@rubytech/create-maxy-code 0.1.572 → 0.1.574

package/payload/server/server.js

@@ -340,26 +340,26 @@ function keyOf(resource, accountId) {
 function generationOf(resource, key2) {
   return (keyGenerations.get(key2) ?? 0) + (resourceGenerations.get(resource) ?? 0);
 }
-function recomputeFloorMs(entry) {
+function recomputeFloorMs(entry2) {
   return Math.min(
-    Math.max(entry.computeMs * RECOMPUTE_FLOOR_FACTOR, MIN_RECOMPUTE_FLOOR_MS),
+    Math.max(entry2.computeMs * RECOMPUTE_FLOOR_FACTOR, MIN_RECOMPUTE_FLOOR_MS),
     MAX_RECOMPUTE_FLOOR_MS
   );
 }
 async function getOrCompute(resource, accountId, compute) {
   const key2 = keyOf(resource, accountId);
-  const entry = entries.get(key2);
-  if (entry !== void 0) {
-    const age = Date.now() - entry.computedAt;
-    if (!entry.dirty && age <= BACKSTOP_MS) {
-      return { value: entry.value, state: "hit" };
+  const entry2 = entries.get(key2);
+  if (entry2 !== void 0) {
+    const age = Date.now() - entry2.computedAt;
+    if (!entry2.dirty && age <= BACKSTOP_MS) {
+      return { value: entry2.value, state: "hit" };
     }
-    const sinceAttempt = Date.now() - entry.lastAttemptAt;
-    if (entry.dirty && sinceAttempt < recomputeFloorMs(entry) && age <= BACKSTOP_MS) {
-      return { value: entry.value, state: "dirty-floor" };
+    const sinceAttempt = Date.now() - entry2.lastAttemptAt;
+    if (entry2.dirty && sinceAttempt < recomputeFloorMs(entry2) && age <= BACKSTOP_MS) {
+      return { value: entry2.value, state: "dirty-floor" };
     }
   }
-  const state = entry === void 0 ? "miss" : "stale-backstop";
+  const state = entry2 === void 0 ? "miss" : "stale-backstop";
   const existing = inFlight.get(key2);
   if (existing) return { value: await existing, state };
   const startedGeneration = generationOf(resource, key2);
@@ -404,8 +404,8 @@ function invalidate(resource, accountId, source = "action") {
       entries.delete(key2);
       return;
     }
-    const entry = entries.get(key2);
-    if (entry) entry.dirty = true;
+    const entry2 = entries.get(key2);
+    if (entry2) entry2.dirty = true;
   };
   if (accountId === null) {
     resourceGenerations.set(resource, (resourceGenerations.get(resource) ?? 0) + 1);
@@ -974,7 +974,7 @@ function parseTitleCache(raw) {
 }
 function serializeTitleCache(cache2) {
   const obj = {};
-  for (const [sessionId, entry] of cache2) obj[sessionId] = entry;
+  for (const [sessionId, entry2] of cache2) obj[sessionId] = entry2;
   return JSON.stringify(obj);
 }
 async function loadTitleCacheOutcome(accountDir) {
@@ -1007,7 +1007,7 @@ async function saveTitleCacheMerged(accountDir, updates, evict) {
     if (err.code !== "ENOENT") throw err;
     merged = /* @__PURE__ */ new Map();
   }
-  for (const [sessionId, entry] of updates) merged.set(sessionId, entry);
+  for (const [sessionId, entry2] of updates) merged.set(sessionId, entry2);
   let evicted = 0;
   if (evict !== void 0) {
     for (const sessionId of evict) {
@@ -1441,11 +1441,11 @@ function enumerateJsonlsWithSkips(projectsRoot, fileRe = SESSION_ID_RE) {
       skipped += 1;
       continue;
     }
-    for (const entry of entries2) {
-      if (entry.isFile() && fileRe.test(entry.name)) {
-        out.push({ path: join11(slugDir, entry.name), isSubagent: false, archived: false });
-      } else if (entry.isDirectory() && entry.name === "subagents") {
-        const subDir = join11(slugDir, entry.name);
+    for (const entry2 of entries2) {
+      if (entry2.isFile() && fileRe.test(entry2.name)) {
+        out.push({ path: join11(slugDir, entry2.name), isSubagent: false, archived: false });
+      } else if (entry2.isDirectory() && entry2.name === "subagents") {
+        const subDir = join11(slugDir, entry2.name);
         let subEntries;
         try {
           subEntries = readdirSync5(subDir, { withFileTypes: true });
@@ -1460,8 +1460,8 @@ function enumerateJsonlsWithSkips(projectsRoot, fileRe = SESSION_ID_RE) {
             out.push({ path: join11(subDir, sub.name), isSubagent: true, archived: false });
           }
         }
-      } else if (entry.isDirectory() && entry.name === "archive") {
-        const archiveDir = join11(slugDir, entry.name);
+      } else if (entry2.isDirectory() && entry2.name === "archive") {
+        const archiveDir = join11(slugDir, entry2.name);
         let archiveEntries;
         try {
           archiveEntries = readdirSync5(archiveDir, { withFileTypes: true });
@@ -2147,7 +2147,7 @@ function createSidecarStore(config) {
   function readAll(sessionsDir, onSkip) {
     let names;
     try {
-      names = readdirSync16(sessionsDir, { withFileTypes: true }).filter((entry) => entry.isFile()).map((entry) => entry.name);
+      names = readdirSync16(sessionsDir, { withFileTypes: true }).filter((entry2) => entry2.isFile()).map((entry2) => entry2.name);
     } catch {
       return [];
     }
@@ -2563,7 +2563,7 @@ function createWebchatRoutes(deps) {
       clearSignal = body?.clearSignal === true;
       quotedUuid = typeof body?.quotedUuid === "string" && body.quotedUuid ? body.quotedUuid : void 0;
     }
-    let deliveryKey = WEBCHAT_ADMIN_KEY;
+    let deliveryKey;
     let deliverySessionId;
     let deliveryAccountId = accountId;
     const explicitTarget = target !== void 0;
@@ -2606,6 +2606,10 @@ function createWebchatRoutes(deps) {
       deliveryKey = `session:${target}`;
       deliverySessionId = target;
       deliveryAccountId = sessionAccountId ?? accountId;
+    } else {
+      deliverySessionId = adminSessionIdFor(bootstrapAccountId, WEBCHAT_ADMIN_KEY, requesterUserId ?? void 0);
+      deliveryKey = `session:${deliverySessionId}`;
+      deliveryAccountId = bootstrapAccountId;
     }
     if (isMultipart) {
       const kind = files.some((f) => isAudioMime(f.type)) ? "voice" : "files";
@@ -2676,20 +2680,24 @@ ${note}` : note;
       }
       console.log(`[webchat:inbound] op=send-parsed kind=${kind} files=${stored.length} bytes=${Buffer.byteLength(text, "utf8")}`);
     }
-    if (deliverySessionId !== void 0 && await managerActivity(deliverySessionId) === "busy") {
+    if (target !== void 0 && await managerActivity(deliverySessionId) === "busy") {
       console.log(`[webchat:inbound] op=queued-busy sessionId=${deliverySessionId.slice(0, 8)} key=${deliveryKey}`);
     }
     const adminUserId = requesterUserId ?? void 0;
     const inboundStartedAt = Date.now();
     const sendId = sendIdFromResolve ?? ++sendSeq;
     const replyContext = resolveQuoted(deliverySessionId, quotedUuid, sendId);
-    const inbound = deliverySessionId !== void 0 ? await deps.handleInbound({ role: "admin", accountId: deliveryAccountId, key: deliveryKey, text, sessionId: deliverySessionId, adminUserId, ...replyContext ? { replyContext } : {} }) : await deps.handleInbound({ role: "admin", accountId: bootstrapAccountId, key: deliveryKey, text, adminUserId });
-    let turnSessionId = deliverySessionId;
-    if (turnSessionId === void 0) {
-      const canonAccount = scopeAccountId ? validateAccountId2(scopeAccountId) : null;
-      turnSessionId = resolveCanonical(accountId, canonAccount?.accountDir ?? null, requesterUserId, primaryUserId, scopeAccountId, multiAccount).sessionId;
-    }
-    const keyDisplay2 = deliveryKey.startsWith("session:") ? deliveryKey.slice(0, "session:".length + 8) : WEBCHAT_ADMIN_KEY;
+    const inbound = await deps.handleInbound({
+      role: "admin",
+      accountId: deliveryAccountId,
+      key: deliveryKey,
+      text,
+      sessionId: deliverySessionId,
+      adminUserId,
+      ...replyContext ? { replyContext } : {}
+    });
+    const turnSessionId = deliverySessionId;
+    const keyDisplay2 = deliveryKey.slice(0, "session:".length + 8);
     const baseline = jsonlSizeBytes(locateSession(turnSessionId).projectDir, turnSessionId);
     console.error(
       `[webchat:inbound] op=send-accepted key=${keyDisplay2} sendId=${sendId} baselineBytes=${baseline ?? "absent"} acceptMs=${Date.now() - inboundStartedAt} spawn=${inbound.spawn !== null ? "triggered" : "none"}`
@@ -2975,15 +2983,22 @@ var require_session = __commonJS({
     exports.withSession = withSession3;
     exports.__setDriverForTests = __setDriverForTests;
     var node_fs_1 = __require("fs");
+    var node_path_1 = __require("path");
     var neo4j_driver_1 = __importDefault(__require("neo4j-driver"));
     var driver2 = null;
     function password2() {
       if (process.env.NEO4J_PASSWORD)
         return process.env.NEO4J_PASSWORD;
-      const file = process.env.NEO4J_PASSWORD_FILE;
-      if (file && (0, node_fs_1.existsSync)(file))
-        return (0, node_fs_1.readFileSync)(file, "utf-8").trim();
-      throw new Error("[dispatch-read] Neo4j password not found in NEO4J_PASSWORD or NEO4J_PASSWORD_FILE");
+      const root = process.env.MAXY_PLATFORM_ROOT ?? process.env.PLATFORM_ROOT;
+      if (!root) {
+        throw new Error("[dispatch-read] neither MAXY_PLATFORM_ROOT nor PLATFORM_ROOT is set \u2014 cannot locate config/.neo4j-password");
+      }
+      const passwordFile = (0, node_path_1.resolve)(root, "config/.neo4j-password");
+      try {
+        return (0, node_fs_1.readFileSync)(passwordFile, "utf-8").trim();
+      } catch (err) {
+        throw new Error(`[dispatch-read] Neo4j password not found. Expected at ${passwordFile}, or in NEO4J_PASSWORD. Read failed: ${err instanceof Error ? err.message : String(err)}`);
+      }
     }
     function getDriver2() {
       if (driver2)
@@ -5087,10 +5102,10 @@ var require_dist7 = __commonJS({
 
 // server/index.ts
 init_dist();
-import { readFileSync as readFileSync54, existsSync as existsSync56, watchFile, readdirSync as readdirSync32, statSync as statSync30 } from "fs";
+import { readFileSync as readFileSync55, existsSync as existsSync55, watchFile, readdirSync as readdirSync32, statSync as statSync30 } from "fs";
 import { spawn as spawn3 } from "child_process";
 import { createHash as createHash8 } from "crypto";
-import { resolve as resolve50, join as join63, basename as basename17 } from "path";
+import { resolve as resolve52, join as join63, basename as basename17 } from "path";
 import { homedir as homedir5 } from "os";
 
 // server/lib/route-cache-watchers.ts
@@ -6341,12 +6356,12 @@ function getLanIp() {
   let fallback = null;
   for (const entries2 of Object.values(nets)) {
     if (!entries2) continue;
-    for (const entry of entries2) {
-      if (entry.family !== "IPv4" || entry.internal) continue;
-      if (entry.address.startsWith("192.168.") || entry.address.startsWith("10.")) {
-        return entry.address;
+    for (const entry2 of entries2) {
+      if (entry2.family !== "IPv4" || entry2.internal) continue;
+      if (entry2.address.startsWith("192.168.") || entry2.address.startsWith("10.")) {
+        return entry2.address;
       }
-      if (!fallback) fallback = entry.address;
+      if (!fallback) fallback = entry2.address;
     }
   }
   return fallback;
@@ -6650,20 +6665,20 @@ function buildX11Env(chromiumWrapperPath, transport = "vnc") {
 // server/routes/health.ts
 init_claude_agent();
 function checkPort(port2, timeoutMs = 500) {
-  return new Promise((resolve51) => {
+  return new Promise((resolve53) => {
     const socket = createConnection2(port2, "127.0.0.1");
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => {
       socket.destroy();
-      resolve51(true);
+      resolve53(true);
     });
     socket.once("error", () => {
       socket.destroy();
-      resolve51(false);
+      resolve53(false);
     });
     socket.once("timeout", () => {
       socket.destroy();
-      resolve51(false);
+      resolve53(false);
     });
   });
 }
@@ -7296,12 +7311,12 @@ function readConversationSummaries2(accountId) {
   const seen = /* @__PURE__ */ new Set();
   try {
     if (!existsSync3(dir)) return out;
-    for (const entry of readdirSync2(dir)) {
-      if (!entry.endsWith(".jsonl")) continue;
-      const stem = entry.slice(0, -".jsonl".length);
+    for (const entry2 of readdirSync2(dir)) {
+      if (!entry2.endsWith(".jsonl")) continue;
+      const stem = entry2.slice(0, -".jsonl".length);
       if (!isStorableStem(stem)) continue;
       const channelKey = fileStemToChannelKey(stem);
-      const file = join7(dir, entry);
+      const file = join7(dir, entry2);
       seen.add(file);
       let size;
       let mtimeMs;
@@ -7640,7 +7655,7 @@ async function defaultResolve(accountId) {
   return resolveSocket2(accountId);
 }
 async function fetchAvatar(accountId, jid, deps = {}) {
-  const resolve51 = deps.resolve;
+  const resolve53 = deps.resolve;
   const httpGet = deps.httpGet ?? defaultHttpGet;
   const maxAgeMs = deps.maxAgeMs ?? DEFAULT_MAX_AGE_MS;
   const cached3 = readAvatar(accountId, jid);
@@ -7650,7 +7665,7 @@ async function fetchAvatar(accountId, jid, deps = {}) {
     return "fresh";
   }
   console.log(`${TAG7} op=cache jid=${jid} hit=false ageMs=${ageMs2}`);
-  const res = resolve51 ? resolve51(accountId) : await defaultResolve(accountId);
+  const res = resolve53 ? resolve53(accountId) : await defaultResolve(accountId);
   if (!res.ok) {
     console.log(`${TAG7} op=no-socket jid=${jid} account=${accountId.slice(0, 8)} reason=${res.reason}`);
     return "no-socket";
@@ -7772,12 +7787,12 @@ async function sweepAvatars() {
 var TAG9 = "[wa-chatmeta]";
 function diffStoredAgainstLive(stored, live) {
   const out = [];
-  for (const entry of stored.values()) {
-    if (!entry.isGroup) continue;
-    const seen = live.get(entry.jid);
+  for (const entry2 of stored.values()) {
+    if (!entry2.isGroup) continue;
+    const seen = live.get(entry2.jid);
     if (seen === void 0) continue;
-    if (seen.name !== entry.name) {
-      out.push({ jid: entry.jid, stored: entry.name, live: seen.name, observedAt: seen.observedAt });
+    if (seen.name !== entry2.name) {
+      out.push({ jid: entry2.jid, stored: entry2.name, live: seen.name, observedAt: seen.observedAt });
     }
   }
   return out;
@@ -7793,13 +7808,13 @@ async function sweepChatMetadata() {
     const sock = conn.sock;
     const stored = readChatMetadata(conn.platformAccountId);
     const live = /* @__PURE__ */ new Map();
-    for (const entry of stored.values()) {
-      if (!entry.isGroup) continue;
+    for (const entry2 of stored.values()) {
+      if (!entry2.isGroup) continue;
       groups += 1;
       try {
-        const meta = await sock.groupMetadata(entry.jid);
+        const meta = await sock.groupMetadata(entry2.jid);
         if (typeof meta.subject === "string" && meta.subject.length > 0) {
-          live.set(entry.jid, { name: meta.subject, observedAt: (/* @__PURE__ */ new Date()).toISOString() });
+          live.set(entry2.jid, { name: meta.subject, observedAt: (/* @__PURE__ */ new Date()).toISOString() });
           checked2 += 1;
         }
       } catch {
@@ -8177,9 +8192,9 @@ function purgeNonSocketAccountManagers(accountDir, socketOwnerId) {
     if (targetId === socketOwnerId) return { removed: [] };
     const map = wa.accountManagers;
     if (!map || typeof map !== "object" || Array.isArray(map)) return { removed: [] };
-    const removed = Object.entries(map).map(([phone, entry]) => ({
+    const removed = Object.entries(map).map(([phone, entry2]) => ({
       phone,
-      managesAccount: typeof entry === "string" ? entry : entry && typeof entry === "object" && typeof entry.managesAccount === "string" ? entry.managesAccount : ""
+      managesAccount: typeof entry2 === "string" ? entry2 : entry2 && typeof entry2 === "object" && typeof entry2.managesAccount === "string" ? entry2.managesAccount : ""
     }));
     if (removed.length === 0) return { removed: [] };
     delete wa.accountManagers;
@@ -8482,10 +8497,10 @@ function purgeNonSocketRegisteredParties(accountDir, socketOwnerId) {
     if (targetId === socketOwnerId) return { removed: [] };
     const map = wa.registeredParties;
     if (!map || typeof map !== "object" || Array.isArray(map)) return { removed: [] };
-    const removed = Object.entries(map).map(([phone, entry]) => ({
+    const removed = Object.entries(map).map(([phone, entry2]) => ({
       phone,
-      account: entry && typeof entry === "object" && typeof entry.account === "string" ? entry.account : "",
-      party: entry && typeof entry === "object" && typeof entry.party === "string" ? entry.party : ""
+      account: entry2 && typeof entry2 === "object" && typeof entry2.account === "string" ? entry2.account : "",
+      party: entry2 && typeof entry2 === "object" && typeof entry2.party === "string" ? entry2.party : ""
     }));
     if (removed.length === 0) return { removed: [] };
     delete wa.registeredParties;
@@ -9141,8 +9156,8 @@ async function startLogin(opts) {
   await clearAuth(authDir);
   let resolveCode = null;
   let rejectCode = null;
-  const codePromise = new Promise((resolve51, reject) => {
-    resolveCode = resolve51;
+  const codePromise = new Promise((resolve53, reject) => {
+    resolveCode = resolve53;
     rejectCode = reject;
   });
   const codeTimer = setTimeout(
@@ -9319,27 +9334,27 @@ function bare(value) {
 function reconcilePersonIdentities(rows) {
   const perAccount = /* @__PURE__ */ new Map();
   for (const row of rows) {
-    let entry = perAccount.get(row.accountId);
-    if (!entry) {
-      entry = { seen: /* @__PURE__ */ new Map(), divergent: 0 };
-      perAccount.set(row.accountId, entry);
+    let entry2 = perAccount.get(row.accountId);
+    if (!entry2) {
+      entry2 = { seen: /* @__PURE__ */ new Map(), divergent: 0 };
+      perAccount.set(row.accountId, entry2);
     }
     const p = row.phone ? bare(row.phone) : null;
     const t = row.telephone ? bare(row.telephone) : null;
-    if (p && t && p !== t) entry.divergent += 1;
+    if (p && t && p !== t) entry2.divergent += 1;
     const key2 = p ?? t;
-    if (key2) entry.seen.set(key2, (entry.seen.get(key2) ?? 0) + 1);
+    if (key2) entry2.seen.set(key2, (entry2.seen.get(key2) ?? 0) + 1);
   }
   const accounts = [];
   let duplicates = 0;
   let divergent = 0;
-  for (const [accountId, entry] of perAccount) {
+  for (const [accountId, entry2] of perAccount) {
     let dup = 0;
-    for (const count of entry.seen.values()) if (count > 1) dup += count - 1;
+    for (const count of entry2.seen.values()) if (count > 1) dup += count - 1;
     duplicates += dup;
-    divergent += entry.divergent;
-    if (dup > 0 || entry.divergent > 0) {
-      accounts.push({ accountId, duplicates: dup, divergent: entry.divergent });
+    divergent += entry2.divergent;
+    if (dup > 0 || entry2.divergent > 0) {
+      accounts.push({ accountId, duplicates: dup, divergent: entry2.divergent });
     }
   }
   return {
@@ -9362,7 +9377,7 @@ function reconcileSelfPhoneAdmins(input) {
   for (const cred of nonHouse) {
     const selfPhone = cred.selfPhone;
     if (!selfPhone) continue;
-    if (input.adminPhones.some((entry) => phonesMatch(entry, selfPhone))) {
+    if (input.adminPhones.some((entry2) => phonesMatch(entry2, selfPhone))) {
       matches.push({ accountId: cred.accountId, phone: selfPhone });
     }
   }
@@ -9771,11 +9786,11 @@ init_src2();
 function buildRegisteredPartyReconcile(params) {
   const rows = [];
   const entries2 = Object.entries(params.registeredParties);
-  for (const [phone, entry] of entries2) {
+  for (const [phone, entry2] of entries2) {
     const shadowedBy = isAdminPhone(phone, params.adminPhones) ? "adminPhones" : managedAccountFor(params.accountManagers, phone) ? "accountManagers" : null;
-    const unresolved2 = !params.isValidAccount(entry.account);
+    const unresolved2 = !params.isValidAccount(entry2.account);
     if (shadowedBy || unresolved2) {
-      rows.push({ phone, account: entry.account, party: entry.party, shadowedBy, unresolved: unresolved2 });
+      rows.push({ phone, account: entry2.account, party: entry2.party, shadowedBy, unresolved: unresolved2 });
     }
   }
   const shadowed = rows.filter((r) => r.shadowedBy !== null).length;
@@ -10185,15 +10200,15 @@ app3.post("/config", async (c) => {
       const agents = [];
       if (existsSync9(agentsDir)) {
         try {
-          for (const entry of readdirSync8(agentsDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
-            if (!entry.isDirectory() || entry.name === "admin") continue;
-            const configPath3 = resolve8(agentsDir, entry.name, "config.json");
+          for (const entry2 of readdirSync8(agentsDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+            if (!entry2.isDirectory() || entry2.name === "admin") continue;
+            const configPath3 = resolve8(agentsDir, entry2.name, "config.json");
             if (!existsSync9(configPath3)) continue;
             try {
               const parsed = JSON.parse(readFileSync11(configPath3, "utf-8"));
-              agents.push({ slug: entry.name, displayName: parsed.displayName ?? entry.name });
+              agents.push({ slug: entry2.name, displayName: parsed.displayName ?? entry2.name });
             } catch {
-              console.error(`${TAG16} config action=list-public-agents error="failed to parse config.json for agent ${entry.name}" \u2014 skipping`);
+              console.error(`${TAG16} config action=list-public-agents error="failed to parse config.json for agent ${entry2.name}" \u2014 skipping`);
             }
           }
         } catch (err) {
@@ -10213,8 +10228,8 @@ app3.post("/config", async (c) => {
         const listDenial = bindingScopeDenial(c, callerAccountId, "list-account-managers");
         if (listDenial) return listDenial;
         const all = readAccountManagers(acct.accountDir);
-        const boundAccountOf = (entry) => typeof entry === "string" ? entry : entry.managesAccount;
-        const accountManagers = houseAdmin ? all : Object.fromEntries(Object.entries(all).filter(([, entry]) => boundAccountOf(entry) === callerAccountId));
+        const boundAccountOf = (entry2) => typeof entry2 === "string" ? entry2 : entry2.managesAccount;
+        const accountManagers = houseAdmin ? all : Object.fromEntries(Object.entries(all).filter(([, entry2]) => boundAccountOf(entry2) === callerAccountId));
         console.error(`${TAG16} config action=list-account-managers caller=${callerAccountId || "none"} houseAdmin=${houseAdmin ? "y" : "n"} count=${Object.keys(accountManagers).length} of=${Object.keys(all).length}`);
         return c.json({ ok: true, accountManagers });
       }
@@ -10252,7 +10267,7 @@ app3.post("/config", async (c) => {
         const listDenial = bindingScopeDenial(c, callerAccountId, "list-registered-parties");
         if (listDenial) return listDenial;
         const all = readRegisteredParties(acct.accountDir);
-        const registeredParties = houseAdmin ? all : Object.fromEntries(Object.entries(all).filter(([, entry]) => entry.account === callerAccountId));
+        const registeredParties = houseAdmin ? all : Object.fromEntries(Object.entries(all).filter(([, entry2]) => entry2.account === callerAccountId));
         console.error(`${TAG16} config action=list-registered-parties caller=${callerAccountId || "none"} houseAdmin=${houseAdmin ? "y" : "n"} count=${Object.keys(registeredParties).length} of=${Object.keys(all).length}`);
         return c.json({ ok: true, registeredParties });
       }
@@ -12162,10 +12177,10 @@ function readState(platformRoot5) {
     return {};
   }
 }
-function recordSuccess(platformRoot5, accountId, entry) {
+function recordSuccess(platformRoot5, accountId, entry2) {
   const path = stateFilePath(platformRoot5);
   const state = readState(platformRoot5);
-  state[accountId] = entry;
+  state[accountId] = entry2;
   try {
     writeFileSync6(path, JSON.stringify(state, null, 1));
   } catch (err) {
@@ -12439,10 +12454,10 @@ function readVisitsPushState(platformRoot5) {
     return {};
   }
 }
-function recordVisitsPush(platformRoot5, accountId, entry) {
+function recordVisitsPush(platformRoot5, accountId, entry2) {
   const path = visitsStateFilePath(platformRoot5);
   const state = readVisitsPushState(platformRoot5);
-  state[accountId] = entry;
+  state[accountId] = entry2;
   try {
     writeFileSync7(path, JSON.stringify(state, null, 1));
   } catch (err) {
@@ -13871,8 +13886,8 @@ function listBotEntries(config) {
 function resolveBotEntry(accounts, botId) {
   const hits = [];
   for (const a of accounts) {
-    for (const entry of listBotEntries(a.config.telegram)) {
-      if (entry.id === botId) hits.push({ accountId: a.accountId, accountDir: a.accountDir, entry });
+    for (const entry2 of listBotEntries(a.config.telegram)) {
+      if (entry2.id === botId) hits.push({ accountId: a.accountId, accountDir: a.accountDir, entry: entry2 });
     }
   }
   if (hits.length === 0) return { kind: "none" };
@@ -14252,6 +14267,12 @@ function pickActivity(entries2, grown, nowMs, concurrencyWindowMs) {
 // server/routes/session-reader.ts
 init_dist();
 var app7 = new Hono();
+function probeDataRef(path) {
+  const res = resolveDataPath(path);
+  if (!res.ok) {
+    console.error(`[data] op=download-ref-unservable root="data" path="${path}" reason=resolve-failed status=${res.status}`);
+  }
+}
 function enrichDownloads(turn, scratchpadRoot) {
   if (turn.kind !== "agent-file") return turn;
   let scratchpadReal = null;
@@ -14263,6 +14284,7 @@ function enrichDownloads(turn, scratchpadRoot) {
   const downloads = turn.files.map((f) => {
     const dataRel = relative3(DATA_ROOT, f);
     if (dataRel && !dataRel.startsWith("..") && !isAbsolute2(dataRel)) {
+      probeDataRef(dataRel);
       return { root: "data", path: dataRel };
     }
     if (scratchpadReal) {
@@ -15701,20 +15723,20 @@ function getTelegramGateway() {
 
