@rubytech/create-maxy-code 0.1.505 → 0.1.506

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.505",
+  "version": "0.1.506",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/lib/account-schema-regions/dist/index.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Parser for the three machine-readable regions of an account's SCHEMA.md.
+ *
+ * Shared because two separate builds need the same answer: the admin UI server
+ * (platform/ui/server/lib/account-root-groups.ts, which groups the /data root
+ * into home/system) and the session manager's standing schema reconcile
+ * (platform/services/claude-session-manager/src/account-dir-schema-reconcile.ts,
+ * which audits declared-versus-on-disk parity). A third reader,
+ * platform/plugins/cloudflare/bin/schema-exposed-dirs.mjs, ships in a separate
+ * deploy tree and keeps its own copy; a parity test asserts the two agree.
+ *
+ * The regions are written by platform/scripts/lib/account-schema-owned-dirs.py
+ * merge(). Their separators differ:
+ *
+ *   ontology roots:  - `jobs/` - one folder per Job record.      (ASCII hyphen)
+ *   plugin-owned:    - `pages/` — Owned by the … plugin.         (em dash)
+ *
+ * .docs/data-portal-folder-index.md records that parsing the ontology region on
+ * the wrong separator matches nothing and reads as "this account has no
+ * deliverables". This parser sidesteps that failure entirely by anchoring on the
+ * backticked `dir/` head rather than the separator, and a test pins the
+ * behaviour so a future edit cannot reintroduce separator sensitivity.
+ */
+/**
+ * Operator-data buckets from the shipped template
+ * (platform/templates/account-schema/SCHEMA.md). They carry no ontology row
+ * because they are not entity buckets, but they hold the operator's own data,
+ * so they are home on every brand. On a vertical with no `## Top-level node
+ * types` table (schema-knowledge-work) they are the whole of home.
+ *
+ * Lives here rather than in either consumer because both the /data page and the
+ * standing reconcile audit must agree on the same set; a hand-synced copy in
+ * each build is precisely the drift this shared module exists to prevent.
+ */
+export declare const HOME_FIXED: readonly string[];
+export interface SchemaRegions {
+    /** Root bucket dirs from the ontology region, in table order, deduped. */
+    ontologyRoots: string[];
+    /** Dirs from the plugin-owned region, in file order, deduped. */
+    pluginOwned: string[];
+    /** Entries of the ```allowed-top-level fence, in file order. */
+    allowedTopLevel: string[];
+    /**
+     * True when the allowed-top-level fence was found with at least one entry.
+     * That fence is present in every valid account SCHEMA.md (it ships in
+     * platform/templates/account-schema/SCHEMA.md), so its absence means the file
+     * is missing or not an account schema. An EMPTY ontology region is NOT a
+     * parse failure: a vertical with no `## Top-level node types` table (for
+     * example schema-knowledge-work) legitimately projects no buckets.
+     */
+    parsed: boolean;
+    /**
+     * Why `parsed` is false, for the caller's log line. The two states need
+     * different remediation — provision the account versus regenerate its schema
+     * — so a single `status=parse-failed` cannot be acted on.
+     */
+    reason: 'ok' | 'schema-absent' | 'fence-absent';
+}
+export declare function parseSchemaRegions(schemaMd: string | null): SchemaRegions;
+//# sourceMappingURL=index.d.ts.map

package/payload/platform/lib/account-schema-regions/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,UAAU,EAAE,SAAS,MAAM,EAAyD,CAAA;AAiBjG,MAAM,WAAW,aAAa;IAC5B,0EAA0E;IAC1E,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,iEAAiE;IACjE,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,gEAAgE;IAChE,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB;;;;;;;OAOG;IACH,MAAM,EAAE,OAAO,CAAA;IACf;;;;OAIG;IACH,MAAM,EAAE,IAAI,GAAG,eAAe,GAAG,cAAc,CAAA;CAChD;AAiCD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,aAAa,CAazE"}

