@rubytech/create-realagent-code 0.1.577 → 0.1.579

package/payload/server/server.js

@@ -471,6 +471,16 @@ var init_agent_errors = __esm({
 });
 
 // app/lib/reader/parse-transcript.ts
+function emptyEnvelopeCensus() {
+  return {
+    rows: 0,
+    wrapped: 0,
+    nested: 0,
+    stripped: 0,
+    unstripped: 0,
+    sources: { whatsapp: 0, webchat: 0, telegram: 0, none: 0 }
+  };
+}
 function isCompactSummaryRow(row, content) {
   return row.isCompactSummary === true || content !== null && content.startsWith(COMPACT_SUMMARY_PREFIX);
 }
@@ -481,10 +491,11 @@ function isScheduleSource(text) {
 }
 function unwrapChannel(text) {
   const m = text.match(CHANNEL_WRAPPER);
-  if (!m) return { text };
+  if (!m) return { text, wrapped: false, nested: false };
   let source = SOURCE_MAP[m[1].match(SOURCE_ATTR)?.[1] ?? ""];
   let inner = m[2];
   const im = inner.match(CHANNEL_WRAPPER);
+  const nested = im !== null;
   if (im) {
     const innerSource = SOURCE_MAP[im[1].match(SOURCE_ATTR)?.[1] ?? ""];
     if (innerSource) {
@@ -492,7 +503,7 @@ function unwrapChannel(text) {
       inner = im[2];
     }
   }
-  return source ? { text: inner, source } : { text: inner };
+  return source ? { text: inner, source, wrapped: true, nested } : { text: inner, wrapped: true, nested };
 }
 function splitReplyNote(payload) {
   const m = payload.match(REPLY_NOTE);
@@ -508,7 +519,17 @@ function uploadCountOf(text) {
   const n = Number(text.match(UPLOAD_COUNT)?.[1]);
   return Number.isInteger(n) && n > 0 ? n : void 0;
 }
-function operatorInboundTurn(u, ts, uuid) {
+function noteEnvelope(census, u) {
+  if (!census) return;
+  census.rows++;
+  if (u.wrapped) census.wrapped++;
+  if (u.nested) census.nested++;
+  if (u.text.startsWith("<channel ")) census.unstripped++;
+  else if (u.wrapped) census.stripped++;
+  census.sources[u.source ?? "none"]++;
+}
+function operatorInboundTurn(u, ts, uuid, census) {
+  noteEnvelope(census, u);
   const framed = rawFromComposedAdminFrame(u.text);
   const split = framed === void 0 ? void 0 : splitReplyNote(framed);
   const rawBody = split?.body;
@@ -635,12 +656,12 @@ function lastTurnTs(turns) {
 function isModelGated(turns) {
   return turns.some((t) => t.kind === "agent-error" && t.code === "model_unavailable");
 }
-function renderOrSuppressChannelInbound(u, ts, out, queuedPendingSuppress, uuid) {
+function renderOrSuppressChannelInbound(u, ts, out, queuedPendingSuppress, uuid, census) {
   const armed2 = queuedPendingSuppress.get(u.text) ?? 0;
   if (armed2 > 0) {
     queuedPendingSuppress.set(u.text, armed2 - 1);
   } else {
-    out.push(operatorInboundTurn(u, ts, uuid));
+    out.push(operatorInboundTurn(u, ts, uuid, census));
   }
 }
 function parseTranscript(lines, queuedPendingSuppress = /* @__PURE__ */ new Map(), turnCtx = {}) {
@@ -678,7 +699,7 @@ function parseTranscript(lines, queuedPendingSuppress = /* @__PURE__ */ new Map(
         const u = unwrapChannel(content);
         turnCtx.lastChannelSource = u.source;
         if (!isScheduleSource(content)) {
-          out.push(operatorInboundTurn(u, ts));
+          out.push(operatorInboundTurn(u, ts, void 0, turnCtx.envelopeCensus));
           queuedPendingSuppress.set(u.text, (queuedPendingSuppress.get(u.text) ?? 0) + 1);
         }
       }
@@ -691,7 +712,7 @@ function parseTranscript(lines, queuedPendingSuppress = /* @__PURE__ */ new Map(
         const u = unwrapChannel(att.prompt);
         turnCtx.lastChannelSource = u.source;
         if (!isScheduleSource(att.prompt)) {
-          renderOrSuppressChannelInbound(u, ts, out, queuedPendingSuppress, asString(row.uuid) ?? void 0);
+          renderOrSuppressChannelInbound(u, ts, out, queuedPendingSuppress, asString(row.uuid) ?? void 0, turnCtx.envelopeCensus);
         }
       }
       continue;
@@ -720,7 +741,7 @@ function parseTranscript(lines, queuedPendingSuppress = /* @__PURE__ */ new Map(
       const u = unwrapChannel(text);
       turnCtx.lastChannelSource = u.source;
       if (!isScheduleSource(text)) {
-        renderOrSuppressChannelInbound(u, ts, out, queuedPendingSuppress, asString(row.uuid) ?? void 0);
+        renderOrSuppressChannelInbound(u, ts, out, queuedPendingSuppress, asString(row.uuid) ?? void 0, turnCtx.envelopeCensus);
       }
     } else if (row.isMeta === true) {
       out.push({ kind: "harness-internal", text, ts });
@@ -747,7 +768,7 @@ var init_parse_transcript = __esm({
     HARNESS_LIFECYCLE_PREFIXES = ["<task-notification>"];
     CC_IMAGE_VISION_HINT = /^\[Image:[^\]]*Multiply coordinates by [\d.]+ to map to original image\.\]$/;
     COMPACT_SUMMARY_PREFIX = "This session is being continued from a previous conversation that ran out of context.";
-    CHANNEL_WRAPPER = /^<channel\b([^>]*)>\n?([\s\S]*?)\n?<\/channel>$/;
+    CHANNEL_WRAPPER = /^<channel\b([^>]*)>\n?([\s\S]*?)\n?<\\?\/channel>$/;
     SOURCE_ATTR = /\bsource="([^"]+)"/;
     SOURCE_MAP = {
       whatsapp: "whatsapp",
@@ -815,7 +836,7 @@ var init_audio_mime = __esm({
 // app/lib/stt/voice-note.ts
 import { writeFile, mkdtemp, rm } from "fs/promises";
 import { tmpdir as tmpdir2 } from "os";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 async function transcribeVoiceNote(file, source) {
   const startMs = Date.now();
   const bytes = file.size;
@@ -826,9 +847,9 @@ async function transcribeVoiceNote(file, source) {
   let tempDir;
   let tempPath;
   try {
-    tempDir = await mkdtemp(join6(tmpdir2(), "voice-"));
+    tempDir = await mkdtemp(join7(tmpdir2(), "voice-"));
     const ext = audioExtension(mimeType);
-    tempPath = join6(tempDir, `recording${ext}`);
+    tempPath = join7(tempDir, `recording${ext}`);
     const buffer = Buffer.from(await file.arrayBuffer());
     await writeFile(tempPath, buffer);
   } catch (err) {
@@ -1239,10 +1260,56 @@ function buildStoreConversationRows(accountId, summaries, chatMeta) {
   }
   return rows.sort((a, b) => (b.lastMessageAt ?? "").localeCompare(a.lastMessageAt ?? ""));
 }
+function buildTelegramStoreConversationRows(accountId, summaries) {
+  const rows = [];
+  for (const [channelKey, { first, last }] of summaries) {
+    rows.push({
+      sessionId: "",
+      projectDir: "",
+      title: channelKey,
+      senderId: last.senderId,
+      startedAt: first.dateSent,
+      channel: "telegram",
+      role: last.scope === "admin" ? "admin" : "public",
+      operatorName: null,
+      whatsappName: null,
+      // The name is what it is NOW, matching how `scope` is taken from `last`.
+      // The fallback covers an outbound last record: the outbound write points
+      // have no sender to name, so they store null.
+      telegramName: last.senderName ?? first.senderName ?? null,
+      lastMessageAt: last.dateSent,
+      modelGated: false,
+      model: null,
+      source: "store",
+      accountId,
+      channelKey,
+      scope: last.scope,
+      preview: last.body
+    });
+  }
+  return rows.sort((a, b) => (b.lastMessageAt ?? "").localeCompare(a.lastMessageAt ?? ""));
+}
+function dropTelegramSessionDuplicates(rows, telegramStoreRows) {
+  const coveredKeys = /* @__PURE__ */ new Set();
+  const coveredSenders = /* @__PURE__ */ new Set();
+  for (const r of telegramStoreRows) {
+    const parsed = r.channelKey ? parseTelegramChannelKey(r.channelKey) : null;
+    if (!parsed) continue;
+    coveredKeys.add(r.channelKey);
+    coveredSenders.add(parsed.senderId);
+  }
+  if (coveredKeys.size === 0) return rows;
+  return rows.filter((r) => {
+    if (r.source !== "session" || r.channel !== "telegram" || r.senderId == null) return true;
+    const parsed = parseTelegramChannelKey(r.senderId);
+    return parsed ? !coveredKeys.has(r.senderId) : !coveredSenders.has(r.senderId);
+  });
+}
 var init_select_sessions = __esm({
   "app/lib/reader/select-sessions.ts"() {
     "use strict";
     init_normalize();
+    init_channel_key();
     init_conversation_preview();
   }
 });
@@ -5450,19 +5517,196 @@ var require_dist7 = __commonJS({
 
 // server/index.ts
 init_dist();
-import { readFileSync as readFileSync56, existsSync as existsSync56, watchFile, readdirSync as readdirSync32, statSync as statSync30 } from "fs";
+import { readFileSync as readFileSync57, existsSync as existsSync56, watchFile, readdirSync as readdirSync33, statSync as statSync30 } from "fs";
 import { spawn as spawn3 } from "child_process";
 import { createHash as createHash8 } from "crypto";
-import { resolve as resolve51, join as join64, basename as basename17 } from "path";
-import { homedir as homedir5 } from "os";
+import { resolve as resolve51, join as join65, basename as basename17 } from "path";
+import { homedir as homedir6 } from "os";
 
 // server/lib/route-cache-watchers.ts
 init_route_cache();
 init_account();
 init_message_store();
-init_src2();
 import { watch } from "fs";
-import { resolve } from "path";
+import { resolve as resolve2 } from "path";
+
+// app/lib/telegram/message-store.ts
+import { existsSync, mkdirSync, readFileSync, appendFileSync, readdirSync, statSync } from "fs";
+import { homedir } from "os";
+import { dirname, join, resolve } from "path";
+function configDirName() {
+  const platformRoot5 = process.env.MAXY_PLATFORM_ROOT ?? resolve(process.cwd(), "..");
+  const brandPath = join(platformRoot5, "config", "brand.json");
+  if (existsSync(brandPath)) {
+    try {
+      return JSON.parse(readFileSync(brandPath, "utf-8")).configDir ?? ".maxy";
+    } catch {
+    }
+  }
+  return ".maxy";
+}
+var STORE_ROOT2 = () => join(process.env.MAXY_DIR_OVERRIDE ?? resolve(homedir(), configDirName()), "data", "telegram-messages");
+function isStorableChannelKey(channelKey) {
+  return /^-?\d+:-?\d+$/.test(channelKey);
+}
+function channelKeyToFileStem(channelKey) {
+  if (!isStorableChannelKey(channelKey)) {
+    throw new Error(`telegram-message-store: refusing unstorable channelKey ${JSON.stringify(channelKey)}`);
+  }
+  return channelKey.replace(":", "_");
+}
+function fileStemToChannelKey(stem) {
+  const i = stem.indexOf("_");
+  return i <= 0 ? stem : `${stem.slice(0, i)}:${stem.slice(i + 1)}`;
+}
+function conversationFile(accountId, channelKey) {
+  return join(STORE_ROOT2(), accountId, `${channelKeyToFileStem(channelKey)}.jsonl`);
+}
+function conversationFilePath2(accountId, channelKey) {
+  return conversationFile(accountId, channelKey);
+}
+function isStorableStem(stem) {
+  return isStorableChannelKey(fileStemToChannelKey(stem));
+}
+function listStoredAccountIds2() {
+  const root = STORE_ROOT2();
+  if (!existsSync(root)) return [];
+  return readdirSync(root).filter((name) => {
+    try {
+      return statSync(join(root, name)).isDirectory();
+    } catch {
+      return false;
+    }
+  });
+}
+function parseLines(raw) {
+  const out = [];
+  for (const line of raw.split("\n")) {
+    if (!line.trim()) continue;
+    try {
+      out.push(JSON.parse(line));
+    } catch {
+      console.error(`[telegram-message-store] skip reason=corrupt-line`);
+    }
+  }
+  return out;
+}
+var byDateSentAsc = (a, b) => a.dateSent.localeCompare(b.dateSent);
+function appendMessage2(accountId, record) {
+  if (!isStorableChannelKey(record.channelKey)) {
+    console.error(
+      `[telegram-message-store] FAIL op=append reason=unstorable-channel-key messageId=${record.messageId}`
+    );
+    return { created: false };
+  }
+  const file = conversationFile(accountId, record.channelKey);
+  try {
+    mkdirSync(dirname(file), { recursive: true });
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    console.error(
+      `[telegram-message-store] FAIL op=append reason=${reason.slice(0, 100)} messageId=${record.messageId}`
+    );
+    return { created: false };
+  }
+  try {
+    if (existsSync(file)) {
+      const existing = parseLines(readFileSync(file, "utf8"));
+      if (existing.some((r) => r.messageId === record.messageId)) {
+        console.error(
+          `[telegram-message-store] op=append channelKey=${record.channelKey} origin=${record.origin} created=false`
+        );
+        return { created: false };
+      }
+    }
+    appendFileSync(file, `${JSON.stringify(record)}
+`);
+    console.error(
+      `[telegram-message-store] op=append channelKey=${record.channelKey} origin=${record.origin} created=true`
+    );
+    return { created: true };
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    console.error(
+      `[telegram-message-store] FAIL op=append reason=${reason.slice(0, 100)} messageId=${record.messageId}`
+    );
+    return { created: false };
+  }
+}
+function readConversation2(accountId, channelKey) {
+  if (!isStorableChannelKey(channelKey)) return [];
+  const file = conversationFile(accountId, channelKey);
+  try {
+    if (!existsSync(file)) return [];
+    return parseLines(readFileSync(file, "utf8")).sort(byDateSentAsc);
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    console.error(
+      `[telegram-message-store] FAIL op=read reason=${reason.slice(0, 100)} channelKey=${channelKey}`
+    );
+    return [];
+  }
+}
+var summaryCache = /* @__PURE__ */ new Map();
+function summariseRecords(records2) {
+  if (records2.length === 0) return null;
+  const sorted = records2.slice().sort(byDateSentAsc);
+  return { first: sorted[0], last: sorted[sorted.length - 1] };
+}
+function readConversationSummaries2(accountId) {
+  const dir = join(STORE_ROOT2(), accountId);
+  const out = /* @__PURE__ */ new Map();
+  const seen = /* @__PURE__ */ new Set();
+  try {
+    if (!existsSync(dir)) return out;
+    for (const entry2 of readdirSync(dir)) {
+      if (!entry2.endsWith(".jsonl")) continue;
+      const stem = entry2.slice(0, -".jsonl".length);
+      if (!isStorableStem(stem)) continue;
+      const channelKey = fileStemToChannelKey(stem);
+      const file = join(dir, entry2);
+      seen.add(file);
+      let size;
+      let mtimeMs;
+      try {
+        const st = statSync(file);
+        size = st.size;
+        mtimeMs = st.mtimeMs;
+      } catch {
+        continue;
+      }
+      const cached3 = summaryCache.get(file);
+      if (cached3 && cached3.size === size && cached3.mtimeMs === mtimeMs) {
+        out.set(channelKey, cached3.summary);
+        continue;
+      }
+      let summary;
+      try {
+        summary = summariseRecords(parseLines(readFileSync(file, "utf8")));
+      } catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        console.error(
+          `[telegram-message-store] FAIL op=summarise reason=${reason.slice(0, 100)} channelKey=${channelKey}`
+        );
+        continue;
+      }
+      if (!summary) continue;
+      summaryCache.set(file, { size, mtimeMs, summary });
+      out.set(channelKey, summary);
+    }
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    console.error(`[telegram-message-store] FAIL op=summarise-dir reason=${reason.slice(0, 100)}`);
+    return out;
+  }
+  for (const key2 of [...summaryCache.keys()]) {
+    if (key2.startsWith(dir) && !seen.has(key2)) summaryCache.delete(key2);
+  }
+  return out;
+}
+
+// server/lib/route-cache-watchers.ts
+init_src2();
 function watchDirInto(dir, resource, accountId) {
   try {
     const w = watch(dir, { recursive: true }, () => {
@@ -5483,9 +5727,9 @@ function watchDirInto(dir, resource, accountId) {
 var perAccountAttached = /* @__PURE__ */ new Set();
 function ensureAccountWatchers(accountId, accountDir) {
   for (const [dir, resource] of [
-    [resolve(accountDir, "plugins"), "skills"],
-    [resolve(accountDir, "agents", "admin"), "sidebar-artefacts"],
-    [resolve(accountDir, "specialists", "agents"), "sidebar-artefacts"]
+    [resolve2(accountDir, "plugins"), "skills"],
+    [resolve2(accountDir, "agents", "admin"), "sidebar-artefacts"],
+    [resolve2(accountDir, "specialists", "agents"), "sidebar-artefacts"]
   ]) {
     if (perAccountAttached.has(dir)) continue;
     const { attached: attached2 } = watchDirInto(dir, resource, accountId);
@@ -5498,11 +5742,11 @@ function attachRouteCacheWatchers() {
   attached = true;
   const configDir = process.env.CLAUDE_CONFIG_DIR;
   if (configDir) {
-    watchDirInto(resolve(configDir, "projects"), "sidebar-sessions", null);
+    watchDirInto(resolve2(configDir, "projects"), "sidebar-sessions", null);
   } else {
     console.error("[admin-events] op=watch-failed resource=sidebar-sessions reason=CLAUDE_CONFIG_DIR-unset");
   }
-  watchDirInto(resolve(PLATFORM_ROOT, "templates", "specialists", "agents"), "sidebar-artefacts", null);
+  watchDirInto(resolve2(PLATFORM_ROOT, "templates", "specialists", "agents"), "sidebar-artefacts", null);
   let houseId = null;
   try {
     houseId = resolveHouseOrSoleAccountId(ACCOUNTS_DIR);
@@ -5511,6 +5755,7 @@ function attachRouteCacheWatchers() {
   }
   if (houseId) {
     watchDirInto(STORE_ROOT(), "conversations-all", houseId);
+    watchDirInto(STORE_ROOT2(), "conversations-all", houseId);
   } else {
     console.error("[admin-events] op=watch-failed resource=conversations-all reason=house-account-unresolved");
   }
@@ -5707,8 +5952,8 @@ var _baseMimes = {
 var baseMimes = _baseMimes;
 