 // app/lib/telegram/access-control.ts
 function checkTelegramAccess(params) {
-  const { senderId, entry } = params;
-  if (entry.role === "admin") {
-    const adminUsers = entry.adminUsers ?? [];
+  const { senderId, entry: entry2 } = params;
+  if (entry2.role === "admin") {
+    const adminUsers = entry2.adminUsers ?? [];
     if (adminUsers.includes(senderId)) {
       return { allowed: true, reason: "admin-binding", agentType: "admin" };
     }
     return { allowed: false, reason: "not-admin-user", agentType: "admin" };
   }
-  const policy = entry.dmPolicy ?? "disabled";
+  const policy = entry2.dmPolicy ?? "disabled";
   switch (policy) {
     case "open":
       return { allowed: true, reason: "dm-policy-open", agentType: "public" };
     case "allowlist": {
-      const allowFrom = entry.allowFrom ?? [];
+      const allowFrom = entry2.allowFrom ?? [];
       if (allowFrom.includes(senderId)) {
         return { allowed: true, reason: "allowlist-match", agentType: "public" };
       }
@@ -16224,8 +16246,8 @@ var NOTIFY_MAX = 5e3;
 var cache = /* @__PURE__ */ new Map();
 function isTelegramNotifyDuplicate(notifyId) {
   const now = Date.now();
-  const entry = cache.get(notifyId);
-  if (entry && now - entry.ts <= NOTIFY_TTL_MS) return true;
+  const entry2 = cache.get(notifyId);
+  if (entry2 && now - entry2.ts <= NOTIFY_TTL_MS) return true;
   for (const [key2, e] of cache) {
     if (now - e.ts > NOTIFY_TTL_MS) cache.delete(key2);
   }
@@ -16324,9 +16346,9 @@ app11.post("/", async (c) => {
     console.error(`${TAG26} op=reject reason=duplicate-bot-id botId=${botId} accounts=${resolved.count}`);
     return c.json({ ok: false }, 401);
   }
-  const { accountId, accountDir, entry } = resolved;
-  const agentSlug = entry.role === "admin" ? "admin" : entry.agent;
-  console.error(`${TAG26} op=entry botId=${botId} accountId=${accountId} role=${entry.role} agent=${agentSlug}`);
+  const { accountId, accountDir, entry: entry2 } = resolved;
+  const agentSlug = entry2.role === "admin" ? "admin" : entry2.agent;
+  console.error(`${TAG26} op=entry botId=${botId} accountId=${accountId} role=${entry2.role} agent=${agentSlug}`);
   const sp = secretPath(botId);
   if (!existsSync22(sp)) {
     console.error(`${TAG26} op=secret botId=${botId} result=missing-file`);
@@ -16349,7 +16371,7 @@ app11.post("/", async (c) => {
   console.error(
     `${TAG26} op=inbound-kind botId=${botId} update=${shape.envelope} content=${shape.content} isEdit=${shape.isEdit ? "yes" : "no"}`
   );
-  const decision = routeTelegramUpdate({ update, entry });
+  const decision = routeTelegramUpdate({ update, entry: entry2 });
   noteInboundKind(shape.primaryKind, decision.kind === "dispatch");
   if (decision.kind === "ignore") {
     console.error(`${TAG26} op=ignore botId=${botId} reason=${decision.reason}`);
@@ -16369,7 +16391,7 @@ app11.post("/", async (c) => {
     if (decision.allowed) {
       const cbKey = telegramChannelKey(botId, decision.senderId);
       const cbAt = (/* @__PURE__ */ new Date()).toISOString();
-      const cbAdminUserId = entry.role === "admin" ? resolveTelegramAdminUserId({ accountId, chatId: decision.senderId }) : null;
+      const cbAdminUserId = entry2.role === "admin" ? resolveTelegramAdminUserId({ accountId, chatId: decision.senderId }) : null;
       appendMessage2(accountId, {
         messageId: `telegram:${accountId}:${cbKey}:cb:${decision.callbackId}`,
         sessionId: cbAdminUserId ? adminSessionIdFor(accountId, decision.senderId, cbAdminUserId) : adminSessionIdFor(accountId, decision.senderId, void 0, botId),
@@ -16380,13 +16402,13 @@ app11.post("/", async (c) => {
         senderName: decision.senderDisplay,
         chatId: String(decision.chatId),
         channelKey: cbKey,
-        scope: entry.role === "admin" ? "admin" : "public",
+        scope: entry2.role === "admin" ? "admin" : "public",
         origin: "inbound",
         createdAt: cbAt
       });
     }
     const answerStartedAt = Date.now();
-    const answered3 = await answerTelegramCallback(entry.token, decision.callbackId);
+    const answered3 = await answerTelegramCallback(entry2.token, decision.callbackId);
     const outcome = !answered3.ok ? "error" : decision.allowed ? "stored" : "refused";
     console.error(
       `${TAG26} op=callback-answered botId=${botId} callbackId=${decision.callbackId} ms=${Date.now() - answerStartedAt} outcome=${outcome}${answered3.error ? ` error=${logValue(answered3.error)}` : ""}`
@@ -16396,8 +16418,8 @@ app11.post("/", async (c) => {
   const { senderId, chatId, text } = decision;
   console.error(`${TAG26} op=access botId=${botId} senderId=${senderId} allowed=true reason=${decision.reason}`);
   const channelKey = telegramChannelKey(botId, senderId);
-  const scope = entry.role === "admin" ? "admin" : "public";
-  const adminUserId = entry.role === "admin" ? resolveTelegramAdminUserId({ accountId, chatId: senderId }) : null;
+  const scope = entry2.role === "admin" ? "admin" : "public";
+  const adminUserId = entry2.role === "admin" ? resolveTelegramAdminUserId({ accountId, chatId: senderId }) : null;
   const sessionId = adminUserId ? adminSessionIdFor(accountId, senderId, adminUserId) : adminSessionIdFor(accountId, senderId, void 0, botId);
   const inboundAt = (/* @__PURE__ */ new Date()).toISOString();
   const editSuffix = decision.isEdit ? `:edit:${decision.editDate}` : "";
@@ -16473,7 +16495,7 @@ app11.post("/", async (c) => {
       });
     }
   }
-  const active = entry.role === "admin" ? true : isActiveAgentSlug(accountDir, entry.agent);
+  const active = entry2.role === "admin" ? true : isActiveAgentSlug(accountDir, entry2.agent);
   console.error(`${TAG26} op=agent botId=${botId} slug=${agentSlug} active=${active}`);
   if (!active) {
     console.error(`${TAG26} op=reject reason=agent-inactive botId=${botId} agent=${agentSlug}`);
@@ -16485,7 +16507,7 @@ app11.post("/", async (c) => {
     return c.json({ ok: true }, 200);
   }
   const reply = async (replyText) => {
-    const sent = await sendTelegramText(entry.token, chatId, replyText);
+    const sent = await sendTelegramText(entry2.token, chatId, replyText);
     if (sent.ok) {
       const at = (/* @__PURE__ */ new Date()).toISOString();
       appendMessage2(accountId, {
@@ -16529,7 +16551,7 @@ app11.post("/", async (c) => {
     });
     if (line) console.error(line);
   }
-  const media = await downloadTelegramMedia({ token: entry.token, botId, items: decision.media });
+  const media = await downloadTelegramMedia({ token: entry2.token, botId, items: decision.media });
   void (async () => {
     const heard = await transcribeTelegramAudio({
       botId,
@@ -16541,10 +16563,10 @@ app11.post("/", async (c) => {
       accountId,
       accountDir,
       botId,
-      botToken: entry.token,
+      botToken: entry2.token,
       agentSlug,
       senderId,
-      role: entry.role,
+      role: entry2.role,
       personId: null,
       // Task 2078 — the admin person this chat is bound to (the users.json
       // telegram binding). It is the SUBJECT of the session id, so one admin's
@@ -16876,16 +16898,27 @@ function writeAdminEntry(input) {
     }
     const rowsBefore = users.map((u) => id8(u.userId)).join(",");
     const existing = users.findIndex((u) => u.userId === input.userId);
+    const pinRotated = existing !== -1 && users[existing].pin !== input.pin;
+    const boundFields = [
+      input.phone !== void 0 ? "phone" : null,
+      input.telegram !== void 0 ? "telegram" : null
+    ].filter(Boolean);
     if (existing === -1) {
-      users.push({ userId: input.userId, pin: input.pin });
+      const row = { userId: input.userId, pin: input.pin };
+      if (input.phone !== void 0) row.phone = input.phone;
+      if (input.telegram !== void 0) row.telegram = input.telegram;
+      users.push(row);
     } else {
-      users[existing] = { ...users[existing], pin: input.pin };
+      const row = { ...users[existing], pin: input.pin };
+      if (input.phone !== void 0) row.phone = input.phone;
+      if (input.telegram !== void 0) row.telegram = input.telegram;
+      users[existing] = row;
     }
     writeFileAtomic(input.usersFile, JSON.stringify(users, null, 2) + "\n", 384);
     result.usersJsonResult = "ok";
     appendUsersAuditLine(input.audit, {
-      action: existing === -1 ? "add" : "set-pin",
-      field: existing === -1 ? "row" : "pin",
+      action: existing === -1 ? "add" : pinRotated ? "set-pin" : "set-binding",
+      field: existing === -1 ? "row" : pinRotated ? "pin" : boundFields.join(","),
       rowsBefore,
       rowsAfter: users.map((u) => id8(u.userId)).join(",")
     });
@@ -16942,9 +16975,9 @@ function computeAdminStoreDivergence(input) {
       result.errors.push({ source: input.accountsDir, detail: err instanceof Error ? err.message : String(err) });
       return result;
     }
-    for (const entry of entries2) {
-      if (entry.startsWith(".")) continue;
-      const accountDir = join35(input.accountsDir, entry);
+    for (const entry2 of entries2) {
+      if (entry2.startsWith(".")) continue;
+      const accountDir = join35(input.accountsDir, entry2);
       try {
         if (!statSync18(accountDir).isDirectory()) continue;
       } catch {
@@ -17395,7 +17428,7 @@ var onboarding_default = app13;
 
 // server/routes/dispatch.ts
 init_dist();
-import { resolve as resolve22 } from "path";
+import { resolve as resolve23 } from "path";
 import { randomUUID as randomUUID5 } from "crypto";
 
 // ../lib/dispatch-read/src/config.ts
@@ -17439,16 +17472,26 @@ function terminalVisitStatuses(cfg) {
 }
 
 // ../lib/dispatch-read/src/session.ts
-import { existsSync as existsSync27, readFileSync as readFileSync32 } from "fs";
+import { readFileSync as readFileSync32 } from "fs";
+import { resolve as resolve22 } from "path";
 import neo4j from "neo4j-driver";
 var driver = null;
 function password() {
   if (process.env.NEO4J_PASSWORD) return process.env.NEO4J_PASSWORD;
-  const file = process.env.NEO4J_PASSWORD_FILE;
-  if (file && existsSync27(file)) return readFileSync32(file, "utf-8").trim();
-  throw new Error(
-    "[dispatch-read] Neo4j password not found in NEO4J_PASSWORD or NEO4J_PASSWORD_FILE"
-  );
+  const root = process.env.MAXY_PLATFORM_ROOT ?? process.env.PLATFORM_ROOT;
+  if (!root) {
+    throw new Error(
+      "[dispatch-read] neither MAXY_PLATFORM_ROOT nor PLATFORM_ROOT is set \u2014 cannot locate config/.neo4j-password"
+    );
+  }
+  const passwordFile = resolve22(root, "config/.neo4j-password");
+  try {
+    return readFileSync32(passwordFile, "utf-8").trim();
+  } catch (err) {
+    throw new Error(
+      `[dispatch-read] Neo4j password not found. Expected at ${passwordFile}, or in NEO4J_PASSWORD. Read failed: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
 }
 function getDriver() {
   if (driver) return driver;
@@ -17888,7 +17931,7 @@ function accountFor(cacheKey) {
   if (!cacheKey) return null;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) return null;
-  return { accountId, accountDir: resolve22(ACCOUNTS_DIR, accountId) };
+  return { accountId, accountDir: resolve23(ACCOUNTS_DIR, accountId) };
 }
 var app14 = new Hono();
 app14.use("*", requireAdminSession);
@@ -18712,7 +18755,7 @@ init_dist();
 init_paths();
 init_remote_auth();
 init_loop_registry();
-import { appendFileSync as appendFileSync3, existsSync as existsSync28, renameSync as renameSync9, statSync as statSync19 } from "fs";
+import { appendFileSync as appendFileSync3, existsSync as existsSync27, renameSync as renameSync9, statSync as statSync19 } from "fs";
 import { join as join38 } from "path";
 var CLIENT_ERRORS_LOG = join38(LOG_DIR, "client-errors.log");
 var MAX_LOG_SIZE = 10 * 1024 * 1024;
@@ -18771,7 +18814,7 @@ function stackHead(stack) {
 }
 function rotateIfNeeded() {
   try {
-    if (!existsSync28(CLIENT_ERRORS_LOG)) return;
+    if (!existsSync27(CLIENT_ERRORS_LOG)) return;
     const stats = statSync19(CLIENT_ERRORS_LOG);
     if (stats.size < MAX_LOG_SIZE) return;
     renameSync9(CLIENT_ERRORS_LOG, CLIENT_ERRORS_LOG + ".1");
@@ -18987,15 +19030,15 @@ function operatorRoleFor(config, userId) {
 async function buildAccountOptionList(accounts, userId) {
   const houseAccount = accounts.find((a) => a.config.role === "house");
   console.log(`[admin-accounts] op=list count=${accounts.length} house=${houseAccount?.accountId ?? "none"}`);
-  const resolve51 = async (a) => {
+  const resolve53 = async (a) => {
     const businessName = await fetchAccountName(a.accountId) || void 0;
     return { accountId: a.accountId, businessName, role: operatorRoleFor(a.config, userId), isHouse: a.config.role === "house" };
   };
   const houseOptions = await Promise.all(
-    accounts.filter((a) => a.config.role === "house").map(resolve51)
+    accounts.filter((a) => a.config.role === "house").map(resolve53)
   );
   const nonHouseOptions = await Promise.all(
-    accounts.filter((a) => a.config.role !== "house").map(resolve51)
+    accounts.filter((a) => a.config.role !== "house").map(resolve53)
   );
   const sortKey = (o) => (o.businessName || o.accountId).toLowerCase();
   nonHouseOptions.sort((x, y) => {
@@ -19137,18 +19180,18 @@ var accounts_default = app18;
 init_dist();
 init_paths();
 init_claude_agent();
-import { existsSync as existsSync30, readdirSync as readdirSync20, readFileSync as readFileSync33, statSync as statSync20 } from "fs";
-import { resolve as resolve23, basename as basename11 } from "path";
+import { existsSync as existsSync29, readdirSync as readdirSync20, readFileSync as readFileSync33, statSync as statSync20 } from "fs";
+import { resolve as resolve24, basename as basename11 } from "path";
 
 // app/lib/logs-read-resolve.ts
-import { existsSync as existsSync29 } from "fs";
+import { existsSync as existsSync28 } from "fs";
 import { join as join39 } from "path";
 function resolveSessionLogPaths(filename, logDirs) {
   const tried = [filename];
   const hits = [];
   for (const dir of logDirs) {
     const fullPath = join39(dir, filename);
-    if (existsSync29(fullPath)) {
+    if (existsSync28(fullPath)) {
       hits.push({ path: fullPath, dir });
     }
   }
@@ -19166,13 +19209,13 @@ app19.get("/", async (c) => {
   const sessionIdParam = c.req.query("sessionId");
   const cacheKeyParam = c.req.query("cacheKey");
   const download = c.req.query("download") === "1";
-  const logDirs = listValidAccounts().slice().sort((a, b) => a.accountId.localeCompare(b.accountId)).map((a) => resolve23(a.accountDir, "logs"));
+  const logDirs = listValidAccounts().slice().sort((a, b) => a.accountId.localeCompare(b.accountId)).map((a) => resolve24(a.accountDir, "logs"));
   logDirs.push(LOG_DIR);
   if (fileParam) {
     const safe = basename11(fileParam);
     const searched = [];
     for (const dir of logDirs) {
-      const filePath = resolve23(dir, safe);
+      const filePath = resolve24(dir, safe);
       searched.push(filePath);
       try {
         const buffer = readFileSync33(filePath);
@@ -19275,7 +19318,7 @@ app19.get("/", async (c) => {
   const seen = /* @__PURE__ */ new Set();
   const logs = {};
   for (const dir of logDirs) {
-    if (!existsSync30(dir)) continue;
+    if (!existsSync29(dir)) continue;
     let files;
     try {
       files = readdirSync20(dir).filter((f) => f.endsWith(".log"));
@@ -19284,10 +19327,10 @@ app19.get("/", async (c) => {
       console.warn(`[admin/logs] readdir-fail dir=${dir} reason=${reason}`);
       continue;
     }
-    files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync20(resolve23(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
+    files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync20(resolve24(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
       seen.add(name);
       try {
-        const content = readFileSync33(resolve23(dir, name));
+        const content = readFileSync33(resolve24(dir, name));
         const tail = content.length > TAIL_BYTES ? content.subarray(content.length - TAIL_BYTES).toString("utf-8") : content.toString("utf-8");
         logs[name] = tail.trim() || "(empty)";
       } catch (err) {
@@ -19340,12 +19383,12 @@ init_claude_agent();
 init_data_path();
 init_attachments();
 import { readFile as readFile6, readdir as readdir2 } from "fs/promises";
-import { existsSync as existsSync31 } from "fs";
-import { resolve as resolve24 } from "path";
+import { existsSync as existsSync30 } from "fs";
+import { resolve as resolve25 } from "path";
 var app21 = new Hono();
 var ATTACHMENT_ID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 function uploadsDirFor(accountId, attachmentId) {
-  return resolve24(DATA_ROOT, "accounts", accountId, "uploads", attachmentId);
+  return resolve25(DATA_ROOT, "accounts", accountId, "uploads", attachmentId);
 }
 app21.get("/:attachmentId", requireAdminSession, async (c) => {
   const attachmentId = c.req.param("attachmentId");
@@ -19363,12 +19406,12 @@ app21.get("/:attachmentId", requireAdminSession, async (c) => {
   }
   let accountId = pinnedAccountId;
   let dir = uploadsDirFor(accountId, attachmentId);
-  let found = existsSync31(dir);
+  let found = existsSync30(dir);
   if (!found) {
     for (const candidate of listValidAccounts()) {
       if (candidate.accountId === pinnedAccountId) continue;
       const candidateDir = uploadsDirFor(candidate.accountId, attachmentId);
-      if (existsSync31(candidateDir)) {
+      if (existsSync30(candidateDir)) {
         accountId = candidate.accountId;
         dir = candidateDir;
         found = true;
@@ -19382,8 +19425,8 @@ app21.get("/:attachmentId", requireAdminSession, async (c) => {
   if (!found) {
     return new Response("Not found", { status: 404 });
   }
-  const metaPath = resolve24(dir, `${attachmentId}.meta.json`);
-  if (!existsSync31(metaPath)) {
+  const metaPath = resolve25(dir, `${attachmentId}.meta.json`);
+  if (!existsSync30(metaPath)) {
     return new Response("Not found", { status: 404 });
   }
   let meta;
@@ -19397,7 +19440,7 @@ app21.get("/:attachmentId", requireAdminSession, async (c) => {
   if (!dataFile) {
     return new Response("Not found", { status: 404 });
   }
-  const filePath = resolve24(dir, dataFile);
+  const filePath = resolve25(dir, dataFile);
   const buffer = await readFile6(filePath);
   const inlineSafe = isInlineSafeMime(meta.mimeType);
   const safeName2 = meta.filename.replace(/["\\\r\n]/g, "_");
@@ -19423,7 +19466,7 @@ init_neo4j_store();
 init_data_path();
 init_attachments();
 import { readFile as readFile7 } from "fs/promises";
-import { existsSync as existsSync32, statSync as statSync21 } from "fs";
+import { existsSync as existsSync31, statSync as statSync21 } from "fs";
 var app22 = new Hono();
 app22.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
@@ -19444,7 +19487,7 @@ app22.get("/", requireAdminSession, async (c) => {
     return c.json({ error: "Not found" }, 404);
   }
   const resolution = resolveClaudeUploadsPath(`${sessionId}/${file}`);
-  if (!resolution.ok || !existsSync32(resolution.absolute) || !statSync21(resolution.absolute).isFile()) {
+  if (!resolution.ok || !existsSync31(resolution.absolute) || !statSync21(resolution.absolute).isFile()) {
     console.log(`[session-upload] op=miss session=${short2} file=${file} status=404 reason=absent`);
     return c.json({ error: "Not found" }, 404);
   }
@@ -19470,12 +19513,12 @@ init_helpers();
 init_account_scope();
 init_neo4j_store();
 init_account();
-import { resolve as resolve25 } from "path";
-import { readdirSync as readdirSync22, readFileSync as readFileSync35, existsSync as existsSync34, rmSync as rmSync5, renameSync as renameSync10, mkdirSync as mkdirSync7, writeFileSync as writeFileSync15, chmodSync } from "fs";
+import { resolve as resolve26 } from "path";
+import { readdirSync as readdirSync22, readFileSync as readFileSync35, existsSync as existsSync33, rmSync as rmSync5, renameSync as renameSync10, mkdirSync as mkdirSync7, writeFileSync as writeFileSync15, chmodSync } from "fs";
 import { execFileSync as execFileSync6 } from "child_process";
 
 // ../services/claude-session-manager/src/tool-surface.ts
-import { readFileSync as readFileSync34, readdirSync as readdirSync21, statSync as statSync22, existsSync as existsSync33 } from "fs";
+import { readFileSync as readFileSync34, readdirSync as readdirSync21, statSync as statSync22, existsSync as existsSync32 } from "fs";
 import { createHash as createHash5 } from "crypto";
 import { join as join40 } from "path";
 
