@rubytech/create-maxy-code 0.1.549 → 0.1.551

package/payload/server/server.js

@@ -1836,10 +1836,10 @@ var require_dist6 = __commonJS({
 });
 
 // server/index.ts
-import { readFileSync as readFileSync47, existsSync as existsSync51, watchFile, readdirSync as readdirSync30, statSync as statSync27 } from "fs";
+import { readFileSync as readFileSync48, existsSync as existsSync52, watchFile, readdirSync as readdirSync30, statSync as statSync27 } from "fs";
 import { spawn as spawn3 } from "child_process";
 import { createHash as createHash7 } from "crypto";
-import { resolve as resolve45, join as join55, basename as basename18 } from "path";
+import { resolve as resolve45, join as join56, basename as basename18 } from "path";
 import { homedir as homedir4 } from "os";
 
 // server/lib/route-cache-watchers.ts
@@ -3847,11 +3847,22 @@ ${result.result.text}` : result.result.text;
 import { statSync as statSync5 } from "fs";
 import { join as join10 } from "path";
 
+// app/lib/telegram/channel-key.ts
+function telegramChannelKey(botId, senderId) {
+  return `${botId}:${senderId}`;
+}
+function parseTelegramChannelKey(key) {
+  const i = key.indexOf(":");
+  if (i <= 0 || i === key.length - 1) return null;
+  return { botId: key.slice(0, i), senderId: key.slice(i + 1) };
+}
+
 // app/lib/channel-pty-bridge/admin-session-id.ts
 import { createHash } from "crypto";
-function adminSessionIdFor(accountId, senderId, personId) {
+function adminSessionIdFor(accountId, senderId, personId, botId) {
   const subject = personId && personId.length > 0 ? `person:${personId}` : senderId;
-  const b = createHash("sha256").update(`${accountId}:admin:${subject}`).digest().subarray(0, 16);
+  const scope = botId && botId.length > 0 ? `admin:${botId}` : "admin";
+  const b = createHash("sha256").update(`${accountId}:${scope}:${subject}`).digest().subarray(0, 16);
   const v = Buffer.from(b);
   v[6] = v[6] & 15 | 64;
   v[8] = v[8] & 63 | 128;
@@ -4598,7 +4609,8 @@ async function computeSessionList(scopeAccountId) {
       continue;
     }
     const metaPath = join9(projectDir, `${sessionId}.meta.json`);
-    const { bridgeIds, role, channel: sidecarChannel, senderId, personId, adminUserId, accountId: rowAccountId } = await readSidecarMetaAsync(metaPath);
+    const { bridgeIds, role, channel: sidecarChannel, senderId: rawSenderId, personId, adminUserId, accountId: rowAccountId } = await readSidecarMetaAsync(metaPath);
+    const senderId = sidecarChannel === "telegram" ? parseTelegramChannelKey(rawSenderId ?? "")?.senderId ?? rawSenderId : rawSenderId;
     if (multiAccount) {
       if (rowAccountId === null) untaggedCount += 1;
       if (rowAccountId !== scopeAccountId) continue;
@@ -4872,19 +4884,15 @@ function createScheduleInjectRoutes(deps) {
       console.error(`${TAG5} op=telegram-destination-ambiguous eventId=${eventId} destination=${destination} accounts=${resolution.count} dispatched=no`);
       return c.json({ ok: false, error: "telegram-destination-ambiguous" }, 403);
     }
-    const effectiveAccount = resolution.accountId;
-    console.error(`${TAG5} op=effective-account eventId=${eventId} effectiveAccount=${effectiveAccount}`);
+    const { accountId: effectiveAccount, botId, botToken } = resolution;
+    console.error(`${TAG5} op=effective-account eventId=${eventId} effectiveAccount=${effectiveAccount} botId=${botId}`);
     if (eventAccountId === null || eventAccountId !== effectiveAccount) {
       console.error(`${TAG5} op=event-account-scope-mismatch eventId=${eventId} eventAccount=${eventAccountId ?? "-"} effectiveAccount=${effectiveAccount} destination=${destination} dispatched=no`);
       return c.json({ ok: false, error: "event-account-scope-mismatch" }, 403);
     }
-    const botToken = resolution.botToken;
-    if (!botToken) {
-      console.error(`${TAG5} reject reason=no-admin-bot-token eventId=${eventId} accountId=${effectiveAccount}`);
-      return c.json({ ok: false, error: "no-admin-bot-token" }, 400);
-    }
     const chatId = Number(destination);
-    const sessionId = deps.resolveSessionOverride?.(effectiveAccount, "telegram", destination) ?? adminSessionIdFor(effectiveAccount, destination);
+    const channelKey = telegramChannelKey(botId, destination);
+    const sessionId = deps.resolveSessionOverride?.(effectiveAccount, "telegram", channelKey) ?? adminSessionIdFor(effectiveAccount, destination, void 0, botId);
     const reply = (text) => deps.sendTelegramText(botToken, chatId, text);
     try {
       await deps.tgHandleInbound({
@@ -4893,6 +4901,14 @@ function createScheduleInjectRoutes(deps) {
         // session scope are one account and Telegram needs no
         // effectiveAccountId companion field the way WhatsApp does above.
         accountId: effectiveAccount,
+        // A scheduled dispatch is always role:'admin', and the admin branch of
+        // the spawn never reads the account dir (only the public branch
+        // re-checks its paired agent against it), so there is nothing to
+        // resolve here.
+        accountDir: "",
+        botId,
+        botToken,
+        agentSlug: "admin",
         senderId: destination,
         chatId: destination,
         role: "admin",
@@ -12907,6 +12923,44 @@ import { homedir as homedir2 } from "os";
 import { resolve as resolve17, join as join29 } from "path";
 import { existsSync as existsSync21, readFileSync as readFileSync23 } from "fs";
 
+// app/lib/telegram/bot-registry.ts
+function botIdFromToken(token) {
+  const i = token.indexOf(":");
+  if (i <= 0) return null;
+  const id = token.slice(0, i);
+  return /^\d+$/.test(id) ? id : null;
+}
+function listBotEntries(config) {
+  const raw = config?.bots;
+  if (!Array.isArray(raw)) return [];
+  const out = [];
+  for (const e of raw) {
+    if (!e || typeof e !== "object") continue;
+    const { id, token, role } = e;
+    if (typeof id !== "string" || id.length === 0) continue;
+    if (typeof token !== "string" || token.length === 0) continue;
+    if (role === "admin") {
+      out.push(e);
+    } else if (role === "public") {
+      const agent = e.agent;
+      if (typeof agent !== "string" || agent.length === 0) continue;
+      out.push(e);
+    }
+  }
+  return out;
+}
+function resolveBotEntry(accounts, botId) {
+  const hits = [];
+  for (const a of accounts) {
+    for (const entry of listBotEntries(a.config.telegram)) {
+      if (entry.id === botId) hits.push({ accountId: a.accountId, accountDir: a.accountDir, entry });
+    }
+  }
+  if (hits.length === 0) return { kind: "none" };
+  if (hits.length > 1) return { kind: "duplicate", count: hits.length };
+  return { kind: "one", ...hits[0] };
+}
+
 // app/lib/telegram/gateway/instance.ts
 var instance = null;
 function setTelegramGateway(gw) {
@@ -12918,20 +12972,20 @@ function getTelegramGateway() {
 
 // app/lib/telegram/access-control.ts
 function checkTelegramAccess(params) {
-  const { senderId, botType, config } = params;
-  if (botType === "admin") {
-    const adminUsers = config.adminUsers ?? [];
+  const { senderId, entry } = params;
+  if (entry.role === "admin") {
+    const adminUsers = entry.adminUsers ?? [];
     if (adminUsers.includes(senderId)) {
       return { allowed: true, reason: "admin-binding", agentType: "admin" };
     }
     return { allowed: false, reason: "not-admin-user", agentType: "admin" };
   }
-  const policy = config.dmPolicy ?? "disabled";
+  const policy = entry.dmPolicy ?? "disabled";
   switch (policy) {
     case "open":
       return { allowed: true, reason: "dm-policy-open", agentType: "public" };
     case "allowlist": {
-      const allowFrom = config.allowFrom ?? [];
+      const allowFrom = entry.allowFrom ?? [];
       if (allowFrom.includes(senderId)) {
         return { allowed: true, reason: "allowlist-match", agentType: "public" };
       }
@@ -12953,11 +13007,11 @@ function routeTelegramUpdate(input) {
   if (typeof m.text !== "string" || m.text.length === 0) {
     return { kind: "ignore", reason: "no-text" };
   }
-  const access = checkTelegramAccess({ senderId: m.from.id, botType: input.botType, config: input.config });
+  const access = checkTelegramAccess({ senderId: m.from.id, entry: input.entry });
   if (!access.allowed) {
     return { kind: "denied", reason: access.reason, agentType: access.agentType };
   }
-  return { kind: "dispatch", senderId: String(m.from.id), chatId: m.chat.id, text: m.text, agentType: access.agentType };
+  return { kind: "dispatch", senderId: String(m.from.id), chatId: m.chat.id, text: m.text, agentType: access.agentType, reason: access.reason };
 }
 
