@rubytech/create-maxy 1.0.884 → 1.0.886

package/payload/platform/scripts/conversation-id-allowlist.txt

@@ -0,0 +1,151 @@
+.docs/agents.md
+.docs/conversation-archive.md
+.docs/deployment.md
+.docs/mcp-servers.md
+.docs/neo4j.md
+.docs/observability.md
+.docs/platform.md
+.docs/web-chat.md
+.docs/whatsapp.md
+platform/lib/graph-mcp/src/index.ts
+platform/lib/graph-trash/src/index.ts
+platform/lib/graph-write/src/__tests__/audit.test.ts
+platform/lib/graph-write/src/audit.ts
+platform/neo4j/schema.cypher
+platform/plugins/admin/PLUGIN.md
+platform/plugins/admin/hooks/__tests__/archive-ingest-surface-gate.test.sh
+platform/plugins/admin/mcp/src/index.ts
+platform/plugins/admin/skills/onboarding/SKILL.md
+platform/plugins/admin/skills/stream-log-review/SKILL.md
+platform/plugins/admin/skills/stream-log-review/references/analysis-patterns.md
+platform/plugins/business-assistant/references/profiling.md
+platform/plugins/contacts/mcp/src/index.ts
+platform/plugins/contacts/mcp/src/tools/contact-erase.ts
+platform/plugins/contacts/mcp/src/tools/contact-export.ts
+platform/plugins/contacts/mcp/src/tools/group-create.ts
+platform/plugins/contacts/mcp/src/tools/group-manage.ts
+platform/plugins/docs/references/admin-session.md
+platform/plugins/docs/references/contacts-guide.md
+platform/plugins/docs/references/internals.md
+platform/plugins/docs/references/platform.md
+platform/plugins/docs/references/plugins-guide.md
+platform/plugins/docs/references/troubleshooting.md
+platform/plugins/linkedin-import/skills/linkedin-import/SKILL.md
+platform/plugins/linkedin-import/skills/linkedin-import/references/connections.md
+platform/plugins/memory/bin/conversation-archive-ingest.mjs
+platform/plugins/memory/bin/conversation-archive-ingest.sh
+platform/plugins/memory/mcp/scripts/boot-smoke.sh
+platform/plugins/memory/mcp/scripts/graph/fixture.cypher
+platform/plugins/memory/mcp/src/index.ts
+platform/plugins/memory/mcp/src/lib/graph-prune.ts
+platform/plugins/memory/mcp/src/tools/conversation-archive-derive-insights.ts
+platform/plugins/memory/mcp/src/tools/conversation-archive-enrich-rejection.ts
+platform/plugins/memory/mcp/src/tools/conversation-memory-expunge.ts
+platform/plugins/memory/mcp/src/tools/memory-archive-write.ts
+platform/plugins/memory/mcp/src/tools/memory-find-candidates.ts
+platform/plugins/memory/mcp/src/tools/memory-ingest.ts
+platform/plugins/memory/mcp/src/tools/profile-update.ts
+platform/plugins/memory/references/graph-primitives.md
+platform/plugins/memory/references/schema-base.md
+platform/plugins/memory/skills/conversation-archive/SKILL.md
+platform/plugins/memory/skills/conversational-memory/SKILL.md
+platform/plugins/memory/skills/document-ingest/SKILL.md
+platform/plugins/scheduling/mcp/src/index.ts
+platform/plugins/tasks/.mcp.json
+platform/plugins/tasks/mcp/src/index.ts
+platform/plugins/tasks/mcp/src/tools/project-create.ts
+platform/plugins/tasks/mcp/src/tools/session-list.ts
+platform/plugins/waitlist/mcp/src/index.ts
+platform/plugins/waitlist/mcp/src/tools/__tests__/waitlist-persist.test.ts
+platform/plugins/waitlist/mcp/src/tools/waitlist-heal.ts
+platform/plugins/waitlist/mcp/src/tools/waitlist-list.ts
+platform/plugins/waitlist/mcp/src/tools/waitlist-persist.ts
+platform/plugins/waitlist/mcp/src/tools/waitlist-scan.ts
+platform/plugins/waitlist/mcp/src/tools/waitlist-setup.ts
+platform/plugins/whatsapp/PLUGIN.md
+platform/plugins/whatsapp/mcp/src/index.ts
+platform/plugins/workflows/mcp/src/index.ts
+platform/scripts/__tests__/admin-persist-audit.test.ts
+platform/scripts/admin-conversation-recover.mjs
+platform/scripts/admin-persist-audit.ts
+platform/scripts/check-no-conversation-id-leaks.mjs
+platform/scripts/check-sdk-oauth.mjs
+platform/scripts/component-knowledgedoc-backfill.ts
+platform/scripts/seed-neo4j.sh
