@rubytech/create-realagent-code 0.1.576 → 0.1.578

package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: platform-architecture
 description: Use when grounding any documented-surface claim about what Real Agent ships — plugins, skills, specialists, install/deploy flows, internals. This is the install catalogue, not evidence of what is enabled on the current account. For install state on this account, call `capabilities-here`; for documented surface, cite the `Source:` URL inline.
-content-hash: sha256:c2788a2fda2cab3890e93ca987a686c5115d06a836e1ebbc9da7782f3d827d34
+content-hash: sha256:3783bc8e36395aa87ab8e75dc385eaeae9bf826d201d552f5c97587f68149c05
 brand: realagent-code
 product-name: Real Agent
 ---
@@ -282,6 +282,8 @@ The sweep is the catch-net for `master-fd=close-failed` and any future regressio
 
 `openFdCount()` reads `/proc/self/fd` directly on Linux and returns `-1` on darwin (the dev-Mac path). The fd-leak audit on the laptop: `~/maxy-code/platform/scripts/logs-read.sh --tail server 400 | grep -E '\[fd-audit\]|op=archive-release'`. Full per-spawn lifeline: `grep -E '\[rc-spawn\]|\[pty-tracker\]'` filtered by `unitToken`.
 
+**Reader frame-strip census.** `~/maxy-code/platform/scripts/logs-read.sh --tail server 200 | grep -E '\[chat-reader\]|op=channel-unified'` pairs the per-account envelope-strip counts against the multi-door spawn count, which is the pairing the check needs: `op=frame-unstripped rows=0` is only a pass alongside `op=frame-census nested>0`, because a zero on its own cannot tell a healthy account from a census that stopped measuring. `op=frame-census accounts=0` says the pass measured nothing. `server.log` rotates on size, so `zgrep` the `.gz` siblings before concluding a window is absent. Mechanism, success and failure conditions in [`.docs/admin-webchat-native-channel.md`](../../../.docs/admin-webchat-native-channel.md).
+
 **WhatsApp inbound `/input` post-condition + sink-timestamp invariant.** An accepted `/input` returns `200` the moment the PTY write lands, but a `200` is not proof a turn submitted. The manager fires a bounded post-condition poll and logs `op=input-submitted … ackMs=…` (PTY went `busy` or a new JSONL user entry appeared) or `op=input-no-turn … ptyStatus=… lastJsonlEntryAgeMs=…` when the window elapses — so an accepted-but-unsubmitted input is visible in ≈8s, not only at the 300s turn-timeout. On timeout the bridge attributes the cause from the JSONL tail: `op=turn-timeout cause=no-turn` (no completed turn) vs `cause=relay-missed` (an assistant `end_turn` landed but the follower never relayed it); a per-sender `op=inbound-outcome relay-ok=N timeout-no-turn=N timeout-relay-missed=N` tally makes the failure rate one grep. **Sink-timestamp invariant:** every `server.log` line is stamped with a leading ISO timestamp at the stdout/stderr sink of the process that emits it — two sinks, one per process (UI: `server-init.cjs`; manager: `src/install-log-sink.ts`) — because both systemd units append to one `server.log` and `append:` bypasses journald. Never hand-inline a timestamp in a log call. Full lifeline, failure signatures, and diagnostic greps in [`.docs/whatsapp-inbound-lifeline.md`](../../../.docs/whatsapp-inbound-lifeline.md).
 
 **PTY lifecycle contract.** A PTY reaches its end via one of two branches: **operator-request** (operator clicks End or the auto-archive Stop hook calls `killSession`) or **natural-exit** (the claude child exits on its own — operator typed `/quit`, SIGINT in the PTY, crash, network drop on `--remote-control`). Both branches honour a single invariant: the pty master file descriptor is released by an explicit `pty.destroy()` and the in-process tracker entry is removed before the next `/list` or `/events` tick. The tracker is a module-scoped `Map<sessionId, PtyTracker>` in `pty-spawner.ts` — the metadata-rich `SessionStore` is gone; the tracker holds only what the file system cannot (PtyHandle + pid + bridge ids + runtime flags). Without the explicit destroy, the master fd lingers in node-pty's internal socket until V8 GC finalises the IPty object — non-deterministic and accumulates under load until the kernel pty cap (Linux 3072, macOS 511) refuses new spawns. Without the explicit row removal, the manager shutdown loop SIGTERMs PIDs that already logged `process-exited`, masking the leak only because the manager restarts every few hours. When both branches fire on the same exit (operator clicks End and node-pty's `onExit` fans out the SIGTERM to both listeners), a per-row `fdReleased` flag short-circuits the second branch so `pty.destroy()` runs exactly once on the live socket — without the flag, the second call throws "socket already destroyed" and the operator-request line would falsely log `master-fd=close-failed`. If the first branch's destroy throws and is rescued, the flag stays unset and the second branch retries (defense in depth). Every `kill … pid=<n>` log line carries a `master-fd=closed` suffix (or `master-fd=close-failed err=<msg>` on the rescued throw branch — a graceful degradation so a corner-case socket-state failure cannot turn a logically-successful exit into a 500); the operator-request line additionally identifies `reason=operator-request`, the natural-exit line identifies `reason=process-exited`. Both branches are verified by the `stop-session-fd-release` and `endpoint-stop-delete` integration tests (operator-request live and already-exited cycles + natural-exit cycle + throw-then-retry coordination, Linux kernel-level ptmx fd accounting on each).
@@ -6160,7 +6162,7 @@ Standing rules the operator gives over a channel are `Preference` nodes. Two mec
 
