@rubytech/create-maxy-code 0.1.536 → 0.1.538

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.536",
+  "version": "0.1.538",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/plugins/admin/hooks/__tests__/mailbox-inject.test.sh

@@ -105,14 +105,20 @@ else
 fi
 rm -rf "$A"
 
-# --- Case 2: ACCOUNT_DIR unset, cwd is the account dir ----------------------
+# --- Case 2: ACCOUNT_DIR unset (a public spawn) -> silent -------------------
+# Task 2271 — ACCOUNT_DIR is stamped for admin and specialist spawns only
+# (pty-spawner.ts, the `isSpecialistSpawn || role === admin` gate) and
+# unconditionally on the rc-spawn path. Its ABSENCE therefore means a
+# role:public spawn, and a public visitor must never receive the operator's
+# mailbox list. The cwd fallback this case used to assert was handing a stranger
+# the HOUSE's addresses, because a public spawn's cwd is the house account dir.
 A=$(newacct)
 OUT=$(cd "$A" && printf '%s' "$STDIN" | env -u ACCOUNT_DIR LOG_DIR="$A/logs" bash "$HOOK" 2>/dev/null); EX=$?
-C=$(ctx)
-if [[ "$EX" -eq 0 && "$C" == *"<mailboxes>"* ]]; then
-  ok "ACCOUNT_DIR unset -> account dir resolved from cwd"
+if [[ "$EX" -eq 0 && -z "$OUT" ]] \
+   && /usr/bin/grep -q "op=skip reason=no-account-dir" "$A/logs/mailbox-inject.log"; then
+  ok "ACCOUNT_DIR unset (public spawn) -> exit 0, no block emitted"
 else
-  bad "cwd fallback (exit=$EX ctx=$C)"
+  bad "public-spawn silence (exit=$EX stdout=$OUT log=$(cat "$A/logs/mailbox-inject.log" 2>/dev/null))"
 fi
 rm -rf "$A"
 

package/payload/platform/plugins/admin/hooks/mailbox-inject.sh

@@ -37,16 +37,21 @@ command -v node >/dev/null 2>&1 || exit 0
 
 # --- account dir -----------------------------------------------------------
 # ACCOUNT_DIR is stamped unconditionally on the rc-spawn path (rc-daemon.ts
-# buildRcChildEnv) but only for admin/specialist on the pty-spawner path
-# (pty-spawner.ts, the `isSpecialistSpawn || role === admin` gate), so a
-# role:public webchat or passive WhatsApp spawn has none. The spawn cwd IS the
-# account dir on both paths (config.ts: spawnCwd defaults to accountDir), which
-# is how fs-schema-guard.sh already resolves it.
+# buildRcChildEnv) and, on the pty-spawner path, only for admin/specialist
+# (pty-spawner.ts, the `isSpecialistSpawn || role === admin` gate).
+#
+# Task 2271 — requiring it IS the role gate. This hook is wired unconditionally
+# for every account (provision-account-dir.sh) with no role of its own, and the
+# previous `$PWD` fallback existed to serve the spawns that carry no
+# ACCOUNT_DIR. On that path those are exactly the role:public ones: a public
+# WhatsApp or webchat visitor, or a passive intake whose only tool is
+# work-create. None of them should receive the operator's mailbox list, and a
+# public visitor session was receiving the HOUSE's, because a public spawn's cwd
+# is the house account dir. The block's only prior protection was a sentence
+# asking the model not to recite it.
 ACCT=""
 if [ -n "${ACCOUNT_DIR:-}" ] && [ -d "${ACCOUNT_DIR}" ]; then
   ACCT="$ACCOUNT_DIR"
-elif [ -f "$PWD/.claude/settings.json" ] && [ -d "$PWD/secrets" ]; then
-  ACCT="$PWD"
 fi
 
 # --- log dir ---------------------------------------------------------------

package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: platform-architecture
 description: Use when grounding any documented-surface claim about what Maxy ships — plugins, skills, specialists, install/deploy flows, internals. This is the install catalogue, not evidence of what is enabled on the current account. For install state on this account, call `capabilities-here`; for documented surface, cite the `Source:` URL inline.
-content-hash: sha256:46709b4084d565de5c59a8b8a2fcf7450e2ac4202ef08ebafde533dd5cd3385c
+content-hash: sha256:08b03d80446b9b08b4b64926a3ac7d7f55a6f07d4182512dcca1d107c78cc9a2
 brand: maxy-code
 product-name: Maxy
 ---
@@ -1661,6 +1661,86 @@ Changes are per-account and take effect immediately.
 
