@rubytech/create-maxy-code 0.1.580 → 0.1.582

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.580",
+  "version": "0.1.582",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: platform-architecture
 description: Use when grounding any documented-surface claim about what Maxy ships — plugins, skills, specialists, install/deploy flows, internals. This is the install catalogue, not evidence of what is enabled on the current account. For install state on this account, call `capabilities-here`; for documented surface, cite the `Source:` URL inline.
-content-hash: sha256:4eb02ff428a09b296251263d231678bc61690bf738143a2e1defe9be2882c0a9
+content-hash: sha256:f3b452d33afd6a7c74195c06354f261ebac82ab557a00b9f80b5daa36b0a30a7
 brand: maxy-code
 product-name: Maxy
 ---
@@ -2896,6 +2896,52 @@ Just ask for what you want. "Send the team a message with Yes and No buttons",
 Maxy loads its Telegram build skill, which lists every available
 method and how to call it.
 
+When somebody presses one of those buttons or votes in one of those polls,
+Maxy hears it and can answer. Before, a press was recorded but reached
+nobody, and a vote was dropped without a trace. A press on a job-sheet card is the
+one exception: the dispatch plugin applies the change and tells the presser
+itself, so Maxy does not answer a second time.
+
+The same is now true of most of what Telegram sends. Reply to one of
+Maxy's messages and it sees the message you replied to, so "yes, do
+that one" means something. React to a message with an emoji and it hears the
+reaction and what it was on. When a poll closes, it hears the final counts. When
+somebody blocks the bot, that appears in the logs instead of sends quietly
+failing.
+
+Two things worth knowing about reactions. Telegram sends them only to a bot that
+is an administrator of the chat, and a one-to-one chat has no administrator, so a
+reaction in a private chat may never arrive at all. And a reaction on a message
+Maxy itself sent will say the original is not held: it knows the
+reaction happened, not what it was on.
+
+Payments now complete. Telegram gives a bot ten seconds to approve a checkout
+before cancelling it, which is faster than anything that has to think, so
+Maxy approves it automatically and then tells you the sale happened,
+with your own reference on it. If you sell a subscription, a customer cancelling,
+re-subscribing or failing to pay all reach Maxy as well.
+
+One limit worth knowing, and it is Telegram's rather than ours. Telegram only
+reports who voted in a poll that is **not** anonymous, and polls are anonymous
+unless you say otherwise. Ask for a poll where you can see who chose what, and
+Maxy will send it that way; ask for a plain poll and Telegram will tell
+nobody how anyone voted, so no reply is possible.
+
+## Checklists and Telegram Business
+
+Maxy can send a Telegram checklist, the kind with tick-boxes that anyone in the chat can
+mark off. Telegram only allows this on behalf of a **business account**, never from a bot on its own,
+so there is one thing to do first: in Telegram, open Settings, then Business, then Chatbots, and
+connect your bot there.
+
+That is the whole setup. Maxy notices the connection the moment you make it and remembers
+it, so from then on you can just ask for a checklist. Disconnect the bot and it stops, and
+Maxy will tell you that is why rather than failing silently.
+
+One limit, and it is Telegram's. A message sent on behalf of a business account cannot carry a button
+that opens a small web page, so a checklist and a job-sheet button arrive as two messages rather than
+one.
+
 Five of the 185 are deliberately refused, because they would break your own
 inbound messages: setting or deleting the webhook by hand, polling Telegram for
 updates instead, and the two that move the bot off Telegram's cloud servers.
@@ -3326,6 +3372,8 @@ Click any entry to open its details, where you can also edit it: the full title,
 
 Everything on the calendar comes from records the rest of Maxy already uses, scoped to your account.
 
+Two things about what Maxy itself can see and change. A deleted entry no longer comes back when Maxy lists your diary, so if you or Maxy removed a duplicate, it stays removed. And every entry Maxy can see, Maxy can now also change or cancel. Before, some entries could be read and not touched, and Maxy would say so rather than act. If you ask Maxy to record something *about* a meeting rather than the meeting itself, it writes that as a note attached to the meeting.
+
 ## The public booking page
 
 The booking page is a separate, public site on its own web address (for example `book.yourdomain.com`). A visitor sees only open time slots, never the titles or details of your existing meetings. They pick a slot, enter their name, email, and an optional note, and submit. That is the whole flow, like a simple Calendly.
@@ -3911,7 +3959,9 @@ either is a regression.
 
 **WhatsApp reader is read/write (WhatsApp-Web surface).** A WhatsApp store conversation in the operator Conversations reader (`OperatorConversations`) and the admin root channel viewer (`app/page.tsx`) no longer opens the plain read-only DM chrome — it opens `app/whatsapp/WhatsappWebConversation.tsx`, a WhatsApp-Web-styled surface: a conversation header, the delivered-only store transcript reskinned green/white under a `.wa-web` root class, and a reply composer (`app/whatsapp/ReplyComposer.tsx`). The operator can type text, insert emoji (a codepoint-data picker — no OS input, so the `check-no-emoji-in-jsx` gate stays green), record a voice note (MediaRecorder → the existing audio send path), attach a file **from device storage** (a modal browsing the DATA_ROOT tree via `GET /api/admin/files`, sent by reference — the OS file dialog is no longer the reader's picker), reply to a specific message (a per-bubble affordance that quotes the original in the composer and threads natively on WhatsApp), and search the loaded transcript (a header control that filters to matching turns and highlights the match). The header carries only that Search control — the former Video / Phone / menu icons are gone, because no call or presence data exists behind them. Sent files honour the webchat allowlist (`SUPPORTED_MIME_SET` / 50 MB / 5 files); a device-file reference is authorised server-side (`authorizeReplyFileRef`) against the send's own account (the conversation owner) **or** the session's pinned account (`getAccountIdForSession` — the exact scope the DeviceFilePicker used to offer it), so a house/managing-admin session can attach a managed-client file the picker listed. Because a reply sends bytes OUT to an external WhatsApp recipient, any other account, a `public` partition, and any install-wide / non-account path are refused fail-closed; the cross-account admission's authority is the session's pinned account, never the caller-supplied body `accountId` (the own-account admission matches the body `accountId`, which the route already trusts via `isValidAccountId` and the existing-conversation guard). A scope refusal returns a distinct HTTP 403 reason (`file-ref-cross-account` / `file-ref-public` / `file-ref-foreign`) and copy, never "device file not found" (reserved for a genuine resolve/stat miss). Per-ref `[wa-manual-send] op=reply-file-ref … via=own|session|deny reason=<…> ok=<bool>` logs the decision before any send; `via=deny ok=true` is the exfiltration signature that must never appear. **Send is reply-only and DM-only:** `POST /api/whatsapp-reader/reply` (`requireAdminSession`) refuses any target with no existing stored conversation (`reason=no-existing-conversation`, HTTP 403) — a cold first-contact send bans the account, so the composer is never a cold-contact path, enforced server-side — and refuses `@g.us` groups (`reason=group-send-blocked`), matching the agent's observe-only group invariant; a group thread shows a read-only note in place of the composer. The endpoint is the sole store writer for a manual send: right after each send resolves it appends the record itself, stamped `origin:'operator-manual'` (attributed "You", distinct from an assistant reply), because the Baileys echo that normally persists the store is gated on message text (`manager.ts:906`) and would leave an uncaptioned media send delivered-but-invisible. The record's `messageId` matches the echo's derivation so the async text echo's own persist dedups to a no-op; the send is confirmed by re-read (`op=recorded present=<bool>`). A sent send does not spawn an assistant turn (echo dispatch stays suppressed). Attachments deliver as WhatsApp media/documents and render **inline** in the store reader (image thumbnail / pdf preview / audio player / download chip), because the manual-send path records the message with the servable `attachmentId`. The `.wa-web` skin is scoped to WhatsApp store threads only, so `/chat`, the admin agent session view, and the public visitor webchat are unchanged; the visitor webchat gains no send capability. The in-bubble delivered-tick is cosmetic (no read-receipt data is stored); inbound bubbles keep their sender name so group threads stay attributable, and both directions carry a WhatsApp callout tail (`.wa-web`-scoped only). Non-WhatsApp reader rows (Telegram/webchat session JSONLs) keep the plain read-only `Transcript`. Observability rides `[wa-manual-send]` lines correlated by a per-request `sendId`. **Composer sizing matches the webchat composer:** the reply textarea auto-grows to fit multi-line content (measured from `scrollHeight`, clamped to a one-row minimum and a `viewport/3` maximum, scrollable past the cap with the scrollbar hidden), and a top-border grab handle drags (pointer) or nudges (ArrowUp/ArrowDown, keyboard-focusable) to an explicit height in the same clamp; a manual drag pins the height and overrides auto-grow until the field is cleared, which releases it back to auto-grow. A completed manual resize logs `[operator-ui] op=wa-composer-resize mode=drag|key h=<px>`; a bare click on the handle (no drag) logs nothing.
 