@@ -19721,7 +19764,7 @@ function parseMcpBlock(frontmatter, pluginDir) {
 function loadToolSurface(pluginsRoots) {
   const roots = Array.isArray(pluginsRoots) ? pluginsRoots : [pluginsRoots];
   for (const r of roots) {
-    if (!existsSync33(r)) throw new ToolSurfaceError("plugins-root-missing", r);
+    if (!existsSync32(r)) throw new ToolSurfaceError("plugins-root-missing", r);
   }
   const admin = /* @__PURE__ */ new Set();
   const pub = /* @__PURE__ */ new Set();
@@ -19737,7 +19780,7 @@ function loadToolSurface(pluginsRoots) {
       return;
     }
     const manifestPath = join40(pluginDir, "PLUGIN.md");
-    if (!existsSync33(manifestPath)) return;
+    if (!existsSync32(manifestPath)) return;
     const raw = readFileSync34(manifestPath, "utf-8");
     const frontmatter = extractFrontmatter(raw, plugin);
     const tools = parseToolsBlock(frontmatter, plugin);
@@ -19918,7 +19961,7 @@ function agentRiskClass(tools, riskByTool) {
 // server/routes/admin/agents.ts
 var SLUG_UNSAFE = (s) => s.includes("/") || s.includes("..") || s.includes("\\");
 function subdirs(dir) {
-  if (!existsSync34(dir)) return [];
+  if (!existsSync33(dir)) return [];
   try {
     return readdirSync22(dir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
   } catch {
@@ -19939,7 +19982,7 @@ var SPECIALISTS_DIR = ["specialists", "agents"];
 var QUARANTINE_DIR = ["specialists", "agents-disabled"];
 var DISABLED_STORE = "agents-disabled.json";
 function loadRiskSurface() {
-  const roots = [resolve25(PLATFORM_ROOT, "plugins"), resolve25(PLATFORM_ROOT, "..", "premium-plugins")].filter((r) => existsSync34(r));
+  const roots = [resolve26(PLATFORM_ROOT, "plugins"), resolve26(PLATFORM_ROOT, "..", "premium-plugins")].filter((r) => existsSync33(r));
   try {
     return { riskByTool: loadToolSurface(roots).riskByTool, failed: null };
   } catch (err) {
@@ -19950,8 +19993,8 @@ function loadRiskSurface() {
   }
 }
 function readDisabledStoreStrict(accountDir) {
-  const p = resolve25(accountDir, DISABLED_STORE);
-  if (!existsSync34(p)) return /* @__PURE__ */ new Set();
+  const p = resolve26(accountDir, DISABLED_STORE);
+  if (!existsSync33(p)) return /* @__PURE__ */ new Set();
   const parsed = JSON.parse(readFileSync35(p, "utf-8"));
   if (!Array.isArray(parsed.disabled)) throw new Error("disabled is not an array");
   return new Set(parsed.disabled.filter((x) => typeof x === "string"));
@@ -19965,40 +20008,88 @@ function readDisabledStore(accountDir) {
     return /* @__PURE__ */ new Set();
   }
 }
-function authoredAgentFilenames(accountDir) {
-  const pluginsDir = resolve25(accountDir, "plugins");
-  const names = /* @__PURE__ */ new Set();
+function authoredAgentFiles(accountDir) {
+  const pluginsDir = resolve26(accountDir, "plugins");
+  const byName = /* @__PURE__ */ new Map();
   for (const plugin of subdirs(pluginsDir)) {
-    const dir = resolve25(pluginsDir, plugin, "agents");
-    if (!existsSync34(dir)) continue;
+    const dir = resolve26(pluginsDir, plugin, "agents");
+    if (!existsSync33(dir)) continue;
     try {
-      for (const entry of readdirSync22(dir)) if (entry.endsWith(".md")) names.add(entry);
+      for (const entry2 of readdirSync22(dir)) {
+        if (!entry2.endsWith(".md")) continue;
+        const path = resolve26(dir, entry2);
+        const paths = byName.get(entry2);
+        if (paths) paths.push(path);
+        else byName.set(entry2, [path]);
+      }
     } catch (err) {
       console.error(`[admin/agents] op=authored-scan read-failed plugin=${plugin} error="${err}"`);
     }
   }
-  return names;
+  return byName;
 }
 function shippedSourceDirs(accountDir) {
   return [
-    resolve25(accountDir, ...SPECIALISTS_DIR),
-    resolve25(accountDir, ...QUARANTINE_DIR),
-    resolve25(PLATFORM_ROOT, "templates", "specialists", "agents")
+    resolve26(accountDir, ...SPECIALISTS_DIR),
+    resolve26(accountDir, ...QUARANTINE_DIR),
+    resolve26(PLATFORM_ROOT, "templates", "specialists", "agents")
   ];
 }
+function readRowFields(path) {
+  const { fm } = splitFrontmatter(readFileSync35(path, "utf-8"));
+  return {
+    name: fm.name ?? "",
+    description: fm.description ?? "",
+    tools: new Set(parseToolsLine(fm.tools))
+  };
+}
+function divergentFields(a, b) {
+  const out = [];
+  if (a.name !== b.name) out.push("name");
+  if (a.description !== b.description) out.push("description");
+  if (a.tools.size !== b.tools.size || [...a.tools].some((t) => !b.tools.has(t))) out.push("tools");
+  return out;
+}
+function compareToAuthored(candidatePath, authoredPaths, filename) {
+  let candidate;
+  try {
+    candidate = readRowFields(candidatePath);
+  } catch (err) {
+    console.error(`[admin/agents] op=list-shipped-compare-failed file=${filename} side=found reason="${err}"`);
+    return { verdict: "unreadable" };
+  }
+  let firstDivergence = null;
+  let anyUnreadable = false;
+  for (const path of authoredPaths) {
+    let authored;
+    try {
+      authored = readRowFields(path);
+    } catch (err) {
+      console.error(`[admin/agents] op=list-shipped-compare-failed file=${filename} side=authored reason="${err}"`);
+      anyUnreadable = true;
+      continue;
+    }
+    const fields = divergentFields(candidate, authored);
+    if (fields.length === 0) return { verdict: "matched" };
+    firstDivergence ??= { authoredPath: path, fields };
+  }
+  if (firstDivergence) return { verdict: "divergent", ...firstDivergence };
+  if (anyUnreadable) return { verdict: "unreadable" };
+  return { verdict: "unreadable" };
+}
 function writeDisabledStore(accountDir, disabled) {
-  const path = resolve25(accountDir, DISABLED_STORE);
+  const path = resolve26(accountDir, DISABLED_STORE);
   writeFileSync15(path, `${JSON.stringify({ disabled: [...disabled].sort() }, null, 2)}
 `, { mode: 384 });
   chmodSync(path, 384);
 }
-function listShipped(accountDir, riskByTool, disabled, riskSurfaceFailed, authoredFilenames) {
+function listShipped(accountDir, riskByTool, disabled, riskSurfaceFailed, authoredFiles) {
   const dirs = shippedSourceDirs(accountDir);
   const names = /* @__PURE__ */ new Set();
   for (const dir of dirs) {
-    if (!existsSync34(dir)) continue;
+    if (!existsSync33(dir)) continue;
     try {
-      for (const entry of readdirSync22(dir)) if (entry.endsWith(".md")) names.add(entry);
+      for (const entry2 of readdirSync22(dir)) if (entry2.endsWith(".md")) names.add(entry2);
     } catch (err) {
       console.error(`[admin/agents] op=list-shipped read-failed dir=${dir} error="${err}"`);
     }
@@ -20006,16 +20097,27 @@ function listShipped(accountDir, riskByTool, disabled, riskSurfaceFailed, author
   const shipped = [];
   let shippedSkipped = 0;
   let deduped = 0;
+  let divergent = 0;
   for (const filename of [...names].sort()) {
-    const source = dirs.find((d) => existsSync34(resolve25(d, filename)));
+    const source = dirs.find((d) => existsSync33(resolve26(d, filename)));
     if (!source) continue;
-    if ((source === dirs[0] || source === dirs[1]) && authoredFilenames.has(filename)) {
-      deduped++;
-      console.log(`[admin/agents] op=list-shipped-dedup file=${filename}`);
-      continue;
+    const authoredPaths = source === dirs[0] || source === dirs[1] ? authoredFiles.get(filename) : void 0;
+    if (authoredPaths) {
+      const cmp = compareToAuthored(resolve26(source, filename), authoredPaths, filename);
+      if (cmp.verdict === "matched") {
+        deduped++;
+        console.log(`[admin/agents] op=list-shipped-dedup file=${filename}`);
+        continue;
+      }
+      if (cmp.verdict === "divergent") {
+        divergent++;
+        console.log(
+          `[admin/agents] op=list-shipped-divergent file=${filename} found=${resolve26(source, filename)} authored=${cmp.authoredPath} fields=${cmp.fields.join(",")}`
+        );
+      }
     }
     try {
-      const { fm } = splitFrontmatter(readFileSync35(resolve25(source, filename), "utf-8"));
+      const { fm } = splitFrontmatter(readFileSync35(resolve26(source, filename), "utf-8"));
       if (!fm.name) {
         shippedSkipped++;
         console.error(`[admin/agents] op=list-shipped-skip file=${filename} reason=no-name`);
@@ -20048,7 +20150,7 @@ function listShipped(accountDir, riskByTool, disabled, riskSurfaceFailed, author
       console.error(`[admin/agents] op=list-shipped-skip file=${filename} error="${err}"`);
     }
   }
-  return { shipped, shippedSkipped, deduped };
+  return { shipped, shippedSkipped, deduped, divergent };
 }
 function parseToolsLine(raw) {
   return raw ? raw.split(",").map((t) => t.trim()).filter(Boolean) : [];
@@ -20069,31 +20171,31 @@ function classify(tools, riskByTool, riskSurfaceFailed) {
   return agentRiskClass(tools, riskByTool);
 }
 function listSpecialists(accountDir, riskByTool, riskSurfaceFailed) {
-  const pluginsDir = resolve25(accountDir, "plugins");
+  const pluginsDir = resolve26(accountDir, "plugins");
   const specialists = [];
   let specialistsSkipped = 0;
   for (const plugin of subdirs(pluginsDir).sort()) {
-    const agentsDirP = resolve25(pluginsDir, plugin, "agents");
-    if (!existsSync34(agentsDirP)) continue;
+    const agentsDirP = resolve26(pluginsDir, plugin, "agents");
+    if (!existsSync33(agentsDirP)) continue;
     let entries2;
     try {
       entries2 = readdirSync22(agentsDirP, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
     } catch {
       continue;
     }
-    for (const entry of entries2) {
-      if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
+    for (const entry2 of entries2) {
+      if (!entry2.isFile() || !entry2.name.endsWith(".md")) continue;
       try {
-        const { fm } = splitFrontmatter(readFileSync35(resolve25(agentsDirP, entry.name), "utf-8"));
+        const { fm } = splitFrontmatter(readFileSync35(resolve26(agentsDirP, entry2.name), "utf-8"));
         if (!fm.name) {
           specialistsSkipped++;
-          console.error(`[admin/agents] op=list-specialist-skip plugin=${plugin} file=${entry.name}`);
+          console.error(`[admin/agents] op=list-specialist-skip plugin=${plugin} file=${entry2.name}`);
           continue;
         }
         const specialistTools = parseToolsLine(fm.tools);
         const r = classify(specialistTools, riskByTool, riskSurfaceFailed);
         specialists.push({
-          slug: entry.name.replace(/\.md$/, ""),
+          slug: entry2.name.replace(/\.md$/, ""),
           displayName: fm.name,
           kind: "specialist",
           origin: "specialist",
@@ -20116,11 +20218,11 @@ function listSpecialists(accountDir, riskByTool, riskSurfaceFailed) {
           // have the surface claim an agent is stopped while it is still being
           // spawned. Absence from the live dir alone is also not the test: a
           // specialist that was never activated was never switched off either.
-          disabled: existsSync34(resolve25(accountDir, ...QUARANTINE_DIR, entry.name)) && !existsSync34(resolve25(accountDir, ...SPECIALISTS_DIR, entry.name))
+          disabled: existsSync33(resolve26(accountDir, ...QUARANTINE_DIR, entry2.name)) && !existsSync33(resolve26(accountDir, ...SPECIALISTS_DIR, entry2.name))
         });
       } catch {
         specialistsSkipped++;
-        console.error(`[admin/agents] op=list-specialist-skip plugin=${plugin} file=${entry.name}`);
+        console.error(`[admin/agents] op=list-specialist-skip plugin=${plugin} file=${entry2.name}`);
       }
     }
   }
@@ -20143,20 +20245,20 @@ app23.get("/", requireAdminSession, (c) => {
   const disabled = readDisabledStore(account.accountDir);
   const agents = [];
   let skipped = 0;
-  const agentsDir = resolve25(account.accountDir, "agents");
-  if (existsSync34(agentsDir)) {
+  const agentsDir = resolve26(account.accountDir, "agents");
+  if (existsSync33(agentsDir)) {
     try {
       const entries2 = readdirSync22(agentsDir, { withFileTypes: true });
-      for (const entry of entries2.sort((a, b) => a.name.localeCompare(b.name))) {
-        if (!entry.isDirectory()) continue;
-        if (entry.name === "admin") continue;
-        const configPath3 = resolve25(agentsDir, entry.name, "config.json");
-        if (!existsSync34(configPath3)) continue;
+      for (const entry2 of entries2.sort((a, b) => a.name.localeCompare(b.name))) {
+        if (!entry2.isDirectory()) continue;
+        if (entry2.name === "admin") continue;
+        const configPath3 = resolve26(agentsDir, entry2.name, "config.json");
+        if (!existsSync33(configPath3)) continue;
         try {
           const config = JSON.parse(readFileSync35(configPath3, "utf-8"));
           agents.push({
-            slug: entry.name,
-            displayName: config.displayName ?? entry.name,
+            slug: entry2.name,
+            displayName: config.displayName ?? entry2.name,
             status: config.status ?? "unknown",
             kind: "public",
             origin: "public",
@@ -20169,7 +20271,7 @@ app23.get("/", requireAdminSession, (c) => {
           });
         } catch {
           skipped++;
-          console.error(`[admin/agents] failed to parse config.json for agent "${entry.name}" \u2014 skipping`);
+          console.error(`[admin/agents] failed to parse config.json for agent "${entry2.name}" \u2014 skipping`);
         }
       }
     } catch (err) {
@@ -20177,12 +20279,12 @@ app23.get("/", requireAdminSession, (c) => {
     }
   }
   const { specialists, specialistsSkipped } = listSpecialists(account.accountDir, riskByTool, riskSurfaceFailed !== null);
-  const { shipped, shippedSkipped, deduped } = listShipped(
+  const { shipped, shippedSkipped, deduped, divergent } = listShipped(
     account.accountDir,
     riskByTool,
     disabled,
     riskSurfaceFailed !== null,
-    authoredAgentFilenames(account.accountDir)
+    authoredAgentFiles(account.accountDir)
   );
   const rows = [...agents, ...specialists, ...shipped];
   const acct = account.accountId.slice(0, 8);
@@ -20200,17 +20302,26 @@ app23.get("/", requireAdminSession, (c) => {
   console.log(
     `[agents] op=rule-census account=${acct} rules=${COMBINATION_RULES.length} classified=${classified} fired=${firedRules.size} never=${never.length > 0 ? never.join(",") : "none"}`
   );
-  console.log(`[admin/agents] op=list accountId=${acct} agents=${agents.length} specialists=${specialists.length} shipped=${shipped.length} skipped=${skipped} specialistsSkipped=${specialistsSkipped} shippedSkipped=${shippedSkipped} deduped=${deduped}`);
+  console.log(`[admin/agents] op=list accountId=${acct} agents=${agents.length} specialists=${specialists.length} shipped=${shipped.length} skipped=${skipped} specialistsSkipped=${specialistsSkipped} shippedSkipped=${shippedSkipped} deduped=${deduped} divergent=${divergent}`);
   return c.json({
     agents: rows,
     accountId: account.accountId,
     skipped,
     specialistsSkipped,
     shippedSkipped,
-    // How many live-directory candidates were dropped as authored duplicates.
-    // `shipped + shippedSkipped + deduped` equals the number of distinct `.md`
-    // names across the three source directories.
+    // How many live-directory or quarantine-directory candidates were dropped as
+    // authored duplicates — meaning the two files agree on the three fields the
+    // row shows. `shipped + shippedSkipped + deduped` equals the number of
+    // distinct `.md` names across the three source directories.
     deduped,
+    // How many candidates were KEPT because both files read and the three
+    // fields DISAGREE. Never a fourth term in the identity above: a kept
+    // candidate is parsed like any other, so it lands in `shipped`, or in
+    // `shippedSkipped` when its own frontmatter carries no `name:`. A candidate
+    // that could not be compared at all is not counted here — that is
+    // `op=list-shipped-compare-failed`, and reporting it as drift would claim a
+    // disagreement nobody read.
+    divergent,
     riskSurfaceFailed: riskSurfaceFailed !== null
   });
 });
@@ -20224,9 +20335,9 @@ app23.get("/:slug", requireAdminSession, (c) => {
   if (SLUG_UNSAFE(slug)) return c.json({ error: "Invalid agent slug" }, 400);
   if (c.req.query("origin") === "shipped") {
     const dirs = shippedSourceDirs(account.accountDir);
-    const source = dirs.find((d) => existsSync34(resolve25(d, `${slug}.md`)));
+    const source = dirs.find((d) => existsSync33(resolve26(d, `${slug}.md`)));
     if (!source) return c.json({ error: "Agent not found" }, 404);
-    const { fm, body } = splitFrontmatter(readFileSync35(resolve25(source, `${slug}.md`), "utf-8"));
+    const { fm, body } = splitFrontmatter(readFileSync35(resolve26(source, `${slug}.md`), "utf-8"));
     const { riskByTool, failed: failed2 } = loadRiskSurface();
     const tools = parseToolsLine(fm.tools);
     const r = classify(tools, riskByTool, failed2 !== null);
@@ -20256,10 +20367,10 @@ app23.get("/:slug", requireAdminSession, (c) => {
   const pluginParam = c.req.query("plugin");
   if (pluginParam) {
     if (SLUG_UNSAFE(pluginParam)) return c.json({ error: "Invalid plugin" }, 400);
-    const file = resolve25(account.accountDir, "plugins", pluginParam, "agents", `${slug}.md`);
-    if (!existsSync34(file)) return c.json({ error: "Agent not found" }, 404);
+    const file = resolve26(account.accountDir, "plugins", pluginParam, "agents", `${slug}.md`);
+    if (!existsSync33(file)) return c.json({ error: "Agent not found" }, 404);
     const { fm, body } = splitFrontmatter(readFileSync35(file, "utf-8"));
-    const skills = subdirs(resolve25(account.accountDir, "plugins", pluginParam, "skills"));
+    const skills = subdirs(resolve26(account.accountDir, "plugins", pluginParam, "skills"));
     const { riskByTool, failed: failed2 } = loadRiskSurface();
     const tools = parseToolsLine(fm.tools);
     const r = classify(tools, riskByTool, failed2 !== null);
@@ -20286,9 +20397,9 @@ app23.get("/:slug", requireAdminSession, (c) => {
       }
     });
   }
-  const agentDir = resolve25(account.accountDir, "agents", slug);
-  const configPath3 = resolve25(agentDir, "config.json");
-  if (!existsSync34(configPath3)) return c.json({ error: "Agent not found" }, 404);
+  const agentDir = resolve26(account.accountDir, "agents", slug);
+  const configPath3 = resolve26(agentDir, "config.json");
+  if (!existsSync33(configPath3)) return c.json({ error: "Agent not found" }, 404);
   let config;
   try {
     config = JSON.parse(readFileSync35(configPath3, "utf-8"));
@@ -20299,9 +20410,9 @@ app23.get("/:slug", requireAdminSession, (c) => {
   const docs = {};
   const present = {};
   for (const { file, key: key2 } of OWNED_DOCS) {
-    const p = resolve25(agentDir, file);
+    const p = resolve26(agentDir, file);
     try {
-      if (existsSync34(p)) {
+      if (existsSync33(p)) {
         docs[key2] = readFileSync35(p, "utf-8");
         present[key2] = true;
       } else {
@@ -20350,7 +20461,7 @@ async function resolveWritableAccount(c, op, slug) {
   return account;
 }
 function reconcileRoutingProse(accountDir, accountId, op, slug) {
-  const script = resolve25(PLATFORM_ROOT, "scripts", "lib", "agents-md-bootstrap.sh");
+  const script = resolve26(PLATFORM_ROOT, "scripts", "lib", "agents-md-bootstrap.sh");
   try {
     execFileSync6("bash", [script, accountDir], { encoding: "utf-8", timeout: 1e4 });
     return true;
@@ -20361,8 +20472,8 @@ function reconcileRoutingProse(accountDir, accountId, op, slug) {
   }
 }
 function reconcileAuthoredRoutingLine(accountDir, accountId, op, source) {
-  const agentsMd = resolve25(accountDir, "agents", "admin", "AGENTS.md");
-  if (!existsSync34(agentsMd) || !existsSync34(source)) return false;
+  const agentsMd = resolve26(accountDir, "agents", "admin", "AGENTS.md");
+  if (!existsSync33(agentsMd) || !existsSync33(source)) return false;
   try {
     const { fm } = splitFrontmatter(readFileSync35(source, "utf-8"));
     if (!fm.name) return false;
@@ -20385,18 +20496,18 @@ app23.post("/:slug/disable", async (c) => {
   const resolved = await resolveWritableAccount(c, "disable", slug);
   if ("status" in resolved) return c.json({ error: resolved.error }, resolved.status);
   const filename = `${slug}.md`;
-  const live = resolve25(resolved.accountDir, ...SPECIALISTS_DIR, filename);
-  const quarantined = resolve25(resolved.accountDir, ...QUARANTINE_DIR, filename);
-  if (!authoredAgentFilenames(resolved.accountDir).has(filename)) {
+  const live = resolve26(resolved.accountDir, ...SPECIALISTS_DIR, filename);
+  const quarantined = resolve26(resolved.accountDir, ...QUARANTINE_DIR, filename);
+  if (!authoredAgentFiles(resolved.accountDir).has(filename)) {
     console.error(`[admin/agents] op=disable accountId=${resolved.accountId.slice(0, 8)} slug=${slug} origin=not-authored eligible=false outcome=refused reason=not-user-created`);
     return c.json({ error: "Only an agent you created can be switched off here. A shipped agent is stopped by suspending the routines that dispatch it." }, 404);
   }
-  if (!existsSync34(live)) {
+  if (!existsSync33(live)) {
     console.error(`[admin/agents] op=disable accountId=${resolved.accountId.slice(0, 8)} slug=${slug} origin=specialist eligible=true outcome=refused reason=not-dispatchable`);
     return c.json({ error: "This agent is not in the dispatchable set, so there is nothing to switch off." }, 409);
   }
   try {
-    mkdirSync7(resolve25(resolved.accountDir, ...QUARANTINE_DIR), { recursive: true });
+    mkdirSync7(resolve26(resolved.accountDir, ...QUARANTINE_DIR), { recursive: true });
     renameSync10(live, quarantined);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -20413,28 +20524,28 @@ app23.post("/:slug/enable", async (c) => {
   const resolved = await resolveWritableAccount(c, "enable", slug);
   if ("status" in resolved) return c.json({ error: resolved.error }, resolved.status);
   const filename = `${slug}.md`;
-  const live = resolve25(resolved.accountDir, ...SPECIALISTS_DIR, filename);
-  const quarantined = resolve25(resolved.accountDir, ...QUARANTINE_DIR, filename);
-  const authored = authoredAgentFilenames(resolved.accountDir).has(filename);
+  const live = resolve26(resolved.accountDir, ...SPECIALISTS_DIR, filename);
+  const quarantined = resolve26(resolved.accountDir, ...QUARANTINE_DIR, filename);
+  const authored = authoredAgentFiles(resolved.accountDir).has(filename);
   const origin = authored ? "specialist" : "shipped";
   let restored = false;
   try {
     if (authored) {
-      if (!existsSync34(quarantined)) {
+      if (!existsSync33(quarantined)) {
         console.error(`[admin/agents] op=enable accountId=${resolved.accountId.slice(0, 8)} slug=${slug} origin=specialist eligible=true outcome=refused reason=not-disabled`);
         return c.json({ error: "This agent is not disabled" }, 404);
       }
-      mkdirSync7(resolve25(resolved.accountDir, ...SPECIALISTS_DIR), { recursive: true });
+      mkdirSync7(resolve26(resolved.accountDir, ...SPECIALISTS_DIR), { recursive: true });
       renameSync10(quarantined, live);
       restored = true;
     } else {
       const disabled = readDisabledStoreStrict(resolved.accountDir);
-      if (!existsSync34(quarantined) && !disabled.has(filename)) {
+      if (!existsSync33(quarantined) && !disabled.has(filename)) {
         console.error(`[admin/agents] op=enable accountId=${resolved.accountId.slice(0, 8)} slug=${slug} origin=shipped eligible=true outcome=refused reason=not-disabled`);
         return c.json({ error: "This agent is not disabled" }, 404);
       }
-      if (existsSync34(quarantined)) {
-        mkdirSync7(resolve25(resolved.accountDir, ...SPECIALISTS_DIR), { recursive: true });
+      if (existsSync33(quarantined)) {
+        mkdirSync7(resolve26(resolved.accountDir, ...SPECIALISTS_DIR), { recursive: true });
         renameSync10(quarantined, live);
         restored = true;
       }
@@ -20475,8 +20586,8 @@ app23.delete("/:slug", async (c) => {
     console.error(`[admin/agents] op=delete rejected reason=${authz.reason} accountId=${account.accountId.slice(0, 8)} slug=${slug}`);
     return c.json({ error: "Not authorized for this account" }, 403);
   }
-  const agentDir = resolve25(account.accountDir, "agents", slug);
-  if (!existsSync34(agentDir)) {
+  const agentDir = resolve26(account.accountDir, "agents", slug);
+  if (!existsSync33(agentDir)) {
     return c.json({ error: "Agent not found" }, 404);
   }
   try {
@@ -20518,8 +20629,8 @@ app23.post("/:slug/project", async (c) => {
     console.error(`[admin/agents] op=project rejected reason=${authz.reason} accountId=${account.accountId.slice(0, 8)} slug=${slug}`);
     return c.json({ error: "Not authorized for this account" }, 403);
   }
-  const agentDir = resolve25(account.accountDir, "agents", slug);
-  if (!existsSync34(agentDir)) {
+  const agentDir = resolve26(account.accountDir, "agents", slug);
+  if (!existsSync33(agentDir)) {
     console.error(`[admin/agents] op=project rejected reason=agent-not-on-disk accountId=${account.accountId.slice(0, 8)} slug=${slug} probed=${agentDir}`);
     return c.json({ error: "Agent not found on disk" }, 404);
   }
@@ -20543,7 +20654,7 @@ init_account();
 init_neo4j_store();
 import crypto2 from "crypto";
 import { resolve as resolvePath } from "path";
-import { existsSync as existsSync35, mkdirSync as mkdirSync8, createWriteStream } from "fs";
+import { existsSync as existsSync34, mkdirSync as mkdirSync8, createWriteStream } from "fs";
 
 // app/lib/admin-conversation-cascade.ts
 init_neo4j_store();
@@ -20711,7 +20822,7 @@ function validateAndShapeAttachments(raws, conversationAccountId, sessionId, mes
     let reason = null;
     if (!a.attachmentId || !a.filename || !a.mimeType || !a.storagePath) reason = "schema-fail";
     else if (a.accountId !== conversationAccountId) reason = "account-mismatch";
-    else if (!existsSync35(a.storagePath)) reason = "missing-file";
+    else if (!existsSync34(a.storagePath)) reason = "missing-file";
     if (reason) {
       invalid++;
       try {
@@ -20827,7 +20938,7 @@ app24.get("/", requireAdminSession, async (c) => {
   if (!userId) return c.json({ error: "User identity required \u2014 authenticate with users.json PIN" }, 401);
   try {
     const flushed = await listAdminSessions(accountId, userId, 20);
-    const sessions2 = flushed.map((r) => ({
+    const sessions3 = flushed.map((r) => ({
       sessionId: r.sessionId,
       cacheKey: null,
       name: r.name,
@@ -20835,15 +20946,15 @@ app24.get("/", requireAdminSession, async (c) => {
       phase: "flushed",
       channel: r.channel
     })).sort((a, b) => a.updatedAt < b.updatedAt ? 1 : a.updatedAt > b.updatedAt ? -1 : 0).slice(0, 20);
-    const channelCounts = sessions2.reduce((acc, s) => {
+    const channelCounts = sessions3.reduce((acc, s) => {
       const k = s.channel ?? "unknown";
       acc[k] = (acc[k] ?? 0) + 1;
       return acc;
     }, {});
     console.error(
-      `[conversations-list] render rows=${sessions2.length} channels=${JSON.stringify(channelCounts)}`
+      `[conversations-list] render rows=${sessions3.length} channels=${JSON.stringify(channelCounts)}`
     );
-    return c.json({ sessions: sessions2 });
+    return c.json({ sessions: sessions3 });
   } catch (err) {
     console.error(`[sessions-list] Failed: ${err instanceof Error ? err.message : String(err)}`);
     return c.json({ error: "Failed to fetch sessions" }, 500);
@@ -21244,8 +21355,8 @@ init_claude_agent();
 // app/lib/claude-agent/spawn-context.ts
 init_account();
 init_neo4j_store();
-import { existsSync as existsSync36, readFileSync as readFileSync36, readdirSync as readdirSync23, statSync as statSync23 } from "fs";
-import { dirname as dirname14, resolve as resolve26, join as join41 } from "path";
+import { existsSync as existsSync35, readFileSync as readFileSync36, readdirSync as readdirSync23, statSync as statSync23 } from "fs";
+import { dirname as dirname14, resolve as resolve27, join as join41 } from "path";
 async function resolveOwnerProfileBlock(accountId, userId) {
   if (!userId) return { ok: false, reason: "missing-user-id" };
   try {
@@ -21291,7 +21402,7 @@ function extractPluginToolDescriptions(pluginDir) {
   ];
   let raw = null;
   for (const path of candidates) {
-    if (!existsSync36(path)) continue;
+    if (!existsSync35(path)) continue;
     try {
       raw = readFileSync36(path, "utf-8");
       break;
@@ -21342,8 +21453,8 @@ function parseSkillPathsFromFrontmatter(fm) {
 }
 function listPluginDirs(accountPluginsDir) {
   const out = /* @__PURE__ */ new Map();
-  const platformPlugins = resolve26(PLATFORM_ROOT, "plugins");
-  if (existsSync36(platformPlugins)) {
+  const platformPlugins = resolve27(PLATFORM_ROOT, "plugins");
+  if (existsSync35(platformPlugins)) {
     for (const name of readdirSync23(platformPlugins)) {
       const dir = join41(platformPlugins, name);
       try {
@@ -21352,11 +21463,11 @@ function listPluginDirs(accountPluginsDir) {
       }
     }
   }
-  const premiumRoot = resolve26(dirname14(PLATFORM_ROOT), "premium-plugins");
-  if (existsSync36(premiumRoot)) {
+  const premiumRoot = resolve27(dirname14(PLATFORM_ROOT), "premium-plugins");
+  if (existsSync35(premiumRoot)) {
     for (const bundle of readdirSync23(premiumRoot)) {
       const bundlePlugins = join41(premiumRoot, bundle, "plugins");
-      if (!existsSync36(bundlePlugins)) continue;
+      if (!existsSync35(bundlePlugins)) continue;
       try {
         for (const name of readdirSync23(bundlePlugins)) {
           const dir = join41(bundlePlugins, name);
@@ -21369,7 +21480,7 @@ function listPluginDirs(accountPluginsDir) {
       }
     }
   }
-  if (accountPluginsDir && existsSync36(accountPluginsDir)) {
+  if (accountPluginsDir && existsSync35(accountPluginsDir)) {
     try {
       for (const name of readdirSync23(accountPluginsDir)) {
         if (out.has(name)) continue;
@@ -21385,10 +21496,10 @@ function listPluginDirs(accountPluginsDir) {
   return out;
 }
 function accountPluginsDirFor(accountId) {
-  return resolve26(PLATFORM_ROOT, "..", "data/accounts", accountId, "plugins");
+  return resolve27(PLATFORM_ROOT, "..", "data/accounts", accountId, "plugins");
 }
 function listAccountPluginNames(accountPluginsDir) {
-  if (!existsSync36(accountPluginsDir)) return [];
+  if (!existsSync35(accountPluginsDir)) return [];
   try {
     return readdirSync23(accountPluginsDir).filter((name) => {
       try {
@@ -21402,8 +21513,8 @@ function listAccountPluginNames(accountPluginsDir) {
   }
 }
 function readEnabledPlugins(accountId) {
-  const accountFile = resolve26(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
-  if (!existsSync36(accountFile)) return /* @__PURE__ */ new Set();
+  const accountFile = resolve27(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
+  if (!existsSync35(accountFile)) return /* @__PURE__ */ new Set();
   try {
     const parsed = JSON.parse(readFileSync36(accountFile, "utf-8"));
     return new Set(
@@ -21414,7 +21525,7 @@ function readEnabledPlugins(accountId) {
   }
 }
 function readFrontmatter(path) {
-  if (!existsSync36(path)) return null;
+  if (!existsSync35(path)) return null;
   let raw;
   try {
     raw = readFileSync36(path, "utf-8");
@@ -21452,7 +21563,7 @@ ${fm}
       `plugin-manifest-tool-coverage plugin=${name} tools=${tools.length} with-desc=${withDesc}`
     );
     if (toolNames.length > 0 && descMap.size === 0) {
-      const hasSource = existsSync36(join41(dir, "mcp/dist/index.js")) || existsSync36(join41(dir, "mcp/src/index.ts"));
+      const hasSource = existsSync35(join41(dir, "mcp/dist/index.js")) || existsSync35(join41(dir, "mcp/src/index.ts"));
       if (hasSource) {
         console.warn(
           `[spawn-context] WARN plugin=${name} mcp source present but tool-description regex matched zero entries \u2014 SDK upgrade may have changed the registration shape`
@@ -21478,8 +21589,8 @@ ${skillFm}
   return out;
 }
 function computeSpecialistDomains(accountId) {
-  const specialistsDir = resolve26(PLATFORM_ROOT, "..", "data/accounts", accountId, "specialists", "agents");
-  if (!existsSync36(specialistsDir)) return [];
+  const specialistsDir = resolve27(PLATFORM_ROOT, "..", "data/accounts", accountId, "specialists", "agents");
+  if (!existsSync35(specialistsDir)) return [];
   let entries2;
   try {
     entries2 = readdirSync23(specialistsDir);
@@ -21524,8 +21635,8 @@ ${fm}
   return out;
 }
 function computeDormantPlugins(accountId) {
-  const accountFile = resolve26(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
-  if (!existsSync36(accountFile)) return [];
+  const accountFile = resolve27(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
+  if (!existsSync35(accountFile)) return [];
   let enabled;
   try {
     const raw = readFileSync36(accountFile, "utf-8");
@@ -21539,8 +21650,8 @@ function computeDormantPlugins(accountId) {
     );
     return [];
   }
-  const pluginsDir = resolve26(PLATFORM_ROOT, "plugins");
-  if (!existsSync36(pluginsDir)) return [];
+  const pluginsDir = resolve27(PLATFORM_ROOT, "plugins");
+  if (!existsSync35(pluginsDir)) return [];
   let entries2;
   try {
     entries2 = readdirSync23(pluginsDir);
@@ -21550,8 +21661,8 @@ function computeDormantPlugins(accountId) {
   const out = [];
   for (const name of entries2) {
     if (enabled.has(name)) continue;
-    const manifestPath = resolve26(pluginsDir, name, "PLUGIN.md");
-    if (!existsSync36(manifestPath)) continue;
+    const manifestPath = resolve27(pluginsDir, name, "PLUGIN.md");
+    if (!existsSync35(manifestPath)) continue;
     let manifest;
     try {
       manifest = readFileSync36(manifestPath, "utf-8");
@@ -21569,11 +21680,11 @@ function computeDormantPlugins(accountId) {
 
