@rubytech/create-maxy-code 0.1.496 → 0.1.498

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.496",
+  "version": "0.1.498",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/docs/superpowers/plans/2026-07-24-task-1942-subaccount-switcher-brand-head.md

@@ -0,0 +1,327 @@
+# Task 1942 — Sub-account switcher to sidebar brand head — Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: superpowers:executing-plans. Steps use checkbox (`- [ ]`) syntax.
+
+**Goal:** Open the sub-account picker by clicking the sidebar brand head; remove it from the footer kebab.
+
+**Architecture:** `Sidebar.tsx` owns a `switcherOpen` state and renders the brand head as a button (icon + lockup + chevron) when the switcher is available, with `SubAccountPicker` + a full-screen scrim anchored beneath `.side-brand`. `AccountMenu.tsx` loses the switcher block, its five props, and the `SubAccountPicker` import. `globals.css` makes `.side-brand` a positioned anchor, re-anchors the panel left-aligned, and deletes the dead footer overrides.
+
+**Tech Stack:** React 18, TypeScript, vitest + jsdom (Node 22), lucide-react icons.
+
+## Global Constraints
+
+- Node 22 for the jsdom test run (`platform/ui` requirement).
+- Switcher availability gate is exactly `subAccounts.length > 1 && Boolean(onSwitchAccount)`; unchanged from today.
+- No new task-id leaks in shipped docs; docs edit at `platform/plugins/docs/references/admin-ui.md`.
+- All paths below are relative to the worktree's `maxy-code/platform/ui/`.
+
+---
+
+### Task 1: Strip the switcher out of AccountMenu
+
+**Files:**
+- Modify: `app/components/AccountMenu.tsx`
+- Test: `app/components/__tests__/AccountMenu.test.tsx`
+
+**Interfaces:**
+- Produces: `AccountMenuProps` with no `subAccounts`/`activeAccountId`/`switchingAccount`/`onSwitchAccount`/`refreshAccounts` fields.
+
+- [ ] **Step 1: Update the test to assert the switcher is gone**
+
+In `AccountMenu.test.tsx`, delete the two switcher tests (`renders no Switch account affordance with 0-1 sub-accounts` and `opens the sub-account picker and fires onSwitchAccount + refreshAccounts`, lines 56-88). Add one test:
+
+```tsx
+it('renders no Switch account affordance (relocated to sidebar brand head, Task 1942)', () => {
+  render(<AccountMenu {...baseProps} variant="admin" cacheKey="k" onOpenConversations={vi.fn()} />)
+  expect(screen.queryByRole('menuitem', { name: /switch account/i })).toBeNull()
+  expect(screen.queryByPlaceholderText(/search sub-accounts/i)).toBeNull()
+})
+```
+
+Remove `subAccounts`/`activeAccountId`/`switchingAccount`/`onSwitchAccount`/`refreshAccounts` from any remaining render in the file.
+
+- [ ] **Step 2: Run — expect fail (props still typed / item still renders)**
+
+Run: `npx vitest run app/components/__tests__/AccountMenu.test.tsx`
+Expected: FAIL (the Switch account menuitem still renders).
+
+- [ ] **Step 3: Remove the switcher from AccountMenu.tsx**
+
+- Delete the `import { SubAccountPicker } from './SubAccountPicker'` line.
+- In `AccountMenuProps`, delete the five switcher prop declarations and their doc comment block (`subAccounts?`, `activeAccountId?`, `switchingAccount?`, `onSwitchAccount?`, `refreshAccounts?`).
+- In the destructure, remove `subAccounts = []`, `activeAccountId = null`, `switchingAccount = false`, `onSwitchAccount`, `refreshAccounts`.
+- Delete the `switcherOpen` state and `switcherAvailable` const.
+- Delete the whole `{switcherAvailable && ( … <SubAccountPicker … /> … )}` JSX block.
+- Remove `UserRound` from the lucide-react import (it was used only by the deleted block; grep the file to confirm no other use).
+
+- [ ] **Step 4: Run — expect pass**
+
+Run: `npx vitest run app/components/__tests__/AccountMenu.test.tsx`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add maxy-code/platform/ui/app/components/AccountMenu.tsx maxy-code/platform/ui/app/components/__tests__/AccountMenu.test.tsx
+git commit -m "refactor(1942): remove sub-account switcher from AccountMenu"
+```
+
+---
+
+### Task 2: Brand head becomes the switcher trigger in Sidebar
+
+**Files:**
+- Modify: `app/Sidebar.tsx`
+- Test: `app/__tests__/Sidebar-subaccount-switcher.test.tsx` (create), `app/__tests__/Sidebar-user-footer.test.tsx`
+
+**Interfaces:**
+- Consumes: `SubAccountPicker` from `./components/SubAccountPicker`; `ChevronDown` from `lucide-react`; existing `subAccounts`/`activeAccountId`/`switchingAccount`/`onSwitchAccount`/`refreshAccounts` Sidebar props.
+
+- [ ] **Step 1: Write the failing test (new file)**
+
+Create `app/__tests__/Sidebar-subaccount-switcher.test.tsx`:
+
+```tsx
+import React from 'react'
+import { render, screen, fireEvent } from '@testing-library/react'
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { Sidebar } from '../Sidebar'
+
+function jsonResponse(body: unknown, status = 200): Response {
+  return new Response(JSON.stringify(body), { status, headers: { 'content-type': 'application/json' } }) as Response
+}
+function routedFetch() {
+  return vi.spyOn(global, 'fetch').mockImplementation((input: RequestInfo | URL) => {
+    const url = typeof input === 'string' ? input : input.toString()
+    if (url.includes('/api/admin/sidebar-sessions')) return Promise.resolve(jsonResponse({ accountId: 'acct', sessions: [] }))
