@rubytech/create-maxy-code 0.1.505 → 0.1.506

package/payload/server/server.js

@@ -91,6 +91,7 @@ import {
   requirePortEnv,
   resolveAccount,
   resolveAgentConfig,
+  resolveCacheKey,
   resolveCallback,
   resolveClientIp,
   resolveDefaultAgentSlug,
@@ -117,7 +118,7 @@ import {
   vncLog,
   walkPremiumBundles,
   writeAdminUserAndPerson
-} from "./chunk-HN4HFTXE.js";
+} from "./chunk-5ADBNEJA.js";
 import {
   D1_MAX_SQL_STATEMENT_BYTES,
   D1_QUERY_MAX_BODY_BYTES,
@@ -217,8 +218,69 @@ ${lines.join("\n")}`;
   }
 });
 
-// ../lib/graph-trash/dist/index.js
+// ../lib/account-schema-regions/dist/index.js
 var require_dist2 = __commonJS({
+  "../lib/account-schema-regions/dist/index.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.HOME_FIXED = void 0;
+    exports.parseSchemaRegions = parseSchemaRegions2;
+    exports.HOME_FIXED = Object.freeze(["projects", "contacts", "documents"]);
+    var ONT_START2 = "<!-- ontology-buckets:start -->";
+    var ONT_END2 = "<!-- ontology-buckets:end -->";
+    var PLUGIN_START = "<!-- plugin-owned-dirs:start -->";
+    var PLUGIN_END = "<!-- plugin-owned-dirs:end -->";
+    var ALLOWED_FENCE = "```allowed-top-level";
+    var DIR_LINE = /^-\s+`([^`/]+)\/`/;
+    function regionLines(text, start, end) {
+      const from = text.indexOf(start);
+      if (from === -1)
+        return [];
+      const to = text.indexOf(end, from);
+      if (to === -1)
+        return [];
+      return text.slice(from + start.length, to).split("\n");
+    }
+    function dirsIn(lines) {
+      const out = [];
+      for (const line of lines) {
+        const m = DIR_LINE.exec(line.trim());
+        if (m && !out.includes(m[1]))
+          out.push(m[1]);
+      }
+      return out;
+    }
+    function fenceEntries(text) {
+      const from = text.indexOf(ALLOWED_FENCE);
+      if (from === -1)
+        return [];
+      const bodyStart = text.indexOf("\n", from);
+      if (bodyStart === -1)
+        return [];
+      const to = text.indexOf("```", bodyStart);
+      if (to === -1)
+        return [];
+      return text.slice(bodyStart + 1, to).split("\n").map((s) => s.trim()).filter((s) => s.length > 0);
+    }
+    function parseSchemaRegions2(schemaMd) {
+      if (schemaMd === null || schemaMd.length === 0) {
+        return { ontologyRoots: [], pluginOwned: [], allowedTopLevel: [], parsed: false, reason: "schema-absent" };
+      }
+      const allowedTopLevel = fenceEntries(schemaMd);
+      const parsed = allowedTopLevel.length > 0;
+      return {
+        ontologyRoots: dirsIn(regionLines(schemaMd, ONT_START2, ONT_END2)),
+        pluginOwned: dirsIn(regionLines(schemaMd, PLUGIN_START, PLUGIN_END)),
+        allowedTopLevel,
+        parsed,
+        reason: parsed ? "ok" : "fence-absent"
+      };
+    }
+  }
+});
+
+// ../lib/graph-trash/dist/index.js
+var require_dist3 = __commonJS({
   "../lib/graph-trash/dist/index.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
@@ -499,7 +561,7 @@ var require_dist2 = __commonJS({
 });
 
 // ../lib/graph-style/dist/index.js
-var require_dist3 = __commonJS({
+var require_dist4 = __commonJS({
   "../lib/graph-style/dist/index.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
@@ -1228,7 +1290,7 @@ var require_conversation_provenance = __commonJS({
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.injectConversationProvenance = injectConversationProvenance;
-    var index_js_1 = require_dist4();
+    var index_js_1 = require_dist5();
     async function injectConversationProvenance(params) {
       const { session, relationships, accountId, writeLabels, conversationNodeId, logNamespace, tool } = params;
       const original = [...relationships];
@@ -1278,7 +1340,7 @@ var require_conversation_provenance = __commonJS({
 });
 
 // ../lib/graph-write/dist/index.js
-var require_dist4 = __commonJS({
+var require_dist5 = __commonJS({
   "../lib/graph-write/dist/index.js"(exports) {
     "use strict";
     var __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m, k, k2) {
@@ -1756,194 +1818,138 @@ var serveStatic = (options = { root: "" }) => {
 import { readFileSync as readFileSync47, existsSync as existsSync46, watchFile, readdirSync as readdirSync28, statSync as statSync20 } from "fs";
 import { spawn as spawn3 } from "child_process";
 import { createHash as createHash7 } from "crypto";
-import { resolve as resolve44, join as join47, basename as basename14 } from "path";
+import { resolve as resolve45, join as join47, basename as basename14 } from "path";
 import { homedir as homedir4 } from "os";
-import { monitorEventLoopDelay } from "perf_hooks";
 
-// app/lib/whatsapp/inbound/media-download-guard.ts
-var TAG = "[media-guard]";
-var inFlight = 0;
-var containedCount = 0;
-function containedSinceBoot() {
-  return containedCount;
-}
-function beginMediaDownload() {
-  inFlight += 1;
-}
-function endMediaDownload() {
-  if (inFlight > 0) inFlight -= 1;
-}
-function mediaDownloadsInFlight() {
-  return inFlight;
-}
-function stackOf(err) {
-  if (err instanceof Error) return err.stack ?? err.message;
-  return String(err);
-}
-function causeCode(err) {
-  const cause = err?.cause;
-  const code = cause?.code;
-  return typeof code === "string" ? code : "none";
-}
-function handleEscapedMediaError(err, channel) {
-  const stack = stackOf(err);
-  const undiciFrame = /node_modules[\\/]undici|node:internal[\\/]deps[\\/]undici/.test(stack);
-  if (undiciFrame && inFlight > 0) {
-    containedCount += 1;
-    console.error(
-      `${TAG} op=contained channel=${channel} inFlight=${inFlight} err=${err instanceof Error ? err.message : String(err)} cause=${causeCode(err)}
-${stack}`
-    );
-    return true;
-  }
-  console.error(
-    `${TAG} op=escaped channel=${channel} inFlight=${inFlight} undiciFrame=${undiciFrame} err=${err instanceof Error ? err.message : String(err)} cause=${causeCode(err)} contained=false`
+// server/lib/route-cache-watchers.ts
+import { watch } from "fs";
+import { resolve as resolve2 } from "path";
+
+// server/lib/route-cache.ts
+var BACKSTOP_MS = 3e4;
+var NOTIFY_COALESCE_MS = 1e3;
+var RECOMPUTE_FLOOR_FACTOR = 10;
+var MIN_RECOMPUTE_FLOOR_MS = 1e3;
+var MAX_RECOMPUTE_FLOOR_MS = 1e4;
+var entries = /* @__PURE__ */ new Map();
+var inFlight = /* @__PURE__ */ new Map();
+var keyGenerations = /* @__PURE__ */ new Map();
+var resourceGenerations = /* @__PURE__ */ new Map();
+var listeners = /* @__PURE__ */ new Set();
+var pendingNotifications = /* @__PURE__ */ new Map();
+var notifyTimer = null;
+function keyOf(resource, accountId) {
+  return `${resource}::${accountId}`;
+}
+function generationOf(resource, key) {
+  return (keyGenerations.get(key) ?? 0) + (resourceGenerations.get(resource) ?? 0);
+}
+function recomputeFloorMs(entry) {
+  return Math.min(
+    Math.max(entry.computeMs * RECOMPUTE_FLOOR_FACTOR, MIN_RECOMPUTE_FLOOR_MS),
+    MAX_RECOMPUTE_FLOOR_MS
   );
-  return false;
-}
-var installed = false;
-function guardInstalled() {
-  return installed;
-}
-function installMediaDownloadGuard() {
-  if (installed) return;
-  installed = true;
-  process.on("uncaughtException", (err) => {
-    if (handleEscapedMediaError(err, "uncaughtException")) return;
-    process.stderr.write(`${err instanceof Error ? err.stack ?? err.message : String(err)}
-`);
-    process.exit(1);
-  });
-  process.on("unhandledRejection", (reason) => {
-    if (handleEscapedMediaError(reason, "unhandledRejection")) return;
-    process.stderr.write(
-      `Unhandled rejection: ${reason instanceof Error ? reason.stack ?? reason.message : String(reason)}
-`
-    );
-    process.exit(1);
-  });
-  console.error(`${TAG} op=installed`);
 }
-
-// app/lib/whatsapp/ingest-audit.ts
-import { readdirSync as readdirSync3, readFileSync as readFileSync3, statSync as statSync3 } from "fs";
-import { join as join4 } from "path";
-
-// app/lib/whatsapp/ingest-ledger.ts
-import { existsSync as existsSync2, mkdirSync, appendFileSync, readFileSync, writeFileSync, readdirSync } from "fs";
-import { join as join2 } from "path";
-var TAG2 = "[wa-ingest-ledger]";
-var LEDGER_ROOT = () => join2(process.env.MAXY_DIR_OVERRIDE ?? MAXY_DIR, "data", "whatsapp-ingest-ledger");
-var ensuredRoots = /* @__PURE__ */ new Set();
-function ledgerFilePath(account) {
-  const root = LEDGER_ROOT();
-  if (!ensuredRoots.has(root)) {
-    if (!existsSync2(root)) mkdirSync(root, { recursive: true });
-    ensuredRoots.add(root);
+async function getOrCompute(resource, accountId, compute) {
+  const key = keyOf(resource, accountId);
+  const entry = entries.get(key);
+  if (entry !== void 0) {
+    const age = Date.now() - entry.computedAt;
+    if (!entry.dirty && age <= BACKSTOP_MS) {
+      return { value: entry.value, state: "hit" };
+    }
+    const sinceAttempt = Date.now() - entry.lastAttemptAt;
+    if (entry.dirty && sinceAttempt < recomputeFloorMs(entry) && age <= BACKSTOP_MS) {
+      return { value: entry.value, state: "dirty-floor" };
+    }
   }
-  return join2(root, `${account}.jsonl`);
-}
-function appendStanza(entry) {
-  try {
-    const row = {
-      msgId: entry.msgId,
-      from: entry.from,
-      type: entry.type,
-      ts: (/* @__PURE__ */ new Date()).toISOString()
-    };
-    appendFileSync(ledgerFilePath(entry.account), JSON.stringify(row) + "\n");
-  } catch (err) {
-    console.error(
-      `${TAG2} FAIL op=append msgId=${entry.msgId} err=${err instanceof Error ? err.message : String(err)}`
-    );
+  const state = entry === void 0 ? "miss" : "stale-backstop";
+  const existing = inFlight.get(key);
+  if (existing) return { value: await existing, state };
+  const startedGeneration = generationOf(resource, key);
+  const startedAt = Date.now();
+  const pending = compute();
+  inFlight.set(key, pending);
+  try {
+    const value = await pending;
+    const finishedAt = Date.now();
+    const computeMs = finishedAt - startedAt;
+    if (value !== null && generationOf(resource, key) === startedGeneration) {
+      entries.set(key, {
+        value,
+        computedAt: finishedAt,
+        computeMs,
+        dirty: false,
+        lastAttemptAt: finishedAt
+      });
+    } else {
+      const prior = entries.get(key);
+      if (prior) {
+        prior.lastAttemptAt = finishedAt;
+        prior.computeMs = computeMs;
+      }
+    }
+    return { value, state };
+  } finally {
+    inFlight.delete(key);
   }
 }
-function markDeclined(entry) {
-  try {
-    const row = {
-      declined: entry.msgId,
-      reason: entry.reason,
-      ts: (/* @__PURE__ */ new Date()).toISOString()
-    };
-    appendFileSync(ledgerFilePath(entry.account), JSON.stringify(row) + "\n");
-  } catch (err) {
-    console.error(
-      `${TAG2} FAIL op=decline msgId=${entry.msgId} err=${err instanceof Error ? err.message : String(err)}`
-    );
+function flushNotifications() {
+  notifyTimer = null;
+  const batch = [...pendingNotifications.values()];
+  pendingNotifications.clear();
+  for (const { resource, accountId } of batch) {
+    for (const fn of listeners) fn(resource, accountId);
   }
 }
-function readDeclined(account) {
-  const path3 = ledgerFilePath(account);
-  const out = /* @__PURE__ */ new Set();
-  if (!existsSync2(path3)) return out;
-  for (const line of readFileSync(path3, "utf8").split("\n")) {
-    if (!line.trim()) continue;
-    try {
-      const row = JSON.parse(line);
-      if (typeof row.declined === "string") out.add(row.declined);
-    } catch {
+function invalidate(resource, accountId, source = "action") {
+  const markOrDrop = (key) => {
+    if (source === "action") {
+      entries.delete(key);
+      return;
     }
-  }
-  return out;
-}
-function readLedger(account) {
-  const path3 = ledgerFilePath(account);
-  if (!existsSync2(path3)) return [];
-  const out = [];
-  for (const line of readFileSync(path3, "utf8").split("\n")) {
-    if (!line.trim()) continue;
-    try {
-      const row = JSON.parse(line);
-      if (row && typeof row.msgId === "string") out.push(row);
-    } catch {
+    const entry = entries.get(key);
+    if (entry) entry.dirty = true;
+  };
+  if (accountId === null) {
+    resourceGenerations.set(resource, (resourceGenerations.get(resource) ?? 0) + 1);
+    for (const key of [...entries.keys()]) {
+      if (key.startsWith(`${resource}::`)) markOrDrop(key);
     }
+  } else {
+    const key = keyOf(resource, accountId);
+    keyGenerations.set(key, (keyGenerations.get(key) ?? 0) + 1);
+    markOrDrop(key);
   }
-  return out;
-}
-function pruneLedger(account, olderThanMs) {
-  const path3 = ledgerFilePath(account);
-  if (!existsSync2(path3)) return 0;
-  const lines = readFileSync(path3, "utf8").split("\n").filter((l) => l.trim());
-  const cutoff = Date.now() - olderThanMs;
-  const kept = lines.filter((line) => {
-    try {
-      const row = JSON.parse(line);
-      const t = typeof row.ts === "string" ? Date.parse(row.ts) : NaN;
-      return Number.isFinite(t) && t >= cutoff;
-    } catch {
-      return false;
-    }
-  });
-  if (kept.length === lines.length) return 0;
-  writeFileSync(path3, kept.join("\n") + (kept.length ? "\n" : ""));
-  return lines.length - kept.length;
-}
-function listLedgerAccounts() {
-  const root = LEDGER_ROOT();
-  if (!existsSync2(root)) return [];
-  try {
-    return readdirSync(root).filter((f) => f.endsWith(".jsonl")).map((f) => f.slice(0, -".jsonl".length));
-  } catch {
-    return [];
+  pendingNotifications.set(`${resource}::${accountId ?? "*"}`, { resource, accountId });
+  if (notifyTimer === null) {
+    notifyTimer = setTimeout(flushNotifications, NOTIFY_COALESCE_MS);
+    if (typeof notifyTimer === "object" && "unref" in notifyTimer) notifyTimer.unref();
   }
 }
+function onInvalidate(fn) {
+  listeners.add(fn);
+  return () => {
+    listeners.delete(fn);
+  };
+}
 
 // app/lib/whatsapp/message-store.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, appendFileSync as appendFileSync2, readdirSync as readdirSync2, statSync as statSync2 } from "fs";
-import { dirname, join as join3 } from "path";
+import { existsSync as existsSync2, mkdirSync, readFileSync, appendFileSync, readdirSync, statSync as statSync2 } from "fs";
+import { dirname, join as join2 } from "path";
 function isReactionRecord(r) {
   return r.kind === "reaction";
 }
-var STORE_ROOT = () => join3(process.env.MAXY_DIR_OVERRIDE ?? MAXY_DIR, "data", "whatsapp-messages");
+var STORE_ROOT = () => join2(process.env.MAXY_DIR_OVERRIDE ?? MAXY_DIR, "data", "whatsapp-messages");
 function conversationFile(platformAccountId, remoteJid) {
-  return join3(STORE_ROOT(), platformAccountId, `${remoteJid}.jsonl`);
+  return join2(STORE_ROOT(), platformAccountId, `${remoteJid}.jsonl`);
 }
 function listStoredAccountIds() {
   const root = STORE_ROOT();
-  if (!existsSync3(root)) return [];
-  return readdirSync2(root).filter((name) => {
+  if (!existsSync2(root)) return [];
+  return readdirSync(root).filter((name) => {
     try {
-      return statSync2(join3(root, name)).isDirectory();
+      return statSync2(join2(root, name)).isDirectory();
     } catch {
       return false;
     }
@@ -1970,7 +1976,7 @@ var byDateSentAsc = (a, b) => a.dateSent.localeCompare(b.dateSent);
 function appendMessage(platformAccountId, record, altDedupeRemoteJids = []) {
   const file = conversationFile(platformAccountId, record.remoteJid);
   try {
-    mkdirSync2(dirname(file), { recursive: true });
+    mkdirSync(dirname(file), { recursive: true });
   } catch (err) {
     const reason = err instanceof Error ? err.message : String(err);
     console.error(`[whatsapp-message-store] FAIL op=append reason=${reason.slice(0, 100)} messageId=${record.messageId}`);
@@ -1979,8 +1985,8 @@ function appendMessage(platformAccountId, record, altDedupeRemoteJids = []) {
   try {
     const filesToCheck = [file, ...altDedupeRemoteJids.filter((jid) => jid && jid !== record.remoteJid).map((jid) => conversationFile(platformAccountId, jid))];
     for (const candidate of new Set(filesToCheck)) {
-      if (!existsSync3(candidate)) continue;
-      const existing = parseLines(readFileSync2(candidate, "utf8"));
+      if (!existsSync2(candidate)) continue;
+      const existing = parseLines(readFileSync(candidate, "utf8"));
       if (existing.some((r) => r.messageId === record.messageId)) {
         return { created: false };
       }
@@ -1991,7 +1997,7 @@ function appendMessage(platformAccountId, record, altDedupeRemoteJids = []) {
     return { created: false };
   }
   try {
-    appendFileSync2(file, JSON.stringify(record) + "\n");
+    appendFileSync(file, JSON.stringify(record) + "\n");
   } catch (err) {
     const reason = err instanceof Error ? err.message : String(err);
     console.error(`[whatsapp-message-store] FAIL op=append reason=${reason.slice(0, 100)} messageId=${record.messageId}`);
@@ -2002,8 +2008,8 @@ function appendMessage(platformAccountId, record, altDedupeRemoteJids = []) {
 function readConversation(platformAccountId, remoteJid) {
   const file = conversationFile(platformAccountId, remoteJid);
   try {
-    if (!existsSync3(file)) return [];
-    return parseLines(readFileSync2(file, "utf8")).sort(byDateSentAsc);
+    if (!existsSync2(file)) return [];
+    return parseLines(readFileSync(file, "utf8")).sort(byDateSentAsc);
   } catch (err) {
     const reason = err instanceof Error ? err.message : String(err);
     console.error(`[whatsapp-message-store] FAIL op=read reason=${reason.slice(0, 100)} remoteJid=${remoteJid}`);
@@ -2013,8 +2019,8 @@ function readConversation(platformAccountId, remoteJid) {
 function appendReaction(platformAccountId, record) {
   const file = conversationFile(platformAccountId, record.remoteJid);
   try {
-    mkdirSync2(dirname(file), { recursive: true });
-    appendFileSync2(file, JSON.stringify(record) + "\n");
+    mkdirSync(dirname(file), { recursive: true });
+    appendFileSync(file, JSON.stringify(record) + "\n");
   } catch (err) {
     const reason = err instanceof Error ? err.message : String(err);
     console.error(
@@ -2027,9 +2033,9 @@ function appendReaction(platformAccountId, record) {
 function readReactions(platformAccountId, remoteJid) {
   const file = conversationFile(platformAccountId, remoteJid);
   try {
-    if (!existsSync3(file)) return [];
+    if (!existsSync2(file)) return [];
     const out = [];
-    for (const line of readFileSync2(file, "utf8").split("\n")) {
+    for (const line of readFileSync(file, "utf8").split("\n")) {
       if (!line.trim()) continue;
       try {
         const rec = JSON.parse(line);
@@ -2073,18 +2079,18 @@ function summariseRecords(records) {
   };
 }
 function readConversationSummaries(platformAccountId) {
-  const dir = join3(STORE_ROOT(), platformAccountId);
+  const dir = join2(STORE_ROOT(), platformAccountId);
   const out = /* @__PURE__ */ new Map();
   const seen = /* @__PURE__ */ new Set();
   let fullReads = 0;
   let cacheHits = 0;
   let bytesRead = 0;
   try {
-    if (!existsSync3(dir)) return out;
-    for (const entry of readdirSync2(dir)) {
+    if (!existsSync2(dir)) return out;
+    for (const entry of readdirSync(dir)) {
       if (!entry.endsWith(".jsonl")) continue;
       const remoteJid = entry.slice(0, -".jsonl".length);
-      const file = join3(dir, entry);
+      const file = join2(dir, entry);
       seen.add(file);
       let size;
       let mtimeMs;
@@ -2103,7 +2109,7 @@ function readConversationSummaries(platformAccountId) {
       }
       let summary;
       try {
-        const raw = readFileSync2(file, "utf8");
+        const raw = readFileSync(file, "utf8");
         bytesRead += Buffer.byteLength(raw);
         fullReads++;
         summary = summariseRecords(parseLines(raw));
@@ -2129,11 +2135,11 @@ function readConversationSummaries(platformAccountId) {
   return out;
 }
 function readAllConversations(platformAccountId) {
-  const dir = join3(STORE_ROOT(), platformAccountId);
+  const dir = join2(STORE_ROOT(), platformAccountId);
   const out = /* @__PURE__ */ new Map();
   try {
-    if (!existsSync3(dir)) return out;
-    for (const entry of readdirSync2(dir)) {
+    if (!existsSync2(dir)) return out;
+    for (const entry of readdirSync(dir)) {
       if (!entry.endsWith(".jsonl")) continue;
       const remoteJid = entry.slice(0, -".jsonl".length);
       out.set(remoteJid, readConversation(platformAccountId, remoteJid));
@@ -2145,6 +2151,303 @@ function readAllConversations(platformAccountId) {
   return out;
 }
 