 // server/routes/admin/claude-sessions.ts
 init_neo4j_store();
-import { existsSync as existsSync37, readFileSync as readFileSync37 } from "fs";
-import { resolve as resolve27 } from "path";
+import { existsSync as existsSync36, readFileSync as readFileSync37 } from "fs";
+import { resolve as resolve28 } from "path";
 function readTunnelState(brandConfigDir) {
   const statePath = `${process.env.HOME ?? ""}/${brandConfigDir}/cloudflared/tunnel.state`;
-  if (!existsSync37(statePath)) return null;
+  if (!existsSync36(statePath)) return null;
   try {
     const parsed = JSON.parse(readFileSync37(statePath, "utf-8"));
     const tunnelId = typeof parsed.tunnelId === "string" ? parsed.tunnelId : null;
@@ -21586,10 +21697,10 @@ function readTunnelState(brandConfigDir) {
   }
 }
 function resolveTunnelUrl() {
-  const platformRoot5 = process.env.MAXY_PLATFORM_ROOT ?? process.env.PLATFORM_ROOT ?? resolve27(process.cwd(), "..");
+  const platformRoot5 = process.env.MAXY_PLATFORM_ROOT ?? process.env.PLATFORM_ROOT ?? resolve28(process.cwd(), "..");
   let brand;
   try {
-    brand = JSON.parse(readFileSync37(resolve27(platformRoot5, "config", "brand.json"), "utf-8"));
+    brand = JSON.parse(readFileSync37(resolve28(platformRoot5, "config", "brand.json"), "utf-8"));
   } catch {
     return null;
   }
@@ -22049,11 +22160,11 @@ init_helpers();
 init_claude_agent();
 init_data_path();
 init_sidebar_sessions();
-import { createReadStream as createReadStream2, createWriteStream as createWriteStream2, existsSync as existsSync38 } from "fs";
+import { createReadStream as createReadStream2, createWriteStream as createWriteStream2, existsSync as existsSync37 } from "fs";
 import { readdir as readdir4, readFile as readFile9, stat as stat6, mkdir as mkdir3, unlink as unlink3, rename as rename3, rmdir } from "fs/promises";
 import { realpathSync as realpathSync7 } from "fs";
 import { randomUUID as randomUUID7 } from "crypto";
-import { basename as basename13, dirname as dirname15, join as join44, relative as relative6, resolve as resolve29, sep as sep9 } from "path";
+import { basename as basename13, dirname as dirname15, join as join44, relative as relative6, resolve as resolve30, sep as sep9 } from "path";
 import { Readable as Readable2 } from "stream";
 init_attachments();
 
@@ -22377,7 +22488,7 @@ async function cascadeDeleteDocument(params) {
 init_data_path();
 init_neo4j_store();
 import * as fsp from "fs/promises";
-import { resolve as resolve28, relative as relative5, join as join43, basename as basename12, extname, sep as sep8 } from "path";
+import { resolve as resolve29, relative as relative5, join as join43, basename as basename12, extname, sep as sep8 } from "path";
 import { tmpdir as tmpdir3 } from "os";
 import { execFile } from "child_process";
 import { promisify } from "util";
@@ -22539,14 +22650,14 @@ async function walkSubtree(root, dataRoot, out) {
     return { clean: false };
   }
   let clean = true;
-  for (const entry of entries2) {
-    if (entry.isSymbolicLink()) continue;
-    if (entry.isDirectory() && entry.name === ".uploads-tmp") continue;
-    const abs = join43(root, entry.name);
-    if (entry.isDirectory()) {
+  for (const entry2 of entries2) {
+    if (entry2.isSymbolicLink()) continue;
+    if (entry2.isDirectory() && entry2.name === ".uploads-tmp") continue;
+    const abs = join43(root, entry2.name);
+    if (entry2.isDirectory()) {
       const sub = await walkSubtree(abs, dataRoot, out);
       if (!sub.clean) clean = false;
-    } else if (entry.isFile()) {
+    } else if (entry2.isFile()) {
       try {
         const st = await fsp.stat(abs);
         out.push({
@@ -22697,7 +22808,7 @@ async function reconcileFileIndex(accountId, opts) {
   return withSession2(opts, async (session) => {
     const walked = [];
     const subtreeRoots = [
-      resolve28(dataRoot, "accounts", accountId)
+      resolve29(dataRoot, "accounts", accountId)
     ];
     let clean = true;
     for (const root of subtreeRoots) {
@@ -22780,7 +22891,7 @@ async function reconcileFileIndexDebounced(accountId, opts) {
 async function indexFile(accountId, relativePath, opts) {
   const dataRoot = opts?.dataRoot ?? DATA_ROOT;
   const embed2 = opts?.embed ?? embed;
-  const absolute = resolve28(dataRoot, relativePath);
+  const absolute = resolve29(dataRoot, relativePath);
   await withSession2(opts, async (session) => {
     const st = await fsp.stat(absolute);
     const wf = {
@@ -22838,14 +22949,14 @@ function buildZip(entries2) {
   const localChunks = [];
   const centralChunks = [];
   let offset = 0;
-  for (const entry of entries2) {
-    const nameBytes = Buffer.from(entry.name, "utf8");
-    const crc = crc32(entry.data);
-    const uncompressedSize = entry.data.length;
-    const deflated = deflateRawSync(entry.data);
+  for (const entry2 of entries2) {
+    const nameBytes = Buffer.from(entry2.name, "utf8");
+    const crc = crc32(entry2.data);
+    const uncompressedSize = entry2.data.length;
+    const deflated = deflateRawSync(entry2.data);
     const useDeflate = deflated.length < uncompressedSize;
     const method = useDeflate ? 8 : 0;
-    const payload = useDeflate ? deflated : entry.data;
+    const payload = useDeflate ? deflated : entry2.data;
     const compressedSize = payload.length;
     const localHeader = Buffer.alloc(30);
     localHeader.writeUInt32LE(LOCAL_SIG, 0);
@@ -22929,7 +23040,7 @@ async function readMeta2(absDir, baseName) {
 }
 async function readAccountNames() {
   const map = /* @__PURE__ */ new Map();
-  const accountsDir = resolve29(DATA_ROOT, "accounts");
+  const accountsDir = resolve30(DATA_ROOT, "accounts");
   let names;
   try {
     names = await readdir4(accountsDir);
@@ -22938,7 +23049,7 @@ async function readAccountNames() {
   }
   for (const name of names) {
     if (!UUID_RE3.test(name)) continue;
-    const configPath3 = resolve29(accountsDir, name, "account.json");
+    const configPath3 = resolve30(accountsDir, name, "account.json");
     try {
       const raw = await readFile9(configPath3, "utf8");
       const parsed = JSON.parse(raw);
@@ -22971,47 +23082,47 @@ async function servableFilesIn(dirAbs, uuid) {
   }
   return out;
 }
-async function enrich(absolute, entry, accountNames) {
-  if (entry.kind === "directory" && UUID_RE3.test(entry.name)) {
-    const dirAbs = join44(absolute, entry.name);
-    const meta = await readMeta2(dirAbs, entry.name);
+async function enrich(absolute, entry2, accountNames) {
+  if (entry2.kind === "directory" && UUID_RE3.test(entry2.name)) {
+    const dirAbs = join44(absolute, entry2.name);
+    const meta = await readMeta2(dirAbs, entry2.name);
     if (meta?.filename) {
-      const servable = await servableFilesIn(dirAbs, entry.name);
+      const servable = await servableFilesIn(dirAbs, entry2.name);
       if (servable.length === 1) {
         const innerName = servable[0];
         let size = null;
-        let modifiedAt = entry.modifiedAt;
+        let modifiedAt = entry2.modifiedAt;
         try {
           const st = await stat6(join44(dirAbs, innerName));
           size = st.size;
           modifiedAt = st.mtime.toISOString();
         } catch {
         }
-        entry.kind = "file";
-        entry.displayName = meta.filename;
-        entry.mimeType = meta.mimeType;
-        entry.sizeBytes = size;
-        entry.modifiedAt = modifiedAt;
-        entry.entryPath = `${entry.name}/${innerName}`;
+        entry2.kind = "file";
+        entry2.displayName = meta.filename;
+        entry2.mimeType = meta.mimeType;
+        entry2.sizeBytes = size;
+        entry2.modifiedAt = modifiedAt;
+        entry2.entryPath = `${entry2.name}/${innerName}`;
         return "flattened";
       }
-      entry.displayName = meta.filename;
+      entry2.displayName = meta.filename;
       return "kept-as-dir";
     }
-    const accountName = accountNames.get(entry.name);
+    const accountName = accountNames.get(entry2.name);
     if (accountName) {
-      entry.displayName = accountName;
+      entry2.displayName = accountName;
     }
     return null;
   }
-  if (entry.kind === "file") {
-    const dot = entry.name.lastIndexOf(".");
-    const base = dot === -1 ? entry.name : entry.name.slice(0, dot);
+  if (entry2.kind === "file") {
+    const dot = entry2.name.lastIndexOf(".");
+    const base = dot === -1 ? entry2.name : entry2.name.slice(0, dot);
     if (UUID_RE3.test(base)) {
       const meta = await readMeta2(absolute, base);
       if (meta?.filename) {
-        entry.displayName = meta.filename;
-        entry.mimeType = meta.mimeType;
+        entry2.displayName = meta.filename;
+        entry2.mimeType = meta.mimeType;
       }
     }
   }
@@ -23102,6 +23213,10 @@ function isValidEntryName(name) {
   if (name.startsWith("@")) return false;
   return !/[\\/\0]/.test(name);
 }
+function crossAccountOwner(relPath) {
+  const segs = relPath.split("/").filter(Boolean);
+  return segs.length >= 2 && segs[0] === "accounts" ? segs[1] : "";
+}
 function resolveOwnAccountWrite(rawPath, accountId, endpoint) {
   const res = resolveDataPath(rawPath);
   if (!res.ok) {
@@ -23169,8 +23284,7 @@ app29.get("/", requireAdminSession, async (c) => {
   }
   const { absolute, relative: relPath } = resolution;
   if (crossesForeignAccountPartition(relPath, accountId)) {
-    console.error(`[data] account-scope-blocked endpoint="/api/admin/files" path="${relPath}" account=${accountId.slice(0, 8)}\u2026`);
-    return c.json({ error: "Not found" }, 404);
+    console.error(`[data] op=cross-account-read endpoint="GET /api/admin/files" path="${relPath}" pinned=${accountId.slice(0, 8)}\u2026 owner=${crossAccountOwner(relPath).slice(0, 8)}\u2026`);
   }
   try {
     const info = await stat6(absolute);
@@ -23346,8 +23460,7 @@ app29.get("/download", requireAdminSession, async (c) => {
       return c.json({ error: "Not found" }, 404);
     }
   } else if (root === "data" && crossesForeignAccountPartition(relPath, accountId)) {
-    console.error(`[data] account-scope-blocked endpoint="/api/admin/files/download" path="${relPath}" account=${accountId.slice(0, 8)}\u2026`);
-    return c.json({ error: "Not found" }, 404);
+    console.error(`[data] op=cross-account-read endpoint="GET /api/admin/files/download" path="${relPath}" pinned=${accountId.slice(0, 8)}\u2026 owner=${crossAccountOwner(relPath).slice(0, 8)}\u2026`);
   }
   try {
     const info = await stat6(absolute);
@@ -23460,8 +23573,7 @@ app29.get("/download-zip", requireAdminSession, async (c) => {
     }
     const { absolute, relative: relPath } = resolution;
     if (crossesForeignAccountPartition(relPath, accountId)) {
-      console.error(`[data] account-scope-blocked endpoint="/api/admin/files/download-zip" path="${relPath}" account=${accountId.slice(0, 8)}\u2026`);
-      return c.json({ error: "Not found" }, 404);
+      console.error(`[data] op=cross-account-read endpoint="GET /api/admin/files/download-zip" path="${relPath}" pinned=${accountId.slice(0, 8)}\u2026 owner=${crossAccountOwner(relPath).slice(0, 8)}\u2026`);
     }
     try {
       const info = await stat6(absolute);
@@ -23469,9 +23581,6 @@ app29.get("/download-zip", requireAdminSession, async (c) => {
         dirsWalked++;
         const parentAbs = dirname15(absolute);
         for await (const fileAbs of walkRegularFiles(absolute)) {
-          const within = relative6(absolute, fileAbs).split(sep9).join("/");
-          const fileRel = relPath === "" || relPath === "." ? within : `${relPath}/${within}`;
-          if (crossesForeignAccountPartition(fileRel, accountId)) continue;
           const fileInfo = await stat6(fileAbs);
           const member = relative6(parentAbs, fileAbs).split(sep9).join("/");
           const over = await addFile(fileAbs, fileInfo.size, member);
@@ -23542,8 +23651,8 @@ async function resolveUploadTarget(c, accountId, uid) {
       return { ok: false, status: 403, error: "Path is outside your account folder" };
     }
   }
-  const destDir = relDir === "." ? base.absolute : resolve29(base.absolute, relDir);
-  const destPath = resolve29(destDir, finalName);
+  const destDir = relDir === "." ? base.absolute : resolve30(base.absolute, relDir);
+  const destPath = resolve30(destDir, finalName);
   if (relpath) {
     const firstCreated = await mkdir3(destDir, { recursive: true });
     if (firstCreated) console.error(`[data-upload] op=mkdir uid=${uid} token=${token} dir="${destRel}"`);
@@ -23560,7 +23669,7 @@ async function resolveUploadTarget(c, accountId, uid) {
   return { ok: true, destDir, destPath, destRel, finalName, mimeType, relpath, token };
 }
 async function logUploadsTmpCensus(accountId) {
-  const tmpDir = resolve29(DATA_ROOT, "accounts", accountId, UPLOAD_TMP_DIR);
+  const tmpDir = resolve30(DATA_ROOT, "accounts", accountId, UPLOAD_TMP_DIR);
   let live = 0;
   try {
     live = (await readdir4(tmpDir)).length;
@@ -23587,9 +23696,9 @@ app29.post("/upload", requireAdminSession, async (c) => {
   if (!body) return c.json({ error: "Empty request body" }, 400);
   console.error(`[data-upload] op=request uid=${uid} account=${accountId} dir="${destRel}" token=${token} rel="${relpath ?? ""}" declaredBytes=${declaredBytes}`);
   const ceiling = dataUploadCeiling();
-  const tmpDir = resolve29(DATA_ROOT, "accounts", accountId, UPLOAD_TMP_DIR);
+  const tmpDir = resolve30(DATA_ROOT, "accounts", accountId, UPLOAD_TMP_DIR);
   await mkdir3(tmpDir, { recursive: true });
-  const tmpPath = resolve29(tmpDir, `${uid}.part`);
+  const tmpPath = resolve30(tmpDir, `${uid}.part`);
   const out = createWriteStream2(tmpPath);
   const t0 = Date.now();
   let received2 = 0;
@@ -23607,7 +23716,7 @@ app29.post("/upload", requireAdminSession, async (c) => {
     });
     await unlink3(tmpPath).catch(() => {
     });
-    const tempRemoved = !existsSync38(tmpPath);
+    const tempRemoved = !existsSync37(tmpPath);
     console.error(`[data-upload] op=cleanup uid=${uid} tempRemoved=${tempRemoved}`);
   };
   const reader = body.getReader();
@@ -23681,7 +23790,7 @@ async function discardChunkUpload(uploadId, state) {
   });
   await unlink3(state.tmpPath).catch(() => {
   });
-  const tempRemoved = !existsSync38(state.tmpPath);
+  const tempRemoved = !existsSync37(state.tmpPath);
   console.error(`[data-upload] op=cleanup uid=${uploadId} tempRemoved=${tempRemoved}`);
 }
 async function writeChunkBody(body, out, alreadyReceived, ceiling) {
@@ -23736,9 +23845,9 @@ async function handleChunkUpload(c, accountId) {
     }
     const target = await resolveUploadTarget(c, accountId, uploadId);
     if (!target.ok) return c.json({ error: target.error }, target.status);
-    const tmpDir = resolve29(DATA_ROOT, "accounts", accountId, UPLOAD_TMP_DIR);
+    const tmpDir = resolve30(DATA_ROOT, "accounts", accountId, UPLOAD_TMP_DIR);
     await mkdir3(tmpDir, { recursive: true });
-    const tmpPath = resolve29(tmpDir, `${uploadId}.part`);
+    const tmpPath = resolve30(tmpDir, `${uploadId}.part`);
     const out = createWriteStream2(tmpPath);
     const state2 = {
       accountId,
@@ -23844,7 +23953,7 @@ async function evictStaleChunkUploads(ttlMs) {
   return evicted;
 }
 async function sweepStaleUploadTemps() {
-  const accountsRoot = resolve29(DATA_ROOT, "accounts");
+  const accountsRoot = resolve30(DATA_ROOT, "accounts");
   let accounts;
   try {
     accounts = await readdir4(accountsRoot, { withFileTypes: true });
@@ -23854,7 +23963,7 @@ async function sweepStaleUploadTemps() {
   let removed = 0;
   for (const acc of accounts) {
     if (!acc.isDirectory()) continue;
-    const tmpDir = resolve29(accountsRoot, acc.name, UPLOAD_TMP_DIR);
+    const tmpDir = resolve30(accountsRoot, acc.name, UPLOAD_TMP_DIR);
     let entries2;
     try {
       entries2 = await readdir4(tmpDir);
@@ -23863,7 +23972,7 @@ async function sweepStaleUploadTemps() {
     }
     for (const name of entries2) {
       try {
-        await unlink3(resolve29(tmpDir, name));
+        await unlink3(resolve30(tmpDir, name));
         removed++;
       } catch {
       }
@@ -23978,7 +24087,7 @@ app29.post("/folder", requireAdminSession, async (c) => {
   if (!isValidEntryName(name)) return c.json({ error: "Invalid folder name" }, 400);
   const parent = resolveSharedOrOwnAccountWrite(rawPath, accountId, "POST /api/admin/files/folder");
   if (!parent.ok) return c.json({ error: parent.error }, parent.status);
-  const newAbs = resolve29(parent.absolute, name);
+  const newAbs = resolve30(parent.absolute, name);
   const newRel = `${parent.relative}/${name}`;
   try {
     const info = await stat6(parent.absolute);
@@ -24017,7 +24126,7 @@ app29.post("/rename", requireAdminSession, async (c) => {
     console.error(`[data] file-rename blocked path="${src.relative}" reason="protected"`);
     return c.json({ error: "Protected entry \u2014 refusing to rename" }, 403);
   }
-  const destAbs = resolve29(dirname15(src.absolute), newName);
+  const destAbs = resolve30(dirname15(src.absolute), newName);
   const newRel = `${dirname15(src.relative)}/${newName}`.replace(/^\.\//, "");
   if (isProtectedFromRename(newRel)) {
     console.error(`[data] file-rename blocked path="${newRel}" reason="protected-target"`);
@@ -25050,7 +25159,7 @@ function isHiddenByDefault(label) {
 // server/lib/top-level-labels.ts
 var import_dist8 = __toESM(require_dist6(), 1);
 import { readdirSync as readdirSync24, readFileSync as readFileSync38 } from "fs";
-import { join as join45, resolve as resolve30 } from "path";
+import { join as join45, resolve as resolve31 } from "path";
 var STATIC_TOP_LEVEL_LABELS = Object.freeze(
   /* @__PURE__ */ new Set([
     // Base-schema infra (schema-base.md has no top-level section).
@@ -25156,7 +25265,7 @@ function resolveReferencesDir() {
   if (process.env.MAXY_PLATFORM_ROOT) {
     return join45(process.env.MAXY_PLATFORM_ROOT, "plugins", "memory", "references");
   }
-  return resolve30(import.meta.dirname, "../../../plugins/memory/references");
+  return resolve31(import.meta.dirname, "../../../plugins/memory/references");
 }
 function parseTableTopLevelLabels(referencesDir) {
   const labels = /* @__PURE__ */ new Set();
@@ -26342,8 +26451,8 @@ init_claude_agent();
 init_account();
 init_route_cache();
 import { readdir as readdir5, stat as stat7 } from "fs/promises";
-import { resolve as resolve31, relative as relative7, isAbsolute as isAbsolute4, sep as sep10, basename as basename14 } from "path";
-import { existsSync as existsSync39 } from "fs";
+import { resolve as resolve32, relative as relative7, isAbsolute as isAbsolute4, sep as sep10, basename as basename14 } from "path";
+import { existsSync as existsSync38 } from "fs";
 init_neo4j_store();
 init_attachments();
 init_data_path();
@@ -26361,11 +26470,11 @@ app36.get("/", requireAdminSession, async (c) => {
     return c.json({ error: "Account not found for session" }, 401);
   }
   const start = Date.now();
-  ensureAccountWatchers(accountId, resolve31(ACCOUNTS_DIR, accountId));
+  ensureAccountWatchers(accountId, resolve32(ACCOUNTS_DIR, accountId));
   const { value, state } = await getOrCompute("sidebar-artefacts", accountId, async () => {
     const accountFiles = await fetchAccountFileArtefacts(accountId);
     if (accountFiles === null) return null;
-    const accountDir = resolve31(ACCOUNTS_DIR, accountId);
+    const accountDir = resolve32(ACCOUNTS_DIR, accountId);
     const agents = await fetchAgentTemplateRows(accountDir);
     const artefacts = [...accountFiles, ...agents].sort(
       (a, b) => (b.updatedAt ?? "").localeCompare(a.updatedAt ?? "")
@@ -26422,8 +26531,8 @@ async function fetchAccountFileArtefacts(accountId) {
 async function fetchAgentTemplateRows(accountDir) {
   const rows = [];
   for (const filename of ADMIN_AGENT_FILES) {
-    const overridePath = resolve31(accountDir, "agents", "admin", filename);
-    const bundledPath = resolve31(PLATFORM_ROOT, "templates", "agents", "admin", filename);
+    const overridePath = resolve32(accountDir, "agents", "admin", filename);
+    const bundledPath = resolve32(PLATFORM_ROOT, "templates", "agents", "admin", filename);
     const labelStem = filename.replace(/\.md$/, "");
     const row = await readAgentTemplateRow({
       id: `agent-template:admin:${filename}`,
@@ -26436,12 +26545,12 @@ async function fetchAgentTemplateRows(accountDir) {
     });
     if (row) rows.push(row);
   }
-  const overrideDir = resolve31(accountDir, "specialists", "agents");
-  const bundledDir = resolve31(PLATFORM_ROOT, "templates", "specialists", "agents");
+  const overrideDir = resolve32(accountDir, "specialists", "agents");
+  const bundledDir = resolve32(PLATFORM_ROOT, "templates", "specialists", "agents");
   const specialistNames = await unionSpecialistFilenames(overrideDir, bundledDir);
   for (const filename of specialistNames) {
-    const overridePath = resolve31(overrideDir, filename);
-    const bundledPath = resolve31(bundledDir, filename);
+    const overridePath = resolve32(overrideDir, filename);
+    const bundledPath = resolve32(bundledDir, filename);
     const row = await readAgentTemplateRow({
       id: `agent-template:specialist:${filename}`,
       displayName: filename.replace(/\.md$/, ""),
@@ -26458,11 +26567,11 @@ async function fetchAgentTemplateRows(accountDir) {
 async function unionSpecialistFilenames(overrideDir, bundledDir) {
   const names = /* @__PURE__ */ new Set();
   for (const dir of [overrideDir, bundledDir]) {
-    if (!existsSync39(dir)) continue;
+    if (!existsSync38(dir)) continue;
     try {
       const entries2 = await readdir5(dir);
-      for (const entry of entries2) {
-        if (entry.endsWith(".md")) names.add(entry);
+      for (const entry2 of entries2) {
+        if (entry2.endsWith(".md")) names.add(entry2);
       }
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
@@ -26473,7 +26582,7 @@ async function unionSpecialistFilenames(overrideDir, bundledDir) {
 }
 async function readAgentTemplateRow(inp) {
   let chosenPath = null;
-  if (existsSync39(inp.overridePath)) {
+  if (existsSync38(inp.overridePath)) {
     try {
       validateFilePathInAccount(inp.overridePath, inp.overrideRoot);
       chosenPath = inp.overridePath;
@@ -26484,7 +26593,7 @@ async function readAgentTemplateRow(inp) {
       );
       return null;
     }
-  } else if (existsSync39(inp.bundledPath)) {
+  } else if (existsSync38(inp.bundledPath)) {
     if (!isWithin(inp.bundledPath, inp.bundledRoot)) {
       console.error(
         `[admin/sidebar-artefacts] agent-template-read-failed agent=${inp.displayName} kind=${inp.logName} error="bundled path outside PLATFORM_ROOT"`
@@ -26944,24 +27053,24 @@ init_session_store();
 import { randomUUID as randomUUID9 } from "crypto";
 
 // server/wa-descriptor.ts
-import { resolve as resolve32, join as join46 } from "path";
+import { resolve as resolve33, join as join46 } from "path";
 function waGatewayUrl() {
   return `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`;
 }
 function waServerPath() {
-  return process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve32(process.env.MAXY_PLATFORM_ROOT ?? join46(__dirname, ".."), "services/whatsapp-channel/dist/server.js");
+  return process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve33(process.env.MAXY_PLATFORM_ROOT ?? join46(__dirname, ".."), "services/whatsapp-channel/dist/server.js");
 }
 function waChannelDescriptor(senderId) {
   return { senderId, gatewayUrl: waGatewayUrl(), serverPath: waServerPath() };
 }
 
 // server/telegram-descriptor.ts
-import { resolve as resolve33, join as join47 } from "path";
+import { resolve as resolve34, join as join47 } from "path";
 function telegramGatewayUrl() {
   return `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`;
 }
 function telegramServerPath() {
-  return process.env.MAXY_TELEGRAM_CHANNEL_SERVER_PATH ?? resolve33(process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, ".."), "services/telegram-channel/dist/server.js");
+  return process.env.MAXY_TELEGRAM_CHANNEL_SERVER_PATH ?? resolve34(process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, ".."), "services/telegram-channel/dist/server.js");
 }
 function telegramChannelDescriptor(senderId) {
   return { senderId, gatewayUrl: telegramGatewayUrl(), serverPath: telegramServerPath() };
@@ -27257,23 +27366,23 @@ var system_stats_default = app44;
 // server/routes/admin/health.ts
 init_dist();
 init_neo4j_store();
-import { existsSync as existsSync40, readFileSync as readFileSync39 } from "fs";
-import { resolve as resolve34, join as join48 } from "path";
-var PLATFORM_ROOT4 = process.env.MAXY_PLATFORM_ROOT ?? resolve34(process.cwd(), "..");
+import { existsSync as existsSync39, readFileSync as readFileSync39 } from "fs";
+import { resolve as resolve35, join as join48 } from "path";
+var PLATFORM_ROOT4 = process.env.MAXY_PLATFORM_ROOT ?? resolve35(process.cwd(), "..");
 var brandHostname = "maxy";
 var brandJsonPath = join48(PLATFORM_ROOT4, "config", "brand.json");
-if (existsSync40(brandJsonPath)) {
+if (existsSync39(brandJsonPath)) {
   try {
     const brand = JSON.parse(readFileSync39(brandJsonPath, "utf-8"));
     if (brand.hostname) brandHostname = brand.hostname;
   } catch {
   }
 }
-var VERSION_FILE = resolve34(PLATFORM_ROOT4, `config/.${brandHostname}-version`);
+var VERSION_FILE = resolve35(PLATFORM_ROOT4, `config/.${brandHostname}-version`);
 var PROCESS_STARTED_AT = (/* @__PURE__ */ new Date()).toISOString();
 var PROBE_TIMEOUT_MS = 1e3;
 function readVersion() {
-  if (!existsSync40(VERSION_FILE)) return "unknown";
+  if (!existsSync39(VERSION_FILE)) return "unknown";
   return readFileSync39(VERSION_FILE, "utf-8").trim() || "unknown";
 }
 async function probeConversationDb() {
@@ -27330,17 +27439,17 @@ import { randomUUID as randomUUID10 } from "crypto";
 
