@rubytech/create-realagent-code 0.1.573 → 0.1.575

package/payload/platform/plugins/dispatch/skills/dispatch-page/template/planner.js

@@ -0,0 +1,343 @@
+/* The office planner. Dependency-free, no bundler, the same shape as portal.js.
+
+   It draws worker rows against the days of one week from what /api/visits
+   returns. THAT ENDPOINT IS THE GATE. This page re-applies no filter of its
+   own: an own-scoped person already receives only their own rows and their own
+   roster row, and a second filter here would be a second thing to get wrong.
+
+   Nothing an operator can name is in this file. The nouns, the statuses and the
+   timezone all arrive in `meta`, published from the account's own config. */
+(function () {
+  'use strict';
+
+  function metaTag(name) {
+    var el = document.querySelector('meta[name="' + name + '"]');
+    return el ? el.getAttribute('content') || '' : '';
+  }
+
+  var API = metaTag('api-base');
+  var statusEl = document.getElementById('dp-status');
+  var loginEl = document.getElementById('dp-login');
+  var panelEl = document.getElementById('pl-panel');
+  var gridEl = document.getElementById('pl-grid');
+  var rangeEl = document.getElementById('pl-range');
+  var freshEl = document.getElementById('pl-freshness');
+  var unplaceableEl = document.getElementById('pl-unplaceable');
+
+  /* Monday of the week on screen, held as a UTC midnight. The two arrows move
+     it a week at a time and the seven day keys derive from it. */
+  var anchor = mondayOf(new Date());
+  /* The last payload read, so moving the week re-renders without a round trip
+     and a refused write can redraw what is actually on the device. */
+  var latest = null;
+
+  function say(msg) {
+    statusEl.textContent = msg;
+  }
+
+  function api(path, opts) {
+    return fetch(API + path, Object.assign({ credentials: 'same-origin' }, opts || {}));
+  }
+
+  function mondayOf(d) {
+    var u = new Date(Date.UTC(d.getUTCFullYear(), d.getUTCMonth(), d.getUTCDate()));
+    var back = (u.getUTCDay() + 6) % 7;
+    u.setUTCDate(u.getUTCDate() - back);
+    return u;
+  }
+
+  function ymd(d) {
+    return d.toISOString().slice(0, 10);
+  }
+
+  function dayKeys() {
+    var out = [];
+    for (var i = 0; i < 7; i++) {
+      var d = new Date(anchor.getTime());
+      d.setUTCDate(d.getUTCDate() + i);
+      out.push(ymd(d));
+    }
+    return out;
+  }
+
+  /* Which day an instant falls on IN THE ACCOUNT'S ZONE. en-CA formats
+     YYYY-MM-DD, so the result compares directly against dayKeys(). The zone is
+     always passed: a formatter built without one takes the browser's, and a
+     23:30 London visit then lands on tomorrow for somebody in Auckland. */
+  function dayOf(iso, zone) {
+    if (!iso) return '';
+    var t = new Date(iso);
+    if (isNaN(t.getTime())) return '';
+    return new Intl.DateTimeFormat('en-CA', {
+      timeZone: zone,
+      year: 'numeric',
+      month: '2-digit',
+      day: '2-digit',
+    }).format(t);
+  }
+
+  function timeOf(iso, zone) {
+    var t = new Date(iso);
+    if (isNaN(t.getTime())) return '';
+    return new Intl.DateTimeFormat('en-GB', {
+      timeZone: zone,
+      hour: '2-digit',
+      minute: '2-digit',
+    }).format(t);
+  }
+
+  function dayLabel(key, zone) {
+    return new Intl.DateTimeFormat('en-GB', {
+      timeZone: zone,
+      weekday: 'short',
+      day: 'numeric',
+      month: 'short',
+    }).format(new Date(key + 'T12:00:00.000Z'));
+  }
+
+  /* A config noun rendered as a heading. The retired grid printed the raw value
+     beside formatted day names, so one cell read lowercase and the rest did
+     not. */
+  function capitalise(word) {
+    if (!word) return '';
+    return word.charAt(0).toUpperCase() + word.slice(1);
+  }
+
+  function cell(cls, text) {
+    var el = document.createElement('div');
+    el.className = cls;
+    if (text !== undefined) el.textContent = text;
+    return el;
+  }
+
+  /* The keys working hours are declared under, Monday first, matching the