+// ../lib/account-enumeration/src/index.ts
+import { readdirSync as readdirSync2, readFileSync as readFileSync2 } from "fs";
+import { resolve } from "path";
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var cache = /* @__PURE__ */ new Map();
+function enumerateValidAccountIds(accountsDir) {
+  const cached3 = cache.get(accountsDir);
+  if (cached3 !== void 0) return cached3;
+  let names;
+  try {
+    names = readdirSync2(accountsDir);
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      cache.set(accountsDir, []);
+      return [];
+    }
+    throw err;
+  }
+  const valid = [];
+  for (const name of names) {
+    if (!UUID_RE.test(name)) continue;
+    const configPath2 = resolve(accountsDir, name, "account.json");
+    try {
+      JSON.parse(readFileSync2(configPath2, "utf-8"));
+      valid.push(name);
+    } catch (err) {
+      const code = err.code;
+      if (code === "ENOENT") continue;
+    }
+  }
+  cache.set(accountsDir, valid);
+  return valid;
+}
+function resolveHouseOrSoleAccountId(accountsDir) {
+  const valid = enumerateValidAccountIds(accountsDir);
+  const houses = [];
+  for (const id of valid) {
+    const configPath2 = resolve(accountsDir, id, "account.json");
+    try {
+      const cfg = JSON.parse(readFileSync2(configPath2, "utf-8"));
+      if (cfg.role === "house") houses.push(id);
+    } catch {
+    }
+  }
+  if (houses.length === 1) return houses[0];
+  if (houses.length === 0 && valid.length === 1) return valid[0];
+  throw new Error(
+    `[account-registry] resolveHouseOrSoleAccountId: houses=${houses.length} total=${valid.length} under ${accountsDir} \u2014 expected exactly one role:"house" (or a single unlabelled account). Loud-fail rather than picking one silently.`
+  );
+}
+function getAccountsDirFromEnv() {
+  const root = process.env.MAXY_PLATFORM_ROOT;
+  if (!root) {
+    throw new Error(
+      "[graph-write] MAXY_PLATFORM_ROOT not set \u2014 cannot enforce accountId gate. Set MAXY_PLATFORM_ROOT in the spawning process or pass `accountsDir` explicitly."
+    );
+  }
+  return resolve(root, "..", "data/accounts");
+}
+function validateAccountIdEnv(envValue, diskIds) {
+  if (!envValue) {
+    return { ok: false, reason: "missing", envId: null, diskIds };
+  }
+  if (diskIds.length === 0) {
+    return { ok: false, reason: "no-on-disk-account", envId: envValue, diskIds };
+  }
+  if (!diskIds.includes(envValue)) {
+    return { ok: false, reason: "mismatch", envId: envValue, diskIds };
+  }
+  return { ok: true, envId: envValue, diskIds };
+}
+
+// server/lib/route-cache-watchers.ts
+function watchDirInto(dir, resource, accountId) {
+  try {
+    const w = watch(dir, { recursive: true }, () => {
+      invalidate(resource, accountId, "watcher");
+    });
+    w.on("error", (err) => {
+      console.error(`[admin-events] op=watch-failed resource=${resource} reason=${String(err)}`);
+    });
+    return { stop: () => {
+      w.close();
+    }, attached: true };
+  } catch (err) {
+    console.error(`[admin-events] op=watch-failed resource=${resource} reason=${String(err)}`);
+    return { stop: () => {
+    }, attached: false };
+  }
+}
+var perAccountAttached = /* @__PURE__ */ new Set();
+function ensureAccountWatchers(accountId, accountDir) {
+  for (const [dir, resource] of [
+    [resolve2(accountDir, "plugins"), "skills"],
+    [resolve2(accountDir, "agents", "admin"), "sidebar-artefacts"],
+    [resolve2(accountDir, "specialists", "agents"), "sidebar-artefacts"]
+  ]) {
+    if (perAccountAttached.has(dir)) continue;
+    const { attached: attached2 } = watchDirInto(dir, resource, accountId);
+    if (attached2) perAccountAttached.add(dir);
+  }
+}
+var attached = false;
+function attachRouteCacheWatchers() {
+  if (attached) return;
+  attached = true;
+  const configDir2 = process.env.CLAUDE_CONFIG_DIR;
+  if (configDir2) {
+    watchDirInto(resolve2(configDir2, "projects"), "sidebar-sessions", null);
+  } else {
+    console.error("[admin-events] op=watch-failed resource=sidebar-sessions reason=CLAUDE_CONFIG_DIR-unset");
+  }
+  watchDirInto(resolve2(PLATFORM_ROOT, "templates", "specialists", "agents"), "sidebar-artefacts", null);
+  let houseId = null;
+  try {
+    houseId = resolveHouseOrSoleAccountId(ACCOUNTS_DIR);
+  } catch {
+    houseId = null;
+  }
+  if (houseId) {
+    watchDirInto(STORE_ROOT(), "conversations-all", houseId);
+  } else {
+    console.error("[admin-events] op=watch-failed resource=conversations-all reason=house-account-unresolved");
+  }
+}
+
+// server/index.ts
+import { monitorEventLoopDelay } from "perf_hooks";
+
+// app/lib/whatsapp/inbound/media-download-guard.ts
+var TAG = "[media-guard]";
+var inFlight2 = 0;
+var containedCount = 0;
+function containedSinceBoot() {
+  return containedCount;
+}
+function beginMediaDownload() {
+  inFlight2 += 1;
+}
+function endMediaDownload() {
+  if (inFlight2 > 0) inFlight2 -= 1;
+}
+function mediaDownloadsInFlight() {
+  return inFlight2;
+}
+function stackOf(err) {
+  if (err instanceof Error) return err.stack ?? err.message;
+  return String(err);
+}
+function causeCode(err) {
+  const cause = err?.cause;
+  const code = cause?.code;
+  return typeof code === "string" ? code : "none";
+}
+function handleEscapedMediaError(err, channel) {
+  const stack = stackOf(err);
+  const undiciFrame = /node_modules[\\/]undici|node:internal[\\/]deps[\\/]undici/.test(stack);
+  if (undiciFrame && inFlight2 > 0) {
+    containedCount += 1;
+    console.error(
+      `${TAG} op=contained channel=${channel} inFlight=${inFlight2} err=${err instanceof Error ? err.message : String(err)} cause=${causeCode(err)}
+${stack}`
+    );
+    return true;
+  }
+  console.error(
+    `${TAG} op=escaped channel=${channel} inFlight=${inFlight2} undiciFrame=${undiciFrame} err=${err instanceof Error ? err.message : String(err)} cause=${causeCode(err)} contained=false`
+  );
+  return false;
+}
+var installed = false;
+function guardInstalled() {
+  return installed;
+}
+function installMediaDownloadGuard() {
+  if (installed) return;
+  installed = true;
+  process.on("uncaughtException", (err) => {
+    if (handleEscapedMediaError(err, "uncaughtException")) return;
+    process.stderr.write(`${err instanceof Error ? err.stack ?? err.message : String(err)}
+`);
+    process.exit(1);
+  });
+  process.on("unhandledRejection", (reason) => {
+    if (handleEscapedMediaError(reason, "unhandledRejection")) return;
+    process.stderr.write(
+      `Unhandled rejection: ${reason instanceof Error ? reason.stack ?? reason.message : String(reason)}
+`
+    );
+    process.exit(1);
+  });
+  console.error(`${TAG} op=installed`);
+}
+
+// app/lib/whatsapp/ingest-audit.ts
+import { readdirSync as readdirSync4, readFileSync as readFileSync4, statSync as statSync3 } from "fs";
+import { join as join4 } from "path";
+
+// app/lib/whatsapp/ingest-ledger.ts
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, appendFileSync as appendFileSync2, readFileSync as readFileSync3, writeFileSync, readdirSync as readdirSync3 } from "fs";
+import { join as join3 } from "path";
+var TAG2 = "[wa-ingest-ledger]";
+var LEDGER_ROOT = () => join3(process.env.MAXY_DIR_OVERRIDE ?? MAXY_DIR, "data", "whatsapp-ingest-ledger");
+var ensuredRoots = /* @__PURE__ */ new Set();
+function ledgerFilePath(account) {
+  const root = LEDGER_ROOT();
+  if (!ensuredRoots.has(root)) {
+    if (!existsSync3(root)) mkdirSync2(root, { recursive: true });
+    ensuredRoots.add(root);
+  }
+  return join3(root, `${account}.jsonl`);
+}
+function appendStanza(entry) {
+  try {
+    const row = {
+      msgId: entry.msgId,
+      from: entry.from,
+      type: entry.type,
+      ts: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    appendFileSync2(ledgerFilePath(entry.account), JSON.stringify(row) + "\n");
+  } catch (err) {
+    console.error(
+      `${TAG2} FAIL op=append msgId=${entry.msgId} err=${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+}
+function markDeclined(entry) {
+  try {
+    const row = {
+      declined: entry.msgId,
+      reason: entry.reason,
+      ts: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    appendFileSync2(ledgerFilePath(entry.account), JSON.stringify(row) + "\n");
+  } catch (err) {
+    console.error(
+      `${TAG2} FAIL op=decline msgId=${entry.msgId} err=${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+}
+function readDeclined(account) {
+  const path3 = ledgerFilePath(account);
+  const out = /* @__PURE__ */ new Set();
+  if (!existsSync3(path3)) return out;
+  for (const line of readFileSync3(path3, "utf8").split("\n")) {
+    if (!line.trim()) continue;
+    try {
+      const row = JSON.parse(line);
+      if (typeof row.declined === "string") out.add(row.declined);
+    } catch {
+    }
+  }
+  return out;
+}
+function readLedger(account) {
+  const path3 = ledgerFilePath(account);
+  if (!existsSync3(path3)) return [];
+  const out = [];
+  for (const line of readFileSync3(path3, "utf8").split("\n")) {
+    if (!line.trim()) continue;
+    try {
+      const row = JSON.parse(line);
+      if (row && typeof row.msgId === "string") out.push(row);
+    } catch {
+    }
+  }
+  return out;
+}
+function pruneLedger(account, olderThanMs) {
+  const path3 = ledgerFilePath(account);
+  if (!existsSync3(path3)) return 0;
+  const lines = readFileSync3(path3, "utf8").split("\n").filter((l) => l.trim());
+  const cutoff = Date.now() - olderThanMs;
+  const kept = lines.filter((line) => {
+    try {
+      const row = JSON.parse(line);
+      const t = typeof row.ts === "string" ? Date.parse(row.ts) : NaN;
+      return Number.isFinite(t) && t >= cutoff;
+    } catch {
+      return false;
+    }
+  });
+  if (kept.length === lines.length) return 0;
+  writeFileSync(path3, kept.join("\n") + (kept.length ? "\n" : ""));
+  return lines.length - kept.length;
+}
+function listLedgerAccounts() {
+  const root = LEDGER_ROOT();
+  if (!existsSync3(root)) return [];
+  try {
+    return readdirSync3(root).filter((f) => f.endsWith(".jsonl")).map((f) => f.slice(0, -".jsonl".length));
+  } catch {
+    return [];
+  }
+}
+
 // app/lib/whatsapp/ingest-audit.ts
 var TAG3 = "[wa-ingest-audit]";
 var DEFAULT_GRACE_MS = 10 * 60 * 1e3;
@@ -2164,7 +2467,7 @@ function readAllConversationsCached(accountId) {
   const out = /* @__PURE__ */ new Map();
   let dir;
   try {
-    dir = readdirSync3(join4(STORE_ROOT(), accountId));
+    dir = readdirSync4(join4(STORE_ROOT(), accountId));
   } catch {
     return out;
   }
@@ -2184,7 +2487,7 @@ function readAllConversationsCached(accountId) {
     }
     const parsed = [];
     try {
-      for (const line of readFileSync3(path3, "utf8").split("\n")) {
+      for (const line of readFileSync4(path3, "utf8").split("\n")) {
         if (!line.trim()) continue;
         try {
           const row = JSON.parse(line);
@@ -2347,19 +2650,19 @@ function pwaCensus(d) {
 }
 
 // server/webchat-descriptor.ts
-import { resolve, join as join5 } from "path";
+import { resolve as resolve3, join as join5 } from "path";
 function webchatGatewayUrl() {
   return `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`;
 }
 function webchatServerPath() {
-  return process.env.MAXY_WEBCHAT_CHANNEL_SERVER_PATH ?? resolve(process.env.MAXY_PLATFORM_ROOT ?? join5(__dirname, ".."), "services/webchat-channel/dist/server.js");
+  return process.env.MAXY_WEBCHAT_CHANNEL_SERVER_PATH ?? resolve3(process.env.MAXY_PLATFORM_ROOT ?? join5(__dirname, ".."), "services/webchat-channel/dist/server.js");
 }
 function webchatChannelDescriptor(key) {
   return { key, gatewayUrl: webchatGatewayUrl(), serverPath: webchatServerPath() };
 }
 
 // app/lib/claude-auth.ts
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync2, renameSync, unlinkSync } from "fs";
+import { readFileSync as readFileSync5, writeFileSync as writeFileSync2, renameSync, unlinkSync } from "fs";
 import { sep } from "path";
 import { lock } from "proper-lockfile";
 if (!CLAUDE_CREDENTIALS_FILE.startsWith(MAXY_DIR + sep)) {
@@ -2376,7 +2679,7 @@ var REFRESH_NOT_FIRING_THRESHOLD = 2;
 function readCredentials() {
   let raw;
   try {
-    raw = readFileSync4(CLAUDE_CREDENTIALS_FILE, "utf-8");
+    raw = readFileSync5(CLAUDE_CREDENTIALS_FILE, "utf-8");
   } catch {
     return null;
   }
@@ -2404,7 +2707,7 @@ function writeOAuthCredentials(tokens) {
   try {
     let fileData = {};
     try {
-      const rawFile = readFileSync4(CLAUDE_CREDENTIALS_FILE, "utf-8");
+      const rawFile = readFileSync5(CLAUDE_CREDENTIALS_FILE, "utf-8");
       fileData = JSON.parse(rawFile);
     } catch {
     }
@@ -2634,9 +2937,9 @@ import { networkInterfaces } from "os";
 function getLanIp() {
   const nets = networkInterfaces();
   let fallback = null;
-  for (const entries of Object.values(nets)) {
-    if (!entries) continue;
-    for (const entry of entries) {
+  for (const entries2 of Object.values(nets)) {
+    if (!entries2) continue;
+    for (const entry of entries2) {
       if (entry.family !== "IPv4" || entry.internal) continue;
       if (entry.address.startsWith("192.168.") || entry.address.startsWith("10.")) {
         return entry.address;
@@ -2880,8 +3183,8 @@ function discardAuthDirSync(authDir) {
 function listCredentialAccountIds(configDir2) {
   const credsRoot = path.join(os.homedir(), configDir2, "credentials", "whatsapp");
   try {
-    const entries = fsSync.readdirSync(credsRoot, { withFileTypes: true });
-    return entries.filter((e) => e.isDirectory() && hasCredsSync(path.join(credsRoot, e.name))).map((e) => e.name);
+    const entries2 = fsSync.readdirSync(credsRoot, { withFileTypes: true });
+    return entries2.filter((e) => e.isDirectory() && hasCredsSync(path.join(credsRoot, e.name))).map((e) => e.name);
   } catch {
     return [];
   }
@@ -2910,7 +3213,7 @@ var SENTINEL_BASENAME = "baileys-debug-until";
 var STAT_INTERVAL_MS = 1e3;
 var VALID_LEVELS = /* @__PURE__ */ new Set(["trace", "debug", "info"]);
 var INACTIVE = { active: false, level: "warn" };
-var cache = /* @__PURE__ */ new Map();
+var cache2 = /* @__PURE__ */ new Map();
 function sentinelPath(authDir) {
   return path2.join(authDir, SENTINEL_BASENAME);
 }
@@ -2937,7 +3240,7 @@ function readSentinel(authDir, nowMs) {
 }
 function resolveDebugWindow(authDir, nowMs = Date.now()) {
   if (!authDir) return INACTIVE;
-  const prev = cache.get(authDir);
+  const prev = cache2.get(authDir);
   if (prev && nowMs - prev.checkedAtMs < STAT_INTERVAL_MS) {
     return prev.state;
   }
@@ -2952,7 +3255,7 @@ function resolveDebugWindow(authDir, nowMs = Date.now()) {
       `${TAG5} op=baileys-debug-window-close account=${path2.basename(authDir)}`
     );
   }
-  cache.set(authDir, { checkedAtMs: nowMs, state });
+  cache2.set(authDir, { checkedAtMs: nowMs, state });
   return state;
 }
 
@@ -3030,7 +3333,7 @@ var credsSaveQueue = Promise.resolve();
 async function drainCredsSaveQueue(timeoutMs = 5e3) {
   console.error(`${TAG6} draining credential save queue\u2026`);
   const timer = new Promise(
-    (resolve45) => setTimeout(() => resolve45("timeout"), timeoutMs)
+    (resolve46) => setTimeout(() => resolve46("timeout"), timeoutMs)
   );
   const result = await Promise.race([
     credsSaveQueue.then(() => "drained"),
@@ -3207,11 +3510,11 @@ async function createWaSocket(opts) {
   return sock;
 }
 async function waitForConnection(sock) {
-  return new Promise((resolve45, reject) => {
+  return new Promise((resolve46, reject) => {
     const handler = (update) => {
       if (update.connection === "open") {
         sock.ev.off("connection.update", handler);
-        resolve45();
+        resolve46();
       }
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
@@ -3319,7 +3622,7 @@ function isTimeoutError(err) {
   return Boolean(err?.__maxyTimeout);
 }
 function withTimeout(label, promise, timeoutMs) {
-  return new Promise((resolve45, reject) => {
+  return new Promise((resolve46, reject) => {
     const timer = setTimeout(() => {
       const err = new Error(`${label} timed out after ${timeoutMs}ms`);
       err.__maxyTimeout = true;
@@ -3329,7 +3632,7 @@ function withTimeout(label, promise, timeoutMs) {
     promise.then(
       (value) => {
         clearTimeout(timer);
-        resolve45(value);
+        resolve46(value);
       },
       (err) => {
         clearTimeout(timer);
@@ -3559,7 +3862,7 @@ async function resolveCanonicalConversationJid(remoteJid, lidMapping) {
 }
 
 // app/lib/whatsapp/inbound/lid-map.ts
-import { existsSync as existsSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync6, writeFileSync as writeFileSync3 } from "fs";
 function resolveViaLidMap(map, senderPhone) {
   const key = normalizeE164(senderPhone);
   if (!key) return null;
@@ -3577,7 +3880,7 @@ function lidCaptureFor(senderJid, senderPhone) {
 function readLidMap() {
   try {
     if (!existsSync4(LID_MAP_FILE)) return null;
-    const raw = readFileSync5(LID_MAP_FILE, "utf-8").trim();
+    const raw = readFileSync6(LID_MAP_FILE, "utf-8").trim();
     if (!raw) return null;
     const parsed = JSON.parse(raw);
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
@@ -3836,16 +4139,16 @@ function decideDispatch(conn, payload, deps) {
 
 // app/lib/access-gate.ts
 import neo4j from "neo4j-driver";
-import { readFileSync as readFileSync6 } from "fs";
-import { resolve as resolve2 } from "path";
+import { readFileSync as readFileSync7 } from "fs";
+import { resolve as resolve4 } from "path";
 import { randomUUID as randomUUID2 } from "crypto";
-var PLATFORM_ROOT2 = process.env.MAXY_PLATFORM_ROOT ?? resolve2(process.cwd(), "..");
+var PLATFORM_ROOT2 = process.env.MAXY_PLATFORM_ROOT ?? resolve4(process.cwd(), "..");
 var driver = null;
 function readPassword() {
   if (process.env.NEO4J_PASSWORD) return process.env.NEO4J_PASSWORD;
-  const passwordFile = resolve2(PLATFORM_ROOT2, "config/.neo4j-password");
+  const passwordFile = resolve4(PLATFORM_ROOT2, "config/.neo4j-password");
   try {
-    return readFileSync6(passwordFile, "utf-8").trim();
+    return readFileSync7(passwordFile, "utf-8").trim();
   } catch {
     throw new Error(
       `Neo4j password not found. Expected at ${passwordFile} or in NEO4J_PASSWORD env var.`
@@ -4394,8 +4697,8 @@ async function persistWhatsAppMessage(input) {
   const { givenName, familyName } = splitName(input.pushName);
   const prev = sessionWriteLocks.get(input.cacheKey);
   let release;
-  const mine = new Promise((resolve45) => {
-    release = resolve45;
+  const mine = new Promise((resolve46) => {
+    release = resolve46;
   });
   const chained = (prev ?? Promise.resolve()).then(() => mine);
   sessionWriteLocks.set(input.cacheKey, chained);
@@ -4489,124 +4792,52 @@ function splitName(pushName) {
   const trimmed = pushName.trim();
   if (!trimmed) return { givenName: null, familyName: null };
   const firstSpace = trimmed.search(/\s/);
-  if (firstSpace === -1) return { givenName: trimmed, familyName: null };
-  return {
-    givenName: trimmed.slice(0, firstSpace).trim(),
-    familyName: trimmed.slice(firstSpace + 1).trim() || null
-  };
-}
-function sanitizeReason(err) {
-  if (!(err instanceof Error)) return String(err).slice(0, 200);
-  const msg = err.message.replace(/bolt:\/\/[^\s)]+/g, "bolt://<redacted>").replace(/\b(neo4j|admin|password)=[^\s)]+/gi, "$1=<redacted>").slice(0, 200);
-  return `${err.name}:${msg}`;
-}
-
-// app/lib/whatsapp/ensure-conversation.ts
-var TAG12 = "[whatsapp-persist]";
-async function ensureWhatsAppConversation(input) {
-  const t0 = Date.now();
-  try {
-    const result = await ensureConversation(
-      input.platformAccountId,
-      input.agentType,
-      input.cacheKey
-    );
-    const ms = Date.now() - t0;
-    if (!result.sessionId) {
-      console.error(
-        `${TAG12} conversation-merged FAIL cacheKey=${input.cacheKey} reason=null-sessionId ms=${ms}`
-      );
-      return null;
-    }
-    console.error(
-      `${TAG12} conversation-merged cacheKey=${input.cacheKey} agentType=${input.agentType} channel=whatsapp accountId=${input.platformAccountId} connectionAccountId=${input.connectionAccountId ?? input.platformAccountId} created=${result.created} ms=${ms}`
-    );
-    return { sessionId: result.sessionId, created: result.created };
-  } catch (err) {
-    const ms = Date.now() - t0;
-    const reason = err instanceof Error ? `${err.name}:${err.message.slice(0, 200)}` : String(err).slice(0, 200);
-    console.error(
-      `${TAG12} conversation-merged FAIL cacheKey=${input.cacheKey} reason=${reason} ms=${ms}`
-    );
-    return null;
-  }
-}
-
-// ../lib/account-enumeration/src/index.ts
-import { readdirSync as readdirSync4, readFileSync as readFileSync7 } from "fs";
-import { resolve as resolve3 } from "path";
-var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-var cache2 = /* @__PURE__ */ new Map();
-function enumerateValidAccountIds(accountsDir) {
-  const cached3 = cache2.get(accountsDir);
-  if (cached3 !== void 0) return cached3;
-  let names;
-  try {
-    names = readdirSync4(accountsDir);
-  } catch (err) {
-    if (err.code === "ENOENT") {
-      cache2.set(accountsDir, []);
-      return [];
-    }
-    throw err;
-  }
-  const valid = [];
-  for (const name of names) {
-    if (!UUID_RE.test(name)) continue;
-    const configPath2 = resolve3(accountsDir, name, "account.json");
-    try {
-      JSON.parse(readFileSync7(configPath2, "utf-8"));
-      valid.push(name);
-    } catch (err) {
-      const code = err.code;
-      if (code === "ENOENT") continue;
-    }
-  }
-  cache2.set(accountsDir, valid);
-  return valid;
-}
-function resolveHouseOrSoleAccountId(accountsDir) {
-  const valid = enumerateValidAccountIds(accountsDir);
-  const houses = [];
-  for (const id of valid) {
-    const configPath2 = resolve3(accountsDir, id, "account.json");
-    try {
-      const cfg = JSON.parse(readFileSync7(configPath2, "utf-8"));
-      if (cfg.role === "house") houses.push(id);
-    } catch {
-    }
-  }
-  if (houses.length === 1) return houses[0];
-  if (houses.length === 0 && valid.length === 1) return valid[0];
-  throw new Error(
-    `[account-registry] resolveHouseOrSoleAccountId: houses=${houses.length} total=${valid.length} under ${accountsDir} \u2014 expected exactly one role:"house" (or a single unlabelled account). Loud-fail rather than picking one silently.`
-  );
+  if (firstSpace === -1) return { givenName: trimmed, familyName: null };
+  return {
+    givenName: trimmed.slice(0, firstSpace).trim(),
+    familyName: trimmed.slice(firstSpace + 1).trim() || null
+  };
 }
-function getAccountsDirFromEnv() {
-  const root = process.env.MAXY_PLATFORM_ROOT;
-  if (!root) {
-    throw new Error(
-      "[graph-write] MAXY_PLATFORM_ROOT not set \u2014 cannot enforce accountId gate. Set MAXY_PLATFORM_ROOT in the spawning process or pass `accountsDir` explicitly."
-    );
-  }
-  return resolve3(root, "..", "data/accounts");
+function sanitizeReason(err) {
+  if (!(err instanceof Error)) return String(err).slice(0, 200);
+  const msg = err.message.replace(/bolt:\/\/[^\s)]+/g, "bolt://<redacted>").replace(/\b(neo4j|admin|password)=[^\s)]+/gi, "$1=<redacted>").slice(0, 200);
+  return `${err.name}:${msg}`;
 }
-function validateAccountIdEnv(envValue, diskIds) {
-  if (!envValue) {
-    return { ok: false, reason: "missing", envId: null, diskIds };
-  }
-  if (diskIds.length === 0) {
-    return { ok: false, reason: "no-on-disk-account", envId: envValue, diskIds };
-  }
-  if (!diskIds.includes(envValue)) {
-    return { ok: false, reason: "mismatch", envId: envValue, diskIds };
+
+// app/lib/whatsapp/ensure-conversation.ts
+var TAG12 = "[whatsapp-persist]";
+async function ensureWhatsAppConversation(input) {
+  const t0 = Date.now();
+  try {
+    const result = await ensureConversation(
+      input.platformAccountId,
+      input.agentType,
+      input.cacheKey
+    );
+    const ms = Date.now() - t0;
+    if (!result.sessionId) {
+      console.error(
+        `${TAG12} conversation-merged FAIL cacheKey=${input.cacheKey} reason=null-sessionId ms=${ms}`
+      );
+      return null;
+    }
+    console.error(
+      `${TAG12} conversation-merged cacheKey=${input.cacheKey} agentType=${input.agentType} channel=whatsapp accountId=${input.platformAccountId} connectionAccountId=${input.connectionAccountId ?? input.platformAccountId} created=${result.created} ms=${ms}`
+    );
+    return { sessionId: result.sessionId, created: result.created };
+  } catch (err) {
+    const ms = Date.now() - t0;
+    const reason = err instanceof Error ? `${err.name}:${err.message.slice(0, 200)}` : String(err).slice(0, 200);
+    console.error(
+      `${TAG12} conversation-merged FAIL cacheKey=${input.cacheKey} reason=${reason} ms=${ms}`
+    );
+    return null;
   }
-  return { ok: true, envId: envValue, diskIds };
 }
 
 // app/lib/whatsapp/platform-account-id.ts
 import { readFileSync as readFileSync8 } from "fs";
-import { resolve as resolve4 } from "path";
+import { resolve as resolve5 } from "path";
 var cachedHouseId = null;
 var cachedHouseAccountsDir = null;
 function resolveHouseId(accountsDir) {
@@ -4617,7 +4848,7 @@ function resolveHouseId(accountsDir) {
   return cachedHouseId;
 }
 function readChannelRoutingOverride(accountsDir, houseId) {
-  const configPath2 = resolve4(accountsDir, houseId, "account.json");
+  const configPath2 = resolve5(accountsDir, houseId, "account.json");
   let raw;
   try {
     raw = readFileSync8(configPath2, "utf-8");
@@ -4682,14 +4913,14 @@ import {
 import { randomUUID as randomUUID3 } from "crypto";
 import { mkdir, writeFile } from "fs/promises";
 import { realpathSync as realpathSync2, existsSync as existsSync5, readFileSync as readFileSync10, readdirSync as readdirSync5 } from "fs";
-import { resolve as resolve6, extname } from "path";
+import { resolve as resolve7, extname } from "path";
 
 // app/lib/data-path.ts
 import { realpathSync } from "fs";
-import { resolve as resolve5, normalize, sep as sep2, relative, basename, join as join7 } from "path";
-var PLATFORM_ROOT3 = process.env.MAXY_PLATFORM_ROOT ?? resolve5(process.cwd(), "../platform");
-var DATA_ROOT = resolve5(PLATFORM_ROOT3, "..", "data");
-var CLAUDE_UPLOADS_ROOT = process.env.CLAUDE_CONFIG_DIR ? resolve5(process.env.CLAUDE_CONFIG_DIR, "uploads") : null;
+import { resolve as resolve6, normalize, sep as sep2, relative, basename, join as join7 } from "path";
+var PLATFORM_ROOT3 = process.env.MAXY_PLATFORM_ROOT ?? resolve6(process.cwd(), "../platform");
+var DATA_ROOT = resolve6(PLATFORM_ROOT3, "..", "data");
+var CLAUDE_UPLOADS_ROOT = process.env.CLAUDE_CONFIG_DIR ? resolve6(process.env.CLAUDE_CONFIG_DIR, "uploads") : null;
 var ACCOUNT_PARTITION_DIRS = /* @__PURE__ */ new Set(["accounts"]);
 var ACCOUNT_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function crossesForeignAccountPartition(relPath, accountId) {
@@ -4706,7 +4937,7 @@ function isWithinOwnAccountPartition(relPath, accountId) {
 }
 function resolveUnderRoot(raw, rootAbs, rootLabel) {
   const cleaned = normalize("/" + (raw ?? "").replace(/\\/g, "/")).replace(/^\/+/, "");
-  const absolute = resolve5(rootAbs, cleaned);
+  const absolute = resolve6(rootAbs, cleaned);
   let rootReal;
   try {
     rootReal = realpathSync(rootAbs);
@@ -4928,7 +5159,7 @@ function docToText(buffer, mimeType) {
 