 // ../lib/account-ingest-token/src/index.ts
 import { randomBytes, timingSafeEqual as timingSafeEqual2 } from "crypto";
-import { existsSync as existsSync41, readdirSync as readdirSync25, readFileSync as readFileSync40, writeFileSync as writeFileSync16 } from "fs";
-import { resolve as resolve35 } from "path";
+import { existsSync as existsSync40, readdirSync as readdirSync25, readFileSync as readFileSync40, writeFileSync as writeFileSync16 } from "fs";
+import { resolve as resolve36 } from "path";
 var UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var INGEST_TOKEN_FIELD = "ingestToken";
 var TOKEN_RE = /^[0-9a-f]{64}$/;
 function configPath2(accountsDir, accountId) {
-  return resolve35(accountsDir, accountId, "account.json");
+  return resolve36(accountsDir, accountId, "account.json");
 }
 function readConfig2(accountsDir, accountId) {
   const path = configPath2(accountsDir, accountId);
-  if (!existsSync41(path)) return null;
+  if (!existsSync40(path)) return null;
   try {
     const parsed = JSON.parse(readFileSync40(path, "utf-8"));
     return parsed !== null && typeof parsed === "object" ? parsed : null;
@@ -27353,7 +27462,7 @@ function readIngestToken(accountsDir, accountId) {
   return typeof value === "string" && TOKEN_RE.test(value) ? value : null;
 }
 function listAccountIdsOnDisk(accountsDir) {
-  if (!existsSync41(accountsDir)) return [];
+  if (!existsSync40(accountsDir)) return [];
   let entries2;
   try {
     entries2 = readdirSync25(accountsDir);
@@ -27361,7 +27470,7 @@ function listAccountIdsOnDisk(accountsDir) {
     return [];
   }
   return entries2.filter(
-    (name) => UUID_RE4.test(name) && existsSync41(resolve35(accountsDir, name, "account.json"))
+    (name) => UUID_RE4.test(name) && existsSync40(resolve36(accountsDir, name, "account.json"))
   );
 }
 function resolveAccountIdByIngestToken(accountsDir, token) {
@@ -27498,6 +27607,7 @@ async function managerRcRecover(opts) {
     body: JSON.stringify({
       sessionId: opts.sessionId,
       recover: true,
+      subscriberAttached: opts.subscriberAttached,
       role: "admin",
       channel: "webchat",
       senderId: opts.webchatChannel.key,
@@ -28215,7 +28325,7 @@ init_helpers();
 init_claude_agent();
 init_account_scope();
 init_neo4j_store();
-import { existsSync as existsSync42 } from "fs";
+import { existsSync as existsSync41 } from "fs";
 import { randomUUID as randomUUID11 } from "crypto";
 import { join as join50 } from "path";
 
@@ -28885,7 +28995,7 @@ app53.get("/booking-link", requireAdminSession, (c) => {
   }
   const id82 = account.accountId.slice(0, 8);
   try {
-    if (!existsSync42(join50(account.accountDir, AVAILABILITY_FILENAME))) {
+    if (!existsSync41(join50(account.accountDir, AVAILABILITY_FILENAME))) {
       console.log(`[calendar] op=booking-link accountId=${id82} bookingDomain=none source=availability-config`);
       return c.json({ bookingDomain: null });
     }
@@ -28907,7 +29017,7 @@ var calendar_default = app53;
 init_dist();
 init_helpers();
 init_account_scope();
-import { existsSync as existsSync43, readFileSync as readFileSync42 } from "fs";
+import { existsSync as existsSync42, readFileSync as readFileSync42 } from "fs";
 import { join as join51 } from "path";
 var app54 = new Hono();
 var PORTAL_FILENAME = "data-portal.json";
@@ -28920,7 +29030,7 @@ app54.get("/portal-link", requireAdminSession, (c) => {
   const id82 = account.accountId.slice(0, 8);
   try {
     const path = join51(account.accountDir, PORTAL_FILENAME);
-    if (!existsSync43(path)) {
+    if (!existsSync42(path)) {
       console.log(`[data-portal] op=portal-link accountId=${id82} portalDomain=none source=data-portal-config`);
       return c.json({ portalDomain: null });
     }
@@ -28945,10 +29055,12 @@ init_neo4j_store();
 init_src2();
 import cronParser from "cron-parser";
 import { int as int2 } from "neo4j-driver";
+import { readFileSync as readFileSync44 } from "fs";
+import { resolve as resolve38 } from "path";
 
 // ../lib/agent-dispatch-rule/src/index.ts
 import { readFileSync as readFileSync43 } from "fs";
-import { resolve as resolve36 } from "path";
+import { resolve as resolve37 } from "path";
 function normalizeE1642(value) {
   let candidate = value.trim().replace(/[\s\-().]/g, "");
   candidate = candidate.replace(/^whatsapp:/i, "");
@@ -28965,7 +29077,7 @@ function phonesMatch2(a, b) {
 function readChannelAdmins(accountDir, channel) {
   let config = {};
   try {
-    config = JSON.parse(readFileSync43(resolve36(accountDir, "account.json"), "utf-8"));
+    config = JSON.parse(readFileSync43(resolve37(accountDir, "account.json"), "utf-8"));
   } catch {
     config = {};
   }
@@ -29022,7 +29134,7 @@ function boundSubAccountFor(accountDir, destination) {
 }
 function validateAgentDestination(accountsDir, houseAccountId, creatingAccountId, channel, destination) {
   if (channel === "whatsapp") {
-    const houseDir = resolve36(accountsDir, houseAccountId);
+    const houseDir = resolve37(accountsDir, houseAccountId);
     const registered = registeredAccountForDestination(houseDir, houseAccountId, destination);
     if (registered === null) return { valid: false, reason: "not-registered" };
     if (creatingAccountId === houseAccountId) return { valid: true };
@@ -29034,7 +29146,7 @@ function validateAgentDestination(accountsDir, houseAccountId, creatingAccountId
       scheduleAccount: creatingAccountId
     };
   }
-  const { adminUsers } = readChannelAdmins(resolve36(accountsDir, creatingAccountId), "telegram");
+  const { adminUsers } = readChannelAdmins(resolve37(accountsDir, creatingAccountId), "telegram");
   const asNumber = Number(destination);
   const ok2 = Number.isInteger(asNumber) && adminUsers.includes(asNumber);
   return ok2 ? { valid: true } : { valid: false, reason: "not-registered" };
@@ -29044,7 +29156,7 @@ function listDispatchDestinations(input) {
   const managers = [];
   const admins = [];
   if (houseAccountId !== null) {
-    const houseDir = resolve36(accountsDir, houseAccountId);
+    const houseDir = resolve37(accountsDir, houseAccountId);
     const { adminPhones, accountManagers } = readChannelAdmins(houseDir, "whatsapp");
     const seen = /* @__PURE__ */ new Set();
     for (const [phone, subAccountId] of Object.entries(accountManagers)) {
@@ -29062,7 +29174,7 @@ function listDispatchDestinations(input) {
       admins.push({ channel: "whatsapp", destination: phone, label: "House admin" });
     }
   }
-  const { byBot: byBot2 } = readChannelAdmins(resolve36(accountsDir, accountId), "telegram");
+  const { byBot: byBot2 } = readChannelAdmins(resolve37(accountsDir, accountId), "telegram");
   const telegram = byBot2.flatMap((b) => b.adminUsers.map((id) => ({ botId: b.botId, id }))).sort((a, b) => a.id - b.id || a.botId.localeCompare(b.botId)).map(({ botId, id }) => ({
     channel: "telegram",
     destination: String(id),
@@ -29112,6 +29224,23 @@ var ROUTINE_COLS = `e.eventId AS eventId, e.name AS name, e.eventStatus AS event
 function since24h() {
   return new Date(Date.now() - 24 * 60 * 60 * 1e3).toISOString();
 }
+function gateClassification(row) {
+  const judged = row.eventStatus === "scheduled" && row.recurrence !== null && row.agentChannel !== null && row.agentDestination !== null && row.agentPrompt !== null;
+  if (!judged) return null;
+  if (row.gatePlugin) return true;
+  return typeof row.gateWaived === "string" && row.gateWaived.trim() !== "";
+}
+function gateWatermarkPath(eventId) {
+  return resolve38(PLATFORM_ROOT, "..", "state", "scheduling-gate", `${eventId}.json`);
+}
+function readGateLastCommitAt(eventId) {
+  try {
+    const parsed = JSON.parse(readFileSync44(gateWatermarkPath(eventId), "utf-8"));
+    return typeof parsed?.lastCommitAt === "string" ? parsed.lastCommitAt : null;
+  } catch {
+    return null;
+  }
+}
 function mapRoutine(r) {
   const g = (k) => r.get(k) ?? null;
   const n = (k) => {
@@ -29161,7 +29290,23 @@ function mapRoutine(r) {
     // only the list: the modal's save replaces the list row wholesale
     // (page.tsx:202), so counts served on the list alone would blank on save.
     runs24h: n("runs24h"),
-    gated24h: n("gated24h")
+    gated24h: n("gated24h"),
+    // Task 2472 — computed from columns already projected above, so no Cypher
+    // changes and no second query. See gateClassification for why `null` is a
+    // third state rather than a default `true`.
+    gateClassified: gateClassification({
+      eventStatus: g("eventStatus"),
+      recurrence: g("recurrence"),
+      agentChannel: g("agentChannel"),
+      agentDestination: g("agentDestination"),
+      agentPrompt: g("agentPrompt"),
+      gatePlugin: g("gatePlugin"),
+      gateWaived: g("gateWaived")
+    }),
+    // Task 2472 — read only for a gated row: an ungated one has no gate to be
+    // late, and a file read per card on every list would otherwise be spent
+    // proving that.
+    gateLastCommitAt: g("gateTool") === null ? null : readGateLastCommitAt(g("eventId") ?? "")
   };
 }
 function dispatchFieldsOf(r) {
@@ -29919,8 +30064,8 @@ init_dist();
 init_helpers();
 init_account_scope();
 init_route_cache();
-import { existsSync as existsSync44, readdirSync as readdirSync26, readFileSync as readFileSync44, rmSync as rmSync6 } from "fs";
-import { resolve as resolve37 } from "path";
+import { existsSync as existsSync43, readdirSync as readdirSync26, readFileSync as readFileSync45, rmSync as rmSync6 } from "fs";
+import { resolve as resolve39 } from "path";
 var app56 = new Hono();
 var NAME_RE = /^[a-z0-9][a-z0-9-]*$/;
 function splitSkillMd(text) {
@@ -29943,7 +30088,7 @@ function stripQuotes(s) {
   return s;
 }
 function subdirs2(dir) {
-  if (!existsSync44(dir)) return [];
+  if (!existsSync43(dir)) return [];
   try {
     return readdirSync26(dir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
   } catch {
@@ -29958,19 +30103,19 @@ app56.get("/", requireAdminSession, async (c) => {
   }
   ensureAccountWatchers(acct.accountId, acct.accountDir);
   const { value, state } = await getOrCompute("skills", acct.accountId, async () => {
-    const pluginsDir = resolve37(acct.accountDir, "plugins");
+    const pluginsDir = resolve39(acct.accountDir, "plugins");
     const skills = [];
     let pluginCount = 0;
     for (const plugin of subdirs2(pluginsDir)) {
       pluginCount++;
-      const skillsDir = resolve37(pluginsDir, plugin, "skills");
+      const skillsDir = resolve39(pluginsDir, plugin, "skills");
       for (const skill of subdirs2(skillsDir)) {
-        const skillMd = resolve37(skillsDir, skill, "SKILL.md");
-        if (!existsSync44(skillMd)) continue;
+        const skillMd = resolve39(skillsDir, skill, "SKILL.md");
+        if (!existsSync43(skillMd)) continue;
         try {
-          const { frontmatter } = splitSkillMd(readFileSync44(skillMd, "utf-8"));
-          const refsDir = resolve37(skillsDir, skill, "references");
-          const refCount = existsSync44(refsDir) ? readdirSync26(refsDir, { withFileTypes: true }).filter((e) => e.isFile()).length : 0;
+          const { frontmatter } = splitSkillMd(readFileSync45(skillMd, "utf-8"));
+          const refsDir = resolve39(skillsDir, skill, "references");
+          const refCount = existsSync43(refsDir) ? readdirSync26(refsDir, { withFileTypes: true }).filter((e) => e.isFile()).length : 0;
           skills.push({ plugin, skill, description: frontmatter.description, refCount });
         } catch (err) {
           console.error(`[admin:skills] op=list-skip plugin=${plugin} skill=${skill} reason="${err instanceof Error ? err.message : String(err)}"`);
@@ -29992,15 +30137,15 @@ app56.get("/:plugin/:skill", requireAdminSession, async (c) => {
     console.error(`[admin:skills] op=get outcome=rejected reason=invalid-name plugin="${plugin}" skill="${skill}"`);
     return c.json({ error: "Invalid plugin or skill name" }, 400);
   }
-  const skillDir = resolve37(acct.accountDir, "plugins", plugin, "skills", skill);
-  const skillMd = resolve37(skillDir, "SKILL.md");
-  const found = existsSync44(skillMd);
+  const skillDir = resolve39(acct.accountDir, "plugins", plugin, "skills", skill);
+  const skillMd = resolve39(skillDir, "SKILL.md");
+  const found = existsSync43(skillMd);
   console.log(`[admin:skills] op=get plugin=${plugin} skill=${skill} found=${found}`);
   if (!found) return c.json({ error: "Skill not found" }, 404);
   try {
-    const { frontmatter, body } = splitSkillMd(readFileSync44(skillMd, "utf-8"));
-    const refsDir = resolve37(skillDir, "references");
-    const references = existsSync44(refsDir) ? readdirSync26(refsDir, { withFileTypes: true }).filter((e) => e.isFile()).map((e) => e.name).sort() : [];
+    const { frontmatter, body } = splitSkillMd(readFileSync45(skillMd, "utf-8"));
+    const refsDir = resolve39(skillDir, "references");
+    const references = existsSync43(refsDir) ? readdirSync26(refsDir, { withFileTypes: true }).filter((e) => e.isFile()).map((e) => e.name).sort() : [];
     return c.json({ skill: { plugin, skill, frontmatter, body, references } });
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
@@ -30017,10 +30162,10 @@ app56.delete("/:plugin/:skill", requireAdminSession, async (c) => {
     console.error(`[admin:skills] op=delete outcome=rejected reason=invalid-name plugin="${plugin}" skill="${skill}"`);
     return c.json({ error: "Invalid plugin or skill name" }, 400);
   }
-  const pluginDir = resolve37(acct.accountDir, "plugins", plugin);
-  const skillsDir = resolve37(pluginDir, "skills");
-  const skillDir = resolve37(skillsDir, skill);
-  if (!existsSync44(resolve37(skillDir, "SKILL.md"))) {
+  const pluginDir = resolve39(acct.accountDir, "plugins", plugin);
+  const skillsDir = resolve39(pluginDir, "skills");
+  const skillDir = resolve39(skillsDir, skill);
+  if (!existsSync43(resolve39(skillDir, "SKILL.md"))) {
     console.error(`[admin:skills] op=delete outcome=rejected reason=not-found plugin=${plugin} skill=${skill}`);
     return c.json({ error: "Skill not found" }, 404);
   }
@@ -30028,7 +30173,7 @@ app56.delete("/:plugin/:skill", requireAdminSession, async (c) => {
     rmSync6(skillDir, { recursive: true, force: true });
     const pluginDirRemoved = subdirs2(skillsDir).length === 0;
     if (pluginDirRemoved) rmSync6(pluginDir, { recursive: true, force: true });
-    const skillDirGone = !existsSync44(skillDir);
+    const skillDirGone = !existsSync43(skillDir);
     if (!skillDirGone) {
       console.error(`[admin:skills] op=delete plugin=${plugin} skill=${skill} outcome=rejected reason=rm-incomplete skillDirGone=false`);
       return c.json({ error: "Delete did not remove the skill directory" }, 503);
@@ -30672,8 +30817,8 @@ init_neo4j_store();
 // app/lib/admin-roster.ts
 init_account();
 init_neo4j_store();
-import { existsSync as existsSync45, readdirSync as readdirSync27, readFileSync as readFileSync45 } from "fs";
-import { resolve as resolve38 } from "path";
+import { existsSync as existsSync44, readdirSync as readdirSync27, readFileSync as readFileSync46 } from "fs";
+import { resolve as resolve40 } from "path";
 function readHouseAdminUserIds(accountsDir = ACCOUNTS_DIR) {
   let entries2;
   try {
@@ -30681,11 +30826,11 @@ function readHouseAdminUserIds(accountsDir = ACCOUNTS_DIR) {
   } catch {
     return [];
   }
-  for (const entry of entries2) {
-    const cfgPath = resolve38(accountsDir, entry, "account.json");
-    if (!existsSync45(cfgPath)) continue;
+  for (const entry2 of entries2) {
+    const cfgPath = resolve40(accountsDir, entry2, "account.json");
+    if (!existsSync44(cfgPath)) continue;
     try {
-      const cfg = JSON.parse(readFileSync45(cfgPath, "utf-8"));
+      const cfg = JSON.parse(readFileSync46(cfgPath, "utf-8"));
       if (cfg.role !== "house") continue;
       if (!Array.isArray(cfg.admins)) return [];
       return cfg.admins.map(
@@ -31033,7 +31178,7 @@ init_claude_agent();
 init_account();
 init_neo4j_store();
 init_src2();
-import { resolve as resolve39 } from "path";
+import { resolve as resolve41 } from "path";
 var TAG49 = "[admin:routines]";
 function scopeFor(d, houseDir, houseAccountId) {
   if (d.channel !== "whatsapp") return null;
@@ -31063,7 +31208,7 @@ app67.get("/", requireAdminSession, async (c) => {
     console.error(`${TAG49} op=destinations account=${accountId.slice(0, 8)} outcome=house-unresolved reason="${message}"`);
   }
   const destinations = listDispatchDestinations({ accountsDir: ACCOUNTS_DIR, houseAccountId, accountId });
-  const houseDir = houseAccountId === null ? null : resolve39(ACCOUNTS_DIR, houseAccountId);
+  const houseDir = houseAccountId === null ? null : resolve41(ACCOUNTS_DIR, houseAccountId);
   const byScope = /* @__PURE__ */ new Map();
   for (const d of destinations) {
     const scope = houseDir === null || houseAccountId === null ? null : scopeFor(d, houseDir, houseAccountId);
@@ -31413,9 +31558,9 @@ init_dist();
 
 // app/lib/access-email.ts
 import { spawn as spawn2 } from "child_process";
-import { resolve as resolve40 } from "path";
-var PLATFORM_ROOT5 = process.env.MAXY_PLATFORM_ROOT ?? resolve40(process.cwd(), "..");
-var SEND_SCRIPT = resolve40(
+import { resolve as resolve42 } from "path";
+var PLATFORM_ROOT5 = process.env.MAXY_PLATFORM_ROOT ?? resolve42(process.cwd(), "..");
+var SEND_SCRIPT = resolve42(
   PLATFORM_ROOT5,
   "plugins",
   "email",
@@ -31559,8 +31704,8 @@ var access_default = app72;
 // server/routes/sites.ts
 init_dist();
 init_claude_agent();
-import { existsSync as existsSync46, readFileSync as readFileSync46, realpathSync as realpathSync8, statSync as statSync25 } from "fs";
-import { resolve as resolve41 } from "path";
+import { existsSync as existsSync45, readFileSync as readFileSync47, realpathSync as realpathSync8, statSync as statSync25 } from "fs";
+import { resolve as resolve43 } from "path";
 var SAFE_SEG_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var MIME = {
   ".html": "text/html; charset=utf-8",
@@ -31617,15 +31762,15 @@ app73.get("/:rel{.*}", (c) => {
     }
     segments.push(seg);
   }
-  const rootDir = resolve41(account.accountDir, "sites");
-  let filePath = segments.length === 0 ? rootDir : resolve41(rootDir, ...segments);
+  const rootDir = resolve43(account.accountDir, "sites");
+  let filePath = segments.length === 0 ? rootDir : resolve43(rootDir, ...segments);
   if (filePath !== rootDir && !filePath.startsWith(rootDir + "/")) {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
   }
   let stat11;
   try {
-    stat11 = existsSync46(filePath) ? statSync25(filePath) : null;
+    stat11 = existsSync45(filePath) ? statSync25(filePath) : null;
   } catch {
     stat11 = null;
   }
@@ -31638,13 +31783,13 @@ app73.get("/:rel{.*}", (c) => {
     return c.redirect(target, 301);
   }
   if (stat11?.isDirectory()) {
-    filePath = resolve41(filePath, "index.html");
+    filePath = resolve43(filePath, "index.html");
   }
   if (!filePath.startsWith(rootDir + "/")) {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync46(filePath)) {
+  if (!existsSync45(filePath)) {
     console.error(`[sites] not-found path=${reqPath} status=404`);
     return c.text("Not found", 404);
   }
@@ -31663,7 +31808,7 @@ app73.get("/:rel{.*}", (c) => {
   }
   let body;
   try {
-    body = readFileSync46(realPath);
+    body = readFileSync47(realPath);
   } catch (err) {
     const code = err?.code;
     if (code === "EISDIR") {
@@ -31705,7 +31850,7 @@ init_neo4j_store();
 // app/lib/visitor-token.ts
 init_paths();
 import { createHmac as createHmac2, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual3 } from "crypto";
-import { mkdirSync as mkdirSync9, readFileSync as readFileSync47, writeFileSync as writeFileSync17 } from "fs";
+import { mkdirSync as mkdirSync9, readFileSync as readFileSync48, writeFileSync as writeFileSync17 } from "fs";
 import { dirname as dirname16 } from "path";
 var TOKEN_PREFIX = "v1.";
 var SECRET_BYTES = 32;
@@ -31714,7 +31859,7 @@ var cachedSecret = null;
 function getSecret() {
   if (cachedSecret) return cachedSecret;
   try {
-    const hex2 = readFileSync47(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
+    const hex2 = readFileSync48(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
     if (hex2.length === SECRET_BYTES * 2) {
       cachedSecret = Buffer.from(hex2, "hex");
       return cachedSecret;
@@ -31728,7 +31873,7 @@ function getSecret() {
     console.log(`[visitor-token] secret minted path=${VISITOR_TOKEN_SECRET_FILE}`);
   } catch {
   }
-  const hex = readFileSync47(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
+  const hex = readFileSync48(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
   cachedSecret = Buffer.from(hex, "hex");
   return cachedSecret;
 }
@@ -31784,7 +31929,7 @@ var VISITOR_COOKIE_MAX_AGE_SECONDS = Math.floor(DEFAULT_TTL_MS / 1e3);
 init_dist();
 
 // app/lib/brand-config.ts
-import { existsSync as existsSync47, readFileSync as readFileSync48 } from "fs";
+import { existsSync as existsSync46, readFileSync as readFileSync49 } from "fs";
 import { join as join53 } from "path";
 var cached2 = null;
 var cachedAttempted = false;
@@ -31794,9 +31939,9 @@ function readBrandConfig() {
   const platformRoot5 = process.env.MAXY_PLATFORM_ROOT;
   if (!platformRoot5) return null;
   const brandPath = join53(platformRoot5, "config", "brand.json");
-  if (!existsSync47(brandPath)) return null;
+  if (!existsSync46(brandPath)) return null;
   try {
-    cached2 = JSON.parse(readFileSync48(brandPath, "utf-8"));
+    cached2 = JSON.parse(readFileSync49(brandPath, "utf-8"));
     return cached2;
   } catch {
     return null;
@@ -32075,9 +32220,9 @@ function originAllowed(origin, allowlist) {
   try {
     const u = new URL(origin);
     const host = u.host;
-    return allowlist.some((entry) => {
-      if (entry === host) return true;
-      if (entry.startsWith("*.")) return host.endsWith(entry.slice(1));
+    return allowlist.some((entry2) => {
+      if (entry2 === host) return true;
+      if (entry2.startsWith("*.")) return host.endsWith(entry2.slice(1));
       return false;
     });
   } catch {
@@ -32299,16 +32444,16 @@ var visitor_event_default = app76;
 // server/routes/session.ts
 init_dist();
 init_claude_agent();
-import { resolve as resolve42 } from "path";
-import { existsSync as existsSync48, writeFileSync as writeFileSync18, mkdirSync as mkdirSync10 } from "fs";
+import { resolve as resolve44 } from "path";
+import { existsSync as existsSync47, writeFileSync as writeFileSync18, mkdirSync as mkdirSync10 } from "fs";
 init_neo4j_store();
 init_paths();
 var UUID_RE5 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function writeBrandingCache(accountId, agentSlug, branding) {
   try {
-    const cacheDir = resolve42(MAXY_DIR, "branding-cache", accountId);
+    const cacheDir = resolve44(MAXY_DIR, "branding-cache", accountId);
     mkdirSync10(cacheDir, { recursive: true });
-    writeFileSync18(resolve42(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
+    writeFileSync18(resolve44(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
   } catch (err) {
     console.error(`[branding] cache write failed: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -32389,8 +32534,8 @@ app77.post("/", async (c) => {
   }
   let agentConfig = null;
   if (account) {
-    const agentDir = resolve42(account.accountDir, "agents", agentSlug);
-    if (!existsSync48(agentDir) || !existsSync48(resolve42(agentDir, "config.json"))) {
+    const agentDir = resolve44(account.accountDir, "agents", agentSlug);
+    if (!existsSync47(agentDir) || !existsSync47(resolve44(agentDir, "config.json"))) {
       return c.json({ error: "Agent not found" }, 404);
     }
     agentConfig = resolveAgentConfig(account.accountDir, agentSlug);
@@ -32574,7 +32719,7 @@ var calendar_public_default = app78;
 init_dist();
 import { createReadStream as createReadStream3 } from "fs";
 import { stat as stat8, readFile as readFile11, realpath } from "fs/promises";
-import { join as join54, resolve as resolve43, sep as sep11 } from "path";
+import { join as join54, resolve as resolve45, sep as sep11 } from "path";
 import { Readable as Readable3 } from "stream";
 init_data_path();
 init_attachments();
@@ -32629,7 +32774,7 @@ ${expiresAtMs}`)
   return diff2 === 0;
 }
 async function readAccountSecret(accountId) {
-  const path = resolve43(DATA_ROOT, "accounts", accountId, "secrets", "data-portal.env");
+  const path = resolve45(DATA_ROOT, "accounts", accountId, "secrets", "data-portal.env");
   let text;
   try {
     text = await readFile11(path, "utf8");
@@ -32665,7 +32810,7 @@ async function resolveFetchTarget(accountDir, relPath, ownerId) {
   const exposeFolders = await readExposeFolders2(accountDir);
   const { exposed } = resolveExposedDirs(schemaText, exposeFolders);
   if (exposed.length === 0 && !ownerId) return { ok: false, reason: "not-exposed" };
-  const lexical = resolve43(accountDir, relPath);
+  const lexical = resolve45(accountDir, relPath);
   let root;
   let absolute;
   try {
@@ -32714,7 +32859,7 @@ async function handle(c, headOnly) {
     return c.json({ ok: false, error: "denied" }, 401);
   }
   const target = await resolveFetchTarget(
-    resolve43(DATA_ROOT, "accounts", accountId),
+    resolve45(DATA_ROOT, "accounts", accountId),
     relPath,
     owner || void 0
   );
@@ -32836,7 +32981,7 @@ init_neo4j_store();
 
 // app/lib/ledger-census.ts
 init_loop_registry();
-import { readdirSync as readdirSync29, readFileSync as readFileSync49, statSync as statSync26 } from "fs";
+import { readdirSync as readdirSync29, readFileSync as readFileSync50, statSync as statSync26 } from "fs";
 import { join as join55 } from "path";
 