 **Reconcile by meaning on write (`profile-update`).** The existence check is two-tier. First an exact `(category, key)` match — the classic fast path, unchanged. When that misses, a semantic-neighbour lookup runs over the `preference_embedding` vector index, scoped to the same `accountId` and `scope:'admin'`, non-trashed. If the nearest neighbour is at or above `SAME_SUBJECT_COSINE` (0.85), the write lands on that node through the existing reinforce/update/contradict curve instead of minting a duplicate; the matched neighbours are returned in the tool result so the agent can classify future writes against real prior state. The confidence constants are unchanged — only the join key widens, so a rephrasing under a new `key` no longer forks the rule and a correction demotes the prior node rather than adding a contradictory one.
 
-**Inject the active rule-set every turn (channel gateways).** The one definition of "this account's active rules" is `@maxy/active-rules`: the account owner's admin-scope preferences (resolve the seeded `AdminUser {role:'owner'}`, then select through that owner's `UserProfile` via `HAS_PREFERENCE`), a floor-filtered (`confidence >= 0.4`), confidence-ordered query that returns every such preference verbatim — no cap, no de-confliction, no candidate limit. Concision is enforced at write time by the `conversational-memory` skill (each stored value is a single minimal imperative) and by the write-time semantic reconcile (a same-subject write at or above `SAME_SUBJECT_COSINE` folds into the existing node rather than minting a duplicate), so the injected block stays small because each stored preference is short and non-redundant, not because injection truncates. A preference owned by a non-owner profile (an operator's, stranded on the operator's own profile while managing the account) is never injected; an account with no seeded owner injects nothing. `profile-read` exposes this same owner-scoped set as `activeRules`, and the three inbound gateways (`wa-gateway`, `telegram-gateway`, `webchat-gateway`) fetch it for the effective session account and attach it as `standingRules` on the inbound frame; the channel builders prepend it as a `## Standing rules` block above `## Context`. Both channel-server inbound paths carry the block: the single-target SSE loop parses the whole frame, and the unified multi-target door reader (`runDoorStream`,) reconstructs it through the shared `doorInboundPayload` seam whose `parseFrame` closures read `standingRules` off the frame. The read is by code, not agent discretion, so a rule set last week is applied this week regardless of how many times the session compacted. Telegram and webchat inject for `role:'admin'` only — a public visitor never receives operator rules.
+**Inject the active rule-set every turn (channel gateways).** The one definition of "this account's active rules" is `@maxy/active-rules`: the account owner's admin-scope preferences (resolve the seeded `AdminUser {role:'owner'}`, then select through that owner's `UserProfile` via `HAS_PREFERENCE`), a floor-filtered (`confidence >= 0.4`), confidence-ordered query that returns every such preference verbatim — no cap, no de-confliction, no candidate limit. Concision is enforced at write time by the `conversational-memory` skill (each stored value is a single minimal imperative) and by the write-time semantic reconcile (a same-subject write at or above `SAME_SUBJECT_COSINE` folds into the existing node rather than minting a duplicate), so the injected block stays small because each stored preference is short and non-redundant, not because injection truncates. A preference owned by a non-owner profile (an operator's, stranded on the operator's own profile while managing the account) is never injected; an account with no seeded owner injects nothing. `profile-read` exposes this same owner-scoped set as `activeRules`, and the three inbound gateways (`wa-gateway`, `telegram-gateway`, `webchat-gateway`) fetch it for the effective session account and attach it as `standingRules` on the inbound frame; the channel builders prepend it as a `## Standing rules (account owner)` block above `## Context`, whose header and first line name the owner as the subject of the rules so a third-person rule about the owner is not read as a statement about the sender. Both channel-server inbound paths carry the block: the single-target SSE loop parses the whole frame, and the unified multi-target door reader (`runDoorStream`,) reconstructs it through the shared `doorInboundPayload` seam whose `parseFrame` closures read `standingRules` off the frame. The read is by code, not agent discretion, so a rule set last week is applied this week regardless of how many times the session compacted. Telegram and webchat inject for `role:'admin'` only — a public visitor never receives operator rules.
 