+platform/templates/agents/admin/IDENTITY.md
+platform/templates/specialists/agents/database-operator.md
+platform/ui/__tests__/form-spawn-tailer.test.ts
+platform/ui/app/AdminModals.tsx
+platform/ui/app/ChatActionsMenu.tsx
+platform/ui/app/ChatFooter.tsx
+platform/ui/app/ConversationRowActions.tsx
+platform/ui/app/Sidebar.tsx
+platform/ui/app/__tests__/buildSessionLogsUrl.test.ts
+platform/ui/app/admin/components/CloudflareSetupForm.tsx
+platform/ui/app/graph/__tests__/display-helpers.test.ts
+platform/ui/app/graph/__tests__/zoom-tier-colour-stability.test.ts
+platform/ui/app/graph/display-helpers.ts
+platform/ui/app/lib/__tests__/admin-conversation-create.test.ts
+platform/ui/app/lib/__tests__/admin-persist-observability.test.ts
+platform/ui/app/lib/__tests__/claude-agent-loop-stop.test.ts
+platform/ui/app/lib/__tests__/conversation-deferred-persistence.test.ts
+platform/ui/app/lib/__tests__/ensure-conversation-handled-by.test.ts
+platform/ui/app/lib/__tests__/graph-trash-conversation-cascade.test.ts
+platform/ui/app/lib/__tests__/jsonl-replay.test.ts
+platform/ui/app/lib/__tests__/load-user-profile-sparse.test.ts
+platform/ui/app/lib/__tests__/neo4j-store-autolabel.test.ts
+platform/ui/app/lib/__tests__/neo4j-store-persist-message.test.ts
+platform/ui/app/lib/admin-sse-registry.ts
+platform/ui/app/lib/attachments.ts
+platform/ui/app/lib/claude-agent/admin-agent.ts
+platform/ui/app/lib/claude-agent/compaction.ts
+platform/ui/app/lib/claude-agent/dispatcher.ts
+platform/ui/app/lib/claude-agent/jsonl-replay.ts
+platform/ui/app/lib/claude-agent/logging.ts
+platform/ui/app/lib/claude-agent/memory-context.ts
+platform/ui/app/lib/claude-agent/public-agent.ts
+platform/ui/app/lib/claude-agent/session-store.ts
+platform/ui/app/lib/claude-agent/spawn-env.ts
+platform/ui/app/lib/claude-agent/stream-parser.ts
+platform/ui/app/lib/client-event.ts
+platform/ui/app/lib/cloudflare-setup-types.ts
+platform/ui/app/lib/cloudflare-task-tracker.ts
+platform/ui/app/lib/logs-read-resolve.ts
+platform/ui/app/lib/neo4j-store.ts
+platform/ui/app/lib/paths.ts
+platform/ui/app/lib/useConversationRename.ts
+platform/ui/app/lib/useLogsPopover.ts
+platform/ui/app/lib/vnc.ts
+platform/ui/app/lib/whatsapp/__tests__/ensure-conversation.test.ts
+platform/ui/app/lib/whatsapp/__tests__/persist-message.test.ts
+platform/ui/app/lib/whatsapp/ensure-conversation.ts
+platform/ui/app/lib/whatsapp/manager.ts
+platform/ui/app/lib/whatsapp/persist-message.ts
+platform/ui/app/page.tsx
+platform/ui/app/public/MessageList.tsx
+platform/ui/app/public/page.tsx
+platform/ui/app/public/types.ts
+platform/ui/app/public/useSession.ts
+platform/ui/app/useAdminAuth.ts
+platform/ui/app/useAdminChat.ts
+platform/ui/server/index.ts
+platform/ui/server/routes/__tests__/whatsapp-conversation-graph-state.test.ts
+platform/ui/server/routes/_helpers.ts
+platform/ui/server/routes/admin/__tests__/browser-iframe-route.test.ts
+platform/ui/server/routes/admin/__tests__/chat-stream-log-path.test.ts
+platform/ui/server/routes/admin/__tests__/cloudflare-tunnels-zero.test.ts
+platform/ui/server/routes/admin/__tests__/graph-search.test.ts
+platform/ui/server/routes/admin/__tests__/graph-subgraph.test.ts
+platform/ui/server/routes/admin/__tests__/logs.test.ts
+platform/ui/server/routes/admin/__tests__/sessions.test.ts
+platform/ui/server/routes/admin/browser-iframe.ts
+platform/ui/server/routes/admin/chat-failure.ts
+platform/ui/server/routes/admin/chat.ts
+platform/ui/server/routes/admin/cloudflare.ts
+platform/ui/server/routes/admin/graph-subgraph.ts
+platform/ui/server/routes/admin/logs.ts
+platform/ui/server/routes/admin/session.ts
+platform/ui/server/routes/admin/sessions.ts
+platform/ui/server/routes/group.ts
+platform/ui/server/routes/session.ts
+platform/ui/server/routes/whatsapp.ts