-**Shared locations show a map.** When someone shares a location on WhatsApp, the conversation shows a small map with a pin on the spot, above the coordinates themselves. Selecting the map opens the full map on OpenStreetMap in a new tab. A location shared as a place name with no coordinates shows the name only, because there is no point to put a pin on. The map images are fetched by your browser from OpenStreetMap, so the shared coordinates reach that service when a location bubble is on screen.
+**Shared locations show a map.** When someone shares a location on WhatsApp, the conversation shows a small map with a pin on the spot, above the coordinates themselves. A location shared as a place name with no coordinates shows the name only, because there is no point to put a pin on. The map images are fetched by your browser from OpenStreetMap, so the shared coordinates reach that service when a location bubble is on screen.
+
+**Selecting a map opens one you can move around.** The small map opens a larger one over the conversation: drag to move it, scroll or pinch to zoom in and out, double-click to zoom in, and press Escape or select the backdrop to close it. On a phone it fills the screen. A link at the bottom still opens the same spot on OpenStreetMap in a new tab if you want it there. Someone sharing their live location keeps arriving as they move, and the open map keeps centring on where they are now until you move it yourself; from then on your own view stays put while the trail keeps growing, and a **Follow** button brings it back to following them.
 
 **`/chat` live activity line.** While a turn is in flight the transcript tail shows one ephemeral `ChatActivity` line (mounted only while `busy`, admin/operator only). It tracks real activity, not a timer: while a `Task` subagent runs it shows that subagent's headline (`agentType · description`, prefixed `N agents ·` when ≥2 are concurrent), sourced from `agent-<hex>.meta.json` via named `activity` SSE events the admin reader pushes from the session's `subagents/` dir; with no subagent active it shows a neutral word that advances only on a real turn arrival. The line carries a turn-elapsed clock and flips to a `stalled` state once nothing has been written for 5 minutes (`now − lastEmitAt`), so the operator can tell a wedge from progress without SSH. It is never added to the persisted timeline. Detail and the `[webchat-activity]` observability live in [`admin-webchat-native-channel.md`](../../../.docs/admin-webchat-native-channel.md).
 

package/payload/platform/plugins/admin/skills/whats-new/SKILL.md

@@ -9,6 +9,22 @@ Invoked by the admin agent directly.
 
 This is the platform's release timeline, newest first. Each entry shows the date it shipped and the version it shipped in, so you can tell the operator how current their install is. To compare, read the installed version from `capabilities-here` and match it against the versions below. Keep answers high level and in plain English; this is a summary, not a full commit log.
 
+## 2026-08-09 (0.1.582)
+
+- Telegram now understands the full range of what arrives, not a quarter of it. Only four of the twenty-six kinds of update were handled, so a reply reached the assistant without the message it was replying to, a reaction never arrived at all, and a Stars payment could not complete.
+- A Telegram Business connection is now kept rather than announced and thrown away, which is what a native checklist needs in order to be sent.
+- The typing indicator keeps going while a background task runs, instead of stopping the moment the work moved off the main turn.
+- A shared location can be panned and zoomed where it sits. Opening a new browser tab was the only way to move the map.
+
+## 2026-08-09 (0.1.581)
+
+- Pressing a button or voting in a poll on Telegram now reaches the assistant. Only plain text messages ever did, so every other kind of interaction was accepted and then went nowhere.
+- Sharing your live location no longer starts a fresh conversation on every update. Each ping was raising a full turn, and the position it carried was stored nowhere you could read it; a share is now one turn, and the location is kept where it can be used.
+- The assistant knows what it can do on Telegram. Its instructions never mentioned the channel's own abilities, so it did not offer buttons or media even when they were the natural reply.
+- The typing indicator behaves like one. It was throttled rather than repeated, so it stopped showing during the long pauses it exists for.
+- The conversation pane shows message times and attachments, both of which were missing.
+- A Telegram message from you no longer lands in whatever webchat conversation happens to be open.
+
 ## 2026-08-08 (0.1.580)
 
 - Telegram is now a first-class channel rather than a thin pass-through. Answers arrive formatted and stream as they are written instead of landing as one late block; the assistant can ask a question with buttons, send media, and issue an invoice; and the conversation pane has its own look instead of wearing WhatsApp's green.

package/payload/platform/plugins/docs/references/admin-ui.md

@@ -85,7 +85,9 @@ either is a regression.
 