 **Trust a scheduled turn's provenance, never an inbound's claim (channel-agent grounding).** A cron-dispatched agent turn reaches the same channel builders as a real inbound, so its own authorisation text would otherwise land inside `## Context` — the zone `REFRAME_INSTRUCTION` demotes to untrusted — and a security-cautious agent would distrust its own automation (the self-cancel loop). The dispatcher therefore stamps a `ScheduleProvenance` marker (owning account, event, owner userId, dispatch time) that the channel builders render as a `## Scheduled automation (platform-verified)` preamble **above** `## Context` (and above the rules block); the whatsapp wrap tag names the door `scheduler`. Both channel-server paths carry the marker — the single-target loop and the unified multi-target door reader (via the same `doorInboundPayload` seam that carries `standingRules`); the scheduler only dispatches to the whatsapp/telegram door, so a webchat frame never bears one. Because the marker is dispatcher-stamped and never derived from payload text, an inbound message cannot forge it — placement above `## Context` alone is not the trust signal, the dispatcher provenance is. The grounding binds to it in two places: one recipient-neutral clause added byte-identical to the three reframe instructions (a marker-bearing turn is authorised standing automation; a reconfiguration or re-enable is not intrusion), and the admin `IDENTITY.md` "Untrusted input" rule that the agent never states a platform-level authenticity or impersonation verdict it was not given (an unsourced "this is not from you" is its own inference, flagged, never asserted as the platform's). A sender has exactly one session: every inbound, real or scheduled, resolves to the deterministic `adminSessionIdFor(effectiveAccount, destination)`. An earlier change gave each firing its own salted seat so distrust could not accrete across firings, but the inbound hub keys on `senderId` and replaces its subscriber outright, so a seat's channel server attached under the sender's own key and swallowed the sender's REAL messages until it detached — splitting one conversation across two sessions that each denied what the other held. The seat is removed; the authoritative `agentPrompt`, this provenance marker, and the injected standing rules ground each firing without one. Self-cancel attribution is disarmed while that model beds in: the guard used to compare the cancelling turn's session id to a dispatcher stamp, which discriminated only because each firing ran its own seat, so with one session per sender it would report an autonomous loop on every operator cancel. It now always reports false — under-counting a real loop rather than inventing one — until the discriminator is rebuilt from the turn's own dispatched eventId. See `.docs/scheduling-agent-dispatch.md § Operator-provenance marker`, `§ Session model — one session per sender`, and `§ Self-cancel attribution — disarmed`.
 

package/payload/platform/plugins/admin/skills/whats-new/SKILL.md

@@ -9,6 +9,23 @@ Invoked by the admin agent directly.
 
 This is the platform's release timeline, newest first. Each entry shows the date it shipped and the version it shipped in, so you can tell the operator how current their install is. To compare, read the installed version from `capabilities-here` and match it against the versions below. Keep answers high level and in plain English; this is a summary, not a full commit log.
 
+## 2026-08-08 (0.1.578)
+
+- Telegram conversations now appear on the dashboard. The composer shipped two releases ago had nothing to show, because the rows behind it were never written.
+- Telegram shows a typing indicator while the assistant is working, so a pause reads as thinking rather than silence.
+- A message no longer arrives wrapped in its own delivery envelope. The clean view was printing the whole composed frame instead of what was written.
+- Two phones on separate accounts no longer share one reader. Two conversations were being served by a single reader while the health check called that healthy.
+- The check that counts answered Telegram turns can now actually register one. It could never record an answer on a turn from you, so its count was always short.
+- The three conversion scripts left behind by the previous release are gone from the install. They were still being built and shipped with nothing able to run them.
+
+## 2026-08-08 (0.1.577)
+
+- Telegram messages keep arriving after a quiet spell. The reader that carries them was attached only when a conversation started, so it died once the conversation went quiet and nothing said so or restarted it. This is the same fault fixed for WhatsApp in the previous release; a standing check now covers Telegram too.
+- Telegram now says who is writing. A message carried no sender, so a second person messaging the same assistant was answered as though they were the account owner, under the owner's own standing instructions.
+- The standing instructions attached to a turn are now labelled as such, rather than appearing as unmarked text.
+- The planner can now change a day, not just show one. It could display an allocated day and offer no way to alter it.
+- A webhook address ending in a slash is no longer rejected. The guard that admits it tested the path differently from the router that serves it, so the two could disagree on the same address.
+
 ## 2026-08-08 (0.1.576)
 
 - Installing and upgrading no longer runs data conversions on your existing records. Five had accumulated, each added to repair a state that every install has long since passed, so all five did nothing but add work and risk to every upgrade. One of them stopped the install outright after reporting it had nothing to do. Any future conversion will be something you run deliberately, not part of an upgrade.