package/payload/platform/scripts/log-adherence-check.sh

@@ -0,0 +1,100 @@
+#!/usr/bin/env bash
+# log-adherence-check.sh — Task 1006 existence contract diagnostic.
+#
+# Reads every sessionKey under the active install's per-account logs and
+# asserts that a resolvable claude-agent-stream-<sessionKey>.log exists for
+# each. Runs hourly on-device in addition to the in-process timer wired
+# from platform/ui/app/lib/claude-agent/logging.ts; both are intentionally
+# redundant — one runs inside the server process, this one runs out of band
+# so a stalled server still leaves a fresh adherence record.
+#
+# Emits one `[log-tee] adherence-check window=24h sessions=N misses=M ts=...`
+# line to the platform server log on every run. Per-miss lines surface as
+# `[log-tee] missing-on-resolve sessionKey=<8> surface=adherence-script
+# reason=file-not-on-disk`. `misses=0` is the steady state.
+#
+# Exit codes:
+#   0  No misses (steady state).
+#   1  At least one miss recorded.
+#   2  Usage / environment error.
+set -euo pipefail
+
+# --- Resolve install dir, the same way logs-read.sh does. ---
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PLATFORM_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+INSTALL_DIR="$(dirname "$PLATFORM_ROOT")"
+INSTALL_DIR_NAME=$(basename "$INSTALL_DIR")
+CONFIG_DIR="$HOME/.$INSTALL_DIR_NAME"
+SERVER_LOG="$CONFIG_DIR/logs/server.log"
+
+ACCOUNTS_DIR="$INSTALL_DIR/data/accounts"
+if [[ ! -d "$ACCOUNTS_DIR" ]]; then
+  echo "[log-adherence-check] accounts directory missing: $ACCOUNTS_DIR" >&2
+  exit 2
+fi
+
+# Window: only count session keys whose stream-log file was modified in the
+# last 24h. This avoids fingerprinting long-archived sessions that have aged
+# out via the 7-day retention purge.
+WINDOW_HOURS=24
+
+# Collect every basename-derived sessionKey from claude-agent-stream-*.log
+# files across all account log directories, filtered to the active window.
+declare -a KEYS=()
+shopt -s nullglob
+for log_dir in "$ACCOUNTS_DIR"/*/logs; do
+  for f in "$log_dir"/claude-agent-stream-*.log; do
+    if [[ -f "$f" ]]; then
+      # find -mmin needs minutes; 24h = 1440 min.
+      if find "$f" -mmin "-$((WINDOW_HOURS * 60))" -print -quit | grep -q .; then
+        base=$(basename "$f")
+        key="${base#claude-agent-stream-}"
+        key="${key%.log}"
+        KEYS+=("$key")
+      fi
+    fi
+  done
+done
+shopt -u nullglob
+
+# De-duplicate sessionKeys (one session may emit multiple .log files via
+# sibling prefixes; the existence contract is per-sessionKey).
+declare -A SEEN=()
+declare -a UNIQUE=()
+for k in "${KEYS[@]:-}"; do
+  if [[ -z "${SEEN[$k]:-}" ]]; then
+    SEEN[$k]=1
+    UNIQUE+=("$k")
+  fi
+done
+
+SESSIONS=${#UNIQUE[@]}
+MISSES=0
+
+# For each sessionKey, verify the agent-stream file is present. Misses
+# surface as a missing-on-resolve line. The file we just listed must
+# exist by definition; this loop catches the case where a sessionKey was
+# referenced in tee/register emissions on server.log but the file itself
+# was unlinked between the scan and the check (very rare, but visible).
+TS=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+for k in "${UNIQUE[@]:-}"; do
+  found=0
+  for log_dir in "$ACCOUNTS_DIR"/*/logs; do
+    if [[ -f "$log_dir/claude-agent-stream-${k}.log" ]]; then
+      found=1
+      break
+    fi
+  done
+  if [[ $found -eq 0 ]]; then
+    MISSES=$((MISSES + 1))
+    echo "${TS} [log-tee] missing-on-resolve sessionKey=${k:0:8} surface=adherence-script reason=file-not-on-disk" >> "$SERVER_LOG" 2>/dev/null || true
+  fi
+done
+
+echo "${TS} [log-tee] adherence-check window=${WINDOW_HOURS}h sessions=${SESSIONS} misses=${MISSES} surface=script ts=${TS}" >> "$SERVER_LOG" 2>/dev/null || true
+echo "[log-adherence-check] sessions=${SESSIONS} misses=${MISSES} window=${WINDOW_HOURS}h"
+
+if [[ $MISSES -gt 0 ]]; then
+  exit 1
+fi
+exit 0