 **WhatsApp reader is read/write (WhatsApp-Web surface).** A WhatsApp store conversation in the operator Conversations reader (`OperatorConversations`) and the admin root channel viewer (`app/page.tsx`) no longer opens the plain read-only DM chrome — it opens `app/whatsapp/WhatsappWebConversation.tsx`, a WhatsApp-Web-styled surface: a conversation header, the delivered-only store transcript reskinned green/white under a `.wa-web` root class, and a reply composer (`app/whatsapp/ReplyComposer.tsx`). The operator can type text, insert emoji (a codepoint-data picker — no OS input, so the `check-no-emoji-in-jsx` gate stays green), record a voice note (MediaRecorder → the existing audio send path), attach a file **from device storage** (a modal browsing the DATA_ROOT tree via `GET /api/admin/files`, sent by reference — the OS file dialog is no longer the reader's picker), reply to a specific message (a per-bubble affordance that quotes the original in the composer and threads natively on WhatsApp), and search the loaded transcript (a header control that filters to matching turns and highlights the match). The header carries only that Search control — the former Video / Phone / menu icons are gone, because no call or presence data exists behind them. Sent files honour the webchat allowlist (`SUPPORTED_MIME_SET` / 50 MB / 5 files); a device-file reference is authorised server-side (`authorizeReplyFileRef`) against the send's own account (the conversation owner) **or** the session's pinned account (`getAccountIdForSession` — the exact scope the DeviceFilePicker used to offer it), so a house/managing-admin session can attach a managed-client file the picker listed. Because a reply sends bytes OUT to an external WhatsApp recipient, any other account, a `public` partition, and any install-wide / non-account path are refused fail-closed; the cross-account admission's authority is the session's pinned account, never the caller-supplied body `accountId` (the own-account admission matches the body `accountId`, which the route already trusts via `isValidAccountId` and the existing-conversation guard). A scope refusal returns a distinct HTTP 403 reason (`file-ref-cross-account` / `file-ref-public` / `file-ref-foreign`) and copy, never "device file not found" (reserved for a genuine resolve/stat miss). Per-ref `[wa-manual-send] op=reply-file-ref … via=own|session|deny reason=<…> ok=<bool>` logs the decision before any send; `via=deny ok=true` is the exfiltration signature that must never appear. **Send is reply-only and DM-only:** `POST /api/whatsapp-reader/reply` (`requireAdminSession`) refuses any target with no existing stored conversation (`reason=no-existing-conversation`, HTTP 403) — a cold first-contact send bans the account, so the composer is never a cold-contact path, enforced server-side — and refuses `@g.us` groups (`reason=group-send-blocked`), matching the agent's observe-only group invariant; a group thread shows a read-only note in place of the composer. The endpoint is the sole store writer for a manual send: right after each send resolves it appends the record itself, stamped `origin:'operator-manual'` (attributed "You", distinct from an assistant reply), because the Baileys echo that normally persists the store is gated on message text (`manager.ts:906`) and would leave an uncaptioned media send delivered-but-invisible. The record's `messageId` matches the echo's derivation so the async text echo's own persist dedups to a no-op; the send is confirmed by re-read (`op=recorded present=<bool>`). A sent send does not spawn an assistant turn (echo dispatch stays suppressed). Attachments deliver as WhatsApp media/documents and render **inline** in the store reader (image thumbnail / pdf preview / audio player / download chip), because the manual-send path records the message with the servable `attachmentId`. The `.wa-web` skin is scoped to WhatsApp store threads only, so `/chat`, the admin agent session view, and the public visitor webchat are unchanged; the visitor webchat gains no send capability. The in-bubble delivered-tick is cosmetic (no read-receipt data is stored); inbound bubbles keep their sender name so group threads stay attributable, and both directions carry a WhatsApp callout tail (`.wa-web`-scoped only). Non-WhatsApp reader rows (Telegram/webchat session JSONLs) keep the plain read-only `Transcript`. Observability rides `[wa-manual-send]` lines correlated by a per-request `sendId`. **Composer sizing matches the webchat composer:** the reply textarea auto-grows to fit multi-line content (measured from `scrollHeight`, clamped to a one-row minimum and a `viewport/3` maximum, scrollable past the cap with the scrollbar hidden), and a top-border grab handle drags (pointer) or nudges (ArrowUp/ArrowDown, keyboard-focusable) to an explicit height in the same clamp; a manual drag pins the height and overrides auto-grow until the field is cleared, which releases it back to auto-grow. A completed manual resize logs `[operator-ui] op=wa-composer-resize mode=drag|key h=<px>`; a bare click on the handle (no drag) logs nothing.
 
-**Shared locations show a map.** When someone shares a location on WhatsApp, the conversation shows a small map with a pin on the spot, above the coordinates themselves. Selecting the map opens the full map on OpenStreetMap in a new tab. A location shared as a place name with no coordinates shows the name only, because there is no point to put a pin on. The map images are fetched by your browser from OpenStreetMap, so the shared coordinates reach that service when a location bubble is on screen.
+**Shared locations show a map.** When someone shares a location on WhatsApp, the conversation shows a small map with a pin on the spot, above the coordinates themselves. A location shared as a place name with no coordinates shows the name only, because there is no point to put a pin on. The map images are fetched by your browser from OpenStreetMap, so the shared coordinates reach that service when a location bubble is on screen.
+
+**Selecting a map opens one you can move around.** The small map opens a larger one over the conversation: drag to move it, scroll or pinch to zoom in and out, double-click to zoom in, and press Escape or select the backdrop to close it. On a phone it fills the screen. A link at the bottom still opens the same spot on OpenStreetMap in a new tab if you want it there. Someone sharing their live location keeps arriving as they move, and the open map keeps centring on where they are now until you move it yourself; from then on your own view stays put while the trail keeps growing, and a **Follow** button brings it back to following them.
 
 **`/chat` live activity line.** While a turn is in flight the transcript tail shows one ephemeral `ChatActivity` line (mounted only while `busy`, admin/operator only). It tracks real activity, not a timer: while a `Task` subagent runs it shows that subagent's headline (`agentType · description`, prefixed `N agents ·` when ≥2 are concurrent), sourced from `agent-<hex>.meta.json` via named `activity` SSE events the admin reader pushes from the session's `subagents/` dir; with no subagent active it shows a neutral word that advances only on a real turn arrival. The line carries a turn-elapsed clock and flips to a `stalled` state once nothing has been written for 5 minutes (`now − lastEmitAt`), so the operator can tell a wedge from progress without SSH. It is never added to the persisted timeline. Detail and the `[webchat-activity]` observability live in [`admin-webchat-native-channel.md`](../../../.docs/admin-webchat-native-channel.md).
 

package/payload/platform/plugins/docs/references/calendar-booking.md

@@ -18,6 +18,8 @@ Click any entry to open its details, where you can also edit it: the full title,
 
 Everything on the calendar comes from records the rest of Maxy already uses, scoped to your account.
 
+Two things about what Maxy itself can see and change. A deleted entry no longer comes back when Maxy lists your diary, so if you or Maxy removed a duplicate, it stays removed. And every entry Maxy can see, Maxy can now also change or cancel. Before, some entries could be read and not touched, and Maxy would say so rather than act. If you ask Maxy to record something *about* a meeting rather than the meeting itself, it writes that as a note attached to the meeting.
+
 ## The public booking page
 
 The booking page is a separate, public site on its own web address (for example `book.yourdomain.com`). A visitor sees only open time slots, never the titles or details of your existing meetings. They pick a slot, enter their name, email, and an optional note, and submit. That is the whole flow, like a simple Calendly.

package/payload/platform/plugins/docs/references/telegram-guide.md

@@ -90,6 +90,52 @@ Just ask for what you want. "Send the team a message with Yes and No buttons",
 {{productName}} loads its Telegram build skill, which lists every available
 method and how to call it.
 
+When somebody presses one of those buttons or votes in one of those polls,
+{{productName}} hears it and can answer. Before, a press was recorded but reached
+nobody, and a vote was dropped without a trace. A press on a job-sheet card is the
+one exception: the dispatch plugin applies the change and tells the presser
+itself, so {{productName}} does not answer a second time.
+
+The same is now true of most of what Telegram sends. Reply to one of
+{{productName}}'s messages and it sees the message you replied to, so "yes, do
+that one" means something. React to a message with an emoji and it hears the
+reaction and what it was on. When a poll closes, it hears the final counts. When
+somebody blocks the bot, that appears in the logs instead of sends quietly
+failing.
+
+Two things worth knowing about reactions. Telegram sends them only to a bot that
+is an administrator of the chat, and a one-to-one chat has no administrator, so a
+reaction in a private chat may never arrive at all. And a reaction on a message
+{{productName}} itself sent will say the original is not held: it knows the
+reaction happened, not what it was on.
+
+Payments now complete. Telegram gives a bot ten seconds to approve a checkout
+before cancelling it, which is faster than anything that has to think, so
+{{productName}} approves it automatically and then tells you the sale happened,
+with your own reference on it. If you sell a subscription, a customer cancelling,
+re-subscribing or failing to pay all reach {{productName}} as well.
+
+One limit worth knowing, and it is Telegram's rather than ours. Telegram only
+reports who voted in a poll that is **not** anonymous, and polls are anonymous
+unless you say otherwise. Ask for a poll where you can see who chose what, and
+{{productName}} will send it that way; ask for a plain poll and Telegram will tell
+nobody how anyone voted, so no reply is possible.
+
+## Checklists and Telegram Business
+
+{{productName}} can send a Telegram checklist, the kind with tick-boxes that anyone in the chat can
+mark off. Telegram only allows this on behalf of a **business account**, never from a bot on its own,
+so there is one thing to do first: in Telegram, open Settings, then Business, then Chatbots, and
+connect your bot there.
+
+That is the whole setup. {{productName}} notices the connection the moment you make it and remembers
+it, so from then on you can just ask for a checklist. Disconnect the bot and it stops, and
+{{productName}} will tell you that is why rather than failing silently.
+
+One limit, and it is Telegram's. A message sent on behalf of a business account cannot carry a button
+that opens a small web page, so a checklist and a job-sheet button arrive as two messages rather than
+one.
+
 Five of the 185 are deliberately refused, because they would break your own
 inbound messages: setting or deleting the webhook by hand, polling Telegram for
 updates instead, and the two that move the bot off Telegram's cloud servers.