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-visit-status-write.test.ts

@@ -1,6 +1,8 @@
 import { describe, it, expect } from 'vitest'
 import {
   MAX_NOTE_LENGTH,
+  INSTANT_RE,
+  MAX_OWNER_ID_LENGTH,
   MAX_STATUS_LENGTH,
   WORK_DATE_RE,
   processVisitStatus,
@@ -14,6 +16,9 @@ interface Row {
   accountId: string
   ownerId: string
   visitId: string
+  /** The visit's CURRENT status, which the Task 2511 transition pre-read needs
+   *  to know what a move is moving from. */
+  status?: string
 }
 
 /**
@@ -23,7 +28,11 @@ interface Row {
  * `meta.changes` as the number of rows the SELECT admitted. A fake that always
  * reported one change would pass a handler with no gate at all.
  */
-function db(rows: Row[], person: { ownerId: string; recordScope: string; accountId: string }) {
+function db(
+  rows: Row[],
+  person: { ownerId: string; recordScope: string; accountId: string },
+  transitions: Array<[string, string]> | string = [],
+) {
   const inserted: unknown[][] = []
   const database = {
     prepare(sql: string) {
@@ -34,7 +43,25 @@ function db(rows: Row[], person: { ownerId: string; recordScope: string; account
           return stmt
         },
         async first<T>() {
-          return person as unknown as T
+          // Three reads now use first(): the session resolve, and the Task 2511
+          // pre-read of the visit's current status with the account's published
+          // transitions. Branching on the table is what keeps the fake honest
+          // about which one answered, and the pre-read APPLIES THE SAME TWO
+          // FILTERS the insert does, so a test that deletes the scope branch in
+          // the endpoint sees the pre-read stop matching too.
+          if (!sql.includes('FROM visits')) return person as unknown as T
+          const acct = bound[0] as string
+          const visitId = bound[bound.length - 1] as string
+          let admitted = rows.filter((r) => r.accountId === acct && r.visitId === visitId)
+          if (sql.includes('AND v.ownerId = ?')) {
+            admitted = admitted.filter((r) => r.ownerId === (bound[1] as string))
+          }
+          if (admitted.length === 0) return null as unknown as T
+          return {
+            status: admitted[0].status ?? '',
+            transitions:
+              typeof transitions === 'string' ? transitions : JSON.stringify(transitions),
+          } as unknown as T
         },
         async run() {
           if (!sql.startsWith('INSERT INTO visit_status')) return { meta: { changes: 0 } }
@@ -62,10 +89,25 @@ const env = (d: D1Database): PortalEnv =>
   ({ DB: d, BUCKET: {}, PORTAL_ACCOUNT_ID: 'acc-a' }) as unknown as PortalEnv
 
 const ROWS: Row[] = [
-  { accountId: 'acc-a', ownerId: 'alice', visitId: 'v1' },
-  { accountId: 'acc-a', ownerId: 'bob', visitId: 'v2' },
-  { accountId: 'acc-a', ownerId: '', visitId: 'v3' },
-  { accountId: 'acc-b', ownerId: 'alice', visitId: 'v4' },
+  { accountId: 'acc-a', ownerId: 'alice', visitId: 'v1', status: 'booked' },
+  { accountId: 'acc-a', ownerId: 'bob', visitId: 'v2', status: 'booked' },
+  { accountId: 'acc-a', ownerId: '', visitId: 'v3', status: 'booked' },
+  { accountId: 'acc-b', ownerId: 'alice', visitId: 'v4', status: 'booked' },
+]
+
+/**
+ * Every move the tests BELOW this line make, declared legal.
+ *
+ * Those tests measure the scope gate and the field gates, not the transition
+ * gate Task 2511 added. Without this list each of them would be refused as an
+ * illegal move and would stop measuring what it was written to measure. The
+ * transition gate has its own describe block at the end of this file, where the
+ * list is stated per test.
+ */
+const DECLARED: Array<[string, string]> = [
+  ['booked', 'on-site'],
+  ['booked', 'done'],
+  ['booked', 'on-site-at-granary-court'],
 ]
 
 const person = (ownerId: string, recordScope: string) => ({
@@ -78,7 +120,7 @@ const body = (visitId: string, status = 'on-site') => ({ visitId, status })
 