+     column order above. */
+  var HOUR_KEYS = ['mon', 'tue', 'wed', 'thu', 'fri', 'sat', 'sun'];
+
+  /* One visit. Clicking moves it to the next declared status and posts that
+     through the portal's existing write door. Which transitions are legal is
+     Task 2511's; this cycles the declared list. */
+  function visitButton(v, meta, zone) {
+    var b = document.createElement('button');
+    b.type = 'button';
+    b.className = 'pl-visit';
+    b.textContent = [timeOf(v.startDate, zone), v.status, v.purpose].filter(Boolean).join(' · ');
+    b.addEventListener('click', function () {
+      advance(v, meta);
+    });
+    return b;
+  }
+
+  function advance(v, meta) {
+    var names = ((meta && meta.statuses) || []).map(function (s) {
+      return s.name;
+    });
+    if (!names.length) {
+      say('No statuses are configured for this account.');
+      return;
+    }
+    var next = names[(names.indexOf(v.status) + 1) % names.length];
+    say('Saving…');
+    api('/api/visit-status', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ visitId: v.visitId, status: next }),
+    })
+      .then(function (r) {
+        return r.json().then(function (d) {
+          return { s: r.status, d: d };
+        });
+      })
+      .then(function (res) {
+        if (!res.d.ok) {
+          /* The endpoint answers the same 404 for "no such record" and "not
+             yours", deliberately, so this message says neither. */
+          console.error('[planner] status write refused', { status: res.s, error: res.d.error });
+          say(res.s === 404 ? 'That is not yours to change.' : 'That change was refused.');
+          return;
+        }
+        /* The graph is the authority and the device carries this there within a
+           minute. Showing it now and re-reading on the next poll is what makes
+           the page honest about which of the two it is displaying. */
+        v.status = next;
+        say('Saved. It reaches the office within a minute.');
+        if (latest) render(latest);
+      })
+      .catch(function (err) {
+        console.error('[planner] status write failed', { status: 'network', error: err });
+        say('Could not reach the server.');
+      });
+  }
+
+  function render(data) {
+    var meta = data.meta;
+    /* UTC when the account published no config. Never the browser's: a page
+       that guesses the zone draws a plausible week on the wrong days. */
+    var zone = (meta && meta.zone) || 'UTC';
+    var keys = dayKeys();
+
+    rangeEl.textContent = dayLabel(keys[0], zone) + ' – ' + dayLabel(keys[6], zone);
+    freshEl.textContent =
+      meta && meta.publishedAt ? 'As at ' + timeOf(meta.publishedAt, zone) : 'Never published';
+
+    gridEl.replaceChildren();
+    gridEl.appendChild(
+      cell('pl-corner', capitalise((meta && meta.vocabulary && meta.vocabulary.worker) || '')),
+    );
+    keys.forEach(function (k) {
+      gridEl.appendChild(cell('pl-colhead', dayLabel(k, zone)));
+    });
+
+    /* Visits group onto a row by ownerId, the key both halves of the exchange
+       already use. A visit whose owner matches no roster row gets its own row
+       rather than vanishing, and one with no start date is listed below the
+       grid: a dropped visit is invisible, and invisible is the failure this
+       surface exists to catch. */
+    var byOwner = {};
+    var unplaceable = [];
+    (data.visits || []).forEach(function (v) {
+      var key = dayOf(v.startDate, zone);
+      if (!key) {
+        unplaceable.push(v);
+        return;
+      }
+      if (keys.indexOf(key) === -1) return;
+      var owner = v.ownerId || '';
+      (byOwner[owner] = byOwner[owner] || []).push(v);
+    });
+
+    var rows = (data.roster || []).slice();
+    var known = {};
+    rows.forEach(function (w) {
+      known[w.ownerId] = true;
+    });
+    Object.keys(byOwner).forEach(function (owner) {
+      if (!known[owner]) rows.push({ workerId: '', ownerId: owner, name: '', workingHours: {} });
+    });
+
+    rows.forEach(function (w) {