package/payload/platform/lib/account-schema-regions/dist/index.js

@@ -0,0 +1,101 @@
+"use strict";
+/**
+ * Parser for the three machine-readable regions of an account's SCHEMA.md.
+ *
+ * Shared because two separate builds need the same answer: the admin UI server
+ * (platform/ui/server/lib/account-root-groups.ts, which groups the /data root
+ * into home/system) and the session manager's standing schema reconcile
+ * (platform/services/claude-session-manager/src/account-dir-schema-reconcile.ts,
+ * which audits declared-versus-on-disk parity). A third reader,
+ * platform/plugins/cloudflare/bin/schema-exposed-dirs.mjs, ships in a separate
+ * deploy tree and keeps its own copy; a parity test asserts the two agree.
+ *
+ * The regions are written by platform/scripts/lib/account-schema-owned-dirs.py
+ * merge(). Their separators differ:
+ *
+ *   ontology roots:  - `jobs/` - one folder per Job record.      (ASCII hyphen)
+ *   plugin-owned:    - `pages/` — Owned by the … plugin.         (em dash)
+ *
+ * .docs/data-portal-folder-index.md records that parsing the ontology region on
+ * the wrong separator matches nothing and reads as "this account has no
+ * deliverables". This parser sidesteps that failure entirely by anchoring on the
+ * backticked `dir/` head rather than the separator, and a test pins the
+ * behaviour so a future edit cannot reintroduce separator sensitivity.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HOME_FIXED = void 0;
+exports.parseSchemaRegions = parseSchemaRegions;
+/**
+ * Operator-data buckets from the shipped template
+ * (platform/templates/account-schema/SCHEMA.md). They carry no ontology row
+ * because they are not entity buckets, but they hold the operator's own data,
+ * so they are home on every brand. On a vertical with no `## Top-level node
+ * types` table (schema-knowledge-work) they are the whole of home.
+ *
+ * Lives here rather than in either consumer because both the /data page and the
+ * standing reconcile audit must agree on the same set; a hand-synced copy in
+ * each build is precisely the drift this shared module exists to prevent.
+ */
+exports.HOME_FIXED = Object.freeze(['projects', 'contacts', 'documents']);
+const ONT_START = '<!-- ontology-buckets:start -->';
+const ONT_END = '<!-- ontology-buckets:end -->';
+const PLUGIN_START = '<!-- plugin-owned-dirs:start -->';
+const PLUGIN_END = '<!-- plugin-owned-dirs:end -->';
+const ALLOWED_FENCE = '```allowed-top-level';
+/**
+ * A region line declaring a directory: `- \`<dir>/\` …`. The trailing slash
+ * inside the backticks is what excludes a nested-entity line
+ * (`- \`Quote\` records live under \`jobs/\` …`), whose first backtick span is a
+ * bare label. Anything after the closing backtick is ignored, so both
+ * separators parse.
+ */
+const DIR_LINE = /^-\s+`([^`/]+)\/`/;
+function regionLines(text, start, end) {
+    const from = text.indexOf(start);
+    if (from === -1)
+        return [];
+    const to = text.indexOf(end, from);
+    if (to === -1)
+        return [];
+    return text.slice(from + start.length, to).split('\n');
+}
+function dirsIn(lines) {
+    const out = [];
+    for (const line of lines) {
+        const m = DIR_LINE.exec(line.trim());
+        if (m && !out.includes(m[1]))
+            out.push(m[1]);
+    }
+    return out;
+}
+function fenceEntries(text) {
+    const from = text.indexOf(ALLOWED_FENCE);
+    if (from === -1)
+        return [];
+    const bodyStart = text.indexOf('\n', from);
+    if (bodyStart === -1)
+        return [];
+    const to = text.indexOf('```', bodyStart);
+    if (to === -1)
+        return [];
+    return text
+        .slice(bodyStart + 1, to)
+        .split('\n')
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0);
+}
+function parseSchemaRegions(schemaMd) {
+    if (schemaMd === null || schemaMd.length === 0) {
+        return { ontologyRoots: [], pluginOwned: [], allowedTopLevel: [], parsed: false, reason: 'schema-absent' };
+    }
+    const allowedTopLevel = fenceEntries(schemaMd);
+    const parsed = allowedTopLevel.length > 0;
+    return {
+        ontologyRoots: dirsIn(regionLines(schemaMd, ONT_START, ONT_END)),
+        pluginOwned: dirsIn(regionLines(schemaMd, PLUGIN_START, PLUGIN_END)),
+        allowedTopLevel,
+        parsed,
+        reason: parsed ? 'ok' : 'fence-absent',
+    };
+}
+//# sourceMappingURL=index.js.map

package/payload/platform/lib/account-schema-regions/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;;;AAqFH,gDAaC;AAhGD;;;;;;;;;;GAUG;AACU,QAAA,UAAU,GAAsB,MAAM,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAA;AAEjG,MAAM,SAAS,GAAG,iCAAiC,CAAA;AACnD,MAAM,OAAO,GAAG,+BAA+B,CAAA;AAC/C,MAAM,YAAY,GAAG,kCAAkC,CAAA;AACvD,MAAM,UAAU,GAAG,gCAAgC,CAAA;AACnD,MAAM,aAAa,GAAG,sBAAsB,CAAA;AAE5C;;;;;;GAMG;AACH,MAAM,QAAQ,GAAG,mBAAmB,CAAA;AA0BpC,SAAS,WAAW,CAAC,IAAY,EAAE,KAAa,EAAE,GAAW;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAChC,IAAI,IAAI,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,CAAA;IAC1B,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAClC,IAAI,EAAE,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,CAAA;IACxB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;AACxD,CAAC;AAED,SAAS,MAAM,CAAC,KAAe;IAC7B,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC9C,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;IACxC,IAAI,IAAI,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,CAAA;IAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IAC1C,IAAI,SAAS,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,CAAA;IAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IACzC,IAAI,EAAE,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,CAAA;IACxB,OAAO,IAAI;SACR,KAAK,CAAC,SAAS,GAAG,CAAC,EAAE,EAAE,CAAC;SACxB,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;AAChC,CAAC;AAED,SAAgB,kBAAkB,CAAC,QAAuB;IACxD,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/C,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;IAC5G,CAAC;IACD,MAAM,eAAe,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAA;IAC9C,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,GAAG,CAAC,CAAA;IACzC,OAAO;QACL,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAChE,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;QACpE,eAAe;QACf,MAAM;QACN,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc;KACvC,CAAA;AACH,CAAC"}

package/payload/platform/lib/account-schema-regions/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "@maxy/account-schema-regions",
+  "version": "0.1.0",
+  "private": true,
+  "type": "commonjs",
+  "main": "dist/index.js"
+}