 Brand isolation extends to the device filesystem. Every Maxy install provisions an SMB share scoped to that brand's install folder, credentialled by the brand's install owner and the Maxy PIN. A device that hosts more than one brand carries one share per brand; tearing one brand down never exposes another brand's files. See [Samba Share](./samba.md) for the credential model, per-OS mount syntax, and peer-brand lifecycle.
 
+---
+# What Wakes a Session
+Source: https://docs.getmaxy.com/channel-wake-and-prompt.md
+
+# What wakes a session, and what is in its prompt
+
+Two questions an agent cannot answer from inside itself, and both have caused real faults: *what woke me?* and *which files did my prompt come from?* This page answers both. When the answer is not here, the logs have it: `logs-read --tail server`, filtered on the `[whatsapp:*]` tags.
+
+## What wakes a session
+
+Five things start or resume a WhatsApp session. They are distinguishable, and the distinction matters, because two of them are written by the platform rather than by the person named as the sender.
+
+**An admin phone or an account manager messages the line.** This resumes that person's own admin session. There is no per-account admin session: the session id is a hash of the account plus the person, so one person messaging from two channels resumes one thread, and two managers on one account have two threads.
+
+**A public sender messages the line.** Three things follow, in this order, and each is independent of the ones after it.
+
+1. The account's registered managers are notified, verbatim, unless the account has turned that off. This fires before any agent starts, so it survives a spawn that fails.
+2. Every bound manager's own admin session is woken with a `public-relay` turn carrying the sender's message as fenced content. This is the carrier for anything the account needs to do about the visitor: translate, put a request to a registered counterparty, carry the answer back.
+3. The account's public agent answers the visitor, if the account has one and has enabled it. If not, the visitor receives nothing at all, and steps 1 and 2 have already happened regardless.
+
+**The scheduler fires a due event.** This raises a `schedule` turn on the destination's own session, carrying the event's prompt.
+
+**A passive account-manager binding receives a message.** This spawns a constrained one-shot that files a task and never replies. It cannot hold a conversation or answer against existing state.
+
+## Reading why you woke
+
+Every turn carries a `source`. Three values exist:
+
+| `source` | Meaning |
+|---|---|
+| `user` | A real person sent this message to the line. Also the value when the field is absent. |
+| `schedule` | The scheduler wrote this turn. The named destination did not send it. |
+| `public-relay` | The platform wrote this turn because a public visitor messaged the account. The named sender is a manager being told, not someone who wrote to you. |
+
+A `public-relay` turn also says so in its own first two lines. If a turn claims a manager wrote something they plainly would not have written, check the source before answering them.
+
+## Which files compose the prompt
+
+The system prompt is assembled per spawn from one agent directory, and **which directory depends on the role**:
+
+- A `role:'public'` spawn reads `agents/<the account's public-agent slug>/`.
+- Every other role reads `agents/admin/`.
+
+From that one directory it takes `IDENTITY.md` and `SOUL.md`, verbatim.
+
+The consequence catches people out: **an instruction written into `agents/admin/SOUL.md` is never read by a public spawn**, and an instruction written into a public agent's `SOUL.md` is never read by an admin turn. Before writing an instruction into a role file, decide which role will actually be running when it needs to apply. If the answer is "the admin agent, woken by a stranger's message", the file is `agents/admin/SOUL.md` and the trigger is the `public-relay` dispatch above.
+
+A public agent's directory also carries `KNOWLEDGE.md` and `config.json`. An account can hold as many public agents as it likes; only one is bound to WhatsApp at a time, and that binding is per account.
+
+## The switches, and what each one stops
+
+Four settings sit on this path. They are not interchangeable, and reaching for the wrong one is how an operator ends up silencing more than they meant.
+
+| Setting | What it stops | What it leaves running |
+|---|---|---|
+| `dmPolicy: disabled` | Public senders are refused at the gate. | Admin and manager inbound. |
+| `publicAgentEnabled: false` | The visitor gets no reply. | The manager notification and the relay. |
+| `managerNotifyEnabled: false` | The verbatim copy of the visitor's message. | The relay, and any reply the woken turn sends. |
+| `dispatchInbound: false` | Every agent turn on that account's socket. | Storage: messages are still stored and readable. |
+
+`managerNotifyEnabled` is the fine-grained one, and the one to reach for when the notifications are unwanted but the work is not. Unbinding a manager is not a substitute: the manager registry is shared by the notification, the relay and `whatsapp-notify-manager`, so unbinding silences all three.
+
+Read the current value with `whatsapp-config {action:'get-manager-notify-enabled'}` and set it with `set-manager-notify-enabled`. Both are scoped to the calling session's own account.
+
+## When the answer is not here
+
+`logs-read --tail server` and filter on the tags. One public inbound writes this chain, in order, with `account=` and `sender=` on each line:
+
+```
+[whatsapp:wire]         op=stanza
+[wa-notify]             op=eligible        reason=<how the sender was admitted>
+[whatsapp:route]        op=routed          agentType=public
+[whatsapp:notify]       op=public-inbound  enabled=0|1 outcome=sent|failed|no-recipients|disabled
+[whatsapp:relay]        op=dispatch        outcome=sent|failed|no-recipients
+[whatsapp:public-agent] op=route           enabled=… slug=… spawned=0|1
+[whatsapp:public-agent] op=spawn-ok | op=spawn-failed
+```
+
+Three standing audits reconcile that chain rather than waiting for someone to notice. `op=public-notify-reconcile` reports `gap`, `relayGap` and `englishGap`, each of which counts a step that a routed inbound reached and the next one did not. `op=spawn-census` reports attempts against successes. A non-zero gap, or attempts with no successes, is a fault even when nothing has been reported.
+
 ---
 # Settings
 Source: https://docs.getmaxy.com/settings.md
@@ -3535,6 +3615,46 @@ scheduling heartbeat and report on every tick including zero:
 `op=dispatch-mode-none` (a routine that fires and delivers nothing) and
 `op=null-timezone` (a routine that fires at the box's hour).
 