+      var label = cell('pl-rowlabel', w.name || w.ownerId || 'Unassigned');
+      if (!w.workerId) label.setAttribute('data-unknown', 'true');
+      gridEl.appendChild(label);
+      keys.forEach(function (k, i) {
+        var c = cell('pl-cell');
+        c.setAttribute(
+          'data-off',
+          w.workingHours && w.workingHours[HOUR_KEYS[i]] ? 'false' : 'true',
+        );
+        (byOwner[w.ownerId] || [])
+          .filter(function (v) {
+            return dayOf(v.startDate, zone) === k;
+          })
+          .forEach(function (v) {
+            c.appendChild(visitButton(v, meta, zone));
+          });
+        gridEl.appendChild(c);
+      });
+    });
+
+    if (unplaceable.length) {
+      unplaceableEl.hidden = false;
+      unplaceableEl.textContent =
+        unplaceable.length +
+        ' with no date: ' +
+        unplaceable
+          .map(function (v) {
+            return v.visitId;
+          })
+          .join(', ');
+    } else {
+      unplaceableEl.hidden = true;
+      unplaceableEl.textContent = '';
+    }
+  }
+
+  function refresh() {
+    return api('/api/visits')
+      .then(function (r) {
+        if (r.status === 401) {
+          panelEl.hidden = true;
+          loginEl.hidden = false;
+          return null;
+        }
+        return r.json();
+      })
+      .then(function (d) {
+        if (!d || !d.ok) return;
+        latest = d;
+        loginEl.hidden = true;
+        panelEl.hidden = false;
+        render(d);
+      })
+      .catch(function (err) {
+        console.error('[planner] read failed', { error: err });
+        say('Could not reach the server.');
+      });
+  }
+
+  function authFailureMessage(status) {
+    if (status === 429) return 'Too many attempts. Try again later.';
+    if (status === 400) return 'Enter both your name and your passcode.';
+    if (status === 401) return 'That name and passcode did not match.';
+    return 'Something went wrong. Please try again in a moment.';
+  }
+
+  loginEl.addEventListener('submit', function (e) {
+    e.preventDefault();
+    say('Signing in…');
+    api('/api/auth', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({
+        ownerId: document.getElementById('dp-owner').value.trim(),
+        passcode: document.getElementById('dp-passcode').value,
+      }),
+    })
+      .then(function (r) {
+        return r.json().then(function (d) {
+          return { s: r.status, d: d };
+        });
+      })
+      .then(function (res) {
+        if (!res.d.ok) {
+          /* The server returns one denial for a wrong passcode and an unknown
+             person on purpose, so this message stays single. */
+          console.error('[planner] auth failed', { status: res.s, error: res.d.error });
+          say(authFailureMessage(res.s));
+          return;
+        }
+        document.getElementById('dp-passcode').value = '';
+        say('');
+        return refresh();
+      })
+      .catch(function (err) {
+        console.error('[planner] auth failed', { status: 'network', error: err });
+        say('Could not reach the server. Check your connection and try again.');
+      });
+  });
+
+  document.getElementById('pl-prev').addEventListener('click', function () {
+    anchor.setUTCDate(anchor.getUTCDate() - 7);
+    if (latest) render(latest);
+  });
+
+  document.getElementById('pl-next').addEventListener('click', function () {
+    anchor.setUTCDate(anchor.getUTCDate() + 7);
+    if (latest) render(latest);
+  });
+
+  /* Re-read at the cadence the device publishes at, so a change made on the
+     device appears without anybody clicking. Gated on visibility so a forgotten
+     tab costs nothing, and skipped while a read is in flight so a slow response
+     cannot stack requests. */
+  var polling = false;
+  setInterval(function () {
+    if (document.hidden || panelEl.hidden || polling) return;
+    polling = true;
+    refresh().then(function () {
+      polling = false;
+    });
+  }, 60000);
+
+  refresh();
+})();