 // server/routes/telegram.ts
@@ -12973,81 +13027,85 @@ function configDirName() {
   }
   return ".maxy";
 }
-function secretPath(botType, accountId) {
-  const stem = botType === "admin" ? ".telegram-admin-webhook-secret" : ".telegram-webhook-secret";
-  return resolve17(homedir2(), configDirName(), `${stem}.${accountId}`);
+function telegramSecretsDir() {
+  return resolve17(homedir2(), configDirName(), "telegram-secrets");
+}
+function secretPath(botId) {
+  return resolve17(telegramSecretsDir(), botId);
 }
 var app10 = new Hono();
 app10.post("/", async (c) => {
-  const botParam = c.req.query("bot");
-  const botType = botParam === "admin" ? "admin" : botParam === "public" ? "public" : null;
-  if (!botType) {
+  const botId = c.req.query("bot");
+  if (!botId) {
     console.error(`${TAG19} op=reject reason=missing-bot-param`);
     return c.json({ ok: false }, 400);
   }
-  const accountParam = c.req.query("account");
-  if (!accountParam) {
-    console.error(`${TAG19} op=reject reason=missing-account-param botType=${botType}`);
+  console.error(`${TAG19} op=received botId=${botId} path=/api/telegram/`);
+  const resolved = resolveBotEntry(listValidAccounts(), botId);
+  if (resolved.kind === "none") {
+    console.error(`${TAG19} op=reject reason=unknown-bot botId=${botId}`);
     return c.json({ ok: false }, 401);
   }
-  const account = listValidAccounts().find((a) => a.accountId === accountParam) ?? null;
-  if (!account) {
-    console.error(`${TAG19} op=reject reason=bad-account botType=${botType}`);
+  if (resolved.kind === "duplicate") {
+    console.error(`${TAG19} op=reject reason=duplicate-bot-id botId=${botId} accounts=${resolved.count}`);
     return c.json({ ok: false }, 401);
   }
-  const sp = secretPath(botType, account.accountId);
+  const { accountId, accountDir, entry } = resolved;
+  const agentSlug = entry.role === "admin" ? "admin" : entry.agent;
+  console.error(`${TAG19} op=entry botId=${botId} accountId=${accountId} role=${entry.role} agent=${agentSlug}`);
+  const sp = secretPath(botId);
   if (!existsSync21(sp)) {
-    console.error(`${TAG19} op=reject reason=no-secret-file botType=${botType} accountId=${account.accountId}`);
+    console.error(`${TAG19} op=secret botId=${botId} result=missing-file`);
     return c.json({ ok: false }, 401);
   }
   const expected = readFileSync23(sp, "utf-8").trim();
   const got = c.req.header("x-telegram-bot-api-secret-token") ?? "";
   if (got !== expected) {
-    console.error(`${TAG19} op=reject reason=bad-secret botType=${botType} accountId=${account.accountId}`);
+    console.error(`${TAG19} op=secret botId=${botId} result=mismatch`);
     return c.json({ ok: false }, 401);
   }
+  console.error(`${TAG19} op=secret botId=${botId} result=ok`);
   let update;
   try {
     update = await c.req.json();
   } catch {
     return c.json({ ok: true }, 200);
   }
-  const decision = routeTelegramUpdate({ update, botType, config: account.config.telegram ?? {} });
+  const decision = routeTelegramUpdate({ update, entry });
   if (decision.kind === "ignore") {
-    console.error(`${TAG19} op=ignore reason=${decision.reason}`);
+    console.error(`${TAG19} op=ignore botId=${botId} reason=${decision.reason}`);
     return c.json({ ok: true }, 200);
   }
   if (decision.kind === "denied") {
-    console.error(`${TAG19} op=denied reason=${decision.reason} agentType=${decision.agentType}`);
+    console.error(`${TAG19} op=access botId=${botId} senderId=- allowed=false reason=${decision.reason}`);
     return c.json({ ok: true }, 200);
   }
-  const role = decision.agentType === "admin" ? "admin" : "public";
-  const agentSlug = role === "admin" ? "admin" : resolveDefaultAgentSlug(account.accountDir);
-  if (!agentSlug) {
-    console.error(`${TAG19} op=reject reason=no-default-agent`);
+  const { senderId, chatId, text } = decision;
+  console.error(`${TAG19} op=access botId=${botId} senderId=${senderId} allowed=true reason=${decision.reason}`);
+  const active = entry.role === "admin" ? true : isActiveAgentSlug(accountDir, entry.agent);
+  console.error(`${TAG19} op=agent botId=${botId} slug=${agentSlug} active=${active}`);
+  if (!active) {
+    console.error(`${TAG19} op=reject reason=agent-inactive botId=${botId} agent=${agentSlug}`);
     return c.json({ ok: true }, 200);
   }
-  console.error(`${TAG19} op=update accountId=${account.accountId} from=${decision.senderId}`);
-  const botToken = botType === "admin" ? account.config.telegram?.adminBotToken : account.config.telegram?.publicBotToken;
-  const { senderId, chatId, text } = decision;
   const gateway = getTelegramGateway();
   if (!gateway) {
-    console.error(`${TAG19} op=reject reason=gateway-not-ready from=${senderId}`);
+    console.error(`${TAG19} op=reply-dropped botId=${botId} reason=gateway-not-ready`);
     return c.json({ ok: true }, 200);
   }
   const reply = async (replyText) => {
-    if (!botToken) {
-      const reason = account.config.telegram ? "no-bot-token" : "no-telegram-config";
-      console.error(`${TAG19} op=reply-dropped reason=${reason} botType=${botType} from=${senderId}`);
-      return;
-    }
-    const sent = await sendTelegramText(botToken, chatId, replyText);
-    console.error(`${TAG19} op=reply-sent from=${senderId} ok=${sent.ok}${sent.ok ? "" : ` error=${sent.error}`}`);
+    const sent = await sendTelegramText(entry.token, chatId, replyText);
+    if (sent.ok) console.error(`${TAG19} op=reply-sent botId=${botId} ok=true`);
+    else console.error(`${TAG19} op=reply-dropped botId=${botId} reason=${sent.error}`);
   };
   void gateway.handleInbound({
-    accountId: account.accountId,
+    accountId,
+    accountDir,
+    botId,
+    botToken: entry.token,
+    agentSlug,
     senderId,
-    role,
+    role: entry.role,
     personId: null,
     chatId: String(chatId),
     text,
@@ -16927,18 +16985,18 @@ var ALLOWED_EVENTS = /* @__PURE__ */ new Set([
 ]);
 var app24 = new Hono();
 app24.post("/", async (c) => {
-  const TAG53 = "[admin:events]";
+  const TAG54 = "[admin:events]";
   let body;
   try {
     body = await c.req.json();
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG53} reject reason=body-not-json detail=${detail}`);
+    console.error(`${TAG54} reject reason=body-not-json detail=${detail}`);
     return c.json({ ok: false, detail: "Request body was not valid JSON" }, 400);
   }
   const event = typeof body.event === "string" ? body.event : "";
   if (!ALLOWED_EVENTS.has(event)) {
-    console.error(`${TAG53} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
+    console.error(`${TAG54} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
     return c.json({ ok: false, detail: `Event "${event}" is not allowed` }, 400);
   }
   const rawFields = body.fields && typeof body.fields === "object" ? body.fields : {};
@@ -22405,6 +22463,7 @@ async function managerSpawn(opts) {
       name: opts.name,
       webchatChannel: opts.webchatChannel,
       waChannel: opts.waChannel,
+      telegramChannel: opts.telegramChannel,
       sessionId: opts.sessionId,
       previousContext: opts.previousContext,
       initialMessage: opts.initialMessage,
@@ -22448,6 +22507,7 @@ async function managerRcSpawn(opts) {
       adminUserId: opts.adminUserId,
       waChannel: opts.waChannel,
       webchatChannel: opts.webchatChannel,
+      telegramChannel: opts.telegramChannel,
       role: opts.role,
       channel: opts.channel,
       senderId: opts.senderId,
@@ -23934,8 +23994,24 @@ function readChannelAdmins(accountDir, channel) {
     return { adminPhones, accountManagers };
   }
   const tg = config.telegram ?? {};
-  const adminUsers = Array.isArray(tg.adminUsers) ? tg.adminUsers.filter((u) => typeof u === "number") : [];
-  return { adminUsers };
+  const byBot = [];
+  const seen = /* @__PURE__ */ new Set();
+  const adminUsers = [];
+  if (Array.isArray(tg.bots)) {
+    for (const raw of tg.bots) {
+      if (!raw || typeof raw !== "object") continue;
+      const b = raw;
+      if (b.role !== "admin" || typeof b.id !== "string" || b.id.length === 0) continue;
+      const users = Array.isArray(b.adminUsers) ? b.adminUsers.filter((u) => typeof u === "number") : [];
+      byBot.push({ botId: b.id, adminUsers: users });
+      for (const u of users) {
+        if (seen.has(u)) continue;
+        seen.add(u);
+        adminUsers.push(u);
+      }
+    }
+  }
+  return { adminUsers, byBot };
 }
 function registeredAccountForDestination(houseDir, houseAccountId, destination) {
   const { adminPhones, accountManagers } = readChannelAdmins(houseDir, "whatsapp");
@@ -23994,8 +24070,13 @@ function listDispatchDestinations(input) {
       admins.push({ channel: "whatsapp", destination: phone, label: "House admin" });
     }
   }
-  const { adminUsers } = readChannelAdmins(resolve31(accountsDir, accountId), "telegram");
-  const telegram = [...adminUsers].sort((a, b) => a - b).map((id) => ({ channel: "telegram", destination: String(id), label: "Telegram admin" }));
+  const { byBot } = readChannelAdmins(resolve31(accountsDir, accountId), "telegram");
+  const telegram = byBot.flatMap((b) => b.adminUsers.map((id) => ({ botId: b.botId, id }))).sort((a, b) => a.id - b.id || a.botId.localeCompare(b.botId)).map(({ botId, id }) => ({
+    channel: "telegram",
+    destination: String(id),
+    label: "Telegram admin",
+    botId
+  }));
   const byDestination = (a, b) => a.destination.localeCompare(b.destination);
   return [...managers.sort(byDestination), ...admins.sort(byDestination), ...telegram];
 }
@@ -31102,19 +31183,22 @@ var TelegramGateway = class {
    * its own `sessionIdFor`.
    */
   sessionIdFor(input) {
-    return (input.role === "admin" ? this.deps.resolveSessionOverride?.(input.accountId, input.senderId) : null) || adminSessionIdFor(
+    const key = telegramChannelKey(input.botId, input.senderId);
+    return (input.role === "admin" ? this.deps.resolveSessionOverride?.(input.accountId, key) : null) || adminSessionIdFor(
       input.accountId,
       input.senderId,
-      input.role === "public" && input.personId ? input.personId : void 0
+      input.role === "public" && input.personId ? input.personId : void 0,
+      input.botId
     );
   }
   /** Handle one inbound telegram message. */
   async handleInbound(input) {
     const bytes = Buffer.byteLength(input.text, "utf8");
-    const hadSubscriber = this.hub.hasSubscriber(input.senderId);
-    const willDeliverNow = this.hub.isReady(input.senderId);
+    const key = telegramChannelKey(input.botId, input.senderId);
+    const hadSubscriber = this.hub.hasSubscriber(key);
+    const willDeliverNow = this.hub.isReady(key);
     const source = input.source ?? "user";
-    this.replies.set(input.senderId, input.reply);
+    this.replies.set(key, input.reply);
     let standingRules;
     if (input.role === "admin" && this.deps.fetchStandingRules) {
       const res = await this.deps.fetchStandingRules(input.accountId);
@@ -31126,19 +31210,24 @@ var TelegramGateway = class {
       );
     }
     this.hub.deliver(
-      { key: input.senderId, text: input.text, messageId: `tg-${++this.seq}`, source, standingRules, scheduleProvenance: input.scheduleProvenance },
+      { key, text: input.text, messageId: `tg-${++this.seq}`, source, standingRules, scheduleProvenance: input.scheduleProvenance },
       Date.now()
     );
     const resolvedSessionId = this.sessionIdFor(input);
     console.error(
-      `[telegram-native] op=inbound key=${input.senderId} accountId=${input.accountId} botType=${input.role} bytes=${bytes} source=${source} delivery=${willDeliverNow ? "immediate" : "queued"} sessionId=${resolvedSessionId}`
+      `[telegram-native] op=inbound key=${key} botId=${input.botId} accountId=${input.accountId} role=${input.role} agent=${input.agentSlug} bytes=${bytes} source=${source} delivery=${willDeliverNow ? "immediate" : "queued"} sessionId=${resolvedSessionId}`
     );
-    if (!hadSubscriber && !this.spawning.has(input.senderId)) {
-      this.spawning.add(input.senderId);
-      console.error(`[telegram-native] op=spawn-trigger key=${input.senderId} role=${input.role}`);
+    if (!hadSubscriber && !this.spawning.has(key)) {
+      this.spawning.add(key);
+      console.error(`[telegram-native] op=spawn-trigger key=${key} botId=${input.botId} role=${input.role}`);
       try {
         await this.deps.ensureChannelSession({
           accountId: input.accountId,
+          accountDir: input.accountDir,
+          botId: input.botId,
+          botToken: input.botToken,
+          agentSlug: input.agentSlug,
+          channelKey: key,
           senderId: input.senderId,
           role: input.role,
           personId: input.personId ?? null,
@@ -31147,7 +31236,7 @@ var TelegramGateway = class {
           serverPath: this.deps.serverPath
         });
       } finally {
-        this.spawning.delete(input.senderId);
+        this.spawning.delete(key);
       }
     }
   }
@@ -31161,12 +31250,17 @@ var TelegramGateway = class {
 // app/lib/telegram/gateway/spawn-request.ts
 function buildTelegramSpawnRequest(input) {
   const personId = input.role === "public" && input.personId ? input.personId : void 0;
+  const channelKey = telegramChannelKey(input.botId, input.senderId);
   return {
     // Task 1746 / 1789 — the deterministic per-sender id is the DEFAULT; an
     // operator re-seat sets a stable per-sender forward pointer that wins here.
     // Mirror of the WhatsApp builder; see its comment for the full distinction
     // between this pointer and Task 1526's removed per-firing seat.
-    sessionId: input.overrideSessionId || adminSessionIdFor(input.accountId, input.senderId, personId),
+    // Task 2368 — the bot id is a hash component of its own, not part of the
+    // subject: with a resolved personId the subject is `person:<personId>` and
+    // the sender never enters the hash at all.
+    sessionId: input.overrideSessionId || adminSessionIdFor(input.accountId, input.senderId, personId, input.botId),
+    channelKey,
     role: input.role,
     channel: "telegram",
     personId,
@@ -31176,8 +31270,78 @@ function buildTelegramSpawnRequest(input) {
     // session resolve under that account, not the manager's boot-time house
     // default. Mirror of the WhatsApp builder.
     targetAccountId: input.accountId,
-    telegramChannel: { senderId: input.senderId, gatewayUrl: input.gatewayUrl, serverPath: input.serverPath },
-    logContext: `channel=telegram-native role=${input.role} senderId=${input.senderId}`
+    telegramChannel: { senderId: channelKey, gatewayUrl: input.gatewayUrl, serverPath: input.serverPath },
+    logContext: `channel=telegram-native role=${input.role} botId=${input.botId} senderId=${input.senderId}`
+  };
+}
+
+// server/telegram-ensure-session.ts
+var TAG50 = "[telegram-inbound]";
+function buildTelegramEnsureSession(deps) {
+  return async (input) => {
+    const req = buildTelegramSpawnRequest({
+      accountId: input.accountId,
+      senderId: input.senderId,
+      role: input.role,
+      personId: input.personId,
+      gatewayUrl: input.gatewayUrl,
+      serverPath: input.serverPath,
+      botId: input.botId,
+      // Task 1789 — admin rows only; see the WhatsApp twin.
+      overrideSessionId: input.role === "admin" ? deps.resolveSessionOverride(input.accountId, input.channelKey) : null
+    });
+    if (input.role === "public") {
+      const result2 = await deps.managerSpawn({
+        senderId: req.channelKey,
+        role: "public",
+        channel: "telegram",
+        accountId: input.accountId,
+        targetAccountId: input.accountId,
+        // The slug came from THIS account's own bot entry, so the spawn reads
+        // that account's agents directory, runs in its directory and files its
+        // session under it. Mirror of the WhatsApp public-agent path.
+        agentAccountId: input.accountId,
+        agentSlug: input.agentSlug,
+        sessionId: req.sessionId,
+        personId: input.personId ?? void 0,
+        telegramChannel: req.telegramChannel
+      });
+      if ("error" in result2) {
+        console.error(
+          `[telegram-native] op=spawn-failed botId=${input.botId} key=${req.channelKey} role=public agent=${input.agentSlug} error=${result2.error} status=${result2.status}`
+        );
+        return;
+      }
+      console.error(
+        `${TAG50} op=spawn botId=${input.botId} sessionId=${result2.sessionId} targetAccountId=${input.accountId} role=public`
+      );
+      return;
+    }
+    const result = await deps.managerRcSpawn(req);
+    if ("error" in result) {
+      console.error(
+        `[telegram-native] op=spawn-failed botId=${input.botId} key=${req.channelKey} role=admin error=${result.error} status=${result.status}`
+      );
+      return;
+    }
+    console.error(
+      `${TAG50} op=spawn botId=${input.botId} sessionId=${req.sessionId} targetAccountId=${input.accountId} role=admin`
+    );
+    deps.followers.get(req.channelKey)?.abort();
+    let ac;
+    ac = deps.startFileFollower({
+      sessionId: req.sessionId,
+      senderId: req.channelKey,
+      accountId: input.accountId,
+      chatId: input.chatId,
+      botToken: input.botToken,
+      // Identity-guarded eviction: only delete if this controller is still the
+      // current one, so a stale self-close never removes a live follower.
+      onClose: () => {
+        if (deps.followers.get(req.channelKey) === ac) deps.followers.delete(req.channelKey);
+      }
+    });
+    deps.followers.set(req.channelKey, ac);
   };
 }
 