+    if (url.includes('/api/admin/system-stats')) return Promise.resolve(jsonResponse({ cpuPct: null, memUsedPct: 0.5, platform: 'darwin' }))
+    if (url.includes('/api/admin/version')) return Promise.resolve(jsonResponse({ installed: '1.0.0', latest: null, updateAvailable: false }))
+    return Promise.resolve(jsonResponse({}, 404))
+  })
+}
+const ACCOUNTS = [
+  { accountId: 'a1', businessName: 'House', role: 'admin', isHouse: true },
+  { accountId: 'a2', businessName: 'Client', role: 'admin', isHouse: false },
+]
+function baseProps(over: Record<string, unknown> = {}) {
+  return {
+    businessName: 'House', cacheKey: 'k', role: 'admin', userName: 'Ada Ops', userAvatar: null,
+    onSelectProjects: vi.fn(), onSelectTasks: vi.fn(), onCloseMobileDrawer: vi.fn(),
+    collapsed: false, mobileDrawerOpen: false, onSelectData: vi.fn(),
+    onLogout: vi.fn(), onDisconnect: vi.fn(async () => true), disconnecting: false, claudeConnected: true,
+    ...over,
+  }
+}
+beforeEach(() => { Object.defineProperty(document, 'hidden', { value: false, configurable: true }) })
+afterEach(() => { vi.restoreAllMocks() })
+
+describe('Sidebar sub-account switcher on the brand head (Task 1942)', () => {
+  it('brand head is a button that toggles the picker and fires refreshAccounts', () => {
+    routedFetch()
+    const refreshAccounts = vi.fn()
+    render(<Sidebar {...baseProps({ subAccounts: ACCOUNTS, activeAccountId: 'a1', switchingAccount: false, onSwitchAccount: vi.fn(), refreshAccounts })} />)
+    const head = screen.getByRole('button', { name: /switch sub-account/i })
+    expect(screen.queryByPlaceholderText(/search sub-accounts/i)).toBeNull()
+    fireEvent.click(head)
+    expect(screen.getByPlaceholderText(/search sub-accounts/i)).toBeInTheDocument()
+    expect(refreshAccounts).toHaveBeenCalledTimes(1)
+    fireEvent.click(head)
+    expect(screen.queryByPlaceholderText(/search sub-accounts/i)).toBeNull()
+  })
+
+  it('selecting a card calls onSwitchAccount and closes the picker', () => {
+    routedFetch()
+    const onSwitchAccount = vi.fn()
+    render(<Sidebar {...baseProps({ subAccounts: ACCOUNTS, activeAccountId: 'a1', switchingAccount: false, onSwitchAccount, refreshAccounts: vi.fn() })} />)
+    fireEvent.click(screen.getByRole('button', { name: /switch sub-account/i }))
+    fireEvent.click(screen.getByRole('button', { name: 'Client' }))
+    expect(onSwitchAccount).toHaveBeenCalledWith('a2')
+    expect(screen.queryByPlaceholderText(/search sub-accounts/i)).toBeNull()
+  })
+
+  it('single-account install: brand head is not a switcher button and no picker mounts', () => {
+    routedFetch()
+    render(<Sidebar {...baseProps({ subAccounts: [ACCOUNTS[0]], activeAccountId: 'a1', onSwitchAccount: vi.fn() })} />)
+    expect(screen.queryByRole('button', { name: /switch sub-account/i })).toBeNull()
+    expect(screen.queryByPlaceholderText(/search sub-accounts/i)).toBeNull()
+  })
+})
+```
+
+- [ ] **Step 2: Run — expect fail**
+
+Run: `npx vitest run app/__tests__/Sidebar-subaccount-switcher.test.tsx`
+Expected: FAIL (no button named "Switch sub-account").
+
+- [ ] **Step 3: Implement the trigger in Sidebar.tsx**
+
+Add imports: `SubAccountPicker` from `'./components/SubAccountPicker'`, and `ChevronDown` to the existing `lucide-react` import.
+
+Add state beside `footerMenuOpen`:
+
+```tsx
+const [switcherOpen, setSwitcherOpen] = useState(false)
+const switcherAvailable = (subAccounts?.length ?? 0) > 1 && Boolean(onSwitchAccount)
+```
+
+Replace the `<div className="side-brand">…</div>` block (icon + lockup) with:
+
+```tsx
+<div className="side-brand">
+  {switcherAvailable ? (
+    <button
+      type="button"
+      className="side-brand-trigger"
+      aria-haspopup="menu"
+      aria-expanded={switcherOpen}
+      aria-label="Switch sub-account"
+      onClick={() => {
+        const opening = !switcherOpen
+        setSwitcherOpen(opening)
+        if (opening) refreshAccounts?.()
+        console.info(`[admin-ui] op=subaccount-switcher-toggle anchor=brand-head open=${opening} available=true accounts=${subAccounts?.length ?? 0}`)
+      }}
+    >
+      <img className="side-brand-icon" src={brandIcon} alt="" aria-hidden="true" />
+      <span className="side-brand-lockup">
+        <span className="side-brand-business">{displayName}</span>
+        <span className="side-brand-product">{brand.productName}</span>
+      </span>
+      <ChevronDown size={14} className="side-brand-caret" aria-hidden="true" />
+    </button>
+  ) : (
+    <>
+      <img className="side-brand-icon" src={brandIcon} alt="" aria-hidden="true" />
+      <span className="side-brand-lockup">
+        <span className="side-brand-business">{displayName}</span>
+        <span className="side-brand-product">{brand.productName}</span>
+      </span>
+    </>
+  )}
+  {switcherOpen && (
+    <>
+      <div className="side-brand-scrim" aria-hidden="true" onClick={() => setSwitcherOpen(false)} />
+      <SubAccountPicker
+        open={switcherOpen}
+        accounts={subAccounts ?? []}
+        activeAccountId={activeAccountId ?? null}
+        switching={switchingAccount ?? false}
+        onSelect={(accountId) => onSwitchAccount?.(accountId)}
+        onClose={() => setSwitcherOpen(false)}
+      />
+    </>
+  )}
+</div>
+```
+