package/payload/platform/plugins/dispatch/skills/dispatch-setup/SKILL.md

@@ -58,7 +58,12 @@ exists. Check with `dispatch-job-list` before removing any status, and say what
 
 ## What this skill does not do
 
-It creates no `:Site`, `:Customer`, `:Person:Engineer` or `:Vehicle` node. A `workerId` in the
-roster must have a matching `:Person:Engineer` on the account before `dispatch-allocate` will use
-it, created with `memory-update`. Say this at the end of setup rather than letting the first
-allocation discover it.
+It creates no `:Customer`, `:Person:Engineer` or `:Vehicle` node. A `workerId` in the roster must
+have a matching `:Person:Engineer` on the account before `dispatch-allocate` will use it, created
+with `memory-update`. Say this at the end of setup rather than letting the first allocation discover
+it.
+
+Sites are `dispatch-site-upsert`'s, not this skill's, and a site wants its street and postcode at
+the moment it is created. A site with only a name reaches the worker's card as a name, and he sets
+off without a street to drive to. The same tool adds an address to a site that already exists, so a
+gap found later is one call, not a re-creation.

package/payload/platform/plugins/docs/references/admin-ui.md

@@ -436,24 +436,43 @@ both `kind: 'specialist'` and differ only by origin.
   repair, and it is not what runs unattended: an agent runs only when something
   dispatches it, an inbound message is operator-initiated, so the only autonomous
   path is the scheduler. The modal says so and points at the routines instead.
-  **A file in the LIVE directory whose name also exists under
-  `<accountDir>/plugins/*/agents/` is excluded from this set.** `agent-builder`
-  copies the authored file into `specialists/agents/` because presence there is
-  what makes an agent dispatchable, so the live directory says nothing about who
-  wrote the agent and every activated user-created specialist used to render
-  twice, the second time as Shipped. The account plugin tree is the authorship
-  evidence and its row wins; it is the same discriminator `disable` requires.
-  Both gates read filenames off disk, so a plugin file whose frontmatter does not
-  parse still suppresses its live twin — it is authored either way, and
-  `specialistsSkipped` is what reports the parse failure. **The exclusion covers
-  both account directories, live and quarantine.** It was live-only while only a
-  shipped agent could be quarantined; now that an authored specialist can be
-  switched off, its specialist row carries the plugin, the skills, the detail
-  route and its own disabled state, so a second row from the shipped walk would
-  be a duplicate with none of that. The bundled templates are never deduped: a
-  bundled name is shipped by definition. Each exclusion logs
-  `op=list-shipped-dedup file=<name>` and the count rides `op=list` and the
-  response as `deduped`.
+  **A file in the LIVE or QUARANTINE directory whose name also exists under
+  `<accountDir>/plugins/*/agents/` is excluded from this set only when the two
+  files agree.** `agent-builder` copies the authored file into
+  `specialists/agents/` because presence there is what makes an agent
+  dispatchable, so the live directory says nothing about who wrote the agent and
+  every activated user-created specialist used to render twice, the second time
+  as Shipped. But the filename alone was also not evidence that the live file IS
+  that copy: `computeSpecialistDomains` builds the spawn manifest from the live
+  file, so an excluded row could describe an agent nobody would run, and a
+  premium agent — which reaches an account only through the live directory, since
+  the bundled templates carry no `--` name — lost its only row to an authored
+  file of the same name, its risk class replaced by that file's. **The test is
+  the three fields the card shows and the prompt reads: `name`, `description`,
+  and `tools` compared as a set.** Agreement means one row, exactly as before.
+  Disagreement means both rows render and `op=list-shipped-divergent` names both
+  files and the differing fields. Tools compare as a set rather than as the raw
+  line, because a reordered `tools:` declares the same surface and derives the
+  same class. The body is never compared: the card does not render the system
+  prompt, so a body-only edit does not make the row wrong. A read failure on
+  either side also keeps the row, because an unreadable file cannot be proven
+  equal to anything and keeping it hides nothing — but it is reported as a
+  compare failure, not as a divergence, since nothing was read to disagree. An
+  authored file that does not parse therefore no longer suppresses its live
+  twin. **That test answers a different
+  question to the write gates.** `disable` and `enable` still key on the filename
+  alone, because authorship is a property of the tree a file sits in, not of its
+  frontmatter, so the operator keeps the control on an agent of their own whose
+  frontmatter is broken. **The comparison covers both account directories, live
+  and quarantine.** It was live-only while only a shipped agent could be
+  quarantined; now that an authored specialist can be switched off, its
+  specialist row carries the plugin, the skills, the detail route and its own
+  disabled state, so a second row from the shipped walk would be a duplicate with
+  none of that. The bundled templates are never compared: a bundled name is
+  shipped by definition and has no authored twin to be a copy of. Each exclusion
+  logs `op=list-shipped-dedup file=<name>`; each kept pair logs
+  `op=list-shipped-divergent`. Both counts ride `op=list` and the response, as
+  `deduped` and `divergent`.
 