 // app/lib/attachments.ts
 function uploadsDirFor(accountId, subPath, attachmentId) {
-  return subPath ? resolve6(DATA_ROOT, "accounts", accountId, "uploads", subPath, attachmentId) : resolve6(DATA_ROOT, "accounts", accountId, "uploads", attachmentId);
+  return subPath ? resolve7(DATA_ROOT, "accounts", accountId, "uploads", subPath, attachmentId) : resolve7(DATA_ROOT, "accounts", accountId, "uploads", attachmentId);
 }
 var SUPPORTED_MIME_TYPES = /* @__PURE__ */ new Set([
   "image/jpeg",
@@ -5005,14 +5236,14 @@ async function storeMediaBuffer(accountId, attachmentId, filename, mimeType, buf
   return writeAttachment(accountId, "", filename, mimeType, buffer.byteLength, buffer, attachmentId);
 }
 function attachmentExists(accountId, attachmentId) {
-  return existsSync5(resolve6(uploadsDirFor(accountId, "", attachmentId), `${attachmentId}.meta.json`));
+  return existsSync5(resolve7(uploadsDirFor(accountId, "", attachmentId), `${attachmentId}.meta.json`));
 }
 function resolveStoredAttachment(accountId, attachmentId) {
   if (!ATTACHMENT_ID_RE.test(attachmentId)) return null;
   const dir = uploadsDirFor(accountId, "", attachmentId);
   let meta;
   try {
-    meta = JSON.parse(readFileSync10(resolve6(dir, `${attachmentId}.meta.json`), "utf8"));
+    meta = JSON.parse(readFileSync10(resolve7(dir, `${attachmentId}.meta.json`), "utf8"));
   } catch {
     return null;
   }
@@ -5020,25 +5251,25 @@ function resolveStoredAttachment(accountId, attachmentId) {
   const { filename, mimeType, sizeBytes } = meta;
   if (typeof filename !== "string" || typeof mimeType !== "string") return null;
   const resolvedSizeBytes = typeof sizeBytes === "number" ? sizeBytes : void 0;
-  let entries;
+  let entries2;
   try {
-    entries = readdirSync5(dir, { withFileTypes: true });
+    entries2 = readdirSync5(dir, { withFileTypes: true });
   } catch {
     return null;
   }
-  const dataFile = entries.find((e) => e.isFile() && !e.name.endsWith(".meta.json") && !e.name.endsWith(EXTRACTED_TEXT_SUFFIX));
+  const dataFile = entries2.find((e) => e.isFile() && !e.name.endsWith(".meta.json") && !e.name.endsWith(EXTRACTED_TEXT_SUFFIX));
   if (!dataFile) return null;
   const readableSibling = `${attachmentId}${EXTRACTED_TEXT_SUFFIX}`;
-  const readableTextPath = entries.some((e) => e.isFile() && e.name === readableSibling) ? resolve6(dir, readableSibling) : void 0;
-  return { attachmentId, filename, mimeType, sizeBytes: resolvedSizeBytes, path: resolve6(dir, dataFile.name), readableTextPath };
+  const readableTextPath = entries2.some((e) => e.isFile() && e.name === readableSibling) ? resolve7(dir, readableSibling) : void 0;
+  return { attachmentId, filename, mimeType, sizeBytes: resolvedSizeBytes, path: resolve7(dir, dataFile.name), readableTextPath };
 }
 async function writeAttachment(accountId, subPath, filename, mimeType, sizeBytes, buffer, explicitId) {
   const attachmentId = explicitId ?? randomUUID3();
   const dir = uploadsDirFor(accountId, subPath, attachmentId);
   await mkdir(dir, { recursive: true });
   const ext = extname(filename) || "";
-  const storagePath = resolve6(dir, `${attachmentId}${ext}`);
-  const metaPath = resolve6(dir, `${attachmentId}.meta.json`);
+  const storagePath = resolve7(dir, `${attachmentId}${ext}`);
+  const metaPath = resolve7(dir, `${attachmentId}.meta.json`);
   const meta = {
     attachmentId,
     scope: subPath || accountId,
@@ -5060,7 +5291,7 @@ async function writeAttachment(accountId, subPath, filename, mimeType, sizeBytes
     }
     console.error(`[doc-to-text] op=convert mime=${bare} ok=${text !== null} chars=${text?.length ?? 0}`);
     if (text) {
-      const siblingPath = resolve6(dir, `${attachmentId}${EXTRACTED_TEXT_SUFFIX}`);
+      const siblingPath = resolve7(dir, `${attachmentId}${EXTRACTED_TEXT_SUFFIX}`);
       try {
         await writeFile(siblingPath, text);
         readableTextPath = siblingPath;
@@ -5144,8 +5375,8 @@ async function storeComponentArtefact(accountId, attachmentId, mimeType, content
   const dir = uploadsDirFor(accountId, "", attachmentId);
   await mkdir(dir, { recursive: true });
   const ext = extname(filename) || (mimeType === "text/html" ? ".html" : ".md");
-  const storagePath = resolve6(dir, `${attachmentId}${ext}`);
-  const metaPath = resolve6(dir, `${attachmentId}.meta.json`);
+  const storagePath = resolve7(dir, `${attachmentId}${ext}`);
+  const metaPath = resolve7(dir, `${attachmentId}.meta.json`);
   const meta = {
     attachmentId,
     scope: accountId,
@@ -5468,10 +5699,10 @@ function createInboundDebouncer(opts) {
 }
 
 // app/lib/whatsapp/inbound/combine-batch.ts
-function combineInboundBatch(entries) {
-  const last = entries[entries.length - 1];
-  const combinedText = entries.map((e) => e.text).filter(Boolean).join("\n");
-  const media = entries.flatMap((e) => e.media);
+function combineInboundBatch(entries2) {
+  const last = entries2[entries2.length - 1];
+  const combinedText = entries2.map((e) => e.text).filter(Boolean).join("\n");
+  const media = entries2.flatMap((e) => e.media);
   return { ...last, text: combinedText, media };
 }
 
@@ -5718,15 +5949,15 @@ function messageStoreKey(accountId, remoteJid) {
   return `${accountId}:${remoteJid}`;
 }
 function storeMessage(storeKey, entry) {
-  let entries = messageStore.get(storeKey);
-  if (!entries) {
-    entries = [];
-    messageStore.set(storeKey, entries);
-  }
-  entries.push(entry);
-  if (entries.length > MESSAGE_STORE_MAX) {
-    const trimmed = entries.length - MESSAGE_STORE_MAX;
-    entries.splice(0, trimmed);
+  let entries2 = messageStore.get(storeKey);
+  if (!entries2) {
+    entries2 = [];
+    messageStore.set(storeKey, entries2);
+  }
+  entries2.push(entry);
+  if (entries2.length > MESSAGE_STORE_MAX) {
+    const trimmed = entries2.length - MESSAGE_STORE_MAX;
+    entries2.splice(0, trimmed);
     console.error(`${TAG17} message store trimmed for ${storeKey}: ${trimmed} oldest messages removed`);
   }
 }
@@ -6132,11 +6363,11 @@ async function connectWithReconnect(conn) {
       console.error(
         `${TAG17} reconnecting account=${conn.accountId} in ${delay}ms (attempt ${decision.nextAttempts}/${maxAttempts})`
       );
-      await new Promise((resolve45) => {
-        const timer = setTimeout(resolve45, delay);
+      await new Promise((resolve46) => {
+        const timer = setTimeout(resolve46, delay);
         conn.abortController.signal.addEventListener("abort", () => {
           clearTimeout(timer);
-          resolve45();
+          resolve46();
         }, { once: true });
       });
     }
@@ -6144,16 +6375,16 @@ async function connectWithReconnect(conn) {
   }
 }
 function waitForDisconnectEvent(conn) {
-  return new Promise((resolve45) => {
+  return new Promise((resolve46) => {
     if (!conn.sock) {
-      resolve45();
+      resolve46();
       return;
     }
     const sock = conn.sock;
     const handler = (update) => {
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
-        resolve45();
+        resolve46();
       }
     };
     sock.ev.on("connection.update", handler);
@@ -6201,12 +6432,12 @@ function monitorInbound(conn) {
       const conversationKey = payload.isGroup ? payload.groupJid : payload.senderPhone;
       return `${payload.accountId}:${conversationKey ?? payload.senderPhone}:${payload.senderPhone}`;
     },
-    onFlush: (entries) => {
+    onFlush: (entries2) => {
       if (!onInboundMessage) return;
-      if (entries.length > 1) {
-        console.error(`${TAG17} debounce: combining ${entries.length} messages account=${conn.accountId} from=${entries[0].senderPhone}`);
+      if (entries2.length > 1) {
+        console.error(`${TAG17} debounce: combining ${entries2.length} messages account=${conn.accountId} from=${entries2[0].senderPhone}`);
       }
-      dispatchInboundPayload(conn, combineInboundBatch(entries));
+      dispatchInboundPayload(conn, combineInboundBatch(entries2));
     },
     onError: (err) => {
       console.error(`${TAG17} debounce flush error account=${conn.accountId}: ${String(err)}`);
@@ -6261,9 +6492,9 @@ function monitorInbound(conn) {
               quoted: extracted.quotedMessage ? { id: extracted.quotedMessage.id, body: extracted.quotedMessage.text, sender: extracted.quotedMessage.sender } : void 0
             });
           }
-          const entries = messageStore.get(storeKey);
+          const entries2 = messageStore.get(storeKey);
           console.error(
-            `${TAG17} stored message ${msg.key.id ?? "?"} for ${remoteJid} (type: ${upsert.type}, store size: ${entries?.length ?? 0}/${MESSAGE_STORE_MAX}) storeAccount=${persistAccountId} socketOwner=${conn.platformAccountId}`
+            `${TAG17} stored message ${msg.key.id ?? "?"} for ${remoteJid} (type: ${upsert.type}, store size: ${entries2?.length ?? 0}/${MESSAGE_STORE_MAX}) storeAccount=${persistAccountId} socketOwner=${conn.platformAccountId}`
           );
           recordActivity({
             accountId: conn.accountId,
@@ -6627,8 +6858,8 @@ async function handleInboundMessage(conn, msg) {
     const conversationKey = isGroup ? remoteJid : senderPhone;
     const debounceKey = `${conn.accountId}:${conversationKey}:${senderPhone}`;
     let resolvePending;
-    const sttPending = new Promise((resolve45) => {
-      resolvePending = resolve45;
+    const sttPending = new Promise((resolve46) => {
+      resolvePending = resolve46;
     });
     if (conn.debouncer) conn.debouncer.registerPending(debounceKey, sttPending);
     try {
@@ -6715,9 +6946,9 @@ async function handleInboundMessage(conn, msg) {
 import { spawnSync, execFileSync } from "child_process";
 import { createConnection } from "net";
 import { mkdirSync as mkdirSync3, readFileSync as readFileSync11, writeFileSync as writeFileSync4 } from "fs";
-import { resolve as resolve7 } from "path";
-var PLATFORM_ROOT4 = process.env.MAXY_PLATFORM_ROOT ?? resolve7(process.cwd(), "..");
-var VNC_SCRIPT = resolve7(PLATFORM_ROOT4, "scripts/vnc.sh");
+import { resolve as resolve8 } from "path";
+var PLATFORM_ROOT4 = process.env.MAXY_PLATFORM_ROOT ?? resolve8(process.cwd(), "..");
+var VNC_SCRIPT = resolve8(PLATFORM_ROOT4, "scripts/vnc.sh");
 var displayMode = process.env.DISPLAY_MODE ?? "virtual";
 if (displayMode === "native") {
   console.log(`[vnc] DISPLAY_MODE=native \u2014 local requests use desktop display, remote requests use VNC`);
@@ -6830,7 +7061,7 @@ function ensureLogDir() {
   mkdirSync3(LOG_DIR, { recursive: true });
 }
 function logPath(name) {
-  return resolve7(LOG_DIR, `${name}.log`);
+  return resolve8(LOG_DIR, `${name}.log`);
 }
 async function ensureVnc() {
   if (process.platform !== "linux") {
@@ -6917,7 +7148,7 @@ function killChromium() {
 }
 function writeChromiumWrapper() {
   mkdirSync3(BIN_DIR, { recursive: true });
-  const wrapperPath = resolve7(BIN_DIR, "chromium");
+  const wrapperPath = resolve8(BIN_DIR, "chromium");
   writeFileSync4(wrapperPath, `#!/bin/bash
 LOG="${LOG_DIR}/chromium.log"
 echo "==== [$(date)] chromium wrapper ====" >> "$LOG"
@@ -7017,20 +7248,20 @@ function buildX11Env(chromiumWrapperPath, transport = "vnc") {
 
 // server/routes/health.ts
 function checkPort(port2, timeoutMs = 500) {
-  return new Promise((resolve45) => {
+  return new Promise((resolve46) => {
     const socket = createConnection2(port2, "127.0.0.1");
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => {
       socket.destroy();
-      resolve45(true);
+      resolve46(true);
     });
     socket.once("error", () => {
       socket.destroy();
-      resolve45(false);
+      resolve46(false);
     });
     socket.once("timeout", () => {
       socket.destroy();
-      resolve45(false);
+      resolve46(false);
     });
   });
 }
@@ -7690,7 +7921,7 @@ function createScheduleInjectRoutes(deps) {
 }
 
 // server/index.ts
-var import_dist8 = __toESM(require_dist(), 1);
+var import_dist9 = __toESM(require_dist(), 1);
 
 // app/lib/whatsapp/socket-resolution-error.ts
 function formatPresentKeys(presentKeys) {
@@ -7731,7 +7962,7 @@ async function sendTelegramText(botToken, chatId, text) {
 }
 
 // server/routes/whatsapp.ts
-import { join as join12, resolve as resolve10 } from "path";
+import { join as join12, resolve as resolve11 } from "path";
 import { readdirSync as readdirSync7, readFileSync as readFileSync14, existsSync as existsSync8 } from "fs";
 
 // app/lib/whatsapp/login.ts
@@ -7739,10 +7970,10 @@ import { randomUUID as randomUUID6 } from "crypto";
 
 // app/lib/whatsapp/config-persist.ts
 import { readFileSync as readFileSync13, writeFileSync as writeFileSync5, existsSync as existsSync7 } from "fs";
-import { resolve as resolve8, join as join10, dirname as dirname2, basename as basename2 } from "path";
+import { resolve as resolve9, join as join10, dirname as dirname2, basename as basename2 } from "path";
 var TAG21 = "[whatsapp:config]";
 function configPath(accountDir) {
-  return resolve8(accountDir, "account.json");
+  return resolve9(accountDir, "account.json");
 }
 function readConfig(accountDir) {
   const path3 = configPath(accountDir);
@@ -7814,8 +8045,8 @@ function addAdminPhone(accountDir, phone) {
   }
   try {
     const config = readConfig(accountDir);
-    const targetId = typeof config.accountId === "string" && config.accountId ? config.accountId : basename2(resolve8(accountDir));
-    const socketOwner = resolveHouseOrSoleAccountId(dirname2(resolve8(accountDir)));
+    const targetId = typeof config.accountId === "string" && config.accountId ? config.accountId : basename2(resolve9(accountDir));
+    const socketOwner = resolveHouseOrSoleAccountId(dirname2(resolve9(accountDir)));
     if (targetId !== socketOwner) {
       console.error(`${TAG21} add-admin-phone rejected accountId=${targetId} reason=not-socket-account`);
       return {
@@ -7904,7 +8135,7 @@ function purgeNonSocketAdminPhones(accountDir, socketOwnerId) {
     const config = readConfig(accountDir);
     const wa = config.whatsapp;
     if (!wa || typeof wa !== "object") return { removed: [] };
-    const targetId = typeof config.accountId === "string" && config.accountId ? config.accountId : basename2(resolve8(accountDir));
+    const targetId = typeof config.accountId === "string" && config.accountId ? config.accountId : basename2(resolve9(accountDir));
     if (targetId === socketOwnerId) return { removed: [] };
     const adminPhones = Array.isArray(wa.adminPhones) ? wa.adminPhones.filter((p) => typeof p === "string") : [];
     if (adminPhones.length === 0) return { removed: [] };
@@ -8369,8 +8600,8 @@ async function startLogin(opts) {
   await clearAuth(authDir);
   let resolveCode = null;
   let rejectCode = null;
-  const codePromise = new Promise((resolve45, reject) => {
-    resolveCode = resolve45;
+  const codePromise = new Promise((resolve46, reject) => {
+    resolveCode = resolve46;
     rejectCode = reject;
   });
   const codeTimer = setTimeout(
@@ -8521,7 +8752,7 @@ function reconcileMessageStoreAccountKeys(input) {
 // app/lib/whatsapp/outbound/send-document.ts
 import { realpathSync as realpathSync3 } from "fs";
 import { readFile, stat as stat2 } from "fs/promises";
-import { resolve as resolve9, basename as basename3 } from "path";
+import { resolve as resolve10, basename as basename3 } from "path";
 var TAG23 = "[whatsapp:outbound]";
 var lastDocumentOutboundAt = /* @__PURE__ */ new Map();
 var lastRouteDocumentOutboundAt = /* @__PURE__ */ new Map();
@@ -8548,7 +8779,7 @@ async function sendWhatsAppDocument(input) {
   if (!maxyAccountId || !platformRoot5) {
     return { ok: false, status: 400, error: "Cannot validate file path: missing account or platform context" };
   }
-  const accountDir = resolve9(platformRoot5, "..", "data/accounts", maxyAccountId);
+  const accountDir = resolve10(platformRoot5, "..", "data/accounts", maxyAccountId);
   let accountResolved;
   try {
     accountResolved = realpathSync3(accountDir);
@@ -8740,25 +8971,25 @@ function isAccountConfigured(accountDir, accountId) {
 }
 function reconcileCredsOnDisk(opts) {
   const { credsRoot, accountDir, liveAccountIds, activeLoginAccountIds } = opts;
-  const entries = [];
+  const entries2 = [];
   for (const accountId of listCredsAccountIds(credsRoot)) {
     if (liveAccountIds.has(accountId)) continue;
     const authDir = join11(credsRoot, accountId);
     const census = credsCensus(authDir);
     if (census.registered && !census.hasAccountSignature) {
-      const inFlight2 = activeLoginAccountIds.has(accountId);
+      const inFlight3 = activeLoginAccountIds.has(accountId);
       const ageMs2 = getAuthAgeMs(authDir);
-      const abandoned = !inFlight2 && ageMs2 !== null && ageMs2 >= HALF_REGISTERED_MIN_AGE_MS;
+      const abandoned = !inFlight3 && ageMs2 !== null && ageMs2 >= HALF_REGISTERED_MIN_AGE_MS;
       if (!abandoned) {
-        console.error(`${TAG24} op=half-registered account=${accountId} registered=true hasAccount=false inFlight=${inFlight2} ageMs=${ageMs2 ?? "null"}`);
-        entries.push({ accountId, connected: false, linkedUnconfigured: true });
+        console.error(`${TAG24} op=half-registered account=${accountId} registered=true hasAccount=false inFlight=${inFlight3} ageMs=${ageMs2 ?? "null"}`);
+        entries2.push({ accountId, connected: false, linkedUnconfigured: true });
         continue;
       }
       console.error(`${TAG24} op=discard-half-registered account=${accountId} registered=true hasAccount=false ageMs=${ageMs2}`);
       const removed = discardAuthDirSync(authDir);
       if (!removed) {
         console.error(`${TAG24} op=discard-half-registered-failed account=${accountId} \u2014 residue persists`);
-        entries.push({ accountId, connected: false, linkedUnconfigured: true });
+        entries2.push({ accountId, connected: false, linkedUnconfigured: true });
       }
       continue;
     }
@@ -8775,9 +9006,9 @@ function reconcileCredsOnDisk(opts) {
         console.error(`${TAG24} self-heal FAILED account=${accountId}: ${result.error}`);
       }
     }
-    entries.push({ accountId, selfPhone, connected: false, linkedUnconfigured: !configured });
+    entries2.push({ accountId, selfPhone, connected: false, linkedUnconfigured: !configured });
   }
-  return entries;
+  return entries2;
 }
 
 // app/lib/whatsapp/outbound/reply-guard.ts
@@ -9165,14 +9396,14 @@ app2.post("/config", async (c) => {
         return c.json({ ok: true, slug: resolved?.slug ?? null, source: resolved?.source ?? null });
       }
       case "list-public-agents": {
-        const agentsDir = resolve10(account.accountDir, "agents");
+        const agentsDir = resolve11(account.accountDir, "agents");
         const agents = [];
         if (existsSync8(agentsDir)) {
           try {
-            const entries = readdirSync7(agentsDir, { withFileTypes: true });
-            for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+            const entries2 = readdirSync7(agentsDir, { withFileTypes: true });
+            for (const entry of entries2.sort((a, b) => a.name.localeCompare(b.name))) {
               if (!entry.isDirectory() || entry.name === "admin") continue;
-              const configPath2 = resolve10(agentsDir, entry.name, "config.json");
+              const configPath2 = resolve11(agentsDir, entry.name, "config.json");
               if (!existsSync8(configPath2)) continue;
               try {
                 const config = JSON.parse(readFileSync14(configPath2, "utf-8"));
@@ -9664,7 +9895,7 @@ var bodyLimit = (options) => {
 };
 
 // server/routes/storage-broker.ts
-import { join as join13, resolve as resolve11 } from "path";
+import { join as join13, resolve as resolve12 } from "path";
 import { readdirSync as readdirSync8, readFileSync as readFileSync15, existsSync as existsSync9, realpathSync as realpathSync4 } from "fs";
 import { randomUUID as randomUUID7 } from "crypto";
 var app3 = new Hono();
@@ -9742,9 +9973,9 @@ var pagesDeployBodyLimit = bodyLimit({
 function resolveSiteDir(account, site) {
   if (!site || site === "." || site === "..") return null;
   if (site.includes("/") || site.includes("\\") || site.includes("\0")) return null;
-  const accountsDir = resolve11(platformRoot(), "..", "data", "accounts");
-  const base = resolve11(accountsDir, account, "sites");
-  const dir = resolve11(base, site);
+  const accountsDir = resolve12(platformRoot(), "..", "data", "accounts");
+  const base = resolve12(accountsDir, account, "sites");
+  const dir = resolve12(base, site);
   if (dir !== base && !dir.startsWith(base + "/")) return null;
   try {
     const realBase = realpathSync4(base);
@@ -10177,7 +10408,7 @@ var storage_broker_default = app3;
 async function runStorageAudit(root) {
   const { reconcileStorage } = await import("./src-JN6PIAJN.js");
   const cf = await makeHouseCfExec(root);
-  const accountsDir = resolve11(root, "..", "data", "accounts");
+  const accountsDir = resolve12(root, "..", "data", "accounts");
   const strays = (await reconcileStorage({
     cfD1: async () => (await cf.d1List()).map((d) => d.name),
     cfR2: async () => (await cf.r2List()).map((b) => b.name),
@@ -10275,7 +10506,7 @@ function auditErrorText(message) {
 function readLastPushAgeSec(platformRoot5, accountId, nowMs) {
   try {
     const raw = readFileSync15(
-      resolve11(platformRoot5, "..", "data", "portal-index-state.json"),
+      resolve12(platformRoot5, "..", "data", "portal-index-state.json"),
       "utf-8"
     );
     const state = JSON.parse(raw);
@@ -10289,7 +10520,7 @@ function readLastPushAgeSec(platformRoot5, accountId, nowMs) {
 function countConfigAbsent(platformRoot5, present) {
   try {
     const raw = readFileSync15(
-      resolve11(platformRoot5, "..", "data", "portal-index-state.json"),
+      resolve12(platformRoot5, "..", "data", "portal-index-state.json"),
       "utf-8"
     );
     const state = JSON.parse(raw);
@@ -10316,7 +10547,7 @@ function discoverPortalAccounts(accountsDir) {
   return found;
 }
 async function runDataPortalAudit(root) {
-  const portals = discoverPortalAccounts(resolve11(root, "..", "data", "accounts"));
+  const portals = discoverPortalAccounts(resolve12(root, "..", "data", "accounts"));
   const configAbsent = countConfigAbsent(root, portals);
   if (portals.length === 0) {
     if (configAbsent > 0) {
@@ -10386,7 +10617,7 @@ async function runDataPortalAudit(root) {
 // server/portal-uploads-pull.ts
 import { existsSync as existsSync10 } from "fs";
 import { mkdir as mkdir3, readFile as readFile2, rename, stat as stat3, unlink as unlink2, writeFile as writeFile4 } from "fs/promises";
-import { basename as basename4, dirname as dirname4, join as join14, relative as relative2, resolve as resolve12, sep as sep3 } from "path";
+import { basename as basename4, dirname as dirname4, join as join14, relative as relative2, resolve as resolve13, sep as sep3 } from "path";
 
 // ../plugins/cloudflare/bin/schema-exposed-dirs.mjs
 var ONT_START = "<!-- ontology-buckets:start -->";
@@ -10483,10 +10714,10 @@ function resolveDestination(accountDir, row, exposed) {
     const segments = row.targetPath.split("/");
     if (!segments.every(safeSegment)) return { ok: false, reason: "bad-target" };
     if (!exposed.includes(segments[0])) return { ok: false, reason: "bad-target" };
-    root = resolve12(accountDir);
+    root = resolve13(accountDir);
     dir = join14(root, ...segments);
   } else {
-    root = resolve12(accountDir, "uploads");
+    root = resolve13(accountDir, "uploads");
     dir = join14(root, row.ownerId);
   }
   const final = join14(dir, row.filename);
@@ -10498,7 +10729,7 @@ function resolveDestination(accountDir, row, exposed) {
     dir,
     tmp: join14(dir, ".uploads-tmp", row.filename),
     final,
-    relative: relative2(resolve12(accountDir), final).split(sep3).join("/")
+    relative: relative2(resolve13(accountDir), final).split(sep3).join("/")
   };
 }
 function nextFreePath(final) {
@@ -10553,7 +10784,7 @@ async function pullAccount(opts) {
         `${TAG26} op=collision account=${accountId}${idField} suffix="${basename4(finalPath)}" result=suffixed`
       );
     }
-    const relPath = relative2(resolve12(accountDir), finalPath).split(sep3).join("/");
+    const relPath = relative2(resolve13(accountDir), finalPath).split(sep3).join("/");
     try {
       await mkdir3(dirname4(dest.tmp), { recursive: true });
       await writeFile4(dest.tmp, bytes);
@@ -10613,8 +10844,8 @@ async function withdrawRow(opts) {
     log2(`${head} removed=false result=bad-path`);
     return false;
   }
-  const absolute = join14(resolve12(accountDir), ...segments);
-  if (!absolute.startsWith(resolve12(accountDir) + sep3)) {
+  const absolute = join14(resolve13(accountDir), ...segments);
+  if (!absolute.startsWith(resolve13(accountDir) + sep3)) {
     log2(`${head} removed=false result=bad-path`);
     return false;
   }
@@ -10693,7 +10924,7 @@ async function readExposedDirs(accountDir) {
   return exposed;
 }
 async function runPortalUploadsPull(root) {
-  const accountsRoot = resolve12(root, "..", "data", "accounts");
+  const accountsRoot = resolve13(root, "..", "data", "accounts");
   const portals = discoverPortalAccounts(accountsRoot);
   if (portals.length === 0) return "portals=0 pulled=0";
   const cf = await makeHouseCfExec(root);
@@ -10742,7 +10973,7 @@ async function runPortalUploadsPull(root) {
 import { readFile as readFile3, readdir, stat as stat4 } from "fs/promises";
 import { existsSync as existsSync11, readFileSync as readFileSync16, writeFileSync as writeFileSync6 } from "fs";
 import { execFileSync as execFileSync2 } from "child_process";
-import { join as join15, resolve as resolve13 } from "path";
+import { join as join15, resolve as resolve14 } from "path";
 import { fileURLToPath } from "url";
 