 // node_modules/@hono/node-server/dist/serve-static.mjs
-import { createReadStream, statSync, existsSync } from "fs";
-import { join } from "path";
+import { createReadStream, statSync as statSync2, existsSync as existsSync2 } from "fs";
+import { join as join2 } from "path";
 import { versions } from "process";
 import { Readable } from "stream";
 var COMPRESSIBLE_CONTENT_TYPE_REGEX = /^\s*(?:text\/[^;\s]+|application\/(?:javascript|json|xml|xml-dtd|ecmascript|dart|postscript|rtf|tar|toml|vnd\.dart|vnd\.ms-fontobject|vnd\.ms-opentype|wasm|x-httpd-php|x-javascript|x-ns-proxy-autoconfig|x-sh|x-tar|x-virtualbox-hdd|x-virtualbox-ova|x-virtualbox-ovf|x-virtualbox-vbox|x-virtualbox-vdi|x-virtualbox-vhd|x-virtualbox-vmdk|x-www-form-urlencoded)|font\/(?:otf|ttf)|image\/(?:bmp|vnd\.adobe\.photoshop|vnd\.microsoft\.icon|vnd\.ms-dds|x-icon|x-ms-bmp)|message\/rfc822|model\/gltf-binary|x-shader\/x-fragment|x-shader\/x-vertex|[^;\s]+?\+(?:json|text|xml|yaml))(?:[;\s]|$)/i;
@@ -5748,7 +5993,7 @@ var createStreamBody = (stream2) => {
 var getStats = (path) => {
   let stats;
   try {
-    stats = statSync(path);
+    stats = statSync2(path);
   } catch {
   }
   return stats;
@@ -5770,7 +6015,7 @@ var tryDecodeURI = (str2) => tryDecode(str2, decodeURI);
 var serveStatic = (options = { root: "" }) => {
   const root = options.root || "";
   const optionPath = options.path;
-  if (root !== "" && !existsSync(root)) {
+  if (root !== "" && !existsSync2(root)) {
     console.error(`serveStatic: root path '${root}' is not found, are you sure it's correct?`);
   }
   return async (c, next) => {
@@ -5791,14 +6036,14 @@ var serveStatic = (options = { root: "" }) => {
         return next();
       }
     }
-    let path = join(
+    let path = join2(
       root,
       !optionPath && options.rewriteRequestPath ? options.rewriteRequestPath(filename, c) : filename
     );
     let stats = getStats(path);
     if (stats && stats.isDirectory()) {
       const indexFile2 = options.index ?? "index.html";
-      path = join(path, indexFile2);
+      path = join2(path, indexFile2);
       stats = getStats(path);
     }
     if (!stats) {
@@ -5856,13 +6101,13 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/lib/static-cache.ts
-import { statSync as statSync2 } from "fs";
-import { join as join2 } from "path";
+import { statSync as statSync3 } from "fs";
+import { join as join3 } from "path";
 var IMMUTABLE = "public, max-age=31536000, immutable";
 var REVALIDATE = "public, no-cache";
 function statOrNull(path) {
   try {
-    return statSync2(path);
+    return statSync3(path);
   } catch {
     return null;
   }
@@ -5883,10 +6128,10 @@ function tryDecodeURI2(str2) {
 function resolveStaticFile(root, reqPath) {
   const filename = tryDecodeURI2(reqPath);
   if (/(?:^|[/\\])\.\.(?:$|[/\\])/.test(filename)) return null;
-  let path = join2(root, filename);
+  let path = join3(root, filename);
   let stats = statOrNull(path);
   if (stats?.isDirectory()) {
-    path = join2(path, "index.html");
+    path = join3(path, "index.html");
     stats = statOrNull(path);
   }
   if (!stats?.isFile()) return null;
@@ -5961,8 +6206,8 @@ ${clientErrorReporterBody}
 </script>`;
 
 // app/lib/whatsapp/ingest-audit.ts
-import { readdirSync, readFileSync, statSync as statSync3 } from "fs";
-import { join as join3 } from "path";
+import { readdirSync as readdirSync2, readFileSync as readFileSync2, statSync as statSync4 } from "fs";
+import { join as join4 } from "path";
 init_message_store();
 var TAG2 = "[wa-ingest-audit]";
 var NOTIFY_TAG = "[wa-notify]";
@@ -5983,16 +6228,16 @@ function readAllConversationsCached(accountId) {
   const out = /* @__PURE__ */ new Map();
   let dir;
   try {
-    dir = readdirSync(join3(STORE_ROOT(), accountId));
+    dir = readdirSync2(join4(STORE_ROOT(), accountId));
   } catch {
     return out;
   }
   for (const file of dir) {
     if (!file.endsWith(".jsonl")) continue;
-    const path = join3(STORE_ROOT(), accountId, file);
+    const path = join4(STORE_ROOT(), accountId, file);
     let stat11;
     try {
-      stat11 = statSync3(path);
+      stat11 = statSync4(path);
     } catch {
       continue;
     }
@@ -6003,7 +6248,7 @@ function readAllConversationsCached(accountId) {
     }
     const parsed = [];
     try {
-      for (const line of readFileSync(path, "utf8").split("\n")) {
+      for (const line of readFileSync2(path, "utf8").split("\n")) {
         if (!line.trim()) continue;
         try {
           const row = JSON.parse(line);
@@ -6119,17 +6364,17 @@ function runNotifyReconcile(opts) {
 init_parse_transcript();
 import { mkdtempSync, rmSync, writeFileSync } from "fs";
 import { tmpdir } from "os";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 
 // server/lib/tail-window.ts
-import { openSync, readSync, closeSync, statSync as statSync4 } from "fs";
+import { openSync, readSync, closeSync, statSync as statSync5 } from "fs";
 var TAIL_WINDOW_BYTES = 1024 * 1024;
 var ALIGN_SCAN_MAX_BYTES = 4 * 1024 * 1024;
 function tailWindowStart(fileEnd, budget = TAIL_WINDOW_BYTES) {
   return Math.max(0, fileEnd - budget);
 }
 function readRange(path, from, to) {
-  const size = statSync4(path).size;
+  const size = statSync5(path).size;
   const start = Math.max(0, from);
   const end = Math.min(to, size);
   if (end <= start) return Buffer.alloc(0);
@@ -6251,8 +6496,62 @@ function censusSnapshot() {
   return { windowed: windowedOpens.size, withBackfill };
 }
 
+// server/lib/frame-strip-census.ts
+var MAX_ACCOUNTS = 50;
+var MAX_UNSTRIPPED_SESSIONS = 3;
+var byAccount = /* @__PURE__ */ new Map();
+function rowFor(accountId) {
+  const existing = byAccount.get(accountId);
+  if (existing) return existing;
+  if (byAccount.size >= MAX_ACCOUNTS) {
+    const oldest = byAccount.keys().next();
+    if (!oldest.done) byAccount.delete(oldest.value);
+  }
+  const fresh = {
+    accountId,
+    rows: 0,
+    wrapped: 0,
+    nested: 0,
+    stripped: 0,
+    unstripped: 0,
+    sources: { whatsapp: 0, webchat: 0, telegram: 0, none: 0 },
+    unstrippedSessions: []
+  };
+  byAccount.set(accountId, fresh);
+  return fresh;
+}
+function foldFrameCensus(accountId, sessionId, acc) {
+  if (acc.rows === 0) return;
+  const row = rowFor(accountId);
+  row.rows += acc.rows;
+  row.wrapped += acc.wrapped;
+  row.nested += acc.nested;
+  row.stripped += acc.stripped;
+  row.unstripped += acc.unstripped;
+  row.sources.whatsapp += acc.sources.whatsapp;
+  row.sources.webchat += acc.sources.webchat;
+  row.sources.telegram += acc.sources.telegram;
+  row.sources.none += acc.sources.none;
+  if (acc.unstripped > 0 && row.unstrippedSessions.length < MAX_UNSTRIPPED_SESSIONS && !row.unstrippedSessions.includes(sessionId)) {
+    row.unstrippedSessions.push(sessionId);
+  }
+  acc.rows = 0;
+  acc.wrapped = 0;
+  acc.nested = 0;
+  acc.stripped = 0;
+  acc.unstripped = 0;
+  acc.sources.whatsapp = 0;
+  acc.sources.webchat = 0;
+  acc.sources.telegram = 0;
+  acc.sources.none = 0;
+}
+function frameCensusSnapshot() {
+  return [...byAccount.values()];
+}
+
 // server/lib/reader-window-audit.ts
 var TAG3 = "[reader-audit]";
+var FRAME_TAG = "[chat-reader]";
 var FIXTURE_ROWS = 60;
 var FIXTURE_BUDGET = 2e3;
 function fixtureBody() {
@@ -6286,8 +6585,25 @@ var key = (t) => JSON.stringify(t);
 function runReaderWindowAudit() {
   const census = censusSnapshot();
   console.log(`${TAG3} op=backfill-reach windowed=${census.windowed} withBackfill=${census.withBackfill}`);
-  const dir = mkdtempSync(join4(tmpdir(), "reader-audit-"));
-  const path = join4(dir, "fixture.jsonl");
+  const frames = frameCensusSnapshot();
+  let frameRows = 0;
+  let frameUnstripped = 0;
+  if (frames.length === 0) {
+    console.log(`${FRAME_TAG} op=frame-census accounts=0`);
+  }
+  for (const f of frames) {
+    frameRows += f.rows;
+    frameUnstripped += f.unstripped;
+    console.log(
+      `${FRAME_TAG} op=frame-census accountId=${f.accountId} rows=${f.rows} wrapped=${f.wrapped} nested=${f.nested} stripped=${f.stripped} sources=whatsapp:${f.sources.whatsapp},webchat:${f.sources.webchat},telegram:${f.sources.telegram},none:${f.sources.none}`
+    );
+    console.log(
+      `${FRAME_TAG} op=frame-unstripped accountId=${f.accountId} rows=${f.unstripped} sessions=${f.unstrippedSessions.join(",")}`
+    );
+  }
+  const frameSummary = `frames=${frameRows} unstripped=${frameUnstripped}`;
+  const dir = mkdtempSync(join5(tmpdir(), "reader-audit-"));
+  const path = join5(dir, "fixture.jsonl");
   try {
     const body = fixtureBody();
     writeFileSync(path, body);
@@ -6332,11 +6648,11 @@ function runReaderWindowAudit() {
       `${TAG3} op=window-kinds fixture=synthetic windowTurns=${windowTurns.length} mismatched=${mismatched}`
     );
     const ok2 = duplicates === 0 && gaps === 0 && ordered && walkTerminated && mismatched === 0;
-    return `continuity=${ok2 ? "ok" : "FAILED"} full=${full.length} assembled=${assembled.length} walk=${walkTerminated ? "ok" : "STUCK"} reach=${census.withBackfill}/${census.windowed}`;
+    return `continuity=${ok2 ? "ok" : "FAILED"} full=${full.length} assembled=${assembled.length} walk=${walkTerminated ? "ok" : "STUCK"} reach=${census.withBackfill}/${census.windowed} ${frameSummary}`;
   } catch (err) {
     const reason = err instanceof Error ? err.message : String(err);
     console.error(`${TAG3} op=audit-failed reason=${reason.slice(0, 120)}`);
-    return `continuity=ERROR ${reason.slice(0, 60)}`;
+    return `continuity=ERROR ${reason.slice(0, 60)} ${frameSummary}`;
   } finally {
     try {
       rmSync(dir, { recursive: true, force: true });
@@ -6398,12 +6714,12 @@ init_src();
 init_pwa();
 
 // server/webchat-descriptor.ts
-import { resolve as resolve2, join as join5 } from "path";
+import { resolve as resolve3, join as join6 } from "path";
 function webchatGatewayUrl() {
   return `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`;
 }
 function webchatServerPath() {
-  return process.env.MAXY_WEBCHAT_CHANNEL_SERVER_PATH ?? resolve2(process.env.MAXY_PLATFORM_ROOT ?? join5(__dirname, ".."), "services/webchat-channel/dist/server.js");
+  return process.env.MAXY_WEBCHAT_CHANNEL_SERVER_PATH ?? resolve3(process.env.MAXY_PLATFORM_ROOT ?? join6(__dirname, ".."), "services/webchat-channel/dist/server.js");
 }
 function webchatChannelDescriptor(key2) {
   return { key: key2, gatewayUrl: webchatGatewayUrl(), serverPath: webchatServerPath() };
@@ -6421,7 +6737,7 @@ init_paths();
 // app/lib/claude-auth.ts
 init_paths();
 init_loop_registry();
-import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, renameSync, unlinkSync } from "fs";
+import { readFileSync as readFileSync3, writeFileSync as writeFileSync2, renameSync, unlinkSync } from "fs";
 import { sep } from "path";
 import { lock } from "proper-lockfile";
 if (!CLAUDE_CREDENTIALS_FILE.startsWith(MAXY_DIR + sep)) {
@@ -6438,7 +6754,7 @@ var REFRESH_NOT_FIRING_THRESHOLD = 2;
 function readCredentials() {
   let raw;
   try {
-    raw = readFileSync2(CLAUDE_CREDENTIALS_FILE, "utf-8");
+    raw = readFileSync3(CLAUDE_CREDENTIALS_FILE, "utf-8");
   } catch {
     return null;
   }
@@ -6461,20 +6777,32 @@ function readCredentials() {
     expiresAt
   };
 }
-function writeOAuthCredentials(tokens) {
+function logCredentialWrite(site, refreshTokenLen) {
+  console.log(`[claude-auth] op=cred-write site=${site} refreshTokenLen=${refreshTokenLen}`);
+}
+function writeHostCredsFile(credentialsFile, blob, refreshTokenLen) {
+  const tmp = `${credentialsFile}.${process.pid}.tmp`;
+  writeFileSync2(tmp, blob, { mode: 384 });
+  renameSync(tmp, credentialsFile);
+  logCredentialWrite("login-writeback", refreshTokenLen);
+}
+function writeOAuthCredentials(tokens, site) {
   const newExpiresAt = typeof tokens.expiresIn === "number" && tokens.expiresIn > 0 ? Date.now() + tokens.expiresIn * 1e3 : Date.now() + 3600 * 1e3;
   try {
     let fileData = {};
     try {
-      const rawFile = readFileSync2(CLAUDE_CREDENTIALS_FILE, "utf-8");
+      const rawFile = readFileSync3(CLAUDE_CREDENTIALS_FILE, "utf-8");
       fileData = JSON.parse(rawFile);
     } catch {
     }
     const existingOauth = fileData.claudeAiOauth;
+    const existingRefresh = typeof existingOauth?.refreshToken === "string" ? existingOauth.refreshToken : "";
+    const incomingRefresh = typeof tokens.refreshToken === "string" ? tokens.refreshToken : "";
+    const blankingRefused = incomingRefresh.length === 0 && existingRefresh.length > 0;
     fileData.claudeAiOauth = {
       ...existingOauth,
       accessToken: tokens.accessToken,
-      ...tokens.refreshToken != null ? { refreshToken: tokens.refreshToken } : {},
+      ...incomingRefresh.length > 0 ? { refreshToken: incomingRefresh } : {},
       expiresAt: newExpiresAt
     };
     const tmpPath = `${CLAUDE_CREDENTIALS_FILE}.${process.pid}.tmp`;
@@ -6488,6 +6816,13 @@ function writeOAuthCredentials(tokens) {
       }
       throw writeErr;
     }
+    if (blankingRefused) {
+      console.warn(
+        `[claude-auth] op=cred-write-refused site=${site} reason=blank-refresh-token storedLen=${existingRefresh.length}`
+      );
+    }
+    const landed = fileData.claudeAiOauth.refreshToken;
+    logCredentialWrite(site, typeof landed === "string" ? landed.length : 0);
     return newExpiresAt;
   } catch (err) {
     console.error(`[claude-auth] credential write failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -6617,9 +6952,11 @@ async function doRefreshLocked() {
   }
   const newExpiresAt = writeOAuthCredentials({
     accessToken: newAccessToken,
-    refreshToken: newRefreshToken ?? creds.refreshToken,
+    // Task 2572 — `??` does not fall back on the empty string, so a response
+    // carrying `refresh_token: ""` used to overwrite a good stored token.
+    refreshToken: typeof newRefreshToken === "string" && newRefreshToken.length > 0 ? newRefreshToken : creds.refreshToken,
     expiresIn: typeof expiresIn === "number" && expiresIn > 0 ? expiresIn : void 0
-  });
+  }, "refresh");
   if (newExpiresAt) {
     console.log(`[auth-refresh] op=renewed expiresAt=${new Date(newExpiresAt).toISOString()}`);
   } else {
@@ -6694,7 +7031,7 @@ init_helpers();
 // server/routes/health.ts
 init_dist();
 init_paths();
-import { existsSync as existsSync2, readFileSync as readFileSync4 } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync5 } from "fs";
 import { createConnection as createConnection2 } from "net";
 
 // app/lib/network.ts
@@ -6719,11 +7056,11 @@ function getLanIp() {
 init_paths();
 import { spawnSync, execFileSync } from "child_process";
 import { createConnection } from "net";
-import { mkdirSync, readFileSync as readFileSync3, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
-import { resolve as resolve3 } from "path";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync4, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
+import { resolve as resolve4 } from "path";
 init_remote_auth();
-var PLATFORM_ROOT2 = process.env.MAXY_PLATFORM_ROOT ?? resolve3(process.cwd(), "..");
-var VNC_SCRIPT = resolve3(PLATFORM_ROOT2, "scripts/vnc.sh");
+var PLATFORM_ROOT2 = process.env.MAXY_PLATFORM_ROOT ?? resolve4(process.cwd(), "..");
+var VNC_SCRIPT = resolve4(PLATFORM_ROOT2, "scripts/vnc.sh");
 var displayMode = process.env.DISPLAY_MODE ?? "virtual";
 if (displayMode === "native") {
   console.log(`[vnc] DISPLAY_MODE=native \u2014 local requests use desktop display, remote requests use VNC`);
@@ -6778,7 +7115,7 @@ function discoverNativeDisplay() {
       const leaderPid = leaderResult.stdout?.trim();
       if (leaderPid) {
         try {
-          const environ = readFileSync3(`/proc/${leaderPid}/environ`, "utf8");
+          const environ = readFileSync4(`/proc/${leaderPid}/environ`, "utf8");
           const match = environ.split("\0").find((e) => e.startsWith("WAYLAND_DISPLAY="));
           if (match) waylandDisplay = match.split("=")[1];
         } catch {
@@ -6833,10 +7170,10 @@ async function waitForPort(port2, timeoutMs = 12e3) {
   return false;
 }
 function ensureLogDir() {
-  mkdirSync(LOG_DIR, { recursive: true });
+  mkdirSync2(LOG_DIR, { recursive: true });
 }
 function logPath(name) {
-  return resolve3(LOG_DIR, `${name}.log`);
+  return resolve4(LOG_DIR, `${name}.log`);
 }
 async function ensureVnc() {
   if (process.platform !== "linux") {
@@ -6921,19 +7258,36 @@ async function ensureCdp(transport = "vnc") {
 function killChromium() {
   spawnSync("pkill", ["-f", "chromium"], { stdio: "pipe" });
 }
-var AUTH_TARGET_ID_FILE = resolve3(LOG_DIR, "claude-auth-target.id");
+var AUTH_TARGET_ID_FILE = resolve4(LOG_DIR, "claude-auth-target.id");
 function readAuthTargetId() {
   try {
-    const id = readFileSync3(AUTH_TARGET_ID_FILE, "utf8").trim();
+    const parts = readFileSync4(AUTH_TARGET_ID_FILE, "utf8").trim().split(/\s+/);
+    const id = parts[parts.length - 1];
     return id.length > 0 ? id : null;
   } catch {
     return null;
   }
 }
-function writeChromiumWrapper() {
-  mkdirSync(BIN_DIR, { recursive: true });
+function readAuthAttemptId() {
+  try {
+    const parts = readFileSync4(AUTH_TARGET_ID_FILE, "utf8").trim().split(/\s+/);
+    return parts.length === 2 && parts[0].length > 0 ? parts[0] : null;
+  } catch {
+    return null;
+  }
+}
+async function closeAuthTarget(targetId) {
+  try {
+    const res = await fetch(`http://127.0.0.1:${CDP_PORT}/json/close/${encodeURIComponent(targetId)}`);
+    return res.ok;
+  } catch {
+    return false;
+  }
+}
+function writeChromiumWrapper(attemptId) {
+  mkdirSync2(BIN_DIR, { recursive: true });
   rmSync2(AUTH_TARGET_ID_FILE, { force: true });
-  const wrapperPath = resolve3(BIN_DIR, "chromium");
+  const wrapperPath = resolve4(BIN_DIR, "chromium");
   writeFileSync3(wrapperPath, `#!/bin/bash
 # Generated by writeChromiumWrapper (app/lib/vnc.ts) \u2014 Task 1562.
 # Hands its URL argument to the brand's running Chromium over CDP.
@@ -6941,6 +7295,9 @@ LOG_DIR="${LOG_DIR}"
 LOG="$LOG_DIR/chromium.log"
 TARGET_ID_FILE="$LOG_DIR/claude-auth-target.id"
 CDP="http://127.0.0.1:${CDP_PORT}/json/new"
+# The sign-in this wrapper was generated for. Server-minted hex from
+# randomUUID().slice(0, 8), never caller-supplied, so it carries no shell.
+ATTEMPT_ID="${attemptId}"
 
 mkdir -p "$LOG_DIR"
 echo "==== [$(date)] chromium wrapper (cdp-handover) ====" >> "$LOG"
@@ -6972,9 +7329,9 @@ if [ -z "$TARGET_ID" ]; then
   exit 65
 fi
 