 The former "Public" flyout toggle in the account menu was removed; this page is
 the sole agent surface.
@@ -623,7 +642,7 @@ explicit `?plugin=` parameter, not inferred from `--` in the slug.
 
 | Route | Behaviour |
 |-------|-----------|
-| `GET /api/admin/agents` | Session-scoped. Lists the session account's public `agents/*/` dirs (never the `admin` agent), its user-created specialists from `plugins/*/agents/*.md`, and its shipped specialists, each row tagged `kind` and `origin` and carrying `risk`, `riskiestTool`, `riskRule`, `riskReason`, `unresolved` and `disabled`. A live-directory candidate whose filename also exists under `plugins/*/agents/` is dropped and counted, so an activated user-created agent is listed once. Returns `{agents, accountId, skipped, specialistsSkipped, shippedSkipped, deduped, riskSurfaceFailed}`. 401 when the session maps to no account. |
+| `GET /api/admin/agents` | Session-scoped. Lists the session account's public `agents/*/` dirs (never the `admin` agent), its user-created specialists from `plugins/*/agents/*.md`, and its shipped specialists, each row tagged `kind` and `origin` and carrying `risk`, `riskiestTool`, `riskRule`, `riskReason`, `unresolved` and `disabled`. A live-directory or quarantine-directory candidate whose filename also exists under `plugins/*/agents/` is dropped and counted only when the two files agree on `name`, `description` and the `tools` set, so an activated user-created agent is listed once and a divergent or colliding pair renders both rows. Returns `{agents, accountId, skipped, specialistsSkipped, shippedSkipped, deduped, divergent, riskSurfaceFailed}`. 401 when the session maps to no account. |
 | `GET /api/admin/agents/:slug` | Session-scoped. Without `?plugin=` or `?origin=`, returns a public agent's config fields + four owned docs + a `present` map (a missing or unreadable doc is `''`/`present.<role>=false`, never a 500). With `?plugin=`, that plugin's user-created specialist; with `?origin=shipped`, the shipped one. Both specialist shapes add `{risk, riskiestTool, riskRule, riskReason, unresolved, byTool, disabled}`, where `byTool` is one class per declared tool. Selection is explicit rather than inferred, because a premium file and a user-created specialist under a plugin of the same name produce the same slug. Unknown 404s, 401 as above. |
 | `POST /api/admin/agents/:slug/disable?accountId=` | Agents the operator authored only, enforced here rather than left to the UI: a slug NOT present under `plugins/*/agents/` 404s (`reason=not-user-created`), and the message names suspending the routines as what stops a shipped agent instead. An authored slug with no copy in `specialists/agents/` 409s (`reason=not-dispatchable`): it is already not dispatchable, so there is nothing to move and nothing to record. Otherwise it moves the file from `specialists/agents/` to `specialists/agents-disabled/` and returns `{ok, moved:true}` — the only outcome, since the two other cases refuse. It writes NO store entry: `agents-disabled.json` exists to stop provisioning re-delivering a withheld shipped file, and provisioning never writes the account plugin tree. Returns `routingReconciled`, false when either AGENTS.md pass threw; the move already happened and already stopped dispatch, so the request is not failed and the caller is told rather than left assuming the prose is right. Same `accountId` contract as delete. |
 | `POST /api/admin/agents/:slug/enable?accountId=` | Takes NO authorship check, and that asymmetry with disable is deliberate: an install that switched a shipped agent off under the old gate must still reach this route, or inverting the gate strands it. For an authored slug the quarantined file is the whole state — 404 when it is absent, `restored:true` when it moves back, and the store is never touched. For a shipped slug it covers both of the old disable's outcomes: a quarantined file moves back (`restored:true`), and a bundled-only agent has nothing to move so clearing the store entry is the whole job (`restored:false`), which is what stops provisioning withholding it. 404 only when neither the quarantine directory nor the store knows the slug. The store is read strictly first, because this is the read half of a read-modify-write that rewrites the file whole, and it is written back only when an entry was actually removed — so enabling never creates a store an account did not have. |
@@ -669,11 +688,13 @@ on** (`accountId=<id8>`) — a well-formed answer about the wrong account is
 otherwise indistinguishable from a correct one, which is exactly how an empty
 Agents page survived undiagnosed on a multi-account install.
 