+In the footer `<AccountMenu … />`, delete the five props `subAccounts`, `activeAccountId`, `switchingAccount`, `onSwitchAccount`, `refreshAccounts` (the Sidebar keeps consuming them for the head). Leave `onOpenConversations` and the rest.
+
+- [ ] **Step 4: Run — expect pass**
+
+Run: `npx vitest run app/__tests__/Sidebar-subaccount-switcher.test.tsx`
+Expected: PASS.
+
+- [ ] **Step 5: Fix the footer test that asserted the switcher was in the kebab**
+
+In `app/__tests__/Sidebar-user-footer.test.tsx`, the test `threads the sub-account switcher and Conversations into the kebab menu` (lines 53-75) now asserts a false thing. Rewrite it to cover Conversations only:
+
+```tsx
+it('threads Conversations into the kebab menu (switcher moved to brand head, Task 1942)', async () => {
+  routedFetch({ cpuPct: null, memUsedPct: 0.5, platform: 'darwin' })
+  const onOpenConversations = vi.fn()
+  render(<Sidebar {...baseProps({ onOpenConversations })} />)
+  fireEvent.click(screen.getByRole('button', { name: 'Account menu' }))
+  expect(screen.queryByRole('menuitem', { name: /switch account/i })).toBeNull()
+  fireEvent.click(await screen.findByRole('menuitem', { name: /conversations/i }))
+  expect(onOpenConversations).toHaveBeenCalledTimes(1)
+})
+```
+
+- [ ] **Step 6: Run both Sidebar suites — expect pass**
+
+Run: `npx vitest run app/__tests__/Sidebar-subaccount-switcher.test.tsx app/__tests__/Sidebar-user-footer.test.tsx`
+Expected: PASS.
+
+- [ ] **Step 7: Commit**
+
+```bash
+git add maxy-code/platform/ui/app/Sidebar.tsx maxy-code/platform/ui/app/__tests__/Sidebar-subaccount-switcher.test.tsx maxy-code/platform/ui/app/__tests__/Sidebar-user-footer.test.tsx
+git commit -m "feat(1942): brand head opens the sub-account picker"
+```
+
+---
+
+### Task 3: CSS — anchor the panel under the head, style the trigger, drop dead overrides
+
+**Files:**
+- Modify: `app/globals.css`
+
+**Interfaces:** consumes class names `side-brand`, `side-brand-trigger`, `side-brand-caret`, `side-brand-scrim`, `sub-account-picker-panel` from Task 2.
+
+- [ ] **Step 1: Add `position: relative` to `.side-brand`**
+
+In the `.side-brand { … }` rule, add `position: relative;`.
+
+- [ ] **Step 2: Add the trigger, caret, and scrim rules** (place beside `.side-brand`)
+
+```css
+.side-brand-trigger {
+  display: flex; align-items: center; gap: 10px; flex: 1; min-width: 0;
+  background: none; border: 0; padding: 0; margin: 0;
+  font: inherit; color: inherit; text-align: left; cursor: pointer;
+}
+.side-brand-caret { flex: none; color: var(--text-tertiary); }
+.side-brand-trigger:hover .side-brand-caret { color: var(--text-secondary); }
+.platform.sidebar-collapsed .side-brand-caret { display: none; }
+.side-brand-scrim { position: fixed; inset: 0; z-index: 40; }
+.platform.sidebar-collapsed .side-brand-scrim { display: none; }
+```
+
+- [ ] **Step 3: Re-anchor `.sub-account-picker-panel` under the head**
+
+The brand head is now the only consumer. In `.sub-account-picker-panel`, remove `left: 50%;` and `transform: translateX(-50%);`, remove the `min-width` (if present), and set `left: 0; right: 0; margin-top: 8px; z-index: 41;` so the panel spans the head's inner width and sits above the scrim.
+
+- [ ] **Step 4: Delete the dead footer overrides**
+
+Delete the `.side-foot-menu .sub-account-picker-panel { … }` and `.side-foot-menu .sub-account-picker-list { … }` rules and the comment above them that describes the footer kebab anchoring.
+
+- [ ] **Step 5: Run the class-name CSS gate + the switcher suites**
+
+Run: `npm run -s check:classname-css 2>/dev/null || node scripts/check-classname-css.mjs`
+Then: `npx vitest run app/__tests__/Sidebar-subaccount-switcher.test.tsx`
+Expected: gate clean; tests PASS.
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add maxy-code/platform/ui/app/globals.css
+git commit -m "style(1942): anchor sub-account picker under the sidebar brand head"
+```
+
+---
+
+### Task 4: Docs
+
+**Files:**
+- Modify: `platform/plugins/docs/references/admin-ui.md`
+
+- [ ] **Step 1: Update the switcher location**
+
+Find the passage describing the sub-account switcher opening from the footer kebab / user-footer AccountMenu. Rewrite it to state the switcher opens by clicking the sidebar brand head (the account name), with the picker dropping beneath it; note the footer kebab no longer carries it. Keep it to the existing register; no task-id string in the shipped doc.
+
+- [ ] **Step 2: Commit**
+
+```bash
+git add maxy-code/platform/plugins/docs/references/admin-ui.md
+git commit -m "docs(1942): sub-account switcher now opens from the sidebar brand head"
+```
+
+## Self-Review
+
+- **Spec coverage:** brand-head trigger (T2), whole-head + chevron + scrim decisions (T2/T3), AccountMenu strip (T1), CSS re-anchor + dead-override delete (T3), observability toggle log (T2 Step 3), docs (T4), test updates incl. the footer-test fix (T2 Step 5). All spec items mapped.
+- **Placeholder scan:** none; every code step shows code.
+- **Type consistency:** `SubAccountPicker` prop names (`open`, `accounts`, `activeAccountId`, `switching`, `onSelect`, `onClose`) match its component signature; Sidebar prop names match the existing signature.
+
+## Known follow-ups
+
+None at plan time. Any code-review finding out of scope is filed as a new `.tasks/` file per the sprint rules.