-printf '%s' "$TARGET_ID" > "$TARGET_ID_FILE"
-echo "  opened target $TARGET_ID" >> "$LOG"
-echo "[chromium-wrapper] op=cdp-handover outcome=ready targetId=$TARGET_ID" >> "$LOG"
+printf '%s %s' "$ATTEMPT_ID" "$TARGET_ID" > "$TARGET_ID_FILE"
+echo "  opened target $TARGET_ID for attempt $ATTEMPT_ID" >> "$LOG"
+echo "[chromium-wrapper] op=cdp-handover outcome=ready attempt=$ATTEMPT_ID targetId=$TARGET_ID" >> "$LOG"
 `, { mode: 493 });
   return wrapperPath;
 }
@@ -7035,8 +7392,8 @@ app.get("/", async (c) => {
   const browserTransport = resolveBrowserTransport(c.req.raw, c.env?.incoming?.socket?.remoteAddress);
   let pinConfigured = false;
   try {
-    if (existsSync2(USERS_FILE)) {
-      const raw = readFileSync4(USERS_FILE, "utf-8").trim();
+    if (existsSync3(USERS_FILE)) {
+      const raw = readFileSync5(USERS_FILE, "utf-8").trim();
       if (raw) {
         const users = JSON.parse(raw);
         pinConfigured = Array.isArray(users) && users.length > 0;
@@ -7529,183 +7886,6 @@ init_dist();
 init_channel_key();
 import { statSync as statSync7 } from "fs";
 import { join as join12 } from "path";
-
-// app/lib/telegram/message-store.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync5, appendFileSync, readdirSync as readdirSync2, statSync as statSync5 } from "fs";
-import { homedir } from "os";
-import { dirname, join as join7, resolve as resolve4 } from "path";
-function configDirName() {
-  const platformRoot5 = process.env.MAXY_PLATFORM_ROOT ?? resolve4(process.cwd(), "..");
-  const brandPath = join7(platformRoot5, "config", "brand.json");
-  if (existsSync3(brandPath)) {
-    try {
-      return JSON.parse(readFileSync5(brandPath, "utf-8")).configDir ?? ".maxy";
-    } catch {
-    }
-  }
-  return ".maxy";
-}
-var STORE_ROOT2 = () => join7(process.env.MAXY_DIR_OVERRIDE ?? resolve4(homedir(), configDirName()), "data", "telegram-messages");
-function isStorableChannelKey(channelKey) {
-  return /^-?\d+:-?\d+$/.test(channelKey);
-}
-function channelKeyToFileStem(channelKey) {
-  if (!isStorableChannelKey(channelKey)) {
-    throw new Error(`telegram-message-store: refusing unstorable channelKey ${JSON.stringify(channelKey)}`);
-  }
-  return channelKey.replace(":", "_");
-}
-function fileStemToChannelKey(stem) {
-  const i = stem.indexOf("_");
-  return i <= 0 ? stem : `${stem.slice(0, i)}:${stem.slice(i + 1)}`;
-}
-function conversationFile(accountId, channelKey) {
-  return join7(STORE_ROOT2(), accountId, `${channelKeyToFileStem(channelKey)}.jsonl`);
-}
-function conversationFilePath2(accountId, channelKey) {
-  return conversationFile(accountId, channelKey);
-}
-function isStorableStem(stem) {
-  return isStorableChannelKey(fileStemToChannelKey(stem));
-}
-function listStoredAccountIds2() {
-  const root = STORE_ROOT2();
-  if (!existsSync3(root)) return [];
-  return readdirSync2(root).filter((name) => {
-    try {
-      return statSync5(join7(root, name)).isDirectory();
-    } catch {
-      return false;
-    }
-  });
-}
-function parseLines(raw) {
-  const out = [];
-  for (const line of raw.split("\n")) {
-    if (!line.trim()) continue;
-    try {
-      out.push(JSON.parse(line));
-    } catch {
-      console.error(`[telegram-message-store] skip reason=corrupt-line`);
-    }
-  }
-  return out;
-}
-var byDateSentAsc = (a, b) => a.dateSent.localeCompare(b.dateSent);
-function appendMessage2(accountId, record) {
-  if (!isStorableChannelKey(record.channelKey)) {
-    console.error(
-      `[telegram-message-store] FAIL op=append reason=unstorable-channel-key messageId=${record.messageId}`
-    );
-    return { created: false };
-  }
-  const file = conversationFile(accountId, record.channelKey);
-  try {
-    mkdirSync2(dirname(file), { recursive: true });
-  } catch (err) {
-    const reason = err instanceof Error ? err.message : String(err);
-    console.error(
-      `[telegram-message-store] FAIL op=append reason=${reason.slice(0, 100)} messageId=${record.messageId}`
-    );
-    return { created: false };
-  }
-  try {
-    if (existsSync3(file)) {
-      const existing = parseLines(readFileSync5(file, "utf8"));
-      if (existing.some((r) => r.messageId === record.messageId)) {
-        console.error(
-          `[telegram-message-store] op=append channelKey=${record.channelKey} origin=${record.origin} created=false`
-        );
-        return { created: false };
-      }
-    }
-    appendFileSync(file, `${JSON.stringify(record)}
-`);
-    console.error(
-      `[telegram-message-store] op=append channelKey=${record.channelKey} origin=${record.origin} created=true`
-    );
-    return { created: true };
-  } catch (err) {
-    const reason = err instanceof Error ? err.message : String(err);
-    console.error(
-      `[telegram-message-store] FAIL op=append reason=${reason.slice(0, 100)} messageId=${record.messageId}`
-    );
-    return { created: false };
-  }
-}
-function readConversation2(accountId, channelKey) {
-  if (!isStorableChannelKey(channelKey)) return [];
-  const file = conversationFile(accountId, channelKey);
-  try {
-    if (!existsSync3(file)) return [];
-    return parseLines(readFileSync5(file, "utf8")).sort(byDateSentAsc);
-  } catch (err) {
-    const reason = err instanceof Error ? err.message : String(err);
-    console.error(
-      `[telegram-message-store] FAIL op=read reason=${reason.slice(0, 100)} channelKey=${channelKey}`
-    );
-    return [];
-  }
-}
-var summaryCache = /* @__PURE__ */ new Map();
-function summariseRecords(records2) {
-  if (records2.length === 0) return null;
-  const sorted = records2.slice().sort(byDateSentAsc);
-  return { first: sorted[0], last: sorted[sorted.length - 1] };
-}
-function readConversationSummaries2(accountId) {
-  const dir = join7(STORE_ROOT2(), accountId);
-  const out = /* @__PURE__ */ new Map();
-  const seen = /* @__PURE__ */ new Set();
-  try {
-    if (!existsSync3(dir)) return out;
-    for (const entry2 of readdirSync2(dir)) {
-      if (!entry2.endsWith(".jsonl")) continue;
-      const stem = entry2.slice(0, -".jsonl".length);
-      if (!isStorableStem(stem)) continue;
-      const channelKey = fileStemToChannelKey(stem);
-      const file = join7(dir, entry2);
-      seen.add(file);
-      let size;
-      let mtimeMs;
-      try {
-        const st = statSync5(file);
-        size = st.size;
-        mtimeMs = st.mtimeMs;
-      } catch {
-        continue;
-      }
-      const cached3 = summaryCache.get(file);
-      if (cached3 && cached3.size === size && cached3.mtimeMs === mtimeMs) {
-        out.set(channelKey, cached3.summary);
-        continue;
-      }
-      let summary;
-      try {
-        summary = summariseRecords(parseLines(readFileSync5(file, "utf8")));
-      } catch (err) {
-        const reason = err instanceof Error ? err.message : String(err);
-        console.error(
-          `[telegram-message-store] FAIL op=summarise reason=${reason.slice(0, 100)} channelKey=${channelKey}`
-        );
-        continue;
-      }
-      if (!summary) continue;
-      summaryCache.set(file, { size, mtimeMs, summary });
-      out.set(channelKey, summary);
-    }
-  } catch (err) {
-    const reason = err instanceof Error ? err.message : String(err);
-    console.error(`[telegram-message-store] FAIL op=summarise-dir reason=${reason.slice(0, 100)}`);
-    return out;
-  }
-  for (const key2 of [...summaryCache.keys()]) {
-    if (key2.startsWith(dir) && !seen.has(key2)) summaryCache.delete(key2);
-  }
-  return out;
-}
-
-// server/routes/channel/schedule-inject.ts
 init_admin_session_id();
 init_normalize();
 
@@ -8288,6 +8468,32 @@ async function sendTelegramText(botToken, chatId, text) {
   }
 }
 
+// app/lib/telegram/outbound/send-chat-action.ts
+async function sendTelegramChatAction(botToken, chatId, key2, site) {
+  const report = (ok2, reason) => console.error(
+    `[telegram-native] op=chat-action key=${key2} site=${site} ok=${ok2}${ok2 ? "" : ` reason=${reason}`}`
+  );
+  try {
+    const res = await fetch(`https://api.telegram.org/bot${botToken}/sendChatAction`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ chat_id: chatId, action: "typing" })
+    });
+    const data = await res.json();
+    if (data.ok) {
+      report(true);
+      return { ok: true };
+    }
+    const error = data.description ?? "chat action failed";
+    report(false, error);
+    return { ok: false, error };
+  } catch (e) {
+    const error = e instanceof Error ? e.message : String(e);
+    report(false, error);
+    return { ok: false, error };
+  }
+}
+
 // server/routes/whatsapp.ts
 init_dist();
 import { basename as basename3, join as join17, resolve as resolve8 } from "path";
@@ -15549,6 +15755,7 @@ function pickActivity(entries2, grown, nowMs, concurrencyWindowMs) {
 }
 
 // server/routes/session-reader.ts
+init_session_store();
 init_dist();
 var app7 = new Hono();
 function probeDataRef(path) {
@@ -15724,6 +15931,7 @@ data: ${JSON.stringify(turn)}
 