+### Tasks
+
+The Tasks surface (`/tasks`) lists the account's `:Task` nodes on Open,
+Completed and Clients tabs and records billable time against each one. Its
+routes are all account-scoped:
+
+| Mount | Purpose |
+|---|---|
+| `/tasks-list` | Open/Completed partition, plus the standing censuses described below. |
+| `/task-timer-start`, `/task-timer-stop` | Open and close a `:TimeEntry`. Timers on different tasks run concurrently; there is no auto-stop. |
+| `/task-complete` | Status → completed. Does **not** stop a running timer. |
+| `/task-time-adjust` | Manual time edit. Writes one `:TimeAdjustment`; 409s while the task has an open `:TimeEntry`. |
+| `/task-delete` | Removes the `:Task` **and** every `:TimeEntry` and `:TimeAdjustment` on it. Nothing is recoverable and there is no restore route. 409s while the task has an open `:TimeEntry`; 404s a wrong-account task. |
+| `/task-assign`, `/task-session-open`, `/task-session-link` | Assignee writes, and the Session control's spawn-or-resume path. |
+
+**Row controls.** Each row carries a burger — the same `SessionRowActions`
+component the sidebar's session rows use — holding Edit time, Reset logged time
+to 0:00, Session and Delete. Only Complete (icon only) and Start/Stop stay
+inline, on open rows; a completed row carries the burger alone. A row whose
+`:Task` has no `taskId` is unactionable and shows a "Needs repair" marker with no
+burger. While a row's timer runs, Edit time, Reset and Delete are refused and
+each tooltip says why. Delete opens a confirm anchored beside the row that names
+the task and its logged time before it writes.
+
+**Observability.** `[task-delete]` emits one lifeline per deletion keyed by
+`deletionId`: `op=request` (carrying `confirmed`), `op=guard`, `op=reject
+reason=…`, `op=persisted` and `op=error`. `op=persisted` carries `remaining=`,
+a **fresh read after the delete** counting what still holds that `taskId` — the
+delete's own counters agree with themselves by construction, so only the read-back
+proves the rows are gone. A non-zero `remaining` also emits `op=incomplete` at
+error level.
+
+Separately, `/tasks-list` reconciles time records against tasks on **every**
+compute and reports `op=orphan-time-records`, or
+`op=orphan-time-records-census-failed` when the census itself could not run. This
+is not aimed at `task-delete`, which is atomic and self-verifying: it catches any
+other path that removes a `:Task` without its records — the graph trash tooling
+handles `:Task` and knows nothing about `:TimeEntry` or `:TimeAdjustment`, and
+strands both silently.
+
 ### Skills
 
 The Skills surface (`/skills`) is the admin view of the account's operator-
@@ -4131,9 +4251,20 @@ a browser that is already running it re-ran the same launch check and changed
 nothing anyone could see, so it now appears only when the browser is unreachable
 or has no tabs open.
 