-- `op=list accountId=<id8> agents=<n> specialists=<m> skipped=<x> specialistsSkipped=<y>`
-  — the heartbeat. Compare `accountId` against the account the operator is
-  viewing; `skipped>0`/`specialistsSkipped>0` is a malformed-source signal the
-  page renders as a banner, and `specialists=0` with user plugins present is the
-  broken-walk signature.
+- `op=list accountId=<id8> agents=<n> specialists=<m> shipped=<s> skipped=<x>
+  specialistsSkipped=<y> shippedSkipped=<z> deduped=<d> divergent=<v>` — the
+  heartbeat. Compare `accountId` against the account the operator is viewing;
+  `skipped>0`/`specialistsSkipped>0`/`shippedSkipped>0` is a malformed-source
+  signal the page renders as a banner, and `specialists=0` with user plugins
+  present is the broken-walk signature. `deduped` and `divergent` are described
+  under their own lines below.
 - `op=detail accountId=<id8> slug=<…> kind=<public|specialist>` — with
   `present=<comma-list|none>` on the public branch, where a role absent for an
   agent expected complete is the missing-doc signature. One
@@ -700,13 +721,32 @@ Agents page survived undiagnosed on a multi-account install.
 - `op=delete accountId=<id8> slug=<…> outcome=<ok|failed>` with
   `reason=<graph-cleanup-failed|rm-error>` on failure (files preserved on a
   graph-cleanup throw).
-- `op=list-shipped-dedup file=<name>` — one line per live-directory candidate
-  dropped as an authored duplicate, with `deduped=<n>` on the `op=list` line and
-  in the response. `shipped + shippedSkipped + deduped` equals the number of
-  distinct `.md` names across the three source directories, so a listing that
-  does not add up is visible without reproducing anything. The over-exclusion to
-  watch for is a `deduped` line naming a file that is also a bundled or premium
-  agent: the authored file then hides a genuinely shipped one.
+- `op=list-shipped-dedup file=<name>` — one line per live-directory or
+  quarantine-directory candidate dropped as an authored duplicate, with
+  `deduped=<n>` on the `op=list` line and in the response. `shipped +
+  shippedSkipped + deduped` equals the number of distinct `.md` names across the
+  three source directories, so a listing that does not add up is visible without
+  reproducing anything. The over-exclusion to watch for is a `deduped` line
+  naming a file that is also a bundled or premium agent: the authored file then
+  hides a genuinely shipped one, which now requires it to have reproduced that
+  agent's `name`, `description` and `tools` exactly.
+- `op=list-shipped-divergent file=<name> found=<path> authored=<path>
+  fields=<comma-list>` — one line per candidate KEPT because it does not match
+  the authored copy, naming both files and which of `name`, `description`,
+  `tools` differ. Without it a divergence emits nothing: both files parse and the
+  row renders green, so "the row is stale" is indistinguishable from "the agent
+  changed" without diffing the account tree by hand. `found=` rather than
+  `live=`, because the candidate may have come from the quarantine directory and
+  the path itself says which. `divergent=<n>` rides the `op=list` line and the
+  response. A kept candidate is parsed like any other, so it lands in `shipped`,
+  or in `shippedSkipped` when its own frontmatter carries no `name:` — either
+  way `divergent` is never a fourth term and the identity above is unchanged.
+- `op=list-shipped-compare-failed file=<name> side=<found|authored>
+  reason="<msg>"` — a frontmatter read threw during that comparison. The row is
+  kept, because an unreadable file proves nothing, but it is **not** counted in
+  `divergent`: "could not read one of them" and "the two disagree" are different
+  facts, and reporting the first as the second would put drift in the count that
+  nobody observed.
 - `[agents] op=risk account=<id8> slug=<name> origin=<shipped|public|specialist>
   class=<green|amber|red> rule=<id|none> riskiestTool=<tool> tools=<n>
   unresolved=<n> unresolvedTools=<comma-list|none> disabled=<bool>` — one line