 `));
   const connId = `${sessionId.slice(0, 8)}-${process.hrtime.bigint().toString(36).slice(-6)}`;
+  const censusAccountId = getAccountIdForSession(c.get("cacheKey") ?? "") ?? "unresolved";
   const startedAt = Date.now();
   const lastEventId = c.req.header("Last-Event-ID");
   let teardown = () => {
@@ -15759,7 +15967,8 @@ data: ${JSON.stringify(obj)}
         log: (line) => console.log(line)
       });
       const queuedPendingSuppress = /* @__PURE__ */ new Map();
-      const turnCtx = {};
+      const envelopeCensus = emptyEnvelopeCensus();
+      const turnCtx = { envelopeCensus };
       const drain = () => {
         try {
           const { buf, end } = readFrom(jsonlPath, offset);
@@ -15776,6 +15985,7 @@ data: ${JSON.stringify(obj)}
             n++;
           }
           if (n > 0) {
+            foldFrameCensus(censusAccountId, sessionId, envelopeCensus);
             actx.parentGrewThisTick = true;
             console.log(`[wa-stream] op=drain conn=${connId} turns=${n}`);
           }
@@ -15822,6 +16032,7 @@ data: ${JSON.stringify({ from: alignedFrom, fileEnd: fileEnd0 })}
             }
             n++;
           }
+          foldFrameCensus(censusAccountId, sessionId, envelopeCensus);
           console.log(
             `[wa-stream] op=backlog conn=${connId} turns=${n} bytes=${end - alignedFrom} from=${alignedFrom}`
           );
@@ -16005,7 +16216,7 @@ import { basename as basename8, dirname as dirname9, join as join26 } from "path
 // app/lib/reader/operator-conversations.ts
 function operatorConvName(row) {
   if (row.isGroup === true) return row.chatName ?? row.title;
-  const name = row.operatorName ?? row.chatName ?? row.whatsappName;
+  const name = row.operatorName ?? row.chatName ?? row.whatsappName ?? row.telegramName;
   const senderId = row.senderId != null && row.channel === "whatsapp" ? formatSenderPhone(row.senderId) : row.senderId;
   if (name) return senderId ? `${name}  ${senderId}` : name;
   return senderId ?? row.title;
@@ -16015,6 +16226,7 @@ function operatorConvNameSource(row) {
   if (row.operatorName) return "operator";
   if (row.chatName) return "chatmeta";
   if (row.whatsappName) return "inbound-pushname";
+  if (row.telegramName) return "telegram-sender-name";
   if (row.senderId != null) return "counterparty-number";
   return "jid";
 }
@@ -16234,6 +16446,14 @@ app8.get("/conversations", requireAdminSession, async (c) => {
   );
   const adminScope = allStoreRows.filter((r) => r.scope === "admin").length;
   const publicScope = allStoreRows.length - adminScope;
+  const telegramStoreRows = account ? buildTelegramStoreConversationRows(account.accountId, readConversationSummaries2(account.accountId)) : [];
+  const dedupedSessionRows = dropTelegramSessionDuplicates(sessionConversations, telegramStoreRows);
+  const telegramRows = [
+    ...dedupedSessionRows.filter((r) => r.channel === "telegram"),
+    ...telegramStoreRows
+  ].sort((a, b) => (b.lastMessageAt ?? "").localeCompare(a.lastMessageAt ?? ""));
+  const otherSessionRows = dedupedSessionRows.filter((r) => r.channel !== "telegram");
+  const conversations = [...otherSessionRows, ...allStoreRows, ...telegramRows];
   const census = buildLabelCensus(allStoreRows, selfPushNames(summaries));
   for (const f of fallbackLabelSources(allStoreRows)) {
     console.log(`[wa-label] op=row-label jid=${f.jid} source=${f.source} route=conversations`);
@@ -16241,11 +16461,11 @@ app8.get("/conversations", requireAdminSession, async (c) => {
   console.log(
     `[wa-label-census] route=conversations chats=${census.chats} withMeta=${census.withMeta} groups=${census.groups} groupsWithSubject=${census.groupsWithSubject} labelledByMember=${census.labelledByMember} dms=${census.dms} namedDms=${census.namedDms} labelledBySelfPushName=${census.labelledBySelfPushName}`
   );
-  const sessionRowCount = sessionConversations.length;
+  const sessionRowCount = dedupedSessionRows.length;
   console.log(
-    `[wa-reader] op=list pinnedAccount=${scopeAccountId?.slice(0, 8) ?? "null"} resolvedAccount=${account?.accountId.slice(0, 8) ?? "null"} multiAccount=${multiAccount} conversations=${sessionRowCount + allStoreRows.length} sessionRows=${sessionRowCount} storeRows=${allStoreRows.length} adminScope=${adminScope} publicScope=${publicScope} sessionRowsExcludedUntagged=${sessionRowsExcludedUntagged} houseResolved=${houseId ? houseId.slice(0, 8) : "null"} managerPhonesBound=${managerPhonesBound} managedStoreRows=${managedRows.length}`
+    `[wa-reader] op=list pinnedAccount=${scopeAccountId?.slice(0, 8) ?? "null"} resolvedAccount=${account?.accountId.slice(0, 8) ?? "null"} multiAccount=${multiAccount} conversations=${conversations.length} sessionRows=${sessionRowCount} storeRows=${allStoreRows.length} storeRowsByChannel=whatsapp:${allStoreRows.length},telegram:${telegramStoreRows.length} adminScope=${adminScope} publicScope=${publicScope} sessionRowsExcludedUntagged=${sessionRowsExcludedUntagged} houseResolved=${houseId ? houseId.slice(0, 8) : "null"} managerPhonesBound=${managerPhonesBound} managedStoreRows=${managedRows.length}`
   );
-  return c.json({ conversations: [...sessionConversations, ...allStoreRows] });
+  return c.json({ conversations });
 });
 function tagAndMergeInstallConversations(perAccount) {
   const all = [];
@@ -16256,7 +16476,7 @@ function tagAndMergeInstallConversations(perAccount) {
 }
 function dropHouseRowsOwnedBySubAccount(rows, subManagerPhones) {
   return rows.filter((r) => {
-    if (r.isHouse !== true || r.source !== "store" || r.senderId == null) return true;
+    if (r.channel !== "whatsapp" || r.isHouse !== true || r.source !== "store" || r.senderId == null) return true;
     let owner = null;
     for (const [subId, phones] of subManagerPhones) {
       if (counterpartyBoundToSubAccount(phones, r.senderId)) {
@@ -16396,7 +16616,14 @@ app8.get("/conversations-all", requireAdminSession, async (c) => {
         readConversationSummaries(account.accountId),
         readChatMetadata(account.accountId)
       );
-      perAccount.push({ isHouse, rows: [...named, ...storeRows] });
+      const telegramStoreRows = buildTelegramStoreConversationRows(
+        account.accountId,
+        readConversationSummaries2(account.accountId)
+      );
+      perAccount.push({
+        isHouse,
+        rows: [...dropTelegramSessionDuplicates(named, telegramStoreRows), ...storeRows, ...telegramStoreRows]
+      });
     }
     const houseAccount = validAccounts.find((a) => a.accountId === houseId) ?? null;
     const subManagerPhones = /* @__PURE__ */ new Map();
@@ -16414,16 +16641,19 @@ app8.get("/conversations-all", requireAdminSession, async (c) => {
     for (const account of validAccounts) {
       for (const [jid, s] of readConversationSummaries(account.accountId)) allSummaries.set(`${account.accountId}:${jid}`, s);
     }
-    const census = buildLabelCensus(conversations, selfPushNames(allSummaries));
-    for (const f of fallbackLabelSources(conversations)) {
+    const whatsappRows = conversations.filter((r) => r.channel === "whatsapp");
+    const census = buildLabelCensus(whatsappRows, selfPushNames(allSummaries));
+    for (const f of fallbackLabelSources(whatsappRows)) {
       console.log(`[wa-label] op=row-label jid=${f.jid} source=${f.source} route=conversations-all`);
     }
     console.log(
       `[wa-label-census] route=conversations-all chats=${census.chats} withMeta=${census.withMeta} groups=${census.groups} groupsWithSubject=${census.groupsWithSubject} labelledByMember=${census.labelledByMember} dms=${census.dms} namedDms=${census.namedDms} labelledBySelfPushName=${census.labelledBySelfPushName}`
     );
     const houseRows = conversations.filter((r) => r.isHouse).length;
+    const storeByChannel = conversations.filter((r) => r.source === "store");
+    const waStoreRows = storeByChannel.filter((r) => r.channel === "whatsapp").length;
     console.log(
-      `[wa-reader] op=conversations-all accounts=${validAccounts.length} rows=${conversations.length} house=${houseRows} sub=${conversations.length - houseRows} deduped=${merged.length - conversations.length}`
+      `[wa-reader] op=conversations-all accounts=${validAccounts.length} rows=${conversations.length} house=${houseRows} sub=${conversations.length - houseRows} deduped=${merged.length - conversations.length} storeRowsByChannel=whatsapp:${waStoreRows},telegram:${storeByChannel.length - waStoreRows}`
     );
     return { conversations };
   });
@@ -18653,7 +18883,7 @@ var quickbooks_default = app12;
 // server/routes/onboarding.ts
 init_dist();
 import { spawn, spawnSync as spawnSync2, execFileSync as execFileSync4 } from "child_process";
-import { openSync as openSync8, closeSync as closeSync8, writeFileSync as writeFileSync14, writeSync, existsSync as existsSync26, readFileSync as readFileSync32, unlinkSync as unlinkSync3, renameSync as renameSync8 } from "fs";
+import { openSync as openSync8, closeSync as closeSync8, appendFileSync as appendFileSync3, writeFileSync as writeFileSync14, writeSync, existsSync as existsSync26, readFileSync as readFileSync32, unlinkSync as unlinkSync3 } from "fs";
 import { createHash as createHash4, randomUUID as randomUUID4 } from "crypto";
 init_claude_agent();
 init_neo4j_store();
@@ -18726,8 +18956,10 @@ function bridgeKeychainToFile(deps) {
     deps.log(`[onboarding] op=login-writeback result=no-claudeAiOauth service=${JSON.stringify(service)}`);
     return { wrote: false, reason: "no-claudeAiOauth", bytes: 0, service };
   }
+  const oauth = parsed.claudeAiOauth;
+  const refreshTokenLen = typeof oauth.refreshToken === "string" ? oauth.refreshToken.length : 0;
   try {
-    deps.writeFile(blob);
+    deps.writeFile(blob, refreshTokenLen);
   } catch (err) {
     deps.log(`[onboarding] op=login-writeback result=write-failed service=${JSON.stringify(service)} err=${err instanceof Error ? err.message : String(err)}`);
     return { wrote: false, reason: "write-failed", bytes: 0, service };
@@ -18991,7 +19223,35 @@ function readUsersFile2() {
   if (!raw) return [];
   return JSON.parse(raw);
 }
-var darwinAuthChild = null;
+var pendingAuthLogin = null;
+async function endLogin(pending) {
+  if (!pending) return { priorId: null, priorPid: null, tabClosed: null };
+  let tabClosed = null;
+  const targetId = readAuthTargetId();
+  if (targetId && readAuthAttemptId() === pending.attemptId) {
+    tabClosed = await closeAuthTarget(targetId);
+  }
+  const priorPid = pending.child?.pid ?? null;
+  try {
+    pending.child?.kill("SIGTERM");
+  } catch {
+  }
+  return { priorId: pending.attemptId, priorPid, tabClosed };
+}
+function adoptOrStopChild(attemptId, child) {
+  if (pendingAuthLogin?.attemptId === attemptId) {
+    pendingAuthLogin.child = child;
+    return true;
+  }
+  try {
+    child.kill("SIGTERM");
+  } catch {
+  }
+  return false;
+}
+function formatEnded(ended) {
+  return `superseded=${ended.priorId ?? "none"} priorPid=${ended.priorPid ?? "none"} tabClosed=${ended.tabClosed === null ? "na" : ended.tabClosed}`;
+}
 var darwinCredsBefore = {};
 async function checkAuthStatus() {
   let status;
@@ -19032,7 +19292,11 @@ app13.post("/claude-auth", async (c) => {
   const remoteAddress = c.env?.incoming?.socket?.remoteAddress;
   const transport = resolveBrowserTransport(c.req.raw, remoteAddress);
   if (body.action === "stop") {
-    return c.json({ stopped: true });
+    const superseded2 = pendingAuthLogin;
+    pendingAuthLogin = null;
+    const ended2 = await endLogin(superseded2);
+    console.log(`[onboarding] op=auth-login-stop attempt=${ended2.priorId ?? "none"} outcome=${ended2.priorId ? "stopped" : "no-pending"} priorPid=${ended2.priorPid ?? "none"} tabClosed=${ended2.tabClosed === null ? "na" : ended2.tabClosed}`);
+    return c.json({ stopped: ended2.priorId !== null });
   }
   if (body.action === "logout") {
     const start = Date.now();
@@ -19057,7 +19321,7 @@ app13.post("/claude-auth", async (c) => {
   }
   if (body.action === "paste-code") {
     const code = typeof body.code === "string" ? body.code : "";
-    const child = darwinAuthChild;
+    const child = pendingAuthLogin?.child ?? null;
     if (!child || !child.stdin || child.stdin.destroyed) {
       console.log("[onboarding] op=claude-paste-code accepted=false reason=no-active-login");
       return c.json({ accepted: false, error: "No active login to paste into. Start sign-in first." }, 400);
@@ -19079,8 +19343,13 @@ app13.post("/claude-auth", async (c) => {
     const cdpReady = await ensureCdp(transport);
     return c.json({ launched: cdpReady });
   }
+  const attemptId = randomUUID4().slice(0, 8);
+  const superseded = pendingAuthLogin;
+  pendingAuthLogin = { child: null, attemptId, startedAt: Date.now() };
+  const ended = await endLogin(superseded);
   ensureLogDir();
-  writeFileSync14(logPath("claude-auth"), "");
+  appendFileSync3(logPath("claude-auth"), `==== attempt ${attemptId} ${(/* @__PURE__ */ new Date()).toISOString()} ====
+`);
   const claudeAuthLogFd = openSync8(logPath("claude-auth"), "a");
   const onClaudeOutput = (chunk) => writeSync(claudeAuthLogFd, chunk);
   if (process.platform === "darwin") {
@@ -19091,7 +19360,8 @@ app13.post("/claude-auth", async (c) => {
       stdio: ["pipe", "pipe", "pipe"]
     });
     claudeProc2.unref();
-    darwinAuthChild = claudeProc2;
+    const adopted2 = adoptOrStopChild(attemptId, claudeProc2);
+    console.log(`[onboarding] op=auth-login-start attempt=${attemptId} platform=darwin transport=native outcome=${adopted2 ? "started" : "self-superseded"} ${formatEnded(ended)}`);
     claudeProc2.stdin?.on("error", () => {
     });
     claudeProc2.stdout?.on("data", onClaudeOutput);
@@ -19103,11 +19373,9 @@ app13.post("/claude-auth", async (c) => {
         before: darwinCredsBefore,
         listMdats: listHostCredsMdats,
         readBlob: readHostCredsBlob,
-        writeFile: (blob) => {
-          const tmp = `${CLAUDE_CREDENTIALS_FILE}.${process.pid}.tmp`;
-          writeFileSync14(tmp, blob, { mode: 384 });
-          renameSync8(tmp, CLAUDE_CREDENTIALS_FILE);
-        },
+        // Task 2572 — the write itself lives in claude-auth.ts beside the other
+        // writer of this file, so both emit provenance and both are testable.
+        writeFile: (blob, refreshTokenLen) => writeHostCredsFile(CLAUDE_CREDENTIALS_FILE, blob, refreshTokenLen),
         log: (line) => console.log(line)
       });
       persistKeychainService(
@@ -19115,7 +19383,7 @@ app13.post("/claude-auth", async (c) => {
         (service) => writeFileSync14(join37(dirname13(CLAUDE_CREDENTIALS_FILE), ".keychain-service"), service, { mode: 384 }),
         (line) => console.log(line)
       );
-      if (darwinAuthChild === claudeProc2) darwinAuthChild = null;
+      if (pendingAuthLogin?.child === claudeProc2) pendingAuthLogin = null;
     });
     return c.json({ started: true, transport: "native" });
   }
@@ -19124,7 +19392,7 @@ app13.post("/claude-auth", async (c) => {
     if (!vncReady) return c.json({ error: "VNC display failed to start" }, 500);
   }
   await ensureCdp(transport);
-  const chromiumWrapper = writeChromiumWrapper();
+  const chromiumWrapper = writeChromiumWrapper(attemptId);
   const x11Env = buildX11Env(chromiumWrapper, transport);
   vncLog("claude-auth", { action: "start", transport });
   const claudeProc = spawn("claude", ["auth", "login"], {
@@ -19132,9 +19400,14 @@ app13.post("/claude-auth", async (c) => {
     stdio: ["ignore", "pipe", "pipe"]
   });
   claudeProc.unref();
+  const adopted = adoptOrStopChild(attemptId, claudeProc);
+  console.log(`[onboarding] op=auth-login-start attempt=${attemptId} platform=${process.platform} transport=${transport} outcome=${adopted ? "started" : "self-superseded"} ${formatEnded(ended)}`);
   claudeProc.stdout?.on("data", onClaudeOutput);
   claudeProc.stderr?.on("data", onClaudeOutput);
-  claudeProc.once("close", () => closeSync8(claudeAuthLogFd));
+  claudeProc.once("close", () => {
+    closeSync8(claudeAuthLogFd);
+    if (pendingAuthLogin?.child === claudeProc) pendingAuthLogin = null;
+  });
   await waitForAuthPage(2e4);
   return c.json({ started: true, transport });
 });
@@ -19814,7 +20087,7 @@ init_dist();
 init_paths();
 init_remote_auth();
 init_loop_registry();
-import { appendFileSync as appendFileSync3, existsSync as existsSync27, renameSync as renameSync9, statSync as statSync19 } from "fs";
+import { appendFileSync as appendFileSync4, existsSync as existsSync27, renameSync as renameSync9, statSync as statSync19 } from "fs";
 import { join as join38 } from "path";
 var CLIENT_ERRORS_LOG = join38(LOG_DIR, "client-errors.log");
 var MAX_LOG_SIZE = 10 * 1024 * 1024;
@@ -19960,7 +20233,7 @@ app15.post("/", async (c) => {
       const safe = typeof v === "string" ? truncate(v, 200) : typeof v === "number" || typeof v === "boolean" ? String(v) : JSON.stringify(v).slice(0, 200);
       return `${k}=${safe}`;
     }).join(" ");
-    const TAGGED_PREFIX_SOURCES = /* @__PURE__ */ new Set(["stream-log-click", "pwa", "graph-settle", "dashboard-load", "routines", "calendar-legibility"]);
+    const TAGGED_PREFIX_SOURCES = /* @__PURE__ */ new Set(["stream-log-click", "pwa", "graph-settle", "dashboard-load", "routines", "calendar-legibility", "channels-card"]);
     if (TAGGED_PREFIX_SOURCES.has(source)) {
       console.log(
         `[${source}] ts=${ts} ip=${ip} version=${version || "unknown"}${extra ? " " + extra : ""}`
@@ -19993,7 +20266,7 @@ app15.post("/", async (c) => {
         tag: typeof body.tag === "string" ? truncate(body.tag, 32) : void 0,
         status: typeof body.status === "number" ? body.status : void 0
       };
-      appendFileSync3(CLIENT_ERRORS_LOG, JSON.stringify(payload) + "\n", "utf-8");
+      appendFileSync4(CLIENT_ERRORS_LOG, JSON.stringify(payload) + "\n", "utf-8");
     } catch (err) {
       console.error(`[client-error] append failed: ${err instanceof Error ? err.message : String(err)}`);
     }
@@ -23086,18 +23359,18 @@ var ALLOWED_EVENTS = /* @__PURE__ */ new Set([
 ]);
 var app27 = new Hono();
 app27.post("/", async (c) => {
-  const TAG66 = "[admin:events]";
+  const TAG68 = "[admin:events]";
   let body;
   try {
     body = await c.req.json();
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG66} reject reason=body-not-json detail=${detail}`);
+    console.error(`${TAG68} reject reason=body-not-json detail=${detail}`);
     return c.json({ ok: false, detail: "Request body was not valid JSON" }, 400);
   }
   const event = typeof body.event === "string" ? body.event : "";
   if (!ALLOWED_EVENTS.has(event)) {
-    console.error(`${TAG66} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
+    console.error(`${TAG68} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
     return c.json({ ok: false, detail: `Event "${event}" is not allowed` }, 400);
   }
   const rawFields = body.fields && typeof body.fields === "object" ? body.fields : {};
@@ -34796,6 +35069,68 @@ function startSharedFolderCensus() {
   });
 }
 
