.ReadWrite` (reply also needs `Mail.Send`).
+- **Mail (ingest to graph):** `outlook-mail-ingest` writes operator-reviewed messages into the business graph as `:ConversationArchive {source:'email'}` threads, the analogue of the IMAP `email-ingest`. Input is `decisions`: one `{messageId, disposition:'ingest'|'discard'}` per listed message. Each `ingest` message's full body + envelope is fetched via `runMailFetchBody`, threads are grouped by Graph `conversationId`, and participant resolution is closed-set — every From/To/Cc address must already resolve to a `:Person.email` or `:AdminUser.email` for the `accountId`, or its thread is skipped and the address is returned to the operator (no `:Person` auto-create). Resolvable threads dispatch one at a time through the shared `plugins/memory/bin/conversation-archive-ingest.sh --source email` (same RFC822 thread-JSON shape the `email` normaliser consumes). This is the plugin's only Neo4j coupling (`neo4j-driver`). Human-in-the-loop: nothing enters the graph without an explicit per-message decision; the `outlook-mail-ingest` skill drives the list → summarise → ask → ingest loop. Requires `Mail.Read`.
 - **Mail (OTP):** `outlook-mail-otp-extract` polls the inbox for a one-time verification code from a named sender, reading full bodies to extract it — used during service authentication.
 - **Mail (send / draft):** `outlook-mail-send` sends a new message — via `POST /me/sendMail` with no attachments, or composed as a draft, attached, and sent when `attachments` is present (`/me/sendMail` carries attachments inline and cannot fit a large file); `outlook-draft` creates a draft, attaches any files, and returns its id — either a new message (`to` + `subject` required) or, with `replyToMessageId`, a threaded reply created via `POST /me/messages/{id}/createReply` that lands under the original conversation (the only way to draft a reply without sending it; `outlook-mail-reply` threads but always sends). On the threaded path Graph sets the recipients and `RE:` subject from the original and composes the body above its own quote — the same email `outlook-mail-reply` sends — so that path is plain text only and `to`, `subject`, and `isHtml: true` are refused rather than silently dropped; `replyAll` and `cc`/`bcc` work as on reply. `outlook-draft-edit` updates an existing draft in place (Graph drafts are mutable) and edits its attachments — `attachments` adds files, `removeAttachments` takes them off by name or attachment id, and both together replace a file in one call; `outlook-draft-send` sends an existing draft by id. Recipients are to/cc/bcc arrays; body is HTML or plain text via `isHtml`; `attachments` are file paths inside the account directory, capped at 25 MB per file and validated before any Graph write. Success asserted on Graph 202. Requires `Mail.Send` + `Mail.ReadWrite`; a mailbox on the old read-only consent returns an actionable "re-register to grant send" signal.
 - **Calendar (read + control):** `outlook-calendar-list` and `outlook-calendar-event` read events; `outlook-calendar-create` books an event; `outlook-calendar-update` reschedules or edits one; `outlook-calendar-cancel` cancels a meeting (notifying attendees when the account organises it) or deletes a personal appointment; `outlook-calendar-respond` accepts, declines, or tentatively accepts an invite; `outlook-calendar-freebusy` reports availability for one or more addresses over a window. Writes require the `Calendars.ReadWrite` consent; a mailbox on stale read-only consent returns a distinct signal naming the scope and `outlook-account-register`.
@@ -108,7 +112,7 @@ Microsoft Graph access for Outlook.com / Microsoft 365 mailboxes. Mail is read (
 ## Out of scope
 
 - Mail move (to arbitrary folders) / flag — write surfaces beyond reply, delete (move to Deleted Items), and compose are not implemented. Hard/permanent delete is deliberately excluded; `outlook-mail-delete` only moves to Deleted Items.
-- Ingesting reviewed mail into the business graph — the `outlook-mail-ingest` analogue of `email-ingest` is a follow-up task (adds a Neo4j dependency).
+- Attachment-byte archival into the graph — `outlook-mail-ingest` lands text threads only; the IMAP path also archives attachment bytes as `:DigitalDocument`, and the Outlook equivalent is a separate concern (see out-of-scope).
 - Contacts write — read-only.
 - Recurring-series occurrence editing (edit-this-occurrence) beyond whole-series create/update.
 - The `scheduling` (Neo4j graph) plugin and any auto-sync between it and the Outlook calendar.

package/payload/platform/plugins/outlook/mcp/dist/__tests__/dispatch-grouping.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=dispatch-grouping.test.d.ts.map

package/payload/platform/plugins/outlook/mcp/dist/__tests__/dispatch-grouping.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch-grouping.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/dispatch-grouping.test.ts"],"names":[],"mappings":""}

package/payload/platform/plugins/outlook/mcp/dist/__tests__/dispatch-grouping.test.js

@@ -0,0 +1,54 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { groupByThread, buildThreadJson } from "../lib/conversation-archive-dispatch.js";
+const base = {
+    fromAddress: "a@x.com",
+    fromName: "Ann",
+    toAddresses: ["b@x.com"],
+    ccAddresses: [],
+    subject: "s",
+    bodyText: "hi",
+    accountId: "acct1",
+};
+test("two messages sharing conversationId group into one thread", () => {
+    const msgs = [
+        { ...base, messageId: "m1", conversationId: "c1", receivedDateTime: "2026-01-01T10:00:00Z" },
+        { ...base, messageId: "m2", conversationId: "c1", receivedDateTime: "2026-01-01T11:00:00Z" },
+    ];
+    const threads = groupByThread(msgs);
+    assert.equal(threads.length, 1);
+    assert.equal(threads[0].messages.length, 2);
+});
+test("null conversationId becomes its own thread keyed on messageId", () => {
+    const msgs = [
+        { ...base, messageId: "m1", conversationId: null, receivedDateTime: "2026-01-01T10:00:00Z" },
+        { ...base, messageId: "m2", conversationId: null, receivedDateTime: "2026-01-01T11:00:00Z" },
+    ];
+    assert.equal(groupByThread(msgs).length, 2);
+});
+test("thread addresses are lowercased union of from/to/cc, sorted", () => {
+    const msgs = [
+        {
+            ...base,
+            messageId: "m1",
+            conversationId: "c1",
+            fromAddress: "A@X.com",
+            toAddresses: ["B@X.com"],
+            ccAddresses: ["c@x.com"],
+            receivedDateTime: "2026-01-01T10:00:00Z",
+        },
+    ];
+    assert.deepEqual(groupByThread(msgs)[0].addresses, ["a@x.com", "b@x.com", "c@x.com"]);
+});
+test("buildThreadJson emits {from:{name,email},date,bodyText} in receivedDateTime order", () => {
+    const thread = groupByThread([
+        { ...base, messageId: "m2", conversationId: "c1", bodyText: "second", receivedDateTime: "2026-01-01T11:00:00Z" },
+        { ...base, messageId: "m1", conversationId: "c1", bodyText: "first", receivedDateTime: "2026-01-01T10:00:00Z" },
+    ])[0];
+    const json = buildThreadJson(thread);
+    assert.deepEqual(json, [
+        { from: { name: "Ann", email: "a@x.com" }, date: "2026-01-01T10:00:00Z", bodyText: "first" },
+        { from: { name: "Ann", email: "a@x.com" }, date: "2026-01-01T11:00:00Z", bodyText: "second" },
+    ]);
+});
+//# sourceMappingURL=dispatch-grouping.test.js.map