package/payload/platform/lib/account-schema-regions/src/index.ts

@@ -0,0 +1,121 @@
+/**
+ * Parser for the three machine-readable regions of an account's SCHEMA.md.
+ *
+ * Shared because two separate builds need the same answer: the admin UI server
+ * (platform/ui/server/lib/account-root-groups.ts, which groups the /data root
+ * into home/system) and the session manager's standing schema reconcile
+ * (platform/services/claude-session-manager/src/account-dir-schema-reconcile.ts,
+ * which audits declared-versus-on-disk parity). A third reader,
+ * platform/plugins/cloudflare/bin/schema-exposed-dirs.mjs, ships in a separate
+ * deploy tree and keeps its own copy; a parity test asserts the two agree.
+ *
+ * The regions are written by platform/scripts/lib/account-schema-owned-dirs.py
+ * merge(). Their separators differ:
+ *
+ *   ontology roots:  - `jobs/` - one folder per Job record.      (ASCII hyphen)
+ *   plugin-owned:    - `pages/` — Owned by the … plugin.         (em dash)
+ *
+ * .docs/data-portal-folder-index.md records that parsing the ontology region on
+ * the wrong separator matches nothing and reads as "this account has no
+ * deliverables". This parser sidesteps that failure entirely by anchoring on the
+ * backticked `dir/` head rather than the separator, and a test pins the
+ * behaviour so a future edit cannot reintroduce separator sensitivity.
+ */
+
+/**
+ * Operator-data buckets from the shipped template
+ * (platform/templates/account-schema/SCHEMA.md). They carry no ontology row
+ * because they are not entity buckets, but they hold the operator's own data,
+ * so they are home on every brand. On a vertical with no `## Top-level node
+ * types` table (schema-knowledge-work) they are the whole of home.
+ *
+ * Lives here rather than in either consumer because both the /data page and the
+ * standing reconcile audit must agree on the same set; a hand-synced copy in
+ * each build is precisely the drift this shared module exists to prevent.
+ */
+export const HOME_FIXED: readonly string[] = Object.freeze(['projects', 'contacts', 'documents'])
+
+const ONT_START = '<!-- ontology-buckets:start -->'
+const ONT_END = '<!-- ontology-buckets:end -->'
+const PLUGIN_START = '<!-- plugin-owned-dirs:start -->'
+const PLUGIN_END = '<!-- plugin-owned-dirs:end -->'
+const ALLOWED_FENCE = '```allowed-top-level'
+
+/**
+ * A region line declaring a directory: `- \`<dir>/\` …`. The trailing slash
+ * inside the backticks is what excludes a nested-entity line
+ * (`- \`Quote\` records live under \`jobs/\` …`), whose first backtick span is a
+ * bare label. Anything after the closing backtick is ignored, so both
+ * separators parse.
+ */
+const DIR_LINE = /^-\s+`([^`/]+)\/`/
+
+export interface SchemaRegions {
+  /** Root bucket dirs from the ontology region, in table order, deduped. */
+  ontologyRoots: string[]
+  /** Dirs from the plugin-owned region, in file order, deduped. */
+  pluginOwned: string[]
+  /** Entries of the ```allowed-top-level fence, in file order. */
+  allowedTopLevel: string[]
+  /**
+   * True when the allowed-top-level fence was found with at least one entry.
+   * That fence is present in every valid account SCHEMA.md (it ships in
+   * platform/templates/account-schema/SCHEMA.md), so its absence means the file
+   * is missing or not an account schema. An EMPTY ontology region is NOT a
+   * parse failure: a vertical with no `## Top-level node types` table (for
+   * example schema-knowledge-work) legitimately projects no buckets.
+   */
+  parsed: boolean
+  /**
+   * Why `parsed` is false, for the caller's log line. The two states need
+   * different remediation — provision the account versus regenerate its schema
+   * — so a single `status=parse-failed` cannot be acted on.
+   */
+  reason: 'ok' | 'schema-absent' | 'fence-absent'
+}
+
+function regionLines(text: string, start: string, end: string): string[] {
+  const from = text.indexOf(start)
+  if (from === -1) return []
+  const to = text.indexOf(end, from)
+  if (to === -1) return []
+  return text.slice(from + start.length, to).split('\n')
+}
+
+function dirsIn(lines: string[]): string[] {
+  const out: string[] = []
+  for (const line of lines) {
+    const m = DIR_LINE.exec(line.trim())
+    if (m && !out.includes(m[1])) out.push(m[1])
+  }
+  return out
+}
+
+function fenceEntries(text: string): string[] {
+  const from = text.indexOf(ALLOWED_FENCE)
+  if (from === -1) return []
+  const bodyStart = text.indexOf('\n', from)
+  if (bodyStart === -1) return []
+  const to = text.indexOf('```', bodyStart)
+  if (to === -1) return []
+  return text
+    .slice(bodyStart + 1, to)
+    .split('\n')
+    .map((s) => s.trim())
+    .filter((s) => s.length > 0)
+}
+
+export function parseSchemaRegions(schemaMd: string | null): SchemaRegions {
+  if (schemaMd === null || schemaMd.length === 0) {
+    return { ontologyRoots: [], pluginOwned: [], allowedTopLevel: [], parsed: false, reason: 'schema-absent' }
+  }
+  const allowedTopLevel = fenceEntries(schemaMd)
+  const parsed = allowedTopLevel.length > 0
+  return {
+    ontologyRoots: dirsIn(regionLines(schemaMd, ONT_START, ONT_END)),
+    pluginOwned: dirsIn(regionLines(schemaMd, PLUGIN_START, PLUGIN_END)),
+    allowedTopLevel,
+    parsed,
+    reason: parsed ? 'ok' : 'fence-absent',
+  }
+}

package/payload/platform/lib/account-schema-regions/tsconfig.json

@@ -0,0 +1,9 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "dist",
+    "rootDir": "src"
+  },
+  "include": ["src"],
+  "exclude": ["src/**/*.test.ts"]
+}