+// app/lib/cred-refresh-census.ts
+init_loop_registry();
+import { readdirSync as readdirSync31, readFileSync as readFileSync53 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join59 } from "path";
+var TAG60 = "[claude-auth]";
+function refreshTokenLength(raw) {
+  let data;
+  try {
+    data = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  const oauth = data.claudeAiOauth;
+  if (!oauth || typeof oauth !== "object") return null;
+  return typeof oauth.refreshToken === "string" ? oauth.refreshToken.length : null;
+}
+function surveyBrandCredentials(home) {
+  let entries2;
+  try {
+    entries2 = readdirSync31(home);
+  } catch {
+    return [];
+  }
+  const rows = [];
+  for (const entry2 of entries2.sort()) {
+    if (!entry2.startsWith(".")) continue;
+    let raw;
+    try {
+      raw = readFileSync53(join59(home, entry2, ".claude", ".credentials.json"), "utf-8");
+    } catch {
+      continue;
+    }
+    rows.push({ brand: entry2.slice(1), refreshTokenLen: refreshTokenLength(raw) });
+  }
+  return rows;
+}
+function isBlank(row) {
+  return row.refreshTokenLen === null || row.refreshTokenLen === 0;
+}
+function censusResult(rows) {
+  if (rows.length === 0) return "no-brands-found";
+  return rows.some(isBlank) ? "blank-tokens" : "ok";
+}
+function runCredRefreshCensus(home = homedir5()) {
+  const rows = surveyBrandCredentials(home);
+  const blank = rows.filter(isBlank).length;
+  const detail = rows.map((r) => `${r.brand}:${r.refreshTokenLen === null ? "unreadable" : r.refreshTokenLen}`).join(",");
+  console.log(
+    `${TAG60} op=cred-refresh-census result=${censusResult(rows)} brands=${rows.length} blank=${blank} detail=${detail}`
+  );
+  return `${rows.length} brand(s), ${blank} blank`;
+}
+function startCredRefreshCensus() {
+  registerLoop({
+    name: "cred-refresh-census",
+    intervalMs: 60 * 60 * 1e3,
+    firstRunDelayMs: 0,
+    run: () => runCredRefreshCensus()
+  });
+}
+
 // app/lib/file-watcher.ts
 init_data_path();
 import * as fsp2 from "fs/promises";
@@ -35033,7 +35368,7 @@ init_account();
 init_neo4j_store();
 import { readdir as readdir7, readFile as readFile12, rename as rename5, writeFile as writeFile5, unlink as unlink4 } from "fs/promises";
 import { existsSync as existsSync50 } from "fs";
-import { join as join59 } from "path";
+import { join as join60 } from "path";
 var ADMIN_ROLE2 = "admin";
 var WEBCHAT_CHANNEL2 = "webchat";
 var SESSION_META_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.meta\.json$/i;
@@ -35078,7 +35413,7 @@ async function collectLiveSidecars(projectsRoot) {
   }
   for (const slug of slugs) {
     if (!slug.isDirectory()) continue;
-    const slugDir = join59(projectsRoot, slug.name);
+    const slugDir = join60(projectsRoot, slug.name);
     let entries2;
     try {
       entries2 = await readdir7(slugDir, { withFileTypes: true });
@@ -35087,9 +35422,9 @@ async function collectLiveSidecars(projectsRoot) {
     }
     for (const entry2 of entries2) {
       if (entry2.isFile() && SESSION_META_RE.test(entry2.name)) {
-        out.push(join59(slugDir, entry2.name));
+        out.push(join60(slugDir, entry2.name));
       } else if (entry2.isDirectory() && entry2.name === "subagents") {
-        const subDir = join59(slugDir, entry2.name);
+        const subDir = join60(slugDir, entry2.name);
         let subs;
         try {
           subs = await readdir7(subDir, { withFileTypes: true });
@@ -35097,7 +35432,7 @@ async function collectLiveSidecars(projectsRoot) {
           continue;
         }
         for (const s of subs) {
-          if (s.isFile() && SESSION_META_RE.test(s.name)) out.push(join59(subDir, s.name));
+          if (s.isFile() && SESSION_META_RE.test(s.name)) out.push(join60(subDir, s.name));
         }
       }
     }
@@ -35109,7 +35444,7 @@ function shortId(path) {
   return base.slice(0, 8);
 }
 async function migrateAdminWebchatSidecars(opts = {}) {
-  const projectsRoot = opts.projectsRoot ?? (process.env.CLAUDE_CONFIG_DIR ? join59(process.env.CLAUDE_CONFIG_DIR, "projects") : null) ?? "";
+  const projectsRoot = opts.projectsRoot ?? (process.env.CLAUDE_CONFIG_DIR ? join60(process.env.CLAUDE_CONFIG_DIR, "projects") : null) ?? "";
   const usersFile = opts.usersFile ?? USERS_FILE;
   const accountId = opts.accountId ?? resolveAccount()?.accountId ?? null;
   const resolveName = opts.resolveName ?? defaultResolveName;
@@ -35187,7 +35522,7 @@ async function migrateAdminWebchatSidecars(opts = {}) {
 init_account();
 import { readdir as readdir8, readFile as readFile13, rename as rename6, writeFile as writeFile6, unlink as unlink5 } from "fs/promises";
 import { existsSync as existsSync51 } from "fs";
-import { join as join60 } from "path";
+import { join as join61 } from "path";
 var SESSION_META_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.meta\.json$/i;
 function projectSlugForCwd(cwd) {
   return cwd.replace(/\//g, "-");
@@ -35233,7 +35568,7 @@ async function collectSidecars(projectsRoot) {
   }
   for (const slug of slugs) {
     if (!slug.isDirectory()) continue;
-    const slugDir = join60(projectsRoot, slug.name);
+    const slugDir = join61(projectsRoot, slug.name);
     let entries2;
     try {
       entries2 = await readdir8(slugDir, { withFileTypes: true });
@@ -35242,9 +35577,9 @@ async function collectSidecars(projectsRoot) {
     }
     for (const entry2 of entries2) {
       if (entry2.isFile() && SESSION_META_RE2.test(entry2.name)) {
-        out.push({ path: join60(slugDir, entry2.name), slug: slug.name });
+        out.push({ path: join61(slugDir, entry2.name), slug: slug.name });
       } else if (entry2.isDirectory() && (entry2.name === "subagents" || entry2.name === "archive")) {
-        const subDir = join60(slugDir, entry2.name);
+        const subDir = join61(slugDir, entry2.name);
         let subs;
         try {
           subs = await readdir8(subDir, { withFileTypes: true });
@@ -35253,7 +35588,7 @@ async function collectSidecars(projectsRoot) {
         }
         for (const s of subs) {
           if (s.isFile() && SESSION_META_RE2.test(s.name)) {
-            out.push({ path: join60(subDir, s.name), slug: slug.name });
+            out.push({ path: join61(subDir, s.name), slug: slug.name });
           }
         }
       }
@@ -35262,7 +35597,7 @@ async function collectSidecars(projectsRoot) {
   return out;
 }
 async function migrateSidecarAccountIds(opts = {}) {
-  const projectsRoot = opts.projectsRoot ?? (process.env.CLAUDE_CONFIG_DIR ? join60(process.env.CLAUDE_CONFIG_DIR, "projects") : null) ?? "";
+  const projectsRoot = opts.projectsRoot ?? (process.env.CLAUDE_CONFIG_DIR ? join61(process.env.CLAUDE_CONFIG_DIR, "projects") : null) ?? "";
   const accounts = opts.accounts ?? listValidAccounts();
   const result = {
     scanned: 0,
@@ -35357,13 +35692,13 @@ var InboundHub = class {
     if (s.subscriber && s.ready) {
       if (payload.accountId !== s.accountId) this.crossAccountDelivered++;
       s.subscriber(payload);
-      s.inFlight.push({ payload, state: "drained", enqueuedAt: now, drainedAt: now });
+      s.inFlight.push({ payload, state: "drained", enqueuedAt: now, drainedAt: now, spawnUndeliveredAt: null });
       return;
     }
     if (this.subscriberAccounts(payload.senderId).some((a) => a !== payload.accountId)) {
       this.crossAccountQueued++;
     }
-    s.inFlight.push({ payload, state: "queued", enqueuedAt: now, drainedAt: null });
+    s.inFlight.push({ payload, state: "queued", enqueuedAt: now, drainedAt: null, spawnUndeliveredAt: null });
   }
   /** This account's channel server for the sender connected. Register the
    *  subscriber but do NOT drain yet — the drain waits for markReady so nothing
@@ -35422,13 +35757,16 @@ var InboundHub = class {
    *     is attached -> inbound-undelivered (the readiness handoff broke);
    *   - a still-queued message older than queuedThresholdMs with NO subscriber
    *     attached -> spawn-undelivered (the channel server never attached: spawn
-   *     failed, or the session ended and never resumed);
+   *     failed, or the session ended and never resumed). Task 2575 — reported
+   *     ONCE and RETAINED, because the gateway retries the spawn for it;
+   *   - a still-queued message with NO subscriber older than giveUpMs ->
+   *     spawn-given-up (Task 2575: the retry window closed), removed;
    *   - a drained message unacked past ackThresholdMs -> drain-undelivered (the
    *     channel server never confirmed receipt — the silent cold-start drop).
    *  Task 2290 — "a subscriber" means one attached for the SAME account, so a
    *  message waiting on its own account's cold start is not masked by another
    *  account's live subscriber on the same phone. Each message is emitted at
-   *  most once (removed when emitted). */
+   *  most once per kind; every kind but spawn-undelivered removes it. */
   sweep(now, t) {
     const events = [];
     for (const s of this.senders.values()) {
@@ -35438,9 +35776,17 @@ var InboundHub = class {
           events.push({ kind: "inbound-undelivered", accountId, senderId, waMessageId: e.payload.waMessageId, ageMs: now - e.enqueuedAt });
           return false;
         }
-        if (e.state === "queued" && !s.subscriber && now - e.enqueuedAt > t.queuedThresholdMs) {
-          events.push({ kind: "spawn-undelivered", accountId, senderId, waMessageId: e.payload.waMessageId, ageMs: now - e.enqueuedAt });
-          return false;
+        if (e.state === "queued" && !s.subscriber) {
+          const age = now - e.enqueuedAt;
+          if (age > t.giveUpMs) {
+            events.push({ kind: "spawn-given-up", accountId, senderId, waMessageId: e.payload.waMessageId, ageMs: age });
+            return false;
+          }
+          if (age > t.queuedThresholdMs && e.spawnUndeliveredAt == null) {
+            e.spawnUndeliveredAt = now;
+            events.push({ kind: "spawn-undelivered", accountId, senderId, waMessageId: e.payload.waMessageId, ageMs: age });
+          }
+          return true;
         }
         if (e.state === "drained" && e.drainedAt != null && now - e.drainedAt > t.ackThresholdMs) {
           events.push({ kind: "drain-undelivered", accountId, senderId, waMessageId: e.payload.waMessageId, ageMs: now - e.drainedAt });
@@ -35451,6 +35797,23 @@ var InboundHub = class {
     }
     return events;
   }
+  /** Task 2575 — every key holding queued work with NO subscriber whose oldest
+   *  message is older than `thresholdMs`. This is the population a refused spawn
+   *  leaves behind: the gateway's sweep re-invokes the retained spawn arguments
+   *  for each one. Read-only — it emits nothing and mutates nothing, so calling
+   *  it cannot consume a terminal event the sweep is about to report. */
+  heldSpawns(now, thresholdMs) {
+    const out = [];
+    for (const s of this.senders.values()) {
+      if (s.subscriber) continue;
+      const queued = s.inFlight.filter((e) => e.state === "queued");
+      if (queued.length === 0) continue;
+      const oldestAgeMs = Math.max(...queued.map((e) => now - e.enqueuedAt));
+      if (oldestAgeMs <= thresholdMs) continue;
+      out.push({ accountId: s.accountId, senderId: s.senderId, oldestAgeMs, count: queued.length });
+    }
+    return out;
+  }
   /** Task 2290 — every account holding a live subscriber for this phone, sorted.
    *  Read-only. Feeds the cross-account field on the inbound log line and the
    *  queued census, so a phone shared across accounts is greppable at the moment
@@ -35953,6 +36316,7 @@ init_loop_registry();
 var QUEUED_THRESHOLD_MS = 3e4;
 var ACK_THRESHOLD_MS = 3e4;
 var SWEEP_INTERVAL_MS = 15e3;
+var GIVE_UP_MS = 3e5;
 var MEDIA_STANZA_STALE_MS = 12e4;
 var WaGateway = class {
   constructor(deps) {
@@ -35974,6 +36338,14 @@ var WaGateway = class {
   // effective session account — the file-path validation scope.
   docContexts = /* @__PURE__ */ new Map();
   spawning = /* @__PURE__ */ new Set();
+  /** Task 2575 — the arguments of the last `ensureChannelSession` call per hub
+   *  key, so the sweep can re-invoke a spawn that was refused. The refusal is not
+   *  visible here — `ensureChannelSession` returns void and server/index.ts logs
+   *  and returns on the `{ error }` envelope — so the retry keys off queue state
+   *  (a queued message with no subscriber), which is the observable consequence
+   *  of the refusal. `attempts` is the per-key retry counter that rides the log
+   *  line, reset whenever a fresh inbound takes the spawn path. */
+  heldSpawnArgs = /* @__PURE__ */ new Map();
   seq = 0;
   // Task 2110 — senderId -> the arrival ms of every still-unemitted non-audio
   // media stanza for that sender, oldest first. This is the race window: a reply
@@ -36110,7 +36482,8 @@ var WaGateway = class {
   reconcile(now) {
     const events = this.hub.sweep(now, {
       queuedThresholdMs: QUEUED_THRESHOLD_MS,
-      ackThresholdMs: ACK_THRESHOLD_MS
+      ackThresholdMs: ACK_THRESHOLD_MS,
+      giveUpMs: GIVE_UP_MS
     });
     for (const e of events) {
       console.error(
@@ -36132,6 +36505,53 @@ var WaGateway = class {
     );
     return events;
   }
+  /** Task 2575 — re-invoke the retained spawn for every key holding queued work
+   *  with no channel server attached. Driven by startSweeper() beside reconcile();
+   *  called directly with an injected clock in tests. Returns the number of
+   *  ensureChannelSession calls made.
+   *
+   *  This is the missing action behind `op=spawn-undelivered`. Before it, that
+   *  line was emitted and nothing consumed it: on 2026-08-08 it fired for wa-1 at
+   *  ageMs=37743 and the message was never delivered.
+   *
+   *  A retry while auth is still dead re-enters the same refusal and returns; the
+   *  cost is one refusal line plus one op=spawn-retry line per key per sweep,
+   *  bounded by the hub's 5-minute give-up. */
+  async retryHeldSpawns(now) {
+    const held = this.hub.heldSpawns(now, QUEUED_THRESHOLD_MS);
+    let calls = 0;
+    for (const h of held) {
+      const key2 = hubKey(h.accountId, h.senderId);
+      if (this.spawning.has(key2)) continue;
+      const entry2 = this.heldSpawnArgs.get(key2);
+      if (!entry2) {
+        console.error(
+          `[whatsapp-native] op=spawn-retry-skipped senderId=${h.senderId} accountId=${h.accountId} ageMs=${h.oldestAgeMs} queued=${h.count} reason=no-args`
+        );
+        continue;
+      }
+      entry2.attempts++;
+      this.spawning.add(key2);
+      calls++;
+      try {
+        await this.deps.ensureChannelSession(entry2.args);
+        console.error(
+          `[whatsapp-native] op=spawn-retry senderId=${h.senderId} accountId=${h.accountId} attempt=${entry2.attempts} ageMs=${h.oldestAgeMs} queued=${h.count} ok=true`
+        );
+      } catch (err) {
+        console.error(
+          `[whatsapp-native] op=spawn-retry senderId=${h.senderId} accountId=${h.accountId} attempt=${entry2.attempts} ageMs=${h.oldestAgeMs} queued=${h.count} ok=false reason=${err instanceof Error ? err.message : String(err)}`
+        );
+      } finally {
+        this.spawning.delete(key2);
+      }
+    }
+    const heldKeys = new Set(held.map((h) => hubKey(h.accountId, h.senderId)));
+    for (const k of [...this.heldSpawnArgs.keys()]) {
+      if (!heldKeys.has(k) && !this.spawning.has(k)) this.heldSpawnArgs.delete(k);
+    }
+    return calls;
+  }
   /** Arm the periodic reconciliation sweep in the long-lived UI process.
    *
    *  Task 1814 — armed through the registry, so it appears on /activity. This
@@ -36149,9 +36569,14 @@ var WaGateway = class {
     return registerLoop({
       name: "whatsapp-native-sweep",
       intervalMs,
-      run: () => {
-        const events = this.reconcile(Date.now());
-        return events.length > 0 ? `${events.length} terminal events` : void 0;
+      run: async () => {
+        const now = Date.now();
+        const events = this.reconcile(now);
+        const retried = await this.retryHeldSpawns(now);
+        const parts = [];
+        if (events.length > 0) parts.push(`${events.length} terminal events`);
+        if (retried > 0) parts.push(`${retried} spawn retries`);
+        return parts.length > 0 ? parts.join(", ") : void 0;
       }
     });
   }
@@ -36259,33 +36684,35 @@ var WaGateway = class {
       console.error(
         `[whatsapp-native] op=spawn-trigger senderId=${senderId} accountId=${input.effectiveAccountId}`
       );
+      const spawnArgs = {
+        accountId: input.accountId,
+        effectiveAccountId: input.effectiveAccountId,
+        senderId,
+        role: input.role ?? "admin",
+        personId: input.personId ?? null,
+        gatewayUrl: this.deps.gatewayUrl,
+        serverPath: this.deps.serverPath,
+        // Task 1575 — the gate's owner-self verdict; drives owner attribution
+        // for an unbound owner self-phone at the spawn site.
+        ownerSelfPhone: input.ownerSelfPhone,
+        // Task 2262 — resolved once in onMessage; its presence routes this
+        // spawn to /public-spawn under the named public agent.
+        publicAgentSlug: input.publicAgentSlug,
+        // Task 2281 — the correlation id, so the spawn outcome lines join the
+        // rest of this inbound's lifeline. Only this call site takes it: the
+        // passive branch above never reaches the public spawn, which is where
+        // op=spawn-ok and op=spawn-failed are emitted.
+        inboundId: input.inboundId,
+        // Task 2234 — the registered-party label, forwarded verbatim so the
+        // spawn env carries WA_SENDER_PARTY. Undefined for every other sender.
+        // Only this call site takes it: the passive branch above hardcodes
+        // role:'admin', and a registered party is public, so the combination
+        // cannot arise there.
+        party: input.party
+      };
+      this.heldSpawnArgs.set(spawnKey, { args: spawnArgs, attempts: 0 });
       try {
-        await this.deps.ensureChannelSession({
-          accountId: input.accountId,
-          effectiveAccountId: input.effectiveAccountId,
-          senderId,
-          role: input.role ?? "admin",
-          personId: input.personId ?? null,
-          gatewayUrl: this.deps.gatewayUrl,
-          serverPath: this.deps.serverPath,
-          // Task 1575 — the gate's owner-self verdict; drives owner attribution
-          // for an unbound owner self-phone at the spawn site.
-          ownerSelfPhone: input.ownerSelfPhone,
-          // Task 2262 — resolved once in onMessage; its presence routes this
-          // spawn to /public-spawn under the named public agent.
-          publicAgentSlug: input.publicAgentSlug,
-          // Task 2281 — the correlation id, so the spawn outcome lines join the
-          // rest of this inbound's lifeline. Only this call site takes it: the
-          // passive branch above never reaches the public spawn, which is where
-          // op=spawn-ok and op=spawn-failed are emitted.
-          inboundId: input.inboundId,
-          // Task 2234 — the registered-party label, forwarded verbatim so the
-          // spawn env carries WA_SENDER_PARTY. Undefined for every other sender.
-          // Only this call site takes it: the passive branch above hardcodes
-          // role:'admin', and a registered party is public, so the combination
-          // cannot arise there.
-          party: input.party
-        });
+        await this.deps.ensureChannelSession(spawnArgs);
       } finally {
         this.spawning.delete(spawnKey);
       }
@@ -36813,8 +37240,41 @@ function createWebchatChannelRoutes(deps) {
 }
 
 // app/lib/webchat/gateway/resolve-turn-answer.ts
-import { existsSync as existsSync52, openSync as openSync9, readSync as readSync8, closeSync as closeSync9, readdirSync as readdirSync31 } from "fs";
-import { join as join61 } from "path";
+import { existsSync as existsSync52, openSync as openSync9, readSync as readSync8, closeSync as closeSync9, readdirSync as readdirSync32 } from "fs";
+import { join as join62 } from "path";
+
+// app/lib/channel-delivery/outbound-guard.ts
+var INTERNAL_LEAK_PATTERNS = [
+  { name: "task-id", re: /\bTasks?[\s-]+\d{2,4}\b/g },
+  { name: "media-path", re: /\/tmp\/maxy-media[A-Za-z0-9_./-]*/g },
+  { name: "repo-path", re: /\bplatform\/[A-Za-z0-9_./-]+/g },
+  { name: "bundle", re: /\bserver\.(?:js|cjs|mjs)\b/g },
+  { name: "source-file", re: /\b[A-Za-z0-9_-]+\.tsx?\b/g },
+  { name: "log-tag", re: /\[[a-z]+(?:-[a-z]+)+\]/g },
+  { name: "op-tag", re: /\bop=[a-z][a-z-]*\b/g }
+];
+function redactInternalLeaks(text) {
+  const redactions = [];
+  let clean = text;
+  for (const { name, re } of INTERNAL_LEAK_PATTERNS) {
+    clean = clean.replace(re, (m) => {
+      redactions.push({ pattern: name, match: m });
+      return "[redacted]";
+    });
+  }
+  return { clean, redactions };
+}
+function guardOutbound(senderId, text) {
+  const { clean, redactions } = redactInternalLeaks(text);
+  for (const r of redactions) {
+    console.error(
+      `[channel-guard] op=redact senderId=${senderId} pattern=${r.pattern} bytes=${Buffer.byteLength(r.match, "utf8")}`
+    );
+  }
+  return clean;
+}
+
+// app/lib/webchat/gateway/resolve-turn-answer.ts
 function resolveTurnAnswer(p) {
   if (!SESSION_ID_RE2.test(p.sessionId)) return "";
   const path = findJsonl(p.projectsRoot, p.sessionId);
@@ -36839,18 +37299,18 @@ function resolveTurnAnswer(p) {
   for (const turn of turns) {
     if (turn.kind === "agent-webchat-final" || turn.kind === "agent-reply") parts.push(turn.text);
   }
-  return segmentText(parts.join("\n\n")).join("\n\n");
+  return segmentText(guardOutbound(p.senderId, parts.join("\n\n"))).join("\n\n");
 }
 function findJsonl(projectsRoot, sessionId) {
   if (!existsSync52(projectsRoot)) return null;
   let slugs;
   try {
-    slugs = readdirSync31(projectsRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+    slugs = readdirSync32(projectsRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
   } catch {
     return null;
   }
   for (const slug of slugs) {
-    const live = join61(projectsRoot, slug, `${sessionId}.jsonl`);
+    const live = join62(projectsRoot, slug, `${sessionId}.jsonl`);
     if (existsSync52(live)) return live;
   }
   return null;
@@ -36998,7 +37458,7 @@ var WebchatGateway = class _WebchatGateway {
     if (rec) rec.lastActivityAt = Date.now();
     const awaiter = this.replyAwaiters.get(key2);
     const projectsRoot = this.deps.publicProjectsRoot?.() ?? "";
-    const text = projectsRoot ? resolveTurnAnswer({ ...turn, projectsRoot }) : "";
+    const text = projectsRoot ? resolveTurnAnswer({ ...turn, senderId: keyDisplay(key2), projectsRoot }) : "";
     const bytes = Buffer.byteLength(text, "utf8");
     const deliveredAt = this.lastDeliveredAt.get(key2);
     const latency = deliveredAt != null ? Date.now() - deliveredAt : -1;
@@ -37493,37 +37953,6 @@ var AnswerAccumulator = class {
   }
 };
 
-// app/lib/channel-delivery/outbound-guard.ts
-var INTERNAL_LEAK_PATTERNS = [
-  { name: "task-id", re: /\bTasks?[\s-]+\d{2,4}\b/g },
-  { name: "media-path", re: /\/tmp\/maxy-media[A-Za-z0-9_./-]*/g },
-  { name: "repo-path", re: /\bplatform\/[A-Za-z0-9_./-]+/g },
-  { name: "bundle", re: /\bserver\.(?:js|cjs|mjs)\b/g },
-  { name: "source-file", re: /\b[A-Za-z0-9_-]+\.tsx?\b/g },
-  { name: "log-tag", re: /\[[a-z]+(?:-[a-z]+)+\]/g },
-  { name: "op-tag", re: /\bop=[a-z][a-z-]*\b/g }
-];
-function redactInternalLeaks(text) {
-  const redactions = [];
-  let clean = text;
-  for (const { name, re } of INTERNAL_LEAK_PATTERNS) {
-    clean = clean.replace(re, (m) => {
-      redactions.push({ pattern: name, match: m });
-      return "[redacted]";
-    });
-  }
-  return { clean, redactions };
-}
-function guardOutbound(senderId, text) {
-  const { clean, redactions } = redactInternalLeaks(text);
-  for (const r of redactions) {
-    console.error(
-      `[channel-guard] op=redact senderId=${senderId} pattern=${r.pattern} bytes=${Buffer.byteLength(r.match, "utf8")}`
-    );
-  }
-  return clean;
-}
-
 // app/lib/channel-delivery/emitter.ts
 function followerPendingMaxMs() {
   return Number(process.env.CHANNEL_PTY_FOLLOWER_PENDING_MAX_MS ?? String(3e5));
@@ -37865,14 +38294,14 @@ function makeFileDelivery(opts) {
 }
 
 // app/lib/webchat/file-delivery.ts
-var TAG60 = "[webchat-adaptor]";
+var TAG61 = "[webchat-adaptor]";
 function platformRoot2() {
   return process.env.MAXY_PLATFORM_ROOT || "";
 }
 function makeWebchatSendFile(entry2) {
   return async (filePath) => {
     if (!entry2.accountId) {
-      console.error(`${TAG60} file-delivery reject reason=no-account sender=${entry2.senderId}`);
+      console.error(`${TAG61} file-delivery reject reason=no-account sender=${entry2.senderId}`);
       return { ok: false, error: "no-account" };
     }
     const accountDir = resolve47(platformRoot2(), "..", "data/accounts", entry2.accountId);
@@ -37880,14 +38309,14 @@ function makeWebchatSendFile(entry2) {
       const resolved = realpathSync9(filePath);
       const accountResolved = realpathSync9(accountDir);
       if (!resolved.startsWith(accountResolved + "/")) {
-        console.error(`${TAG60} file-delivery reject reason=outside_account_directory sender=${entry2.senderId}`);
+        console.error(`${TAG61} file-delivery reject reason=outside_account_directory sender=${entry2.senderId}`);
         return { ok: false, error: "outside-account" };
       }
       return { ok: true };
     } catch (err) {
       const code = err.code;
       console.error(
-        `${TAG60} file-delivery reject reason=${code === "ENOENT" ? "not-found" : "path-error"} sender=${entry2.senderId}`
+        `${TAG61} file-delivery reject reason=${code === "ENOENT" ? "not-found" : "path-error"} sender=${entry2.senderId}`
       );
       return { ok: false, error: code === "ENOENT" ? "not-found" : "path-error" };
     }
@@ -37896,7 +38325,7 @@ function makeWebchatSendFile(entry2) {
 function makeWebchatFileDelivery(entry2) {
   return makeFileDelivery({
     entry: entry2,
-    tag: TAG60,
+    tag: TAG61,
     channel: "webchat",
     sendFile: makeWebchatSendFile(entry2),
     deferUntilVerdict: true
@@ -37976,7 +38405,7 @@ function buildPublicWebchatSpawnRequest(input) {
 }
 