package/payload/platform/scripts/logs-read.sh

@@ -1,31 +1,30 @@
 #!/usr/bin/env bash
 # logs-read.sh — Shell counterpart to the logs-read MCP tool.
 #
-# Task 532: stream logs are per-conversation, not per-day. The primary mode
-# now reads a single {prefix}-{conversationId}.log file — the reader gets a
-# continuous, conversation-scoped timeline from first [spawn] to final
-# [process-exit] without needing to filter.
-#
-# Task 671: first-turn sessions (pre 1→2-user-turn flush per Task 650) land
-# at {prefix}preflush-{sessionKey:0:12}.log. The per-conversation mode
-# resolves either shape from the same identifier — full first, preflush as
-# fallback.
+# Task 1006: stream logs are per-session, not per-day or per-conversation.
+# The primary mode reads a single {prefix}-{sessionKey}.log file — the
+# operator types a sessionKey prefix and the surface returns the bytes from
+# first [spawn] to final [process-exit] without filtering. sessionKey is
+# the single identifier on disk; the earlier full vs preflush split is gone.
 #
 # Modes:
-#   logs-read.sh <conversationId> [type]       Read {prefix}-{convId}.log
-#   logs-read.sh --tail [type] [lines]         Tail most recent file of type
-#   logs-read.sh --grep <sessionKey> [type]    Legacy grep across log files
+#   logs-read.sh <sessionKey-or-prefix> [type]  Read {prefix}-{sessionKey}.log
+#   logs-read.sh --tail [type] [lines]          Tail most recent file of type
+#   logs-read.sh --grep <sessionKey> [type]     Legacy grep across log files
 #
-# Types: agent-stream (canonical, per-conversation tool-use/tool-result archive;
+# Types: agent-stream (canonical, per-session tool-use/tool-result archive;
 #        `system` is kept as a backwards-compatible alias), session, error,
 #        heartbeat, public, server, mcp, vnc
-# For per-conversation types (agent-stream/system/session/error/public): conversationId is
-# required in the first mode. For platform-scoped types (server/vnc/heartbeat):
-# conversationId is ignored.
+# For per-session types (agent-stream/system/session/error/public): sessionKey
+# is required in the first mode. For platform-scoped types (server/vnc/
+# heartbeat): the id is ignored.
 #
 # Every invocation writes a one-line trailer describing files searched,
 # matches returned, and files rejected — empty output never leaves a reader
-# guessing why.
+# guessing why. On a miss the script appends a one-line
+# `[log-tee] missing-on-resolve sessionKey=<8> surface=logs-read-sh
+# reason=...` entry to server.log so the writer-side existence contract is
+# the authoritative signal.
 #
 # Exit codes:
 #   0  Success (output produced)
@@ -122,16 +121,16 @@ VALID_TYPES="agent-stream, system, session, error, heartbeat, public, server, mc
 usage() {
   cat >&2 <<EOF
 Usage:
-  logs-read.sh <conversationId> [type]       Read {prefix}-{convId}.log
-  logs-read.sh --tail [type] [lines]         Tail most recent log of type
-  logs-read.sh --grep <sessionKey> [type]    Legacy grep across log files
+  logs-read.sh <sessionKey-or-prefix> [type]  Read {prefix}-{sessionKey}.log
+  logs-read.sh --tail [type] [lines]          Tail most recent log of type
+  logs-read.sh --grep <sessionKey> [type]     Legacy grep across log files
 