package/payload/platform/plugins/memory/mcp/dist/lib/__tests__/label-origin-gate.test.js

@@ -1,6 +1,7 @@
 // Task 350 — tests for the per-account-root reservation gate.
+// Task 2613 — plus the calendar-label reservation, below.
 import { describe, it, expect } from "vitest";
-import { checkLabelOriginGate, RESERVED_LABEL_REFUSAL } from "../label-origin-gate.js";
+import { checkLabelOriginGate, RESERVED_LABEL_REFUSAL, CALENDAR_LABEL_REFUSAL, } from "../label-origin-gate.js";
 describe("checkLabelOriginGate", () => {
     it("(a) system origin writing LocalBusiness → ok", () => {
         const r = checkLabelOriginGate({
@@ -47,4 +48,66 @@ describe("checkLabelOriginGate", () => {
         expect(r.ok).toBe(false);
     });
 });
+// Task 2613 — memory-write created :Meeting rows carrying no uid. A meeting's
+// only handle IS its uid, so schedule-list returned eventId:null for them and
+// schedule-get/update/cancel, which all resolve MATCH (m:Meeting {uid: $id}),
+// could never match. 37 untrashed rows on one install were unreachable, and
+// with no key there was no MERGE collision either, so the same appointment was
+// written twice three weeks apart.
+describe("checkLabelOriginGate — :Meeting is scheduling-owned", () => {
+    it("refuses a Meeting create and names schedule-event", () => {
+        const r = checkLabelOriginGate({
+            labels: ["Meeting"],
+            createdBy: { agent: "admin" },
+            accountId: "acct-12345678",
+            tool: "memory-write",
+        });
+        expect(r.ok).toBe(false);
+        if (r.ok)
+            return;
+        expect(r.reason).toBe("calendar-label");
+        expect(r.message).toBe(CALENDAR_LABEL_REFUSAL);
+        expect(r.message).toContain("schedule-event");
+        expect(r.message).toContain("uid");
+    });
+    it("refuses Meeting even from system origin", () => {
+        // No exemption: meeting-write.ts, reconcile-bookings.ts and
+        // ics-graph-ingest.ts each run their own Cypher and none routes through
+        // memoryWrite, so nothing legitimate needs a bypass here.
+        const r = checkLabelOriginGate({
+            labels: ["Meeting"],
+            createdBy: { agent: "system" },
+            accountId: "acct-12345678",
+            tool: "memory-write",
+        });
+        expect(r.ok).toBe(false);
+    });
+    it("refuses Meeting when it rides along with another label", () => {
+        const r = checkLabelOriginGate({
+            labels: ["KnowledgeDocument", "Meeting"],
+            createdBy: { agent: "admin" },
+            accountId: "acct-12345678",
+            tool: "memory-write",
+        });
+        expect(r.ok).toBe(false);
+    });
+    it("still allows Note, the redirect target", () => {
+        const r = checkLabelOriginGate({
+            labels: ["Note"],
+            createdBy: { agent: "admin" },
+            accountId: "acct-12345678",
+            tool: "memory-write",
+        });
+        expect(r.ok).toBe(true);
+    });
+    it("leaves the LocalBusiness rule exactly as it was", () => {
+        const system = checkLabelOriginGate({
+            labels: ["LocalBusiness"],
+            createdBy: { agent: "system" },
+            accountId: "acct-12345678",
+            tool: "memory-write",
+        });
+        expect(system.ok).toBe(true);
+    });
+});
 //# sourceMappingURL=label-origin-gate.test.js.map

package/payload/platform/plugins/memory/mcp/dist/lib/__tests__/label-origin-gate.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"label-origin-gate.test.js","sourceRoot":"","sources":["../../../src/lib/__tests__/label-origin-gate.test.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAE9D,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEvF,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,GAAG,oBAAoB,CAAC;YAC7B,MAAM,EAAE,CAAC,eAAe,CAAC;YACzB,SAAS,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAW;YACvC,SAAS,EAAE,eAAe;YAC1B,IAAI,EAAE,cAAc;SACrB,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,GAAG,EAAE;QACrF,MAAM,CAAC,GAAG,oBAAoB,CAAC;YAC7B,MAAM,EAAE,CAAC,eAAe,CAAC;YACzB,SAAS,EAAE,EAAE,KAAK,EAAE,OAAO,EAAW;YACtC,SAAS,EAAE,eAAe;YAC1B,IAAI,EAAE,cAAc;SACrB,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,CAAC,CAAC,EAAE;YAAE,OAAO;QACjB,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACxC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAC/C,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,iCAAiC,CAAC,CAAC;QAC/D,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAChD,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,CAAC,GAAG,oBAAoB,CAAC;YAC7B,MAAM,EAAE,CAAC,cAAc,CAAC;YACxB,SAAS,EAAE,EAAE,KAAK,EAAE,OAAO,EAAW;YACtC,SAAS,EAAE,eAAe;YAC1B,IAAI,EAAE,cAAc;SACrB,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,4EAA4E;QAC5E,MAAM,CAAC,GAAG,oBAAoB,CAAC;YAC7B,MAAM,EAAE,CAAC,eAAe,CAAC;YACzB,SAAS,EAAE,EAAW;YACtB,SAAS,EAAE,eAAe;YAC1B,IAAI,EAAE,cAAc;SACrB,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"label-origin-gate.test.js","sourceRoot":"","sources":["../../../src/lib/__tests__/label-origin-gate.test.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,0DAA0D;AAE1D,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAEjC,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,GAAG,oBAAoB,CAAC;YAC7B,MAAM,EAAE,CAAC,eAAe,CAAC;YACzB,SAAS,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAW;YACvC,SAAS,EAAE,eAAe;YAC1B,IAAI,EAAE,cAAc;SACrB,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,GAAG,EAAE;QACrF,MAAM,CAAC,GAAG,oBAAoB,CAAC;YAC7B,MAAM,EAAE,CAAC,eAAe,CAAC;YACzB,SAAS,EAAE,EAAE,KAAK,EAAE,OAAO,EAAW;YACtC,SAAS,EAAE,eAAe;YAC1B,IAAI,EAAE,cAAc;SACrB,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,CAAC,CAAC,EAAE;YAAE,OAAO;QACjB,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACxC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAC/C,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,iCAAiC,CAAC,CAAC;QAC/D,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAChD,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,CAAC,GAAG,oBAAoB,CAAC;YAC7B,MAAM,EAAE,CAAC,cAAc,CAAC;YACxB,SAAS,EAAE,EAAE,KAAK,EAAE,OAAO,EAAW;YACtC,SAAS,EAAE,eAAe;YAC1B,IAAI,EAAE,cAAc;SACrB,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,4EAA4E;QAC5E,MAAM,CAAC,GAAG,oBAAoB,CAAC;YAC7B,MAAM,EAAE,CAAC,eAAe,CAAC;YACzB,SAAS,EAAE,EAAW;YACtB,SAAS,EAAE,eAAe;YAC1B,IAAI,EAAE,cAAc;SACrB,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,8EAA8E;AAC9E,8EAA8E;AAC9E,4EAA4E;AAC5E,+EAA+E;AAC/E,mCAAmC;AACnC,QAAQ,CAAC,qDAAqD,EAAE,GAAG,EAAE;IACnE,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,CAAC,GAAG,oBAAoB,CAAC;YAC7B,MAAM,EAAE,CAAC,SAAS,CAAC;YACnB,SAAS,EAAE,EAAE,KAAK,EAAE,OAAO,EAAW;YACtC,SAAS,EAAE,eAAe;YAC1B,IAAI,EAAE,cAAc;SACrB,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,CAAC,CAAC,EAAE;YAAE,OAAO;QACjB,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACxC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAC/C,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAC9C,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,4DAA4D;QAC5D,wEAAwE;QACxE,0DAA0D;QAC1D,MAAM,CAAC,GAAG,oBAAoB,CAAC;YAC7B,MAAM,EAAE,CAAC,SAAS,CAAC;YACnB,SAAS,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAW;YACvC,SAAS,EAAE,eAAe;YAC1B,IAAI,EAAE,cAAc;SACrB,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,GAAG,oBAAoB,CAAC;YAC7B,MAAM,EAAE,CAAC,mBAAmB,EAAE,SAAS,CAAC;YACxC,SAAS,EAAE,EAAE,KAAK,EAAE,OAAO,EAAW;YACtC,SAAS,EAAE,eAAe;YAC1B,IAAI,EAAE,cAAc;SACrB,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,GAAG,oBAAoB,CAAC;YAC7B,MAAM,EAAE,CAAC,MAAM,CAAC;YAChB,SAAS,EAAE,EAAE,KAAK,EAAE,OAAO,EAAW;YACtC,SAAS,EAAE,eAAe;YAC1B,IAAI,EAAE,cAAc;SACrB,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,MAAM,GAAG,oBAAoB,CAAC;YAClC,MAAM,EAAE,CAAC,eAAe,CAAC;YACzB,SAAS,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAW;YACvC,SAAS,EAAE,eAAe;YAC1B,IAAI,EAAE,cAAc;SACrB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/payload/platform/plugins/memory/mcp/dist/lib/label-origin-gate.d.ts