package/payload/platform/package.json

@@ -6,8 +6,8 @@
     "services/*"
   ],
   "scripts": {
-    "build": "tsc -p lib/models/tsconfig.json && tsc -p lib/mcp-spawn-tee/tsconfig.json && tsc -p lib/mcp-lifeline/tsconfig.json && tsc -p lib/mcp-eager/tsconfig.json && tsc -p lib/account-enumeration/tsconfig.json && tsc -p lib/account-scope/tsconfig.json && tsc -p lib/graph-write/tsconfig.json && tsc -p lib/ledger-core/tsconfig.json && tsc -p lib/embed-client/tsconfig.json && tsc -p lib/graph-mcp/tsconfig.json && tsc -p lib/graph-trash/tsconfig.json && tsc -p lib/active-rules/tsconfig.json && tsc -p lib/admin-conversation-purge/tsconfig.json && tsc -p lib/graph-search/tsconfig.json && tsc -p lib/graph-style/tsconfig.json && tsc -p lib/device-url/tsconfig.json && tsc -p lib/brand-templating/tsconfig.json && tsc -p lib/entitlement/tsconfig.json && tsc -p lib/task-secrets/tsconfig.json && tsc -p lib/admins-write/tsconfig.json && tsc -p lib/admin-access-password/tsconfig.json && tsc -p lib/persistent-components/tsconfig.json && tsc -p lib/require-port-env/tsconfig.json && tsc -p lib/aeo-llms-txt-writer/tsconfig.json && tsc -p lib/obsidian-parser/tsconfig.json && tsc -p lib/storage-broker/tsconfig.json && tsc -p services/claude-session-manager/tsconfig.json && tsc -p services/whatsapp-channel/tsconfig.json && tsc -p services/webchat-channel/tsconfig.json && tsc -p services/telegram-channel/tsconfig.json && NODE_OPTIONS='--max-old-space-size=8192' tsc -b plugins/*/mcp/tsconfig.json",
-    "build:lib": "tsc -p lib/models/tsconfig.json && tsc -p lib/mcp-spawn-tee/tsconfig.json && tsc -p lib/mcp-lifeline/tsconfig.json && tsc -p lib/mcp-eager/tsconfig.json && tsc -p lib/account-enumeration/tsconfig.json && tsc -p lib/account-scope/tsconfig.json && tsc -p lib/graph-write/tsconfig.json && tsc -p lib/ledger-core/tsconfig.json && tsc -p lib/embed-client/tsconfig.json && tsc -p lib/graph-mcp/tsconfig.json && tsc -p lib/graph-trash/tsconfig.json && tsc -p lib/active-rules/tsconfig.json && tsc -p lib/admin-conversation-purge/tsconfig.json && tsc -p lib/graph-search/tsconfig.json && tsc -p lib/graph-style/tsconfig.json && tsc -p lib/device-url/tsconfig.json && tsc -p lib/brand-templating/tsconfig.json && tsc -p lib/entitlement/tsconfig.json && tsc -p lib/task-secrets/tsconfig.json && tsc -p lib/admins-write/tsconfig.json && tsc -p lib/admin-access-password/tsconfig.json && tsc -p lib/persistent-components/tsconfig.json && tsc -p lib/require-port-env/tsconfig.json && tsc -p lib/aeo-llms-txt-writer/tsconfig.json && tsc -p lib/obsidian-parser/tsconfig.json && tsc -p lib/storage-broker/tsconfig.json",
+    "build": "tsc -p lib/account-schema-regions/tsconfig.json && tsc -p lib/models/tsconfig.json && tsc -p lib/mcp-spawn-tee/tsconfig.json && tsc -p lib/mcp-lifeline/tsconfig.json && tsc -p lib/mcp-eager/tsconfig.json && tsc -p lib/account-enumeration/tsconfig.json && tsc -p lib/account-scope/tsconfig.json && tsc -p lib/graph-write/tsconfig.json && tsc -p lib/ledger-core/tsconfig.json && tsc -p lib/embed-client/tsconfig.json && tsc -p lib/graph-mcp/tsconfig.json && tsc -p lib/graph-trash/tsconfig.json && tsc -p lib/active-rules/tsconfig.json && tsc -p lib/admin-conversation-purge/tsconfig.json && tsc -p lib/graph-search/tsconfig.json && tsc -p lib/graph-style/tsconfig.json && tsc -p lib/device-url/tsconfig.json && tsc -p lib/brand-templating/tsconfig.json && tsc -p lib/entitlement/tsconfig.json && tsc -p lib/task-secrets/tsconfig.json && tsc -p lib/admins-write/tsconfig.json && tsc -p lib/admin-access-password/tsconfig.json && tsc -p lib/persistent-components/tsconfig.json && tsc -p lib/require-port-env/tsconfig.json && tsc -p lib/aeo-llms-txt-writer/tsconfig.json && tsc -p lib/obsidian-parser/tsconfig.json && tsc -p lib/storage-broker/tsconfig.json && tsc -p services/claude-session-manager/tsconfig.json && tsc -p services/whatsapp-channel/tsconfig.json && tsc -p services/webchat-channel/tsconfig.json && tsc -p services/telegram-channel/tsconfig.json && NODE_OPTIONS='--max-old-space-size=8192' tsc -b plugins/*/mcp/tsconfig.json",
+    "build:lib": "tsc -p lib/account-schema-regions/tsconfig.json && tsc -p lib/models/tsconfig.json && tsc -p lib/mcp-spawn-tee/tsconfig.json && tsc -p lib/mcp-lifeline/tsconfig.json && tsc -p lib/mcp-eager/tsconfig.json && tsc -p lib/account-enumeration/tsconfig.json && tsc -p lib/account-scope/tsconfig.json && tsc -p lib/graph-write/tsconfig.json && tsc -p lib/ledger-core/tsconfig.json && tsc -p lib/embed-client/tsconfig.json && tsc -p lib/graph-mcp/tsconfig.json && tsc -p lib/graph-trash/tsconfig.json && tsc -p lib/active-rules/tsconfig.json && tsc -p lib/admin-conversation-purge/tsconfig.json && tsc -p lib/graph-search/tsconfig.json && tsc -p lib/graph-style/tsconfig.json && tsc -p lib/device-url/tsconfig.json && tsc -p lib/brand-templating/tsconfig.json && tsc -p lib/entitlement/tsconfig.json && tsc -p lib/task-secrets/tsconfig.json && tsc -p lib/admins-write/tsconfig.json && tsc -p lib/admin-access-password/tsconfig.json && tsc -p lib/persistent-components/tsconfig.json && tsc -p lib/require-port-env/tsconfig.json && tsc -p lib/aeo-llms-txt-writer/tsconfig.json && tsc -p lib/obsidian-parser/tsconfig.json && tsc -p lib/storage-broker/tsconfig.json",
     "gen:canonical-tools": "node scripts/generate-canonical-tool-names.mjs",
     "build:memory": "tsc -p plugins/memory/mcp/tsconfig.json",
     "build:contacts": "tsc -p plugins/contacts/mcp/tsconfig.json",
@@ -22,7 +22,7 @@
     "build:replicate": "tsc -p plugins/replicate/mcp/tsconfig.json",
     "build:graph-viewer": "tsc -p plugins/graph-viewer/mcp/tsconfig.json",
     "build:claude-session-manager": "tsc -p services/claude-session-manager/tsconfig.json",
-  "build:whatsapp-channel": "tsc -p services/whatsapp-channel/tsconfig.json",
+    "build:whatsapp-channel": "tsc -p services/whatsapp-channel/tsconfig.json",
     "build:webchat-channel": "tsc -p services/webchat-channel/tsconfig.json",
     "build:telegram-channel": "tsc -p services/telegram-channel/tsconfig.json"
   },