 // app/lib/whatsapp/inbound/file-delivery-bridge.ts
-var TAG61 = "[whatsapp-adaptor]";
+var TAG62 = "[whatsapp-adaptor]";
 var SEND_USER_FILE2 = "SendUserFile";
 var WHATSAPP_SEND_DOCUMENT = "whatsapp-send-document";
 function platformRoot3() {
@@ -37994,7 +38423,7 @@ function makeWhatsAppSendFile(entry2, maxyAccountId) {
     });
     if (result.ok) return { ok: true };
     console.error(
-      `${TAG61} file-delivery reject reason=send-failed sender=${entry2.senderId} status=${result.status} message=${result.error}`
+      `${TAG62} file-delivery reject reason=send-failed sender=${entry2.senderId} status=${result.status} message=${result.error}`
     );
     return { ok: false, error: result.error };
   };
@@ -38002,7 +38431,7 @@ function makeWhatsAppSendFile(entry2, maxyAccountId) {
 function makeWhatsAppFileDelivery(entry2, maxyAccountId) {
   const shared = makeFileDelivery({
     entry: entry2,
-    tag: TAG61,
+    tag: TAG62,
     channel: "whatsapp",
     sendFile: makeWhatsAppSendFile(entry2, maxyAccountId)
   });
@@ -38037,7 +38466,7 @@ function makeWhatsAppFileDelivery(entry2, maxyAccountId) {
         if (!delivered) {
           const fileField = call.filePath !== void 0 ? ` file=${call.filePath}` : "";
           console.error(
-            `${TAG61} file-delivery-unreconciled sender=${entry2.senderId} sessionId=${sid} tool=${WHATSAPP_SEND_DOCUMENT}${fileField}`
+            `${TAG62} file-delivery-unreconciled sender=${entry2.senderId} sessionId=${sid} tool=${WHATSAPP_SEND_DOCUMENT}${fileField}`
           );
         }
       }
@@ -38129,21 +38558,22 @@ function startNativeFileFollower(input) {
 }
 
 // app/lib/channel-delivery/follower-registry.ts
-function createFollowerRegistry(start) {
+function createFollowerRegistry(start, keyOf2 = (p) => p.senderId) {
   const controllers = /* @__PURE__ */ new Map();
   const params = /* @__PURE__ */ new Map();
   return {
     attach(p) {
-      controllers.get(p.senderId)?.abort();
-      params.set(p.senderId, p);
+      const doorId = keyOf2(p);
+      controllers.get(doorId)?.abort();
+      params.set(doorId, p);
       let ac;
       ac = start(p, () => {
-        if (controllers.get(p.senderId) === ac) controllers.delete(p.senderId);
+        if (controllers.get(doorId) === ac) controllers.delete(doorId);
       });
-      controllers.set(p.senderId, ac);
+      controllers.set(doorId, ac);
     },
     live: () => [...controllers.keys()],
-    paramsFor: (senderId) => params.get(senderId) ?? null
+    paramsFor: (doorId) => params.get(doorId) ?? null
   };
 }
 
@@ -38156,41 +38586,79 @@ var id82 = (s) => s.slice(0, 8);
 function followerCensusTick(deps, state = makeCensusState()) {
   const bound = deps.bound();
   const live = new Set(deps.live());
-  for (const senderId of live) state.attempts.delete(senderId);
-  const missing = bound.filter((senderId) => !live.has(senderId));
+  const label = deps.label ?? id82;
+  for (const doorId of live) state.attempts.delete(doorId);
+  const missing = bound.filter((doorId) => !live.has(doorId));
   console.error(
-    `[channel-follower] op=follower-census channel=${deps.channel} bound=${bound.length} attached=${live.size} missing=${missing.length} missingSenders=${missing.map(id82).join(",") || "none"}`
+    `[channel-follower] op=follower-census channel=${deps.channel} bound=${bound.length} attached=${live.size} missing=${missing.length} missingSenders=${missing.map(label).join(",") || "none"}`
   );
-  for (const senderId of missing) {
-    const used = state.attempts.get(senderId) ?? 0;
+  for (const doorId of missing) {
+    const used = state.attempts.get(doorId) ?? 0;
     if (used >= CENSUS_MAX_REATTEMPTS) {
       console.error(
-        `[channel-follower] op=follower-reattach channel=${deps.channel} sessionId=${id82(deps.paramsFor(senderId)?.sessionId ?? "none")} senderId=${id82(senderId)} outcome=skipped reason=reattach-exhausted attempts=${used}`
+        `[channel-follower] op=follower-reattach channel=${deps.channel} sessionId=${id82(deps.paramsFor(doorId)?.sessionId ?? "none")} senderId=${label(doorId)} outcome=skipped reason=reattach-exhausted attempts=${used}`
       );
       continue;
     }
-    const p = deps.paramsFor(senderId);
+    const p = deps.paramsFor(doorId);
     if (!p) {
       console.error(
-        `[channel-follower] op=follower-reattach channel=${deps.channel} sessionId=none senderId=${id82(senderId)} outcome=failed reason=no-attach-params`
+        `[channel-follower] op=follower-reattach channel=${deps.channel} sessionId=none senderId=${label(doorId)} outcome=failed reason=no-attach-params`
       );
       continue;
     }
     try {
-      state.attempts.set(senderId, used + 1);
+      state.attempts.set(doorId, used + 1);
       deps.attach(p);
       console.error(
-        `[channel-follower] op=follower-reattach channel=${deps.channel} sessionId=${id82(p.sessionId)} senderId=${id82(p.senderId)} outcome=attached reason=none`
+        `[channel-follower] op=follower-reattach channel=${deps.channel} sessionId=${id82(p.sessionId)} senderId=${label(doorId)} outcome=attached reason=none`
       );
     } catch (err) {
       console.error(
-        `[channel-follower] op=follower-reattach channel=${deps.channel} sessionId=${id82(p.sessionId)} senderId=${id82(p.senderId)} outcome=failed reason=${err instanceof Error ? err.message : String(err)}`
+        `[channel-follower] op=follower-reattach channel=${deps.channel} sessionId=${id82(p.sessionId)} senderId=${label(doorId)} outcome=failed reason=${err instanceof Error ? err.message : String(err)}`
       );
     }
   }
   return `${deps.channel}: ${bound.length} door(s), ${missing.length} without a reader`;
 }
 
+// app/lib/channel-delivery/whatsapp-door.ts
+function whatsappDoorId(p) {
+  return hubKey(p.effectiveAccountId, p.senderId);
+}
+function whatsappDoorLabel(doorId) {
+  const [decoded] = decodeHubKeys([doorId]);
+  return decoded ? `${id82(decoded.accountId)}:${id82(decoded.senderId)}` : id82(doorId);
+}
+
+// app/lib/channel-delivery/refusal-notice.ts
+var TAG63 = "[channel-delivery]";
+var notified = /* @__PURE__ */ new Set();
+function refusalNoticeText(reason) {
+  return reason === "claude-auth-dead" ? "Your message arrived but no assistant could be started: the Claude sign-in on this install is not active. An operator has to sign in again; send this again once they have." : `Your message arrived but no assistant could be started (${reason}). Nothing was lost; try again shortly.`;
+}
+async function sendRefusalNotice(input) {
+  if (notified.has(input.doorId)) return;
+  const fields = `channel=${input.channel} sender=${input.sender} reason=${input.reason}`;
+  if (!input.send) {
+    console.error(`${TAG63} op=refusal-notice-failed ${fields} error=no-target`);
+    return;
+  }
+  try {
+    await input.send(guardOutbound(input.sender, refusalNoticeText(input.reason)));
+  } catch (e) {
+    console.error(
+      `${TAG63} op=refusal-notice-failed ${fields} error=${e instanceof Error ? e.message : String(e)}`
+    );
+    return;
+  }
+  notified.add(input.doorId);
+  console.error(`${TAG63} op=refusal-notice ${fields} status=${input.status}`);
+}
+function clearRefusalNotice(doorId) {
+  notified.delete(doorId);
+}
+
 // app/lib/telegram/gateway/inbound-hub.ts
 var InboundHub3 = class {
   keys = /* @__PURE__ */ new Map();
@@ -38211,9 +38679,9 @@ var InboundHub3 = class {
     const s = this.state(payload.key);
     if (s.subscriber && s.ready) {
       s.subscriber(payload);
-      s.inFlight.push({ payload, state: "drained", enqueuedAt: now, drainedAt: now });
+      s.inFlight.push({ payload, state: "drained", enqueuedAt: now, drainedAt: now, spawnUndeliveredAt: null });
     } else {
-      s.inFlight.push({ payload, state: "queued", enqueuedAt: now, drainedAt: null });
+      s.inFlight.push({ payload, state: "queued", enqueuedAt: now, drainedAt: null, spawnUndeliveredAt: null });
     }
   }
   /** A key's channel server connected. Register the subscriber but do NOT
@@ -38273,9 +38741,18 @@ var InboundHub3 = class {
    *  that never reached the agent:
    *   - a still-queued message older than queuedThresholdMs WHILE a subscriber
    *     is attached -> inbound-undelivered (the readiness handoff broke);
+   *   - a still-queued message older than queuedThresholdMs with NO subscriber
+   *     attached -> spawn-undelivered (the channel server never attached: the
+   *     spawn was refused, or the session ended and never resumed). Task 2575 —
+   *     this case did not exist on this door at all before, which is why tg-1
+   *     survived the 2026-08-08 outage unreported. Reported ONCE and RETAINED,
+   *     because the gateway retries the spawn for it;
+   *   - a still-queued message with NO subscriber older than giveUpMs ->
+   *     spawn-given-up (Task 2575: the retry window closed), removed;
    *   - a drained message unacked past ackThresholdMs -> drain-undelivered (the
    *     channel server never confirmed receipt — the silent cold-start drop).
-   *  Each message is emitted at most once (removed when emitted). */
+   *  Each message is emitted at most once per kind; every kind but
+   *  spawn-undelivered removes it. */
   sweep(now, t) {
     const events = [];
     for (const [key2, s] of this.keys) {
@@ -38284,6 +38761,18 @@ var InboundHub3 = class {
           events.push({ kind: "inbound-undelivered", key: key2, messageId: e.payload.messageId, ageMs: now - e.enqueuedAt });
           return false;
         }
+        if (e.state === "queued" && !s.subscriber) {
+          const age = now - e.enqueuedAt;
+          if (age > t.giveUpMs) {
+            events.push({ kind: "spawn-given-up", key: key2, messageId: e.payload.messageId, ageMs: age });
+            return false;
+          }
+          if (age > t.queuedThresholdMs && e.spawnUndeliveredAt == null) {
+            e.spawnUndeliveredAt = now;
+            events.push({ kind: "spawn-undelivered", key: key2, messageId: e.payload.messageId, ageMs: age });
+          }
+          return true;
+        }
         if (e.state === "drained" && e.drainedAt != null && now - e.drainedAt > t.ackThresholdMs) {
           events.push({ kind: "drain-undelivered", key: key2, messageId: e.payload.messageId, ageMs: now - e.drainedAt });
           return false;
@@ -38293,6 +38782,23 @@ var InboundHub3 = class {
     }
     return events;
   }
+  /** Task 2575 — every key holding queued work with NO subscriber whose oldest
+   *  message is older than `thresholdMs`. The gateway's sweep re-invokes the
+   *  retained spawn arguments for each one. Read-only — it emits nothing and
+   *  mutates nothing, so calling it cannot consume a terminal event the sweep is
+   *  about to report. */
+  heldSpawns(now, thresholdMs) {
+    const out = [];
+    for (const [key2, s] of this.keys) {
+      if (s.subscriber) continue;
+      const queued = s.inFlight.filter((e) => e.state === "queued");
+      if (queued.length === 0) continue;
+      const oldestAgeMs = Math.max(...queued.map((e) => now - e.enqueuedAt));
+      if (oldestAgeMs <= thresholdMs) continue;
+      out.push({ key: key2, oldestAgeMs, count: queued.length });
+    }
+    return out;
+  }
   /** Whether a key currently has a live channel server attached. The gateway
    *  uses this to decide whether an inbound needs a cold-start spawn/resume. */
   hasSubscriber(key2) {
@@ -38466,6 +38972,7 @@ init_loop_registry();
 var QUEUED_THRESHOLD_MS3 = 3e4;
 var ACK_THRESHOLD_MS3 = 3e4;
 var SWEEP_INTERVAL_MS3 = 15e3;
+var GIVE_UP_MS2 = 3e5;
 function telegramSubjectSessionId(input) {
   if (input.role === "admin") {
     const adminUserId = input.adminUserId ?? void 0;
@@ -38479,16 +38986,6 @@ var TelegramGateway = class {
   }
   hub = new InboundHub3();
   replies = /* @__PURE__ */ new Map();
-  /** Task 2559 — the keys whose last inbound was `role:'admin'`. The follower
-   *  census's bound set is the doors that SHOULD have a reader, and a public
-   *  Telegram session is given none by design: the public branch of
-   *  `buildTelegramEnsureSession` returns before the attach block, because the
-   *  file follower is an admin surface. Including a public key would report it
-   *  missing on every tick for ever and stop `missing=` ever reaching zero,
-   *  which is the one signal the census exists to give. Removed on a public
-   *  inbound, because the role is read from account config on every inbound and
-   *  a bot can be flipped between the two. */
-  adminKeys = /* @__PURE__ */ new Set();
   spawning = /* @__PURE__ */ new Set();
   /** Task 2428 — keys whose channel server signalled ready while their spawn was
    *  still in flight. The harness discards a channel notification that arrives
@@ -38499,6 +38996,14 @@ var TelegramGateway = class {
    *  `resume-bound`. Holding the signal here rather than draining leaves
    *  `hub.ready` false, so every message in the window queues and none is lost. */
   readyWhileSpawning = /* @__PURE__ */ new Set();
+  /** Task 2575 — the arguments of the last `ensureChannelSession` call per key,
+   *  so the sweep can re-invoke a spawn that was refused. The refusal is not
+   *  visible here — `ensureChannelSession` returns void and the refusal sites in
+   *  server/telegram-ensure-session.ts log and return — so the retry keys off
+   *  queue state, the observable consequence of the refusal. `attempts` is the
+   *  per-key retry counter that rides the log line, reset whenever a fresh
+   *  inbound takes the spawn path. */
+  heldSpawnArgs = /* @__PURE__ */ new Map();
   seq = 0;
   /** Hono sub-app exposing the loopback channel routes; mount on the UI app. */
   routes() {
@@ -38545,7 +39050,8 @@ var TelegramGateway = class {
   reconcile(now) {
     const events = this.hub.sweep(now, {
       queuedThresholdMs: QUEUED_THRESHOLD_MS3,
-      ackThresholdMs: ACK_THRESHOLD_MS3
+      ackThresholdMs: ACK_THRESHOLD_MS3,
+      giveUpMs: GIVE_UP_MS2
     });
     for (const e of events) {
       console.error(
@@ -38554,6 +39060,49 @@ var TelegramGateway = class {
     }
     return events;
   }
+  /** Task 2575 — re-invoke the retained spawn for every key holding queued work
+   *  with no channel server attached. Driven by startSweeper() beside reconcile();
+   *  called directly with an injected clock in tests. Returns the number of
+   *  ensureChannelSession calls made.
+   *
+   *  This door kept its held message across the 2026-08-08 outage but still
+   *  waited 4m41s for it, because the drain fires only when a later inbound
+   *  spawns successfully. This is the trigger that removes that wait. */
+  async retryHeldSpawns(now) {
+    const held = this.hub.heldSpawns(now, QUEUED_THRESHOLD_MS3);
+    let calls = 0;
+    for (const h of held) {
+      if (this.spawning.has(h.key)) continue;
+      const entry2 = this.heldSpawnArgs.get(h.key);
+      if (!entry2) {
+        console.error(
+          `[telegram-native] op=spawn-retry-skipped key=${h.key} ageMs=${h.oldestAgeMs} queued=${h.count} reason=no-args`
+        );
+        continue;
+      }
+      entry2.attempts++;
+      this.spawning.add(h.key);
+      calls++;
+      try {
+        await this.deps.ensureChannelSession(entry2.args);
+        console.error(
+          `[telegram-native] op=spawn-retry key=${h.key} attempt=${entry2.attempts} ageMs=${h.oldestAgeMs} queued=${h.count} ok=true`
+        );
+      } catch (err) {
+        console.error(
+          `[telegram-native] op=spawn-retry key=${h.key} attempt=${entry2.attempts} ageMs=${h.oldestAgeMs} queued=${h.count} ok=false reason=${err instanceof Error ? err.message : String(err)}`
+        );
+      } finally {
+        this.spawning.delete(h.key);
+        if (this.readyWhileSpawning.delete(h.key)) this.drain(h.key);
+      }
+    }
+    const heldKeys = new Set(held.map((h) => h.key));
+    for (const k of [...this.heldSpawnArgs.keys()]) {
+      if (!heldKeys.has(k) && !this.spawning.has(k)) this.heldSpawnArgs.delete(k);
+    }
+    return calls;
+  }
   /** Arm the periodic reconciliation sweep in the long-lived UI process.
    *
    *  Task 1814 — armed through the registry, so it appears on /activity. This
@@ -38571,9 +39120,14 @@ var TelegramGateway = class {
     return registerLoop({
       name: "telegram-native-sweep",
       intervalMs,
-      run: () => {
-        const events = this.reconcile(Date.now());
-        return events.length > 0 ? `${events.length} terminal events` : void 0;
+      run: async () => {
+        const now = Date.now();
+        const events = this.reconcile(now);
+        const retried = await this.retryHeldSpawns(now);
+        const parts = [];
+        if (events.length > 0) parts.push(`${events.length} terminal events`);
+        if (retried > 0) parts.push(`${retried} spawn retries`);
+        return parts.length > 0 ? parts.join(", ") : void 0;
       }
     });
   }
@@ -38600,8 +39154,6 @@ var TelegramGateway = class {
     const willDeliverNow = this.hub.isReady(key2);
     const source = input.source ?? "user";
     this.replies.set(key2, input.reply);
-    if (input.role === "admin") this.adminKeys.add(key2);
-    else this.adminKeys.delete(key2);
     let standingRules;
     if (input.role === "admin" && this.deps.fetchStandingRules) {
       const res = await this.deps.fetchStandingRules(input.accountId);
@@ -38634,25 +39186,36 @@ var TelegramGateway = class {
     console.error(
       `[telegram-native] op=inbound key=${key2} botId=${input.botId} accountId=${input.accountId} role=${input.role} agent=${input.agentSlug} bytes=${bytes} source=${source} delivery=${willDeliverNow ? "immediate" : "queued"} sessionId=${resolvedSessionId}`
     );
+    try {
+      if (source === "user") {
+        this.deps.sendChatAction?.({ botToken: input.botToken, chatId: input.chatId, key: key2 });
+      }
+    } catch (err) {
+      console.error(
+        `[telegram-native] op=chat-action key=${key2} site=inbound ok=false reason=${err instanceof Error ? err.message : String(err)}`
+      );
+    }
     if (!hadSubscriber && !this.spawning.has(key2)) {
       this.spawning.add(key2);
       console.error(`[telegram-native] op=spawn-trigger key=${key2} botId=${input.botId} role=${input.role}`);
       noteSpawnAttempt2(input.botId);
+      const spawnArgs = {
+        accountId: input.accountId,
+        accountDir: input.accountDir,
+        botId: input.botId,
+        botToken: input.botToken,
+        agentSlug: input.agentSlug,
+        channelKey: key2,
+        senderId: input.senderId,
+        role: input.role,
+        personId: input.personId ?? null,
+        chatId: input.chatId,
+        gatewayUrl: this.deps.gatewayUrl,
+        serverPath: this.deps.serverPath
+      };
+      this.heldSpawnArgs.set(key2, { args: spawnArgs, attempts: 0 });
       try {
-        await this.deps.ensureChannelSession({
-          accountId: input.accountId,
-          accountDir: input.accountDir,
-          botId: input.botId,
-          botToken: input.botToken,
-          agentSlug: input.agentSlug,
-          channelKey: key2,
-          senderId: input.senderId,
-          role: input.role,
-          personId: input.personId ?? null,
-          chatId: input.chatId,
-          gatewayUrl: this.deps.gatewayUrl,
-          serverPath: this.deps.serverPath
-        });
+        await this.deps.ensureChannelSession(spawnArgs);
       } finally {
         this.spawning.delete(key2);
         if (this.readyWhileSpawning.delete(key2)) this.drain(key2);
@@ -38667,17 +39230,21 @@ var TelegramGateway = class {
   liveReplyTarget(key2) {
     return this.replies.get(key2) ?? null;
   }
-  /** Task 2559 — every admin door this gateway currently holds a live delivery
-   *  closure for, as the `<botId>:<senderId>` channel key the follower registry
-   *  keys on. The twin of `WaGateway.boundTargets()`: the census reconciles
-   *  against exactly this set, so "should have a reader" and "can be sent to"
-   *  are one fact and cannot drift. A key `parseTelegramChannelKey` rejects is
-   *  the pre-2368 bare-sender shape, skipped rather than halved at an arbitrary
-   *  offset, which would yield a door id nothing keys on. */
+  /** Task 2559 — every door this gateway currently holds a live delivery closure
+   *  for, as the `<botId>:<senderId>` channel key the follower registry keys on.
+   *  The twin of `WaGateway.boundTargets()`: the census reconciles against
+   *  exactly this set, so "should have a reader" and "can be sent to" are one
+   *  fact and cannot drift. A key `parseTelegramChannelKey` rejects is the
+   *  pre-2368 bare-sender shape, skipped rather than halved at an arbitrary
+   *  offset, which would yield a door id nothing keys on.
+   *
+   *  Task 2541 — every role, not admin only. 2559 filtered public keys out of
+   *  this set because a public session was given no reader; it has one now, so
+   *  the filter would hide the door instead of the absence. That is what it did:
+   *  `bound=1 attached=1 missing=0` printed on every tick while a public
+   *  visitor's answer reached no chat at all. */
   boundTargets() {
-    return [...this.replies.keys()].filter(
-      (key2) => this.adminKeys.has(key2) && parseTelegramChannelKey(key2) !== null
-    );
+    return [...this.replies.keys()].filter((key2) => parseTelegramChannelKey(key2) !== null);
   }
   async sendOutbound(key2, text) {
     const reply = this.replies.get(key2);
@@ -38719,7 +39286,7 @@ function buildTelegramSpawnRequest(input) {
 }
 