-The globe button in the chat header opens the browser as a second pane beside
-the conversation, and remembers that choice for the next visit. The pane is
-hidden on narrow screens, where there is no room for two columns.
+The browser opens beside the conversation from the globe button at the top
+right of the chat header. That button is there only while the browser is
+closed; once it is open you close it with the cross at the top right of the
+browser itself, and the button comes back. Beside the cross is a full-screen
+control that gives the browser the whole width and hides the chat, and the same
+control returns you to the split.
+
+Drag the divider between the chat and the browser to change how the width is
+shared. Double-click it to go back to an even split. The chat can never be
+pushed below a readable width, and the choice is remembered for next time. The
+pane is hidden on narrow screens where there is no room for two columns, and
+the page is rendered at the pane's own size so it fills it.
+
+There is no Browser item in the sidebar: the browser lives beside the chat.
 
 Tab opening and closing go to the admin server, which is the only thing that can
 reach the browser's control port. Typing an address, going back and going

package/payload/platform/plugins/admin/skills/whats-new/SKILL.md

@@ -9,6 +9,16 @@ Invoked by the admin agent directly.
 
 This is the platform's release timeline, newest first. Each entry shows the date it shipped and the version it shipped in, so you can tell the operator how current their install is. To compare, read the installed version from `capabilities-here` and match it against the versions below. Keep answers high level and in plain English; this is a summary, not a full commit log.
 
+## 2026-07-31 (0.1.538)
+
+- A message from someone outside your team now also reaches the account's manager in their own chat, written in plain English, and each account can turn the separate raw notification off.
+- The device browser pane can be toggled, opened full screen and resized.
+
+## 2026-07-31 (0.1.537)
+
+- A sub-account's public agent now runs entirely in that account: its own folder, its own settings, and no falling back to the main account's agent. A standing check reports an account switched on with no agent of its own.
+- Task rows keep Complete and Start to hand, with the rest behind a menu, and a task can now be deleted along with its time records after a confirm. A standing check reports any time record left behind.
+
 ## 2026-07-31 (0.1.536)
 
 - You can now switch on a public agent per account to answer WhatsApp messages from people outside your team, with a standing check that reports an account switched on but pointing at an agent that no longer exists.

package/payload/platform/plugins/docs/PLUGIN.md

@@ -23,6 +23,7 @@ Load these when users ask about Maxy features or need guidance:
 - **Telegram** → `references/telegram-guide.md` — Telegram setup, the bot, daily use
 - **Settings** → `references/settings.md` — output style, effort level, account preferences
 - **Access Control** → `references/access-control.md` — who can chat with your public agent, invitations, authentication
+- **What wakes a session** → `references/channel-wake-and-prompt.md` — the five things that start or resume a WhatsApp session, the `source` value each carries, which agent directory composes the prompt for which role, and the four switches on the public-inbound path. Load before writing an instruction into any role file, or when an agent cannot say why it woke.
 - **Projects** → `references/projects-guide.md` — creating projects, tracking health, phase transitions, completing
 - **Workflows** → `references/workflows.md` — saving and running multi-step processes, declared inputs, scheduling, run history
 - **Slides** → `references/slides.md` — generating, theming, and reviewing HTML slide decks with `/slides`
@@ -51,6 +52,7 @@ Load these when performing admin tasks or diagnosing platform behaviour:
 - references/telegram-guide.md
 - references/settings.md
 - references/access-control.md
+- references/channel-wake-and-prompt.md
 - references/projects-guide.md
 - references/troubleshooting.md
 - references/platform.md

package/payload/platform/plugins/docs/references/admin-ui.md

@@ -258,6 +258,46 @@ scheduling heartbeat and report on every tick including zero:
 `op=dispatch-mode-none` (a routine that fires and delivers nothing) and
 `op=null-timezone` (a routine that fires at the box's hour).
 