package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: platform-architecture
 description: Use when grounding any documented-surface claim about what Maxy ships — plugins, skills, specialists, install/deploy flows, internals. This is the install catalogue, not evidence of what is enabled on the current account. For install state on this account, call `capabilities-here`; for documented surface, cite the `Source:` URL inline.
-content-hash: sha256:1c3857d846036719bbed45a9411a5027e90fc1d28d0a6230e2ef6a7f20b645ec
+content-hash: sha256:7e164ac0a4a7c3a6ab0fead2f2f109cb9a4f9e9c89b4761ecdee9c7166dca4ed
 brand: maxy-code
 product-name: Maxy
 ---
@@ -3101,25 +3101,49 @@ kinds, each card tagged `Public` or `Specialist`:
   link.
 
 The former "Public" flyout toggle in the account menu was removed; this page is
-the sole agent surface. The route (`server/routes/admin/agents.ts`) resolves the
-current account via `resolveAccount`; `:slug` params reject `/`, `..`, `\` (the
-traversal guard). A slug containing `--` routes to the specialist branch.
+the sole agent surface.
+
+**Account scope.** The route (`server/routes/admin/agents.ts`) never infers an
+account from device state. The two reads resolve from the caller's admin session
+(`requireAdminSession` + the shared `accountDirForSession` in
+`server/routes/admin/_account-scope.ts`), returning 401 when the session maps to
+no valid account. The two writes carry no admin session (the
+`public-agent-manager` skill calls them), so they take an explicit `accountId`
+query parameter validated against the account list and refuse a missing or
+unknown one with 400 — never defaulting to a resolved account. `:slug` params
+reject `/`, `..`, `\` (the traversal guard); specialist detail is selected by an
+explicit `?plugin=` parameter, not inferred from `--` in the slug.
 
 | Route | Behaviour |
 |-------|-----------|
-| `GET /api/admin/agents` | Lists public `agents/*/` dirs (never the `admin` agent) plus user-created specialists from `plugins/*/agents/*.md`, each row tagged `kind`. Returns `{agents, skipped, specialistsSkipped}` — `skipped` counts public dirs whose `config.json` failed to parse; `specialistsSkipped` counts specialist `.md` files with no parseable `name`. |
-| `GET /api/admin/agents/:slug` | A `--`-free slug returns a public agent's config fields + four owned docs + a `present` map (a missing doc is `''`/`present.<role>=false`, never a 500). A `--` slug returns a specialist's `{kind, model, tools, systemPrompt, skills}`. Unknown 404s. |
-| `DELETE /api/admin/agents/:slug` | Public agents only: removes the dir after `deleteAgentProjection`; refuses the `admin` slug. Loud-fail: a graph-cleanup throw aborts the file removal. |
-
-Observability rides `[admin/agents]`: `op=list agents=<n> specialists=<m>
-skipped=<x> specialistsSkipped=<y>` (the heartbeat — `skipped>0`/`specialistsSkipped>0`
-is a malformed-source signal the page renders as a banner; `specialists=0` with
-user plugins present is the broken-walk signature), `op=detail slug=<…>
-kind=<public|specialist>` (with `present=<comma-list|none>` on the public branch —
-a role absent for an agent expected complete is the missing-doc signature;
-`op=list-specialist-skip plugin=<p> file=<f>` per unreadable specialist), and the
-existing delete lines (`deleted agent "<slug>"` / `graph cleanup failed …
-aborting file removal`).
+| `GET /api/admin/agents` | Session-scoped. Lists the session account's public `agents/*/` dirs (never the `admin` agent) plus its user-created specialists from `plugins/*/agents/*.md`, each row tagged `kind`. Returns `{agents, accountId, skipped, specialistsSkipped}` — `accountId` names the account resolved (the client sends it back on a delete); `skipped` counts public dirs whose `config.json` failed to parse; `specialistsSkipped` counts specialist `.md` files with no parseable `name`. 401 when the session maps to no account. |
+| `GET /api/admin/agents/:slug` | Session-scoped. Without `?plugin=`, returns a public agent's config fields + four owned docs + a `present` map (a missing or unreadable doc is `''`/`present.<role>=false`, never a 500). With `?plugin=`, returns that plugin's specialist `{kind, model, tools, systemPrompt, skills}`. Unknown 404s, 401 as above. |
+| `DELETE /api/admin/agents/:slug?accountId=` | Public agents only, on the named validated account. Removes the dir after `deleteAgentProjection`; refuses the `admin` slug (403) and a missing/unknown `accountId` (400) with no write. Loud-fail: a graph-cleanup throw aborts the file removal. |
+| `POST /api/admin/agents/:slug/project?accountId=` | Re-projects the named account's on-disk agent into the graph. Same `accountId` contract as delete. |
+
+Observability rides `[admin/agents]`, and **every line names the account it acted
+on** (`accountId=<id8>`) — a well-formed answer about the wrong account is
+otherwise indistinguishable from a correct one, which is exactly how an empty
+Agents page survived undiagnosed on a multi-account install.
+
+- `op=list accountId=<id8> agents=<n> specialists=<m> skipped=<x> specialistsSkipped=<y>`
+  — the heartbeat. Compare `accountId` against the account the operator is
+  viewing; `skipped>0`/`specialistsSkipped>0` is a malformed-source signal the
+  page renders as a banner, and `specialists=0` with user plugins present is the
+  broken-walk signature.
+- `op=detail accountId=<id8> slug=<…> kind=<public|specialist>` — with
+  `present=<comma-list|none>` on the public branch, where a role absent for an
+  agent expected complete is the missing-doc signature. One
+  `op=list-specialist-skip plugin=<p> file=<f>` per unreadable specialist.
+- `op=<list|detail> auth-rejected reason=no-account-for-session` — the session
+  maps to no valid account. No `op=list` line at all for a page load means the
+  request never reached the handler, a distinct signature from a zero count.
+- `op=<delete|project> rejected reason=<missing-accountId|unknown-accountId>` —
+  a caller that did not name its account. A skill that was not updated produces
+  this on its first call instead of writing to the wrong account.
+- `op=delete accountId=<id8> slug=<…> outcome=<ok|failed>` with
+  `reason=<graph-cleanup-failed|rm-error>` on failure (files preserved on a
+  graph-cleanup throw).
 