 Types: $VALID_TYPES
 Default type: agent-stream | Default lines: 50
 
-Per-conversation types (agent-stream, system, session, error, public) require conversationId
-in the first mode — the log file is named {prefix}-{conversationId}.log.
-Platform-scoped types (server, vnc, heartbeat) ignore conversationId.
+Per-session types (agent-stream, system, session, error, public) require
+sessionKey in the first mode — the log file is named {prefix}-{sessionKey}.log.
+Platform-scoped types (server, vnc, heartbeat) ignore the id.
 EOF
   exit 2
 }
@@ -144,65 +143,48 @@ validate_type() {
   esac
 }
 
-# --- Per-conversation mode: prefix-match {prefix}{convId-prefix}*.log ---
+# --- Per-session mode: prefix-match {prefix}{sessionKey-prefix}*.log ---
 #
-# Task 671 — two filename shapes the writer emits:
-#   FULL:     {prefix}{conversationId}.log      (post 1→2-user-turn flush)
-#   PREFLUSH: {prefix}preflush-{id:0:12}.log    (pre-flush, first turn; the
-#                                                 slice is of the sessionKey)
+# Task 1006 — one filename shape per session: {prefix}{sessionKey}.log.
+# The operator types an 8-char-or-greater sessionKey prefix; we glob
+# `${prefix}${session_key}*.log` across every account log dir. The earlier
+# full vs preflush two-shape contract is gone: sessionKey is the single
+# identifier on disk, mounted from turn 1.
 #
-# Task 998 — operator surface accepts any unambiguous prefix of the id.
-# The writer's filename is canonical (full 36-char UUID) but every agent
-# line surfaces the 8-char id (`conversationId=3483269d…`). Pass 1 and
-# Pass 2 each glob `${prefix}${conv_id}*.log` so an 8-char operator input
-# resolves a full-UUID file. Three trailer outcomes:
-#   single hit  → exit 0 + matched_shape=full|preflush  (existing success)
-#   zero hits   → exit 1 + reason=file-not-found-in-either-shape (existing miss)
+# Three trailer outcomes:
+#   single hit  → exit 0   (success)
+#   zero hits   → exit 1 + appends `[log-tee] missing-on-resolve sessionKey=<8>
+#                          surface=logs-read-sh reason=...` to server.log so
+#                          the writer-side existence contract is the
+#                          authoritative signal.
 #   2+ hits     → exit 1 + reason=ambiguous-prefix candidates=[...]; never picks
 #
-# Stale-preflush housekeeping (Task 671): on a single FULL hit, glob the
-# preflush pattern in the same dir and emit `[logs-read] stale-preflush-detected`
-# to server.log for each sibling. Best-effort — retrieval doesn't fail if
-# server.log is unwritable.
-#
-# Identity note: the preflush fallback exists for the abrupt-exit case where
-# the operator passes the sessionKey (no conversationId was ever assigned).
-# For post-flush retrievals the operator passes the conversationId (or any
-# unambiguous prefix of it) and the FULL file is expected to exist.
-#
-# MIRROR — intentional divergence (Task 998):
-#   - platform/ui/app/lib/logs-read-resolve.ts (canonical TS helper) —
-#     EXACT-MATCH on `${prefix}${conversationId}.log`.
-#   - platform/plugins/admin/mcp/src/index.ts (conversationId branch) —
-#     EXACT-MATCH, same shape.
-# Both serve agents that always hold the full conversationId. This shell
-# counterpart is the operator surface; operators read 8-char ids from agent
-# lines and type them at the SSH prompt. Do not "fix" the divergence by
-# adding prefix-match to TS/MCP — it would mask agent bugs that pass
-# partial ids.
+# MIRROR — keep these three sites in lockstep:
+#   - platform/ui/app/lib/logs-read-resolve.ts (TS helper, exact-match)
+#   - platform/plugins/admin/mcp/src/index.ts  (MCP tool, exact-match)
 per_conversation_mode() {
-  local conv_id="$1"
+  local session_key="$1"
   local filter_type="${2:-agent-stream}"
 