 // ../lib/ledger-core/dist/reconcile.js
@@ -32894,7 +33039,7 @@ function countWriteRejects24h(logDir, now) {
     const path = join55(logDir, name);
     try {
       if (now - statSync26(path).mtimeMs > DAY_MS) continue;
-      for (const line of readFileSync49(path, "utf8").split("\n")) {
+      for (const line of readFileSync50(path, "utf8").split("\n")) {
         if (line.includes("[graph-write] reject")) total += 1;
       }
     } catch {
@@ -32997,7 +33142,7 @@ function startLedgerCensus(openSession, opts = {}) {
 // app/lib/dispatch-census.ts
 init_loop_registry();
 init_account();
-import { readFileSync as readFileSync50 } from "fs";
+import { readFileSync as readFileSync51 } from "fs";
 import { join as join56 } from "path";
 var CENSUS_TAG2 = "[dispatch-census]";
 var CONFIG_AUDIT_TAG = "[dispatch-config-audit]";
@@ -33031,7 +33176,7 @@ function percentile(sortedAsc, p) {
 function auditConfigFile(accountDir) {
   let cfg;
   try {
-    cfg = JSON.parse(readFileSync50(join56(accountDir, "dispatch", "config.json"), "utf-8"));
+    cfg = JSON.parse(readFileSync51(join56(accountDir, "dispatch", "config.json"), "utf-8"));
   } catch {
     return null;
   }
@@ -33056,7 +33201,7 @@ function auditConfigFile(accountDir) {
 function terminalStatuses(accountDir) {
   try {
     const cfg = JSON.parse(
-      readFileSync50(join56(accountDir, "dispatch", "config.json"), "utf-8")
+      readFileSync51(join56(accountDir, "dispatch", "config.json"), "utf-8")
     );
     return {
       job: (cfg.statuses?.job ?? []).filter((s) => s.terminal).map((s) => s.name),
@@ -33447,7 +33592,7 @@ function startGraphHealthTimer() {
 init_loop_registry();
 init_data_path();
 var import_dist11 = __toESM(require_dist(), 1);
-import { existsSync as existsSync49, statSync as statSync27, readdirSync as readdirSync30 } from "fs";
+import { existsSync as existsSync48, statSync as statSync27, readdirSync as readdirSync30 } from "fs";
 import { join as join57 } from "path";
 var TAG57 = "[shared-census]";
 var WIRED_SURFACES = 3;
@@ -33467,7 +33612,7 @@ function countFiles(dir) {
 }
 function runSharedFolderCensus(dataRoot = DATA_ROOT) {
   const root = (0, import_dist11.sharedRoot)(dataRoot);
-  const exists = existsSync49(root);
+  const exists = existsSync48(root);
   let isDir = false;
   if (exists) {
     try {
@@ -33493,7 +33638,7 @@ function startSharedFolderCensus() {
 // app/lib/file-watcher.ts
 init_data_path();
 import * as fsp2 from "fs/promises";
-import { resolve as resolve44, sep as sep12 } from "path";
+import { resolve as resolve46, sep as sep12 } from "path";
 var ACCOUNT_UUID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var DEFAULT_COALESCE_MS = 500;
 var ROOTS = ["accounts"];
@@ -33512,7 +33657,7 @@ async function startFileWatcher(opts = {}) {
   const dropFn = opts.drop ?? dropFileIndex;
   for (const r of ROOTS) {
     try {
-      await fsp2.mkdir(resolve44(dataRoot, r), { recursive: true });
+      await fsp2.mkdir(resolve46(dataRoot, r), { recursive: true });
     } catch (err) {
       console.error(
         `[file-watcher] start-failed root="${r}" err="${err.message}" \u2014 index will be maintained by the 5-min reconcile backstop only`
@@ -33533,7 +33678,7 @@ async function startFileWatcher(opts = {}) {
     timers.set(relativePath, t);
   }
   async function runHook(relativePath, accountId) {
-    const absolute = resolve44(dataRoot, relativePath);
+    const absolute = resolve46(dataRoot, relativePath);
     let exists = false;
     try {
       const st = await fsp2.stat(absolute);
@@ -33557,7 +33702,7 @@ async function startFileWatcher(opts = {}) {
     }
   }
   async function watchRoot(rootName) {
-    const absRoot = resolve44(dataRoot, rootName);
+    const absRoot = resolve46(dataRoot, rootName);
     try {
       const iter = fsp2.watch(absRoot, { recursive: true, signal: controller.signal });
       for await (const event of iter) {
@@ -33599,7 +33744,7 @@ init_data_path();
 init_neo4j_store();
 init_account();
 import { mkdir as mkdir5, readdir as readdir6, rename as rename4, rm as rm3 } from "fs/promises";
-import { dirname as dirname17, relative as relative8, resolve as resolve45 } from "path";
+import { dirname as dirname17, relative as relative8, resolve as resolve47 } from "path";
 var ACCOUNT_UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function walkFiles(dir) {
   const out = [];
@@ -33610,7 +33755,7 @@ async function walkFiles(dir) {
     return out;
   }
   for (const e of entries2) {
-    const abs = resolve45(dir, e.name);
+    const abs = resolve47(dir, e.name);
     if (e.isDirectory()) {
       out.push(...await walkFiles(abs));
     } else if (e.isFile()) {
@@ -33630,7 +33775,7 @@ async function relocateTree(srcDir, destDir, dataRoot, accountId, session) {
   let moved = 0;
   for (const oldAbs of files) {
     const suffix = relative8(srcDir, oldAbs);
-    const newAbs = resolve45(destDir, suffix);
+    const newAbs = resolve47(destDir, suffix);
     await mkdir5(dirname17(newAbs), { recursive: true });
     await rename4(oldAbs, newAbs);
     moved++;
@@ -33657,7 +33802,7 @@ async function relocateTree(srcDir, destDir, dataRoot, accountId, session) {
 }
 async function migrateUploads(opts = {}) {
   const dataRoot = opts.dataRoot ?? DATA_ROOT;
-  const oldRoot = resolve45(dataRoot, "uploads");
+  const oldRoot = resolve47(dataRoot, "uploads");
   let topEntries;
   try {
     topEntries = await readdir6(oldRoot, { withFileTypes: true });
@@ -33674,12 +33819,12 @@ async function migrateUploads(opts = {}) {
   let moved = 0;
   let skipped = 0;
   try {
-    for (const entry of topEntries) {
-      const name = entry.name;
+    for (const entry2 of topEntries) {
+      const name = entry2.name;
       if (ACCOUNT_UUID_RE4.test(name)) {
         moved += await relocateTree(
-          resolve45(oldRoot, name),
-          resolve45(dataRoot, "accounts", name, "uploads"),
+          resolve47(oldRoot, name),
+          resolve47(dataRoot, "accounts", name, "uploads"),
           dataRoot,
           name,
           session
@@ -33691,8 +33836,8 @@ async function migrateUploads(opts = {}) {
           continue;
         }
         moved += await relocateTree(
-          resolve45(oldRoot, "public"),
-          resolve45(dataRoot, "accounts", installAccountId, "uploads", "public"),
+          resolve47(oldRoot, "public"),
+          resolve47(dataRoot, "accounts", installAccountId, "uploads", "public"),
           dataRoot,
           null,
           // public uploads carry no graph nodes
@@ -33726,7 +33871,7 @@ init_pin_validator();
 init_account();
 init_neo4j_store();
 import { readdir as readdir7, readFile as readFile12, rename as rename5, writeFile as writeFile5, unlink as unlink4 } from "fs/promises";
-import { existsSync as existsSync50 } from "fs";
+import { existsSync as existsSync49 } from "fs";
 import { join as join58 } from "path";
 var ADMIN_ROLE2 = "admin";
 var WEBCHAT_CHANNEL2 = "webchat";
@@ -33756,7 +33901,7 @@ async function writeRaw(path, obj) {
     await rename5(tmp, path);
   } catch (err) {
     try {
-      if (existsSync50(tmp)) await unlink4(tmp);
+      if (existsSync49(tmp)) await unlink4(tmp);
     } catch {
     }
     throw err;
@@ -33779,11 +33924,11 @@ async function collectLiveSidecars(projectsRoot) {
     } catch {
       continue;
     }
-    for (const entry of entries2) {
-      if (entry.isFile() && SESSION_META_RE.test(entry.name)) {
-        out.push(join58(slugDir, entry.name));
-      } else if (entry.isDirectory() && entry.name === "subagents") {
-        const subDir = join58(slugDir, entry.name);
+    for (const entry2 of entries2) {
+      if (entry2.isFile() && SESSION_META_RE.test(entry2.name)) {
+        out.push(join58(slugDir, entry2.name));
+      } else if (entry2.isDirectory() && entry2.name === "subagents") {
+        const subDir = join58(slugDir, entry2.name);
         let subs;
         try {
           subs = await readdir7(subDir, { withFileTypes: true });
@@ -33880,7 +34025,7 @@ async function migrateAdminWebchatSidecars(opts = {}) {
 // app/lib/migrate-sidecar-account-ids.ts
 init_account();
 import { readdir as readdir8, readFile as readFile13, rename as rename6, writeFile as writeFile6, unlink as unlink5 } from "fs/promises";
-import { existsSync as existsSync51 } from "fs";
+import { existsSync as existsSync50 } from "fs";
 import { join as join59 } from "path";
 var SESSION_META_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.meta\.json$/i;
 function projectSlugForCwd(cwd) {
@@ -33907,7 +34052,7 @@ async function writeRaw2(path, obj) {
     await rename6(tmp, path);
   } catch (err) {
     try {
-      if (existsSync51(tmp)) await unlink5(tmp);
+      if (existsSync50(tmp)) await unlink5(tmp);
     } catch {
     }
     throw err;
@@ -33934,11 +34079,11 @@ async function collectSidecars(projectsRoot) {
     } catch {
       continue;
     }
-    for (const entry of entries2) {
-      if (entry.isFile() && SESSION_META_RE2.test(entry.name)) {
-        out.push({ path: join59(slugDir, entry.name), slug: slug.name });
-      } else if (entry.isDirectory() && (entry.name === "subagents" || entry.name === "archive")) {
-        const subDir = join59(slugDir, entry.name);
+    for (const entry2 of entries2) {
+      if (entry2.isFile() && SESSION_META_RE2.test(entry2.name)) {
+        out.push({ path: join59(slugDir, entry2.name), slug: slug.name });
+      } else if (entry2.isDirectory() && (entry2.name === "subagents" || entry2.name === "archive")) {
+        const subDir = join59(slugDir, entry2.name);
         let subs;
         try {
           subs = await readdir8(subDir, { withFileTypes: true });
@@ -35326,12 +35471,20 @@ var InboundHub2 = class {
   /** Task-962 — terminal-drop one still-queued in-flight message by id. Returns
    *  whether a matching queued entry was found and removed. */
   dropQueued(key2, messageId) {
+    return this.takeQueued(key2, messageId) !== null;
+  }
+  /** Task 2466 — remove one still-queued in-flight message by id and return its
+   *  payload, so the caller can re-route it. `dropQueued` discards; this hands
+   *  over, and the two share this one removal so a message can never be both
+   *  dropped and re-routed. Null when no matching queued entry exists — a
+   *  message that has already drained, acked, or been dropped is not takeable. */
+  takeQueued(key2, messageId) {
     const s = this.keys.get(key2);
-    if (!s) return false;
+    if (!s) return null;
     const i = s.inFlight.findIndex((e) => e.payload.messageId === messageId && e.state === "queued");
-    if (i < 0) return false;
-    s.inFlight.splice(i, 1);
-    return true;
+    if (i < 0) return null;
+    const [entry2] = s.inFlight.splice(i, 1);
+    return entry2.payload;
   }
   /** Whether a key currently has a live channel server attached. The gateway
    *  uses this to decide whether an inbound needs a cold-start spawn/resume. */
@@ -35481,7 +35634,7 @@ function createWebchatChannelRoutes(deps) {
 }
 
 // app/lib/webchat/gateway/resolve-turn-answer.ts
-import { existsSync as existsSync52, openSync as openSync9, readSync as readSync8, closeSync as closeSync9, readdirSync as readdirSync31 } from "fs";
+import { existsSync as existsSync51, openSync as openSync9, readSync as readSync8, closeSync as closeSync9, readdirSync as readdirSync31 } from "fs";
 import { join as join60 } from "path";
 function resolveTurnAnswer(p) {
   if (!SESSION_ID_RE2.test(p.sessionId)) return "";
@@ -35510,7 +35663,7 @@ function resolveTurnAnswer(p) {
   return segmentText(parts.join("\n\n")).join("\n\n");
 }
 function findJsonl(projectsRoot, sessionId) {
-  if (!existsSync52(projectsRoot)) return null;
+  if (!existsSync51(projectsRoot)) return null;
   let slugs;
   try {
     slugs = readdirSync31(projectsRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
@@ -35519,7 +35672,7 @@ function findJsonl(projectsRoot, sessionId) {
   }
   for (const slug of slugs) {
     const live = join60(projectsRoot, slug, `${sessionId}.jsonl`);
-    if (existsSync52(live)) return live;
+    if (existsSync51(live)) return live;
   }
   return null;
 }
@@ -35573,6 +35726,12 @@ var WebchatGateway = class _WebchatGateway {
   /** Task-962 — `${key}::${messageId}` for messages a recovery call has already
    *  been issued for, so recovery is attempted at most once per message. */
   recoveryAttempted = /* @__PURE__ */ new Set();
+  /** Task 2465 — which session each conversation key's child is running. Written
+   *  at spawn (the admin id is decided before the manager call, so it is already
+   *  known there) and at turn-end (which carries key AND sessionId, so the map
+   *  survives a UI restart for any child that has completed a turn). Read only by
+   *  auditKeyOrphans. */
+  keySession = /* @__PURE__ */ new Map();
   /** Task-962 — guards against overlapping async recovery passes. */
   recovering = false;
   seq = 0;
@@ -35581,16 +35740,16 @@ var WebchatGateway = class _WebchatGateway {
    *  The public /api/chat route awaits this to return the reply on the same SSE
    *  response, preserving the pre-756 POST→single-blob browser contract. */
   awaitReply(key2, timeoutMs) {
-    return new Promise((resolve51) => {
+    return new Promise((resolve53) => {
       const timer = setTimeout(() => {
         this.replyAwaiters.delete(key2);
-        resolve51({ timeout: true });
+        resolve53({ timeout: true });
       }, timeoutMs);
       if (timer.unref) timer.unref();
       this.replyAwaiters.set(key2, (r) => {
         clearTimeout(timer);
         this.replyAwaiters.delete(key2);
-        resolve51(r);
+        resolve53(r);
       });
     });
   }
@@ -35601,11 +35760,11 @@ var WebchatGateway = class _WebchatGateway {
    *  terminal dialog stays answerable). */
   awaitPermissionVerdict(p, timeoutMs) {
     const k = _WebchatGateway.promptKey(p.key, p.requestId);
-    return new Promise((resolve51) => {
+    return new Promise((resolve53) => {
       this.pendingPrompts.get(k)?.resolve({ timeout: true });
       const timer = setTimeout(() => {
         this.pendingPrompts.delete(k);
-        resolve51({ timeout: true });
+        resolve53({ timeout: true });
       }, timeoutMs);
       if (timer.unref) timer.unref();
       this.pendingPrompts.set(k, {
@@ -35615,7 +35774,7 @@ var WebchatGateway = class _WebchatGateway {
           clearTimeout(timer);
           this.pendingPrompts.delete(k);
           this.deps.onPointerChange?.(p.key);
-          resolve51(r);
+          resolve53(r);
         }
       });
       console.error(`[webchat:perm] op=open key=${keyDisplay(p.key)} id=${p.requestId} tool=${p.toolName}`);
@@ -35626,9 +35785,9 @@ var WebchatGateway = class _WebchatGateway {
    *  false (and is a no-op) when no prompt with this key+id is open — a late or
    *  duplicate click. */
   resolvePermissionVerdict(key2, requestId, behavior) {
-    const entry = this.pendingPrompts.get(_WebchatGateway.promptKey(key2, requestId));
-    if (!entry) return false;
-    entry.resolve({ behavior });
+    const entry2 = this.pendingPrompts.get(_WebchatGateway.promptKey(key2, requestId));
+    if (!entry2) return false;
+    entry2.resolve({ behavior });
     console.error(`[webchat:perm] op=verdict key=${keyDisplay(key2)} id=${requestId} behavior=${behavior}`);
     return true;
   }
@@ -35771,6 +35930,7 @@ var WebchatGateway = class _WebchatGateway {
         }
       },
       onTurnEnd: (key2, role, turn) => {
+        this.keySession.set(key2, turn.sessionId);
         if (role === "admin") {
           this.lastDeliveredAt.delete(key2);
           return "none";
@@ -35801,6 +35961,7 @@ var WebchatGateway = class _WebchatGateway {
     });
     for (const e of events) {
       console.error(`[webchat:inbound] op=${e.kind} key=${e.key} messageId=${e.messageId} ageMs=${e.ageMs}`);
+      this.deliveryFailures.set(e.key, { messageId: e.messageId, at: now });
     }
     return events;
   }
@@ -35830,6 +35991,7 @@ var WebchatGateway = class _WebchatGateway {
       run: () => {
         const now = Date.now();
         const events = this.reconcile(now);
+        this.auditKeyOrphans(now);
         void this.recoverStalled(now);
         return events.length > 0 ? `${events.length} terminal events` : void 0;
       }
@@ -35846,6 +36008,60 @@ var WebchatGateway = class _WebchatGateway {
   clearDeliveryFailure(key2) {
     this.deliveryFailures.delete(key2);
   }
+  /** Task 2465 — record which session a conversation key's child is running.
+   *  Public so the audit below can be driven directly in tests without standing
+   *  up the channel-server HTTP surface; production writes come from runSpawn and
+   *  the turn-end handler. */
+  noteKeySession(key2, sessionId) {
+    this.keySession.set(key2, sessionId);
+  }
+  /** Task 2465 — STANDING RECONCILIATION: a queued message on a key no live child
+   *  subscribes to, while the session that key names IS live under a different
+   *  key. Expected against actual, on the sweep tick.
+   *
+   *  There is no action to hang this on and re-running the send reproduces the
+   *  same silence, which is why it is an audit rather than another action log.
+   *  Before this, the state emitted nothing until the 30s recovery tick, and the
+   *  queued key and the live key never appeared on one line anywhere in
+   *  server.log — the reason the 2026-08-06 incident read as a wedge throughout.
+   *  `liveKey` is the whole diagnosis, and it fires on the FIRST occurrence.
+   *
+   *  Covers: a queued key with no subscriber whose named session is held by a
+   *  different attached key. Does NOT cover a live child this process neither
+   *  spawned nor saw finish a turn — it is absent from keySession, and this is
+   *  silent for it. Silent when the keys agree, which is every healthy send.
+   *
+   *  Public for the same reason noteKeySession is.
+   *
+   *  Task 2466 — the live-key scan moved to sessionSubscriberKey, which the
+   *  recovery pass also reads. The audit's own behaviour is unchanged. */
+  auditKeyOrphans(now) {
+    for (const c of this.hub.staleQueued(now, 0)) {
+      const sessionId = c.key.startsWith("session:") ? c.key.slice("session:".length) : this.keySession.get(c.key);
+      if (!sessionId) continue;
+      const liveKey = this.sessionSubscriberKey(sessionId);
+      if (liveKey === null || liveKey === c.key) continue;
+      console.error(
+        `[webchat:inbound] op=key-orphan key=${c.key} messageId=${c.messageId} ageMs=${c.ageMs} liveKey=${liveKey} sessionId=${sessionId.slice(0, 8)}`
+      );
+    }
+  }
+  /** Task 2466 — the conversation key whose channel server is attached right now
+   *  and which this gateway records as serving `sessionId`, or null when no such
+   *  key exists. The one place "is this session reachable over its channel" is
+   *  decided; the orphan audit above and the recovery pass below both read it.
+   *
+   *  Both readers are recovery-shaped, so the caller always holds a key with no
+   *  subscriber and this can never return that same key. Blind, by construction,
+   *  to a live child this process neither spawned nor saw finish a turn: it is
+   *  absent from keySession, and the answer is null. */
+  sessionSubscriberKey(sessionId) {
+    for (const [liveKey, liveSession] of this.keySession) {
+      if (liveSession !== sessionId) continue;
+      if (this.hub.hasSubscriber(liveKey)) return liveKey;
+    }
+    return null;
+  }
   /** Task-962 — recovery-aware pass over queued-no-subscriber messages.
    *   - age in [RECOVER_TRIGGER_MS, DELIVER_FINAL_MS): ask the manager to recover
    *     the live session ONCE. busy → leave queued for the channel server's
@@ -35874,15 +36090,19 @@ var WebchatGateway = class _WebchatGateway {
         const d = this.recoverable.get(c.key);
         if (!d || !this.deps.recoverLiveSession) {
           this.hub.dropQueued(c.key, c.messageId);
+          this.deliveryFailures.set(c.key, { messageId: c.messageId, at: now });
           console.error(
             `[webchat:inbound] op=spawn-undelivered key=${keyDisplay(c.key)} messageId=${c.messageId} ageMs=${c.ageMs} reason=no-descriptor`
           );
           continue;
         }
         this.recoveryAttempted.add(attemptKey);
+        const recoverSessionId = c.key.startsWith("session:") ? c.key.slice("session:".length) : this.keySession.get(c.key) ?? d.sessionId;
+        const liveKey = recoverSessionId === void 0 ? null : this.sessionSubscriberKey(recoverSessionId);
+        const subscriberAttached = liveKey !== null;
         let r;
         try {
-          r = await this.deps.recoverLiveSession(d);
+          r = await this.deps.recoverLiveSession({ ...d, subscriberAttached });
         } catch (err) {
           console.error(
             `[webchat:inbound] op=recover-error key=${keyDisplay(c.key)} messageId=${c.messageId} err=${err instanceof Error ? err.message : String(err)}`
@@ -35892,6 +36112,7 @@ var WebchatGateway = class _WebchatGateway {
         if (!r.live) {
           this.hub.dropQueued(c.key, c.messageId);
           this.recoveryAttempted.delete(attemptKey);
+          this.deliveryFailures.set(c.key, { messageId: c.messageId, at: now });
           console.error(
             `[webchat:inbound] op=spawn-undelivered key=${keyDisplay(c.key)} messageId=${c.messageId} ageMs=${c.ageMs} reason=not-live`
           );
@@ -35899,6 +36120,16 @@ var WebchatGateway = class _WebchatGateway {
           console.error(
             `[webchat:inbound] op=recover key=${keyDisplay(c.key)} messageId=${c.messageId} classification=${r.classification ?? "unknown"} respawned=${r.recovered === true}`
           );
+          if (r.classification === "busy" && liveKey !== null && liveKey !== c.key) {
+            const handed = this.hub.takeQueued(c.key, c.messageId);
+            if (handed) {
+              this.recoveryAttempted.delete(attemptKey);
+              this.hub.deliver({ ...handed, key: liveKey }, now);
+              console.error(
+                `[webchat:inbound] op=recover-redeliver key=${c.key} liveKey=${liveKey} messageId=${c.messageId} ageMs=${c.ageMs}`
+              );
+            }
+          }
         }
       }
       for (const key2 of this.recoverable.keys()) {
@@ -35963,6 +36194,10 @@ var WebchatGateway = class _WebchatGateway {
         accountId: input.accountId,
         key: input.key,
         role: input.role,
+        // Task 2466 — a template value. Reachability is a fact about NOW, not
+        // about when the message arrived, so recoverStalled re-stamps it on the
+        // copy it hands to the manager.
+        subscriberAttached: false,
         ...input.sessionId !== void 0 ? { sessionId: input.sessionId } : {},
         ...input.adminUserId !== void 0 ? { adminUserId: input.adminUserId } : {}
       });
@@ -36011,6 +36246,9 @@ var WebchatGateway = class _WebchatGateway {
           lastActivityAt: Date.now()
         });
       }
+      if (input.role === "admin" && input.sessionId !== void 0) {
+        this.keySession.set(input.key, input.sessionId);
+      }
     } catch (err) {
       const reason = (err instanceof Error ? err.message : String(err)).replace(/\s+/g, " ");
       console.error(
@@ -36023,7 +36261,60 @@ var WebchatGateway = class _WebchatGateway {
   }
 };
 
-// app/lib/channel-pty-bridge/follower.ts
+// app/lib/channel-delivery/answer-accumulator.ts
+var AnswerAccumulator = class {
+  openId = "";
+  buf = "";
+  open = false;
+  emitted = false;
+  /** Feed one JSONL line. Returns every answer completed by this line, in order:
+   *  at most the previous message's, then this one's. */
+  push(line) {
+    if (!line) return [];
+    let row;
+    try {
+      row = JSON.parse(line);
+    } catch {
+      return [];
+    }
+    if (row.type !== "assistant") return this.complete();
+    const msg = row.message;
+    const id = typeof msg?.id === "string" ? msg.id : "";
+    const out = [];
+    if (!this.open || id !== this.openId) {
+      out.push(...this.complete());
+      this.openId = id;
+      this.buf = "";
+      this.open = true;
+      this.emitted = false;
+    }
+    if (Array.isArray(msg?.content)) {
+      for (const block of msg.content) {
+        if (block?.type === "text" && typeof block.text === "string") this.buf += block.text;
+      }
+    }
+    if (!this.emitted && msg?.stop_reason === "end_turn" && this.buf.trim().length > 0) {
+      this.emitted = true;
+      out.push({ messageId: this.openId, text: this.buf });
+    }
+    return out;
+  }
+  /** Complete any open message. Called when the stream ends. */
+  flush() {
+    return this.complete();
+  }
+  complete() {
+    if (!this.open) return [];
+    const answer = !this.emitted && this.buf.trim().length > 0 ? { messageId: this.openId, text: this.buf } : null;
+    this.open = false;
+    this.openId = "";
+    this.buf = "";
+    this.emitted = false;
+    return answer ? [answer] : [];
+  }
+};
+
+// app/lib/channel-delivery/emitter.ts
 function followerPendingMaxMs() {
   return Number(process.env.CHANNEL_PTY_FOLLOWER_PENDING_MAX_MS ?? String(3e5));
 }
@@ -36037,19 +36328,31 @@ function toolResultText(content) {
     (b) => b && typeof b === "object" && typeof b.text === "string" ? b.text : ""
   ).join("");
 }
-function startFollower(opts) {
+function startEmitter(opts) {
   const abort2 = new AbortController();
-  const { entry, tag } = opts;
+  const { entry: entry2, tag } = opts;
+  const answers = new AnswerAccumulator();
+  const emitAnswer = async (answer) => {
+    if (answer.text.trim()) await fanOut2(entry2.subscribers, answer.text, opts.onError, tag);
+    if (!opts.onAnswer) return;
+    try {
+      await opts.onAnswer(answer);
+    } catch (err) {
+      console.error(
+        `${tag} answer-error sessionId=${entry2.sessionId.slice(0, 8)} messageId=${answer.messageId} message=${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  };
   void (async () => {
     try {
-      const sid = entry.sessionId.slice(0, 8);
+      const sid = entry2.sessionId.slice(0, 8);
       const deadline = Date.now() + followerPendingMaxMs();
       const retryMs = followerRetryMs();
       let res;
       let attempt = 0;
       for (; ; ) {
         res = await fetch(
-          managerLogFollowUrl(entry.sessionId, { boundary: opts.suppressResumeReplay === true }),
+          managerLogFollowUrl(entry2.sessionId, { boundary: opts.suppressResumeReplay === true }),
           { signal: abort2.signal }
         );
         console.error(`${tag} follower-connect sessionId=${sid} status=${res.status}`);
@@ -36083,7 +36386,7 @@ function startFollower(opts) {
       const awaitingVerdict = /* @__PURE__ */ new Set();
       let firedFileTools = [];
       let suppressing = opts.suppressResumeReplay === true;
-      let discardedTurns = 0;
+      let discardedAnswers = 0;
       let discardedFileTools = 0;
       while (!abort2.signal.aborted) {
         const { value, done } = await reader.read();
@@ -36100,7 +36403,7 @@ function startFollower(opts) {
             event = JSON.parse(line);
           } catch (err) {
             console.error(
-              `${tag} jsonl-parse-skip sessionId=${entry.sessionId.slice(0, 8)} bytes=${line.length} message=${err instanceof Error ? err.message : String(err)}`
+              `${tag} jsonl-parse-skip sessionId=${entry2.sessionId.slice(0, 8)} bytes=${line.length} message=${err instanceof Error ? err.message : String(err)}`
             );
             continue;
           }
@@ -36108,11 +36411,18 @@ function startFollower(opts) {
             if (suppressing) {
               suppressing = false;
               console.error(
-                `${tag} follower-resume-boundary sessionId=${sid} discarded-head-turns=${discardedTurns} discarded-head-filetools=${discardedFileTools}`
+                `${tag} emitter-resume-boundary sessionId=${sid} discarded-head-answers=${discardedAnswers} discarded-head-filetools=${discardedFileTools}`
               );
             }
             continue;
           }
+          for (const answer of answers.push(line)) {
+            if (suppressing) {
+              discardedAnswers += 1;
+              continue;
+            }
+            await emitAnswer(answer);
+          }
           if (event.type === "user") {
             if (captureVerdicts && awaitingVerdict.size > 0 && !suppressing) {
               const umsg = event.message;
@@ -36136,7 +36446,6 @@ function startFollower(opts) {
                 }
               }
             }
-            entry.pendingTurnText = "";
             firedFileTools = [];
             continue;
           }
@@ -36147,7 +36456,6 @@ function startFollower(opts) {
           if (Array.isArray(msg.content)) {
             for (const block of msg.content) {
               if (block?.type === "text" && typeof block.text === "string") {
-                entry.pendingTurnText += block.text;
                 sawContent = true;
               } else if (block?.type === "tool_use") {
                 sawContent = true;
@@ -36172,16 +36480,9 @@ function startFollower(opts) {
           }
           if (msg.stop_reason === "end_turn") {
             if (suppressing) {
-              entry.pendingTurnText = "";
               firedFileTools = [];
-              discardedTurns += 1;
               continue;
             }
-            const flush = entry.pendingTurnText;
-            entry.pendingTurnText = "";
-            if (flush.trim()) {
-              await fanOut2(entry.subscribers, flush, opts.onError, tag);
-            }
             if (fileDelivery && (firedFileTools.length > 0 || captureVerdicts)) {
               const fired = firedFileTools;
               firedFileTools = [];
@@ -36200,9 +36501,10 @@ function startFollower(opts) {
           }
         }
       }
+      for (const answer of answers.flush()) await emitAnswer(answer);
     } catch (err) {
       if (!abort2.signal.aborted) {
-        opts.onError?.(`follower-error: ${err instanceof Error ? err.message : String(err)}`);
+        opts.onError?.(`emitter-error: ${err instanceof Error ? err.message : String(err)}`);
       }
     } finally {
       opts.onClose();
@@ -36223,14 +36525,42 @@ async function fanOut2(subscribers, text, onError, tag) {
   );
 }
 