@@ -1,5 +1,6 @@
 import type { CreatedBy } from "../../../../../lib/graph-write/dist/index.js";
 export declare const RESERVED_LABEL_REFUSAL: string;
+export declare const CALENDAR_LABEL_REFUSAL: string;
 interface OriginGateArgs {
     labels: string[];
     createdBy: CreatedBy;
@@ -12,6 +13,10 @@ type OriginGateResult = {
     ok: false;
     reason: "reserved-label";
     message: string;
+} | {
+    ok: false;
+    reason: "calendar-label";
+    message: string;
 };
 export declare function checkLabelOriginGate(args: OriginGateArgs): OriginGateResult;
 export {};

package/payload/platform/plugins/memory/mcp/dist/lib/label-origin-gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"label-origin-gate.d.ts","sourceRoot":"","sources":["../../src/lib/label-origin-gate.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8CAA8C,CAAC;AAK9E,eAAO,MAAM,sBAAsB,QAIoC,CAAC;AAExE,UAAU,cAAc;IACtB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,SAAS,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,cAAc,CAAC;CACtB;AAED,KAAK,gBAAgB,GACjB;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7D,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,cAAc,GAAG,gBAAgB,CAqB3E"}
+{"version":3,"file":"label-origin-gate.d.ts","sourceRoot":"","sources":["../../src/lib/label-origin-gate.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8CAA8C,CAAC;AAM9E,eAAO,MAAM,sBAAsB,QAIoC,CAAC;AAExE,eAAO,MAAM,sBAAsB,QAMJ,CAAC;AAEhC,UAAU,cAAc;IACtB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,SAAS,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,cAAc,CAAC;CACtB;AAED,KAAK,gBAAgB,GACjB;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7D,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,cAAc,GAAG,gBAAgB,CAgC3E"}

package/payload/platform/plugins/memory/mcp/dist/lib/label-origin-gate.js

@@ -1,22 +1,44 @@
-// Task 350 + Task 448 — Refuse agent-origin *creates* of a second
-// `:LocalBusiness`. The installer's seed-neo4j.sh writes the single root node
-// via raw cypher (createdBy.agent === 'system' by convention); third-party
-// companies must go to `:Organization` per schema-base.md. Without this gate
-// an agent mislabel either silently corrupts the operator's root via MERGE
-// or trips the UNIQUE constraint on LocalBusiness.accountId.
+// Two labels this module reserves against agent-origin *creates*.
+//
+// Task 350 + Task 448 — `:LocalBusiness`. The installer's seed-neo4j.sh writes
+// the single root node via raw cypher (createdBy.agent === 'system' by
+// convention); third-party companies must go to `:Organization` per
+// schema-base.md. Without this gate an agent mislabel either silently corrupts
+// the operator's root via MERGE or trips the UNIQUE constraint on
+// LocalBusiness.accountId. System origin is exempt.
+//
+// Task 2613 — `:Meeting`, with no exemption. A meeting's only handle is its
+// `uid`, a content hash schedule-event computes and MERGEs on; memory-write
+// writes none, so every row it created could be listed and never edited or
+// cancelled, and with no key the same appointment duplicated freely.
 //
 // Scope is creates only (`memory-write`). Property updates against the
 // existing root (`memory-update`, elementId-resolved + accountId-scoped)
 // cannot create a new node, so the gate does not apply there — they are
 // guarded by checkLabelWriteGate + checkGraphWriteGate + property restriction.
 const RESERVED_LABEL = "LocalBusiness";
+const CALENDAR_LABEL = "Meeting";
 const SYSTEM_AGENT = "system";
 export const RESERVED_LABEL_REFUSAL = `Creating a second ${RESERVED_LABEL} is refused — it is the per-account root ` +
     `seeded by the installer. Use Organization for third-party companies — see ` +
     `platform/plugins/memory/references/schema-base.md. ` +
     `To edit the existing root, use memory-update against its elementId.`;
+export const CALENDAR_LABEL_REFUSAL = `Creating a ${CALENDAR_LABEL} through memory-write is refused. A calendar ` +
+    `entry's handle is its uid, which only schedule-event computes, and a row ` +
+    `written without one can never be read back, edited or cancelled by any ` +
+    `scheduling tool. Use schedule-event (scheduling plugin) with startDate and ` +
+    `endDate. To record notes ABOUT a meeting, write a Note or KnowledgeDocument ` +
+    `and link it to the meeting.`;
 export function checkLabelOriginGate(args) {
     const { labels, createdBy, accountId, tool } = args;
+    // Checked before LocalBusiness so a write carrying both is refused for the
+    // calendar reason, which is the one that names the tool to use instead.
+    if (labels.includes(CALENDAR_LABEL)) {
+        const acctPrefix = accountId ? accountId.slice(0, 8) : "<none>";
+        const agent = createdBy.agent ?? "<unset>";
+        console.error(`[label-origin-gate] reject accountId=${acctPrefix} label=${CALENDAR_LABEL} agent=${agent} tool=${tool}`);
+        return { ok: false, reason: "calendar-label", message: CALENDAR_LABEL_REFUSAL };
+    }
     if (!labels.includes(RESERVED_LABEL)) {
         return { ok: true };
     }