@@ -31185,7 +31349,7 @@ function buildTelegramSpawnRequest(input) {
 import { realpathSync as realpathSync10 } from "fs";
 import { readFile as readFile14, stat as stat10 } from "fs/promises";
 import { resolve as resolve42, basename as basename16 } from "path";
-var TAG50 = "[telegram:outbound]";
+var TAG51 = "[telegram:outbound]";
 var TELEGRAM_DOCUMENT_MAX_BYTES = 50 * 1024 * 1024;
 async function sendTelegramDocument(input) {
   const { botToken, chatId, filePath, caption, maxyAccountId, platformRoot: platformRoot5 } = input;
@@ -31202,10 +31366,10 @@ async function sendTelegramDocument(input) {
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
-      console.error(`${TAG50} document ENOENT scope=account-dir accountDir=${accountDir} maxyAccountId=${maxyAccountId}`);
+      console.error(`${TAG51} document ENOENT scope=account-dir accountDir=${accountDir} maxyAccountId=${maxyAccountId}`);
       return { ok: false, status: 500, error: `Account directory not resolvable for ${maxyAccountId}` };
     }
-    console.error(`${TAG50} document path error scope=account-dir maxyAccountId=${maxyAccountId}: ${String(err)}`);
+    console.error(`${TAG51} document path error scope=account-dir maxyAccountId=${maxyAccountId}: ${String(err)}`);
     return { ok: false, status: 500, error: String(err) };
   }
   let resolvedPath;
@@ -31214,14 +31378,14 @@ async function sendTelegramDocument(input) {
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
-      console.error(`${TAG50} document ENOENT scope=file path=${filePath} maxyAccountId=${maxyAccountId}`);
+      console.error(`${TAG51} document ENOENT scope=file path=${filePath} maxyAccountId=${maxyAccountId}`);
       return { ok: false, status: 404, error: `File not found: ${filePath}` };
     }
-    console.error(`${TAG50} document path error scope=file maxyAccountId=${maxyAccountId}: ${String(err)}`);
+    console.error(`${TAG51} document path error scope=file maxyAccountId=${maxyAccountId}: ${String(err)}`);
     return { ok: false, status: 500, error: String(err) };
   }
   if (!resolvedPath.startsWith(accountResolved + "/")) {
-    console.error(`${TAG50} document REJECTED reason=outside_account_directory maxyAccountId=${maxyAccountId}`);
+    console.error(`${TAG51} document REJECTED reason=outside_account_directory maxyAccountId=${maxyAccountId}`);
     return { ok: false, status: 403, error: "Access denied: file is outside the account directory" };
   }
   const fileStat = await stat10(resolvedPath);
@@ -31254,29 +31418,24 @@ async function sendTelegramDocument(input) {
     error = e instanceof Error ? e.message : String(e);
   }
   console.error(
-    `${TAG50} sent document to=${chatId} file=${filename} bytes=${fileStat.size} ok=${ok2}` + (messageId !== void 0 ? ` id=${messageId}` : "")
+    `${TAG51} sent document to=${chatId} file=${filename} bytes=${fileStat.size} ok=${ok2}` + (messageId !== void 0 ? ` id=${messageId}` : "")
   );
   return ok2 ? { ok: true, messageId } : { ok: false, status: 500, error };
 }
 