-  if [[ -z "$conv_id" ]]; then
-    echo "Error: conversationId cannot be empty" >&2
+  if [[ -z "$session_key" ]]; then
+    echo "Error: sessionKey cannot be empty" >&2
     exit 2
   fi
 
-  # Reject shell metacharacters in conv_id — the prefix-match glob below
-  # would otherwise turn user input into a shell pattern. UUIDs and
-  # sessionKeys only contain [a-zA-Z0-9-].
-  if [[ ! "$conv_id" =~ ^[a-zA-Z0-9-]+$ ]]; then
-    echo "Error: conversationId contains invalid characters (allowed: a-z, A-Z, 0-9, -)" >&2
+  # Reject shell metacharacters in session_key — the prefix-match glob below
+  # would otherwise turn user input into a shell pattern. SessionKeys only
+  # contain [a-zA-Z0-9-].
+  if [[ ! "$session_key" =~ ^[a-zA-Z0-9-]+$ ]]; then
+    echo "Error: sessionKey contains invalid characters (allowed: a-z, A-Z, 0-9, -)" >&2
     exit 2
   fi
 
   validate_type "$filter_type"
 
-  # Platform-scoped types shortcut to their fixed files regardless of convId.
+  # Platform-scoped types shortcut to their fixed files regardless of id.
   case "$filter_type" in
     server|vnc|heartbeat|mcp)
-      echo "# note: type=$filter_type is platform-scoped; conversationId ignored — showing fixed file" >&2
+      echo "# note: type=$filter_type is platform-scoped; sessionKey ignored — showing fixed file" >&2
       tail_mode "$filter_type" "50"
       return
       ;;
@@ -215,103 +197,51 @@ per_conversation_mode() {
     exit 2
   fi
 
-  # Glob patterns the two-shape contract expects (Task 998: prefix match).
-  local full_glob="${prefix}${conv_id}*.log"
-  local preflush_glob="${prefix}preflush-${conv_id:0:12}*.log"
-
+  local glob="${prefix}${session_key}*.log"
   local searched=0
-  local matched_shape=""
 
-  # Pass 1: FULL prefix glob across every log dir; aggregate hits.
-  local -a full_hits=()
-  local -a full_dirs=()
+  local -a hits=()
+  local -a hit_dirs=()
   shopt -s nullglob
   for log_dir in "${ACCOUNT_LOG_DIRS[@]}"; do
     searched=$((searched + 1))
-    for f in "$log_dir"/${prefix}${conv_id}*.log; do
-      full_hits+=("$f")
-      full_dirs+=("$log_dir")
+    for f in "$log_dir"/${prefix}${session_key}*.log; do
+      hits+=("$f")
+      hit_dirs+=("$log_dir")
     done
   done
   shopt -u nullglob
 
-  # Pass 1 ambiguous → refuse, never silently pick.
-  if [[ ${#full_hits[@]} -gt 1 ]]; then
+  if [[ ${#hits[@]} -gt 1 ]]; then
     local -a candidate_names=()
     local cf
-    for cf in "${full_hits[@]}"; do
+    for cf in "${hits[@]}"; do
       candidate_names+=("$(basename "$cf")")
     done
     local joined
     joined=$(IFS=','; printf '%s' "${candidate_names[*]}")
-    echo "-- trailer: conversationId=$conv_id type=$filter_type searched=$searched matches=${#full_hits[@]} reason=ambiguous-prefix candidates=[${joined}]" >&2
+    echo "-- trailer: sessionKey=$session_key type=$filter_type searched=$searched matches=${#hits[@]} reason=ambiguous-prefix candidates=[${joined}]" >&2
     exit 1
   fi
 