package/payload/platform/plugins/memory/mcp/dist/lib/label-origin-gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"label-origin-gate.js","sourceRoot":"","sources":["../../src/lib/label-origin-gate.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,8EAA8E;AAC9E,2EAA2E;AAC3E,6EAA6E;AAC7E,2EAA2E;AAC3E,6DAA6D;AAC7D,EAAE;AACF,uEAAuE;AACvE,yEAAyE;AACzE,wEAAwE;AACxE,+EAA+E;AAI/E,MAAM,cAAc,GAAG,eAAe,CAAC;AACvC,MAAM,YAAY,GAAG,QAAQ,CAAC;AAE9B,MAAM,CAAC,MAAM,sBAAsB,GACjC,qBAAqB,cAAc,2CAA2C;IAC9E,4EAA4E;IAC5E,qDAAqD;IACrD,qEAAqE,CAAC;AAaxE,MAAM,UAAU,oBAAoB,CAAC,IAAoB;IACvD,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;IAEpD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,YAAY,EAAE,CAAC;QAC7C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAChE,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC;IAC3C,OAAO,CAAC,KAAK,CACX,wCAAwC,UAAU,UAAU,cAAc,UAAU,KAAK,SAAS,IAAI,EAAE,CACzG,CAAC;IAEF,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,gBAAgB;QACxB,OAAO,EAAE,sBAAsB;KAChC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"label-origin-gate.js","sourceRoot":"","sources":["../../src/lib/label-origin-gate.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,EAAE;AACF,+EAA+E;AAC/E,uEAAuE;AACvE,oEAAoE;AACpE,+EAA+E;AAC/E,kEAAkE;AAClE,oDAAoD;AACpD,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,2EAA2E;AAC3E,qEAAqE;AACrE,EAAE;AACF,uEAAuE;AACvE,yEAAyE;AACzE,wEAAwE;AACxE,+EAA+E;AAI/E,MAAM,cAAc,GAAG,eAAe,CAAC;AACvC,MAAM,cAAc,GAAG,SAAS,CAAC;AACjC,MAAM,YAAY,GAAG,QAAQ,CAAC;AAE9B,MAAM,CAAC,MAAM,sBAAsB,GACjC,qBAAqB,cAAc,2CAA2C;IAC9E,4EAA4E;IAC5E,qDAAqD;IACrD,qEAAqE,CAAC;AAExE,MAAM,CAAC,MAAM,sBAAsB,GACjC,cAAc,cAAc,+CAA+C;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,6EAA6E;IAC7E,8EAA8E;IAC9E,6BAA6B,CAAC;AAchC,MAAM,UAAU,oBAAoB,CAAC,IAAoB;IACvD,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;IAEpD,2EAA2E;IAC3E,wEAAwE;IACxE,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAChE,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC;QAC3C,OAAO,CAAC,KAAK,CACX,wCAAwC,UAAU,UAAU,cAAc,UAAU,KAAK,SAAS,IAAI,EAAE,CACzG,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAClF,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,YAAY,EAAE,CAAC;QAC7C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAChE,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC;IAC3C,OAAO,CAAC,KAAK,CACX,wCAAwC,UAAU,UAAU,cAAc,UAAU,KAAK,SAAS,IAAI,EAAE,CACzG,CAAC;IAEF,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,gBAAgB;QACxB,OAAO,EAAE,sBAAsB;KAChC,CAAC;AACJ,CAAC"}

package/payload/platform/plugins/memory/references/schema-knowledge-work.md

@@ -13,7 +13,7 @@ When loading this reference, confirm: "Using schema-base + schema-knowledge-work
 Most of knowledge work is already in the base schema. Use the base labels, do not duplicate them:
 
 - People and orgs: `Person`, `Organization`, `Position`, `Credential`. Reporting lines are the `REPORTS_TO` edge below, not a node.
-- Work: `Task` (a `schema:Action`), `Project`, `Meeting`, `Event`, `Workflow`.
+- Work: `Task` (a `schema:Action`), `Project`, `Meeting`, `Event`, `Workflow`. `Meeting` is scheduling-owned: `memory-write` refuses to create one, because a meeting's handle is the `uid` only `schedule-event` computes, and a row written without one can never be read back, edited or cancelled. Book it with `schedule-event`; to record notes *about* a meeting, write a `Note` or `KnowledgeDocument` and link it.
 - Concepts and content: `DefinedTerm` (concepts, skills, glossary, learnings), `Concept`, `Idea`, `CreativeWork`, `KnowledgeDocument` and `Section`.
 
 The gaps this vertical fills are: goals and OKRs, decision records, risk, and the research / citation / evidence layer. It adds those seven labels and nothing else.

package/payload/platform/plugins/scheduling/PLUGIN.md

@@ -134,6 +134,8 @@ To book a meeting with someone, resolve the counterparty to a `:Person` first (v
 
 The chosen bucket is logged on every write: `[schedule-event] op=write label=Meeting|Event reason=<discriminator>`.
 
+`:Meeting` has exactly three writers: `schedule-event` (`meeting-write.ts`), public-booking reconcile (`reconcile-bookings.ts`) and `.ics` import (`ics-graph-ingest.ts`). `memory-write` refuses the label outright and redirects to `schedule-event`, because it computes no `uid`, and a meeting without one can never be read back, edited or cancelled. To record notes *about* a meeting, write a `:Note` or `:KnowledgeDocument` and link it.
+
 Backfilling already-written `:Event` appointments into `:Meeting` is a separate divergence-driven migration, not part of this write path.
 
 ### Reading meetings back
@@ -142,7 +144,11 @@ Both labels are readable. `schedule-list` returns meetings and events together a
 
 A meeting's handle is its `uid`. `schedule-event` returns it on creation, and `schedule-get`, `schedule-update` and `schedule-cancel` accept it wherever they accept an event id — they resolve an event first, then a meeting, so a caller never has to say which kind it holds. Updating a meeting sets `title`, `startsAt`, `endsAt` and `location` and never rewrites the `uid`; `eventStatus`, `recurrence`, `note`, `action` and `agentDispatch` have no meeting equivalent and do not cross over. A meeting DOES carry a `description`: `schedule-event` writes one, `schedule-get` returns it, and the admin Calendar edits it. `schedule-update` does not write it, so this tool's field set is narrower than the admin Calendar edit's. Cancelling a meeting **deletes** it and its attendee edges, the same as deleting it on the Calendar page — a `:Meeting` has no status to set to cancelled. A booking-sourced meeting that is deleted is rewritten by the next reconcile run.
 
-Until this landed, `schedule-list` matched `:Event` alone while `schedule-event` wrote `:Meeting`, so an agent could not see its own writes: a calendar-sync turn read back an empty list, re-applied the same three meetings, and told the operator over WhatsApp that they had not saved. Observability is therefore two-part. Every list call logs `[schedule-list] op=result kind=<kind|any> meetings=<n> events=<n>`. The standing check is `[schedule-audit] account=<id> meetings=<n> listable=<n> invisible=<n>`, emitted per account on every `reconcile-bookings` run (every 120 s) **before** that script's Cloudflare gates, so it also reports on installs with no booking site. `listable` is what the real `scheduleList` returns, not a re-implementation of its query — that is the whole point, since a copy would agree with a broken original. `invisible=0` is the success signal; `invisible>0` means a calendar entry exists that the agent cannot see.
+A trashed meeting or event is excluded from `schedule-list`, `schedule-get`, `schedule-update` and `schedule-cancel`, on the reads and the writes alike. Before this, all four served deleted rows: on 2026-08-09 an agent was shown three copies of one appointment, two of which had been trashed on 28 July and 6 August with reasons naming the duplication, reported a de-duplication problem that had already been resolved twice, and wrote its correction to the copy trashed twelve days earlier.
+
+Until this landed, `schedule-list` matched `:Event` alone while `schedule-event` wrote `:Meeting`, so an agent could not see its own writes: a calendar-sync turn read back an empty list, re-applied the same three meetings, and told the operator over WhatsApp that they had not saved. Observability is therefore two-part. Every list call logs `[schedule-list] op=result kind=<kind|any> meetings=<n> events=<n>`. The standing check is `[schedule-audit] account=<id> meetings=<n> listable=<n> invisible=<n> unaddressable=<n>`, emitted per account on every `reconcile-bookings` run (every 120 s) **before** that script's Cloudflare gates, so it also reports on installs with no booking site. `listable` is what the real `scheduleList` returns, not a re-implementation of its query — that is the whole point, since a copy would agree with a broken original. `invisible=0` is the success signal; `invisible>0` means a calendar entry exists that the agent cannot see.
+
+`unaddressable` is the other half, and `invisible` is structurally blind to it: a row can be listed and still be untouchable, because a meeting's handle is its `uid` and `memory-write` wrote rows without one. Those came back with `eventId: null`, and `schedule-get`, `schedule-update` and `schedule-cancel` all resolve `MATCH (m:Meeting {uid: $id})`, which can never match a null. The install that raised this read `meetings=97 listable=97 invisible=0` throughout, with 37 rows unreachable. `unaddressable=0` is the success signal; above zero means a live calendar entry the agent can see and cannot act on. The count is taken from the graph rather than from the list result, because the list is precisely what cannot tell the two apart.
 