+### Tasks
+
+The Tasks surface (`/tasks`) lists the account's `:Task` nodes on Open,
+Completed and Clients tabs and records billable time against each one. Its
+routes are all account-scoped:
+
+| Mount | Purpose |
+|---|---|
+| `/tasks-list` | Open/Completed partition, plus the standing censuses described below. |
+| `/task-timer-start`, `/task-timer-stop` | Open and close a `:TimeEntry`. Timers on different tasks run concurrently; there is no auto-stop. |
+| `/task-complete` | Status → completed. Does **not** stop a running timer. |
+| `/task-time-adjust` | Manual time edit. Writes one `:TimeAdjustment`; 409s while the task has an open `:TimeEntry`. |
+| `/task-delete` | Removes the `:Task` **and** every `:TimeEntry` and `:TimeAdjustment` on it. Nothing is recoverable and there is no restore route. 409s while the task has an open `:TimeEntry`; 404s a wrong-account task. |
+| `/task-assign`, `/task-session-open`, `/task-session-link` | Assignee writes, and the Session control's spawn-or-resume path. |
+
+**Row controls.** Each row carries a burger — the same `SessionRowActions`
+component the sidebar's session rows use — holding Edit time, Reset logged time
+to 0:00, Session and Delete. Only Complete (icon only) and Start/Stop stay
+inline, on open rows; a completed row carries the burger alone. A row whose
+`:Task` has no `taskId` is unactionable and shows a "Needs repair" marker with no
+burger. While a row's timer runs, Edit time, Reset and Delete are refused and
+each tooltip says why. Delete opens a confirm anchored beside the row that names
+the task and its logged time before it writes.
+
+**Observability.** `[task-delete]` emits one lifeline per deletion keyed by
+`deletionId`: `op=request` (carrying `confirmed`), `op=guard`, `op=reject
+reason=…`, `op=persisted` and `op=error`. `op=persisted` carries `remaining=`,
+a **fresh read after the delete** counting what still holds that `taskId` — the
+delete's own counters agree with themselves by construction, so only the read-back
+proves the rows are gone. A non-zero `remaining` also emits `op=incomplete` at
+error level.
+
+Separately, `/tasks-list` reconciles time records against tasks on **every**
+compute and reports `op=orphan-time-records`, or
+`op=orphan-time-records-census-failed` when the census itself could not run. This
+is not aimed at `task-delete`, which is atomic and self-verifying: it catches any
+other path that removes a `:Task` without its records — the graph trash tooling
+handles `:Task` and knows nothing about `:TimeEntry` or `:TimeAdjustment`, and
+strands both silently.
+
 ### Skills
 
 The Skills surface (`/skills`) is the admin view of the account's operator-
@@ -854,9 +894,20 @@ a browser that is already running it re-ran the same launch check and changed
 nothing anyone could see, so it now appears only when the browser is unreachable
 or has no tabs open.
 
-The globe button in the chat header opens the browser as a second pane beside
-the conversation, and remembers that choice for the next visit. The pane is
-hidden on narrow screens, where there is no room for two columns.
+The browser opens beside the conversation from the globe button at the top
+right of the chat header. That button is there only while the browser is
+closed; once it is open you close it with the cross at the top right of the
+browser itself, and the button comes back. Beside the cross is a full-screen
+control that gives the browser the whole width and hides the chat, and the same
+control returns you to the split.
+
+Drag the divider between the chat and the browser to change how the width is
+shared. Double-click it to go back to an even split. The chat can never be
+pushed below a readable width, and the choice is remembered for next time. The
+pane is hidden on narrow screens where there is no room for two columns, and
+the page is rendered at the pane's own size so it fills it.
+
+There is no Browser item in the sidebar: the browser lives beside the chat.
 
 Tab opening and closing go to the admin server, which is the only thing that can
 reach the browser's control port. Typing an address, going back and going