 // ../plugins/cloudflare/bin/d1-http.mjs
@@ -10827,9 +11058,9 @@ async function readExposeFolders(accountDir) {
 async function walkExposed(accountDir, exposed) {
   const out = [];
   async function walk(rel) {
-    let entries;
+    let entries2;
     try {
-      entries = await readdir(join15(accountDir, rel), { withFileTypes: true });
+      entries2 = await readdir(join15(accountDir, rel), { withFileTypes: true });
     } catch {
       return;
     }
@@ -10838,7 +11069,7 @@ async function walkExposed(accountDir, exposed) {
       out.push({ relPath: rel, sizeBytes: 0, modifiedAt: st.mtime.toISOString(), isDir: true });
     } catch {
     }
-    for (const e of entries) {
+    for (const e of entries2) {
       if (e.name.startsWith(".")) continue;
       const childRel = `${rel}/${e.name}`;
       if (e.isDirectory()) {
@@ -10938,7 +11169,7 @@ async function pushAccount(opts) {
   return { exposed: r.exposed, rows: rows.length, schemaPresent: true, generation: next };
 }
 function stateFilePath(platformRoot5) {
-  return resolve13(platformRoot5, "..", "data", "portal-index-state.json");
+  return resolve14(platformRoot5, "..", "data", "portal-index-state.json");
 }
 function readState(platformRoot5) {
   try {
@@ -11005,7 +11236,7 @@ function resolveCloudflareCredentials(platformRoot5) {
   return { cfAccountId: house.CLOUDFLARE_ACCOUNT_ID, token };
 }
 async function pushAllAccounts(platformRoot5) {
-  const accountsRoot = resolve13(platformRoot5, "..", "data", "accounts");
+  const accountsRoot = resolve14(platformRoot5, "..", "data", "accounts");
   const targets = await portalAccounts(accountsRoot);
   console.error(`${TAG27} op=enumerate accountsRoot="${accountsRoot}" accounts=${targets.length}`);
   if (targets.length === 0) return { accounts: 0, pushed: 0, failed: 0 };
@@ -11084,8 +11315,8 @@ async function main() {
   ]);
   if (r.failed > 0) process.exit(1);
 }
-var invokedPath = process.argv[1] ? resolve13(process.argv[1]) : "";
-if (invokedPath && invokedPath.endsWith("/portal-index-push.mjs") && invokedPath === resolve13(fileURLToPath(import.meta.url))) {
+var invokedPath = process.argv[1] ? resolve14(process.argv[1]) : "";
+if (invokedPath && invokedPath.endsWith("/portal-index-push.mjs") && invokedPath === resolve14(fileURLToPath(import.meta.url))) {
   void main();
 }
 
@@ -11164,12 +11395,12 @@ function runReconcileLivenessAudit(statePath, nowMs, intervalMs, emit) {
 }
 
 // server/routes/whatsapp-reader.ts
-import { readFileSync as readFileSync21, watch, statSync as statSync8, openSync, readSync, closeSync, existsSync as existsSync17, readdirSync as readdirSync14, realpathSync as realpathSync6 } from "fs";
-import { basename as basename6, dirname as dirname7, isAbsolute, join as join21, relative as relative3, resolve as resolve16, sep as sep5 } from "path";
+import { readFileSync as readFileSync21, watch as watch2, statSync as statSync8, openSync, readSync, closeSync, existsSync as existsSync17, readdirSync as readdirSync14, realpathSync as realpathSync6 } from "fs";
+import { basename as basename6, dirname as dirname7, isAbsolute, join as join21, relative as relative3, resolve as resolve17, sep as sep5 } from "path";
 
 // server/routes/admin/sidebar-sessions.ts
 import { readdirSync as readdirSync12, readFileSync as readFileSync19, statSync as statSync6 } from "fs";
-import { dirname as dirname5, join as join19, resolve as resolve14 } from "path";
+import { dirname as dirname5, join as join19, resolve as resolve15 } from "path";
 
 // ../services/claude-session-manager/src/jsonl-path.ts
 import { existsSync as existsSync14, readdirSync as readdirSync10 } from "fs";
@@ -11329,15 +11560,15 @@ function enumerateJsonls(projectsRoot) {
   }
   for (const slug of slugs) {
     const slugDir = join19(projectsRoot, slug);
-    let entries;
+    let entries2;
     try {
-      entries = readdirSync12(slugDir, { withFileTypes: true });
+      entries2 = readdirSync12(slugDir, { withFileTypes: true });
     } catch (err) {
       const code = err.code ?? "unknown";
       console.error(`[admin-sessions-list] slug-skipped slug=${slug} code=${code}`);
       continue;
     }
-    for (const entry of entries) {
+    for (const entry of entries2) {
       if (entry.isFile() && SESSION_ID_RE.test(entry.name)) {
         out.push({ path: join19(slugDir, entry.name), isSubagent: false, archived: false });
       } else if (entry.isDirectory() && entry.name === "subagents") {
@@ -11520,17 +11751,30 @@ function resolveTitle(body, sessionId, userTitles) {
 app4.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const scopeAccountId = getAccountIdForSession(cacheKey) ?? null;
+  const start = Date.now();
+  const { value, state } = await getOrCompute(
+    "sidebar-sessions",
+    scopeAccountId ?? NO_ACCOUNT_KEY,
+    () => computeSessionList(scopeAccountId)
+  );
+  console.log(
+    `[admin-sessions-list] op=list-cache cache=${state} accountId=${scopeAccountId ? scopeAccountId.slice(0, 8) : "unset"} ms=${Date.now() - start}`
+  );
+  return c.json(value);
+});
+var NO_ACCOUNT_KEY = "no-account";
+async function computeSessionList(scopeAccountId) {
   const validAccounts = listValidAccounts();
   const multiAccount = validAccounts.length > 1;
   const configDir2 = claudeConfigDir();
   if (!configDir2) {
     console.error("[admin-sessions-list] CLAUDE_CONFIG_DIR not set; returning empty list");
-    return c.json({ sessions: [], accountId: scopeAccountId });
+    return { sessions: [], accountId: scopeAccountId };
   }
   const projectsRoot = join19(configDir2, "projects");
   const jsonls = enumerateJsonls(projectsRoot);
   const liveSessions = await fetchLiveSessions();
-  const accountDir = scopeAccountId ? resolve14(ACCOUNTS_DIR, scopeAccountId) : null;
+  const accountDir = scopeAccountId ? resolve15(ACCOUNTS_DIR, scopeAccountId) : null;
   const userTitles = loadUserTitles(accountDir);
   const account = multiAccount ? validAccounts.find((a) => a.accountId === scopeAccountId) ?? null : resolveAccount();
   let channelUsers = [];
@@ -11701,8 +11945,8 @@ app4.get("/", requireAdminSession, async (c) => {
   if (multiAccount) {
     console.log(`[admin-sessions-list] untagged-accountId-rows=${untaggedCount}`);
   }
-  return c.json({ sessions: rows, accountId: scopeAccountId });
-});
+  return { sessions: rows, accountId: scopeAccountId };
+}
 var sidebar_sessions_default = app4;
 
 // app/lib/agent-errors.ts
@@ -11983,7 +12227,7 @@ function parseTranscript(lines, queuedPendingSuppress = /* @__PURE__ */ new Map(
 
 // app/lib/whatsapp-reader/enrich-attachments.ts
 import { readFileSync as readFileSync20, readdirSync as readdirSync13, existsSync as existsSync16, statSync as statSync7, realpathSync as realpathSync5 } from "fs";
-import { basename as basename5, dirname as dirname6, join as join20, resolve as resolve15, sep as sep4 } from "path";
+import { basename as basename5, dirname as dirname6, join as join20, resolve as resolve16, sep as sep4 } from "path";
 var ADMIN_UPLOAD_PATH = /\/uploads\/(?!public\/)([0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})\//gi;
 function adminAttachmentIds(text) {
   const ids = [];
@@ -12002,19 +12246,19 @@ function adminAttachmentsFromText(text, uploadsBase) {
   return out;
 }
 function claudeUploadsRoot() {
-  return process.env.CLAUDE_CONFIG_DIR ? resolve15(process.env.CLAUDE_CONFIG_DIR, "uploads") : null;
+  return process.env.CLAUDE_CONFIG_DIR ? resolve16(process.env.CLAUDE_CONFIG_DIR, "uploads") : null;
 }
 var CC_MENTION_RE = /@"([^"]+)"/g;
 function claudeUploadAttachmentsFromText(text, sessionId) {
   const root = claudeUploadsRoot();
   if (!root) return { attachments: [], strippedText: text };
-  const sessionDir = resolve15(root, sessionId);
+  const sessionDir = resolve16(root, sessionId);
   const attachments = [];
   const accepted = [];
   for (const m of text.matchAll(CC_MENTION_RE)) {
     let abs;
     try {
-      abs = resolve15(m[1]);
+      abs = resolve16(m[1]);
     } catch {
       continue;
     }
@@ -12067,14 +12311,14 @@ function readAttachmentMeta(dir) {
   return render;
 }
 function listSessionAttachmentsInDir(dir) {
-  let entries;
+  let entries2;
   try {
-    entries = readdirSync13(dir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+    entries2 = readdirSync13(dir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
   } catch {
     return [];
   }
   const sidecars = [];
-  for (const name of entries) {
+  for (const name of entries2) {
     const sidecar = readSidecar(join20(dir, name), name);
     if (sidecar) sidecars.push(sidecar);
   }
@@ -12124,8 +12368,8 @@ function managerBase(tag) {
 }
 
 // server/routes/activity-scan.ts
-function pickActivity(entries, grown, nowMs, concurrencyWindowMs) {
-  const candidates = entries.filter((e) => grown.has(e.hex));
+function pickActivity(entries2, grown, nowMs, concurrencyWindowMs) {
+  const candidates = entries2.filter((e) => grown.has(e.hex));
   if (candidates.length === 0) return null;
   let newest = candidates[0];
   for (const e of candidates) if (e.mtimeMs > newest.mtimeMs) newest = e;
@@ -12370,83 +12614,87 @@ app5.get("/conversations-all", requireAdminSession, async (c) => {
     console.log(`[wa-reader] op=conversations-all-gate decision=deny caller=${caller2?.slice(0, 8) ?? "null"} house=${houseId?.slice(0, 8) ?? "null"}`);
     return c.json({ error: "house-only" }, 403);
   }
-  const cfg = claudeConfigDir();
-  if (!cfg) return c.json({ conversations: [] });
-  const projectsRoot = join21(cfg, "projects");
-  const userTitles = loadUserTitles(ACCOUNTS_DIR ?? null);
-  const validAccounts = listValidAccounts();
-  const validIds = new Set(validAccounts.map((a) => a.accountId));
-  const houseIds = new Set(validAccounts.filter((a) => a.config.role === "house").map((a) => a.accountId));
-  const rawByAccount = /* @__PURE__ */ new Map();
-  for (const { path: path3 } of enumerateJsonls(projectsRoot)) {
-    const sessionId = basename6(path3).replace(/\.jsonl$/, "");
-    const projectDir = dirname7(path3);
-    const meta = readSidecarMeta(join21(projectDir, `${sessionId}.meta.json`));
-    if (!isReaderChannelSession(meta.role, meta.channel)) continue;
-    if (meta.accountId === null || !validIds.has(meta.accountId)) continue;
-    let body = "";
+  const { value, state } = await getOrCompute("conversations-all", houseId, async () => {
+    const cfg = claudeConfigDir();
+    if (!cfg) return { conversations: [] };
+    const projectsRoot = join21(cfg, "projects");
+    const userTitles = loadUserTitles(ACCOUNTS_DIR ?? null);
+    const validAccounts = listValidAccounts();
+    const validIds = new Set(validAccounts.map((a) => a.accountId));
+    const houseIds = new Set(validAccounts.filter((a) => a.config.role === "house").map((a) => a.accountId));
+    const rawByAccount = /* @__PURE__ */ new Map();
+    for (const { path: path3 } of enumerateJsonls(projectsRoot)) {
+      const sessionId = basename6(path3).replace(/\.jsonl$/, "");
+      const projectDir = dirname7(path3);
+      const meta = readSidecarMeta(join21(projectDir, `${sessionId}.meta.json`));
+      if (!isReaderChannelSession(meta.role, meta.channel)) continue;
+      if (meta.accountId === null || !validIds.has(meta.accountId)) continue;
+      let body = "";
+      try {
+        body = readFileSync21(path3, "utf8");
+      } catch {
+      }
+      const { title } = resolveTitle(body, sessionId, userTitles);
+      const turns = parseTranscript(body.split("\n"));
+      const row = {
+        sessionId,
+        projectDir,
+        title,
+        startedAt: meta.startedAt ?? "",
+        role: meta.role,
+        channel: meta.channel,
+        senderId: meta.senderId,
+        lastMessageAt: lastTurnTs(turns),
+        modelGated: isModelGated(turns),
+        model: lastAssistantModel(body)
+      };
+      const list = rawByAccount.get(meta.accountId) ?? [];
+      list.push(row);
+      rawByAccount.set(meta.accountId, list);
+    }
+    let users = [];
     try {
-      body = readFileSync21(path3, "utf8");
-    } catch {
+      users = readUsersFile(USERS_FILE) ?? [];
+    } catch (err) {
+      console.error(`[wa-reader] op=users-file-unreadable reason=${err instanceof Error ? err.message : String(err)}`);
+      users = [];
     }
-    const { title } = resolveTitle(body, sessionId, userTitles);
-    const turns = parseTranscript(body.split("\n"));
-    const row = {
-      sessionId,
-      projectDir,
-      title,
-      startedAt: meta.startedAt ?? "",
-      role: meta.role,
-      channel: meta.channel,
-      senderId: meta.senderId,
-      lastMessageAt: lastTurnTs(turns),
-      modelGated: isModelGated(turns),
-      model: lastAssistantModel(body)
-    };
-    const list = rawByAccount.get(meta.accountId) ?? [];
-    list.push(row);
-    rawByAccount.set(meta.accountId, list);
-  }
-  let users = [];
-  try {
-    users = readUsersFile(USERS_FILE) ?? [];
-  } catch (err) {
-    console.error(`[wa-reader] op=users-file-unreadable reason=${err instanceof Error ? err.message : String(err)}`);
-    users = [];
-  }
-  const perAccount = [];
-  for (const account of validAccounts) {
-    const isHouse = houseIds.has(account.accountId);
-    const sessionRows = selectReaderChannelSessions(rawByAccount.get(account.accountId) ?? []).filter((r) => r.channel !== "whatsapp");
-    const admins = account.config.admins ?? [];
-    const distinct = [...new Set(sessionRows.map((r) => r.senderId).filter((s) => !!s))];
-    const resolved = await resolveOperatorNamesBySender(users, admins, distinct);
-    const nameBySender = /* @__PURE__ */ new Map();
-    for (const senderId of distinct) nameBySender.set(senderId, resolved.get(senderId)?.name ?? null);
-    const named = sessionRows.map((r) => ({
-      ...r,
-      operatorName: r.senderId ? nameBySender.get(r.senderId) ?? null : null
-    }));
-    const storeRows = buildStoreConversationRows(account.accountId, readConversationSummaries(account.accountId));
-    perAccount.push({ isHouse, rows: [...named, ...storeRows] });
-  }
-  const houseAccount = validAccounts.find((a) => a.accountId === houseId) ?? null;
-  const subManagerPhones = /* @__PURE__ */ new Map();
-  if (houseAccount) {
-    const managers = readAccountManagers(houseAccount.accountDir);
-    for (const a of validAccounts) {
-      if (houseIds.has(a.accountId)) continue;
-      const phones = managerPhonesForAccount(managers, a.accountId);
-      if (phones.length > 0) subManagerPhones.set(a.accountId, phones);
-    }
-  }
-  const merged = tagAndMergeInstallConversations(perAccount);
-  const conversations = dropHouseRowsOwnedBySubAccount(merged, subManagerPhones);
-  const houseRows = conversations.filter((r) => r.isHouse).length;
-  console.log(
-    `[wa-reader] op=conversations-all accounts=${validAccounts.length} rows=${conversations.length} house=${houseRows} sub=${conversations.length - houseRows} deduped=${merged.length - conversations.length}`
-  );
-  return c.json({ conversations });
+    const perAccount = [];
+    for (const account of validAccounts) {
+      const isHouse = houseIds.has(account.accountId);
+      const sessionRows = selectReaderChannelSessions(rawByAccount.get(account.accountId) ?? []).filter((r) => r.channel !== "whatsapp");
+      const admins = account.config.admins ?? [];
+      const distinct = [...new Set(sessionRows.map((r) => r.senderId).filter((s) => !!s))];
+      const resolved = await resolveOperatorNamesBySender(users, admins, distinct);
+      const nameBySender = /* @__PURE__ */ new Map();
+      for (const senderId of distinct) nameBySender.set(senderId, resolved.get(senderId)?.name ?? null);
+      const named = sessionRows.map((r) => ({
+        ...r,
+        operatorName: r.senderId ? nameBySender.get(r.senderId) ?? null : null
+      }));
+      const storeRows = buildStoreConversationRows(account.accountId, readConversationSummaries(account.accountId));
+      perAccount.push({ isHouse, rows: [...named, ...storeRows] });
+    }
+    const houseAccount = validAccounts.find((a) => a.accountId === houseId) ?? null;
+    const subManagerPhones = /* @__PURE__ */ new Map();
+    if (houseAccount) {
+      const managers = readAccountManagers(houseAccount.accountDir);
+      for (const a of validAccounts) {
+        if (houseIds.has(a.accountId)) continue;
+        const phones = managerPhonesForAccount(managers, a.accountId);
+        if (phones.length > 0) subManagerPhones.set(a.accountId, phones);
+      }
+    }
+    const merged = tagAndMergeInstallConversations(perAccount);
+    const conversations = dropHouseRowsOwnedBySubAccount(merged, subManagerPhones);
+    const houseRows = conversations.filter((r) => r.isHouse).length;
+    console.log(
+      `[wa-reader] op=conversations-all accounts=${validAccounts.length} rows=${conversations.length} house=${houseRows} sub=${conversations.length - houseRows} deduped=${merged.length - conversations.length}`
+    );
+    return { conversations };
+  });
+  console.log(`[wa-reader] op=conversations-all cache=${state} house=${houseId.slice(0, 8)}`);
+  return c.json(value);
 });
 function readFrom(path3, from) {
   const end = statSync8(path3).size;
@@ -12500,7 +12748,7 @@ function enrichAdminAttachments(turn, sessionId) {
   if (turn.kind !== "operator-inbound") return turn;
   if (!turn.text.includes('@"') && adminAttachmentIds(turn.text).length === 0) return turn;
   const account = resolveAccount();
-  const store2 = account ? adminAttachmentsFromText(turn.text, resolve16(DATA_ROOT, "accounts", account.accountId, "uploads")) : [];
+  const store2 = account ? adminAttachmentsFromText(turn.text, resolve17(DATA_ROOT, "accounts", account.accountId, "uploads")) : [];
   const cc = claudeUploadAttachmentsFromText(turn.text, sessionId);
   if (cc.attachments.length > 0) {
     console.log(`[session-upload-shape] op=mention accepted=${cc.attachments.length} session=${sessionId.slice(0, 8)}`);
@@ -12569,7 +12817,7 @@ function runActivityTick(c) {
     names = readdirSync14(c.subagentsDir).filter((n) => AGENT_JSONL_RE.test(n));
   } catch {
   }
-  const entries = [];
+  const entries2 = [];
   for (const name of names) {
     const hex = name.replace(AGENT_JSONL_RE, "$1");
     let size = 0;
@@ -12583,14 +12831,14 @@ function runActivityTick(c) {
     }
     if (!c.initialSize.has(hex)) c.initialSize.set(hex, size);
     if (size > (c.initialSize.get(hex) ?? size)) c.grown.add(hex);
-    entries.push({ hex, size, mtimeMs });
+    entries2.push({ hex, size, mtimeMs });
   }
   const openKey = openTaskKey(c.lastParentTurns);
   if (openKey && c.subagentFrames === 0 && !c.reconcileLogged.has(openKey)) {
     c.reconcileLogged.add(openKey);
     c.log(`[webchat-activity] op=reconcile-gap key=${c.sessionKey} toolUseId=${openKey} framesEmitted=0`);
   }
-  const pick = pickActivity(entries, c.grown, c.now, CONCURRENCY_WINDOW_MS);
+  const pick = pickActivity(entries2, c.grown, c.now, CONCURRENCY_WINDOW_MS);
   if (!pick) return;
   const meta = readSubagentMeta(c.subagentsDir, pick.hex);
   if (!meta) return;
@@ -12620,11 +12868,11 @@ app5.get("/stream", requireAdminSession, (c) => {
   const sessionId = c.req.query("sessionId") ?? "";
   const projectDir = c.req.query("projectDir") ?? "";
   const cfg = claudeConfigDir();
-  const projectsRoot = cfg ? resolve16(join21(cfg, "projects")) : null;
+  const projectsRoot = cfg ? resolve17(join21(cfg, "projects")) : null;
   if (!cfg || !projectsRoot || !SESSION_ID_RE2.test(sessionId)) {
     return c.json({ error: "bad session reference" }, 400);
   }
-  const jsonlPath = resolve16(join21(projectDir, `${sessionId}.jsonl`));
+  const jsonlPath = resolve17(join21(projectDir, `${sessionId}.jsonl`));
   if (!jsonlPath.startsWith(projectsRoot + sep5)) {
     return c.json({ error: "bad session reference" }, 400);
   }
@@ -12651,7 +12899,7 @@ data: ${JSON.stringify(turn)}
       let offset = resumeOffset(lastEventId, fileEnd0);
       console.log(`[wa-stream] op=open conn=${connId} sessionId=${sessionId} channel=reader resume=${offset}`);
       const sessionKey = c.req.query("session_key") ?? "";
-      const subagentsDir = resolve16(join21(projectDir, sessionId, "subagents"));
+      const subagentsDir = resolve17(join21(projectDir, sessionId, "subagents"));
       console.log(
         `[webchat-activity] op=watch-subagents key=${sessionKey} dir=${subagentsDir} exists=${existsSync17(subagentsDir)}`
       );
@@ -12715,7 +12963,7 @@ data: ${JSON.stringify(obj)}
       }
       let watcher = null;
       try {
-        watcher = watch(jsonlPath, drain);
+        watcher = watch2(jsonlPath, drain);
       } catch {
       }
       const tick = () => {
@@ -12761,7 +13009,7 @@ var DIRECTIVE_NAME_RE = /^\d+-\d+\.txt$/;
 function directiveStoreDir(sessionId) {
   const account = resolveAccount();
   if (!account) return null;
-  return resolve16(account.accountDir, "logs", "prompt-optimiser-directives", sessionId);
+  return resolve17(account.accountDir, "logs", "prompt-optimiser-directives", sessionId);
 }
 app5.get("/directives", requireAdminSession, (c) => {
   const sessionId = c.req.query("sessionId") ?? "";
@@ -12774,7 +13022,7 @@ app5.get("/directives", requireAdminSession, (c) => {
   } catch {
     return c.json({ entries: [] });
   }
-  const entries = names.map((name) => {
+  const entries2 = names.map((name) => {
     const [secsPart, pidPart] = name.replace(/\.txt$/, "").split("-");
     const secs = Number(secsPart);
     const pid = Number(pidPart);
@@ -12785,7 +13033,7 @@ app5.get("/directives", requireAdminSession, (c) => {
     }
     return { name, secs, pid, ts: Number.isFinite(secs) ? new Date(secs * 1e3).toISOString() : null, len };
   }).sort((a, b) => a.secs - b.secs || a.pid - b.pid).map(({ name, ts, len }) => ({ name, ts, len }));
-  return c.json({ entries });
+  return c.json({ entries: entries2 });
 });
 app5.get("/directive", requireAdminSession, (c) => {
   const sessionId = c.req.query("sessionId") ?? "";
@@ -12795,7 +13043,7 @@ app5.get("/directive", requireAdminSession, (c) => {
   }
   const dir = directiveStoreDir(sessionId);
   if (!dir) return c.json({ error: "no account" }, 404);
-  const path3 = resolve16(join21(dir, name));
+  const path3 = resolve17(join21(dir, name));
   if (!path3.startsWith(dir + sep5)) return c.json({ error: "bad reference" }, 400);
   let body;
   try {
@@ -12825,7 +13073,7 @@ app5.get("/store-stream", requireAdminSession, (c) => {
   const connId = `${remoteJid.slice(0, 12)}-${process.hrtime.bigint().toString(36).slice(-6)}`;
   const startedAt = Date.now();
   const lastEventId = c.req.header("Last-Event-ID");
-  const uploadsBase = resolve16(DATA_ROOT, "accounts", accountId, "uploads");
+  const uploadsBase = resolve17(DATA_ROOT, "accounts", accountId, "uploads");
   const byMsgKeyId = /* @__PURE__ */ new Map();
   const reactionRecords = [];
   const reactionsForTarget = (msgKeyId) => foldReactions(reactionRecords).get(msgKeyId);
@@ -12954,7 +13202,7 @@ data: ${JSON.stringify(payload)}
       };
       let watcher = null;
       try {
-        watcher = watch(file, drain);
+        watcher = watch2(file, drain);
       } catch {
       }
       const lifecycle = openStream(connId, "store", startedAt);
@@ -13233,8 +13481,8 @@ app5.post("/reply", requireAdminSession, async (c) => {
 var whatsapp_reader_default = app5;
 
 // server/routes/public-reader.ts
-import { statSync as statSync9, openSync as openSync2, readSync as readSync2, closeSync as closeSync2, watch as watch2, readFileSync as readFileSync22, readdirSync as readdirSync15 } from "fs";
-import { basename as basename7, dirname as dirname8, join as join22, resolve as resolve17, sep as sep6 } from "path";
+import { statSync as statSync9, openSync as openSync2, readSync as readSync2, closeSync as closeSync2, watch as watch3, readFileSync as readFileSync22, readdirSync as readdirSync15 } from "fs";
+import { basename as basename7, dirname as dirname8, join as join22, resolve as resolve18, sep as sep6 } from "path";
 