package/payload/platform/plugins/docs/references/channel-wake-and-prompt.md

@@ -96,19 +96,11 @@ defect. Turns that answered no inbound — subagent side-chains, turns driven fr
 claude.ai — are deliberately outside that set: the credit guards are what keep
 them out of a customer's chat.
 
-Each door's `src/parity.test.ts` asserts the contract end to end against a real
-JSONL and the real follower.
-
-**Six discard sites, each now logged.** A follower outcome is dropped at:
-
-| File | Guard | `reason=` |
-|---|---|---|
-| `telegram-channel/src/server.ts:241` | `pendingTurns <= 0` | `no-credit` |
-| `webchat-channel/src/server.ts:378` | `pendingTurns <= 0` | `no-credit` |
-| `whatsapp-channel/src/server.ts:481` | `pendingTurns <= 0` | `no-credit` |
-| `whatsapp-channel/src/server.ts:489` | `consumedInbounds <= 0` | `no-consumed-inbound` |
-| `whatsapp-channel/src/server.ts:617` | `pendingTurns <= 0` (2nd follower) | `no-credit` |
-| `whatsapp-channel/src/server.ts:620` | `consumedInbounds <= 0` (2nd follower) | `no-consumed-inbound` |
+**Discard sites.** The WhatsApp and Telegram followers and their credit ledgers
+were removed, so those two doors now have none: one emitter reads the JSONL and
+the fan-out decides where an answer goes. Only webchat still carries credit
+guards, in `webchat-channel/src/server.ts`, and `src/parity.test.ts` survives
+for that door alone.
 
 ```
 [channel-fanout] op=fan-out reached=… notReached=… segments=… messageId=… sessionId=…
@@ -119,6 +111,30 @@ JSONL and the real follower.
 census prints every cycle, including when the counts agree: an absent line means
 the census stopped, never that delivery is healthy.
 
+## Which door an answer reaches
+
+The door the message arrived on, and no other. A question asked on WhatsApp is
+answered on WhatsApp; one asked on Telegram is answered on Telegram. The browser
+reader is not a door at all: it tails the session record the answer was taken
+from, so it shows the conversation without anything being sent to it.
+
+Answers used to also reach the person's other bound channel. That was removed:
+only the answer text travelled, never the question, so the second app showed a
+reply with nothing above it. The same conversation already follows you to
+another device through WhatsApp Web and Telegram Web, each for its own channel.
+
+The two lines that name a delivery failure:
+
+| Line | Means |
+|---|---|
+| `[channel-fanout] op=no-target origin=… reason=origin-not-live` | the door holds no live target for this key |
+| `[channel-fanout] op=no-target origin=telegram key=… accountId=none reason=no-account` | no account on this install owns the bot in that key |
+
+`[whatsapp-account-scope] op=non-uuid-account caller=fan-out` means the fan-out
+was handed a Baileys credential dirname where a platform UUID belongs. That is
+the defect that stranded a live admin answer, and the line exists so the next
+occurrence announces itself instead of being inferred from a silent miss.
+
 **Read them in `server.log`.** Both are emitted by the ui-server, which now owns
 the one emitter between the session JSONL and every channel. The per-door
 `op=turn-drop` and `op=census` lines that used to sit in