package/payload/platform/plugins/docs/references/channel-wake-and-prompt.md

@@ -0,0 +1,75 @@
+# What wakes a session, and what is in its prompt
+
+Two questions an agent cannot answer from inside itself, and both have caused real faults: *what woke me?* and *which files did my prompt come from?* This page answers both. When the answer is not here, the logs have it: `logs-read --tail server`, filtered on the `[whatsapp:*]` tags.
+
+## What wakes a session
+
+Five things start or resume a WhatsApp session. They are distinguishable, and the distinction matters, because two of them are written by the platform rather than by the person named as the sender.
+
+**An admin phone or an account manager messages the line.** This resumes that person's own admin session. There is no per-account admin session: the session id is a hash of the account plus the person, so one person messaging from two channels resumes one thread, and two managers on one account have two threads.
+
+**A public sender messages the line.** Three things follow, in this order, and each is independent of the ones after it.
+
+1. The account's registered managers are notified, verbatim, unless the account has turned that off. This fires before any agent starts, so it survives a spawn that fails.
+2. Every bound manager's own admin session is woken with a `public-relay` turn carrying the sender's message as fenced content. This is the carrier for anything the account needs to do about the visitor: translate, put a request to a registered counterparty, carry the answer back.
+3. The account's public agent answers the visitor, if the account has one and has enabled it. If not, the visitor receives nothing at all, and steps 1 and 2 have already happened regardless.
+
+**The scheduler fires a due event.** This raises a `schedule` turn on the destination's own session, carrying the event's prompt.
+
+**A passive account-manager binding receives a message.** This spawns a constrained one-shot that files a task and never replies. It cannot hold a conversation or answer against existing state.
+
+## Reading why you woke
+
+Every turn carries a `source`. Three values exist:
+
+| `source` | Meaning |
+|---|---|
+| `user` | A real person sent this message to the line. Also the value when the field is absent. |
+| `schedule` | The scheduler wrote this turn. The named destination did not send it. |
+| `public-relay` | The platform wrote this turn because a public visitor messaged the account. The named sender is a manager being told, not someone who wrote to you. |
+
+A `public-relay` turn also says so in its own first two lines. If a turn claims a manager wrote something they plainly would not have written, check the source before answering them.
+
+## Which files compose the prompt
+
+The system prompt is assembled per spawn from one agent directory, and **which directory depends on the role**:
+
+- A `role:'public'` spawn reads `agents/<the account's public-agent slug>/`.
+- Every other role reads `agents/admin/`.
+
+From that one directory it takes `IDENTITY.md` and `SOUL.md`, verbatim.
+
+The consequence catches people out: **an instruction written into `agents/admin/SOUL.md` is never read by a public spawn**, and an instruction written into a public agent's `SOUL.md` is never read by an admin turn. Before writing an instruction into a role file, decide which role will actually be running when it needs to apply. If the answer is "the admin agent, woken by a stranger's message", the file is `agents/admin/SOUL.md` and the trigger is the `public-relay` dispatch above.
+
+A public agent's directory also carries `KNOWLEDGE.md` and `config.json`. An account can hold as many public agents as it likes; only one is bound to WhatsApp at a time, and that binding is per account.
+
+## The switches, and what each one stops
+
+Four settings sit on this path. They are not interchangeable, and reaching for the wrong one is how an operator ends up silencing more than they meant.
+
+| Setting | What it stops | What it leaves running |
+|---|---|---|
+| `dmPolicy: disabled` | Public senders are refused at the gate. | Admin and manager inbound. |
+| `publicAgentEnabled: false` | The visitor gets no reply. | The manager notification and the relay. |
+| `managerNotifyEnabled: false` | The verbatim copy of the visitor's message. | The relay, and any reply the woken turn sends. |
+| `dispatchInbound: false` | Every agent turn on that account's socket. | Storage: messages are still stored and readable. |
+
+`managerNotifyEnabled` is the fine-grained one, and the one to reach for when the notifications are unwanted but the work is not. Unbinding a manager is not a substitute: the manager registry is shared by the notification, the relay and `whatsapp-notify-manager`, so unbinding silences all three.
+
+Read the current value with `whatsapp-config {action:'get-manager-notify-enabled'}` and set it with `set-manager-notify-enabled`. Both are scoped to the calling session's own account.
+
+## When the answer is not here
+
+`logs-read --tail server` and filter on the tags. One public inbound writes this chain, in order, with `account=` and `sender=` on each line:
+
+```
+[whatsapp:wire]         op=stanza
+[wa-notify]             op=eligible        reason=<how the sender was admitted>
+[whatsapp:route]        op=routed          agentType=public
+[whatsapp:notify]       op=public-inbound  enabled=0|1 outcome=sent|failed|no-recipients|disabled
+[whatsapp:relay]        op=dispatch        outcome=sent|failed|no-recipients
+[whatsapp:public-agent] op=route           enabled=… slug=… spawned=0|1
+[whatsapp:public-agent] op=spawn-ok | op=spawn-failed
+```
+
+Three standing audits reconcile that chain rather than waiting for someone to notice. `op=public-notify-reconcile` reports `gap`, `relayGap` and `englishGap`, each of which counts a step that a routed inbound reached and the next one did not. `op=spawn-census` reports attempts against successes. A non-zero gap, or attempts with no successes, is a fault even when nothing has been reported.

package/payload/platform/plugins/whatsapp/PLUGIN.md

@@ -82,8 +82,10 @@ Activate when the user asks about WhatsApp — connecting, linking, checking sta
 - Group observation — group messages are stored, persisted, and browsable, but the agent never responds in a group (observation-only)
 - DM policy enforcement (open, allowlist, disabled)
 - Conversation browsing — list active conversations, read message history, inspect group metadata
+- Inbound media surface — `extractMessage` ([`inbound/extract.ts`](../../ui/app/lib/whatsapp/inbound/extract.ts)) handles image, audio, video, document and sticker messages, giving the agent the caption where one exists and a synthetic `[document: <name>]` / `[sticker]` label where none does, so a media message never reaches the agent as an empty body
 - Inbound voice note transcription (OGG Opus → text via local whisper.cpp)
 - Outbound voice note normalization (OGG Opus via ffmpeg)
+- Inbound location sharing — a shared pin arrives as `[location: <name> — <address> — <lat>,<lon>]` and a live share as `[live location: <lat>,<lon>]`, on the same `extracted.text` field that carries a voice transcript, so an agent can read and relay a coordinate as text with no further platform work. A live share is enrolled for updates so the pin keeps moving rather than freezing at the first fix, and the operator's `/whatsapp` reader draws a map on the bubble. **There is no outbound location send:** the agent cannot put a pin into a chat, only text and documents. See [channels-whatsapp.md](references/channels-whatsapp.md)
 - Auto-reconnection with exponential backoff
 - Business hours gating — public messages gated by `OpeningHoursSpecification` from Neo4j, with optional after-hours auto-reply via the `afterHoursMessage` config field
 