 // app/lib/whatsapp-reader/delivered-kinds.ts
 var PUBLIC_DELIVERED_KINDS = /* @__PURE__ */ new Set([
@@ -13356,7 +13604,7 @@ app6.get("/session", (c) => {
   return c.json({ sessionId: null, projectDir: null, sessionKey });
 });
 function publicUploadsDir(accountId, sessionId) {
-  return resolve17(DATA_ROOT, "accounts", accountId, "uploads", "public", sessionId);
+  return resolve18(DATA_ROOT, "accounts", accountId, "uploads", "public", sessionId);
 }
 function enrichPublicAttachments(turns, sessionAttachments, cursor) {
   for (const turn of turns) {
@@ -13387,11 +13635,11 @@ app6.get("/stream", (c) => {
   const sessionId = c.req.query("sessionId") ?? "";
   const projectDir = c.req.query("projectDir") ?? "";
   const cfg = claudeConfigDir();
-  const projectsRoot = cfg ? resolve17(join22(cfg, "projects")) : null;
+  const projectsRoot = cfg ? resolve18(join22(cfg, "projects")) : null;
   if (!cfg || !projectsRoot || !SESSION_ID_RE2.test(sessionId)) {
     return c.json({ error: "bad session reference" }, 400);
   }
-  const jsonlPath = resolve17(join22(projectDir, `${sessionId}.jsonl`));
+  const jsonlPath = resolve18(join22(projectDir, `${sessionId}.jsonl`));
   if (!jsonlPath.startsWith(projectsRoot + sep6)) {
     return c.json({ error: "bad session reference" }, 400);
   }
@@ -13440,7 +13688,7 @@ data: ${JSON.stringify(turn)}
       };
       let watcher = null;
       try {
-        watcher = watch2(jsonlPath, drain);
+        watcher = watch3(jsonlPath, drain);
       } catch {
       }
       const poll = setInterval(drain, 1e3);
@@ -13495,7 +13743,7 @@ app6.get("/attachment/:attachmentId", (c) => {
     return new Response("Not found", { status: 404 });
   }
   const uploadsRoot = publicUploadsDir(account.accountId, sessionId);
-  const dir = resolve17(uploadsRoot, attachmentId);
+  const dir = resolve18(uploadsRoot, attachmentId);
   if (!dir.startsWith(uploadsRoot + sep6)) {
     console.error(`${ATT_TAG} op=denied session=${ses} att=${at} reason=bad-id`);
     return new Response("Not found", { status: 404 });
@@ -13510,7 +13758,7 @@ app6.get("/attachment/:attachmentId", (c) => {
   try {
     dataFile = readdirSync15(dir).find((f) => !f.endsWith(".meta.json") && !f.endsWith(EXTRACTED_TEXT_SUFFIX));
     if (!dataFile) throw new Error("no data file");
-    buffer = readFileSync22(resolve17(dir, dataFile));
+    buffer = readFileSync22(resolve18(dir, dataFile));
   } catch {
     console.error(`${ATT_TAG} op=denied session=${ses} att=${at} reason=not-found`);
     return new Response("Not found", { status: 404 });
@@ -14364,7 +14612,7 @@ ${note}` : note;
 }
 
 // server/routes/webchat-greeting.ts
-import { resolve as resolve18 } from "path";
+import { resolve as resolve19 } from "path";
 
 // app/lib/claude-agent/specialist-roster.ts
 import { existsSync as existsSync20, readFileSync as readFileSync26, readdirSync as readdirSync18 } from "fs";
@@ -14380,10 +14628,10 @@ function field(fm, name) {
 }
 function readSpecialistRoster(specialistsDir) {
   if (!existsSync20(specialistsDir)) return { specialists: [], skipped: [] };
-  const entries = readdirSync18(specialistsDir);
+  const entries2 = readdirSync18(specialistsDir);
   const specialists = [];
   const skipped = [];
-  for (const file of entries.sort()) {
+  for (const file of entries2.sort()) {
     if (!file.endsWith(".md")) continue;
     let raw;
     try {
@@ -14469,7 +14717,7 @@ app7.get("/", requireAdminSession, async (c) => {
     let specialists = [];
     try {
       const roster = readSpecialistRoster(
-        resolve18(ACCOUNTS_DIR, accountId, "specialists", "agents")
+        resolve19(ACCOUNTS_DIR, accountId, "specialists", "agents")
       );
       specialists = roster.specialists;
       for (const s of roster.skipped) {
@@ -14504,7 +14752,7 @@ var webchat_greeting_default = app7;
 
 // server/routes/telegram.ts
 import { homedir as homedir2 } from "os";
-import { resolve as resolve19, join as join27 } from "path";
+import { resolve as resolve20, join as join27 } from "path";
 import { existsSync as existsSync21, readFileSync as readFileSync27 } from "fs";
 
 // app/lib/telegram/gateway/instance.ts
@@ -14563,7 +14811,7 @@ function routeTelegramUpdate(input) {
 // server/routes/telegram.ts
 var TAG29 = "[telegram-inbound]";
 function configDirName() {
-  const platformRoot5 = process.env.MAXY_PLATFORM_ROOT ?? resolve19(process.cwd(), "..");
+  const platformRoot5 = process.env.MAXY_PLATFORM_ROOT ?? resolve20(process.cwd(), "..");
   const brandPath = join27(platformRoot5, "config", "brand.json");
   if (existsSync21(brandPath)) {
     try {
@@ -14575,7 +14823,7 @@ function configDirName() {
 }
 function secretPath(botType) {
   const filename = botType === "admin" ? ".telegram-admin-webhook-secret" : ".telegram-webhook-secret";
-  return resolve19(homedir2(), configDirName(), filename);
+  return resolve20(homedir2(), configDirName(), filename);
 }
 var app8 = new Hono();
 app8.post("/", async (c) => {
@@ -15013,14 +15261,14 @@ function computeAdminStoreDivergence(input) {
   }
   const accountUserIds = /* @__PURE__ */ new Set();
   if (existsSync23(input.accountsDir)) {
-    let entries;
+    let entries2;
     try {
-      entries = readdirSync19(input.accountsDir);
+      entries2 = readdirSync19(input.accountsDir);
     } catch (err) {
       result.errors.push({ source: input.accountsDir, detail: err instanceof Error ? err.message : String(err) });
       return result;
     }
-    for (const entry of entries) {
+    for (const entry of entries2) {
       if (entry.startsWith(".")) continue;
       const accountDir = join29(input.accountsDir, entry);
       try {
@@ -15716,15 +15964,15 @@ function operatorRoleFor(config, userId) {
 async function buildAccountOptionList(accounts, userId) {
   const houseAccount = accounts.find((a) => a.config.role === "house");
   console.log(`[admin-accounts] op=list count=${accounts.length} house=${houseAccount?.accountId ?? "none"}`);
-  const resolve45 = async (a) => {
+  const resolve46 = async (a) => {
     const businessName = await fetchAccountName(a.accountId) || void 0;
     return { accountId: a.accountId, businessName, role: operatorRoleFor(a.config, userId), isHouse: a.config.role === "house" };
   };
   const houseOptions = await Promise.all(
-    accounts.filter((a) => a.config.role === "house").map(resolve45)
+    accounts.filter((a) => a.config.role === "house").map(resolve46)
   );
   const nonHouseOptions = await Promise.all(
-    accounts.filter((a) => a.config.role !== "house").map(resolve45)
+    accounts.filter((a) => a.config.role !== "house").map(resolve46)
   );
   const sortKey = (o) => (o.businessName || o.accountId).toLowerCase();
   nonHouseOptions.sort((x, y) => {
@@ -15858,7 +16106,7 @@ var accounts_default = app13;
 
 // server/routes/admin/logs.ts
 import { existsSync as existsSync27, readdirSync as readdirSync20, readFileSync as readFileSync31, statSync as statSync13 } from "fs";
-import { resolve as resolve20, basename as basename9 } from "path";
+import { resolve as resolve21, basename as basename9 } from "path";
 
 // app/lib/logs-read-resolve.ts
 import { existsSync as existsSync26 } from "fs";
@@ -15885,7 +16133,7 @@ app14.get("/", async (c) => {
   const cacheKeyParam = c.req.query("cacheKey");
   const download = c.req.query("download") === "1";
   const account = resolveAccount();
-  const accountLogDir = account ? resolve20(account.accountDir, "logs") : null;
+  const accountLogDir = account ? resolve21(account.accountDir, "logs") : null;
   const logDirs = [];
   if (accountLogDir) logDirs.push(accountLogDir);
   logDirs.push(LOG_DIR);
@@ -15893,7 +16141,7 @@ app14.get("/", async (c) => {
     const safe = basename9(fileParam);
     const searched = [];
     for (const dir of logDirs) {
-      const filePath = resolve20(dir, safe);
+      const filePath = resolve21(dir, safe);
       searched.push(filePath);
       try {
         const buffer = readFileSync31(filePath);
@@ -16005,10 +16253,10 @@ app14.get("/", async (c) => {
       console.warn(`[admin/logs] readdir-fail dir=${dir} reason=${reason}`);
       continue;
     }
-    files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync13(resolve20(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
+    files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync13(resolve21(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
       seen.add(name);
       try {
-        const content = readFileSync31(resolve20(dir, name));
+        const content = readFileSync31(resolve21(dir, name));
         const tail = content.length > TAIL_BYTES ? content.subarray(content.length - TAIL_BYTES).toString("utf-8") : content.toString("utf-8");
         logs[name] = tail.trim() || "(empty)";
       } catch (err) {
@@ -16049,11 +16297,11 @@ var claude_info_default = app15;
 // server/routes/admin/attachment.ts
 import { readFile as readFile4, readdir as readdir2 } from "fs/promises";
 import { existsSync as existsSync28 } from "fs";
-import { resolve as resolve21 } from "path";
+import { resolve as resolve22 } from "path";
 var app16 = new Hono();
 var ATTACHMENT_ID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 function uploadsDirFor2(accountId, attachmentId) {
-  return resolve21(DATA_ROOT, "accounts", accountId, "uploads", attachmentId);
+  return resolve22(DATA_ROOT, "accounts", accountId, "uploads", attachmentId);
 }
 app16.get("/:attachmentId", requireAdminSession, async (c) => {
   const attachmentId = c.req.param("attachmentId");
@@ -16090,7 +16338,7 @@ app16.get("/:attachmentId", requireAdminSession, async (c) => {
   if (!found) {
     return new Response("Not found", { status: 404 });
   }
-  const metaPath = resolve21(dir, `${attachmentId}.meta.json`);
+  const metaPath = resolve22(dir, `${attachmentId}.meta.json`);
   if (!existsSync28(metaPath)) {
     return new Response("Not found", { status: 404 });
   }
@@ -16100,12 +16348,12 @@ app16.get("/:attachmentId", requireAdminSession, async (c) => {
   } catch {
     return new Response("Not found", { status: 404 });
   }
-  const entries = await readdir2(dir);
-  const dataFile = entries.find((f) => !f.endsWith(".meta.json") && !f.endsWith(EXTRACTED_TEXT_SUFFIX));
+  const entries2 = await readdir2(dir);
+  const dataFile = entries2.find((f) => !f.endsWith(".meta.json") && !f.endsWith(EXTRACTED_TEXT_SUFFIX));
   if (!dataFile) {
     return new Response("Not found", { status: 404 });
   }
-  const filePath = resolve21(dir, dataFile);
+  const filePath = resolve22(dir, dataFile);
   const buffer = await readFile4(filePath);
   const inlineSafe = isInlineSafeMime(meta.mimeType);
   const safeName = meta.filename.replace(/["\\\r\n]/g, "_");
@@ -16167,8 +16415,35 @@ app17.get("/", requireAdminSession, async (c) => {
 var session_upload_default = app17;
 
 // server/routes/admin/agents.ts
-import { resolve as resolve22 } from "path";
+import { resolve as resolve23 } from "path";
 import { readdirSync as readdirSync21, readFileSync as readFileSync32, existsSync as existsSync30, rmSync as rmSync2 } from "fs";
+
+// server/routes/admin/_account-scope.ts
+function accountDirForSession(cacheKey) {
+  const accountId = getAccountIdForSession(cacheKey);
+  if (!accountId) return null;
+  const match = listValidAccounts().find((a) => a.accountId === accountId);
+  return match ? { accountId, accountDir: match.accountDir } : null;
+}
+function validateAccountId2(accountId) {
+  if (!accountId) return null;
+  const match = listValidAccounts().find((a) => a.accountId === accountId);
+  return match ? { accountId, accountDir: match.accountDir } : null;
+}
+async function authorizeAccountWrite(c, accountId) {
+  const remote = c.env?.incoming?.socket?.remoteAddress ?? "";
+  const peerIsLoopback = remote === "127.0.0.1" || remote === "::1" || remote === "::ffff:127.0.0.1";
+  if (peerIsLoopback && !c.req.header("x-forwarded-for")) return { ok: true, via: "on-device" };
+  const { fingerprint, signedSessionToken } = await resolveCacheKey(c);
+  if (!fingerprint || !validateSession(fingerprint, "admin", signedSessionToken).ok) {
+    return { ok: false, reason: "no-session" };
+  }
+  const acct = accountDirForSession(fingerprint);
+  if (!acct || acct.accountId !== accountId) return { ok: false, reason: "account-mismatch" };
+  return { ok: true, via: "session" };
+}
+
+// server/routes/admin/agents.ts
 var SLUG_UNSAFE = (s) => s.includes("/") || s.includes("..") || s.includes("\\");
 function subdirs(dir) {
   if (!existsSync30(dir)) return [];
@@ -16189,22 +16464,22 @@ function splitFrontmatter(text) {
   return { fm, body: text.slice(m[0].length) };
 }
 function listSpecialists(accountDir) {
-  const pluginsDir = resolve22(accountDir, "plugins");
+  const pluginsDir = resolve23(accountDir, "plugins");
   const specialists = [];
   let specialistsSkipped = 0;
   for (const plugin of subdirs(pluginsDir).sort()) {
-    const agentsDirP = resolve22(pluginsDir, plugin, "agents");
+    const agentsDirP = resolve23(pluginsDir, plugin, "agents");
     if (!existsSync30(agentsDirP)) continue;
-    let entries;
+    let entries2;
     try {
-      entries = readdirSync21(agentsDirP, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+      entries2 = readdirSync21(agentsDirP, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
     } catch {
       continue;
     }
-    for (const entry of entries) {
+    for (const entry of entries2) {
       if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
       try {
-        const { fm } = splitFrontmatter(readFileSync32(resolve22(agentsDirP, entry.name), "utf-8"));
+        const { fm } = splitFrontmatter(readFileSync32(resolve23(agentsDirP, entry.name), "utf-8"));
         if (!fm.name) {
           specialistsSkipped++;
           console.error(`[admin/agents] op=list-specialist-skip plugin=${plugin} file=${entry.name}`);
@@ -16232,19 +16507,22 @@ var OWNED_DOCS = [
   { file: "KNOWLEDGE-SUMMARY.md", key: "knowledgeSummary" }
 ];
 var app18 = new Hono();
-app18.get("/", (c) => {
-  const account = resolveAccount();
-  if (!account) return c.json({ agents: [], skipped: 0, specialistsSkipped: 0 });
+app18.get("/", requireAdminSession, (c) => {
+  const account = accountDirForSession(c.var.cacheKey);
+  if (!account) {
+    console.error("[admin/agents] op=list auth-rejected reason=no-account-for-session");
+    return c.json({ error: "Account not found for session" }, 401);
+  }
   const agents = [];
   let skipped = 0;
-  const agentsDir = resolve22(account.accountDir, "agents");
+  const agentsDir = resolve23(account.accountDir, "agents");
   if (existsSync30(agentsDir)) {
     try {
-      const entries = readdirSync21(agentsDir, { withFileTypes: true });
-      for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+      const entries2 = readdirSync21(agentsDir, { withFileTypes: true });
+      for (const entry of entries2.sort((a, b) => a.name.localeCompare(b.name))) {
         if (!entry.isDirectory()) continue;
         if (entry.name === "admin") continue;
-        const configPath2 = resolve22(agentsDir, entry.name, "config.json");
+        const configPath2 = resolve23(agentsDir, entry.name, "config.json");
         if (!existsSync30(configPath2)) continue;
         try {
           const config = JSON.parse(readFileSync32(configPath2, "utf-8"));
@@ -16264,22 +16542,25 @@ app18.get("/", (c) => {
     }
   }
   const { specialists, specialistsSkipped } = listSpecialists(account.accountDir);
-  console.log(`[admin/agents] op=list agents=${agents.length} specialists=${specialists.length} skipped=${skipped} specialistsSkipped=${specialistsSkipped}`);
-  return c.json({ agents: [...agents, ...specialists], skipped, specialistsSkipped });
+  console.log(`[admin/agents] op=list accountId=${account.accountId.slice(0, 8)} agents=${agents.length} specialists=${specialists.length} skipped=${skipped} specialistsSkipped=${specialistsSkipped}`);
+  return c.json({ agents: [...agents, ...specialists], accountId: account.accountId, skipped, specialistsSkipped });
 });
-app18.get("/:slug", (c) => {
+app18.get("/:slug", requireAdminSession, (c) => {
   const slug = c.req.param("slug");
-  const account = resolveAccount();
-  if (!account) return c.json({ error: "No account resolved" }, 400);
+  const account = accountDirForSession(c.var.cacheKey);
+  if (!account) {
+    console.error("[admin/agents] op=detail auth-rejected reason=no-account-for-session");
+    return c.json({ error: "Account not found for session" }, 401);
+  }
   if (SLUG_UNSAFE(slug)) return c.json({ error: "Invalid agent slug" }, 400);
   const pluginParam = c.req.query("plugin");
   if (pluginParam) {
     if (SLUG_UNSAFE(pluginParam)) return c.json({ error: "Invalid plugin" }, 400);
-    const file = resolve22(account.accountDir, "plugins", pluginParam, "agents", `${slug}.md`);
+    const file = resolve23(account.accountDir, "plugins", pluginParam, "agents", `${slug}.md`);
     if (!existsSync30(file)) return c.json({ error: "Agent not found" }, 404);
     const { fm, body } = splitFrontmatter(readFileSync32(file, "utf-8"));
-    const skills = subdirs(resolve22(account.accountDir, "plugins", pluginParam, "skills"));
-    console.log(`[admin/agents] op=detail slug=${slug} kind=specialist plugin=${pluginParam}`);
+    const skills = subdirs(resolve23(account.accountDir, "plugins", pluginParam, "skills"));
+    console.log(`[admin/agents] op=detail accountId=${account.accountId.slice(0, 8)} slug=${slug} kind=specialist plugin=${pluginParam}`);
     return c.json({
       agent: {
         kind: "specialist",
@@ -16294,8 +16575,8 @@ app18.get("/:slug", (c) => {
       }
     });
   }
-  const agentDir = resolve22(account.accountDir, "agents", slug);
-  const configPath2 = resolve22(agentDir, "config.json");
+  const agentDir = resolve23(account.accountDir, "agents", slug);
+  const configPath2 = resolve23(agentDir, "config.json");
   if (!existsSync30(configPath2)) return c.json({ error: "Agent not found" }, 404);
   let config;
   try {
@@ -16307,7 +16588,7 @@ app18.get("/:slug", (c) => {
   const docs = {};
   const present = {};
   for (const { file, key } of OWNED_DOCS) {
-    const p = resolve22(agentDir, file);
+    const p = resolve23(agentDir, file);
     try {
       if (existsSync30(p)) {
         docs[key] = readFileSync32(p, "utf-8");
@@ -16323,7 +16604,7 @@ app18.get("/:slug", (c) => {
     }
   }
   const found = Object.keys(present).filter((k) => present[k]);
-  console.log(`[admin/agents] op=detail slug=${slug} present=${found.join(",") || "none"}`);
+  console.log(`[admin/agents] op=detail accountId=${account.accountId.slice(0, 8)} slug=${slug} kind=public present=${found.join(",") || "none"}`);
   return c.json({
     agent: {
       slug,
@@ -16341,15 +16622,28 @@ app18.get("/:slug", (c) => {
 });
 app18.delete("/:slug", async (c) => {
   const slug = c.req.param("slug");
-  const account = resolveAccount();
-  if (!account) return c.json({ error: "No account resolved" }, 400);
   if (slug === "admin") {
     return c.json({ error: "Cannot delete the admin agent" }, 403);
   }
   if (SLUG_UNSAFE(slug)) {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
-  const agentDir = resolve22(account.accountDir, "agents", slug);
+  const accountIdParam = c.req.query("accountId") ?? "";
+  if (!accountIdParam) {
+    console.error(`[admin/agents] op=delete rejected reason=missing-accountId slug=${slug}`);
+    return c.json({ error: "accountId is required" }, 400);
+  }
+  const account = validateAccountId2(accountIdParam);
+  if (!account) {
+    console.error(`[admin/agents] op=delete rejected reason=unknown-accountId accountId=${accountIdParam.slice(0, 8)} slug=${slug}`);
+    return c.json({ error: "Unknown accountId" }, 400);
+  }
+  const authz = await authorizeAccountWrite(c, account.accountId);
+  if (!authz.ok) {
+    console.error(`[admin/agents] op=delete rejected reason=${authz.reason} accountId=${account.accountId.slice(0, 8)} slug=${slug}`);
+    return c.json({ error: "Not authorized for this account" }, 403);
+  }
+  const agentDir = resolve23(account.accountDir, "agents", slug);
   if (!existsSync30(agentDir)) {
     return c.json({ error: "Agent not found" }, 404);
   }
@@ -16357,29 +16651,42 @@ app18.delete("/:slug", async (c) => {
     await deleteAgentProjection(account.accountId, slug);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    console.error(`[admin/agents] graph cleanup failed for agent "${slug}", aborting file removal: ${msg}`);
+    console.error(`[admin/agents] op=delete accountId=${account.accountId.slice(0, 8)} slug=${slug} outcome=failed reason=graph-cleanup-failed error="${msg}" \u2014 files preserved`);
     return c.json({ error: `Graph cleanup failed: ${msg}` }, 500);
   }
   try {
     rmSync2(agentDir, { recursive: true, force: true });
-    console.log(`[admin/agents] deleted agent "${slug}"`);
+    console.log(`[admin/agents] op=delete accountId=${account.accountId.slice(0, 8)} slug=${slug} outcome=ok`);
     return c.json({ ok: true });
   } catch (err) {
-    console.error(`[admin/agents] failed to delete agent "${slug}": ${err}`);
+    console.error(`[admin/agents] op=delete accountId=${account.accountId.slice(0, 8)} slug=${slug} outcome=failed reason=rm-error error="${err}"`);
     return c.json({ error: "Failed to delete agent" }, 500);
   }
 });
 app18.post("/:slug/project", async (c) => {
   const slug = c.req.param("slug");
-  const account = resolveAccount();
-  if (!account) return c.json({ error: "No account resolved" }, 400);
   if (slug === "admin") {
     return c.json({ error: "Cannot project the admin agent" }, 403);
   }
   if (SLUG_UNSAFE(slug)) {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
-  const agentDir = resolve22(account.accountDir, "agents", slug);
+  const accountIdParam = c.req.query("accountId") ?? "";
+  if (!accountIdParam) {
+    console.error(`[admin/agents] op=project rejected reason=missing-accountId slug=${slug}`);
+    return c.json({ error: "accountId is required" }, 400);
+  }
+  const account = validateAccountId2(accountIdParam);
+  if (!account) {
+    console.error(`[admin/agents] op=project rejected reason=unknown-accountId accountId=${accountIdParam.slice(0, 8)} slug=${slug}`);
+    return c.json({ error: "Unknown accountId" }, 400);
+  }
+  const authz = await authorizeAccountWrite(c, account.accountId);
+  if (!authz.ok) {
+    console.error(`[admin/agents] op=project rejected reason=${authz.reason} accountId=${account.accountId.slice(0, 8)} slug=${slug}`);
+    return c.json({ error: "Not authorized for this account" }, 403);
+  }
+  const agentDir = resolve23(account.accountDir, "agents", slug);
   if (!existsSync30(agentDir)) {
     return c.json({ error: "Agent not found on disk" }, 404);
   }
@@ -17083,7 +17390,7 @@ var sessions_default = app19;
 
 // app/lib/claude-agent/spawn-context.ts
 import { existsSync as existsSync32, readFileSync as readFileSync33, readdirSync as readdirSync22, statSync as statSync15 } from "fs";
-import { dirname as dirname12, resolve as resolve23, join as join33 } from "path";
+import { dirname as dirname12, resolve as resolve24, join as join33 } from "path";
 async function resolveOwnerProfileBlock(accountId, userId) {
   if (!userId) return { ok: false, reason: "missing-user-id" };
   try {
@@ -17180,7 +17487,7 @@ function parseSkillPathsFromFrontmatter(fm) {
 }
 function listPluginDirs(accountPluginsDir) {
   const out = /* @__PURE__ */ new Map();
-  const platformPlugins = resolve23(PLATFORM_ROOT, "plugins");
+  const platformPlugins = resolve24(PLATFORM_ROOT, "plugins");
   if (existsSync32(platformPlugins)) {
     for (const name of readdirSync22(platformPlugins)) {
       const dir = join33(platformPlugins, name);
@@ -17190,7 +17497,7 @@ function listPluginDirs(accountPluginsDir) {
       }
     }
   }
-  const premiumRoot = resolve23(dirname12(PLATFORM_ROOT), "premium-plugins");
+  const premiumRoot = resolve24(dirname12(PLATFORM_ROOT), "premium-plugins");
   if (existsSync32(premiumRoot)) {
     for (const bundle of readdirSync22(premiumRoot)) {
       const bundlePlugins = join33(premiumRoot, bundle, "plugins");
@@ -17223,7 +17530,7 @@ function listPluginDirs(accountPluginsDir) {
   return out;
 }
 function accountPluginsDirFor(accountId) {
-  return resolve23(PLATFORM_ROOT, "..", "data/accounts", accountId, "plugins");
+  return resolve24(PLATFORM_ROOT, "..", "data/accounts", accountId, "plugins");
 }
 function listAccountPluginNames(accountPluginsDir) {
   if (!existsSync32(accountPluginsDir)) return [];
@@ -17240,7 +17547,7 @@ function listAccountPluginNames(accountPluginsDir) {
   }
 }
 function readEnabledPlugins(accountId) {
-  const accountFile = resolve23(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
+  const accountFile = resolve24(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
   if (!existsSync32(accountFile)) return /* @__PURE__ */ new Set();
   try {
     const parsed = JSON.parse(readFileSync33(accountFile, "utf-8"));
@@ -17316,11 +17623,11 @@ ${skillFm}
   return out;
 }
 function computeSpecialistDomains(accountId) {
-  const specialistsDir = resolve23(PLATFORM_ROOT, "..", "data/accounts", accountId, "specialists", "agents");
+  const specialistsDir = resolve24(PLATFORM_ROOT, "..", "data/accounts", accountId, "specialists", "agents");
   if (!existsSync32(specialistsDir)) return [];
-  let entries;
+  let entries2;
   try {
-    entries = readdirSync22(specialistsDir);
+    entries2 = readdirSync22(specialistsDir);
   } catch {
     return [];
   }
@@ -17342,7 +17649,7 @@ function computeSpecialistDomains(accountId) {
     return map.get(tool);
   };
   const out = [];
-  for (const file of entries.sort()) {
+  for (const file of entries2.sort()) {
     if (!file.endsWith(".md")) continue;
     const fm = readFrontmatter(join33(specialistsDir, file));
     if (!fm) continue;
@@ -17362,7 +17669,7 @@ ${fm}
   return out;
 }
 function computeDormantPlugins(accountId) {
-  const accountFile = resolve23(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
+  const accountFile = resolve24(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
   if (!existsSync32(accountFile)) return [];
   let enabled;
   try {
@@ -17377,18 +17684,18 @@ function computeDormantPlugins(accountId) {
     );
     return [];
   }
-  const pluginsDir = resolve23(PLATFORM_ROOT, "plugins");
+  const pluginsDir = resolve24(PLATFORM_ROOT, "plugins");
   if (!existsSync32(pluginsDir)) return [];
-  let entries;
+  let entries2;
   try {
-    entries = readdirSync22(pluginsDir);
+    entries2 = readdirSync22(pluginsDir);
   } catch {
     return [];
   }
   const out = [];
-  for (const name of entries) {
+  for (const name of entries2) {
     if (enabled.has(name)) continue;
-    const manifestPath = resolve23(pluginsDir, name, "PLUGIN.md");
+    const manifestPath = resolve24(pluginsDir, name, "PLUGIN.md");
     if (!existsSync32(manifestPath)) continue;
     let manifest;
     try {
@@ -17407,7 +17714,7 @@ function computeDormantPlugins(accountId) {
 