 describe('the visit-status write gate', () => {
   it('accepts an own-scoped person setting status on their own visit', async () => {
-    const { database, inserted } = db(ROWS, person('alice', 'own'))
+    const { database, inserted } = db(ROWS, person('alice', 'own'), DECLARED)
     const h = await processVisitStatus(body('v1'), 'sess', env(database), () => {}, 1)
     expect(h.status).toBe(200)
     expect(inserted).toHaveLength(1)
@@ -87,28 +129,28 @@ describe('the visit-status write gate', () => {
   it('refuses an own-scoped person setting status on someone else visit', async () => {
     // A read leak shows someone a day that is not theirs. A write leak lets
     // them change it, which is why the gate is the same one and is structural.
-    const { database, inserted } = db(ROWS, person('alice', 'own'))
+    const { database, inserted } = db(ROWS, person('alice', 'own'), DECLARED)
     const h = await processVisitStatus(body('v2'), 'sess', env(database), () => {}, 1)
     expect(h.status).toBe(404)
     expect(inserted).toEqual([])
   })
 
   it('refuses an own-scoped person setting status on an unbound visit', async () => {
-    const { database, inserted } = db(ROWS, person('alice', 'own'))
+    const { database, inserted } = db(ROWS, person('alice', 'own'), DECLARED)
     const h = await processVisitStatus(body('v3'), 'sess', env(database), () => {}, 1)
     expect(h.status).toBe(404)
     expect(inserted).toEqual([])
   })
 
   it('lets an account-scoped person set status on any visit for the account', async () => {
-    const { database, inserted } = db(ROWS, person('marie', 'account'))
+    const { database, inserted } = db(ROWS, person('marie', 'account'), DECLARED)
     const h = await processVisitStatus(body('v2'), 'sess', env(database), () => {}, 1)
     expect(h.status).toBe(200)
     expect(inserted).toHaveLength(1)
   })
 
   it('refuses another account visit even at account scope', async () => {
-    const { database, inserted } = db(ROWS, person('marie', 'account'))
+    const { database, inserted } = db(ROWS, person('marie', 'account'), DECLARED)
     const h = await processVisitStatus(body('v4'), 'sess', env(database), () => {}, 1)
     expect(h.status).toBe(404)
     expect(inserted).toEqual([])
@@ -123,7 +165,7 @@ describe('the visit-status write gate', () => {
   })
 
   it('refuses a body with no visitId or no status', async () => {
-    const { database, inserted } = db(ROWS, person('alice', 'own'))
+    const { database, inserted } = db(ROWS, person('alice', 'own'), DECLARED)
     const e = env(database)
     expect((await processVisitStatus({ status: 'x' }, 'sess', e, () => {}, 1)).status).toBe(400)
     expect((await processVisitStatus({ visitId: 'v1' }, 'sess', e, () => {}, 1)).status).toBe(400)
@@ -135,7 +177,7 @@ describe('the visit-status write gate', () => {
     // The value reaches :Visit.status through the pull. An unbounded free-text
     // field written from the open web is refused at the door, not truncated:
     // a truncated status is a different status, silently.
-    const { database, inserted } = db(ROWS, person('alice', 'own'))
+    const { database, inserted } = db(ROWS, person('alice', 'own'), DECLARED)
     const h = await processVisitStatus(
       body('v1', 'x'.repeat(MAX_STATUS_LENGTH + 1)),
       'sess',
@@ -148,7 +190,7 @@ describe('the visit-status write gate', () => {
   })
 
   it('stamps the setter own id, never one the request supplies', async () => {
-    const { database, inserted } = db(ROWS, person('alice', 'own'))
+    const { database, inserted } = db(ROWS, person('alice', 'own'), DECLARED)
     await processVisitStatus(
       { visitId: 'v1', status: 'on-site', ownerId: 'bob' },
       'sess',
@@ -162,7 +204,7 @@ describe('the visit-status write gate', () => {
 
   it('logs the scope and the outcome, and no status text', async () => {
     const lines: string[] = []
-    const { database } = db(ROWS, person('alice', 'own'))
+    const { database } = db(ROWS, person('alice', 'own'), DECLARED)
     await processVisitStatus(
       body('v1', 'on-site-at-granary-court'),
       'sess',
@@ -181,7 +223,7 @@ describe('the working day a status edit may carry', () => {
   const day = (extra: Record<string, unknown>) => ({ visitId: 'v1', status: 'done', ...extra })
 
   it('inserts the day, the date and the note when the claim is well formed', async () => {
-    const { database, inserted } = db(ROWS, person('alice', 'own'))
+    const { database, inserted } = db(ROWS, person('alice', 'own'), DECLARED)
     const h = await processVisitStatus(
       day({ dayHundredths: 100, workDate: '2026-08-05', workNote: 'second fix' }),
       'sess',
@@ -197,7 +239,7 @@ describe('the working day a status edit may carry', () => {
 