package/payload/platform/docs/superpowers/specs/2026-07-24-task-1942-subaccount-switcher-brand-head-design.md

@@ -0,0 +1,35 @@
+# Task 1942 — Sub-account switcher moves to the sidebar brand head
+
+Design doc. Source task: `.tasks/1942-subaccount-switcher-moves-to-sidebar-brand-head.md`.
+
+## Goal
+
+Open the sub-account picker by clicking the account name at the top of the sidebar, not from the footer kebab. Remove the switcher from the footer menu.
+
+## Resolved decisions (brainstorm)
+
+1. **Click target:** the whole brand head (`side-brand`: icon + two-line lockup) becomes one button when the switcher is available.
+2. **Affordance:** a small down-chevron renders after the business name to signal the dropdown.
+3. **Close:** re-clicking the head toggles it shut, and a transparent full-screen scrim behind the panel closes it on any outside click. Mirrors the footer-menu scrim it replaces.
+
+## Availability gate (unchanged from today)
+
+Switcher is available only when `subAccounts.length > 1 && Boolean(onSwitchAccount)`. Unavailable → the head stays a plain non-interactive `<div>`, no chevron, no picker. This is the current `switcherAvailable` gate, moved from `AccountMenu` to `Sidebar`.
+
+## Components and flow
+
+- **`Sidebar.tsx`** owns `switcherOpen` state. The brand head renders as `<button aria-haspopup="menu" aria-expanded={switcherOpen}>` when available, else the current `<div>`. Click toggles `switcherOpen`; the closed→open transition fires `refreshAccounts?.()` and emits `[admin-ui] op=subaccount-switcher-toggle anchor=brand-head open=<bool> available=<bool> accounts=<N>`. `SubAccountPicker` renders inside `.side-brand`, anchored beneath it, with a sibling scrim that closes on click.
+- **`AccountMenu.tsx`** loses the `switcherAvailable`/`switcherOpen` block, the `SubAccountPicker` import, and the five switcher props. `UserRound` import dropped if otherwise unused.
+- **`globals.css`** gives `.side-brand` `position: relative` and re-anchors `.sub-account-picker-panel` left-aligned under the head (drop the retired header-title `translateX(-50%)` centering). Adds `.side-brand` button-reset styling (transparent, inherit, pointer) and the chevron. Deletes the dead `.side-foot-menu .sub-account-picker-panel` / `-list` overrides.
+
+## Collapsed rail (edge, in scope to not break)
+
+When `sidebar-collapsed`, existing CSS hides `.side-brand-lockup` (name + chevron), leaving only the icon. The head-button still functions on the icon, but no new collapsed affordance is added (per task out-of-scope). The picker anchors under `.side-brand` in both states.
+
+## Testing
+
+vitest + jsdom (Node 22). New `Sidebar` test: available → head is a button, click mounts the picker and fires `refreshAccounts`, re-click closes; unavailable → not a button, no picker. `AccountMenu.test.tsx`: no "Switch account", switcher props dropped. `SubAccountPicker.test.tsx` unchanged.
+
+## Out of scope
+
+`SubAccountPicker` internals, the switch mechanism, other `AccountMenu` items, a dedicated collapsed-rail affordance, maxy-lite, Task 1940's mobile lite tab bar.

package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: platform-architecture
 description: Use when grounding any documented-surface claim about what Maxy ships — plugins, skills, specialists, install/deploy flows, internals. This is the install catalogue, not evidence of what is enabled on the current account. For install state on this account, call `capabilities-here`; for documented surface, cite the `Source:` URL inline.
-content-hash: sha256:019a4f941c1466cfb0a9490c7c92f2eccbba4e67e57df48ddcb28f7b1ef5d835
+content-hash: sha256:99a8e6ca434399104da91bd275d70b2c95bb10b96f5d1b4666053d66de447468
 brand: maxy-code
 product-name: Maxy
 ---
@@ -1905,6 +1905,22 @@ A site capture becomes one of these too: an enquiry becomes a new contact routed
 
 Run a sweep a second time and it proposes nothing it already recorded on the first run, because those records are now in memory and it recognises them. A repeat sweep is quiet on purpose; that is the sign your graph is already up to date.
 