 // server/routes/admin/claude-sessions.ts
 import { existsSync as existsSync33, readFileSync as readFileSync34 } from "fs";
-import { resolve as resolve24 } from "path";
+import { resolve as resolve25 } from "path";
 function readTunnelState(brandConfigDir) {
   const statePath = `${process.env.HOME ?? ""}/${brandConfigDir}/cloudflared/tunnel.state`;
   if (!existsSync33(statePath)) return null;
@@ -17423,10 +17730,10 @@ function readTunnelState(brandConfigDir) {
   }
 }
 function resolveTunnelUrl() {
-  const platformRoot5 = process.env.MAXY_PLATFORM_ROOT ?? process.env.PLATFORM_ROOT ?? resolve24(process.cwd(), "..");
+  const platformRoot5 = process.env.MAXY_PLATFORM_ROOT ?? process.env.PLATFORM_ROOT ?? resolve25(process.cwd(), "..");
   let brand;
   try {
-    brand = JSON.parse(readFileSync34(resolve24(platformRoot5, "config", "brand.json"), "utf-8"));
+    brand = JSON.parse(readFileSync34(resolve25(platformRoot5, "config", "brand.json"), "utf-8"));
   } catch {
     return null;
   }
@@ -17665,6 +17972,77 @@ app22.post("/", async (c) => {
   console.error(`[${event}] ${formatted}`);
   return c.json({ ok: true });
 });
+function formatEvent(resource, accountId) {
+  return `data: ${JSON.stringify({ resource, accountId })}
+
+`;
+}
+function shouldDeliver(eventAccountId, subscriberAccountId) {
+  return eventAccountId === null || eventAccountId === subscriberAccountId;
+}
+app22.get("/", requireAdminSession, async (c) => {
+  const accountId = getAccountIdForSession(c.var.cacheKey);
+  if (!accountId) return c.json({ error: "Account not found for session" }, 401);
+  const encoder = new TextEncoder();
+  let unsubscribe = () => {
+  };
+  let heartbeat = null;
+  let closed = false;
+  const teardown = (reason) => {
+    if (closed) return;
+    closed = true;
+    unsubscribe();
+    if (heartbeat) clearInterval(heartbeat);
+    console.log(`[admin-events] op=drop resource=all accountId=${accountId.slice(0, 8)} reason=${reason}`);
+  };
+  const stream2 = new ReadableStream({
+    start(controller) {
+      console.log(`[admin-events] op=subscribe resource=all accountId=${accountId.slice(0, 8)}`);
+      unsubscribe = onInvalidate((resource, eventAccountId) => {
+        if (closed) return;
+        if (!shouldDeliver(eventAccountId, accountId)) return;
+        try {
+          controller.enqueue(encoder.encode(formatEvent(resource, eventAccountId)));
+          console.log(`[admin-events] op=emit resource=${resource} accountId=${accountId.slice(0, 8)}`);
+        } catch (err) {
+          teardown(`enqueue-failed:${String(err)}`);
+          try {
+            controller.close();
+          } catch {
+          }
+        }
+      });
+      heartbeat = setInterval(() => {
+        try {
+          controller.enqueue(encoder.encode(": ping\n\n"));
+        } catch {
+          teardown("heartbeat-enqueue-failed");
+          try {
+            controller.close();
+          } catch {
+          }
+        }
+      }, 2e4);
+      c.req.raw.signal.addEventListener("abort", () => {
+        teardown("client-aborted");
+        try {
+          controller.close();
+        } catch {
+        }
+      });
+    },
+    cancel() {
+      teardown("client-closed");
+    }
+  });
+  return new Response(stream2, {
+    headers: {
+      "Content-Type": "text/event-stream",
+      "Cache-Control": "no-cache",
+      Connection: "keep-alive"
+    }
+  });
+});
 var events_default = app22;
 
 // server/routes/admin/files.ts
@@ -17672,7 +18050,7 @@ import { createReadStream as createReadStream2, createWriteStream as createWrite
 import { readdir as readdir4, readFile as readFile7, stat as stat6, mkdir as mkdir4, unlink as unlink3, rename as rename2, rmdir } from "fs/promises";
 import { realpathSync as realpathSync7 } from "fs";
 import { randomUUID as randomUUID10 } from "crypto";
-import { basename as basename11, dirname as dirname13, join as join35, relative as relative5, resolve as resolve26, sep as sep8 } from "path";
+import { basename as basename11, dirname as dirname13, join as join35, relative as relative5, resolve as resolve27, sep as sep8 } from "path";
 import { Readable as Readable2 } from "stream";
 
 // ../lib/graph-trash/src/index.ts
@@ -17990,7 +18368,7 @@ async function cascadeDeleteDocument(params) {
 
 // app/lib/file-index.ts
 import * as fsp from "fs/promises";
-import { resolve as resolve25, relative as relative4, join as join34, basename as basename10, extname as extname2, sep as sep7 } from "path";
+import { resolve as resolve26, relative as relative4, join as join34, basename as basename10, extname as extname2, sep as sep7 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
@@ -18143,16 +18521,16 @@ async function readDisplayName(absolute) {
   }
 }
 async function walkSubtree(root, dataRoot, out) {
-  let entries;
+  let entries2;
   try {
-    entries = await fsp.readdir(root, { withFileTypes: true });
+    entries2 = await fsp.readdir(root, { withFileTypes: true });
   } catch (err) {
     if (err.code === "ENOENT") return { clean: true };
     console.error(`[file-index] walk-error dir="${relative4(dataRoot, root)}" err="${err.message}"`);
     return { clean: false };
   }
   let clean = true;
-  for (const entry of entries) {
+  for (const entry of entries2) {
     if (entry.isSymbolicLink()) continue;
     if (entry.isDirectory() && entry.name === ".uploads-tmp") continue;
     const abs = join34(root, entry.name);
@@ -18310,7 +18688,7 @@ async function reconcileFileIndex(accountId, opts) {
   return withSession(opts, async (session) => {
     const walked = [];
     const subtreeRoots = [
-      resolve25(dataRoot, "accounts", accountId)
+      resolve26(dataRoot, "accounts", accountId)
     ];
     let clean = true;
     for (const root of subtreeRoots) {
@@ -18393,7 +18771,7 @@ async function reconcileFileIndexDebounced(accountId, opts) {
 async function indexFile(accountId, relativePath, opts) {
   const dataRoot = opts?.dataRoot ?? DATA_ROOT;
   const embed2 = opts?.embed ?? embed;
-  const absolute = resolve25(dataRoot, relativePath);
+  const absolute = resolve26(dataRoot, relativePath);
   await withSession(opts, async (session) => {
     const st = await fsp.stat(absolute);
     const wf = {
@@ -18444,11 +18822,11 @@ function crc32(buf) {
   for (let i = 0; i < buf.length; i++) crc = crcTable[(crc ^ buf[i]) & 255] ^ crc >>> 8;
   return (crc ^ 4294967295) >>> 0;
 }
-function buildZip(entries) {
+function buildZip(entries2) {
   const localChunks = [];
   const centralChunks = [];
   let offset = 0;
-  for (const entry of entries) {
+  for (const entry of entries2) {
     const nameBytes = Buffer.from(entry.name, "utf8");
     const crc = crc32(entry.data);
     const uncompressedSize = entry.data.length;
@@ -18498,14 +18876,31 @@ function buildZip(entries) {
   eocd.writeUInt32LE(EOCD_SIG, 0);
   eocd.writeUInt16LE(0, 4);
   eocd.writeUInt16LE(0, 6);
-  eocd.writeUInt16LE(entries.length, 8);
-  eocd.writeUInt16LE(entries.length, 10);
+  eocd.writeUInt16LE(entries2.length, 8);
+  eocd.writeUInt16LE(entries2.length, 10);
   eocd.writeUInt32LE(centralSize, 12);
   eocd.writeUInt32LE(centralOffset, 16);
   eocd.writeUInt16LE(0, 20);
   return Buffer.concat([...localChunks, centralDir, eocd]);
 }
 
+// server/lib/account-root-groups.ts
+var import_dist = __toESM(require_dist2(), 1);
+function classifyAccountRoot(schemaMd, rootEntries) {
+  const regions = (0, import_dist.parseSchemaRegions)(schemaMd);
+  if (!regions.parsed) {
+    return { home: [], system: [...rootEntries], unknown: [], parsed: false, reason: regions.reason };
+  }
+  const homeOrder = [...regions.ontologyRoots, ...import_dist.HOME_FIXED].filter((d, i, a) => a.indexOf(d) === i);
+  const homeSet = new Set(homeOrder);
+  const present = new Set(rootEntries);
+  const home = homeOrder.filter((d) => present.has(d));
+  const system = rootEntries.filter((n) => !homeSet.has(n));
+  const declared = /* @__PURE__ */ new Set([...regions.allowedTopLevel, ...regions.pluginOwned, ...homeSet]);
+  const unknown = rootEntries.filter((n) => !declared.has(n));
+  return { home, system, unknown, parsed: true, reason: "ok" };
+}
+
 // server/routes/admin/files.ts
 var UPLOAD_TMP_DIR = ".uploads-tmp";
 var UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
@@ -18522,7 +18917,7 @@ async function readMeta(absDir, baseName) {
 }
 async function readAccountNames() {
   const map = /* @__PURE__ */ new Map();
-  const accountsDir = resolve26(DATA_ROOT, "accounts");
+  const accountsDir = resolve27(DATA_ROOT, "accounts");
   let names;
   try {
     names = await readdir4(accountsDir);
@@ -18531,7 +18926,7 @@ async function readAccountNames() {
   }
   for (const name of names) {
     if (!UUID_RE4.test(name)) continue;
-    const configPath2 = resolve26(accountsDir, name, "account.json");
+    const configPath2 = resolve27(accountsDir, name, "account.json");
     try {
       const raw = await readFile7(configPath2, "utf8");
       const parsed = JSON.parse(raw);
@@ -18617,8 +19012,24 @@ function buildDisplayPath(relPath, accountNames) {
     return dn ? { name: seg, displayName: dn } : { name: seg };
   });
 }
-function sortDirEntries(entries) {
-  entries.sort((a, b) => {
+var HOME_CHILD_PREVIEW = 20;
+function parseGroupPath(raw, sessionAccountId) {
+  const trimmed = raw.replace(/^\.?\/*/, "");
+  if (trimmed === "@home" || trimmed === "@system") {
+    return { view: trimmed.slice(1), accountRel: `accounts/${sessionAccountId}` };
+  }
+  const segs = trimmed.split("/").filter(Boolean);
+  if (segs.length !== 3) return null;
+  if (segs[0] !== "accounts" || !UUID_RE4.test(segs[1])) return null;
+  if (segs[2] !== "@home" && segs[2] !== "@system") return null;
+  return { view: segs[2].slice(1), accountRel: `accounts/${segs[1]}` };
+}
+function isAccountRoot(relPath) {
+  const segs = relPath.split("/").filter(Boolean);
+  return segs.length === 2 && segs[0] === "accounts" && UUID_RE4.test(segs[1]);
+}
+function sortDirEntries(entries2) {
+  entries2.sort((a, b) => {
     if (a.kind !== b.kind) return a.kind === "directory" ? -1 : 1;
     if (a.kind === "file" && b.kind === "file") {
       const byTime = b.modifiedAt.localeCompare(a.modifiedAt);
@@ -18675,6 +19086,7 @@ function isProtectedFromRename(relPath) {
 function isValidEntryName(name) {
   if (typeof name !== "string" || name.length === 0) return false;
   if (name === "." || name === "..") return false;
+  if (name.startsWith("@")) return false;
   return !/[\\/\0]/.test(name);
 }
 function resolveOwnAccountWrite(rawPath, accountId, endpoint) {
@@ -18719,7 +19131,8 @@ app23.get("/", requireAdminSession, async (c) => {
     return c.json({ error: "Account not found for session" }, 401);
   }
   const rawPath = c.req.query("path") ?? "";
-  const resolution = resolveDataPath(rawPath);
+  const groupReq = parseGroupPath(rawPath, accountId);
+  const resolution = resolveDataPath(groupReq ? groupReq.accountRel : rawPath);
   if (!resolution.ok) {
     if (resolution.status === 403) {
       console.error(`[data] path-traversal-blocked requested="${rawPath}" resolved="${resolution.resolved ?? "n/a"}"`);
@@ -18739,7 +19152,7 @@ app23.get("/", requireAdminSession, async (c) => {
     const names = await readdir4(absolute);
     const segs = relPath.split("/").filter(Boolean);
     const isAccountParent = segs.length === 1 && segs[0] === "accounts";
-    const entries = [];
+    const entries2 = [];
     for (const name of names) {
       if (UUID_RE4.test(name.replace(/\.meta\.json$/, "")) && name.endsWith(".meta.json")) {
         continue;
@@ -18752,7 +19165,7 @@ app23.get("/", requireAdminSession, async (c) => {
       try {
         const entryPath = join35(absolute, name);
         const s = await stat6(entryPath);
-        entries.push({
+        entries2.push({
           name,
           kind: s.isDirectory() ? "directory" : s.isFile() ? "file" : "other",
           sizeBytes: s.isDirectory() ? null : s.size,
@@ -18760,12 +19173,12 @@ app23.get("/", requireAdminSession, async (c) => {
           protected: protectedEntry
         });
       } catch {
-        entries.push({ name, kind: "other", sizeBytes: null, modifiedAt: (/* @__PURE__ */ new Date(0)).toISOString(), protected: protectedEntry });
+        entries2.push({ name, kind: "other", sizeBytes: null, modifiedAt: (/* @__PURE__ */ new Date(0)).toISOString(), protected: protectedEntry });
       }
     }
     const accountNames = await readAccountNames();
-    const classes = await Promise.all(entries.map((e) => enrich(absolute, e, accountNames)));
-    sortDirEntries(entries);
+    const classes = await Promise.all(entries2.map((e) => enrich(absolute, e, accountNames)));
+    sortDirEntries(entries2);
     let flattened = 0;
     let keptAsDir = 0;
     for (const cls of classes) {
@@ -18777,8 +19190,77 @@ app23.get("/", requireAdminSession, async (c) => {
       console.error(`[data] op=uploads-flatten containers=${containers} flattened=${flattened} kept-as-dir=${keptAsDir}`);
     }
     const displayPath = buildDisplayPath(relPath, accountNames);
-    console.error(`[data] file-list path="${relPath}" entries=${entries.length}`);
-    return c.json({ path: relPath, displayPath, entries });
+    if (groupReq || isAccountRoot(relPath)) {
+      const acctId = relPath.split("/")[1] ?? accountId;
+      const schemaMd = await readFile7(join35(absolute, "SCHEMA.md"), "utf8").catch(() => null);
+      const groups = classifyAccountRoot(schemaMd, entries2.map((e) => e.name));
+      console.error(
+        `[data-schema] op=classify account=${acctId} status=${groups.parsed ? "ok" : "parse-failed"} reason=${groups.reason} entries=${entries2.length} home=${groups.home.join(",") || "none"} system=${groups.system.length} unknown=${groups.unknown.join(",") || "none"}`
+      );
+      if (groupReq && !groups.parsed) {
+        return c.json({ path: relPath, displayPath, entries: entries2 });
+      }
+      if (!groupReq) {
+        const homeSet = new Set(groups.home);
+        for (const e of entries2) e.group = homeSet.has(e.name) ? "home" : "system";
+        return c.json({ path: relPath, displayPath, entries: entries2 });
+      }
+      const groupPath = `${groupReq.accountRel}/@${groupReq.view}`;
+      const groupDisplay = [...displayPath, { name: `@${groupReq.view}`, displayName: groupReq.view }];
+      if (groupReq.view === "system") {
+        const systemSet = new Set(groups.system);
+        return c.json({
+          path: groupPath,
+          displayPath: groupDisplay,
+          view: "system",
+          entries: entries2.filter((e) => systemSet.has(e.name))
+        });
+      }
+      const byName = new Map(entries2.map((e) => [e.name, e]));
+      const homeDirs = [];
+      const homeFiles = [];
+      for (const name of groups.home) {
+        if (byName.get(name)?.kind === "directory") homeDirs.push(name);
+        else homeFiles.push(name);
+      }
+      if (homeFiles.length > 0) {
+        console.error(`[data-schema] op=home-files account=${acctId} count=${homeFiles.length} names=${homeFiles.join(",")}`);
+      }
+      const cards = [];
+      for (const name of homeDirs) {
+        const base = byName.get(name);
+        try {
+          const dirents = await readdir4(join35(absolute, name), { withFileTypes: true });
+          const visible = dirents.filter((d) => !d.name.startsWith("."));
+          visible.sort((a, b) => {
+            const ad = a.isDirectory() ? 0 : 1;
+            const bd = b.isDirectory() ? 0 : 1;
+            return ad !== bd ? ad - bd : a.name.localeCompare(b.name);
+          });
+          cards.push({
+            ...base,
+            childCount: visible.length,
+            children: visible.slice(0, HOME_CHILD_PREVIEW).map((d) => ({
+              name: d.name,
+              kind: d.isDirectory() ? "directory" : "file"
+            }))
+          });
+        } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          console.error(`[data-schema] op=card-children account=${acctId} bucket=${name} status=error reason="${message}"`);
+          cards.push({ ...base, childCount: null, children: [] });
+        }
+      }
+      return c.json({
+        path: groupPath,
+        displayPath: groupDisplay,
+        view: "home",
+        entries: cards,
+        systemCount: groups.system.length + homeFiles.length
+      });
+    }
+    console.error(`[data] file-list path="${relPath}" entries=${entries2.length}`);
+    return c.json({ path: relPath, displayPath, entries: entries2 });
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
@@ -18930,14 +19412,14 @@ app23.get("/download-zip", requireAdminSession, async (c) => {
   if (rawPaths.length > maxFiles) {
     return c.json({ error: `Too many files (max ${maxFiles})` }, 413);
   }
-  const entries = [];
+  const entries2 = [];
   let total = 0;
   let dirsWalked = 0;
   const addFile = async (absolute, size, member) => {
-    if (entries.length >= maxFiles) return c.json({ error: `Too many files (max ${maxFiles})` }, 413);
+    if (entries2.length >= maxFiles) return c.json({ error: `Too many files (max ${maxFiles})` }, 413);
     total += size;
     if (total > maxTotalBytes) return c.json({ error: "Selection too large to zip" }, 413);
-    entries.push({ name: member, data: await readFile7(absolute) });
+    entries2.push({ name: member, data: await readFile7(absolute) });
     return null;
   };
   for (const rawPath of rawPaths) {
@@ -18985,8 +19467,8 @@ app23.get("/download-zip", requireAdminSession, async (c) => {
       throw err;
     }
   }
-  const archive = buildZip(entries);
-  console.error(`[data] file-download-zip dirs=${dirsWalked} files=${entries.length} bytes=${archive.length}`);
+  const archive = buildZip(entries2);
+  console.error(`[data] file-download-zip dirs=${dirsWalked} files=${entries2.length} bytes=${archive.length}`);
   return new Response(new Uint8Array(archive), {
     status: 200,
     headers: {
@@ -19027,8 +19509,8 @@ async function resolveUploadTarget(c, accountId, uid) {
     console.error(`[data] write-scope-blocked endpoint="POST /api/admin/files/upload" path="${destRel}" account=${accountId.slice(0, 8)}\u2026`);
     return { ok: false, status: 403, error: "Path is outside your account folder" };
   }
-  const destDir = relDir === "." ? base.absolute : resolve26(base.absolute, relDir);
-  const destPath = resolve26(destDir, finalName);
+  const destDir = relDir === "." ? base.absolute : resolve27(base.absolute, relDir);
+  const destPath = resolve27(destDir, finalName);
   if (relpath) {
     const firstCreated = await mkdir4(destDir, { recursive: true });
     if (firstCreated) console.error(`[data-upload] op=mkdir uid=${uid} token=${token} dir="${destRel}"`);
@@ -19045,7 +19527,7 @@ async function resolveUploadTarget(c, accountId, uid) {
   return { ok: true, destDir, destPath, destRel, finalName, mimeType, relpath, token };
 }
 async function logUploadsTmpCensus(accountId) {
-  const tmpDir = resolve26(DATA_ROOT, "accounts", accountId, UPLOAD_TMP_DIR);
+  const tmpDir = resolve27(DATA_ROOT, "accounts", accountId, UPLOAD_TMP_DIR);
   let live = 0;
   try {
     live = (await readdir4(tmpDir)).length;
@@ -19072,9 +19554,9 @@ app23.post("/upload", requireAdminSession, async (c) => {
   if (!body) return c.json({ error: "Empty request body" }, 400);
   console.error(`[data-upload] op=request uid=${uid} account=${accountId} dir="${destRel}" token=${token} rel="${relpath ?? ""}" declaredBytes=${declaredBytes}`);
   const ceiling = dataUploadCeiling();
-  const tmpDir = resolve26(DATA_ROOT, "accounts", accountId, UPLOAD_TMP_DIR);
+  const tmpDir = resolve27(DATA_ROOT, "accounts", accountId, UPLOAD_TMP_DIR);
   await mkdir4(tmpDir, { recursive: true });
-  const tmpPath = resolve26(tmpDir, `${uid}.part`);
+  const tmpPath = resolve27(tmpDir, `${uid}.part`);
   const out = createWriteStream2(tmpPath);
   const t0 = Date.now();
   let received = 0;
@@ -19221,9 +19703,9 @@ async function handleChunkUpload(c, accountId) {
     }
     const target = await resolveUploadTarget(c, accountId, uploadId);
     if (!target.ok) return c.json({ error: target.error }, target.status);
-    const tmpDir = resolve26(DATA_ROOT, "accounts", accountId, UPLOAD_TMP_DIR);
+    const tmpDir = resolve27(DATA_ROOT, "accounts", accountId, UPLOAD_TMP_DIR);
     await mkdir4(tmpDir, { recursive: true });
-    const tmpPath = resolve26(tmpDir, `${uploadId}.part`);
+    const tmpPath = resolve27(tmpDir, `${uploadId}.part`);
     const out = createWriteStream2(tmpPath);
     const state2 = {
       accountId,
@@ -19329,7 +19811,7 @@ async function evictStaleChunkUploads(ttlMs) {
   return evicted;
 }
 async function sweepStaleUploadTemps() {
-  const accountsRoot = resolve26(DATA_ROOT, "accounts");
+  const accountsRoot = resolve27(DATA_ROOT, "accounts");
   let accounts;
   try {
     accounts = await readdir4(accountsRoot, { withFileTypes: true });
@@ -19339,16 +19821,16 @@ async function sweepStaleUploadTemps() {
   let removed = 0;
   for (const acc of accounts) {
     if (!acc.isDirectory()) continue;
-    const tmpDir = resolve26(accountsRoot, acc.name, UPLOAD_TMP_DIR);
-    let entries;
+    const tmpDir = resolve27(accountsRoot, acc.name, UPLOAD_TMP_DIR);
+    let entries2;
     try {
-      entries = await readdir4(tmpDir);
+      entries2 = await readdir4(tmpDir);
     } catch {
       continue;
     }
-    for (const name of entries) {
+    for (const name of entries2) {
       try {
-        await unlink3(resolve26(tmpDir, name));
+        await unlink3(resolve27(tmpDir, name));
         removed++;
       } catch {
       }
@@ -19459,7 +19941,7 @@ app23.post("/folder", requireAdminSession, async (c) => {
   if (!isValidEntryName(name)) return c.json({ error: "Invalid folder name" }, 400);
   const parent = resolveOwnAccountWrite(rawPath, accountId, "POST /api/admin/files/folder");
   if (!parent.ok) return c.json({ error: parent.error }, parent.status);
-  const newAbs = resolve26(parent.absolute, name);
+  const newAbs = resolve27(parent.absolute, name);
   const newRel = `${parent.relative}/${name}`;
   try {
     const info = await stat6(parent.absolute);
@@ -19498,7 +19980,7 @@ app23.post("/rename", requireAdminSession, async (c) => {
     console.error(`[data] file-rename blocked path="${src.relative}" reason="protected"`);
     return c.json({ error: "Protected entry \u2014 refusing to rename" }, 403);
   }
-  const destAbs = resolve26(dirname13(src.absolute), newName);
+  const destAbs = resolve27(dirname13(src.absolute), newName);
   const newRel = `${dirname13(src.relative)}/${newName}`.replace(/^\.\//, "");
   if (isProtectedFromRename(newRel)) {
     console.error(`[data] file-rename blocked path="${newRel}" reason="protected-target"`);
@@ -19529,7 +20011,7 @@ app23.post("/rename", requireAdminSession, async (c) => {
 var files_default = app23;
 
 // ../lib/graph-search/src/index.ts
-var import_dist = __toESM(require_dist2());
+var import_dist2 = __toESM(require_dist3());
 import { int } from "neo4j-driver";
 