 ### Routine run records
 
@@ -344,6 +350,10 @@ Env: `PLATFORM_ROOT`, `NEO4J_URI` (and `NEO4J_PASSWORD` or `config/.neo4j-passwo
 
 Observability: one `[calendar-booking]` line per step keyed by `bookingId` (`reconcile-claim`, `meeting-write`, `notify`, `booked`), and one `[calendar-reconcile] account=… eligibleExamined=… pendingUnreconciled=… pendingOldestAgeMin=… orphanMeetings=…` audit line per account per run. `eligibleExamined` separates "nothing to do" from "verified clean". A `pendingUnreconciled` that persists across runs means those rows are failing to become meetings rather than merely lagging — the `attempt=` count on the claim and failure lines says how many times each has been tried. `orphanMeetings` means a booking meeting has no backing eligible D1 row. `pendingOldestAgeMin` ages that backlog: a count cannot separate a short lag from a nine-hour one. The companion `[calendar-reconcile] op=liveness lastRunAgeMin=… lastAuditAgeMin=… lastSkipReason=… stale=<bool>` line is emitted every ten minutes by the platform/ui server rather than by this script, because the failure it detects is this script not reporting at all. `op=liveness-write-failed` is the one case where that record could not be written; it carries the error body and never stops the run, because a run that worked must not be reported as failed for losing its own bookkeeping.
 
+`[calendar-availability] op=meeting-uid-stamp account=… scanned=… stamped=… skipped=… unhashable=… collided=… failed=…` is the handle repair, in the same loop and on the same terms: it matches untrashed `:Meeting` rows with no `uid` and stamps one, `mem-<hash of account, normalised title and start>`. It stamps only — it never merges and never deletes, because the uid a row would have had is hashed from the values passed at creation and `schedule-update` never rewrites it, so a recomputed uid cannot identify a row's original twin. A stamped row stops matching, so a steady install reads `scanned=0 stamped=0` and this too is a standing repair rather than a migration. The prefix is `mem-`, deliberately not `meetingUid`'s `sched-`, because `sched-` is `schedule-event`'s MERGE key and stamping it would let a later `schedule-event` write adopt one of these rows as its own.
+
+The four non-stamped counts are separate because each names a different thing to do. `stamped` is asserted from the uid the write returns, never from the call resolving: the apply carries `uid IS NULL`, so a row stamped by a concurrent tick matches nothing and still resolves, and counting that as stamped would report a write that never happened — it is `skipped`, and it is benign. `unhashable` is a row with no title or no start, which this repair can never fix; it is deliberately in the select rather than filtered out, because the audit counts it as `unaddressable` and a permanently red line with nothing naming its cause is how a warning stops being read. `collided` is the `meeting_account_uid_unique` constraint on `(accountId, uid)` rejecting the write, meaning two rows share an account, a title and a start and a human must decide which survives. `failed` is the write not landing and retries next tick. The select and the audit's `unaddressable` query scan byte-for-byte the same population, so the repair and the audit can never disagree about the total.
+
 Two further lines print per account on every tick whether or not anything is wrong. `[calendar-availability] op=meeting-retype account=… scanned=… repaired=… unparseable=… failed=…` is the timestamp type census: it matches `:Meeting` rows whose `startsAt` or `endsAt` is stored as a `STRING` and rebuilds each with `datetime()`. It answers "is anything in this calendar stored with the wrong type right now?" without reproducing the failure and without waiting for a customer to hit a bad slot. A repaired row stops matching, so a steady install reads `scanned=0 repaired=0` and this stays a standing repair rather than a migration to remove. A non-zero `repaired` on a steady install means something is still writing strings and names the account. The two failure counts are deliberately separate: `unparseable` is a value Neo4j's own parser rejects and needs a human, while `failed` is the write not landing (a timeout, a disconnect) and retries on the next tick. Neo4j's error code decides which, so a transient fault is never reported as a corrupt value. No JS pre-check stands in for that parser — `Date.parse` rejects the zone-id form `2026-07-29T13:30:00[Europe/London]` that `datetime()` accepts, and would report a repairable row as needing a human.
 
 `[calendar-availability] op=cal-drift account=… outcome=… published=… busyMeetings=… busyConnector=… busyUnusable=… conflicts=…` re-reads what was published and reconciles it against both labels the public free/busy page subtracts, `:Meeting` and `:ConnectorBusy`. It read `:ConnectorBusy` alone before this, so any meeting conflict was outside what it could measure, and it reported `outcome=verified conflicts=0` throughout an incident where five meetings were invisible. The census is split into named counts because one total cannot distinguish "3 connector intervals, no meetings" from "3 meetings, no connector" — the exact ambiguity that made `busy=3 conflicts=0` read as healthy. A meeting with no `endsAt` (nullable by schema) is given `start + durationMins`, the same substitution the free/busy route makes, rather than dropped; `busyUnusable` counts the rows that had no resolvable bound even so, because an interval excluded without a count is the silent drop this whole signal exists to remove. Read together the two lines discriminate three states: a conflict with `repaired=0` is a slot-math or publish fault, a conflict alongside `repaired>0` is corruption caught mid-repair, and `conflicts=0` with `busyMeetings>0` is evidence the meeting path was checked at all.

package/payload/platform/plugins/scheduling/mcp/dist/lib/__tests__/meeting-uid-stamp.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=meeting-uid-stamp.test.d.ts.map

package/payload/platform/plugins/scheduling/mcp/dist/lib/__tests__/meeting-uid-stamp.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"meeting-uid-stamp.test.d.ts","sourceRoot":"","sources":["../../../src/lib/__tests__/meeting-uid-stamp.test.ts"],"names":[],"mappings":""}

package/payload/platform/plugins/scheduling/mcp/dist/lib/__tests__/meeting-uid-stamp.test.js