   it('defaults to no claim when the body carries no day', async () => {
     // A status-only edit is the common case and must stay a one-field write.
-    const { database, inserted } = db(ROWS, person('alice', 'own'))
+    const { database, inserted } = db(ROWS, person('alice', 'own'), DECLARED)
     const h = await processVisitStatus(day({}), 'sess', env(database), () => {}, 1)
     expect(h.status).toBe(200)
     expect(inserted[0]).toContain(0)
@@ -207,7 +249,7 @@ describe('the working day a status edit may carry', () => {
   it('refuses a day outside 0..100 rather than writing it into the graph', async () => {
     // A value above a full day is described by no shipped surface. Refused at
     // the door, exactly as an over-long status is.
-    const { database, inserted } = db(ROWS, person('alice', 'own'))
+    const { database, inserted } = db(ROWS, person('alice', 'own'), DECLARED)
     const e = env(database)
     for (const d of [101, -1, 50.5, '100']) {
       const h = await processVisitStatus(
@@ -225,7 +267,7 @@ describe('the working day a status edit may carry', () => {
   it('refuses a claim whose date is missing or malformed', async () => {
     // The date becomes part of the cost key. A claim the roll-up cannot date is
     // told to the person now, not left sitting in the queue.
-    const { database, inserted } = db(ROWS, person('alice', 'own'))
+    const { database, inserted } = db(ROWS, person('alice', 'own'), DECLARED)
     const e = env(database)
     for (const wd of [undefined, '', '5th Aug', '2026-8-5']) {
       const h = await processVisitStatus(
@@ -246,7 +288,7 @@ describe('the working day a status edit may carry', () => {
   })
 
   it('refuses a note longer than the cap rather than truncating it', async () => {
-    const { database, inserted } = db(ROWS, person('alice', 'own'))
+    const { database, inserted } = db(ROWS, person('alice', 'own'), DECLARED)
     const h = await processVisitStatus(
       day({
         dayHundredths: 100,
@@ -264,7 +306,7 @@ describe('the working day a status edit may carry', () => {
 
   it('logs whether the edit carried a day, and never the note', async () => {
     const lines: string[] = []
-    const { database } = db(ROWS, person('alice', 'own'))
+    const { database } = db(ROWS, person('alice', 'own'), DECLARED)
     await processVisitStatus(
       day({ dayHundredths: 100, workDate: '2026-08-05', workNote: 'granary court rewire' }),
       'sess',
@@ -280,7 +322,7 @@ describe('the working day a status edit may carry', () => {
 