 // server/telegram-ensure-session.ts
-var TAG62 = "[telegram-inbound]";
+var TAG64 = "[telegram-inbound]";
 function buildTelegramEnsureSession(deps) {
   return async (input) => {
     const req = buildTelegramSpawnRequest({
@@ -38733,6 +39300,18 @@ function buildTelegramEnsureSession(deps) {
       // Task 1789 — admin rows only; see the WhatsApp twin.
       overrideSessionId: input.role === "admin" ? deps.resolveSessionOverride(input.accountId, input.channelKey) : null
     });
+    const notifySend = async (text) => {
+      const sent = await deps.sendText(input.botToken, Number(input.chatId), text);
+      if (!sent.ok) throw new Error(sent.error ?? "send failed");
+    };
+    const notifyRefused = (result2) => sendRefusalNotice({
+      channel: "telegram",
+      doorId: req.channelKey,
+      sender: req.channelKey,
+      reason: result2.error,
+      status: result2.status,
+      send: notifySend
+    });
     if (input.role === "public") {
       const result2 = await deps.managerRcSpawn({
         senderId: req.channelKey,
@@ -38750,15 +39329,24 @@ function buildTelegramEnsureSession(deps) {
           `[telegram-native] op=spawn-failed botId=${input.botId} key=${req.channelKey} role=public agent=${input.agentSlug} error=${result2.error} status=${result2.status}`
         );
         noteSpawnFailed2(input.botId);
+        await notifyRefused(result2);
         return;
       }
       console.error(
-        `${TAG62} op=telegram-spawn-door botId=${input.botId} role=public door=rc agent=${input.agentSlug}`
+        `${TAG64} op=telegram-spawn-door botId=${input.botId} role=public door=rc agent=${input.agentSlug}`
       );
       console.error(
-        `${TAG62} op=spawn botId=${input.botId} sessionId=${result2.sessionId} targetAccountId=${input.accountId} role=public`
+        `${TAG64} op=spawn botId=${input.botId} sessionId=${result2.sessionId} targetAccountId=${input.accountId} role=public`
       );
       noteSpawnOk2(input.botId);
+      clearRefusalNotice(req.channelKey);
+      deps.followers.attach({
+        sessionId: result2.sessionId,
+        senderId: req.channelKey,
+        accountId: input.accountId,
+        chatId: input.chatId,
+        botToken: input.botToken
+      });
       return;
     }
     const result = await deps.managerRcSpawn(req);
@@ -38767,12 +39355,14 @@ function buildTelegramEnsureSession(deps) {
         `[telegram-native] op=spawn-failed botId=${input.botId} key=${req.channelKey} role=admin error=${result.error} status=${result.status}`
       );
       noteSpawnFailed2(input.botId);
+      await notifyRefused(result);
       return;
     }
     console.error(
-      `${TAG62} op=spawn botId=${input.botId} sessionId=${req.sessionId} targetAccountId=${input.accountId} role=admin`
+      `${TAG64} op=spawn botId=${input.botId} sessionId=${req.sessionId} targetAccountId=${input.accountId} role=admin`
     );
     noteSpawnOk2(input.botId);
+    clearRefusalNotice(req.channelKey);
     deps.followers.attach({
       sessionId: req.sessionId,
       senderId: req.channelKey,
@@ -38788,7 +39378,7 @@ init_attachments();
 import { realpathSync as realpathSync10 } from "fs";
 import { readFile as readFile14, stat as stat10 } from "fs/promises";
 import { resolve as resolve48, basename as basename16 } from "path";
-var TAG63 = "[telegram:outbound]";
+var TAG65 = "[telegram:outbound]";
 var TELEGRAM_DOCUMENT_MAX_BYTES = 50 * 1024 * 1024;
 async function sendTelegramDocument(input) {
   const { botToken, chatId, filePath, caption, maxyAccountId, platformRoot: platformRoot5 } = input;
@@ -38805,10 +39395,10 @@ async function sendTelegramDocument(input) {
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
-      console.error(`${TAG63} document ENOENT scope=account-dir accountDir=${accountDir} maxyAccountId=${maxyAccountId}`);
+      console.error(`${TAG65} document ENOENT scope=account-dir accountDir=${accountDir} maxyAccountId=${maxyAccountId}`);
       return { ok: false, status: 500, error: `Account directory not resolvable for ${maxyAccountId}` };
     }
-    console.error(`${TAG63} document path error scope=account-dir maxyAccountId=${maxyAccountId}: ${String(err)}`);
+    console.error(`${TAG65} document path error scope=account-dir maxyAccountId=${maxyAccountId}: ${String(err)}`);
     return { ok: false, status: 500, error: String(err) };
   }
   let resolvedPath;
@@ -38817,14 +39407,14 @@ async function sendTelegramDocument(input) {
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
-      console.error(`${TAG63} document ENOENT scope=file path=${filePath} maxyAccountId=${maxyAccountId}`);
+      console.error(`${TAG65} document ENOENT scope=file path=${filePath} maxyAccountId=${maxyAccountId}`);
       return { ok: false, status: 404, error: `File not found: ${filePath}` };
     }
-    console.error(`${TAG63} document path error scope=file maxyAccountId=${maxyAccountId}: ${String(err)}`);
+    console.error(`${TAG65} document path error scope=file maxyAccountId=${maxyAccountId}: ${String(err)}`);
     return { ok: false, status: 500, error: String(err) };
   }
   if (!resolvedPath.startsWith(accountResolved + "/")) {
-    console.error(`${TAG63} document REJECTED reason=outside_account_directory maxyAccountId=${maxyAccountId}`);
+    console.error(`${TAG65} document REJECTED reason=outside_account_directory maxyAccountId=${maxyAccountId}`);
     return { ok: false, status: 403, error: "Access denied: file is outside the account directory" };
   }
   const fileStat = await stat10(resolvedPath);
@@ -38857,24 +39447,24 @@ async function sendTelegramDocument(input) {
     error = e instanceof Error ? e.message : String(e);
   }
   console.error(
-    `${TAG63} sent document to=${chatId} file=${filename} bytes=${fileStat.size} ok=${ok2}` + (messageId !== void 0 ? ` id=${messageId}` : "")
+    `${TAG65} sent document to=${chatId} file=${filename} bytes=${fileStat.size} ok=${ok2}` + (messageId !== void 0 ? ` id=${messageId}` : "")
   );
   return ok2 ? { ok: true, messageId } : { ok: false, status: 500, error };
 }
 
 // app/lib/telegram/outbound/file-delivery.ts
-var TAG64 = "[telegram:outbound]";
+var TAG66 = "[telegram:outbound]";
 function platformRoot4() {
   return process.env.MAXY_PLATFORM_ROOT || "";
 }
 function makeTelegramSendFile(entry2, botToken) {
   return async (filePath, caption) => {
     if (!botToken) {
-      console.error(`${TAG64} file-delivery reject reason=no-bot-token sender=${entry2.senderId} role=${entry2.role}`);
+      console.error(`${TAG66} file-delivery reject reason=no-bot-token sender=${entry2.senderId} role=${entry2.role}`);
       return { ok: false, error: "no-bot-token" };
     }
     if (entry2.replyTarget == null) {
-      console.error(`${TAG64} file-delivery reject reason=no-reply-target sender=${entry2.senderId} role=${entry2.role}`);
+      console.error(`${TAG66} file-delivery reject reason=no-reply-target sender=${entry2.senderId} role=${entry2.role}`);
       return { ok: false, error: "no-reply-target" };
     }
     const result = await sendTelegramDocument({
@@ -38891,13 +39481,14 @@ function makeTelegramSendFile(entry2, botToken) {
 function makeTelegramFileDelivery(entry2, botToken) {
   return makeFileDelivery({
     entry: entry2,
-    tag: TAG64,
+    tag: TAG66,
     channel: "telegram",
     sendFile: makeTelegramSendFile(entry2, botToken)
   });
 }
 
 // app/lib/telegram/gateway/native-file-follower.ts
+var CHAT_ACTION_REFRESH_MS = 4e3;
 function startTelegramNativeFileFollower(input) {
   const entry2 = {
     sessionId: input.sessionId,
@@ -38917,6 +39508,16 @@ function startTelegramNativeFileFollower(input) {
     // The chat id the document is addressed to (set per spawn from the inbound).
     replyTarget: input.chatId
   };
+  let lastChatActionAt = Number.NEGATIVE_INFINITY;
+  const onActivity = () => {
+    const now = Date.now();
+    if (now - lastChatActionAt < CHAT_ACTION_REFRESH_MS) return;
+    lastChatActionAt = now;
+    void sendTelegramChatAction(input.botToken, input.chatId, input.senderId, "activity");
+  };
+  const onTurnComplete = () => {
+    lastChatActionAt = Number.NEGATIVE_INFINITY;
+  };
   return startEmitter({
     entry: entry2,
     tag: "[telegram-adaptor]",
@@ -38930,6 +39531,8 @@ function startTelegramNativeFileFollower(input) {
     // A resumed session's JSONL already holds prior SendUserFile tool_uses;
     // suppress replay so historical files are not re-sent on attach.
     suppressResumeReplay: true,
+    onActivity,
+    onTurnComplete,
     // Task 2521 — the answer reaches every bound door through the one fan-out.
     // Ungated by design: whatever woke the turn, the reader and the chats show
     // the same thing.
@@ -38968,7 +39571,7 @@ init_webchat();
 // app/lib/channel-pty-bridge/public-session-end-review.ts
 init_src3();
 import { randomUUID as randomUUID14 } from "crypto";
-var TAG65 = "[public-session-review]";
+var TAG67 = "[public-session-review]";
 var CONSUMED_CAP = 500;
 var consumed = /* @__PURE__ */ new Set();
 function consumeOnce(sessionId) {
@@ -38995,7 +39598,7 @@ async function fetchJsonl(sessionId) {
     return await res.text();
   } catch (err) {
     console.error(
-      `${TAG65} jsonl-fetch-failed sessionId=${sessionId} err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG67} jsonl-fetch-failed sessionId=${sessionId} err="${err instanceof Error ? err.message : String(err)}"`
     );
     return null;
   }
@@ -39019,7 +39622,7 @@ async function fetchPriorWrites(sliceToken, accountId) {
     const res = await fetch(url);
     if (!res.ok) {
       console.error(
-        `${TAG65} prior-writes-fetch-failed sliceToken=${sliceToken.slice(0, 8)} status=${res.status}`
+        `${TAG67} prior-writes-fetch-failed sliceToken=${sliceToken.slice(0, 8)} status=${res.status}`
       );
       return [];
     }
@@ -39027,7 +39630,7 @@ async function fetchPriorWrites(sliceToken, accountId) {
     return Array.isArray(body.writes) ? body.writes : [];
   } catch (err) {
     console.error(
-      `${TAG65} prior-writes-fetch-threw sliceToken=${sliceToken.slice(0, 8)} err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG67} prior-writes-fetch-threw sliceToken=${sliceToken.slice(0, 8)} err="${err instanceof Error ? err.message : String(err)}"`
     );
     return [];
   }
@@ -39056,7 +39659,7 @@ function composeInitialMessage(input) {
 }
 async function dispatchReviewer(input, initialMessage) {
   const sessionId = randomUUID14();
-  console.log(`${TAG65} route target=rc-spawn sessionId=${sessionId.slice(0, 8)} sourceSession=${input.sessionId.slice(0, 8)}`);
+  console.log(`${TAG67} route target=rc-spawn sessionId=${sessionId.slice(0, 8)} sourceSession=${input.sessionId.slice(0, 8)}`);
   const spawned = await managerRcSpawn({
     sessionId,
     initialMessage,
@@ -39080,21 +39683,21 @@ async function firePublicSessionEndReview(input) {
   const dispatchedAt = Date.now();
   if (consumed.has(input.sessionId)) {
     console.log(
-      `${TAG65} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
+      `${TAG67} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
     );
     return;
   }
   const jsonl = await fetchJsonl(input.sessionId);
   if (!jsonl) {
     console.log(
-      `${TAG65} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-jsonl-missing`
+      `${TAG67} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-jsonl-missing`
     );
     return;
   }
   const operatorTurns = countOperatorTurns(jsonl);
   if (operatorTurns === 0) {
     console.log(
-      `${TAG65} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-no-turns`
+      `${TAG67} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-no-turns`
     );
     return;
   }
@@ -39108,19 +39711,19 @@ async function firePublicSessionEndReview(input) {
   });
   if (!consumeOnce(input.sessionId)) {
     console.log(
-      `${TAG65} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
+      `${TAG67} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
     );
     return;
   }
   const dispatched = await dispatchReviewer(input, initialMessage);
   if (!dispatched.ok) {
     console.error(
-      `${TAG65} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-spawn-failed reason=${dispatched.reason}`
+      `${TAG67} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-spawn-failed reason=${dispatched.reason}`
     );
     return;
   }
   console.log(
-    `${TAG65} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=dispatched managerSessionId=${dispatched.managerSessionId} operatorTurns=${operatorTurns} priorWrites=${priorWrites.length} ms=${Date.now() - dispatchedAt}`
+    `${TAG67} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=dispatched managerSessionId=${dispatched.managerSessionId} operatorTurns=${operatorTurns} priorWrites=${priorWrites.length} ms=${Date.now() - dispatchedAt}`
   );
 }
 
@@ -39272,7 +39875,7 @@ init_account();
 
 // server/telegram-audit.ts
 import { statSync as statSync28 } from "fs";
-import { join as join62 } from "path";
+import { join as join63 } from "path";
 init_channel_key();
 init_sidebar_sessions();
 function buildTelegramAuditLines(input) {
@@ -39338,7 +39941,7 @@ function countTelegramSessionsForAccount(accountId) {
 function* walkTelegramSidecars() {
   const cfg = claudeConfigDir();
   if (!cfg) return;
-  const projectsRoot = join62(cfg, "projects");
+  const projectsRoot = join63(cfg, "projects");
   for (const { path } of enumerateSessionSidecars(projectsRoot)) {
     const meta = readSidecarMeta(path);
     if (meta.channel !== "telegram" || !meta.accountId) continue;
@@ -39363,16 +39966,25 @@ function* walkTelegramSidecars() {
   }
 }
 
+// app/lib/telegram/gateway/origin-target.ts
+function answeringOriginTarget(send, key2, noteAnswered3) {
+  if (!send) return null;
+  return async (text) => {
+    await send(text);
+    noteAnswered3(key2);
+  };
+}
+
 // server/telegram-migrate.ts
-import { readFileSync as readFileSync53, writeFileSync as writeFileSync19, existsSync as existsSync53, renameSync as renameSync11, mkdirSync as mkdirSync11 } from "fs";
-import { dirname as dirname18, join as join63 } from "path";
+import { readFileSync as readFileSync54, writeFileSync as writeFileSync19, existsSync as existsSync53, renameSync as renameSync11, mkdirSync as mkdirSync11 } from "fs";
+import { dirname as dirname18, join as join64 } from "path";
 function migrateTelegramTwoSlot(input) {
   const out = [];
   for (const account of input.accounts) {
-    const configPath3 = join63(account.accountDir, "account.json");
+    const configPath3 = join64(account.accountDir, "account.json");
     let config;
     try {
-      config = JSON.parse(readFileSync53(configPath3, "utf-8"));
+      config = JSON.parse(readFileSync54(configPath3, "utf-8"));
     } catch {
       console.error(`[telegram-audit] op=migrate-unreadable accountId=${account.accountId}`);
       continue;
@@ -39474,14 +40086,14 @@ function backfillMisfiledRecords(params) {
 init_message_store();
 
 // server/lib/booking-site-accounts.ts
-import { existsSync as existsSync54, readFileSync as readFileSync54 } from "fs";
+import { existsSync as existsSync54, readFileSync as readFileSync55 } from "fs";
 import { resolve as resolve49 } from "path";
 function listBookingSiteAccounts(accounts) {
   return accounts.filter((a) => {
     const availPath = resolve49(a.accountDir, "calendar-availability.json");
     if (!existsSync54(availPath)) return false;
     try {
-      const cfg = JSON.parse(readFileSync54(availPath, "utf-8"));
+      const cfg = JSON.parse(readFileSync55(availPath, "utf-8"));
       return typeof cfg.bookingDbName === "string" && cfg.bookingDbName.length > 0;
     } catch {
       return false;
@@ -39526,7 +40138,7 @@ init_paths();
 