 // ../lib/graph-search/src/rrf-fusion.ts
@@ -19779,7 +20261,7 @@ async function bm25Only(session, params) {
        ${scopeClause}
        ${agentClause}
        ${labelClause}
-       AND ${(0, import_dist.notTrashed)("node")}
+       AND ${(0, import_dist2.notTrashed)("node")}
        ${kwClause}
        RETURN node, score, labels(node) AS nodeLabels, elementId(node) AS nodeId
        ORDER BY score DESC
@@ -19941,7 +20423,7 @@ async function hybrid(session, embed2, params) {
              WHERE node.accountId = $accountId
              ${scopeClause}
              ${agentClause}
-             AND ${(0, import_dist.notTrashed)("node")}
+             AND ${(0, import_dist2.notTrashed)("node")}
              ${keywordClause}
              RETURN node, score, labels(node) AS nodeLabels, elementId(node) AS nodeId
              ORDER BY score DESC
@@ -20040,7 +20522,7 @@ async function hybrid(session, embed2, params) {
     const propResult = await session.run(
       `MATCH (node)
        WHERE node.accountId = $accountId
-       AND ${(0, import_dist.notTrashed)("node")}
+       AND ${(0, import_dist2.notTrashed)("node")}
        AND node.keywords IS NOT NULL
        AND ANY(kw IN $kwSubs WHERE ANY(nk IN node.keywords WHERE toLower(nk) = kw))
        ${propScope.clause}
@@ -20092,7 +20574,7 @@ async function hybrid(session, embed2, params) {
     const propResult = await session.run(
       `MATCH (node)
        WHERE node.accountId = $accountId
-       AND ${(0, import_dist.notTrashed)("node")}
+       AND ${(0, import_dist2.notTrashed)("node")}
        AND node.keywords IS NOT NULL
        AND ANY(kw IN $kwSubs WHERE ANY(nk IN node.keywords WHERE toLower(nk) = kw))
        ${propScope.clause}
@@ -20199,7 +20681,7 @@ async function hybrid(session, embed2, params) {
       `UNWIND $nodeIds AS nid
        MATCH (n)-[r]-(related)
        WHERE elementId(n) = nid
-       AND ${(0, import_dist.notTrashed)("related")}
+       AND ${(0, import_dist2.notTrashed)("related")}
        ${expandScopeClause}
        ${expandAgentClause}
        WITH nid, n, r, related
@@ -20427,8 +20909,8 @@ var graph_search_default = app24;
 import neo4j2 from "neo4j-driver";
 
 // app/lib/graph-labels.ts
-var import_dist2 = __toESM(require_dist3(), 1);
-var import_dist3 = __toESM(require_dist3(), 1);
+var import_dist3 = __toESM(require_dist4(), 1);
+var import_dist4 = __toESM(require_dist4(), 1);
 var HIDDEN_BY_DEFAULT_LABELS = Object.freeze(
   /* @__PURE__ */ new Set(["Chunk", "GraphPreference"])
 );
@@ -20506,16 +20988,16 @@ var EXCLUDED_EDGE_TYPES = Object.freeze(
   ])
 );
 function isKnownLabel(label) {
-  return Object.prototype.hasOwnProperty.call(import_dist3.GRAPH_LABEL_COLOURS, label);
+  return Object.prototype.hasOwnProperty.call(import_dist4.GRAPH_LABEL_COLOURS, label);
 }
 function isHiddenByDefault(label) {
   return HIDDEN_BY_DEFAULT_LABELS.has(label);
 }
 
 // server/lib/top-level-labels.ts
-var import_dist4 = __toESM(require_dist3(), 1);
+var import_dist5 = __toESM(require_dist4(), 1);
 import { readdirSync as readdirSync23, readFileSync as readFileSync35 } from "fs";
-import { join as join36, resolve as resolve27 } from "path";
+import { join as join36, resolve as resolve28 } from "path";
 var STATIC_TOP_LEVEL_LABELS = Object.freeze(
   /* @__PURE__ */ new Set([
     // Base-schema infra (schema-base.md has no top-level section).
@@ -20621,7 +21103,7 @@ function resolveReferencesDir() {
   if (process.env.MAXY_PLATFORM_ROOT) {
     return join36(process.env.MAXY_PLATFORM_ROOT, "plugins", "memory", "references");
   }
-  return resolve27(import.meta.dirname, "../../../plugins/memory/references");
+  return resolve28(import.meta.dirname, "../../../plugins/memory/references");
 }
 function parseTableTopLevelLabels(referencesDir) {
   const labels = /* @__PURE__ */ new Set();
@@ -20650,7 +21132,7 @@ function getTopLevelLabelAllowlist(opts = {}) {
   const referencesDir = opts.referencesDir ?? resolveReferencesDir();
   const { labels: derived, contributingFiles } = parseTableTopLevelLabels(referencesDir);
   const excluded = [];
-  for (const label of import_dist4.ADDITIONAL_BASE_LABELS) {
+  for (const label of import_dist5.ADDITIONAL_BASE_LABELS) {
     if (derived.delete(label)) excluded.push(label);
   }
   const derivedCount = derived.size;
@@ -21786,7 +22268,7 @@ var graph_default_view_default = app29;
 
 // server/routes/admin/sidebar-artefacts.ts
 import { readdir as readdir5, stat as stat7 } from "fs/promises";
-import { resolve as resolve28, relative as relative6, isAbsolute as isAbsolute2, sep as sep9, basename as basename12 } from "path";
+import { resolve as resolve29, relative as relative6, isAbsolute as isAbsolute2, sep as sep9, basename as basename12 } from "path";
 import { existsSync as existsSync35 } from "fs";
 var LIMIT = 50;
 var ADMIN_AGENT_FILES = ["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"];
@@ -21802,20 +22284,25 @@ app30.get("/", requireAdminSession, async (c) => {
     return c.json({ error: "Account not found for session" }, 401);
   }
   const start = Date.now();
-  const accountFiles = await fetchAccountFileArtefacts(accountId);
-  if (accountFiles === null) {
+  ensureAccountWatchers(accountId, resolve29(ACCOUNTS_DIR, accountId));
+  const { value, state } = await getOrCompute("sidebar-artefacts", accountId, async () => {
+    const accountFiles = await fetchAccountFileArtefacts(accountId);
+    if (accountFiles === null) return null;
+    const accountDir = resolve29(ACCOUNTS_DIR, accountId);
+    const agents = await fetchAgentTemplateRows(accountDir);
+    const artefacts = [...accountFiles, ...agents].sort(
+      (a, b) => (b.updatedAt ?? "").localeCompare(a.updatedAt ?? "")
+    ).slice(0, LIMIT);
+    return { artefacts, accountFileCount: accountFiles.length, agentCount: agents.length };
+  });
+  if (value === null) {
     return c.json({ error: "Failed to load artefacts" }, 500);
   }
-  const accountDir = resolve28(ACCOUNTS_DIR, accountId);
-  const agents = await fetchAgentTemplateRows(accountDir);
-  const artefacts = [...accountFiles, ...agents].sort(
-    (a, b) => (b.updatedAt ?? "").localeCompare(a.updatedAt ?? "")
-  ).slice(0, LIMIT);
   const ms = Date.now() - start;
   console.log(
-    `[admin/sidebar-artefacts] account=${accountId} count=${artefacts.length} accountFiles=${accountFiles.length} agents=${agents.length} ms=${ms}`
+    `[admin/sidebar-artefacts] account=${accountId} count=${value.artefacts.length} accountFiles=${value.accountFileCount} agents=${value.agentCount} cache=${state} ms=${ms}`
   );
-  return c.json({ artefacts });
+  return c.json({ artefacts: value.artefacts });
 });
 async function fetchAccountFileArtefacts(accountId) {
   const session = getSession();
@@ -21858,8 +22345,8 @@ async function fetchAccountFileArtefacts(accountId) {
 async function fetchAgentTemplateRows(accountDir) {
   const rows = [];
   for (const filename of ADMIN_AGENT_FILES) {
-    const overridePath = resolve28(accountDir, "agents", "admin", filename);
-    const bundledPath = resolve28(PLATFORM_ROOT, "templates", "agents", "admin", filename);
+    const overridePath = resolve29(accountDir, "agents", "admin", filename);
+    const bundledPath = resolve29(PLATFORM_ROOT, "templates", "agents", "admin", filename);
     const labelStem = filename.replace(/\.md$/, "");
     const row = await readAgentTemplateRow({
       id: `agent-template:admin:${filename}`,
@@ -21872,12 +22359,12 @@ async function fetchAgentTemplateRows(accountDir) {
     });
     if (row) rows.push(row);
   }
-  const overrideDir = resolve28(accountDir, "specialists", "agents");
-  const bundledDir = resolve28(PLATFORM_ROOT, "templates", "specialists", "agents");
+  const overrideDir = resolve29(accountDir, "specialists", "agents");
+  const bundledDir = resolve29(PLATFORM_ROOT, "templates", "specialists", "agents");
   const specialistNames = await unionSpecialistFilenames(overrideDir, bundledDir);
   for (const filename of specialistNames) {
-    const overridePath = resolve28(overrideDir, filename);
-    const bundledPath = resolve28(bundledDir, filename);
+    const overridePath = resolve29(overrideDir, filename);
+    const bundledPath = resolve29(bundledDir, filename);
     const row = await readAgentTemplateRow({
       id: `agent-template:specialist:${filename}`,
       displayName: filename.replace(/\.md$/, ""),
@@ -21896,8 +22383,8 @@ async function unionSpecialistFilenames(overrideDir, bundledDir) {
   for (const dir of [overrideDir, bundledDir]) {
     if (!existsSync35(dir)) continue;
     try {
-      const entries = await readdir5(dir);
-      for (const entry of entries) {
+      const entries2 = await readdir5(dir);
+      for (const entry of entries2) {
         if (entry.endsWith(".md")) names.add(entry);
       }
     } catch (err) {
@@ -22363,24 +22850,24 @@ var session_rc_spawn_default = app36;
 import { randomUUID as randomUUID12 } from "crypto";
 
 // server/wa-descriptor.ts
-import { resolve as resolve29, join as join38 } from "path";
+import { resolve as resolve30, join as join38 } from "path";
 function waGatewayUrl() {
   return `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`;
 }
 function waServerPath() {
-  return process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve29(process.env.MAXY_PLATFORM_ROOT ?? join38(__dirname, ".."), "services/whatsapp-channel/dist/server.js");
+  return process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve30(process.env.MAXY_PLATFORM_ROOT ?? join38(__dirname, ".."), "services/whatsapp-channel/dist/server.js");
 }
 function waChannelDescriptor(senderId) {
   return { senderId, gatewayUrl: waGatewayUrl(), serverPath: waServerPath() };
 }
 
 // server/telegram-descriptor.ts
-import { resolve as resolve30, join as join39 } from "path";
+import { resolve as resolve31, join as join39 } from "path";
 function telegramGatewayUrl() {
   return `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`;
 }
 function telegramServerPath() {
-  return process.env.MAXY_TELEGRAM_CHANNEL_SERVER_PATH ?? resolve30(process.env.MAXY_PLATFORM_ROOT ?? join39(__dirname, ".."), "services/telegram-channel/dist/server.js");
+  return process.env.MAXY_TELEGRAM_CHANNEL_SERVER_PATH ?? resolve31(process.env.MAXY_PLATFORM_ROOT ?? join39(__dirname, ".."), "services/telegram-channel/dist/server.js");
 }
 function telegramChannelDescriptor(senderId) {
   return { senderId, gatewayUrl: telegramGatewayUrl(), serverPath: telegramServerPath() };
@@ -22665,8 +23152,8 @@ var system_stats_default = app38;
 
 // server/routes/admin/health.ts
 import { existsSync as existsSync36, readFileSync as readFileSync37 } from "fs";
-import { resolve as resolve31, join as join40 } from "path";
-var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve31(process.cwd(), "..");
+import { resolve as resolve32, join as join40 } from "path";
+var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve32(process.cwd(), "..");
 var brandHostname = "maxy";
 var brandJsonPath = join40(PLATFORM_ROOT6, "config", "brand.json");
 if (existsSync36(brandJsonPath)) {
@@ -22676,7 +23163,7 @@ if (existsSync36(brandJsonPath)) {
   } catch {
   }
 }
-var VERSION_FILE = resolve31(PLATFORM_ROOT6, `config/.${brandHostname}-version`);
+var VERSION_FILE = resolve32(PLATFORM_ROOT6, `config/.${brandHostname}-version`);
 var PROCESS_STARTED_AT = (/* @__PURE__ */ new Date()).toISOString();
 var PROBE_TIMEOUT_MS = 1e3;
 function readVersion() {
@@ -24132,7 +24619,7 @@ var routines_default = app48;
 
 // server/routes/admin/skills.ts
 import { existsSync as existsSync38, readdirSync as readdirSync24, readFileSync as readFileSync39, rmSync as rmSync3 } from "fs";
-import { resolve as resolve32 } from "path";
+import { resolve as resolve33 } from "path";
 var app49 = new Hono();
 var NAME_RE = /^[a-z0-9][a-z0-9-]*$/;
 function splitSkillMd(text) {
@@ -24154,12 +24641,6 @@ function stripQuotes(s) {
   if (s.startsWith('"') && s.endsWith('"') || s.startsWith("'") && s.endsWith("'")) return s.slice(1, -1);
   return s;
 }
-function accountDirForSession(cacheKey) {
-  const accountId = getAccountIdForSession(cacheKey);
-  if (!accountId) return null;
-  const match = listValidAccounts().find((a) => a.accountId === accountId);
-  return match ? { accountId, accountDir: match.accountDir } : null;
-}
 function subdirs2(dir) {
   if (!existsSync38(dir)) return [];
   try {
@@ -24174,28 +24655,32 @@ app49.get("/", requireAdminSession, async (c) => {
     console.error('[admin:skills] op=list auth-rejected reason="no account for session"');
     return c.json({ error: "Account not found for session" }, 401);
   }
-  const pluginsDir = resolve32(acct.accountDir, "plugins");
-  const skills = [];
-  let pluginCount = 0;
-  for (const plugin of subdirs2(pluginsDir)) {
-    pluginCount++;
-    const skillsDir = resolve32(pluginsDir, plugin, "skills");
-    for (const skill of subdirs2(skillsDir)) {
-      const skillMd = resolve32(skillsDir, skill, "SKILL.md");
-      if (!existsSync38(skillMd)) continue;
-      try {
-        const { frontmatter } = splitSkillMd(readFileSync39(skillMd, "utf-8"));
-        const refsDir = resolve32(skillsDir, skill, "references");
-        const refCount = existsSync38(refsDir) ? readdirSync24(refsDir, { withFileTypes: true }).filter((e) => e.isFile()).length : 0;
-        skills.push({ plugin, skill, description: frontmatter.description, refCount });
-      } catch (err) {
-        console.error(`[admin:skills] op=list-skip plugin=${plugin} skill=${skill} reason="${err instanceof Error ? err.message : String(err)}"`);
+  ensureAccountWatchers(acct.accountId, acct.accountDir);
+  const { value, state } = await getOrCompute("skills", acct.accountId, async () => {
+    const pluginsDir = resolve33(acct.accountDir, "plugins");
+    const skills = [];
+    let pluginCount = 0;
+    for (const plugin of subdirs2(pluginsDir)) {
+      pluginCount++;
+      const skillsDir = resolve33(pluginsDir, plugin, "skills");
+      for (const skill of subdirs2(skillsDir)) {
+        const skillMd = resolve33(skillsDir, skill, "SKILL.md");
+        if (!existsSync38(skillMd)) continue;
+        try {
+          const { frontmatter } = splitSkillMd(readFileSync39(skillMd, "utf-8"));
+          const refsDir = resolve33(skillsDir, skill, "references");
+          const refCount = existsSync38(refsDir) ? readdirSync24(refsDir, { withFileTypes: true }).filter((e) => e.isFile()).length : 0;
+          skills.push({ plugin, skill, description: frontmatter.description, refCount });
+        } catch (err) {
+          console.error(`[admin:skills] op=list-skip plugin=${plugin} skill=${skill} reason="${err instanceof Error ? err.message : String(err)}"`);
+        }
       }
     }
-  }
-  skills.sort((a, b) => a.plugin.localeCompare(b.plugin) || a.skill.localeCompare(b.skill));
-  console.log(`[admin:skills] op=list accountId=${acct.accountId.slice(0, 8)} plugins=${pluginCount} skills=${skills.length}`);
-  return c.json({ skills });
+    skills.sort((a, b) => a.plugin.localeCompare(b.plugin) || a.skill.localeCompare(b.skill));
+    return { skills, pluginCount };
+  });
+  console.log(`[admin:skills] op=list accountId=${acct.accountId.slice(0, 8)} plugins=${value.pluginCount} skills=${value.skills.length} cache=${state}`);
+  return c.json({ skills: value.skills });
 });
 app49.get("/:plugin/:skill", requireAdminSession, async (c) => {
   const acct = accountDirForSession(c.var.cacheKey);
@@ -24206,14 +24691,14 @@ app49.get("/:plugin/:skill", requireAdminSession, async (c) => {
     console.error(`[admin:skills] op=get outcome=rejected reason=invalid-name plugin="${plugin}" skill="${skill}"`);
     return c.json({ error: "Invalid plugin or skill name" }, 400);
   }
-  const skillDir = resolve32(acct.accountDir, "plugins", plugin, "skills", skill);
-  const skillMd = resolve32(skillDir, "SKILL.md");
+  const skillDir = resolve33(acct.accountDir, "plugins", plugin, "skills", skill);
+  const skillMd = resolve33(skillDir, "SKILL.md");
   const found = existsSync38(skillMd);
   console.log(`[admin:skills] op=get plugin=${plugin} skill=${skill} found=${found}`);
   if (!found) return c.json({ error: "Skill not found" }, 404);
   try {
     const { frontmatter, body } = splitSkillMd(readFileSync39(skillMd, "utf-8"));
-    const refsDir = resolve32(skillDir, "references");
+    const refsDir = resolve33(skillDir, "references");
     const references = existsSync38(refsDir) ? readdirSync24(refsDir, { withFileTypes: true }).filter((e) => e.isFile()).map((e) => e.name).sort() : [];
     return c.json({ skill: { plugin, skill, frontmatter, body, references } });
   } catch (err) {
@@ -24231,10 +24716,10 @@ app49.delete("/:plugin/:skill", requireAdminSession, async (c) => {
     console.error(`[admin:skills] op=delete outcome=rejected reason=invalid-name plugin="${plugin}" skill="${skill}"`);
     return c.json({ error: "Invalid plugin or skill name" }, 400);
   }
-  const pluginDir = resolve32(acct.accountDir, "plugins", plugin);
-  const skillsDir = resolve32(pluginDir, "skills");
-  const skillDir = resolve32(skillsDir, skill);
-  if (!existsSync38(resolve32(skillDir, "SKILL.md"))) {
+  const pluginDir = resolve33(acct.accountDir, "plugins", plugin);
+  const skillsDir = resolve33(pluginDir, "skills");
+  const skillDir = resolve33(skillsDir, skill);
+  if (!existsSync38(resolve33(skillDir, "SKILL.md"))) {
     console.error(`[admin:skills] op=delete outcome=rejected reason=not-found plugin=${plugin} skill=${skill}`);
     return c.json({ error: "Skill not found" }, 404);
   }
@@ -24286,6 +24771,15 @@ app50.get("/", requireAdminSession, async (c) => {
     console.error(`${TAG39} op=list auth-rejected reason="no account for session"`);
     return c.json({ error: "Account not found for session" }, 401);
   }
+  const cacheStart = Date.now();
+  const cached3 = await getOrCompute("tasks-list", accountId, () => computeTaskList(accountId));
+  console.log(`${TAG39} op=list-cache cache=${cached3.state} account=${accountId} ms=${Date.now() - cacheStart}`);
+  if (cached3.value === null) {
+    return c.json({ error: "tasks-list-failed" }, 500);
+  }
+  return c.json(cached3.value);
+});
+async function computeTaskList(accountId) {
   const session = getSession();
   try {
     const result = await session.run(
@@ -24368,14 +24862,14 @@ app50.get("/", requireAdminSession, async (c) => {
     console.log(
       `${TAG39} op=list account=${accountId} returned=${returned} graphTotal=${graphTotal} open=${open.length} completed=${completed.length} missingTaskId=${missingTaskId} missingCreatedAt=${missingCreatedAt} assigned=${assigned}`
     );
-    return c.json({ open, completed });
+    return { open, completed };
   } catch (err) {
     console.error(`${TAG39} op=list error="${err instanceof Error ? err.message : String(err)}"`);
-    return c.json({ error: "tasks-list-failed" }, 500);
+    return null;
   } finally {
     await session.close();
   }
-});
+}
 var tasks_list_default = app50;
 
 // server/routes/admin/task-timer-start.ts
@@ -24419,6 +24913,7 @@ app51.post("/", requireAdminSession, async (c) => {
     const priorStartedAt = open.records[0]?.get("startedAt");
     if (priorEntryId) {
       console.log(`${TAG40} op=start taskId=${taskId} accountId=${accountId} result=already-running`);
+      invalidate("tasks-list", accountId);
       return c.json({ ok: true, running: true, entryId: priorEntryId, startedAt: priorStartedAt });
     }
     const entryId = randomUUID14();
@@ -24429,6 +24924,7 @@ app51.post("/", requireAdminSession, async (c) => {
       { taskId, accountId, entryId, now }
     );
     console.log(`${TAG40} op=opened taskId=${taskId} entryId=${entryId} startedAt=${now}`);
+    invalidate("tasks-list", accountId);
     return c.json({ ok: true, running: true, entryId, startedAt: now });
   } catch (err) {
     console.error(`${TAG40} op=start error="${err instanceof Error ? err.message : String(err)}"`);
@@ -24478,6 +24974,7 @@ app52.post("/", requireAdminSession, async (c) => {
       );
       const secondsLogged2 = toNum(cur.records[0]?.get("secondsLogged"));
       console.log(`${TAG41} op=stop taskId=${taskId} entryId=none seconds=0 totalAfter=${secondsLogged2}`);
+      invalidate("tasks-list", accountId);
       return c.json({ ok: true, running: false, seconds: 0, secondsLogged: secondsLogged2 });
     }
     const seconds = secondsBetween(startedAt, now);
@@ -24502,6 +24999,7 @@ app52.post("/", requireAdminSession, async (c) => {
     const secondsLogged = toNum(verify.records[0]?.get("secondsLogged"));
     console.log(`${TAG41} op=stop taskId=${taskId} entryId=${entryId} seconds=${seconds} totalAfter=${secondsLogged}`);
     console.log(`${TAG41} op=persisted taskId=${taskId} entryId=${entryId} sumEntries=${sumEntries} sumAdjustments=${sumAdjustments} secondsLogged=${secondsLogged}`);
+    invalidate("tasks-list", accountId);
     return c.json({ ok: true, running: false, seconds, secondsLogged });
   } catch (err) {
     console.error(`${TAG41} op=stop error="${err instanceof Error ? err.message : String(err)}"`);
@@ -24545,6 +25043,7 @@ app53.post("/", requireAdminSession, async (c) => {
     }
     const secondsLogged = toNum(result.records[0].get("secondsLogged"));
     console.log(`${TAG42} op=complete taskId=${taskId} status=completed secondsLogged=${secondsLogged}`);
+    invalidate("tasks-list", accountId);
     return c.json({ ok: true, status: "completed", secondsLogged });
   } catch (err) {
     console.error(`${TAG42} op=complete error="${err instanceof Error ? err.message : String(err)}"`);
@@ -24626,6 +25125,7 @@ app54.post("/", requireAdminSession, async (c) => {
     );
     const secondsLoggedAfter = toNum(write.records[0]?.get("secondsLoggedAfter"));
     console.log(`${TAG43} op=persisted adjustmentId=${adjustmentId} previousSeconds=${previousSeconds} newSeconds=${newSeconds} delta=${delta} secondsLoggedAfter=${secondsLoggedAfter}`);
+    invalidate("tasks-list", accountId);
     return c.json({ ok: true, secondsLogged: secondsLoggedAfter });
   } catch (err) {
     console.error(`${TAG43} op=error adjustmentId=${adjustmentId} taskId=${taskId} error="${err instanceof Error ? err.message : String(err)}"`);
@@ -24638,16 +25138,16 @@ var task_time_adjust_default = app54;
 
 // app/lib/admin-roster.ts
 import { existsSync as existsSync39, readdirSync as readdirSync25, readFileSync as readFileSync40 } from "fs";
-import { resolve as resolve33 } from "path";
+import { resolve as resolve34 } from "path";
 function readHouseAdminUserIds(accountsDir = ACCOUNTS_DIR) {
-  let entries;
+  let entries2;
   try {
-    entries = readdirSync25(accountsDir);
+    entries2 = readdirSync25(accountsDir);
   } catch {
     return [];
   }
-  for (const entry of entries) {
-    const cfgPath = resolve33(accountsDir, entry, "account.json");
+  for (const entry of entries2) {
+    const cfgPath = resolve34(accountsDir, entry, "account.json");
     if (!existsSync39(cfgPath)) continue;
     try {
       const cfg = JSON.parse(readFileSync40(cfgPath, "utf-8"));
@@ -24771,6 +25271,7 @@ app55.post("/", requireAdminSession, async (c) => {
         { taskId, accountId, now }
       );
       console.log(`${TAG44} op=assign taskId=${taskId.slice(0, 8)} assigneeUserId=none assigned=false source=route`);
+      invalidate("tasks-list", accountId);
       return c.json({ ok: true, assigneeUserId: null, assigneeName: null });
     }
     const set = await session.run(
@@ -24795,6 +25296,7 @@ app55.post("/", requireAdminSession, async (c) => {
     console.log(
       `${TAG44} op=assign taskId=${taskId.slice(0, 8)} assigneeUserId=${assigneeUserId.slice(0, 8)} assigned=true source=route`
     );
+    invalidate("tasks-list", accountId);
     return c.json({ ok: true, assigneeUserId, assigneeName });
   } catch (err) {
     console.error(`${TAG44} op=assign error="${err instanceof Error ? err.message : String(err)}"`);
@@ -25103,9 +25605,9 @@ var verify_token_default = app59;
 
 // app/lib/access-email.ts
 import { spawn as spawn2 } from "child_process";
-import { resolve as resolve34 } from "path";
-var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT ?? resolve34(process.cwd(), "..");
-var SEND_SCRIPT = resolve34(
+import { resolve as resolve35 } from "path";
+var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT ?? resolve35(process.cwd(), "..");
+var SEND_SCRIPT = resolve35(
   PLATFORM_ROOT7,
   "plugins",
   "email",
@@ -25248,7 +25750,7 @@ var access_default = app61;
 
 // server/routes/sites.ts
 import { existsSync as existsSync40, readFileSync as readFileSync41, realpathSync as realpathSync8, statSync as statSync17 } from "fs";
-import { resolve as resolve35 } from "path";
+import { resolve as resolve36 } from "path";
 var SAFE_SEG_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var MIME = {
   ".html": "text/html; charset=utf-8",
@@ -25305,8 +25807,8 @@ app62.get("/:rel{.*}", (c) => {
     }
     segments.push(seg);
   }
-  const rootDir = resolve35(account.accountDir, "sites");
-  let filePath = segments.length === 0 ? rootDir : resolve35(rootDir, ...segments);
+  const rootDir = resolve36(account.accountDir, "sites");
+  let filePath = segments.length === 0 ? rootDir : resolve36(rootDir, ...segments);
   if (filePath !== rootDir && !filePath.startsWith(rootDir + "/")) {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
@@ -25326,7 +25828,7 @@ app62.get("/:rel{.*}", (c) => {
     return c.redirect(target, 301);
   }
   if (stat11?.isDirectory()) {
-    filePath = resolve35(filePath, "index.html");
+    filePath = resolve36(filePath, "index.html");
   }
   if (!filePath.startsWith(rootDir + "/")) {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
@@ -25972,14 +26474,14 @@ async function writeEvent(opts) {
 var visitor_event_default = app65;
 