-  local found=0
-
-  # Pass 1 single hit → emit body, run stale-preflush detection in matched dir.
-  if [[ ${#full_hits[@]} -eq 1 ]]; then
-    local full_path="${full_hits[0]}"
-    local match_dir="${full_dirs[0]}"
-    echo "## $(basename "$full_path") ($filter_type)$(account_suffix "$match_dir")"
-    cat "$full_path"
-    found=1
-    matched_shape="full"
-
-    shopt -s nullglob
-    local stale_path
-    for stale_path in "$match_dir"/${prefix}preflush-${conv_id:0:12}*.log; do
-      local stale_ts
-      stale_ts="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
-      echo "${stale_ts} [logs-read] stale-preflush-detected path=${stale_path}" >> "$SERVER_LOG" 2>/dev/null || true
-    done
-    shopt -u nullglob
+  if [[ ${#hits[@]} -eq 1 ]]; then
+    local hit_path="${hits[0]}"
+    local match_dir="${hit_dirs[0]}"
+    echo "## $(basename "$hit_path") ($filter_type)$(account_suffix "$match_dir")"
+    cat "$hit_path"
+    echo "" >&2
+    echo "-- trailer: sessionKey=$session_key type=$filter_type searched=$searched matched=1" >&2
+    exit 0
   fi
 
-  # Pass 2: PREFLUSH prefix glob, only if Pass 1 had zero hits.
-  if [[ $found -eq 0 ]]; then
-    local -a preflush_hits=()
-    local -a preflush_dirs=()
-    shopt -s nullglob
-    for log_dir in "${ACCOUNT_LOG_DIRS[@]}"; do
-      searched=$((searched + 1))
-      for f in "$log_dir"/${prefix}preflush-${conv_id:0:12}*.log; do
-        preflush_hits+=("$f")
-        preflush_dirs+=("$log_dir")
-      done
-    done
-    shopt -u nullglob
-
-    if [[ ${#preflush_hits[@]} -gt 1 ]]; then
-      local -a candidate_names=()
-      local pf
-      for pf in "${preflush_hits[@]}"; do
-        candidate_names+=("$(basename "$pf")")
-      done
-      local joined
-      joined=$(IFS=','; printf '%s' "${candidate_names[*]}")
-      echo "-- trailer: conversationId=$conv_id type=$filter_type searched=$searched matches=${#preflush_hits[@]} reason=ambiguous-prefix candidates=[${joined}]" >&2
-      exit 1
-    fi
+  # Task 1006 — missing-on-resolve emission. Best-effort; never fails the
+  # invocation when server.log is unwritable.
+  local miss_ts
+  miss_ts="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+  echo "${miss_ts} [log-tee] missing-on-resolve sessionKey=${session_key:0:8} surface=logs-read-sh reason=\"file-not-found type=${filter_type}\"" >> "$SERVER_LOG" 2>/dev/null || true
 
-    if [[ ${#preflush_hits[@]} -eq 1 ]]; then
-      local preflush_path="${preflush_hits[0]}"
-      echo "## $(basename "$preflush_path") ($filter_type)$(account_suffix "${preflush_dirs[0]}")"
-      cat "$preflush_path"
-      found=1
-      matched_shape="preflush"
-    fi
-  fi
-
-  # Trailer: empty output never leaves the reader guessing why.
-  if [[ $found -eq 0 ]]; then
-    echo "-- trailer: conversationId=$conv_id type=$filter_type searched=$searched found=0 tried=[${full_glob}, ${preflush_glob}] reason=file-not-found-in-either-shape" >&2
-    exit 1
-  fi
-  echo "" >&2
-  echo "-- trailer: conversationId=$conv_id type=$filter_type searched=$searched matched=$found matched_shape=$matched_shape" >&2
-  exit 0
+  echo "-- trailer: sessionKey=$session_key type=$filter_type searched=$searched found=0 tried=[${glob}] reason=file-not-found" >&2
+  exit 1
 }
 
 # --- Legacy grep mode (backward compatibility with sessionKey-tagged lines) ---