 // app/lib/telegram/outbound/file-delivery.ts
-var TAG51 = "[telegram:outbound]";
+var TAG52 = "[telegram:outbound]";
 function platformRoot4() {
   return process.env.MAXY_PLATFORM_ROOT || "";
 }
-function makeTelegramSendFile(entry) {
-  let botToken;
+function makeTelegramSendFile(entry, botToken) {
   return async (filePath, caption) => {
-    if (botToken === void 0) {
-      const tg = resolveAccount()?.config.telegram;
-      botToken = (entry.role === "admin" ? tg?.adminBotToken : tg?.publicBotToken) ?? null;
-    }
     if (!botToken) {
-      console.error(`${TAG51} file-delivery reject reason=no-bot-token sender=${entry.senderId} role=${entry.role}`);
+      console.error(`${TAG52} file-delivery reject reason=no-bot-token sender=${entry.senderId} role=${entry.role}`);
       return { ok: false, error: "no-bot-token" };
     }
     if (entry.replyTarget == null) {
-      console.error(`${TAG51} file-delivery reject reason=no-reply-target sender=${entry.senderId} role=${entry.role}`);
+      console.error(`${TAG52} file-delivery reject reason=no-reply-target sender=${entry.senderId} role=${entry.role}`);
       return { ok: false, error: "no-reply-target" };
     }
     const result = await sendTelegramDocument({
@@ -31290,12 +31449,12 @@ function makeTelegramSendFile(entry) {
     return result.ok ? { ok: true } : { ok: false, error: result.error };
   };
 }
-function makeTelegramFileDelivery(entry) {
+function makeTelegramFileDelivery(entry, botToken) {
   return makeFileDelivery({
     entry,
-    tag: TAG51,
+    tag: TAG52,
     channel: "telegram",
-    sendFile: makeTelegramSendFile(entry)
+    sendFile: makeTelegramSendFile(entry, botToken)
   });
 }
 
@@ -31323,7 +31482,7 @@ function startTelegramNativeFileFollower(input) {
   return startFollower({
     entry,
     tag: "[telegram-adaptor]",
-    fileDelivery: makeTelegramFileDelivery(entry),
+    fileDelivery: makeTelegramFileDelivery(entry, input.botToken),
     // A resumed session's JSONL already holds prior SendUserFile tool_uses;
     // suppress replay so historical files are not re-sent on attach.
     suppressResumeReplay: true,
@@ -31334,7 +31493,7 @@ function startTelegramNativeFileFollower(input) {
 
 // app/lib/channel-pty-bridge/public-session-end-review.ts
 import { randomUUID as randomUUID14 } from "crypto";
-var TAG52 = "[public-session-review]";
+var TAG53 = "[public-session-review]";
 var CONSUMED_CAP = 500;
 var consumed = /* @__PURE__ */ new Set();
 function consumeOnce(sessionId) {
@@ -31361,7 +31520,7 @@ async function fetchJsonl(sessionId) {
     return await res.text();
   } catch (err) {
     console.error(
-      `${TAG52} jsonl-fetch-failed sessionId=${sessionId} err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG53} jsonl-fetch-failed sessionId=${sessionId} err="${err instanceof Error ? err.message : String(err)}"`
     );
     return null;
   }
@@ -31385,7 +31544,7 @@ async function fetchPriorWrites(sliceToken, accountId) {
     const res = await fetch(url);
     if (!res.ok) {
       console.error(
-        `${TAG52} prior-writes-fetch-failed sliceToken=${sliceToken.slice(0, 8)} status=${res.status}`
+        `${TAG53} prior-writes-fetch-failed sliceToken=${sliceToken.slice(0, 8)} status=${res.status}`
       );
       return [];
     }
@@ -31393,7 +31552,7 @@ async function fetchPriorWrites(sliceToken, accountId) {
     return Array.isArray(body.writes) ? body.writes : [];
   } catch (err) {
     console.error(
-      `${TAG52} prior-writes-fetch-threw sliceToken=${sliceToken.slice(0, 8)} err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG53} prior-writes-fetch-threw sliceToken=${sliceToken.slice(0, 8)} err="${err instanceof Error ? err.message : String(err)}"`
     );
     return [];
   }
@@ -31422,7 +31581,7 @@ function composeInitialMessage(input) {
 }
 async function dispatchReviewer(input, initialMessage) {
   const sessionId = randomUUID14();
-  console.log(`${TAG52} route target=rc-spawn sessionId=${sessionId.slice(0, 8)} sourceSession=${input.sessionId.slice(0, 8)}`);
+  console.log(`${TAG53} route target=rc-spawn sessionId=${sessionId.slice(0, 8)} sourceSession=${input.sessionId.slice(0, 8)}`);
   const spawned = await managerRcSpawn({
     sessionId,
     initialMessage,
@@ -31446,21 +31605,21 @@ async function firePublicSessionEndReview(input) {
   const dispatchedAt = Date.now();
   if (consumed.has(input.sessionId)) {
     console.log(
-      `${TAG52} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
+      `${TAG53} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
     );
     return;
   }
   const jsonl = await fetchJsonl(input.sessionId);
   if (!jsonl) {
     console.log(
-      `${TAG52} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-jsonl-missing`
+      `${TAG53} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-jsonl-missing`
     );
     return;
   }
   const operatorTurns = countOperatorTurns(jsonl);
   if (operatorTurns === 0) {
     console.log(
-      `${TAG52} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-no-turns`
+      `${TAG53} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-no-turns`
     );
     return;
   }
@@ -31474,19 +31633,19 @@ async function firePublicSessionEndReview(input) {
   });
   if (!consumeOnce(input.sessionId)) {
     console.log(
-      `${TAG52} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
+      `${TAG53} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
     );
     return;
   }
   const dispatched = await dispatchReviewer(input, initialMessage);
   if (!dispatched.ok) {
     console.error(
-      `${TAG52} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-spawn-failed reason=${dispatched.reason}`
+      `${TAG53} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-spawn-failed reason=${dispatched.reason}`
     );
     return;
   }
   console.log(
-    `${TAG52} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=dispatched managerSessionId=${dispatched.managerSessionId} operatorTurns=${operatorTurns} priorWrites=${priorWrites.length} ms=${Date.now() - dispatchedAt}`
+    `${TAG53} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=dispatched managerSessionId=${dispatched.managerSessionId} operatorTurns=${operatorTurns} priorWrites=${priorWrites.length} ms=${Date.now() - dispatchedAt}`
   );
 }
 