+// app/lib/channel-delivery/parity-census.ts
+var sessions2 = /* @__PURE__ */ new Map();
+function entry(sessionId) {
+  let e = sessions2.get(sessionId);
+  if (!e) {
+    e = { rendered: /* @__PURE__ */ new Set(), sent: /* @__PURE__ */ new Set() };
+    sessions2.set(sessionId, e);
+  }
+  return e;
+}
+function noteAnswer(sessionId, messageId) {
+  entry(sessionId).rendered.add(messageId);
+}
+function noteSent(sessionId, messageId, channels) {
+  if (channels.length === 0) return;
+  entry(sessionId).sent.add(messageId);
+}
+function parityCensusLines() {
+  const out = [];
+  for (const [sessionId, e] of sessions2) {
+    const missing = [...e.rendered].filter((id) => !e.sent.has(id));
+    out.push(
+      `[channel-parity] op=parity-census sessionId=${sessionId} rendered=${e.rendered.size} sent=${e.sent.size} missing=${missing.length} missingIds=${missing.join(",") || "none"}`
+    );
+  }
+  return out;
+}
+
 // app/lib/webchat/file-delivery.ts
 import { realpathSync as realpathSync9 } from "fs";
-import { resolve as resolve46 } from "path";
+import { resolve as resolve48 } from "path";
 
 // app/lib/channel-pty-bridge/file-delivery.ts
 var SEND_USER_FILE = "SendUserFile";
 function makeFileDelivery(opts) {
-  const { entry, tag, channel, sendFile, deferUntilVerdict = false } = opts;
+  const { entry: entry2, tag, channel, sendFile, deferUntilVerdict = false } = opts;
   let failedFiles = [];
   let attempts = 0;
   const pending = /* @__PURE__ */ new Map();
@@ -36257,7 +36587,7 @@ function makeFileDelivery(opts) {
   function unreconciledCall(reason, files, detail) {
     const d = detail ? ` detail="${detail.replace(/\s+/g, " ").slice(0, 120)}"` : "";
     console.error(
-      `${tag} file-delivery-unreconciled sender=${entry.senderId} sessionId=${entry.sessionId.slice(0, 8)} tool=${SEND_USER_FILE} reason=${reason} files=${files}${d}`
+      `${tag} file-delivery-unreconciled sender=${entry2.senderId} sessionId=${entry2.sessionId.slice(0, 8)} tool=${SEND_USER_FILE} reason=${reason} files=${files}${d}`
     );
   }
   const handler = {
@@ -36278,10 +36608,10 @@ function makeFileDelivery(opts) {
       const tried = attempts;
       failedFiles = [];
       attempts = 0;
-      const sid = entry.sessionId.slice(0, 8);
+      const sid = entry2.sessionId.slice(0, 8);
       for (const file of failed2) {
         console.error(
-          `${tag} file-delivery-unreconciled sender=${entry.senderId} sessionId=${sid} tool=${SEND_USER_FILE} file=${file}`
+          `${tag} file-delivery-unreconciled sender=${entry2.senderId} sessionId=${sid} tool=${SEND_USER_FILE} file=${file}`
         );
       }
       if (deferUntilVerdict) {
@@ -36291,7 +36621,7 @@ function makeFileDelivery(opts) {
       }
       if (firedTools.includes(SEND_USER_FILE) && tried === 0) {
         console.error(
-          `${tag} file-delivery-unreconciled sender=${entry.senderId} sessionId=${sid} tool=${SEND_USER_FILE}`
+          `${tag} file-delivery-unreconciled sender=${entry2.senderId} sessionId=${sid} tool=${SEND_USER_FILE}`
         );
       }
     }
@@ -36320,43 +36650,43 @@ var TAG58 = "[webchat-adaptor]";
 function platformRoot2() {
   return process.env.MAXY_PLATFORM_ROOT || "";
 }
-function makeWebchatSendFile(entry) {
+function makeWebchatSendFile(entry2) {
   return async (filePath) => {
-    if (!entry.accountId) {
-      console.error(`${TAG58} file-delivery reject reason=no-account sender=${entry.senderId}`);
+    if (!entry2.accountId) {
+      console.error(`${TAG58} file-delivery reject reason=no-account sender=${entry2.senderId}`);
       return { ok: false, error: "no-account" };
     }
-    const accountDir = resolve46(platformRoot2(), "..", "data/accounts", entry.accountId);
+    const accountDir = resolve48(platformRoot2(), "..", "data/accounts", entry2.accountId);
     try {
       const resolved = realpathSync9(filePath);
       const accountResolved = realpathSync9(accountDir);
       if (!resolved.startsWith(accountResolved + "/")) {
-        console.error(`${TAG58} file-delivery reject reason=outside_account_directory sender=${entry.senderId}`);
+        console.error(`${TAG58} file-delivery reject reason=outside_account_directory sender=${entry2.senderId}`);
         return { ok: false, error: "outside-account" };
       }
       return { ok: true };
     } catch (err) {
       const code = err.code;
       console.error(
-        `${TAG58} file-delivery reject reason=${code === "ENOENT" ? "not-found" : "path-error"} sender=${entry.senderId}`
+        `${TAG58} file-delivery reject reason=${code === "ENOENT" ? "not-found" : "path-error"} sender=${entry2.senderId}`
       );
       return { ok: false, error: code === "ENOENT" ? "not-found" : "path-error" };
     }
   };
 }
-function makeWebchatFileDelivery(entry) {
+function makeWebchatFileDelivery(entry2) {
   return makeFileDelivery({
-    entry,
+    entry: entry2,
     tag: TAG58,
     channel: "webchat",
-    sendFile: makeWebchatSendFile(entry),
+    sendFile: makeWebchatSendFile(entry2),
     deferUntilVerdict: true
   });
 }
 
 // app/lib/webchat/gateway/native-file-follower.ts
 function startWebchatNativeFileFollower(input) {
-  const entry = {
+  const entry2 = {
     sessionId: input.sessionId,
     role: "admin",
     channel: "webchat",
@@ -36366,7 +36696,6 @@ function startWebchatNativeFileFollower(input) {
     lastInboundAt: Date.now(),
     writeChain: Promise.resolve(),
     subscribers: /* @__PURE__ */ new Set(),
-    pendingTurnText: "",
     followerAbort: null,
     followerRunning: false,
     sliceToken: "",
@@ -36375,13 +36704,24 @@ function startWebchatNativeFileFollower(input) {
     // Webchat renders from the transcript; there is no separate reply target.
     replyTarget: null
   };
-  return startFollower({
-    entry,
+  return startEmitter({
+    entry: entry2,
     tag: "[webchat-adaptor]",
-    fileDelivery: makeWebchatFileDelivery(entry),
+    fileDelivery: makeWebchatFileDelivery(entry2),
     // A resumed session's JSONL already holds prior SendUserFile tool_uses;
     // suppress replay so historical calls are not re-reconciled on attach.
     suppressResumeReplay: true,
+    // Task 2521 — the answer reaches every bound door through the one fan-out.
+    // Ungated by design: whatever woke the turn, the reader and the chats show
+    // the same thing.
+    onAnswer: async (answer) => {
+      const targets = input.fanTargets?.() ?? [];
+      if (targets.length === 0) return;
+      noteAnswer(input.sessionId, answer.messageId);
+      const { line, reached } = await fanOut({ targets, segments: segmentText(answer.text) });
+      noteSent(input.sessionId, answer.messageId, reached);
+      console.error(`${line} messageId=${answer.messageId} sessionId=${input.sessionId.slice(0, 8)}`);
+    },
     onClose: input.onClose ?? (() => {
     })
   });
@@ -36417,29 +36757,29 @@ var WHATSAPP_SEND_DOCUMENT = "whatsapp-send-document";
 function platformRoot3() {
   return process.env.MAXY_PLATFORM_ROOT || "";
 }
-function makeWhatsAppSendFile(entry, maxyAccountId) {
+function makeWhatsAppSendFile(entry2, maxyAccountId) {
   return async (filePath, caption) => {
     const result = await sendWhatsAppDocument({
-      to: entry.senderId,
+      to: entry2.senderId,
       filePath,
       caption,
-      accountId: entry.accountId,
+      accountId: entry2.accountId,
       maxyAccountId,
       platformRoot: platformRoot3()
     });
     if (result.ok) return { ok: true };
     console.error(
-      `${TAG59} file-delivery reject reason=send-failed sender=${entry.senderId} status=${result.status} message=${result.error}`
+      `${TAG59} file-delivery reject reason=send-failed sender=${entry2.senderId} status=${result.status} message=${result.error}`
     );
     return { ok: false, error: result.error };
   };
 }
-function makeWhatsAppFileDelivery(entry, maxyAccountId) {
+function makeWhatsAppFileDelivery(entry2, maxyAccountId) {
   const shared = makeFileDelivery({
-    entry,
+    entry: entry2,
     tag: TAG59,
     channel: "whatsapp",
-    sendFile: makeWhatsAppSendFile(entry, maxyAccountId)
+    sendFile: makeWhatsAppSendFile(entry2, maxyAccountId)
   });
   let turnStartedAt = null;
   let routeCalls = [];
@@ -36464,7 +36804,7 @@ function makeWhatsAppFileDelivery(entry, maxyAccountId) {
       const routes = routeCalls;
       turnStartedAt = null;
       routeCalls = [];
-      const sid = entry.sessionId.slice(0, 8);
+      const sid = entry2.sessionId.slice(0, 8);
       shared.onTurnEnd(firedTools);
       for (const call of routes) {
         const routeAt = call.to !== void 0 && call.filePath !== void 0 ? routeDocumentOutboundAt(call.to, call.filePath) : void 0;
@@ -36472,7 +36812,7 @@ function makeWhatsAppFileDelivery(entry, maxyAccountId) {
         if (!delivered) {
           const fileField = call.filePath !== void 0 ? ` file=${call.filePath}` : "";
           console.error(
-            `${TAG59} file-delivery-unreconciled sender=${entry.senderId} sessionId=${sid} tool=${WHATSAPP_SEND_DOCUMENT}${fileField}`
+            `${TAG59} file-delivery-unreconciled sender=${entry2.senderId} sessionId=${sid} tool=${WHATSAPP_SEND_DOCUMENT}${fileField}`
           );
         }
       }
@@ -36483,17 +36823,16 @@ function makeWhatsAppFileDelivery(entry, maxyAccountId) {
 // app/lib/whatsapp/gateway/native-file-follower.ts
 var COMPOSING_REFRESH_MS = 1e4;
 function startNativeFileFollower(input) {
-  const entry = {
+  const entry2 = {
     sessionId: input.sessionId,
-    role: "admin",
+    role: input.role,
     channel: "whatsapp",
     accountId: input.accountId,
     senderId: input.senderId,
-    agentSlug: "admin",
+    agentSlug: input.role === "admin" ? "admin" : "default",
     lastInboundAt: Date.now(),
     writeChain: Promise.resolve(),
     subscribers: /* @__PURE__ */ new Set(),
-    pendingTurnText: "",
     followerAbort: null,
     followerRunning: false,
     sliceToken: "",
@@ -36529,15 +36868,28 @@ function startNativeFileFollower(input) {
     if (!sock) return;
     void sendPaused(sock, input.senderId);
   };
-  return startFollower({
-    entry,
+  return startEmitter({
+    entry: entry2,
     tag: "[whatsapp-adaptor]",
-    fileDelivery: makeWhatsAppFileDelivery(entry, input.maxyAccountId),
+    // Task 2521 — admin-only. A public spawn has no tools (Task 2078), so a
+    // handler here would reconcile a call that can never fire.
+    fileDelivery: input.role === "admin" ? makeWhatsAppFileDelivery(entry2, input.maxyAccountId) : null,
     // A resumed session's JSONL already holds prior SendUserFile tool_uses;
     // suppress replay so historical files are not re-sent on attach.
     suppressResumeReplay: true,
     onActivity,
     onTurnComplete,
+    // Task 2521 — the answer reaches every bound door through the one fan-out.
+    // Ungated by design: whatever woke the turn, the reader and the chats show
+    // the same thing.
+    onAnswer: async (answer) => {
+      const targets = input.fanTargets?.() ?? [];
+      if (targets.length === 0) return;
+      noteAnswer(input.sessionId, answer.messageId);
+      const { line, reached } = await fanOut({ targets, segments: segmentText(answer.text) });
+      noteSent(input.sessionId, answer.messageId, reached);
+      console.error(`${line} messageId=${answer.messageId} sessionId=${input.sessionId.slice(0, 8)}`);
+    },
     onClose: input.onClose ?? (() => {
     })
   });
@@ -37090,6 +37442,9 @@ function buildTelegramEnsureSession(deps) {
       accountId: input.accountId,
       chatId: input.chatId,
       botToken: input.botToken,
+      // Task 2521 — resolved per answer, not captured once, so a door that goes
+      // live after this session started still receives.
+      fanTargets: () => deps.fanTargets(req.channelKey),
       // Identity-guarded eviction: only delete if this controller is still the
       // current one, so a stale self-close never removes a live follower.
       onClose: () => {
@@ -37104,7 +37459,7 @@ function buildTelegramEnsureSession(deps) {
 init_attachments();
 import { realpathSync as realpathSync10 } from "fs";
 import { readFile as readFile14, stat as stat10 } from "fs/promises";
-import { resolve as resolve47, basename as basename16 } from "path";
+import { resolve as resolve49, basename as basename16 } from "path";
 var TAG61 = "[telegram:outbound]";
 var TELEGRAM_DOCUMENT_MAX_BYTES = 50 * 1024 * 1024;
 async function sendTelegramDocument(input) {
@@ -37115,7 +37470,7 @@ async function sendTelegramDocument(input) {
   if (!maxyAccountId || !platformRoot5) {
     return { ok: false, status: 400, error: "Cannot validate file path: missing account or platform context" };
   }
-  const accountDir = resolve47(platformRoot5, "..", "data/accounts", maxyAccountId);
+  const accountDir = resolve49(platformRoot5, "..", "data/accounts", maxyAccountId);
   let accountResolved;
   try {
     accountResolved = realpathSync10(accountDir);
@@ -37184,39 +37539,39 @@ var TAG62 = "[telegram:outbound]";
 function platformRoot4() {
   return process.env.MAXY_PLATFORM_ROOT || "";
 }
-function makeTelegramSendFile(entry, botToken) {
+function makeTelegramSendFile(entry2, botToken) {
   return async (filePath, caption) => {
     if (!botToken) {
-      console.error(`${TAG62} file-delivery reject reason=no-bot-token sender=${entry.senderId} role=${entry.role}`);
+      console.error(`${TAG62} file-delivery reject reason=no-bot-token sender=${entry2.senderId} role=${entry2.role}`);
       return { ok: false, error: "no-bot-token" };
     }
-    if (entry.replyTarget == null) {
-      console.error(`${TAG62} file-delivery reject reason=no-reply-target sender=${entry.senderId} role=${entry.role}`);
+    if (entry2.replyTarget == null) {
+      console.error(`${TAG62} file-delivery reject reason=no-reply-target sender=${entry2.senderId} role=${entry2.role}`);
       return { ok: false, error: "no-reply-target" };
     }
     const result = await sendTelegramDocument({
       botToken,
-      chatId: Number(entry.replyTarget),
+      chatId: Number(entry2.replyTarget),
       filePath,
       caption,
-      maxyAccountId: entry.accountId,
+      maxyAccountId: entry2.accountId,
       platformRoot: platformRoot4()
     });
     return result.ok ? { ok: true } : { ok: false, error: result.error };
   };
 }
-function makeTelegramFileDelivery(entry, botToken) {
+function makeTelegramFileDelivery(entry2, botToken) {
   return makeFileDelivery({
-    entry,
+    entry: entry2,
     tag: TAG62,
     channel: "telegram",
-    sendFile: makeTelegramSendFile(entry, botToken)
+    sendFile: makeTelegramSendFile(entry2, botToken)
   });
 }
 
 // app/lib/telegram/gateway/native-file-follower.ts
 function startTelegramNativeFileFollower(input) {
-  const entry = {
+  const entry2 = {
     sessionId: input.sessionId,
     role: "admin",
     channel: "telegram",
@@ -37226,7 +37581,6 @@ function startTelegramNativeFileFollower(input) {
     lastInboundAt: Date.now(),
     writeChain: Promise.resolve(),
     subscribers: /* @__PURE__ */ new Set(),
-    pendingTurnText: "",
     followerAbort: null,
     followerRunning: false,
     sliceToken: "",
@@ -37235,13 +37589,24 @@ function startTelegramNativeFileFollower(input) {
     // The chat id the document is addressed to (set per spawn from the inbound).
     replyTarget: input.chatId
   };
-  return startFollower({
-    entry,
+  return startEmitter({
+    entry: entry2,
     tag: "[telegram-adaptor]",
-    fileDelivery: makeTelegramFileDelivery(entry, input.botToken),
+    fileDelivery: makeTelegramFileDelivery(entry2, input.botToken),
     // A resumed session's JSONL already holds prior SendUserFile tool_uses;
     // suppress replay so historical files are not re-sent on attach.
     suppressResumeReplay: true,
+    // Task 2521 — the answer reaches every bound door through the one fan-out.
+    // Ungated by design: whatever woke the turn, the reader and the chats show
+    // the same thing.
+    onAnswer: async (answer) => {
+      const targets = input.fanTargets?.() ?? [];
+      if (targets.length === 0) return;
+      noteAnswer(input.sessionId, answer.messageId);
+      const { line, reached } = await fanOut({ targets, segments: segmentText(answer.text) });
+      noteSent(input.sessionId, answer.messageId, reached);
+      console.error(`${line} messageId=${answer.messageId} sessionId=${input.sessionId.slice(0, 8)}`);
+    },
     onClose: input.onClose ?? (() => {
     })
   });
@@ -37269,22 +37634,22 @@ function adminFanTargets(p) {
     noTarget(p.origin, p.accountId, "users-read-failed");
     return [origin];
   }
-  const entry = (users ?? []).find((u) => u.userId === p.adminUserId);
-  if (!entry) {
+  const entry2 = (users ?? []).find((u) => u.userId === p.adminUserId);
+  if (!entry2) {
     noTarget(p.origin, p.accountId, "no-entry");
     return [origin];
   }
-  if (!entry.phone && !entry.telegram) {
+  if (!entry2.phone && !entry2.telegram) {
     noTarget(p.origin, p.accountId, "no-bindings");
     return [origin];
   }
   const bound = [];
-  if (entry.phone) {
-    const wa = p.deps.whatsappLiveTarget(entry.phone);
+  if (entry2.phone) {
+    const wa = p.deps.whatsappLiveTarget(entry2.phone);
     bound.push(wa ? { channel: "whatsapp", live: true, send: wa } : { channel: "whatsapp", live: false });
   }
-  if (entry.telegram) {
-    const tg = p.deps.telegramLiveTarget(entry.telegram);
+  if (entry2.telegram) {
+    const tg = p.deps.telegramLiveTarget(entry2.telegram);
     bound.push(tg ? { channel: "telegram", live: true, send: tg } : { channel: "telegram", live: false });
   }
   return [origin, ...bound.filter((t) => t.channel !== p.origin)];
@@ -37491,8 +37856,8 @@ init_resolve_admin_userid();
 init_src2();
 function findAccountManagerDrift(accountManagers, validAccountIds) {
   const drift = [];
-  for (const [phone, entry] of Object.entries(accountManagers)) {
-    const managesAccount = typeof entry === "string" ? entry : entry.managesAccount;
+  for (const [phone, entry2] of Object.entries(accountManagers)) {
+    const managesAccount = typeof entry2 === "string" ? entry2 : entry2.managesAccount;
     if (!validAccountIds.includes(managesAccount)) {
       drift.push({ phone, managesAccount, reason: "not-in-registry" });
     }
@@ -37607,36 +37972,36 @@ init_sidebar_sessions();
 function buildTelegramAuditLines(input) {
   const lines = [];
   const entries2 = input.accounts.flatMap(
-    (a) => listBotEntries(a.telegram).map((entry) => ({ accountId: a.accountId, accountDir: a.accountDir, entry }))
+    (a) => listBotEntries(a.telegram).map((entry2) => ({ accountId: a.accountId, accountDir: a.accountDir, entry: entry2 }))
   );
   if (entries2.length === 0) return lines;
   const byId = /* @__PURE__ */ new Map();
-  for (const { entry } of entries2) byId.set(entry.id, (byId.get(entry.id) ?? 0) + 1);
+  for (const { entry: entry2 } of entries2) byId.set(entry2.id, (byId.get(entry2.id) ?? 0) + 1);
   for (const [botId, count] of byId) {
     if (count > 1) lines.push(`[telegram-audit] op=duplicate-bot-id botId=${botId} accounts=${count}`);
   }
-  for (const { accountId, accountDir, entry } of entries2) {
-    if (entry.role === "public" && !input.agentActive(accountDir, entry.agent)) {
+  for (const { accountId, accountDir, entry: entry2 } of entries2) {
+    if (entry2.role === "public" && !input.agentActive(accountDir, entry2.agent)) {
       lines.push(
-        `[telegram-audit] op=entry-agent-inactive accountId=${accountId} botId=${entry.id} agent=${entry.agent}`
+        `[telegram-audit] op=entry-agent-inactive accountId=${accountId} botId=${entry2.id} agent=${entry2.agent}`
       );
     }
-    if (!input.secretFileExists(entry.id)) {
-      lines.push(`[telegram-audit] op=secret-orphan botId=${entry.id} side=entry`);
+    if (!input.secretFileExists(entry2.id)) {
+      lines.push(`[telegram-audit] op=secret-orphan botId=${entry2.id} side=entry`);
     }
   }
   const known = new Set(entries2.map((e) => e.entry.id));
   for (const botId of input.secretFilesOnDisk) {
     if (!known.has(botId)) lines.push(`[telegram-audit] op=secret-orphan botId=${botId} side=file`);
   }
-  for (const { accountId, entry } of entries2) {
-    const last = input.lastActivityByBot(entry.id);
+  for (const { accountId, entry: entry2 } of entries2) {
+    const last = input.lastActivityByBot(entry2.id);
     const spawnAge = last === null ? "never" : String(input.now - last.spawnMs);
     const turnAge = last === null || last.turnMs === null ? "never" : String(input.now - last.turnMs);
-    const agent = entry.role === "admin" ? "admin" : entry.agent;
-    const secretFile = input.secretFileExists(entry.id) ? "present" : "absent";
+    const agent = entry2.role === "admin" ? "admin" : entry2.agent;
+    const secretFile = input.secretFileExists(entry2.id) ? "present" : "absent";
     lines.push(
-      `[telegram-audit] op=configured botId=${entry.id} accountId=${accountId} agent=${agent} secretFile=${secretFile} lastSpawnAgeMs=${spawnAge} lastTurnAgeMs=${turnAge}`
+      `[telegram-audit] op=configured botId=${entry2.id} accountId=${accountId} agent=${agent} secretFile=${secretFile} lastSpawnAgeMs=${spawnAge} lastTurnAgeMs=${turnAge}`
     );
   }
   return lines;
@@ -37693,7 +38058,7 @@ function* walkTelegramSidecars() {
 }
 
 // server/telegram-migrate.ts
-import { readFileSync as readFileSync51, writeFileSync as writeFileSync19, existsSync as existsSync53, renameSync as renameSync11, mkdirSync as mkdirSync11 } from "fs";
+import { readFileSync as readFileSync52, writeFileSync as writeFileSync19, existsSync as existsSync52, renameSync as renameSync11, mkdirSync as mkdirSync11 } from "fs";
 import { dirname as dirname18, join as join62 } from "path";
 function migrateTelegramTwoSlot(input) {
   const out = [];
@@ -37701,7 +38066,7 @@ function migrateTelegramTwoSlot(input) {
     const configPath3 = join62(account.accountDir, "account.json");
     let config;
     try {
-      config = JSON.parse(readFileSync51(configPath3, "utf-8"));
+      config = JSON.parse(readFileSync52(configPath3, "utf-8"));
     } catch {
       console.error(`[telegram-audit] op=migrate-unreadable accountId=${account.accountId}`);
       continue;
@@ -37754,7 +38119,7 @@ function migrateTelegramTwoSlot(input) {
   return out;
 }
 function moveSecret(from, to) {
-  if (!existsSync53(from)) return;
+  if (!existsSync52(from)) return;
   mkdirSync11(dirname18(to), { recursive: true, mode: 448 });
   renameSync11(from, to);
 }
@@ -37803,14 +38168,14 @@ function backfillMisfiledRecords(params) {
 init_message_store();
 
 // server/lib/booking-site-accounts.ts
-import { existsSync as existsSync54, readFileSync as readFileSync52 } from "fs";
-import { resolve as resolve48 } from "path";
+import { existsSync as existsSync53, readFileSync as readFileSync53 } from "fs";
+import { resolve as resolve50 } from "path";
 function listBookingSiteAccounts(accounts) {
   return accounts.filter((a) => {
-    const availPath = resolve48(a.accountDir, "calendar-availability.json");
-    if (!existsSync54(availPath)) return false;
+    const availPath = resolve50(a.accountDir, "calendar-availability.json");
+    if (!existsSync53(availPath)) return false;
     try {
-      const cfg = JSON.parse(readFileSync52(availPath, "utf-8"));
+      const cfg = JSON.parse(readFileSync53(availPath, "utf-8"));
       return typeof cfg.bookingDbName === "string" && cfg.bookingDbName.length > 0;
     } catch {
       return false;
@@ -37832,17 +38197,17 @@ function broadcastAdminShutdown(reason) {
   const done = encoder.encode(`data: [DONE]
 
 `);
-  for (const entry of activeAdminSSEControllers) {
+  for (const entry2 of activeAdminSSEControllers) {
     try {
-      entry.controller.enqueue(frame);
+      entry2.controller.enqueue(frame);
     } catch {
     }
     try {
-      entry.controller.enqueue(done);
+      entry2.controller.enqueue(done);
     } catch {
     }
     try {
-      entry.controller.close();
+      entry2.controller.close();
     } catch {
     }
   }
@@ -37855,8 +38220,8 @@ init_paths();
 