 ### Graph
 
@@ -3253,6 +3277,24 @@ the Web Share API and is disabled where unavailable. Signals:
 `[data-ui] op=mount header=operator home=absent`, `op=select-enter`,
 `op=select-exit reason=<cancel|action>`, `op=share supported=<bool> count=<n>`.
 
+**`/data` opens on the account's own folders, as cards.** With no `#path=` in
+the URL the browser lands on **home**: the account's business folders (the
+entity folders of its trade, plus `projects`, `contacts` and `documents`) shown
+one per card, each listing the first 20 things inside it and a `+N more` row
+past that. Tapping a card opens that folder in the ordinary list or grid. There
+are never loose files at this level. Everything the platform and its plugins
+keep for themselves — caches, logs, published sites, plugin workspaces, hidden
+folders — sits behind a single **system** card at the end, and opens as the
+ordinary list too. The split comes from the account's own `SCHEMA.md`, so it
+follows the graph ontology rather than a hardcoded list, and nothing moves on
+disk. Upload and New folder are disabled on the cards view because it names no
+single folder to write into; open a folder first. The flat account root is still
+reachable from the account name in the breadcrumb, which is the way back if a
+folder is ever grouped wrongly. Signals: `[data-schema] op=classify` on every
+account-root listing (`home=`, `system=`, `unknown=`, `status=ok|parse-failed`),
+`op=home-files` when a name that should be a folder is a file, and
+`op=card-children … status=error` when one card's folder could not be read.
+
 **`/data` list ↔ grid view + image thumbnails.** A toolbar toggle switches the
 file browser between the two-line list and a **grid**. In grid view, image
 files render an inline thumbnail; folders render a folder tile (still navigate

package/payload/platform/plugins/admin/skills/public-agent-manager/SKILL.md

@@ -176,7 +176,7 @@ After creation, no template metadata persists in the agent's files. The resultin
 8. **KNOWLEDGE.md generation** — populate from the now-tagged set plus keyword matches using the `update-knowledge` skill workflow. KNOWLEDGE.md is required and must be non-empty; an empty or missing KNOWLEDGE is refused at spawn.
 9. Write `config.json` with selected model, status "active", and `knowledgeKeywords`. This is the last gated write — placed after IDENTITY.md, SOUL.md, and KNOWLEDGE.md to prevent cascade failure if one gate stalls.
 10. Check context budget — auto-summarise if over threshold
-11. **Project the agent into the graph** — delegate to the `specialists:database-operator` specialist with the instruction: "Project public agent `{slug}` into the graph by POSTing to `/api/admin/agents/{slug}/project`." The route reads the on-disk files and idempotently MERGEs the `:Agent` node, the four owned `:KnowledgeDocument` projections (IDENTITY/SOUL/KNOWLEDGE/KNOWLEDGE-SUMMARY when present, namespaced `attachmentId="agent:<slug>:<role>"`), the `HAS_*` edges, and the `USES_KNOWLEDGE` edges to every operator-tagged doc. Loud-fail: if the route returns non-2xx, surface the error to the user verbatim — the agent's files exist on disk but its graph projection is incomplete, which means the operator's /graph view will not show this agent. Re-running the projection is safe; it is the same idempotent MERGE.
+11. **Project the agent into the graph** — delegate to the `specialists:database-operator` specialist with the instruction: "Project public agent `{slug}` into the graph by POSTing to `/api/admin/agents/{slug}/project?accountId=<the literal ACCOUNT_ID value you read>`." The route reads the on-disk files and idempotently MERGEs the `:Agent` node, the four owned `:KnowledgeDocument` projections (IDENTITY/SOUL/KNOWLEDGE/KNOWLEDGE-SUMMARY when present, namespaced `attachmentId="agent:<slug>:<role>"`), the `HAS_*` edges, and the `USES_KNOWLEDGE` edges to every operator-tagged doc. Loud-fail: if the route returns non-2xx, surface the error to the user verbatim — the agent's files exist on disk but its graph projection is incomplete, which means the operator's /graph view will not show this agent. Re-running the projection is safe; it is the same idempotent MERGE. The `accountId` query parameter is required on every write to this route (project and delete). The route no longer infers an account from device state, so it returns 400 without one and 403 when the caller is not entitled to the account it named. Source the value from the `ACCOUNT_ID` environment variable of this session (`echo $ACCOUNT_ID`), and substitute the literal id into the URL before delegating, since the specialist you delegate to does not share your shell.
 12. **Set the default if none exists.** Read `defaultAgent` from `account-manage`. If it is empty, set it to this new slug via `account-update` (`field: "defaultAgent"`, `value: "{slug}"`) — otherwise the agent answers at `/{slug}` but the bare root serves nothing. If a default already exists, do not change it silently: tell the operator the current default and ask whether to switch the root to this new agent; call `account-update` only if they say yes.
 13. Confirm creation: "Agent created and reachable at `/{slug}`." If you set or changed the default in step 12, add: "The site root also serves this agent." If a different default remains, add: "The site root still serves `{currentDefault}`."
 
@@ -213,7 +213,7 @@ For knowledge scope changes:
 - Allow adding/removing keyword subscriptions (update `knowledgeKeywords` in `config.json`).
 - After changes, offer to refresh KNOWLEDGE.md using the `update-knowledge` skill.
 