@@ -31624,28 +31783,59 @@ import { statSync as statSync25 } from "fs";
 import { basename as basename17, dirname as dirname17, join as join54 } from "path";
 function buildTelegramAuditLines(input) {
   const lines = [];
-  for (const account of input.accounts) {
-    const tg = account.telegram;
-    if (!tg) continue;
-    const botTypes = [];
-    if (tg.adminBotToken) botTypes.push("admin");
-    if (tg.publicBotToken) botTypes.push("public");
-    if (botTypes.length === 0) continue;
-    const last = input.lastInboundAt(account.accountId);
-    const age = last === null ? "never" : String(input.now - last);
-    for (const botType of botTypes) {
-      const secretFile = input.secretFileExists(botType, account.accountId) ? "present" : "absent";
+  const entries2 = input.accounts.flatMap(
+    (a) => listBotEntries(a.telegram).map((entry) => ({ accountId: a.accountId, accountDir: a.accountDir, entry }))
+  );
+  if (entries2.length === 0) return lines;
+  const byId = /* @__PURE__ */ new Map();
+  for (const { entry } of entries2) byId.set(entry.id, (byId.get(entry.id) ?? 0) + 1);
+  for (const [botId, count] of byId) {
+    if (count > 1) lines.push(`[telegram-audit] op=duplicate-bot-id botId=${botId} accounts=${count}`);
+  }
+  for (const { accountId, accountDir, entry } of entries2) {
+    if (entry.role === "public" && !input.agentActive(accountDir, entry.agent)) {
       lines.push(
-        `[telegram-audit] op=configured accountId=${account.accountId} botType=${botType} secretFile=${secretFile} lastInboundAgeMs=${age}`
+        `[telegram-audit] op=entry-agent-inactive accountId=${accountId} botId=${entry.id} agent=${entry.agent}`
       );
     }
+    if (!input.secretFileExists(entry.id)) {
+      lines.push(`[telegram-audit] op=secret-orphan botId=${entry.id} side=entry`);
+    }
+  }
+  const known = new Set(entries2.map((e) => e.entry.id));
+  for (const botId of input.secretFilesOnDisk) {
+    if (!known.has(botId)) lines.push(`[telegram-audit] op=secret-orphan botId=${botId} side=file`);
+  }
+  for (const { accountId, entry } of entries2) {
+    const last = input.lastInboundByBot(entry.id);
+    const age = last === null ? "never" : String(input.now - last);
+    const agent = entry.role === "admin" ? "admin" : entry.agent;
+    const secretFile = input.secretFileExists(entry.id) ? "present" : "absent";
+    lines.push(
+      `[telegram-audit] op=configured botId=${entry.id} accountId=${accountId} agent=${agent} secretFile=${secretFile} lastInboundAgeMs=${age}`
+    );
   }
   return lines;
 }
-function newestTelegramSessionByAccount() {
+function newestTelegramSessionByBot() {
   const out = /* @__PURE__ */ new Map();
+  for (const { botId, mtime } of walkTelegramSidecars()) {
+    if (botId === null) continue;
+    const prev = out.get(botId);
+    if (prev === void 0 || mtime > prev) out.set(botId, mtime);
+  }
+  return out;
+}
+function countTelegramSessionsForAccount(accountId) {
+  let n = 0;
+  for (const { accountId: id } of walkTelegramSidecars()) {
+    if (id === accountId) n += 1;
+  }
+  return n;
+}
+function* walkTelegramSidecars() {
   const cfg = claudeConfigDir();
-  if (!cfg) return out;
+  if (!cfg) return;
   const projectsRoot = join54(cfg, "projects");
   for (const { path } of enumerateJsonls(projectsRoot)) {
     const sessionId = basename17(path).replace(/\.jsonl$/, "");
@@ -31657,11 +31847,80 @@ function newestTelegramSessionByAccount() {
     } catch {
       continue;
     }
-    const prev = out.get(meta.accountId);
-    if (prev === void 0 || mtime > prev) out.set(meta.accountId, mtime);
+    yield {
+      accountId: meta.accountId,
+      botId: parseTelegramChannelKey(meta.senderId ?? "")?.botId ?? null,
+      mtime
+    };
+  }
+}
+
+// server/telegram-migrate.ts
+import { readFileSync as readFileSync45, writeFileSync as writeFileSync17, existsSync as existsSync49, renameSync as renameSync11, mkdirSync as mkdirSync10 } from "fs";
+import { dirname as dirname18, join as join55 } from "path";
+function migrateTelegramTwoSlot(input) {
+  const out = [];
+  for (const account of input.accounts) {
+    const configPath3 = join55(account.accountDir, "account.json");
+    let config;
+    try {
+      config = JSON.parse(readFileSync45(configPath3, "utf-8"));
+    } catch {
+      console.error(`[telegram-audit] op=migrate-unreadable accountId=${account.accountId}`);
+      continue;
+    }
+    const tg = config.telegram;
+    if (!tg) continue;
+    const adminToken = typeof tg.adminBotToken === "string" ? tg.adminBotToken : null;
+    const publicToken = typeof tg.publicBotToken === "string" ? tg.publicBotToken : null;
+    if (!adminToken && !publicToken) continue;
+    const outcome = { accountId: account.accountId, converted: 0, orphanSessions: 0 };
+    const bots = Array.isArray(tg.bots) ? [...tg.bots] : [];
+    if (adminToken) {
+      const id = botIdFromToken(adminToken);
+      if (!id) {
+        outcome.skippedAdmin = "malformed-token";
+      } else {
+        const adminUsers = Array.isArray(tg.adminUsers) ? tg.adminUsers.filter((u) => typeof u === "number") : void 0;
+        bots.push({ id, token: adminToken, role: "admin", ...adminUsers ? { adminUsers } : {} });
+        moveSecret(input.legacySecretPathFor("admin", account.accountId), input.secretPathFor(id));
+        outcome.converted += 1;
+      }
+    }
+    if (publicToken) {
+      const id = botIdFromToken(publicToken);
+      const agent = typeof config.defaultAgent === "string" && config.defaultAgent.length > 0 ? config.defaultAgent : null;
+      if (!id) {
+        outcome.skippedPublic = "malformed-token";
+      } else if (!agent) {
+        outcome.skippedPublic = "no-default-agent";
+      } else {
+        const dmPolicy = typeof tg.dmPolicy === "string" ? tg.dmPolicy : void 0;
+        const allowFrom = Array.isArray(tg.allowFrom) ? tg.allowFrom.filter((u) => typeof u === "number") : void 0;
+        bots.push({
+          id,
+          token: publicToken,
+          role: "public",
+          agent,
+          ...dmPolicy ? { dmPolicy } : {},
+          ...allowFrom ? { allowFrom } : {}
+        });
+        moveSecret(input.legacySecretPathFor("public", account.accountId), input.secretPathFor(id));
+        outcome.converted += 1;
+      }
+    }
+    config.telegram = { bots };
+    writeFileSync17(configPath3, JSON.stringify(config, null, 2) + "\n", "utf-8");
+    outcome.orphanSessions = input.countOrphanSessions(account.accountId);
+    out.push(outcome);
   }
   return out;
 }
+function moveSecret(from, to) {
+  if (!existsSync49(from)) return;
+  mkdirSync10(dirname18(to), { recursive: true, mode: 448 });
+  renameSync11(from, to);
+}
 
 // app/lib/whatsapp/recall-store-backfill.ts
 function backfillMisfiledRecords(params) {
@@ -31699,14 +31958,14 @@ function backfillMisfiledRecords(params) {
 }
 
 // server/lib/booking-site-accounts.ts
-import { existsSync as existsSync49, readFileSync as readFileSync45 } from "fs";
+import { existsSync as existsSync50, readFileSync as readFileSync46 } from "fs";
 import { resolve as resolve43 } from "path";
 function listBookingSiteAccounts(accounts) {
   return accounts.filter((a) => {
     const availPath = resolve43(a.accountDir, "calendar-availability.json");
-    if (!existsSync49(availPath)) return false;
+    if (!existsSync50(availPath)) return false;
     try {
-      const cfg = JSON.parse(readFileSync45(availPath, "utf-8"));
+      const cfg = JSON.parse(readFileSync46(availPath, "utf-8"));
       return typeof cfg.bookingDbName === "string" && cfg.bookingDbName.length > 0;
     } catch {
       return false;
@@ -31744,7 +32003,7 @@ function broadcastAdminShutdown(reason) {
 