   it('still refuses another person visit when the edit carries a day', async () => {
     // The gate is the SELECT and the new fields must not have moved it.
-    const { database, inserted } = db(ROWS, person('alice', 'own'))
+    const { database, inserted } = db(ROWS, person('alice', 'own'), DECLARED)
     const h = await processVisitStatus(
       { visitId: 'v2', status: 'done', dayHundredths: 100, workDate: '2026-08-05' },
       'sess',
@@ -292,3 +334,272 @@ describe('the working day a status edit may carry', () => {
     expect(inserted).toEqual([])
   })
 })
+
+describe('the move a status edit may carry (Task 2511)', () => {
+  const move = (extra: Record<string, unknown>) => ({ visitId: 'v1', status: 'on-site', ...extra })
+
+  it('inserts the new owner and the new start when both are well formed', async () => {
+    const { database, inserted } = db(ROWS, person('marie', 'account'), DECLARED)
+    const h = await processVisitStatus(
+      move({ assignedOwnerId: 'bob', startDate: '2026-08-10T09:00:00.000Z' }),
+      'sess',
+      env(database),
+      () => {},
+      1,
+    )
+    expect(h.status).toBe(200)
+    expect(inserted[0]).toContain('bob')
+    expect(inserted[0]).toContain('2026-08-10T09:00:00.000Z')
+  })
+
+  it('defaults both to empty when the body carries neither', async () => {
+    const { database, inserted } = db(ROWS, person('alice', 'own'), DECLARED)
+    const h = await processVisitStatus(move({}), 'sess', env(database), () => {}, 1)
+    expect(h.status).toBe(200)
+    // status, statusAt, workDate, workNote, assignedOwnerId, startDate: four of
+    // those six are empty on a status-only edit.
+    expect(inserted[0].filter((v) => v === '').length).toBeGreaterThanOrEqual(4)
+  })
+
+  it('refuses an offset-bearing, date-only or second-precision start rather than converting it', async () => {
+    // readCommitments compares stored start values LEXICALLY, so an
+    // offset-bearing row reads the wrong window and a real double-booking goes
+    // unreported. Refused at the door, never normalised here.
+    const { database, inserted } = db(ROWS, person('alice', 'own'), DECLARED)
+    const e = env(database)
+    for (const s of [
+      '2026-08-10T09:00:00+01:00',
+      '2026-08-10',
+      '2026-08-10T09:00:00Z',
+      '2026-08-10 09:00:00.000Z',
+      'soon',
+    ]) {
+      const h = await processVisitStatus(move({ startDate: s }), 'sess', e, () => {}, 1)
+      expect(h.status, `refuses ${s}`).toBe(400)
+    }
+    expect(inserted).toEqual([])
+  })
+
+  it('refuses an over-long assignedOwnerId rather than truncating it', async () => {
+    // A truncated id matches a different person, or nobody, silently.
+    const { database, inserted } = db(ROWS, person('alice', 'own'), DECLARED)
+    const h = await processVisitStatus(
+      move({ assignedOwnerId: 'x'.repeat(MAX_OWNER_ID_LENGTH + 1) }),
+      'sess',
+      env(database),
+      () => {},
+      1,
+    )
+    expect(h.status).toBe(400)
+    expect(inserted).toEqual([])
+  })
+
+  it('still refuses another person visit when the edit carries a move', async () => {
+    // The gate is the SELECT and the new fields must not have moved it.
+    const { database, inserted } = db(ROWS, person('alice', 'own'), DECLARED)
+    const h = await processVisitStatus(
+      { visitId: 'v2', status: 'on-site', assignedOwnerId: 'bob' },
+      'sess',
+      env(database),
+      () => {},
+      1,
+    )
+    expect(h.status).toBe(404)
+    expect(inserted).toEqual([])
+  })
+
+  it('accepts a start only in the shape the tree stores', () => {
+    expect(INSTANT_RE.test('2026-08-10T09:00:00.000Z')).toBe(true)
+    expect(INSTANT_RE.test('2026-08-10T09:00:00Z')).toBe(false)
+    expect(INSTANT_RE.test('2026-08-10')).toBe(false)
+  })
+
+  it('names the visit and the reason when it refuses a bad instant', async () => {
+    const lines: string[] = []
+    const { database } = db(ROWS, person('alice', 'own'), DECLARED)
+    await processVisitStatus(
+      move({ startDate: 'soon' }),
+      'sess',
+      env(database),
+      (l) => lines.push(l),
+      1,
+    )
+    expect(lines.join('\n')).toContain('op=rejected')
+    expect(lines.join('\n')).toContain('reason=bad-instant')
+    expect(lines.join('\n')).toContain('v1')
+  })
+})
+
+describe('the transition gate at the door (Task 2511)', () => {
+  it('accepts a move the account declared', async () => {
+    const { database, inserted } = db(ROWS, person('marie', 'account'), [['booked', 'on-site']])
+    const h = await processVisitStatus(
+      { visitId: 'v1', status: 'on-site' },
+      'sess',
+      env(database),
+      () => {},
+      1,
+    )
+    expect(h.status).toBe(200)
+    expect(inserted).toHaveLength(1)
+  })
+
+  it('refuses a move the account did not declare, and writes nothing', async () => {
+    // The refusal is here and not at the pull, which runs sixty seconds later
+    // with no screen to refuse to, and which sets the status unconditionally.
+    const { database, inserted } = db(ROWS, person('marie', 'account'), [['booked', 'on-site']])
+    const h = await processVisitStatus(
+      { visitId: 'v1', status: 'done' },
+      'sess',
+      env(database),
+      () => {},
+      1,
+    )
+    expect(h.status).toBe(400)
+    expect(h.payload).toEqual({ ok: false, error: 'illegal-transition' })