-**After every Edit operation that touches IDENTITY/SOUL/KNOWLEDGE/KNOWLEDGE-SUMMARY/`config.json` (including `knowledgeKeywords` or direct-tag mutations), delegate to `specialists:database-operator` to re-project: POST `/api/admin/agents/{slug}/project`.** Without re-projection the on-disk files diverge from the graph state — the operator sees stale `:Agent` properties and stale `USES_KNOWLEDGE` edges in /graph. Loud-fail: surface non-2xx errors verbatim.
+**After every Edit operation that touches IDENTITY/SOUL/KNOWLEDGE/KNOWLEDGE-SUMMARY/`config.json` (including `knowledgeKeywords` or direct-tag mutations), delegate to `specialists:database-operator` to re-project: POST `/api/admin/agents/{slug}/project?accountId={accountId}`.** Without re-projection the on-disk files diverge from the graph state — the operator sees stale `:Agent` properties and stale `USES_KNOWLEDGE` edges in /graph. Loud-fail: surface non-2xx errors verbatim.
 
 ### Delete
 
@@ -226,7 +226,7 @@ Deletion removes the entire agent directory (`agents/{slug}/`) — not individua
 - If no other agents remain (or the user declines to set a new default), clear the `defaultAgent` field by calling `account-update` with `field: "defaultAgent"`, `value: ""`. Tell the user that visitors to the root URL will see a "no agents" message until a new agent is created.
 
 **Cleanup sequence:**
-- Issue `DELETE /api/admin/agents/{slug}` — the route removes the `:Agent` node and its four owned `:KnowledgeDocument` projections FIRST, then deletes the directory. Loud-fail: if graph cleanup throws, files are preserved and a 500 is returned with the error text. Re-issuing the DELETE is safe (idempotent on both layers). Operator-tagged docs survive the projection delete — only the `USES_KNOWLEDGE` edges from this Agent are removed.
+- Issue `DELETE /api/admin/agents/{slug}?accountId={accountId}` — the route removes the `:Agent` node and its four owned `:KnowledgeDocument` projections FIRST, then deletes the directory. Loud-fail: if graph cleanup throws, files are preserved and a 500 is returned with the error text. Re-issuing the DELETE is safe (idempotent on both layers). Operator-tagged docs survive the projection delete — only the `USES_KNOWLEDGE` edges from this Agent are removed.
 - Verify the directory no longer exists
 - Report what was removed (list the files that were in the directory)
 

package/payload/platform/plugins/admin/skills/whats-new/SKILL.md

@@ -9,6 +9,12 @@ Invoked by the admin agent directly.
 
 This is the platform's release timeline, newest first. Each entry shows the date it shipped and the version it shipped in, so you can tell the operator how current their install is. To compare, read the installed version from `capabilities-here` and match it against the versions below. Keep answers high level and in plain English; this is a summary, not a full commit log.
 
+## 2026-07-25 (0.1.506)
+
+- Fixed a bug where the Agents page and a few other admin screens could resolve the wrong account.
+- The dashboard and sidebar now update instantly when something changes, instead of waiting for the next refresh.
+- The Data page now groups your files into Home and System, with a clearer card layout.
+
 ## 2026-07-25 (0.1.505)
 
 - Upgraded to Claude Opus 5, the assistant's most capable model.

package/payload/platform/plugins/docs/references/admin-ui.md

@@ -174,25 +174,49 @@ kinds, each card tagged `Public` or `Specialist`:
   link.
 
 The former "Public" flyout toggle in the account menu was removed; this page is
-the sole agent surface. The route (`server/routes/admin/agents.ts`) resolves the
-current account via `resolveAccount`; `:slug` params reject `/`, `..`, `\` (the
-traversal guard). A slug containing `--` routes to the specialist branch.
+the sole agent surface.
+
+**Account scope.** The route (`server/routes/admin/agents.ts`) never infers an
+account from device state. The two reads resolve from the caller's admin session
+(`requireAdminSession` + the shared `accountDirForSession` in
+`server/routes/admin/_account-scope.ts`), returning 401 when the session maps to
+no valid account. The two writes carry no admin session (the
+`public-agent-manager` skill calls them), so they take an explicit `accountId`
+query parameter validated against the account list and refuse a missing or
+unknown one with 400 — never defaulting to a resolved account. `:slug` params
+reject `/`, `..`, `\` (the traversal guard); specialist detail is selected by an
+explicit `?plugin=` parameter, not inferred from `--` in the slug.
 