+## Automatic email→graph sweep (opt-in)
+
+The sweep above runs only when you ask, and it proposes rather than writes. There is a second, opt-in routine that runs on a schedule and writes on its own: the automatic email→graph sweep, set up through the `email-graph-sweep` skill. On each run it reads the new inbound mail on your mailbox, pulls out the organisations, people, and live jobs it finds, checks each against what Maxy already holds, saves the genuinely new ones, and then sends you a short report of what it read and saved.
+
+Turning it on needs two things, and Maxy tells you which is missing if either is absent:
+
+- **A connected mailbox.** The routine reads your mail, so a mail account (a standard IMAP mailbox, or a Microsoft 365 mailbox) must be connected. With no mailbox connected there is nothing to sweep, and Maxy says so instead of switching anything on.
+- **A place to send the report.** The routine reports over a persistent channel, so you name the WhatsApp number or Telegram chat that receives it, and that destination must already be registered as an admin or account-manager. If it is not registered, Maxy tells you that rather than falling back to a silent run.
+
+Two things to know before you switch it on:
+
+- **It messages you on every run.** It is a report you receive each time, not a silent background job. If you want a quiet, always-on tidy-up of the graph instead, that is a different routine.
+- **It is one-account, deliberate opt-in.** Maxy does not turn this on for you automatically, and it is held back from broad rollout for now while a safety fix for scheduled runs lands. Enable it for an account you are watching, not as a default.
+
+Turn it off with the same skill: ask to stop the automatic email sweep and Maxy cancels the schedule, so no further runs fire.
+
 ---
 # Slides
 Source: https://docs.getmaxy.com/slides.md
@@ -2123,6 +2139,7 @@ The `outlook` plugin gives the admin agent access to Microsoft 365 / Outlook.com
 | `outlook-mail-attachment` | List or download any message's attachments — received or draft. With `messageId` alone, LISTS them (`id`, `name`, `contentType`, `size`, `isInline`, and a `kind` of file/item/reference) via `GET /me/messages/{id}/attachments` and `$select` (no bytes). A draft is a message in the same collection, so passing a draftId lists what that draft carries; the returned `name`/`id` is what `outlook-draft-edit`'s `removeAttachments` takes. With `messageId`+`attachmentId`, DOWNLOADS one file attachment: its bytes are written to `{accountDir}/uploads/outlook/<messageHash>/<bytesHash>-<name>` at `0o600` and the saved path is returned, ready for the Read tool, `SendUserFile`, or an `outlook-mail-reply` attachment. Only file attachments download — item/reference kinds, empty payloads, and anything over 25 MB are refused with nothing written. `outlook-mail-list` / `outlook-mail-search` / `outlook-mail-fetch-body` report `hasAttachments` so the agent knows when to call this. Needs `Mail.Read`. |
 | `outlook-mail-reply` | Reply in-thread (`createReply` / `createReplyAll` + send). Threads natively via conversationId. `replyAll`, added cc/bcc, and account-scoped file attachments (up to 25 MB per file; files over Graph's ~3 MB inline limit use a chunked upload session). Body is plain text, prepended above the quote. Needs `Mail.ReadWrite` + `Mail.Send`. |
 | `outlook-mail-delete` | Move messages to Deleted Items (`POST /me/messages/{id}/move`). Recoverable — never hard-deletes. An id already gone is counted not-moved. Needs `Mail.ReadWrite`. |
+| `outlook-mail-ingest` | Write operator-reviewed messages into the business graph as `:ConversationArchive {source:'email'}` threads (the analogue of the IMAP `email-ingest`). Input `decisions`: one `{messageId, disposition:'ingest'\|'discard'}` per listed message. Each `ingest` message's full body + envelope is fetched, threads group by Graph `conversationId`, and participants resolve closed-set against Neo4j (`:Person`/`:AdminUser` by `accountId`); an unresolved From/To/Cc address skips its whole thread and is returned to the operator (no `:Person` auto-create). Resolvable threads dispatch through the shared `conversation-archive-ingest.sh --source email`. Human-in-the-loop: nothing lands without an explicit per-message decision. The plugin's only Neo4j coupling. Needs `Mail.Read`. |
 | `outlook-mail-otp-extract` | Poll the inbox for a one-time code from a sender (domain). Reads full bodies to extract it; optional subject regex and timeout (default 60 s). |
 | `outlook-calendar-list` | Calendar events in next rangeDays days (default 7, max 365). |
 | `outlook-calendar-event` | Full detail of a single event by id. |
@@ -2159,6 +2176,9 @@ All log lines start with `[outlook-mcp]` and write to `server.log`. They are key
 | Refresh failed | `token-refresh-failed account=<id> reason=<err>` (terminal) |
 | Mail list | `mail-list op=resolve account=<id> folderIn=<name> folderResolved=<token> asRawId=<bool> count=<N> elapsedMs=<N>` (on error, `error=<msg>` replaces `count`) |
 | Mail search | `mail-search account=<id> query=<trunc-32> count=<N> elapsedMs=<N>` |
+| Mail ingest (per message) | `mail-ingest op=ingest id=<id> conversationId=<id> disposition=ingest` |
+| Mail ingest (per thread) | `mail-ingest op=thread-dispatched root=<key> messages=<N> participants=<N>` (or `op=thread-failed root=<key> status=<N> err=<msg>`; `status=null` with a non-`none` `err` is a spawn launch failure, not a script rejection) |
+| Mail ingest (summary) | `mail-ingest op=summary ingested=<N> discarded=<N> threadsDispatched=<N> threadsSkipped=<N> unresolved=<N>` — one per call; `threadsSkipped` with `unresolved>0` is the closed-set resolution refusing an unknown participant, not a failure |
 | Calendar list | `calendar-list account=<id> rangeDays=<N> count=<N> elapsedMs=<N>` |
 | Calendar event | `calendar-event account=<id> eventId=<trunc-12> elapsedMs=<N>` |
 | Event created | `cal-create-request account=<id> subj=<trunc-64>` then `event-created account=<id> eventId=<trunc-16> status=201`. A non-201 logs `event-create-failed ... status=<N>` and throws. A 201 whose body carried no readable id logs `event-created-id-unknown account=<id> status=201` and returns a created-but-id-unknown result (the event exists; do not retry) rather than a failure. |
@@ -2218,7 +2238,7 @@ Latency triage: `mail-list count=0 elapsedMs<200` consistent → permissions iss
 