@@ -0,0 +1,102 @@
+// Task 2613. memory-write created :Meeting rows with no uid. A meeting's only
+// handle is its uid, so schedule-list returned eventId:null for them and
+// schedule-get/update/cancel, which all resolve MATCH (m:Meeting {uid: $id}),
+// could never match. 37 untrashed rows on one install were unreachable.
+import { describe, it, expect } from "vitest";
+import { createHash } from "node:crypto";
+import { MEETING_UID_SELECT, MEETING_UID_APPLY, stampedUid, classifyStampError, } from "../booking-reconcile.js";
+import { meetingUid } from "../meeting-write.js";
+const ACC = "20028fb5-db26-4de7-bff6-c5ec2d4fc766";
+const TITLE = "Mind Circles Sip N' Learn";
+const START = "2026-08-11T19:00:00+01:00";
+describe("stampedUid", () => {
+    it("is deterministic", () => {
+        expect(stampedUid(ACC, TITLE, START)).toBe(stampedUid(ACC, TITLE, START));
+    });
+    it("normalises the title the same way meetingUid does", () => {
+        expect(stampedUid(ACC, "  mind circles sip n' learn  ", START)).toBe(stampedUid(ACC, TITLE, START));
+    });
+    it("carries the mem- prefix, not sched-", () => {
+        // sched- is schedule-event's MERGE key. Stamping that form would let a
+        // later schedule-event write adopt a memory-write row as its own.
+        const uid = stampedUid(ACC, TITLE, START);
+        expect(uid.startsWith("mem-")).toBe(true);
+        expect(uid).not.toBe(meetingUid(ACC, TITLE, START));
+    });
+    it("is a 32-char hash body", () => {
+        const expected = "mem-" +
+            createHash("sha256")
+                .update(`${ACC}|${TITLE.trim().toLowerCase()}|${START}`)
+                .digest("hex")
+                .slice(0, 32);
+        expect(stampedUid(ACC, TITLE, START)).toBe(expected);
+        expect(stampedUid(ACC, TITLE, START)).toHaveLength(36);
+    });
+    it("separates rows that differ only by start", () => {
+        expect(stampedUid(ACC, TITLE, "2026-08-11T20:00:00+01:00")).not.toBe(stampedUid(ACC, TITLE, START));
+    });
+});
+describe("the stamp Cypher", () => {
+    it("selects only untrashed meetings that have no uid", () => {
+        expect(MEETING_UID_SELECT).toContain("MATCH (m:Meeting {accountId: $accountId})");
+        expect(MEETING_UID_SELECT).toContain("m.uid IS NULL");
+        expect(MEETING_UID_SELECT).toContain(":Trashed");
+        expect(MEETING_UID_SELECT).toContain("deletedAt IS NULL");
+    });
+    it("selects the same population the audit counts, so the two cannot disagree", () => {
+        // A row with no title or no start cannot be hashed, but it IS unaddressable
+        // and the audit counts it. Filtering it out here would leave `unaddressable`
+        // permanently above zero with nothing naming the cause. The select takes the
+        // whole population and the caller counts what it cannot hash.
+        expect(MEETING_UID_SELECT).not.toContain("m.title IS NOT NULL");
+        expect(MEETING_UID_SELECT).not.toContain("m.startsAt IS NOT NULL");
+    });
+    it("returns the two hash inputs alongside the id", () => {
+        expect(MEETING_UID_SELECT).toContain("elementId(m) AS meetingId");
+        expect(MEETING_UID_SELECT).toContain("m.title AS title");
+        expect(MEETING_UID_SELECT).toContain("toString(m.startsAt) AS startsAt");
+    });
+    it("writes the uid and nothing else, and never deletes", () => {
+        expect(MEETING_UID_APPLY).toContain("SET m.uid = $uid");
+        expect(MEETING_UID_APPLY).not.toContain("DELETE");
+        expect(MEETING_UID_APPLY).not.toContain("REMOVE");
+    });
+    it("re-asserts the label, the account and the null-uid precondition on the write", () => {
+        // Account scope is a property; a write carrying none cannot enforce it. The
+        // null-uid guard makes the apply idempotent against a concurrent stamp.
+        expect(MEETING_UID_APPLY).toContain("MATCH (m:Meeting {accountId: $accountId})");
+        expect(MEETING_UID_APPLY).toContain("elementId(m) = $meetingId");
+        expect(MEETING_UID_APPLY).toContain("m.uid IS NULL");
+    });
+    it("returns the uid it wrote, so the caller can tell a write from a no-op", () => {
+        // The null-uid guard means a row stamped by a concurrent tick matches
+        // nothing and the run still resolves. Without this RETURN the caller counts
+        // it as stamped and the log reports work that never happened.
+        expect(MEETING_UID_APPLY).toContain("RETURN m.uid AS uid");
+    });
+});
+describe("classifyStampError", () => {
+    it("calls a uniqueness violation a collision, which needs a human", () => {
+        const err = Object.assign(new Error("Node already exists with label Meeting"), {
+            code: "Neo.ClientError.Schema.ConstraintValidationFailed",
+        });
+        expect(classifyStampError(err)).toBe("collided");
+    });
+    it("calls anything else a failed write, which retries next tick", () => {
+        const transient = Object.assign(new Error("Connection was closed"), {
+            code: "Neo.TransientError.General.DatabaseUnavailable",
+        });
+        expect(classifyStampError(transient)).toBe("failed");
+        expect(classifyStampError(new Error("socket hang up"))).toBe("failed");
+        expect(classifyStampError(null)).toBe("failed");
+    });
+    it("does not call every client error a collision", () => {
+        // Only the constraint code means "this uid is taken". Widening it would
+        // report a syntax error as a duplicate meeting.
+        const other = Object.assign(new Error("Invalid input"), {
+            code: "Neo.ClientError.Statement.ArgumentError",
+        });
+        expect(classifyStampError(other)).toBe("failed");
+    });
+});
+//# sourceMappingURL=meeting-uid-stamp.test.js.map

package/payload/platform/plugins/scheduling/mcp/dist/lib/__tests__/meeting-uid-stamp.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"meeting-uid-stamp.test.js","sourceRoot":"","sources":["../../../src/lib/__tests__/meeting-uid-stamp.test.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,yEAAyE;AACzE,8EAA8E;AAC9E,wEAAwE;AACxE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,UAAU,EACV,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjD,MAAM,GAAG,GAAG,sCAAsC,CAAC;AACnD,MAAM,KAAK,GAAG,2BAA2B,CAAC;AAC1C,MAAM,KAAK,GAAG,2BAA2B,CAAC;AAE1C,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,EAAE,CAAC,kBAAkB,EAAE,GAAG,EAAE;QAC1B,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,+BAA+B,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAClE,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAC9B,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,uEAAuE;QACvE,kEAAkE;QAClE,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAChC,MAAM,QAAQ,GACZ,MAAM;YACN,UAAU,CAAC,QAAQ,CAAC;iBACjB,MAAM,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,KAAK,EAAE,CAAC;iBACvD,MAAM,CAAC,KAAK,CAAC;iBACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClB,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrD,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,2BAA2B,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAClE,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAC9B,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,CAAC,kBAAkB,CAAC,CAAC,SAAS,CAAC,2CAA2C,CAAC,CAAC;QAClF,MAAM,CAAC,kBAAkB,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QACtD,MAAM,CAAC,kBAAkB,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACjD,MAAM,CAAC,kBAAkB,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,4EAA4E;QAC5E,6EAA6E;QAC7E,6EAA6E;QAC7E,8DAA8D;QAC9D,MAAM,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;QAChE,MAAM,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,kBAAkB,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;QAClE,MAAM,CAAC,kBAAkB,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACzD,MAAM,CAAC,kBAAkB,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,CAAC,iBAAiB,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACxD,MAAM,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8EAA8E,EAAE,GAAG,EAAE;QACtF,4EAA4E;QAC5E,wEAAwE;QACxE,MAAM,CAAC,iBAAiB,CAAC,CAAC,SAAS,CAAC,2CAA2C,CAAC,CAAC;QACjF,MAAM,CAAC,iBAAiB,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;QACjE,MAAM,CAAC,iBAAiB,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAC/E,sEAAsE;QACtE,4EAA4E;QAC5E,8DAA8D;QAC9D,MAAM,CAAC,iBAAiB,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,wCAAwC,CAAC,EAAE;YAC7E,IAAI,EAAE,mDAAmD;SAC1D,CAAC,CAAC;QACH,MAAM,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,EAAE;YAClE,IAAI,EAAE,gDAAgD;SACvD,CAAC,CAAC;QACH,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrD,MAAM,CAAC,kBAAkB,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvE,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,wEAAwE;QACxE,gDAAgD;QAChD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,eAAe,CAAC,EAAE;YACtD,IAAI,EAAE,yCAAyC;SAChD,CAAC,CAAC;QACH,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}