package/payload/platform/plugins/whatsapp/mcp/dist/index.js

@@ -175,10 +175,12 @@ lifelineTool(server, "whatsapp-config", [
     "  - add-registered-party (register a known non-operator counterparty — a driver, a supplier, a contractor — on an account's own number; requires `phone`, `account` and `party`. Their messages to THAT account's number reach its PUBLIC agent carrying the label, and they are NOT granted admin. Use this, not add-account-manager, for anyone who is not an operator of the account)",
     "  - remove-registered-party (clear a phone's registered-party registration; requires `phone`)",
     "  - list-registered-parties (show phone → account and label)",
-    "  - set-public-agent (set the top-level public-agent slug for non-admin DMs; requires `slug`)",
-    "  - get-public-agent (show the resolved public-agent slug for DMs)",
-    "  - list-public-agents (slug and display name for each available public agent)",
-    "  - set-public-agent-enabled (turn public-agent answering on or off; requires boolean `enabled`. Pass `accountId` to set one account, omit it for the install-wide default. Refuses to enable when no public agent is configured for that scope, or when the configured slug has no agent on disk. OFF by default: while off, a public sender's message is stored and the account managers are notified, but the sender receives nothing)",
+    "  - set-public-agent (set the public-agent slug for non-admin DMs; requires `slug`. Scoped to your own account by default; a house admin may pass `accountId` to set another account's, or omit it to set the install-wide top-level default. The slug must name an agent that exists in THAT account's own agents directory.)",
+    "  - get-public-agent (show the resolved public-agent slug for DMs on this account. A sub-account resolves only its own agent — it never inherits the house's.)",
+    "  - list-public-agents (slug and display name for each agent THIS account can name as its public agent, from its own agents directory)",
+    "  - set-public-agent-enabled (turn public-agent answering on or off; requires boolean `enabled`. Scoped to your own account by default; a house admin may pass `accountId` for another, or omit it for the install-wide top-level default. Refuses to enable when no public agent is configured for that scope, or when the configured slug has no agent on disk. OFF by default: while off, a public sender's message is stored and the account managers are notified, but the sender receives nothing)",
+    "  - set-manager-notify-enabled (turn the raw public-inbound notification on or off for this account; requires boolean `enabled`. ON by default. While on, every message from a public sender is forwarded verbatim to the account's registered managers. Turning it off stops that copy and leaves the admin relay, and the translated reply that relay produces, untouched — so a manager who wants the summary but not the raw firehose says so here rather than by unbinding themselves. Scoped to your own account; a house admin may pass `accountId` for another, or omit it for the install-wide top-level default.)",
+    "  - get-manager-notify-enabled (read whether the raw public-inbound notification fires for this account, and whether that value is the account's own or the default)",
     "  - update-config (change any WhatsApp config field — pass `fields` as a JSON string of field/value pairs)",
     "  - get-config (return the full current WhatsApp config object)",
     "  - set-dispatch-inbound (turn a paired socket into an OBSERVE socket or back; requires `accountId` and boolean `dispatchInbound`. false = the account's WhatsApp is read-only: messages are stored and readable but never dispatched to an agent. Scoped to your own account.)",
@@ -187,7 +189,7 @@ lifelineTool(server, "whatsapp-config", [
     "  - schema (return all config field definitions — names, types, defaults, descriptions, constraints)",
     "  - list-groups (return WhatsApp groups the account belongs to — names, JIDs, participant counts)",
     "Groups are observation-only — the agent never responds in a group, so there is no per-group config. list-groups still lists them for reference.",
-    "Public-agent precedence at routing time (DMs): per-account default → top-level default.",
+    "Public-agent resolution at routing time (DMs): an account answers with the agent named in its OWN config, from its OWN agents directory. There is no inheritance — a sub-account that names no agent of its own answers nobody. The top-level publicAgent is the HOUSE's own value, not a default for everyone.",
     "A phone may be a house admin AND a sub-account manager at the same time — both registrations are accepted, and the number the sender messaged decides which scope they get: the house number gives house scope, the sub-account's own number gives that sub-account's scope. A manager bound to a sub-account with no number of its own is reached through the house number. A manager phone is not reachable by whatsapp-send-admin (message it directly instead).",