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash6, verify as cryptoVerify } from "crypto";
-import { existsSync as existsSync50, readFileSync as readFileSync46, statSync as statSync26 } from "fs";
+import { existsSync as existsSync51, readFileSync as readFileSync47, statSync as statSync26 } from "fs";
 import { resolve as resolve44 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
@@ -31793,7 +32052,7 @@ function resolveEntitlement(brand, account) {
     return logResolved(implicitTrust(account), null);
   }
   const entitlementPath = resolve44(brand.configDir, "entitlement.json");
-  if (!existsSync50(entitlementPath)) {
+  if (!existsSync51(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
   const stat11 = statSync26(entitlementPath);
@@ -31808,7 +32067,7 @@ function resolveEntitlement(brand, account) {
 function verifyAndResolve(brand, entitlementPath, account) {
   let pubkeyPem;
   try {
-    pubkeyPem = readFileSync46(pubkeyPath(brand), "utf-8");
+    pubkeyPem = readFileSync47(pubkeyPath(brand), "utf-8");
   } catch (err) {
     return logResolved(anonymousFallback("pubkey-missing"), {
       reason: "pubkey-missing"
@@ -31822,7 +32081,7 @@ function verifyAndResolve(brand, entitlementPath, account) {
   }
   let envelope;
   try {
-    envelope = JSON.parse(readFileSync46(entitlementPath, "utf-8"));
+    envelope = JSON.parse(readFileSync47(entitlementPath, "utf-8"));
   } catch {
     return logResolved(anonymousFallback("malformed"), { reason: "malformed" });
   }
@@ -31984,14 +32243,14 @@ function clientFrom(c) {
 }
 installMediaDownloadGuard();
 var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT || "";
-var BRAND_JSON_PATH = PLATFORM_ROOT6 ? join55(PLATFORM_ROOT6, "config", "brand.json") : "";
+var BRAND_JSON_PATH = PLATFORM_ROOT6 ? join56(PLATFORM_ROOT6, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", marketingUrl: "https://getmaxy.com" };
-if (BRAND_JSON_PATH && !existsSync51(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && !existsSync52(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
 }
-if (BRAND_JSON_PATH && existsSync51(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync52(BRAND_JSON_PATH)) {
   try {
-    const parsed = JSON.parse(readFileSync47(BRAND_JSON_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync48(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
   } catch (err) {
     console.error(`[brand] Failed to parse brand.json: ${err.message}`);
@@ -32023,11 +32282,11 @@ var brandLoginOpts = {
   appleTouchIconPath: brandAppIcon512Path,
   themeColor: BRAND.defaultColors?.primary
 };
-var ALIAS_DOMAINS_PATH = join55(homedir4(), BRAND.configDir, "alias-domains.json");
+var ALIAS_DOMAINS_PATH = join56(homedir4(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
-    if (!existsSync51(ALIAS_DOMAINS_PATH)) return null;
-    const parsed = JSON.parse(readFileSync47(ALIAS_DOMAINS_PATH, "utf-8"));
+    if (!existsSync52(ALIAS_DOMAINS_PATH)) return null;
+    const parsed = JSON.parse(readFileSync48(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
       return null;
@@ -32118,7 +32377,7 @@ var waGateway = new WaGateway({
   sendToParty: (accountId, phone, text) => sendWhatsAppTextForRelay(accountId, phone, text),
   resolveSessionOverride: (accountId, senderId) => resolveChannelOverride(accountId, "whatsapp", senderId),
   gatewayUrl: `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`,
-  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve45(process.env.MAXY_PLATFORM_ROOT ?? join55(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
+  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve45(process.env.MAXY_PLATFORM_ROOT ?? join56(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
   // Task 751 / 1390 — file delivery on the native channel. `maxyAccountId` (the
   // path-validation scope) is the sender's effective SESSION account, resolved
   // once at the inbound gate and threaded here via the gateway's per-sender doc
@@ -32133,7 +32392,7 @@ var waGateway = new WaGateway({
       caption,
       accountId,
       maxyAccountId,
-      platformRoot: resolve45(process.env.MAXY_PLATFORM_ROOT ?? join55(__dirname, ".."))
+      platformRoot: resolve45(process.env.MAXY_PLATFORM_ROOT ?? join56(__dirname, ".."))
     });
     return result.ok ? { ok: true, messageId: result.messageId } : { ok: false, error: result.error };
   },
@@ -32300,7 +32559,7 @@ function runDuplicateSenderAudit() {
   try {
     const configDir = process.env.CLAUDE_CONFIG_DIR;
     if (!configDir) return;
-    const projectsRoot = join55(configDir, "projects");
+    const projectsRoot = join56(configDir, "projects");
     const records = [];
     for (const { path: jsonlPath, isSubagent, archived } of enumerateJsonls(projectsRoot)) {
       if (isSubagent || archived) continue;
@@ -32441,42 +32700,22 @@ var telegramGateway = new TelegramGateway({
   // Task 2353 — no turn-instruction resolver on this door. See the dep comment in
   // telegram-gateway.ts: the account file governs the relay turn, which only the
   // WhatsApp door raises.
-  resolveSessionOverride: (accountId, senderId) => resolveChannelOverride(accountId, "telegram", senderId),
+  // Task 2368 — the pointer keys on the `<botId>:<senderId>` channel key, which
+  // is what the classification sidecar records (the manager reads
+  // telegramChannel.senderId) and therefore what session-reseat.ts writes.
+  resolveSessionOverride: (accountId, channelKey) => resolveChannelOverride(accountId, "telegram", channelKey),
   gatewayUrl: telegramGatewayUrl(),
   serverPath: telegramServerPath(),
-  ensureChannelSession: async ({ accountId, senderId, role, personId, chatId, gatewayUrl, serverPath }) => {
-    const req = buildTelegramSpawnRequest({
-      accountId,
-      senderId,
-      role,
-      personId,
-      gatewayUrl,
-      serverPath,
-      // Task 1789 — admin rows only; see the WhatsApp twin.
-      overrideSessionId: role === "admin" ? resolveChannelOverride(accountId, "telegram", senderId) : null
-    });
-    const result = await managerRcSpawn(req);
-    if ("error" in result) {
-      console.error(`[telegram-native] spawn-failed senderId=${senderId} role=${role} error=${result.error} status=${result.status}`);
-      return;
-    }
-    if (role !== "admin") return;
-    const prior = telegramFileFollowers.get(senderId);
-    if (prior) prior.abort();
-    let ac;
-    ac = startTelegramNativeFileFollower({
-      sessionId: req.sessionId,
-      senderId,
-      accountId,
-      chatId,
-      // Identity-guarded eviction: only delete if this controller is still the
-      // current one, so a stale self-close never removes a live follower.
-      onClose: () => {
-        if (telegramFileFollowers.get(senderId) === ac) telegramFileFollowers.delete(senderId);
-      }
-    });
-    telegramFileFollowers.set(senderId, ac);
-  }
+  // Task 2368 — the role branch lives in its own module so it has a test that
+  // needs no live manager. An admin bot keeps /rc-spawn; a public bot goes to
+  // /public-spawn, the only door that accepts an agent slug.
+  ensureChannelSession: buildTelegramEnsureSession({
+    managerRcSpawn,
+    managerSpawn,
+    resolveSessionOverride: (accountId, channelKey) => resolveChannelOverride(accountId, "telegram", channelKey),
+    startFileFollower: startTelegramNativeFileFollower,
+    followers: telegramFileFollowers
+  })
 });
 setTelegramGateway(telegramGateway);
 app76.route("/", telegramGateway.routes());
@@ -32518,24 +32757,29 @@ var scheduleInjectRoutes = createScheduleInjectRoutes({
   // effective-account.ts for why `resolveAccount()` was the wrong side to move,
   // and why the real dependencies are bound there rather than assembled here.
   effectiveAccountFor: resolveScheduledEffectiveAccountForInstall,
-  // Task 2365 — the account whose own telegram.adminUsers claims this chat id.
-  // Reads the same list, through the same readChannelAdmins call, that
+  // Task 2368 — which BOT claims this chat id, across every account. Reads the
+  // same per-bot split, through the same readChannelAdmins call, that
   // validateAgentDestination uses (agent-dispatch-rule), so the routine picker,
-  // the save and this dispatch cannot disagree. Two claimants is reported to
-  // the route and refused there, never picked between.
+  // the save and this dispatch cannot disagree. Two claimants is reported to the
+  // route and refused there, never picked between — and two bots in ONE account
+  // is as ambiguous as two accounts, because the dispatch has no basis to choose
+  // which bot the person hears from.
   telegramAccountForDestination: (destination) => {
     const asNumber = Number(destination);
     if (!Number.isInteger(asNumber)) return { kind: "none" };
-    const claimants = listValidAccounts().filter(
-      (a) => readChannelAdmins(a.accountDir, "telegram").adminUsers.includes(asNumber)
-    );
-    if (claimants.length === 0) return { kind: "none" };
-    if (claimants.length > 1) return { kind: "ambiguous", count: claimants.length };
-    return {
-      kind: "one",
-      accountId: claimants[0].accountId,