+    expect(inserted).toEqual([])
+  })
+
+  it('lets a re-time through when the status is unchanged', async () => {
+    // `[from, to]` declares a MOVE. A write whose status equals the current one
+    // is not a move, and no account declares a self-transition, so without this
+    // rule every pure re-timing would be refused.
+    const { database, inserted } = db(ROWS, person('marie', 'account'), [['booked', 'on-site']])
+    const h = await processVisitStatus(
+      { visitId: 'v1', status: 'booked', startDate: '2026-08-10T09:00:00.000Z' },
+      'sess',
+      env(database),
+      () => {},
+      1,
+    )
+    expect(h.status).toBe(200)
+    expect(inserted).toHaveLength(1)
+  })
+
+  it('refuses every move when the account published no transitions', async () => {
+    // An empty list means the account declared none, which refuses everything.
+    // That is visibly wrong on screen; accepting everything would leave the page
+    // enforcing nothing and looking identical to one that enforces correctly.
+    const { database, inserted } = db(ROWS, person('marie', 'account'), [])
+    const h = await processVisitStatus(
+      { visitId: 'v1', status: 'on-site' },
+      'sess',
+      env(database),
+      () => {},
+      1,
+    )
+    expect(h.status).toBe(400)
+    expect(inserted).toEqual([])
+  })
+
+  it('refuses every move when the published list is malformed', async () => {
+    const { database, inserted } = db(ROWS, person('marie', 'account'), 'not json')
+    const h = await processVisitStatus(
+      { visitId: 'v1', status: 'on-site' },
+      'sess',
+      env(database),
+      () => {},
+      1,
+    )
+    expect(h.status).toBe(400)
+    expect(inserted).toEqual([])
+  })
+
+  it('answers 404 for a visit the person may not see, before any transition check', async () => {
+    const { database, inserted } = db(ROWS, person('alice', 'own'), [['booked', 'on-site']])
+    const h = await processVisitStatus(
+      { visitId: 'v2', status: 'on-site' },
+      'sess',
+      env(database),
+      () => {},
+      1,
+    )
+    expect(h.status).toBe(404)
+    expect(inserted).toEqual([])
+  })
+
+  it('names the reason in the log, with the visit', async () => {
+    const lines: string[] = []
+    const { database } = db(ROWS, person('marie', 'account'), [['booked', 'on-site']])
+    await processVisitStatus(
+      { visitId: 'v1', status: 'done' },
+      'sess',
+      env(database),
+      (l) => lines.push(l),
+      1,
+    )
+    expect(lines.join('\n')).toContain('op=rejected')
+    expect(lines.join('\n')).toContain('reason=illegal-transition')
+    expect(lines.join('\n')).toContain('v1')
+  })
+
+  it('still never says whether the visit exists, on a 404', async () => {
+    // One answer for "no such visit" and "not yours". Distinguishing them would
+    // let anyone enumerate the account's visit ids.
+    const { database } = db(ROWS, person('alice', 'own'), [['booked', 'on-site']])
+    const missing = await processVisitStatus(
+      { visitId: 'nope', status: 'on-site' },
+      'sess',
+      env(database),
+      () => {},
+      1,
+    )
+    const theirs = await processVisitStatus(
+      { visitId: 'v2', status: 'on-site' },
+      'sess',
+      env(database),
+      () => {},
+      1,
+    )
+    expect(missing.payload).toEqual(theirs.payload)
+    expect(missing.status).toBe(theirs.status)
+  })
+})
+
+describe('a move and a labour claim are separate edits (Task 2511)', () => {
+  it('refuses a body carrying both, and writes nothing', async () => {
+    // The device applies a move in one statement that writes no cost, so a row
+    // carrying both would set the status, move the worker, be claimed, and drop
+    // the day the worker stated.
+    const { database, inserted } = db(ROWS, person('marie', 'account'), DECLARED)
+    const e = env(database)
+    for (const move of [{ assignedOwnerId: 'bob' }, { startDate: '2026-08-10T09:00:00.000Z' }]) {
+      const h = await processVisitStatus(
+        { visitId: 'v1', status: 'on-site', dayHundredths: 100, workDate: '2026-08-05', ...move },
+        'sess',
+        e,
+        () => {},
+        1,
+      )
+      expect(h.status).toBe(400)
+    }
+    expect(inserted).toEqual([])
+  })
+
+  it('still accepts each one on its own', async () => {
+    const { database, inserted } = db(ROWS, person('marie', 'account'), DECLARED)
+    const e = env(database)
+    const labour = await processVisitStatus(
+      { visitId: 'v1', status: 'done', dayHundredths: 100, workDate: '2026-08-05' },
+      'sess', e, () => {}, 1,
+    )
+    const move = await processVisitStatus(
+      { visitId: 'v1', status: 'on-site', assignedOwnerId: 'bob' },
+      'sess', e, () => {}, 1,
+    )
+    expect(labour.status).toBe(200)
+    expect(move.status).toBe(200)
+    expect(inserted).toHaveLength(2)
+  })
+
+  it('names the reason with the visit', async () => {
+    const lines: string[] = []
+    const { database } = db(ROWS, person('marie', 'account'), DECLARED)
+    await processVisitStatus(
+      { visitId: 'v1', status: 'on-site', dayHundredths: 100, workDate: '2026-08-05', assignedOwnerId: 'bob' },
+      'sess', env(database), (l) => lines.push(l), 1,
+    )
+    expect(lines.join('\n')).toContain('reason=move-with-labour')
+    expect(lines.join('\n')).toContain('v1')
+  })
+})