 ## Out of scope
 
-Mail move to arbitrary folders / flag, hard (permanent) delete, removing an attachment from a **sent** message (Graph forbids it), ingesting reviewed mail into the business graph (the `email-ingest` analogue), contacts write, recurring-series occurrence editing, the `scheduling` Neo4j calendar and any auto-sync with it, OneDrive / Files, push notifications, on-premises Exchange, M365 admin scopes (`User.Read.All`, `AuditLog.Read.All`), public-agent exposure, multi-tenant federation. Mail read, full-body read, inbound attachment list/download, reply, delete (to Deleted Items), and compose — all four outbound paths carrying attachments, with a draft's attachments editable in place (add, remove, replace) — are supported (`outlook-mail-fetch-body`, `outlook-mail-attachment`, `outlook-mail-reply`, `outlook-mail-delete`, `outlook-mail-otp-extract`, `outlook-mail-send`, `outlook-draft`, `outlook-draft-edit`, `outlook-draft-send`), and the calendar is read plus control. See `platform/plugins/outlook/PLUGIN.md` for the full out-of-scope list.
+Mail move to arbitrary folders / flag, hard (permanent) delete, removing an attachment from a **sent** message (Graph forbids it), attachment-byte archival into the graph (`outlook-mail-ingest` lands text threads only; the IMAP `:DigitalDocument` archival is a separate concern), contacts write, recurring-series occurrence editing, the `scheduling` Neo4j calendar and any auto-sync with it, OneDrive / Files, push notifications, on-premises Exchange, M365 admin scopes (`User.Read.All`, `AuditLog.Read.All`), public-agent exposure, multi-tenant federation. Mail read, full-body read, inbound attachment list/download, reply, delete (to Deleted Items), and compose — all four outbound paths carrying attachments, with a draft's attachments editable in place (add, remove, replace) — are supported (`outlook-mail-fetch-body`, `outlook-mail-attachment`, `outlook-mail-reply`, `outlook-mail-delete`, `outlook-mail-ingest`, `outlook-mail-otp-extract`, `outlook-mail-send`, `outlook-draft`, `outlook-draft-edit`, `outlook-draft-send`), and the calendar is read plus control. See `platform/plugins/outlook/PLUGIN.md` for the full out-of-scope list.
 
 ---
 # Google Calendar
@@ -2990,6 +3010,35 @@ either is a regression.
 
 **Public visitor surface.** The public-host root (`GET /`), the `/:slug` agent routes, and the admin-host `/public` / `/public-chat` previews all serve one shell, `public.html` → [`app/public-entry.tsx`](../../../ui/app/public-entry.tsx) → `PublicChat`. `PublicChat` reuses `useSession` purely as the magic-link gatekeeper — it drives `AccessGate`, resolves the agent slug from the path, and handles `?token=` verification; once the grant is satisfied it mounts `ChatSurface variant="public"`, whose transcript reads the visitor-scoped, **delivered-only** stream `GET /api/public-reader/stream` ([`server/routes/public-reader.ts`](../../../ui/server/routes/public-reader.ts)) — the visitor sees the agent's delivered prose, never the tool/tool-result/directive bytes the legacy `/api/chat` SSE render exposed. The human visitor's branding is resolved client-side by `useSession`. For the head only, the server injects per-agent link-preview meta — `<title>`, `og:title`/`og:description`/`og:image`, `theme-color`, and a per-agent favicon, resolved from the same branding cache `useSession` reads — into the served shell, so a link-preview crawler (which never runs the client bundle) gets a branded card per agent instead of one generic shell; an agent with no branding cache gets the clean brand-default shell with no empty meta tags. There is exactly one public client surface and it is 1:1 visitor↔agent: the earlier `?surface=next` A/B handle is retired, group messaging is retired (not a supported product surface), and a former `/g/<slug>` group URL now serves the same 1:1 shell — a stale bookmark gets the 1:1 chat, never a broken render.
 
+### Routines
+
+The Routines surface (`/routines`) is the admin view of the account's
+automation `:Event` nodes — the device's scheduled agent turns and tool
+dispatches, which the Calendar surface deliberately excludes (`calendar.ts`
+unions only appointment events, `actionPlugin IS NULL`). It renders one card per
+routine (title, human-readable schedule, next run, channel/destination or tool,
+status); a card opens a detail modal modeled on the calendar `EventDetailModal`.
+The modal edits the prose instruction (`agentPrompt`, agent-dispatch routines
+only) and the schedule via a friendly builder (frequency daily/weekly/monthly,
+day-of-week, day-of-month, time) that falls back to a raw-cron field for patterns
+it cannot represent.
+
+The route (`server/routes/admin/routines.ts`) is account-scoped like `calendar.ts`
+(a foreign-account or non-automation `eventId` 404s):
+
+| Route | Behaviour |
+|-------|-----------|
+| `GET /api/admin/routines` | Lists automation Events: `recurrence IS NOT NULL OR agentChannel IS NOT NULL OR actionPlugin IS NOT NULL`. Keyed by the `eventId` property. |
+| `GET /api/admin/routines/:eventId` | One routine, same automation+account guard. |
+| `PATCH /api/admin/routines/:eventId` | Edits `agentPrompt` and/or `recurrence`. Cron validation and the timezone-aware `nextRun` recompute copy the scheduling plugin's `schedule-update` tool. An invalid cron is rejected 400 with no write. Only creation and deletion stay agent-only (`schedule-event`/`schedule-cancel`). |
+
+Observability rides `[admin:routines]`: `op=list accountId=<8> count=<n>`,
+`op=get id=<8> found=<bool>`, and `op=patch id=<8> fields=<…> outcome=ok|rejected
+reason=<invalid-cron|not-found> nextRun=<…> cron=<serialized>`. A `count=0` while
+routines exist for the account is the account-scope-miss signature; the logged
+`cron=` on `outcome=ok` confirms the persisted expression without opening the
+graph.
+
 ### Graph
 