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash7, verify as cryptoVerify } from "crypto";
-import { existsSync as existsSync55, readFileSync as readFileSync53, statSync as statSync29 } from "fs";
-import { resolve as resolve49 } from "path";
+import { existsSync as existsSync54, readFileSync as readFileSync54, statSync as statSync29 } from "fs";
+import { resolve as resolve51 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
 function canonicalize(value) {
@@ -37891,7 +38256,7 @@ var PUBKEY_SHA256 = "8eee6bcb33545fd13b16d3199a5735ca5db5062834c7b49dfe4f23801d9
 var GRACE_DAYS = 7;
 var GRACE_MS = GRACE_DAYS * 24 * 60 * 60 * 1e3;
 function pubkeyPath(brand) {
-  return resolve49(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
+  return resolve51(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
 }
 var memo = null;
 function memoKey(mtimeMs, account) {
@@ -37903,8 +38268,8 @@ function resolveEntitlement(brand, account) {
   if (brand.commercialMode !== true) {
     return logResolved(implicitTrust(account), null);
   }
-  const entitlementPath = resolve49(brand.configDir, "entitlement.json");
-  if (!existsSync55(entitlementPath)) {
+  const entitlementPath = resolve51(brand.configDir, "entitlement.json");
+  if (!existsSync54(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
   const stat11 = statSync29(entitlementPath);
@@ -37919,7 +38284,7 @@ function resolveEntitlement(brand, account) {
 function verifyAndResolve(brand, entitlementPath, account) {
   let pubkeyPem;
   try {
-    pubkeyPem = readFileSync53(pubkeyPath(brand), "utf-8");
+    pubkeyPem = readFileSync54(pubkeyPath(brand), "utf-8");
   } catch (err) {
     return logResolved(anonymousFallback("pubkey-missing"), {
       reason: "pubkey-missing"
@@ -37933,7 +38298,7 @@ function verifyAndResolve(brand, entitlementPath, account) {
   }
   let envelope;
   try {
-    envelope = JSON.parse(readFileSync53(entitlementPath, "utf-8"));
+    envelope = JSON.parse(readFileSync54(entitlementPath, "utf-8"));
   } catch {
     return logResolved(anonymousFallback("malformed"), { reason: "malformed" });
   }
@@ -38097,12 +38462,12 @@ installMediaDownloadGuard();
 var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT || "";
 var BRAND_JSON_PATH = PLATFORM_ROOT6 ? join63(PLATFORM_ROOT6, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", marketingUrl: "https://getmaxy.com" };
-if (BRAND_JSON_PATH && !existsSync56(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && !existsSync55(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
 }
-if (BRAND_JSON_PATH && existsSync56(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync55(BRAND_JSON_PATH)) {
   try {
-    const parsed = JSON.parse(readFileSync54(BRAND_JSON_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync55(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
   } catch (err) {
     console.error(`[brand] Failed to parse brand.json: ${err.message}`);
@@ -38137,8 +38502,8 @@ var brandLoginOpts = {
 var ALIAS_DOMAINS_PATH = join63(homedir5(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
-    if (!existsSync56(ALIAS_DOMAINS_PATH)) return null;
-    const parsed = JSON.parse(readFileSync54(ALIAS_DOMAINS_PATH, "utf-8"));
+    if (!existsSync55(ALIAS_DOMAINS_PATH)) return null;
+    const parsed = JSON.parse(readFileSync55(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
       return null;
@@ -38209,6 +38574,26 @@ async function recordPassiveDispatch(input) {
     await session.close();
   }
 }
+registerLoop({
+  name: "channel-parity",
+  intervalMs: 6e4,
+  run: () => {
+    const lines = parityCensusLines();
+    for (const line of lines) console.error(line);
+    const missing = lines.filter((l) => !l.includes("missing=0")).length;
+    return `${lines.length} session(s), ${missing} with a missing answer`;
+  }
+});
+var whatsappFanTargets = (accountId, senderId) => {
+  warnNonUuidAccount("fan-out", accountId);
+  return adminFanTargets({
+    origin: "whatsapp",
+    originKey: senderId,
+    accountId,
+    adminUserId: resolveAdminUserId({ accountId, senderPhone: senderId }),
+    deps: adminFanDeps("whatsapp", accountId)
+  });
+};
 var waGateway = new WaGateway({
   fetchStandingRules: fetchAccountStandingRules,
   // Task 2321 — the account's own `## Instruction` body, read from that
@@ -38231,15 +38616,11 @@ var waGateway = new WaGateway({
   // Task 2078 — one answer reaches every live door for this admin person.
   // Task 2459 — the origin door is resolved from `senderId`, so it is present
   // even when the sender resolves to no admin at all.
-  fanTargetsFor: (accountId, senderId) => adminFanTargets({
-    origin: "whatsapp",
-    originKey: senderId,
-    accountId,
-    adminUserId: resolveAdminUserId({ accountId, senderPhone: senderId }),
-    deps: adminFanDeps("whatsapp", accountId)
-  }),
+  // Task 2521 — hoisted, because the emitter's per-answer fan-out needs the same
+  // resolver and `fanTargetsFor` is a constructor dep, not a callable method.
+  fanTargetsFor: whatsappFanTargets,
   gatewayUrl: `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`,
-  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve50(process.env.MAXY_PLATFORM_ROOT ?? join63(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
+  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve52(process.env.MAXY_PLATFORM_ROOT ?? join63(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
   // Task 751 / 1390 — file delivery on the native channel. `maxyAccountId` (the
   // path-validation scope) is the sender's effective SESSION account, resolved
   // once at the inbound gate and threaded here via the gateway's per-sender doc
@@ -38254,7 +38635,7 @@ var waGateway = new WaGateway({
       caption,
       accountId,
       maxyAccountId,
-      platformRoot: resolve50(process.env.MAXY_PLATFORM_ROOT ?? join63(__dirname, ".."))
+      platformRoot: resolve52(process.env.MAXY_PLATFORM_ROOT ?? join63(__dirname, ".."))
     });
     return result.ok ? { ok: true, messageId: result.messageId } : { ok: false, error: result.error };
   },
@@ -38389,7 +38770,6 @@ var waGateway = new WaGateway({
       console.error(`[whatsapp-native] spawn-failed senderId=${senderId} role=${role} error=${result.error} status=${result.status}`);
       return;
     }
-    if (role !== "admin") return;
     const prior = nativeFileFollowers.get(senderId);
     if (prior) prior.abort();
     let ac;
@@ -38401,6 +38781,16 @@ var waGateway = new WaGateway({
       // session account (the sub-account for an account-manager), not the house
       // socket account. accountId stays the getSocket key.
       maxyAccountId: effectiveAccountId,
+      // Task 2521 — file delivery is admin-only; the text emitter is not.
+      role,
+      // Task 2521 — resolved per answer, not captured once, so a door that goes
+      // live after this session started still receives.
+      // Task 2531 — `effectiveAccountId`, NOT `accountId`. The reply map is
+      // keyed on the platform UUID (wa-gateway.ts:567) while `accountId` here is
+      // the Baileys credential dirname (see the Task 1850 note above). Passing
+      // the dirname missed every lookup and delivered session 8e5bc4e8's answer
+      // to nothing. `accountId` stays correct on line 718: that is the socket.
+      fanTargets: () => whatsappFanTargets(effectiveAccountId, senderId),
       onClose: () => {
         if (nativeFileFollowers.get(senderId) === ac) nativeFileFollowers.delete(senderId);
       }
@@ -38547,12 +38937,15 @@ var webchatGateway = new WebchatGateway({
   // live admin session (rc-spawn recover:true). Resolve the session id the same
   // way ensureChannelSession does. Public sessions recover via the idle reaper,
   // so a non-admin descriptor is reported not-live (no respawn).
-  recoverLiveSession: async ({ accountId, key: key2, role, sessionId, adminUserId }) => {
+  recoverLiveSession: async ({ accountId, key: key2, role, sessionId, adminUserId, subscriberAttached }) => {
     if (role !== "admin") return { live: false };
     const id = sessionId ?? adminSessionIdFor(accountId, key2, adminUserId);
     const r = await managerRcRecover({
       sessionId: id,
       webchatChannel: { key: key2, gatewayUrl: webchatGatewayUrl(), serverPath: webchatServerPath() },
+      // Task 2466 — the gateway resolved this against the live subscriber table
+      // just before the call; the manager classifies from it.
+      subscriberAttached,
       ...adminUserId !== void 0 ? { adminUserId } : {},
       logContext: `channel=webchat key=${key2} recover`
     });
@@ -38573,6 +38966,24 @@ app80.route("/", webchatGateway.routes());
 webchatGateway.startSweeper();
 webchatGateway.startPublicReaper();
 var telegramFileFollowers = /* @__PURE__ */ new Map();
+var telegramFanTargets = (key2) => {
+  const chatId = key2.slice(key2.indexOf(":") + 1);
+  const account = listValidAccounts().find(
+    (a) => listBotEntries(a.config.telegram).some((e) => e.id === key2.slice(0, key2.indexOf(":")))
+  );
+  if (!account) {
+    console.error(`[channel-fanout] op=no-target origin=telegram key=${key2} accountId=none reason=no-account`);
+    const send = telegramOriginTarget(key2);
+    return [send ? { channel: "telegram", live: true, send } : { channel: "telegram", live: false }];
+  }
+  return adminFanTargets({
+    origin: "telegram",
+    originKey: key2,
+    accountId: account.accountId,
+    adminUserId: resolveTelegramAdminUserId({ accountId: account.accountId, chatId }),
+    deps: adminFanDeps("telegram", account.accountId)
+  });
+};
 var telegramGateway = new TelegramGateway({
   fetchStandingRules: fetchAccountStandingRules,
   // Task 2353 — no turn-instruction resolver on this door. See the dep comment in
@@ -38582,26 +38993,8 @@ var telegramGateway = new TelegramGateway({
   // is what the classification sidecar records (the manager reads
   // telegramChannel.senderId) and therefore what session-reseat.ts writes.
   resolveSessionOverride: (accountId, channelKey) => resolveChannelOverride(accountId, "telegram", channelKey),
-  // Task 2078 — one answer reaches every live door for this admin person. The
-  // key is the `<botId>:<chatId>` composite, so the chat id is its tail.
-  fanTargetsFor: (key2) => {
-    const chatId = key2.slice(key2.indexOf(":") + 1);
-    const account = listValidAccounts().find(
-      (a) => listBotEntries(a.config.telegram).some((e) => e.id === key2.slice(0, key2.indexOf(":")))
-    );
-    if (!account) {
-      console.error(`[channel-fanout] op=no-target origin=telegram key=${key2} accountId=none reason=no-account`);
-      const send = telegramOriginTarget(key2);
-      return [send ? { channel: "telegram", live: true, send } : { channel: "telegram", live: false }];
-    }
-    return adminFanTargets({
-      origin: "telegram",
-      originKey: key2,
-      accountId: account.accountId,
-      adminUserId: resolveTelegramAdminUserId({ accountId: account.accountId, chatId }),
-      deps: adminFanDeps("telegram", account.accountId)
-    });
-  },
+  // Task 2521 — hoisted above; see `telegramFanTargets`.
+  fanTargetsFor: telegramFanTargets,
   gatewayUrl: telegramGatewayUrl(),
   serverPath: telegramServerPath(),
   // Task 2368 — the role branch lives in its own module so it has a test that
@@ -38612,6 +39005,7 @@ var telegramGateway = new TelegramGateway({
     managerSpawn,
     resolveSessionOverride: (accountId, channelKey) => resolveChannelOverride(accountId, "telegram", channelKey),
     startFileFollower: startTelegramNativeFileFollower,
+    fanTargets: telegramFanTargets,
     followers: telegramFileFollowers
   })
 });
@@ -38670,9 +39064,9 @@ var scheduleInjectRoutes = createScheduleInjectRoutes({
       const entries2 = listBotEntries(a.config.telegram);
       for (const bot of readChannelAdmins(a.accountDir, "telegram").byBot) {
         if (!bot.adminUsers.includes(asNumber)) continue;
-        const entry = entries2.find((e) => e.id === bot.botId);
-        if (!entry) continue;
-        hits.push({ accountId: a.accountId, botId: bot.botId, botToken: entry.token });
+        const entry2 = entries2.find((e) => e.id === bot.botId);
+        if (!entry2) continue;
+        hits.push({ accountId: a.accountId, botId: bot.botId, botToken: entry2.token });
       }
     }
     if (hits.length === 0) return { kind: "none" };
@@ -39052,20 +39446,20 @@ app80.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] no-account slug=${slug} file=${filename}`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve50(account.accountDir, "agents", slug, "assets", filename);
-  const expectedDir = resolve50(account.accountDir, "agents", slug, "assets");
+  const filePath = resolve52(account.accountDir, "agents", slug, "assets", filename);
+  const expectedDir = resolve52(account.accountDir, "agents", slug, "assets");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync56(filePath)) {
+  if (!existsSync55(filePath)) {
     console.error(`[agent-assets] serve slug=${slug} file=${filename} status=404`);
     return c.text("Not found", 404);
   }
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[agent-assets] serve slug=${slug} file=${filename} status=200`);
-  const body = readFileSync54(filePath);
+  const body = readFileSync55(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=3600"
@@ -39082,20 +39476,20 @@ app80.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve50(account.accountDir, "generated", filename);
-  const expectedDir = resolve50(account.accountDir, "generated");
+  const filePath = resolve52(account.accountDir, "generated", filename);
+  const expectedDir = resolve52(account.accountDir, "generated");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync56(filePath)) {
+  if (!existsSync55(filePath)) {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[generated] serve file=${filename} status=200`);
-  const body = readFileSync54(filePath);
+  const body = readFileSync55(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=86400"
@@ -39108,9 +39502,9 @@ app80.route("/v", visitor_consent_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
-if (BRAND_JSON_PATH && existsSync56(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync55(BRAND_JSON_PATH)) {
   try {
-    const fullBrand = JSON.parse(readFileSync54(BRAND_JSON_PATH, "utf-8"));
+    const fullBrand = JSON.parse(readFileSync55(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
     brandIconPath = fullBrand.assets?.icon ? `/brand/${fullBrand.assets.icon}` : brandLogoPath;
   } catch {
@@ -39137,11 +39531,11 @@ var brandScript = `<script>window.__BRAND__=${JSON.stringify({
 var brandThemeColor = BRAND.defaultColors?.primary ?? "#000000";
 var brandBackgroundColor = BRAND.defaultColors?.background ?? "#ffffff";
 var brandAppIconsExist = [brandAppIcon192Path, brandAppIcon512Path, brandMaskableIconPath].every(
-  (p) => existsSync56(resolve50(process.cwd(), "public", p.replace(/^\//, "")))
+  (p) => existsSync55(resolve52(process.cwd(), "public", p.replace(/^\//, "")))
 );
 var SW_SOURCE = (() => {
   try {
-    return readFileSync54(resolve50(process.cwd(), "public", "sw.js"), "utf-8");
+    return readFileSync55(resolve52(process.cwd(), "public", "sw.js"), "utf-8");
   } catch {
     return null;
   }
@@ -39150,8 +39544,8 @@ function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT6) return "unknown";
     const versionFile = join63(PLATFORM_ROOT6, "config", `.${BRAND.hostname}-version`);
-    if (!existsSync56(versionFile)) return "unknown";
-    const content = readFileSync54(versionFile, "utf-8").trim();
+    if (!existsSync55(versionFile)) return "unknown";
+    const content = readFileSync55(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
     return "unknown";
@@ -39162,7 +39556,7 @@ var versionScript = `<script>window.__MAXY_VERSION__=${JSON.stringify(INSTALLED_
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync54(resolve50(process.cwd(), "public", file), "utf-8");
+    html = readFileSync55(resolve52(process.cwd(), "public", file), "utf-8");
     const productNameEsc = escapeHtml(BRAND.productName);
     html = html.replace(/<title>([^<]*)<\/title>/, (_match, inner) => `<title>${escapeHtml(inner).replace(/Maxy/g, productNameEsc)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
@@ -39185,8 +39579,8 @@ function loadBrandingCache(agentSlug) {
     const accountId = verdict.kind === "served" ? verdict.owner.accountId : getDefaultAccountId();
     if (!accountId) return null;
     const cachePath = join63(configDir, "branding-cache", accountId, `${agentSlug}.json`);
-    if (!existsSync56(cachePath)) return null;
-    return JSON.parse(readFileSync54(cachePath, "utf-8"));
+    if (!existsSync55(cachePath)) return null;
+    return JSON.parse(readFileSync55(cachePath, "utf-8"));
   } catch {
     return null;
   }
@@ -39281,7 +39675,7 @@ app80.use("/vnc-popout.html", logViewerFetch);
 app80.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync54(resolve50(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync55(resolve52(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -39441,9 +39835,9 @@ var httpServer = serve({ fetch: app80.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
   const reconcilePlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join63(__dirname, "..");
-  const reconcileScript = resolve50(reconcilePlatformRoot, "plugins/scheduling/mcp/dist/scripts/reconcile-bookings.js");
+  const reconcileScript = resolve52(reconcilePlatformRoot, "plugins/scheduling/mcp/dist/scripts/reconcile-bookings.js");
   const runReconcile = (ctx) => {
-    if (!existsSync56(reconcileScript)) return;
+    if (!existsSync55(reconcileScript)) return;
     try {
       const child = spawn3(process.execPath, [reconcileScript], {
         env: { ...process.env, PLATFORM_ROOT: reconcilePlatformRoot },
@@ -39482,14 +39876,14 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
   const DREAM_CYCLE_SWEEP_INTERVAL_MS = 36e5;
   const dreamPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join63(__dirname, "..");
-  const dreamSweepScript = resolve50(dreamPlatformRoot, "plugins/memory/mcp/dist/scripts/dream-cycle-sweep.js");
+  const dreamSweepScript = resolve52(dreamPlatformRoot, "plugins/memory/mcp/dist/scripts/dream-cycle-sweep.js");
   registerLoop({
     name: "dream-cycle-sweep",
     intervalMs: DREAM_CYCLE_SWEEP_INTERVAL_MS,
     firstRunDelayMs: 3e4,
     detached: true,
     run: (ctx) => {
-      if (!existsSync56(dreamSweepScript)) return;
+      if (!existsSync55(dreamSweepScript)) return;
       try {
         const child = spawn3(process.execPath, [dreamSweepScript], {
           env: { ...process.env, PLATFORM_ROOT: dreamPlatformRoot },
@@ -39506,10 +39900,10 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 }
 {
   const outlookPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join63(__dirname, "..");
-  const outlookScript = resolve50(outlookPlatformRoot, "plugins/outlook/mcp/dist/scripts/complete-registration.js");
+  const outlookScript = resolve52(outlookPlatformRoot, "plugins/outlook/mcp/dist/scripts/complete-registration.js");
   const OUTLOOK_COMPLETE_INTERVAL_MS = 3e4;
   const runOutlookComplete = (ctx) => {
-    if (!existsSync56(outlookScript)) return;
+    if (!existsSync55(outlookScript)) return;
     try {
       const child = spawn3(process.execPath, [outlookScript], {
         env: { ...process.env, PLATFORM_ROOT: outlookPlatformRoot },
@@ -39532,18 +39926,18 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 }
 {
   const auditRoot = process.env.MAXY_PLATFORM_ROOT ?? join63(__dirname, "..");
-  const strandedAccountsDir = resolve50(auditRoot, "..", "data/accounts");
+  const strandedAccountsDir = resolve52(auditRoot, "..", "data/accounts");
   const STRANDED_AUDIT_INTERVAL_MS = 3e5;
   const STRANDED_AGE_MS = 16 * 6e4;
   const STRANDED_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
   const runStrandedAudit = () => {
     try {
-      if (!existsSync56(strandedAccountsDir)) return;
+      if (!existsSync55(strandedAccountsDir)) return;
       const now = Date.now();
       for (const name of readdirSync32(strandedAccountsDir)) {
         if (!STRANDED_UUID_RE.test(name)) continue;
-        const pendingPath2 = resolve50(strandedAccountsDir, name, "secrets/outlook/pending-devicecode.enc");
-        if (!existsSync56(pendingPath2)) continue;
+        const pendingPath2 = resolve52(strandedAccountsDir, name, "secrets/outlook/pending-devicecode.enc");
+        if (!existsSync55(pendingPath2)) continue;
         const ageMs2 = now - statSync30(pendingPath2).mtimeMs;
         if (ageMs2 > STRANDED_AGE_MS) {
           console.error(`[outlook-mcp] devicecode-stranded account=${name} ageSec=${Math.floor(ageMs2 / 1e3)}`);
@@ -39562,7 +39956,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 }
 {
   const googleRoot = process.env.MAXY_PLATFORM_ROOT ?? join63(__dirname, "..");
-  const googleAccountsDir = resolve50(googleRoot, "..", "data/accounts");
+  const googleAccountsDir = resolve52(googleRoot, "..", "data/accounts");
   const GOOGLE_PENDING_AUDIT_INTERVAL_MS = 3e5;
   const runGooglePendingAuditSafe = () => {
     try {
@@ -39577,10 +39971,10 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     firstRunDelayMs: 27e3,
     run: runGooglePendingAuditSafe
   });
-  const googleAuditScript = resolve50(googleRoot, "plugins/google/mcp/dist/scripts/account-audit.js");
+  const googleAuditScript = resolve52(googleRoot, "plugins/google/mcp/dist/scripts/account-audit.js");
   const GOOGLE_ACCOUNT_AUDIT_INTERVAL_MS = 36e5;
   const runGoogleAccountAudit = (ctx) => {
-    if (!existsSync56(googleAuditScript)) return;
+    if (!existsSync55(googleAuditScript)) return;
     try {
       const child = spawn3(process.execPath, [googleAuditScript], {
         env: { ...process.env, PLATFORM_ROOT: googleRoot },
@@ -39640,7 +40034,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   for (const o of migrateTelegramTwoSlot({
     accounts: listValidAccounts().map((a) => ({ accountId: a.accountId, accountDir: a.accountDir })),
     secretPathFor: secretPath,
-    legacySecretPathFor: (botType, accountId) => resolve50(
+    legacySecretPathFor: (botType, accountId) => resolve52(
       homedir5(),
       configDirName2(),
       `${botType === "admin" ? ".telegram-admin-webhook-secret" : ".telegram-webhook-secret"}.${accountId}`
@@ -39669,7 +40063,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     }
     const lines = buildTelegramAuditLines({
       accounts,
-      secretFileExists: (botId) => existsSync56(secretPath(botId)),
+      secretFileExists: (botId) => existsSync55(secretPath(botId)),
       agentActive: isActiveAgentSlug,
       secretFilesOnDisk,
       lastActivityByBot: (botId) => lastByBot.get(botId) ?? null,
@@ -39808,7 +40202,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 }
 {
   const publishPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join63(__dirname, "..");
-  const publishScript = resolve50(publishPlatformRoot, "plugins/scheduling/mcp/dist/scripts/publish-availability.js");
+  const publishScript = resolve52(publishPlatformRoot, "plugins/scheduling/mcp/dist/scripts/publish-availability.js");
   const PUBLISH_INTERVAL_MS = 3e5;
   const bookingAccounts = () => {
     try {
@@ -39819,7 +40213,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     }
   };
   const spawnPublish = (account, ctx) => {
-    if (!existsSync56(publishScript)) return;
+    if (!existsSync55(publishScript)) return;
     try {
       const child = spawn3(process.execPath, [publishScript], {
         env: {
@@ -39838,21 +40232,21 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     }
   };
   const auditSnapshotAge = (account) => {
-    const availPath = resolve50(account.accountDir, "calendar-availability.json");
+    const availPath = resolve52(account.accountDir, "calendar-availability.json");
     let hasBookingSite = false;
     try {
-      if (existsSync56(availPath)) {
-        const cfg = JSON.parse(readFileSync54(availPath, "utf-8"));
+      if (existsSync55(availPath)) {
+        const cfg = JSON.parse(readFileSync55(availPath, "utf-8"));
         hasBookingSite = typeof cfg.bookingDbName === "string" && cfg.bookingDbName.length > 0;
       }
     } catch {
     }
     if (!hasBookingSite) return;
-    const statePath = resolve50(account.accountDir, "state", "booking-availability", "last-publish.json");
+    const statePath = resolve52(account.accountDir, "state", "booking-availability", "last-publish.json");
     let lastSuccessAt = null;
-    if (existsSync56(statePath)) {
+    if (existsSync55(statePath)) {
       try {
-        const rec = JSON.parse(readFileSync54(statePath, "utf-8"));
+        const rec = JSON.parse(readFileSync55(statePath, "utf-8"));
         lastSuccessAt = rec.lastSuccessAt ?? null;
       } catch {
         console.error(`[calendar-availability] op=audit accountId=${account.accountId} snapshotAgeMs=na reason=bad-state-file`);
@@ -39888,11 +40282,11 @@ startPlannerDivergence();
 startDispatchFieldCensus(() => getSession());
 {
   const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join63(__dirname, "..");
-  const auditScript = resolve50(auditPlatformRoot, "plugins/connector/mcp/dist/scripts/audit-connectors.js");
+  const auditScript = resolve52(auditPlatformRoot, "plugins/connector/mcp/dist/scripts/audit-connectors.js");
   const auditLogDir = process.env.LOG_DIR ?? LOG_DIR;
   const CONNECTOR_AUDIT_INTERVAL_MS = 3e5;
   const runConnectorAudit = (ctx) => {
-    if (!existsSync56(auditScript)) return;
+    if (!existsSync55(auditScript)) return;
     try {
       const child = spawn3(process.execPath, [auditScript], {
         env: { ...process.env, PLATFORM_ROOT: auditPlatformRoot, LOG_DIR: auditLogDir },
@@ -40014,11 +40408,11 @@ try {
 var ADMINUSER_RECONCILE_INTERVAL_MS = 60 * 60 * 1e3;
 async function runAdminUserReconcileTick() {
   try {
-    if (!existsSync56(USERS_FILE)) {
+    if (!existsSync55(USERS_FILE)) {
       console.error("[adminuser-self-heal] skip reason=no-users-file");
       return;
     }
-    const usersRaw = readFileSync54(USERS_FILE, "utf-8").trim();
+    const usersRaw = readFileSync55(USERS_FILE, "utf-8").trim();
     if (!usersRaw) {
       console.error("[adminuser-self-heal] skip reason=empty-users-file");
       return;
@@ -40101,7 +40495,7 @@ var runIngestAuditTick = () => {
       agentExists: (accountId, slug) => {
         if (!house) return false;
         const dir = isHouseAccountKey(house.accountId, accountId) ? house.accountDir : join63(ACCOUNTS_DIR, accountId);
-        return existsSync56(join63(dir, "agents", slug, "config.json"));
+        return existsSync55(join63(dir, "agents", slug, "config.json"));
       }
     });
   } catch (err) {
@@ -40150,7 +40544,7 @@ registerLoop({
         houseAccountId: () => resolveAccount()?.accountId ?? null,
         activeSlugs: () => listValidAccounts().map((a) => {
           const agentsRoot = join63(a.accountDir, "agents");
-          if (!existsSync56(agentsRoot)) return { accountId: a.accountId, slugs: [] };
+          if (!existsSync55(agentsRoot)) return { accountId: a.accountId, slugs: [] };
           const slugs = readdirSync32(agentsRoot, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name).filter((slug) => isActiveAgentSlug(a.accountDir, slug));
           return { accountId: a.accountId, slugs };
         })
@@ -40164,8 +40558,8 @@ registerLoop({
 });
 var USERS_RECONCILE_INTERVAL_MS = 60 * 60 * 1e3;
 function countUsersRows() {
-  if (!existsSync56(USERS_FILE)) return 0;
-  const raw = readFileSync54(USERS_FILE, "utf-8").trim();
+  if (!existsSync55(USERS_FILE)) return 0;
+  const raw = readFileSync55(USERS_FILE, "utf-8").trim();
   if (!raw) return 0;
   const users = JSON.parse(raw);
   return users.filter((u) => typeof u.userId === "string").length;
@@ -40333,7 +40727,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve50(process.env.MAXY_PLATFORM_ROOT ?? join63(__dirname, "..")),
+  platformRoot: resolve52(process.env.MAXY_PLATFORM_ROOT ?? join63(__dirname, "..")),
   accountConfig: bootAccountConfig,
   // Task 2074 — enrich with the sub-account name and fan out to every open
   // admin SSE stream. Fire-and-forget: the manager's persist path must not