 | Route | Behaviour |
 |-------|-----------|
-| `GET /api/admin/agents` | Lists public `agents/*/` dirs (never the `admin` agent) plus user-created specialists from `plugins/*/agents/*.md`, each row tagged `kind`. Returns `{agents, skipped, specialistsSkipped}` — `skipped` counts public dirs whose `config.json` failed to parse; `specialistsSkipped` counts specialist `.md` files with no parseable `name`. |
-| `GET /api/admin/agents/:slug` | A `--`-free slug returns a public agent's config fields + four owned docs + a `present` map (a missing doc is `''`/`present.<role>=false`, never a 500). A `--` slug returns a specialist's `{kind, model, tools, systemPrompt, skills}`. Unknown 404s. |
-| `DELETE /api/admin/agents/:slug` | Public agents only: removes the dir after `deleteAgentProjection`; refuses the `admin` slug. Loud-fail: a graph-cleanup throw aborts the file removal. |
-
-Observability rides `[admin/agents]`: `op=list agents=<n> specialists=<m>
-skipped=<x> specialistsSkipped=<y>` (the heartbeat — `skipped>0`/`specialistsSkipped>0`
-is a malformed-source signal the page renders as a banner; `specialists=0` with
-user plugins present is the broken-walk signature), `op=detail slug=<…>
-kind=<public|specialist>` (with `present=<comma-list|none>` on the public branch —
-a role absent for an agent expected complete is the missing-doc signature;
-`op=list-specialist-skip plugin=<p> file=<f>` per unreadable specialist), and the
-existing delete lines (`deleted agent "<slug>"` / `graph cleanup failed …
-aborting file removal`).
+| `GET /api/admin/agents` | Session-scoped. Lists the session account's public `agents/*/` dirs (never the `admin` agent) plus its user-created specialists from `plugins/*/agents/*.md`, each row tagged `kind`. Returns `{agents, accountId, skipped, specialistsSkipped}` — `accountId` names the account resolved (the client sends it back on a delete); `skipped` counts public dirs whose `config.json` failed to parse; `specialistsSkipped` counts specialist `.md` files with no parseable `name`. 401 when the session maps to no account. |
+| `GET /api/admin/agents/:slug` | Session-scoped. Without `?plugin=`, returns a public agent's config fields + four owned docs + a `present` map (a missing or unreadable doc is `''`/`present.<role>=false`, never a 500). With `?plugin=`, returns that plugin's specialist `{kind, model, tools, systemPrompt, skills}`. Unknown 404s, 401 as above. |
+| `DELETE /api/admin/agents/:slug?accountId=` | Public agents only, on the named validated account. Removes the dir after `deleteAgentProjection`; refuses the `admin` slug (403) and a missing/unknown `accountId` (400) with no write. Loud-fail: a graph-cleanup throw aborts the file removal. |
+| `POST /api/admin/agents/:slug/project?accountId=` | Re-projects the named account's on-disk agent into the graph. Same `accountId` contract as delete. |
+
+Observability rides `[admin/agents]`, and **every line names the account it acted
+on** (`accountId=<id8>`) — a well-formed answer about the wrong account is
+otherwise indistinguishable from a correct one, which is exactly how an empty
+Agents page survived undiagnosed on a multi-account install.
+
+- `op=list accountId=<id8> agents=<n> specialists=<m> skipped=<x> specialistsSkipped=<y>`
+  — the heartbeat. Compare `accountId` against the account the operator is
+  viewing; `skipped>0`/`specialistsSkipped>0` is a malformed-source signal the
+  page renders as a banner, and `specialists=0` with user plugins present is the
+  broken-walk signature.
+- `op=detail accountId=<id8> slug=<…> kind=<public|specialist>` — with
+  `present=<comma-list|none>` on the public branch, where a role absent for an
+  agent expected complete is the missing-doc signature. One
+  `op=list-specialist-skip plugin=<p> file=<f>` per unreadable specialist.
+- `op=<list|detail> auth-rejected reason=no-account-for-session` — the session
+  maps to no valid account. No `op=list` line at all for a page load means the
+  request never reached the handler, a distinct signature from a zero count.
+- `op=<delete|project> rejected reason=<missing-accountId|unknown-accountId>` —
+  a caller that did not name its account. A skill that was not updated produces
+  this on its first call instead of writing to the wrong account.
+- `op=delete accountId=<id8> slug=<…> outcome=<ok|failed>` with
+  `reason=<graph-cleanup-failed|rm-error>` on failure (files preserved on a
+  graph-cleanup throw).
 
 ### Graph
 
@@ -326,6 +350,24 @@ the Web Share API and is disabled where unavailable. Signals:
 `[data-ui] op=mount header=operator home=absent`, `op=select-enter`,
 `op=select-exit reason=<cancel|action>`, `op=share supported=<bool> count=<n>`.
 
+**`/data` opens on the account's own folders, as cards.** With no `#path=` in
+the URL the browser lands on **home**: the account's business folders (the
+entity folders of its trade, plus `projects`, `contacts` and `documents`) shown
+one per card, each listing the first 20 things inside it and a `+N more` row
+past that. Tapping a card opens that folder in the ordinary list or grid. There
+are never loose files at this level. Everything the platform and its plugins
+keep for themselves — caches, logs, published sites, plugin workspaces, hidden
+folders — sits behind a single **system** card at the end, and opens as the
+ordinary list too. The split comes from the account's own `SCHEMA.md`, so it
+follows the graph ontology rather than a hardcoded list, and nothing moves on
+disk. Upload and New folder are disabled on the cards view because it names no
+single folder to write into; open a folder first. The flat account root is still
+reachable from the account name in the breadcrumb, which is the way back if a
+folder is ever grouped wrongly. Signals: `[data-schema] op=classify` on every
+account-root listing (`home=`, `system=`, `unknown=`, `status=ok|parse-failed`),
+`op=home-files` when a name that should be a folder is a file, and
+`op=card-children … status=error` when one card's folder could not be read.
+
 **`/data` list ↔ grid view + image thumbnails.** A toolbar toggle switches the
 file browser between the two-line list and a **grid**. In grid view, image
 files render an inline thumbnail; folders render a folder tile (still navigate

package/payload/platform/scripts/check-no-esm-require.mjs

@@ -85,6 +85,11 @@ const ALLOWLIST = new Set([
   // top-level fs/os/path imports initialize), so it requires node builtins
   // directly there.
   'platform/ui/server/routes/admin/__tests__/files-scratchpad-download.test.ts',
+  // Same vi.hoisted pattern: the files-root-groups test builds a tmp
+  // MAXY_PLATFORM_ROOT inside the hoisted block (before the route module's
+  // data-path deps read the env at import), so it requires node builtins
+  // directly there.
+  'platform/ui/server/routes/admin/__tests__/files-root-groups.test.ts',
 ])
 
 const REQUIRE_CALL_RE = /\brequire\s*\(/

package/payload/platform/services/claude-session-manager/dist/account-dir-schema-reconcile.d.ts

@@ -15,7 +15,7 @@ export interface ReconcileResult extends ReconcileCounts {
 /** The single per-run summary line body. A non-zero count is the standing signal
  *  that an agent authored folders the hard guards could not prevent. Pure
  *  formatter so the emitter and its test share one wording. */
-export declare function formatReconcileLine(c: ReconcileCounts): string;
+export declare function formatReconcileLine(c: ReconcileCounts, homeMissing?: number, homeUnaudited?: number): string;
 /** Parse the fenced ```allowed-top-level block from an account's SCHEMA.md —
  *  the same structured set fs-schema-guard.sh parses with awk. Returns the
  *  entry names (blank lines dropped). An absent block yields an empty set. */