     "Three inbound sender classes exist: an OPERATOR (an admin phone or an account manager — admin session), a REGISTERED PARTY (a known counterparty — public session carrying its label), and an unknown visitor (whatever the DM policy allows). A registered party is never granted admin, and the registration applies only on the registered account's own number: on the house number they take the house DM policy like anyone else. A phone cannot hold a party registration and an admin or manager registration at the same time — either write is refused with reason 'party-registration-shadowed', because the operator arms are checked first and the party registration would never be reached.",
     "Phone numbers must be E.164 format (e.g. +441234567890).",
@@ -206,6 +208,8 @@ lifelineTool(server, "whatsapp-config", [
         "get-public-agent",
         "list-public-agents",
         "set-public-agent-enabled",
+        "set-manager-notify-enabled",
+        "get-manager-notify-enabled",
         "update-config",
         "get-config",
         "set-dispatch-inbound",
@@ -220,9 +224,9 @@ lifelineTool(server, "whatsapp-config", [
     account: z.string().optional().describe("Account UUID whose own number this phone is a known counterparty on (required for add-registered-party). Their messages to THAT account's number reach its public agent; on the house number they take the house DM policy instead."),
     party: z.string().optional().describe("Label for this counterparty (required for add-registered-party), e.g. 'driver'. Lowercase letters, digits and hyphens, 1-64 characters. The platform carries it to the session and never interprets it; the account's own skill decides what it means."),
     slug: z.string().optional().describe("Agent slug (required for set-public-agent)"),
-    enabled: z.boolean().optional().describe("On/off value (required for set-public-agent-enabled). true = public senders are answered by the resolved public agent; false = they receive nothing."),
+    enabled: z.boolean().optional().describe("On/off value (required for set-public-agent-enabled and set-manager-notify-enabled). For set-public-agent-enabled: true = public senders are answered by the resolved public agent; false = they receive nothing. For set-manager-notify-enabled: true = every public inbound is forwarded verbatim to the account's managers; false = it is not, and the admin relay is unaffected."),
     fields: z.string().optional().describe('JSON string of config fields to update (required for update-config, e.g. \'{"dmPolicy":"open","allowFrom":["*"]}\')'),
-    accountId: z.string().optional().describe('Account ID. Defaults to the calling session’s own account; the house admin may pass another account id explicitly. Used by list-groups, set-dispatch-inbound, set-account-policy and get-account-policy.'),
+    accountId: z.string().optional().describe('Account ID. Defaults to the calling session’s own account; the house admin may pass another account id explicitly. Used by list-groups, set-dispatch-inbound, set-account-policy, get-account-policy, set-public-agent, get-public-agent, set-public-agent-enabled, list-public-agents, set-manager-notify-enabled and get-manager-notify-enabled.'),
     dispatchInbound: z.boolean().optional().describe("For set-dispatch-inbound: false makes the account an observe socket (stored + readable, never dispatched); true restores agent dispatch."),
     policy: z.object({
         dmPolicy: z.enum(["open", "allowlist", "disabled"]).optional(),
@@ -295,6 +299,17 @@ lifelineTool(server, "whatsapp-config", [
             const sourceLabel = source ? ` (source: ${source})` : "";
             return textResult(`WhatsApp public agent: ${agentSlug}${sourceLabel}`);
         }
+        // Task 2277 — its own formatter. The tail fallback renders `result.message`,
+        // which this read does not carry, so without this the agent would be told
+        // "Done." and learn nothing about the value it asked for.
+        if (action === "get-manager-notify-enabled") {
+            const on = result.enabled === true;
+            const source = result.source;
+            const sourceLabel = source === "default" ? " (the default; this account has set no value of its own)" : ` (source: ${source})`;
+            return textResult(on
+                ? `Raw public-inbound notification is ON${sourceLabel}. Every message from a public sender is forwarded verbatim to this account's managers.`
+                : `Raw public-inbound notification is OFF${sourceLabel}. Public senders' messages are not forwarded verbatim; the admin relay and its reply are unaffected.`);
+        }
         if (action === "list-public-agents") {
             const agents = result.agents ?? [];
             if (agents.length === 0)