 // server/routes/session.ts
-import { resolve as resolve36 } from "path";
+import { resolve as resolve37 } from "path";
 import { existsSync as existsSync42, writeFileSync as writeFileSync15, mkdirSync as mkdirSync9 } from "fs";
 var UUID_RE5 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function writeBrandingCache(accountId, agentSlug, branding) {
   try {
-    const cacheDir = resolve36(MAXY_DIR, "branding-cache", accountId);
+    const cacheDir = resolve37(MAXY_DIR, "branding-cache", accountId);
     mkdirSync9(cacheDir, { recursive: true });
-    writeFileSync15(resolve36(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
+    writeFileSync15(resolve37(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
   } catch (err) {
     console.error(`[branding] cache write failed: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -26056,8 +26558,8 @@ app66.post("/", async (c) => {
   }
   let agentConfig = null;
   if (account) {
-    const agentDir = resolve36(account.accountDir, "agents", agentSlug);
-    if (!existsSync42(agentDir) || !existsSync42(resolve36(agentDir, "config.json"))) {
+    const agentDir = resolve37(account.accountDir, "agents", agentSlug);
+    if (!existsSync42(agentDir) || !existsSync42(resolve37(agentDir, "config.json"))) {
       return c.json({ error: "Agent not found" }, 404);
     }
     agentConfig = resolveAgentConfig(account.accountDir, agentSlug);
@@ -26317,7 +26819,7 @@ var calendar_public_default = app67;
 // server/routes/portal-fetch.ts
 import { createReadStream as createReadStream3 } from "fs";
 import { stat as stat8, readFile as readFile9, realpath } from "fs/promises";
-import { join as join44, resolve as resolve37, sep as sep10 } from "path";
+import { join as join44, resolve as resolve38, sep as sep10 } from "path";
 import { Readable as Readable3 } from "stream";
 var app68 = new Hono();
 var TAG49 = "[portal-fetch]";
@@ -26370,7 +26872,7 @@ ${expiresAtMs}`)
   return diff === 0;
 }
 async function readAccountSecret(accountId) {
-  const path3 = resolve37(DATA_ROOT, "accounts", accountId, "secrets", "data-portal.env");
+  const path3 = resolve38(DATA_ROOT, "accounts", accountId, "secrets", "data-portal.env");
   let text;
   try {
     text = await readFile9(path3, "utf8");
@@ -26406,7 +26908,7 @@ async function resolveFetchTarget(accountDir, relPath, ownerId) {
   const exposeFolders = await readExposeFolders2(accountDir);
   const { exposed } = resolveExposedDirs(schemaText, exposeFolders);
   if (exposed.length === 0 && !ownerId) return { ok: false, reason: "not-exposed" };
-  const lexical = resolve37(accountDir, relPath);
+  const lexical = resolve38(accountDir, relPath);
   let root;
   let absolute;
   try {
@@ -26455,7 +26957,7 @@ async function handle(c, headOnly) {
     return c.json({ ok: false, error: "denied" }, 401);
   }
   const target = await resolveFetchTarget(
-    resolve37(DATA_ROOT, "accounts", accountId),
+    resolve38(DATA_ROOT, "accounts", accountId),
     relPath,
     owner || void 0
   );
@@ -26616,14 +27118,14 @@ function formatCensusLine(f) {
 var TAG51 = "[ledger-census]";
 var DAY_MS = 864e5;
 function countWriteRejects24h(logDir, now) {
-  let entries;
+  let entries2;
   try {
-    entries = readdirSync27(logDir).filter((f) => f.startsWith("mcp-ledger-") && f.endsWith(".log"));
+    entries2 = readdirSync27(logDir).filter((f) => f.startsWith("mcp-ledger-") && f.endsWith(".log"));
   } catch {
     return 0;
   }
   let total = 0;
-  for (const name of entries) {
+  for (const name of entries2) {
     const path3 = join45(logDir, name);
     try {
       if (now - statSync18(path3).mtimeMs > DAY_MS) continue;
@@ -26778,7 +27280,7 @@ async function runConversationAudit() {
 }
 
 // app/lib/graph-health.ts
-var import_dist6 = __toESM(require_dist4(), 1);
+var import_dist7 = __toESM(require_dist5(), 1);
 var HOUR_MS = 60 * 60 * 1e3;
 function renderLabelTop(rows) {
   return rows.map((b) => {
@@ -26823,7 +27325,7 @@ async function runGraphHealthTick() {
     console.error(
       `[graph-health] userprofile-multi accounts=${upAccounts} top=${upTop.length > 0 ? upTop.join(",") : "none"}`
     );
-    const indexed = [...import_dist6.VECTOR_INDEXED_LABELS];
+    const indexed = [...import_dist7.VECTOR_INDEXED_LABELS];
     const embCount = await session.run(
       `MATCH (n) WHERE n.embedding IS NULL AND any(l IN labels(n) WHERE l IN $indexed)
        RETURN count(n) AS total`,
@@ -26896,7 +27398,7 @@ function startGraphHealthTimer() {
 
 // app/lib/file-watcher.ts
 import * as fsp2 from "fs/promises";
-import { resolve as resolve38, sep as sep11 } from "path";
+import { resolve as resolve39, sep as sep11 } from "path";
 var ACCOUNT_UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var DEFAULT_COALESCE_MS = 500;
 var ROOTS = ["accounts"];
@@ -26915,7 +27417,7 @@ async function startFileWatcher(opts = {}) {
   const dropFn = opts.drop ?? dropFileIndex;
   for (const r of ROOTS) {
     try {
-      await fsp2.mkdir(resolve38(dataRoot, r), { recursive: true });
+      await fsp2.mkdir(resolve39(dataRoot, r), { recursive: true });
     } catch (err) {
       console.error(
         `[file-watcher] start-failed root="${r}" err="${err.message}" \u2014 index will be maintained by the 5-min reconcile backstop only`
@@ -26936,7 +27438,7 @@ async function startFileWatcher(opts = {}) {
     timers.set(relativePath, t);
   }
   async function runHook(relativePath, accountId) {
-    const absolute = resolve38(dataRoot, relativePath);
+    const absolute = resolve39(dataRoot, relativePath);
     let exists = false;
     try {
       const st = await fsp2.stat(absolute);
@@ -26960,7 +27462,7 @@ async function startFileWatcher(opts = {}) {
     }
   }
   async function watchRoot(rootName) {
-    const absRoot = resolve38(dataRoot, rootName);
+    const absRoot = resolve39(dataRoot, rootName);
     try {
       const iter = fsp2.watch(absRoot, { recursive: true, signal: controller.signal });
       for await (const event of iter) {
@@ -26999,18 +27501,18 @@ async function startFileWatcher(opts = {}) {
 
 // app/lib/migrate-uploads.ts
 import { mkdir as mkdir6, readdir as readdir6, rename as rename3, rm as rm3 } from "fs/promises";
-import { dirname as dirname15, relative as relative7, resolve as resolve39 } from "path";
+import { dirname as dirname15, relative as relative7, resolve as resolve40 } from "path";
 var ACCOUNT_UUID_RE5 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function walkFiles(dir) {
   const out = [];
-  let entries;
+  let entries2;
   try {
-    entries = await readdir6(dir, { withFileTypes: true });
+    entries2 = await readdir6(dir, { withFileTypes: true });
   } catch {
     return out;
   }
-  for (const e of entries) {
-    const abs = resolve39(dir, e.name);
+  for (const e of entries2) {
+    const abs = resolve40(dir, e.name);
     if (e.isDirectory()) {
       out.push(...await walkFiles(abs));
     } else if (e.isFile()) {
@@ -27030,7 +27532,7 @@ async function relocateTree(srcDir, destDir, dataRoot, accountId, session) {
   let moved = 0;
   for (const oldAbs of files) {
     const suffix = relative7(srcDir, oldAbs);
-    const newAbs = resolve39(destDir, suffix);
+    const newAbs = resolve40(destDir, suffix);
     await mkdir6(dirname15(newAbs), { recursive: true });
     await rename3(oldAbs, newAbs);
     moved++;
@@ -27057,7 +27559,7 @@ async function relocateTree(srcDir, destDir, dataRoot, accountId, session) {
 }
 async function migrateUploads(opts = {}) {
   const dataRoot = opts.dataRoot ?? DATA_ROOT;
-  const oldRoot = resolve39(dataRoot, "uploads");
+  const oldRoot = resolve40(dataRoot, "uploads");
   let topEntries;
   try {
     topEntries = await readdir6(oldRoot, { withFileTypes: true });
@@ -27078,8 +27580,8 @@ async function migrateUploads(opts = {}) {
       const name = entry.name;
       if (ACCOUNT_UUID_RE5.test(name)) {
         moved += await relocateTree(
-          resolve39(oldRoot, name),
-          resolve39(dataRoot, "accounts", name, "uploads"),
+          resolve40(oldRoot, name),
+          resolve40(dataRoot, "accounts", name, "uploads"),
           dataRoot,
           name,
           session
@@ -27091,8 +27593,8 @@ async function migrateUploads(opts = {}) {
           continue;
         }
         moved += await relocateTree(
-          resolve39(oldRoot, "public"),
-          resolve39(dataRoot, "accounts", installAccountId, "uploads", "public"),
+          resolve40(oldRoot, "public"),
+          resolve40(dataRoot, "accounts", installAccountId, "uploads", "public"),
           dataRoot,
           null,
           // public uploads carry no graph nodes
@@ -27169,13 +27671,13 @@ async function collectLiveSidecars(projectsRoot) {
   for (const slug of slugs) {
     if (!slug.isDirectory()) continue;
     const slugDir = join46(projectsRoot, slug.name);
-    let entries;
+    let entries2;
     try {
-      entries = await readdir7(slugDir, { withFileTypes: true });
+      entries2 = await readdir7(slugDir, { withFileTypes: true });
     } catch {
       continue;
     }
-    for (const entry of entries) {
+    for (const entry of entries2) {
       if (entry.isFile() && SESSION_META_RE.test(entry.name)) {
         out.push(join46(slugDir, entry.name));
       } else if (entry.isDirectory() && entry.name === "subagents") {
@@ -28234,16 +28736,16 @@ var WebchatGateway = class _WebchatGateway {
    *  The public /api/chat route awaits this to return the reply on the same SSE
    *  response, preserving the pre-756 POST→single-blob browser contract. */
   awaitReply(key, timeoutMs) {
-    return new Promise((resolve45) => {
+    return new Promise((resolve46) => {
       const timer = setTimeout(() => {
         this.replyAwaiters.delete(key);
-        resolve45({ timeout: true });
+        resolve46({ timeout: true });
       }, timeoutMs);
       if (timer.unref) timer.unref();
       this.replyAwaiters.set(key, (r) => {
         clearTimeout(timer);
         this.replyAwaiters.delete(key);
-        resolve45(r);
+        resolve46(r);
       });
     });
   }
@@ -28254,11 +28756,11 @@ var WebchatGateway = class _WebchatGateway {
    *  terminal dialog stays answerable). */
   awaitPermissionVerdict(p, timeoutMs) {
     const k = _WebchatGateway.promptKey(p.key, p.requestId);
-    return new Promise((resolve45) => {
+    return new Promise((resolve46) => {
       this.pendingPrompts.get(k)?.resolve({ timeout: true });
       const timer = setTimeout(() => {
         this.pendingPrompts.delete(k);
-        resolve45({ timeout: true });
+        resolve46({ timeout: true });
       }, timeoutMs);
       if (timer.unref) timer.unref();
       this.pendingPrompts.set(k, {
@@ -28267,7 +28769,7 @@ var WebchatGateway = class _WebchatGateway {
         resolve: (r) => {
           clearTimeout(timer);
           this.pendingPrompts.delete(k);
-          resolve45(r);
+          resolve46(r);
         }
       });
       console.error(`[webchat:perm] op=open key=${keyDisplay(p.key)} id=${p.requestId} tool=${p.toolName}`);
@@ -28832,7 +29334,7 @@ async function fanOut(subscribers, text, onError, tag) {
 
 // app/lib/webchat/file-delivery.ts
 import { realpathSync as realpathSync9 } from "fs";
-import { resolve as resolve40 } from "path";
+import { resolve as resolve41 } from "path";
 
 // app/lib/channel-pty-bridge/file-delivery.ts
 var SEND_USER_FILE = "SendUserFile";
@@ -28933,7 +29435,7 @@ function makeWebchatSendFile(entry) {
       console.error(`${TAG53} file-delivery reject reason=no-account sender=${entry.senderId}`);
       return { ok: false, error: "no-account" };
     }
-    const accountDir = resolve40(platformRoot2(), "..", "data/accounts", entry.accountId);
+    const accountDir = resolve41(platformRoot2(), "..", "data/accounts", entry.accountId);
     try {
       const resolved = realpathSync9(filePath);
       const accountResolved = realpathSync9(accountDir);
@@ -29497,7 +29999,7 @@ function buildTelegramSpawnRequest(input) {
 // app/lib/telegram/outbound/send-document.ts
 import { realpathSync as realpathSync10 } from "fs";
 import { readFile as readFile11, stat as stat10 } from "fs/promises";
-import { resolve as resolve41, basename as basename13 } from "path";
+import { resolve as resolve42, basename as basename13 } from "path";
 var TAG55 = "[telegram:outbound]";
 var TELEGRAM_DOCUMENT_MAX_BYTES = 50 * 1024 * 1024;
 async function sendTelegramDocument(input) {
@@ -29508,7 +30010,7 @@ async function sendTelegramDocument(input) {
   if (!maxyAccountId || !platformRoot5) {
     return { ok: false, status: 400, error: "Cannot validate file path: missing account or platform context" };
   }
-  const accountDir = resolve41(platformRoot5, "..", "data/accounts", maxyAccountId);
+  const accountDir = resolve42(platformRoot5, "..", "data/accounts", maxyAccountId);
   let accountResolved;
   try {
     accountResolved = realpathSync10(accountDir);
@@ -29800,11 +30302,11 @@ async function firePublicSessionEndReview(input) {
 }
 
 // app/lib/whatsapp/inbound/resolve-client-graph-owner.ts
-var import_dist7 = __toESM(require_dist(), 1);
+var import_dist8 = __toESM(require_dist(), 1);
 async function resolveClientOwnerUserId(accountId, deps = {}) {
   const listAccounts = deps.listAccounts ?? listValidAccounts;
   const getSession4 = deps.getSession ?? getSession;
-  const resolveOwner2 = deps.resolveOwner ?? import_dist7.resolveOwnerUserId;
+  const resolveOwner2 = deps.resolveOwner ?? import_dist8.resolveOwnerUserId;
   const role = listAccounts().find((a) => a.accountId === accountId)?.config.role;
   if (role !== "client") return null;
   const session = getSession4();
@@ -29901,10 +30403,10 @@ function warnOnChannelAdminBindingDrift() {
 
 // server/lib/booking-site-accounts.ts
 import { existsSync as existsSync44, readFileSync as readFileSync45 } from "fs";
-import { resolve as resolve42 } from "path";
+import { resolve as resolve43 } from "path";
 function listBookingSiteAccounts(accounts) {
   return accounts.filter((a) => {
-    const availPath = resolve42(a.accountDir, "calendar-availability.json");
+    const availPath = resolve43(a.accountDir, "calendar-availability.json");
     if (!existsSync44(availPath)) return false;
     try {
       const cfg = JSON.parse(readFileSync45(availPath, "utf-8"));
@@ -29946,7 +30448,7 @@ function broadcastAdminShutdown(reason) {
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash6, verify as cryptoVerify } from "crypto";
 import { existsSync as existsSync45, readFileSync as readFileSync46, statSync as statSync19 } from "fs";
-import { resolve as resolve43 } from "path";
+import { resolve as resolve44 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
 function canonicalize(value) {
@@ -29981,7 +30483,7 @@ var PUBKEY_SHA256 = "8eee6bcb33545fd13b16d3199a5735ca5db5062834c7b49dfe4f23801d9
 var GRACE_DAYS = 7;
 var GRACE_MS = GRACE_DAYS * 24 * 60 * 60 * 1e3;
 function pubkeyPath(brand) {
-  return resolve43(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
+  return resolve44(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
 }
 var memo = null;
 function memoKey(mtimeMs, account) {
@@ -29993,7 +30495,7 @@ function resolveEntitlement(brand, account) {
   if (brand.commercialMode !== true) {
     return logResolved(implicitTrust(account), null);
   }
-  const entitlementPath = resolve43(brand.configDir, "entitlement.json");
+  const entitlementPath = resolve44(brand.configDir, "entitlement.json");
   if (!existsSync45(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
@@ -30249,6 +30751,7 @@ watchFile(ALIAS_DOMAINS_PATH, { interval: 2e3 }, () => {
   aliasDomains = updated;
   console.log(`[alias-domains] reloaded ${updated.size} alias domain(s): ${[...updated].join(", ")}`);
 });
+attachRouteCacheWatchers();
 function isPublicHost(host) {
   return host.startsWith("public.") || aliasDomains.has(host);
 }
@@ -30266,8 +30769,8 @@ var webchatFileFollowers = /* @__PURE__ */ new Map();
 async function fetchAccountStandingRules(accountId) {
   const session = getSession();
   try {
-    const res = await (0, import_dist8.resolveActiveRules)(session, accountId);
-    return { block: (0, import_dist8.formatStandingRulesBlock)(res.rules), ownerUserId: res.ownerUserId, source: res.source };
+    const res = await (0, import_dist9.resolveActiveRules)(session, accountId);
+    return { block: (0, import_dist9.formatStandingRulesBlock)(res.rules), ownerUserId: res.ownerUserId, source: res.source };
   } catch (err) {
     console.error(
       `[preference-inject] op=fetch-failed accountId=${accountId} error=${err instanceof Error ? err.message : String(err)}`
@@ -30301,7 +30804,7 @@ var waGateway = new WaGateway({
   fetchStandingRules: fetchAccountStandingRules,
   resolveSessionOverride: (accountId, senderId) => resolveChannelOverride(accountId, "whatsapp", senderId),
   gatewayUrl: `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`,
-  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve44(process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
+  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve45(process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
   // Task 751 / 1390 — file delivery on the native channel. `maxyAccountId` (the
   // path-validation scope) is the sender's effective SESSION account, resolved
   // once at the inbound gate and threaded here via the gateway's per-sender doc
@@ -30316,7 +30819,7 @@ var waGateway = new WaGateway({
       caption,
       accountId,
       maxyAccountId,
-      platformRoot: resolve44(process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, ".."))
+      platformRoot: resolve45(process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, ".."))
     });
     return result.ok ? { ok: true, messageId: result.messageId } : { ok: false, error: result.error };
   },
@@ -30996,8 +31499,8 @@ app69.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] no-account slug=${slug} file=${filename}`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve44(account.accountDir, "agents", slug, "assets", filename);
-  const expectedDir = resolve44(account.accountDir, "agents", slug, "assets");
+  const filePath = resolve45(account.accountDir, "agents", slug, "assets", filename);
+  const expectedDir = resolve45(account.accountDir, "agents", slug, "assets");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
@@ -31026,8 +31529,8 @@ app69.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve44(account.accountDir, "generated", filename);
-  const expectedDir = resolve44(account.accountDir, "generated");
+  const filePath = resolve45(account.accountDir, "generated", filename);
+  const expectedDir = resolve45(account.accountDir, "generated");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
@@ -31081,11 +31584,11 @@ var brandScript = `<script>window.__BRAND__=${JSON.stringify({
 var brandThemeColor = BRAND.defaultColors?.primary ?? "#000000";
 var brandBackgroundColor = BRAND.defaultColors?.background ?? "#ffffff";
 var brandAppIconsExist = [brandAppIcon192Path, brandAppIcon512Path, brandMaskableIconPath].every(
-  (p) => existsSync46(resolve44(process.cwd(), "public", p.replace(/^\//, "")))
+  (p) => existsSync46(resolve45(process.cwd(), "public", p.replace(/^\//, "")))
 );
 var SW_SOURCE = (() => {
   try {
-    return readFileSync47(resolve44(process.cwd(), "public", "sw.js"), "utf-8");
+    return readFileSync47(resolve45(process.cwd(), "public", "sw.js"), "utf-8");
   } catch {
     return null;
   }
@@ -31136,7 +31639,7 @@ var clientErrorReporterScript = `<script>
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync47(resolve44(process.cwd(), "public", file), "utf-8");
+    html = readFileSync47(resolve45(process.cwd(), "public", file), "utf-8");
     const productNameEsc = escapeHtml(BRAND.productName);
     html = html.replace(/<title>([^<]*)<\/title>/, (_match, inner) => `<title>${escapeHtml(inner).replace(/Maxy/g, productNameEsc)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
@@ -31254,7 +31757,7 @@ app69.use("/vnc-popout.html", logViewerFetch);
 app69.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync47(resolve44(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync47(resolve45(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -31407,7 +31910,7 @@ var httpServer = serve({ fetch: app69.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
   const reconcilePlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, "..");
-  const reconcileScript = resolve44(reconcilePlatformRoot, "plugins/scheduling/mcp/dist/scripts/reconcile-bookings.js");
+  const reconcileScript = resolve45(reconcilePlatformRoot, "plugins/scheduling/mcp/dist/scripts/reconcile-bookings.js");
   const runReconcile = (ctx) => {
     if (!existsSync46(reconcileScript)) return;
     try {
@@ -31448,7 +31951,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
   const DREAM_CYCLE_SWEEP_INTERVAL_MS = 36e5;
   const dreamPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, "..");
-  const dreamSweepScript = resolve44(dreamPlatformRoot, "plugins/memory/mcp/dist/scripts/dream-cycle-sweep.js");
+  const dreamSweepScript = resolve45(dreamPlatformRoot, "plugins/memory/mcp/dist/scripts/dream-cycle-sweep.js");
   registerLoop({
     name: "dream-cycle-sweep",
     intervalMs: DREAM_CYCLE_SWEEP_INTERVAL_MS,
@@ -31472,7 +31975,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 }
 {
   const outlookPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, "..");
-  const outlookScript = resolve44(outlookPlatformRoot, "plugins/outlook/mcp/dist/scripts/complete-registration.js");
+  const outlookScript = resolve45(outlookPlatformRoot, "plugins/outlook/mcp/dist/scripts/complete-registration.js");
   const OUTLOOK_COMPLETE_INTERVAL_MS = 3e4;
   const runOutlookComplete = (ctx) => {
     if (!existsSync46(outlookScript)) return;
@@ -31498,7 +32001,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 }
 {
   const auditRoot = process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, "..");
-  const strandedAccountsDir = resolve44(auditRoot, "..", "data/accounts");
+  const strandedAccountsDir = resolve45(auditRoot, "..", "data/accounts");
   const STRANDED_AUDIT_INTERVAL_MS = 3e5;
   const STRANDED_AGE_MS = 16 * 6e4;
   const STRANDED_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
@@ -31508,7 +32011,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
       const now = Date.now();
       for (const name of readdirSync28(strandedAccountsDir)) {
         if (!STRANDED_UUID_RE.test(name)) continue;
-        const pendingPath2 = resolve44(strandedAccountsDir, name, "secrets/outlook/pending-devicecode.enc");
+        const pendingPath2 = resolve45(strandedAccountsDir, name, "secrets/outlook/pending-devicecode.enc");
         if (!existsSync46(pendingPath2)) continue;
         const ageMs2 = now - statSync20(pendingPath2).mtimeMs;
         if (ageMs2 > STRANDED_AGE_MS) {
@@ -31528,7 +32031,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 }
 {
   const googleRoot = process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, "..");
-  const googleAccountsDir = resolve44(googleRoot, "..", "data/accounts");
+  const googleAccountsDir = resolve45(googleRoot, "..", "data/accounts");
   const GOOGLE_PENDING_AUDIT_INTERVAL_MS = 3e5;
   const runGooglePendingAuditSafe = () => {
     try {
@@ -31543,7 +32046,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     firstRunDelayMs: 27e3,
     run: runGooglePendingAuditSafe
   });
-  const googleAuditScript = resolve44(googleRoot, "plugins/google/mcp/dist/scripts/account-audit.js");
+  const googleAuditScript = resolve45(googleRoot, "plugins/google/mcp/dist/scripts/account-audit.js");
   const GOOGLE_ACCOUNT_AUDIT_INTERVAL_MS = 36e5;
   const runGoogleAccountAudit = (ctx) => {
     if (!existsSync46(googleAuditScript)) return;
@@ -31618,7 +32121,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 }
 {
   const publishPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, "..");
-  const publishScript = resolve44(publishPlatformRoot, "plugins/scheduling/mcp/dist/scripts/publish-availability.js");
+  const publishScript = resolve45(publishPlatformRoot, "plugins/scheduling/mcp/dist/scripts/publish-availability.js");
   const PUBLISH_INTERVAL_MS = 3e5;
   const bookingAccounts = () => {
     try {
@@ -31648,7 +32151,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     }
   };
   const auditSnapshotAge = (account) => {
-    const availPath = resolve44(account.accountDir, "calendar-availability.json");
+    const availPath = resolve45(account.accountDir, "calendar-availability.json");
     let hasBookingSite = false;
     try {
       if (existsSync46(availPath)) {
@@ -31658,7 +32161,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     } catch {
     }
     if (!hasBookingSite) return;
-    const statePath = resolve44(account.accountDir, "state", "booking-availability", "last-publish.json");
+    const statePath = resolve45(account.accountDir, "state", "booking-availability", "last-publish.json");
     let lastSuccessAt = null;
     if (existsSync46(statePath)) {
       try {
@@ -31695,7 +32198,7 @@ startTimeEntryCensus(() => getSession());
 startLedgerCensus(() => getSession());
 {
   const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, "..");
-  const auditScript = resolve44(auditPlatformRoot, "plugins/connector/mcp/dist/scripts/audit-connectors.js");
+  const auditScript = resolve45(auditPlatformRoot, "plugins/connector/mcp/dist/scripts/audit-connectors.js");
   const auditLogDir = process.env.LOG_DIR ?? LOG_DIR;
   const CONNECTOR_AUDIT_INTERVAL_MS = 3e5;
   const runConnectorAudit = (ctx) => {
@@ -32004,7 +32507,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve44(process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, "..")),
+  platformRoot: resolve45(process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, "..")),
   accountConfig: bootAccountConfig,
   onMessage: async (msg) => {
     if (isObserveAccount(msg.accountId)) {