 | Mount | Purpose |
@@ -3298,12 +3347,13 @@ authoritative. This section names the surfaces and what backs each.
 > owns all navigation; the full-width top header bar, the burger flyout, and the
 > "Powered by Claude Code" footer strip are retired. After the redesign:
 >
-> - **Nav rows** are Dashboard, Chat, Tasks, Calendar, Data, the brand container
->   row (Projects / Properties / Jobs, opening the graph filtered to the brand's
->   primary container), Graph (the unfiltered whole graph at `/graph`, waypoints
->   icon — active on plain `/graph`; the container row is active only when a
->   `label=` filter is present), Activity, and Browser. The active row carries an
->   accent left indicator. The older People / Agents / Artefacts entries in the
+> - **Nav rows** are Dashboard, Chat, Tasks, Calendar, Routines (the automation
+>   `:Event` nodes at `/routines`, `Zap` icon), Data, the brand container
+>   row (Projects / Properties / Jobs, `Folder` icon, opening the graph filtered
+>   to the brand's primary container), Graph (the unfiltered whole graph at
+>   `/graph`, waypoints icon — active on plain `/graph`; the container row is
+>   active only when a `label=` filter is present), Activity, and Browser. The
+>   active row carries an accent left indicator. The older People / Agents / Artefacts entries in the
 >   table below are pre-redesign.
 > - **Dashboard home** renders on `/` (a greeting, stat cards, a Live-now column,
 >   a Recent artefacts card, and a Channels column), consuming existing endpoints
@@ -3312,10 +3362,20 @@ authoritative. This section names the surfaces and what backs each.
 >   the sidebar collapse toggle, the page title, and a Claude status pill on the
 >   right (Connected / Connect, driven by `/api/health`). The pill replaces the
 >   retired burger Disconnect visibility and footer strip.
-> - **Account kebab.** The version / Connect-Disconnect / Change PIN / Switch
->   account / Log out items moved from the burger onto a kebab on the sidebar user
->   footer (`AccountMenu`, extracted from the old `HeaderMenu`; the operator
->   variant still mounts `AccountMenu` for its reduced set).
+> - **Account kebab.** The version / Connect-Disconnect / Change PIN / Log out
+>   items moved from the burger onto a kebab on the sidebar user footer
+>   (`AccountMenu`, extracted from the old `HeaderMenu`; the operator variant
+>   still mounts `AccountMenu` for its reduced set).
+> - **Sub-account switcher on the brand head.** The head at the top of the sidebar
+>   splits into two controls when the install has more than one sub-account: the
+>   brand icon jumps straight to the house account, and the name plus chevron
+>   opens the `SubAccountPicker` directly beneath the head (an outside click or a
+>   second click on the name closes it). Clicking the icon while already on the
+>   house account does nothing. A single-account install shows the same head as a
+>   plain, non-interactive lockup, and the collapsed rail hides both controls. The
+>   switcher used to sit in the account kebab; it no longer does. The switch
+>   navigation itself (`useSubAccountSwitcher`, dropping the `?session=` param) is
+>   unchanged.
 > - **Mobile (< 720px).** The sidebar opens as a drawer from a 44x44 header menu
 >   button, and a fixed bottom tab bar (Home, Chat, Tasks, Data, Calendar) sits
 >   under the content; Graph, Activity, and Browser stay reachable through the

package/payload/platform/plugins/docs/references/admin-ui.md

@@ -89,6 +89,35 @@ either is a regression.
 
 **Public visitor surface.** The public-host root (`GET /`), the `/:slug` agent routes, and the admin-host `/public` / `/public-chat` previews all serve one shell, `public.html` → [`app/public-entry.tsx`](../../../ui/app/public-entry.tsx) → `PublicChat`. `PublicChat` reuses `useSession` purely as the magic-link gatekeeper — it drives `AccessGate`, resolves the agent slug from the path, and handles `?token=` verification; once the grant is satisfied it mounts `ChatSurface variant="public"`, whose transcript reads the visitor-scoped, **delivered-only** stream `GET /api/public-reader/stream` ([`server/routes/public-reader.ts`](../../../ui/server/routes/public-reader.ts)) — the visitor sees the agent's delivered prose, never the tool/tool-result/directive bytes the legacy `/api/chat` SSE render exposed. The human visitor's branding is resolved client-side by `useSession`. For the head only, the server injects per-agent link-preview meta — `<title>`, `og:title`/`og:description`/`og:image`, `theme-color`, and a per-agent favicon, resolved from the same branding cache `useSession` reads — into the served shell, so a link-preview crawler (which never runs the client bundle) gets a branded card per agent instead of one generic shell; an agent with no branding cache gets the clean brand-default shell with no empty meta tags. There is exactly one public client surface and it is 1:1 visitor↔agent: the earlier `?surface=next` A/B handle is retired, group messaging is retired (not a supported product surface), and a former `/g/<slug>` group URL now serves the same 1:1 shell — a stale bookmark gets the 1:1 chat, never a broken render.
 