-      botToken: claimants[0].config.telegram?.adminBotToken ?? null
-    };
+    const hits = [];
+    for (const a of listValidAccounts()) {
+      const entries2 = listBotEntries(a.config.telegram);
+      for (const bot of readChannelAdmins(a.accountDir, "telegram").byBot) {
+        if (!bot.adminUsers.includes(asNumber)) continue;
+        const entry = entries2.find((e) => e.id === bot.botId);
+        if (!entry) continue;
+        hits.push({ accountId: a.accountId, botId: bot.botId, botToken: entry.token });
+      }
+    }
+    if (hits.length === 0) return { kind: "none" };
+    if (hits.length > 1) return { kind: "ambiguous", count: hits.length };
+    return { kind: "one", ...hits[0] };
   }
 });
 app76.route("/api/channel/schedule-inject", scheduleInjectRoutes);
@@ -32908,14 +33152,14 @@ app76.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync51(filePath)) {
+  if (!existsSync52(filePath)) {
     console.error(`[agent-assets] serve slug=${slug} file=${filename} status=404`);
     return c.text("Not found", 404);
   }
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[agent-assets] serve slug=${slug} file=${filename} status=200`);
-  const body = readFileSync47(filePath);
+  const body = readFileSync48(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=3600"
@@ -32938,14 +33182,14 @@ app76.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync51(filePath)) {
+  if (!existsSync52(filePath)) {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[generated] serve file=${filename} status=200`);
-  const body = readFileSync47(filePath);
+  const body = readFileSync48(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=86400"
@@ -32958,9 +33202,9 @@ app76.route("/v", visitor_consent_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
-if (BRAND_JSON_PATH && existsSync51(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync52(BRAND_JSON_PATH)) {
   try {
-    const fullBrand = JSON.parse(readFileSync47(BRAND_JSON_PATH, "utf-8"));
+    const fullBrand = JSON.parse(readFileSync48(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
     brandIconPath = fullBrand.assets?.icon ? `/brand/${fullBrand.assets.icon}` : brandLogoPath;
   } catch {
@@ -32987,11 +33231,11 @@ var brandScript = `<script>window.__BRAND__=${JSON.stringify({
 var brandThemeColor = BRAND.defaultColors?.primary ?? "#000000";
 var brandBackgroundColor = BRAND.defaultColors?.background ?? "#ffffff";
 var brandAppIconsExist = [brandAppIcon192Path, brandAppIcon512Path, brandMaskableIconPath].every(
-  (p) => existsSync51(resolve45(process.cwd(), "public", p.replace(/^\//, "")))
+  (p) => existsSync52(resolve45(process.cwd(), "public", p.replace(/^\//, "")))
 );
 var SW_SOURCE = (() => {
   try {
-    return readFileSync47(resolve45(process.cwd(), "public", "sw.js"), "utf-8");
+    return readFileSync48(resolve45(process.cwd(), "public", "sw.js"), "utf-8");
   } catch {
     return null;
   }
@@ -32999,9 +33243,9 @@ var SW_SOURCE = (() => {
 function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT6) return "unknown";
-    const versionFile = join55(PLATFORM_ROOT6, "config", `.${BRAND.hostname}-version`);
-    if (!existsSync51(versionFile)) return "unknown";
-    const content = readFileSync47(versionFile, "utf-8").trim();
+    const versionFile = join56(PLATFORM_ROOT6, "config", `.${BRAND.hostname}-version`);
+    if (!existsSync52(versionFile)) return "unknown";
+    const content = readFileSync48(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
     return "unknown";
@@ -33012,7 +33256,7 @@ var versionScript = `<script>window.__MAXY_VERSION__=${JSON.stringify(INSTALLED_
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync47(resolve45(process.cwd(), "public", file), "utf-8");
+    html = readFileSync48(resolve45(process.cwd(), "public", file), "utf-8");
     const productNameEsc = escapeHtml(BRAND.productName);
     html = html.replace(/<title>([^<]*)<\/title>/, (_match, inner) => `<title>${escapeHtml(inner).replace(/Maxy/g, productNameEsc)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
@@ -33029,14 +33273,14 @@ ${clientErrorReporterScript}
   return html;
 }
 function loadBrandingCache(agentSlug) {
-  const configDir = join55(homedir4(), BRAND.configDir);
+  const configDir = join56(homedir4(), BRAND.configDir);
   try {
     const verdict = resolvePublicAddressFromDisk(agentSlug);
     const accountId = verdict.kind === "served" ? verdict.owner.accountId : getDefaultAccountId();
     if (!accountId) return null;
-    const cachePath = join55(configDir, "branding-cache", accountId, `${agentSlug}.json`);
-    if (!existsSync51(cachePath)) return null;
-    return JSON.parse(readFileSync47(cachePath, "utf-8"));
+    const cachePath = join56(configDir, "branding-cache", accountId, `${agentSlug}.json`);
+    if (!existsSync52(cachePath)) return null;
+    return JSON.parse(readFileSync48(cachePath, "utf-8"));
   } catch {
     return null;
   }
@@ -33131,7 +33375,7 @@ app76.use("/vnc-popout.html", logViewerFetch);
 app76.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync47(resolve45(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync48(resolve45(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -33284,10 +33528,10 @@ var hostname = process.env.HOSTNAME ?? "127.0.0.1";
 var httpServer = serve({ fetch: app76.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
-  const reconcilePlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join55(__dirname, "..");
+  const reconcilePlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join56(__dirname, "..");
   const reconcileScript = resolve45(reconcilePlatformRoot, "plugins/scheduling/mcp/dist/scripts/reconcile-bookings.js");
   const runReconcile = (ctx) => {
-    if (!existsSync51(reconcileScript)) return;
+    if (!existsSync52(reconcileScript)) return;
     try {
       const child = spawn3(process.execPath, [reconcileScript], {
         env: { ...process.env, PLATFORM_ROOT: reconcilePlatformRoot },
@@ -33307,7 +33551,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     detached: true,
     run: runReconcile
   });
-  const reconcileStatePath = join55(MAXY_DIR, "booking-reconcile-state.json");
+  const reconcileStatePath = join56(MAXY_DIR, "booking-reconcile-state.json");
   registerLoop({
     name: "calendar-reconcile-liveness",
     intervalMs: 6e5,
@@ -33325,7 +33569,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 }
 {
   const DREAM_CYCLE_SWEEP_INTERVAL_MS = 36e5;
-  const dreamPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join55(__dirname, "..");
+  const dreamPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join56(__dirname, "..");
   const dreamSweepScript = resolve45(dreamPlatformRoot, "plugins/memory/mcp/dist/scripts/dream-cycle-sweep.js");
   registerLoop({
     name: "dream-cycle-sweep",
@@ -33333,7 +33577,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     firstRunDelayMs: 3e4,
     detached: true,
     run: (ctx) => {
-      if (!existsSync51(dreamSweepScript)) return;
+      if (!existsSync52(dreamSweepScript)) return;
       try {
         const child = spawn3(process.execPath, [dreamSweepScript], {
           env: { ...process.env, PLATFORM_ROOT: dreamPlatformRoot },
@@ -33349,11 +33593,11 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const outlookPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join55(__dirname, "..");
+  const outlookPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join56(__dirname, "..");
   const outlookScript = resolve45(outlookPlatformRoot, "plugins/outlook/mcp/dist/scripts/complete-registration.js");
   const OUTLOOK_COMPLETE_INTERVAL_MS = 3e4;
   const runOutlookComplete = (ctx) => {
-    if (!existsSync51(outlookScript)) return;
+    if (!existsSync52(outlookScript)) return;
     try {
       const child = spawn3(process.execPath, [outlookScript], {
         env: { ...process.env, PLATFORM_ROOT: outlookPlatformRoot },
@@ -33375,19 +33619,19 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const auditRoot = process.env.MAXY_PLATFORM_ROOT ?? join55(__dirname, "..");
+  const auditRoot = process.env.MAXY_PLATFORM_ROOT ?? join56(__dirname, "..");
   const strandedAccountsDir = resolve45(auditRoot, "..", "data/accounts");
   const STRANDED_AUDIT_INTERVAL_MS = 3e5;
   const STRANDED_AGE_MS = 16 * 6e4;
   const STRANDED_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
   const runStrandedAudit = () => {
     try {
-      if (!existsSync51(strandedAccountsDir)) return;
+      if (!existsSync52(strandedAccountsDir)) return;
       const now = Date.now();
       for (const name of readdirSync30(strandedAccountsDir)) {
         if (!STRANDED_UUID_RE.test(name)) continue;
         const pendingPath2 = resolve45(strandedAccountsDir, name, "secrets/outlook/pending-devicecode.enc");
-        if (!existsSync51(pendingPath2)) continue;
+        if (!existsSync52(pendingPath2)) continue;
         const ageMs2 = now - statSync27(pendingPath2).mtimeMs;
         if (ageMs2 > STRANDED_AGE_MS) {
           console.error(`[outlook-mcp] devicecode-stranded account=${name} ageSec=${Math.floor(ageMs2 / 1e3)}`);