+### Routines
+
+The Routines surface (`/routines`) is the admin view of the account's
+automation `:Event` nodes — the device's scheduled agent turns and tool
+dispatches, which the Calendar surface deliberately excludes (`calendar.ts`
+unions only appointment events, `actionPlugin IS NULL`). It renders one card per
+routine (title, human-readable schedule, next run, channel/destination or tool,
+status); a card opens a detail modal modeled on the calendar `EventDetailModal`.
+The modal edits the prose instruction (`agentPrompt`, agent-dispatch routines
+only) and the schedule via a friendly builder (frequency daily/weekly/monthly,
+day-of-week, day-of-month, time) that falls back to a raw-cron field for patterns
+it cannot represent.
+
+The route (`server/routes/admin/routines.ts`) is account-scoped like `calendar.ts`
+(a foreign-account or non-automation `eventId` 404s):
+
+| Route | Behaviour |
+|-------|-----------|
+| `GET /api/admin/routines` | Lists automation Events: `recurrence IS NOT NULL OR agentChannel IS NOT NULL OR actionPlugin IS NOT NULL`. Keyed by the `eventId` property. |
+| `GET /api/admin/routines/:eventId` | One routine, same automation+account guard. |
+| `PATCH /api/admin/routines/:eventId` | Edits `agentPrompt` and/or `recurrence`. Cron validation and the timezone-aware `nextRun` recompute copy the scheduling plugin's `schedule-update` tool. An invalid cron is rejected 400 with no write. Only creation and deletion stay agent-only (`schedule-event`/`schedule-cancel`). |
+
+Observability rides `[admin:routines]`: `op=list accountId=<8> count=<n>`,
+`op=get id=<8> found=<bool>`, and `op=patch id=<8> fields=<…> outcome=ok|rejected
+reason=<invalid-cron|not-found> nextRun=<…> cron=<serialized>`. A `count=0` while
+routines exist for the account is the account-scope-miss signature; the logged
+`cron=` on `outcome=ok` confirms the persisted expression without opening the
+graph.
+
 ### Graph
 
 | Mount | Purpose |
@@ -397,12 +426,13 @@ authoritative. This section names the surfaces and what backs each.
 > owns all navigation; the full-width top header bar, the burger flyout, and the
 > "Powered by Claude Code" footer strip are retired. After the redesign:
 >
-> - **Nav rows** are Dashboard, Chat, Tasks, Calendar, Data, the brand container
->   row (Projects / Properties / Jobs, opening the graph filtered to the brand's
->   primary container), Graph (the unfiltered whole graph at `/graph`, waypoints
->   icon — active on plain `/graph`; the container row is active only when a
->   `label=` filter is present), Activity, and Browser. The active row carries an
->   accent left indicator. The older People / Agents / Artefacts entries in the
+> - **Nav rows** are Dashboard, Chat, Tasks, Calendar, Routines (the automation
+>   `:Event` nodes at `/routines`, `Zap` icon), Data, the brand container
+>   row (Projects / Properties / Jobs, `Folder` icon, opening the graph filtered
+>   to the brand's primary container), Graph (the unfiltered whole graph at
+>   `/graph`, waypoints icon — active on plain `/graph`; the container row is
+>   active only when a `label=` filter is present), Activity, and Browser. The
+>   active row carries an accent left indicator. The older People / Agents / Artefacts entries in the
 >   table below are pre-redesign.
 > - **Dashboard home** renders on `/` (a greeting, stat cards, a Live-now column,
 >   a Recent artefacts card, and a Channels column), consuming existing endpoints
@@ -411,10 +441,20 @@ authoritative. This section names the surfaces and what backs each.
 >   the sidebar collapse toggle, the page title, and a Claude status pill on the
 >   right (Connected / Connect, driven by `/api/health`). The pill replaces the
 >   retired burger Disconnect visibility and footer strip.
-> - **Account kebab.** The version / Connect-Disconnect / Change PIN / Switch
->   account / Log out items moved from the burger onto a kebab on the sidebar user
->   footer (`AccountMenu`, extracted from the old `HeaderMenu`; the operator
->   variant still mounts `AccountMenu` for its reduced set).
+> - **Account kebab.** The version / Connect-Disconnect / Change PIN / Log out
+>   items moved from the burger onto a kebab on the sidebar user footer
+>   (`AccountMenu`, extracted from the old `HeaderMenu`; the operator variant
+>   still mounts `AccountMenu` for its reduced set).
+> - **Sub-account switcher on the brand head.** The head at the top of the sidebar
+>   splits into two controls when the install has more than one sub-account: the
+>   brand icon jumps straight to the house account, and the name plus chevron
+>   opens the `SubAccountPicker` directly beneath the head (an outside click or a
+>   second click on the name closes it). Clicking the icon while already on the
+>   house account does nothing. A single-account install shows the same head as a
+>   plain, non-interactive lockup, and the collapsed rail hides both controls. The
+>   switcher used to sit in the account kebab; it no longer does. The switch
+>   navigation itself (`useSubAccountSwitcher`, dropping the `?session=` param) is
+>   unchanged.
 > - **Mobile (< 720px).** The sidebar opens as a drawer from a 44x44 header menu
 >   button, and a fixed bottom tab bar (Home, Chat, Tasks, Data, Calendar) sits
 >   under the content; Graph, Activity, and Browser stay reachable through the