@@ -33405,7 +33649,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const googleRoot = process.env.MAXY_PLATFORM_ROOT ?? join55(__dirname, "..");
+  const googleRoot = process.env.MAXY_PLATFORM_ROOT ?? join56(__dirname, "..");
   const googleAccountsDir = resolve45(googleRoot, "..", "data/accounts");
   const GOOGLE_PENDING_AUDIT_INTERVAL_MS = 3e5;
   const runGooglePendingAuditSafe = () => {
@@ -33424,7 +33668,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   const googleAuditScript = resolve45(googleRoot, "plugins/google/mcp/dist/scripts/account-audit.js");
   const GOOGLE_ACCOUNT_AUDIT_INTERVAL_MS = 36e5;
   const runGoogleAccountAudit = (ctx) => {
-    if (!existsSync51(googleAuditScript)) return;
+    if (!existsSync52(googleAuditScript)) return;
     try {
       const child = spawn3(process.execPath, [googleAuditScript], {
         env: { ...process.env, PLATFORM_ROOT: googleRoot },
@@ -33449,7 +33693,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join55(__dirname, "..");
+  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join56(__dirname, "..");
   const STORAGE_AUDIT_INTERVAL_MS = 3e5;
   const runStorageAuditSafe = () => runStorageAudit(auditPlatformRoot).catch((err) => {
     console.error(`[storage-audit] error="${err.message}"`);
@@ -33481,15 +33725,42 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     firstRunDelayMs: 5e4,
     run: runDataPortalAuditSafe
   });
+  for (const o of migrateTelegramTwoSlot({
+    accounts: listValidAccounts().map((a) => ({ accountId: a.accountId, accountDir: a.accountDir })),
+    secretPathFor: secretPath,
+    legacySecretPathFor: (botType, accountId) => resolve45(
+      homedir4(),
+      configDirName(),
+      `${botType === "admin" ? ".telegram-admin-webhook-secret" : ".telegram-webhook-secret"}.${accountId}`
+    ),
+    // Counted here and nowhere else: the session-key re-key strands these and no
+    // later event reveals it, because the new key never resolves to the old JSONL.
+    countOrphanSessions: countTelegramSessionsForAccount
+  })) {
+    console.error(
+      `[telegram-audit] op=migrate-session-orphans accountId=${o.accountId} count=${o.orphanSessions} converted=${o.converted}${o.skippedAdmin ? ` skippedAdmin=${o.skippedAdmin}` : ""}${o.skippedPublic ? ` skippedPublic=${o.skippedPublic}` : ""}`
+    );
+  }
   const runTelegramAudit = async () => {
-    const accounts = listValidAccounts().map((a) => ({ accountId: a.accountId, telegram: a.config.telegram }));
-    const configured = accounts.some((a) => a.telegram?.adminBotToken || a.telegram?.publicBotToken);
+    const accounts = listValidAccounts().map((a) => ({
+      accountId: a.accountId,
+      accountDir: a.accountDir,
+      telegram: a.config.telegram
+    }));
+    const configured = accounts.some((a) => listBotEntries(a.telegram).length > 0);
     if (!configured) return;
-    const lastByAccount = newestTelegramSessionByAccount();
+    const lastByBot = newestTelegramSessionByBot();
+    let secretFilesOnDisk = [];
+    try {
+      secretFilesOnDisk = readdirSync30(telegramSecretsDir());
+    } catch {
+    }
     const lines = buildTelegramAuditLines({
       accounts,
-      secretFileExists: (botType, accountId) => existsSync51(secretPath(botType, accountId)),
-      lastInboundAt: (accountId) => lastByAccount.get(accountId) ?? null,
+      secretFileExists: (botId) => existsSync52(secretPath(botId)),
+      agentActive: isActiveAgentSlug,
+      secretFilesOnDisk,
+      lastInboundByBot: (botId) => lastByBot.get(botId) ?? null,
       now: Date.now()
     });
     for (const line of lines) console.error(line);
@@ -33565,7 +33836,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const publishPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join55(__dirname, "..");
+  const publishPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join56(__dirname, "..");
   const publishScript = resolve45(publishPlatformRoot, "plugins/scheduling/mcp/dist/scripts/publish-availability.js");
   const PUBLISH_INTERVAL_MS = 3e5;
   const bookingAccounts = () => {
@@ -33577,7 +33848,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     }
   };
   const spawnPublish = (account, ctx) => {
-    if (!existsSync51(publishScript)) return;
+    if (!existsSync52(publishScript)) return;
     try {
       const child = spawn3(process.execPath, [publishScript], {
         env: {
@@ -33599,8 +33870,8 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     const availPath = resolve45(account.accountDir, "calendar-availability.json");
     let hasBookingSite = false;
     try {
-      if (existsSync51(availPath)) {
-        const cfg = JSON.parse(readFileSync47(availPath, "utf-8"));
+      if (existsSync52(availPath)) {
+        const cfg = JSON.parse(readFileSync48(availPath, "utf-8"));
         hasBookingSite = typeof cfg.bookingDbName === "string" && cfg.bookingDbName.length > 0;
       }
     } catch {
@@ -33608,9 +33879,9 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     if (!hasBookingSite) return;
     const statePath = resolve45(account.accountDir, "state", "booking-availability", "last-publish.json");
     let lastSuccessAt = null;
-    if (existsSync51(statePath)) {
+    if (existsSync52(statePath)) {
       try {
-        const rec = JSON.parse(readFileSync47(statePath, "utf-8"));
+        const rec = JSON.parse(readFileSync48(statePath, "utf-8"));
         lastSuccessAt = rec.lastSuccessAt ?? null;
       } catch {
         console.error(`[calendar-availability] op=audit accountId=${account.accountId} snapshotAgeMs=na reason=bad-state-file`);
@@ -33642,12 +33913,12 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 startTimeEntryCensus(() => getSession());
 startLedgerCensus(() => getSession());
 {
-  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join55(__dirname, "..");
+  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join56(__dirname, "..");
   const auditScript = resolve45(auditPlatformRoot, "plugins/connector/mcp/dist/scripts/audit-connectors.js");
   const auditLogDir = process.env.LOG_DIR ?? LOG_DIR;
   const CONNECTOR_AUDIT_INTERVAL_MS = 3e5;
   const runConnectorAudit = (ctx) => {
-    if (!existsSync51(auditScript)) return;
+    if (!existsSync52(auditScript)) return;
     try {
       const child = spawn3(process.execPath, [auditScript], {
         env: { ...process.env, PLATFORM_ROOT: auditPlatformRoot, LOG_DIR: auditLogDir },
@@ -33767,11 +34038,11 @@ try {
 var ADMINUSER_RECONCILE_INTERVAL_MS = 60 * 60 * 1e3;
 async function runAdminUserReconcileTick() {
   try {
-    if (!existsSync51(USERS_FILE)) {
+    if (!existsSync52(USERS_FILE)) {
       console.error("[adminuser-self-heal] skip reason=no-users-file");
       return;
     }
-    const usersRaw = readFileSync47(USERS_FILE, "utf-8").trim();
+    const usersRaw = readFileSync48(USERS_FILE, "utf-8").trim();
     if (!usersRaw) {
       console.error("[adminuser-self-heal] skip reason=empty-users-file");
       return;
@@ -33853,8 +34124,8 @@ var runIngestAuditTick = () => {
       },
       agentExists: (accountId, slug) => {
         if (!house) return false;
-        const dir = isHouseAccountKey(house.accountId, accountId) ? house.accountDir : join55(ACCOUNTS_DIR, accountId);
-        return existsSync51(join55(dir, "agents", slug, "config.json"));
+        const dir = isHouseAccountKey(house.accountId, accountId) ? house.accountDir : join56(ACCOUNTS_DIR, accountId);
+        return existsSync52(join56(dir, "agents", slug, "config.json"));
       }
     });
   } catch (err) {
@@ -33902,8 +34173,8 @@ registerLoop({
       runPublicAddressCollisionAudit({
         houseAccountId: () => resolveAccount()?.accountId ?? null,
         activeSlugs: () => listValidAccounts().map((a) => {
-          const agentsRoot = join55(a.accountDir, "agents");
-          if (!existsSync51(agentsRoot)) return { accountId: a.accountId, slugs: [] };
+          const agentsRoot = join56(a.accountDir, "agents");
+          if (!existsSync52(agentsRoot)) return { accountId: a.accountId, slugs: [] };
           const slugs = readdirSync30(agentsRoot, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name).filter((slug) => isActiveAgentSlug(a.accountDir, slug));
           return { accountId: a.accountId, slugs };
         })
@@ -33917,8 +34188,8 @@ registerLoop({
 });
 var USERS_RECONCILE_INTERVAL_MS = 60 * 60 * 1e3;
 function countUsersRows() {
-  if (!existsSync51(USERS_FILE)) return 0;
-  const raw = readFileSync47(USERS_FILE, "utf-8").trim();
+  if (!existsSync52(USERS_FILE)) return 0;
+  const raw = readFileSync48(USERS_FILE, "utf-8").trim();
   if (!raw) return 0;
   const users = JSON.parse(raw);
   return users.filter((u) => typeof u.userId === "string").length;
@@ -34054,7 +34325,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve45(process.env.MAXY_PLATFORM_ROOT ?? join55(__dirname, "..")),
+  platformRoot: resolve45(process.env.MAXY_PLATFORM_ROOT ?? join56(__dirname, "..")),
   accountConfig: bootAccountConfig,
   // Task 2074 — enrich with the sub-account name and fan out to every open
   // admin SSE stream. Fire-and-forget: the manager's persist path must not