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash7, verify as cryptoVerify } from "crypto";
-import { existsSync as existsSync55, readFileSync as readFileSync55, statSync as statSync29 } from "fs";
+import { existsSync as existsSync55, readFileSync as readFileSync56, statSync as statSync29 } from "fs";
 import { resolve as resolve50 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
@@ -39590,7 +40202,7 @@ function resolveEntitlement(brand, account) {
 function verifyAndResolve(brand, entitlementPath, account) {
   let pubkeyPem;
   try {
-    pubkeyPem = readFileSync55(pubkeyPath(brand), "utf-8");
+    pubkeyPem = readFileSync56(pubkeyPath(brand), "utf-8");
   } catch (err) {
     return logResolved(anonymousFallback("pubkey-missing"), {
       reason: "pubkey-missing"
@@ -39604,7 +40216,7 @@ function verifyAndResolve(brand, entitlementPath, account) {
   }
   let envelope;
   try {
-    envelope = JSON.parse(readFileSync55(entitlementPath, "utf-8"));
+    envelope = JSON.parse(readFileSync56(entitlementPath, "utf-8"));
   } catch {
     return logResolved(anonymousFallback("malformed"), { reason: "malformed" });
   }
@@ -39766,14 +40378,14 @@ function clientFrom(c) {
 }
 installMediaDownloadGuard();
 var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT || "";
-var BRAND_JSON_PATH = PLATFORM_ROOT6 ? join64(PLATFORM_ROOT6, "config", "brand.json") : "";
+var BRAND_JSON_PATH = PLATFORM_ROOT6 ? join65(PLATFORM_ROOT6, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", marketingUrl: "https://getmaxy.com" };
 if (BRAND_JSON_PATH && !existsSync56(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
 }
 if (BRAND_JSON_PATH && existsSync56(BRAND_JSON_PATH)) {
   try {
-    const parsed = JSON.parse(readFileSync56(BRAND_JSON_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync57(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
   } catch (err) {
     console.error(`[brand] Failed to parse brand.json: ${err.message}`);
@@ -39805,11 +40417,11 @@ var brandLoginOpts = {
   appleTouchIconPath: brandAppIcon512Path,
   themeColor: BRAND.defaultColors?.primary
 };
-var ALIAS_DOMAINS_PATH = join64(homedir5(), BRAND.configDir, "alias-domains.json");
+var ALIAS_DOMAINS_PATH = join65(homedir6(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
     if (!existsSync56(ALIAS_DOMAINS_PATH)) return null;
-    const parsed = JSON.parse(readFileSync56(ALIAS_DOMAINS_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync57(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
       return null;
@@ -39863,7 +40475,12 @@ var nativeFileFollowers = createFollowerRegistry(
     // delivered session 8e5bc4e8's answer to nothing.
     fanTargets: () => whatsappFanTargets(p.effectiveAccountId, p.senderId),
     onClose
-  })
+  }),
+  // Task 2569 — the door is (effective account, sender), the same pair the
+  // reply map and the session id key on. Keyed on the sender alone, a second
+  // account's spawn for the same phone aborted the first account's live reader
+  // and overwrote its recorded parameters, and the census called that healthy.
+  whatsappDoorId
 );
 var webchatFileFollowers = /* @__PURE__ */ new Map();
 async function fetchAccountStandingRules(accountId) {
@@ -39945,7 +40562,7 @@ var waGateway = new WaGateway({
   // resolver and `fanTargetsFor` is a constructor dep, not a callable method.
   fanTargetsFor: whatsappFanTargets,
   gatewayUrl: `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`,
-  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve51(process.env.MAXY_PLATFORM_ROOT ?? join64(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
+  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve51(process.env.MAXY_PLATFORM_ROOT ?? join65(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
   // Task 751 / 1390 — file delivery on the native channel. `maxyAccountId` (the
   // path-validation scope) is the sender's effective SESSION account, resolved
   // once at the inbound gate and threaded here via the gateway's per-sender doc
@@ -39960,7 +40577,7 @@ var waGateway = new WaGateway({
       caption,
       accountId,
       maxyAccountId,
-      platformRoot: resolve51(process.env.MAXY_PLATFORM_ROOT ?? join64(__dirname, ".."))
+      platformRoot: resolve51(process.env.MAXY_PLATFORM_ROOT ?? join65(__dirname, ".."))
     });
     return result.ok ? { ok: true, messageId: result.messageId } : { ok: false, error: result.error };
   },
@@ -40050,11 +40667,20 @@ var waGateway = new WaGateway({
           `[whatsapp:public-agent] op=spawn-failed inboundId=${inboundId} senderId=${senderId} slug=${publicAgentSlug} error=${publicResult.error}`
         );
         noteSpawnFailed();
+        await sendRefusalNotice({
+          channel: "whatsapp",
+          doorId: whatsappDoorId({ effectiveAccountId, senderId }),
+          sender: senderId,
+          reason: publicResult.error,
+          status: publicResult.status,
+          send: waGateway.liveReplyTarget(effectiveAccountId, senderId)
+        });
       } else {
         console.error(
           `[whatsapp:public-agent] op=spawn-ok inboundId=${inboundId} senderId=${senderId} slug=${publicAgentSlug} ms=${Date.now() - publicSpawnStartedAt}`
         );
         noteSpawnOk();
+        clearRefusalNotice(whatsappDoorId({ effectiveAccountId, senderId }));
       }
       return;
     }
@@ -40093,8 +40719,17 @@ var waGateway = new WaGateway({
     const result = await managerRcSpawn({ ...req, userId, party });
     if ("error" in result) {
       console.error(`[whatsapp-native] spawn-failed senderId=${senderId} role=${role} error=${result.error} status=${result.status}`);
+      await sendRefusalNotice({
+        channel: "whatsapp",
+        doorId: whatsappDoorId({ effectiveAccountId, senderId }),
+        sender: senderId,
+        reason: result.error,
+        status: result.status,
+        send: waGateway.liveReplyTarget(effectiveAccountId, senderId)
+      });
       return;
     }
+    clearRefusalNotice(whatsappDoorId({ effectiveAccountId, senderId }));
     nativeFileFollowers.attach({
       sessionId: req.sessionId,
       senderId,
@@ -40117,7 +40752,7 @@ function runDuplicateSenderAudit() {
   try {
     const configDir = process.env.CLAUDE_CONFIG_DIR;
     if (!configDir) return;
-    const projectsRoot = join64(configDir, "projects");
+    const projectsRoot = join65(configDir, "projects");
     const records2 = [];
     for (const { path: jsonlPath, isSubagent, archived } of enumerateJsonls(projectsRoot)) {
       if (isSubagent || archived) continue;
@@ -40169,7 +40804,7 @@ var webchatGateway = new WebchatGateway({
   // rather than hanging the POST.
   publicProjectsRoot: () => {
     const cfg = claudeConfigDir();
-    return cfg ? join64(cfg, "projects") : "";
+    return cfg ? join65(cfg, "projects") : "";
   },
   gatewayUrl: webchatGatewayUrl(),
   serverPath: webchatServerPath(),
@@ -40311,6 +40946,12 @@ var telegramGateway = new TelegramGateway({
   resolveSessionOverride: (accountId, channelKey) => resolveChannelOverride(accountId, "telegram", channelKey),
   // Task 2521 — hoisted above; see `telegramFanTargets`.
   fanTargetsFor: telegramFanTargets,
+  // Task 2576 — the typing indicator. Injected here because the gateway is
+  // contracted to hold no Bot API import; see the dep comment in
+  // telegram-gateway.ts. Not awaited: an indicator never paces a turn.
+  sendChatAction: ({ botToken, chatId, key: key2 }) => {
+    void sendTelegramChatAction(botToken, chatId, key2, "inbound");
+  },
   gatewayUrl: telegramGatewayUrl(),
   serverPath: telegramServerPath(),
   // Task 2368 — the role branch lives in its own module so it has a test that
@@ -40320,6 +40961,8 @@ var telegramGateway = new TelegramGateway({
     managerRcSpawn,
     managerSpawn,
     resolveSessionOverride: (accountId, channelKey) => resolveChannelOverride(accountId, "telegram", channelKey),
+    // Task 2573 — the send the refusal notice goes out on.
+    sendText: sendTelegramText,
     followers: telegramFileFollowers
   })
 });
@@ -40334,10 +40977,16 @@ registerLoop({
     followerCensusTick(
       {
         channel: "whatsapp",
-        bound: () => waGateway.boundTargets().map((t) => t.senderId),
+        // Task 2569 — the whole hub key, not its sender half. `boundTargets()`
+        // decodes the reply-map keys and this re-encodes them through the same
+        // helper pair, so the census and the gateway compare one fact. Halving
+        // it here is what let one phone's two accounts collapse to one door.
+        bound: () => waGateway.boundTargets().map((t) => hubKey(t.accountId, t.senderId)),
         live: () => nativeFileFollowers.live(),
-        paramsFor: (senderId) => nativeFileFollowers.paramsFor(senderId),
-        attach: (p) => nativeFileFollowers.attach(p)
+        paramsFor: (doorId) => nativeFileFollowers.paramsFor(doorId),
+        attach: (p) => nativeFileFollowers.attach(p),
+        // The hub key carries a NUL, which must never reach server.log.
+        label: whatsappDoorLabel
       },
       followerCensusState.whatsapp
     ),
@@ -40346,7 +40995,7 @@ registerLoop({
         channel: "telegram",
         bound: () => telegramGateway.boundTargets(),
         live: () => telegramFileFollowers.live(),
-        paramsFor: (senderId) => telegramFileFollowers.paramsFor(senderId),
+        paramsFor: (doorId) => telegramFileFollowers.paramsFor(doorId),
         attach: (p) => telegramFileFollowers.attach(p)
       },
       followerCensusState.telegram
@@ -40799,7 +41448,7 @@ app80.get("/agent-assets/:slug/:filename", (c) => {
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[agent-assets] serve slug=${slug} file=${filename} status=200`);
-  const body = readFileSync56(filePath);
+  const body = readFileSync57(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=3600"
@@ -40829,7 +41478,7 @@ app80.get("/generated/:filename", (c) => {
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[generated] serve file=${filename} status=200`);
-  const body = readFileSync56(filePath);
+  const body = readFileSync57(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=86400"
@@ -40844,7 +41493,7 @@ var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
 if (BRAND_JSON_PATH && existsSync56(BRAND_JSON_PATH)) {
   try {
-    const fullBrand = JSON.parse(readFileSync56(BRAND_JSON_PATH, "utf-8"));
+    const fullBrand = JSON.parse(readFileSync57(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
     brandIconPath = fullBrand.assets?.icon ? `/brand/${fullBrand.assets.icon}` : brandLogoPath;
   } catch {
@@ -40875,7 +41524,7 @@ var brandAppIconsExist = [brandAppIcon192Path, brandAppIcon512Path, brandMaskabl
 );
 var SW_SOURCE = (() => {
   try {
-    return readFileSync56(resolve51(process.cwd(), "public", "sw.js"), "utf-8");
+    return readFileSync57(resolve51(process.cwd(), "public", "sw.js"), "utf-8");
   } catch {
     return null;
   }
@@ -40883,9 +41532,9 @@ var SW_SOURCE = (() => {
 function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT6) return "unknown";
-    const versionFile = join64(PLATFORM_ROOT6, "config", `.${BRAND.hostname}-version`);
+    const versionFile = join65(PLATFORM_ROOT6, "config", `.${BRAND.hostname}-version`);
     if (!existsSync56(versionFile)) return "unknown";
-    const content = readFileSync56(versionFile, "utf-8").trim();
+    const content = readFileSync57(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
     return "unknown";
@@ -40896,7 +41545,7 @@ var versionScript = `<script>window.__MAXY_VERSION__=${JSON.stringify(INSTALLED_
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync56(resolve51(process.cwd(), "public", file), "utf-8");
+    html = readFileSync57(resolve51(process.cwd(), "public", file), "utf-8");
     const productNameEsc = escapeHtml(BRAND.productName);
     html = html.replace(/<title>([^<]*)<\/title>/, (_match, inner) => `<title>${escapeHtml(inner).replace(/Maxy/g, productNameEsc)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
@@ -40913,14 +41562,14 @@ ${clientErrorReporterScript}
   return html;
 }
 function loadBrandingCache(agentSlug) {
-  const configDir = join64(homedir5(), BRAND.configDir);
+  const configDir = join65(homedir6(), BRAND.configDir);
   try {
     const verdict = resolvePublicAddressFromDisk(agentSlug);
     const accountId = verdict.kind === "served" ? verdict.owner.accountId : getDefaultAccountId();
     if (!accountId) return null;
-    const cachePath = join64(configDir, "branding-cache", accountId, `${agentSlug}.json`);
+    const cachePath = join65(configDir, "branding-cache", accountId, `${agentSlug}.json`);
     if (!existsSync56(cachePath)) return null;
-    return JSON.parse(readFileSync56(cachePath, "utf-8"));
+    return JSON.parse(readFileSync57(cachePath, "utf-8"));
   } catch {
     return null;
   }
@@ -41015,7 +41664,7 @@ app80.use("/vnc-popout.html", logViewerFetch);
 app80.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync56(resolve51(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync57(resolve51(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -41169,7 +41818,7 @@ var hostname = process.env.HOSTNAME ?? "127.0.0.1";
 var httpServer = serve({ fetch: app80.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
-  const reconcilePlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join64(__dirname, "..");
+  const reconcilePlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join65(__dirname, "..");
   const reconcileScript = resolve51(reconcilePlatformRoot, "plugins/scheduling/mcp/dist/scripts/reconcile-bookings.js");
   const runReconcile = (ctx) => {
     if (!existsSync56(reconcileScript)) return;
@@ -41192,7 +41841,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     detached: true,
     run: runReconcile
   });
-  const reconcileStatePath = join64(MAXY_DIR, "booking-reconcile-state.json");
+  const reconcileStatePath = join65(MAXY_DIR, "booking-reconcile-state.json");
   registerLoop({
     name: "calendar-reconcile-liveness",
     intervalMs: 6e5,
@@ -41210,7 +41859,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 }
 {
   const DREAM_CYCLE_SWEEP_INTERVAL_MS = 36e5;
-  const dreamPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join64(__dirname, "..");
+  const dreamPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join65(__dirname, "..");
   const dreamSweepScript = resolve51(dreamPlatformRoot, "plugins/memory/mcp/dist/scripts/dream-cycle-sweep.js");
   registerLoop({
     name: "dream-cycle-sweep",
@@ -41234,7 +41883,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const outlookPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join64(__dirname, "..");
+  const outlookPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join65(__dirname, "..");
   const outlookScript = resolve51(outlookPlatformRoot, "plugins/outlook/mcp/dist/scripts/complete-registration.js");
   const OUTLOOK_COMPLETE_INTERVAL_MS = 3e4;
   const runOutlookComplete = (ctx) => {
@@ -41260,7 +41909,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const auditRoot = process.env.MAXY_PLATFORM_ROOT ?? join64(__dirname, "..");
+  const auditRoot = process.env.MAXY_PLATFORM_ROOT ?? join65(__dirname, "..");
   const strandedAccountsDir = resolve51(auditRoot, "..", "data/accounts");
   const STRANDED_AUDIT_INTERVAL_MS = 3e5;
   const STRANDED_AGE_MS = 16 * 6e4;
@@ -41269,7 +41918,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     try {
       if (!existsSync56(strandedAccountsDir)) return;
       const now = Date.now();
-      for (const name of readdirSync32(strandedAccountsDir)) {
+      for (const name of readdirSync33(strandedAccountsDir)) {
         if (!STRANDED_UUID_RE.test(name)) continue;
         const pendingPath2 = resolve51(strandedAccountsDir, name, "secrets/outlook/pending-devicecode.enc");
         if (!existsSync56(pendingPath2)) continue;
@@ -41290,7 +41939,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const googleRoot = process.env.MAXY_PLATFORM_ROOT ?? join64(__dirname, "..");
+  const googleRoot = process.env.MAXY_PLATFORM_ROOT ?? join65(__dirname, "..");
   const googleAccountsDir = resolve51(googleRoot, "..", "data/accounts");
   const GOOGLE_PENDING_AUDIT_INTERVAL_MS = 3e5;
   const runGooglePendingAuditSafe = () => {
@@ -41334,7 +41983,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join64(__dirname, "..");
+  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join65(__dirname, "..");
   const STORAGE_AUDIT_INTERVAL_MS = 3e5;
   const runStorageAuditSafe = () => runStorageAudit(auditPlatformRoot).catch((err) => {
     console.error(`[storage-audit] error="${err.message}"`);
@@ -41370,7 +42019,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     accounts: listValidAccounts().map((a) => ({ accountId: a.accountId, accountDir: a.accountDir })),
     secretPathFor: secretPath,
     legacySecretPathFor: (botType, accountId) => resolve51(
-      homedir5(),
+      homedir6(),
       configDirName2(),
       `${botType === "admin" ? ".telegram-admin-webhook-secret" : ".telegram-webhook-secret"}.${accountId}`
     ),
@@ -41393,7 +42042,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     const lastByBot = newestTelegramSessionByBot();
     let secretFilesOnDisk = [];
     try {
-      secretFilesOnDisk = readdirSync32(telegramSecretsDir());
+      secretFilesOnDisk = readdirSync33(telegramSecretsDir());
     } catch {
     }
     const lines = buildTelegramAuditLines({
@@ -41536,7 +42185,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const publishPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join64(__dirname, "..");
+  const publishPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join65(__dirname, "..");
   const publishScript = resolve51(publishPlatformRoot, "plugins/scheduling/mcp/dist/scripts/publish-availability.js");
   const PUBLISH_INTERVAL_MS = 3e5;
   const bookingAccounts = () => {
@@ -41571,7 +42220,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     let hasBookingSite = false;
     try {
       if (existsSync56(availPath)) {
-        const cfg = JSON.parse(readFileSync56(availPath, "utf-8"));
+        const cfg = JSON.parse(readFileSync57(availPath, "utf-8"));
         hasBookingSite = typeof cfg.bookingDbName === "string" && cfg.bookingDbName.length > 0;
       }
     } catch {
@@ -41581,7 +42230,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     let lastSuccessAt = null;
     if (existsSync56(statePath)) {
       try {
-        const rec = JSON.parse(readFileSync56(statePath, "utf-8"));
+        const rec = JSON.parse(readFileSync57(statePath, "utf-8"));
         lastSuccessAt = rec.lastSuccessAt ?? null;
       } catch {
         console.error(`[calendar-availability] op=audit accountId=${account.accountId} snapshotAgeMs=na reason=bad-state-file`);
@@ -41616,7 +42265,7 @@ startDispatchCensus(() => getSession());
 startDispatchFieldCensus(() => getSession());
 startDispatchTgCensus(() => getSession());
 {
-  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join64(__dirname, "..");
+  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join65(__dirname, "..");
   const auditScript = resolve51(auditPlatformRoot, "plugins/connector/mcp/dist/scripts/audit-connectors.js");
   const auditLogDir = process.env.LOG_DIR ?? LOG_DIR;
   const CONNECTOR_AUDIT_INTERVAL_MS = 3e5;
@@ -41747,7 +42396,7 @@ async function runAdminUserReconcileTick() {
       console.error("[adminuser-self-heal] skip reason=no-users-file");
       return;
     }
-    const usersRaw = readFileSync56(USERS_FILE, "utf-8").trim();
+    const usersRaw = readFileSync57(USERS_FILE, "utf-8").trim();
     if (!usersRaw) {
       console.error("[adminuser-self-heal] skip reason=empty-users-file");
       return;
@@ -41829,8 +42478,8 @@ var runIngestAuditTick = () => {
       },
       agentExists: (accountId, slug) => {
         if (!house) return false;
-        const dir = isHouseAccountKey(house.accountId, accountId) ? house.accountDir : join64(ACCOUNTS_DIR, accountId);
-        return existsSync56(join64(dir, "agents", slug, "config.json"));
+        const dir = isHouseAccountKey(house.accountId, accountId) ? house.accountDir : join65(ACCOUNTS_DIR, accountId);
+        return existsSync56(join65(dir, "agents", slug, "config.json"));
       }
     });
   } catch (err) {
@@ -41878,9 +42527,9 @@ registerLoop({
       runPublicAddressCollisionAudit({
         houseAccountId: () => resolveAccount()?.accountId ?? null,
         activeSlugs: () => listValidAccounts().map((a) => {
-          const agentsRoot = join64(a.accountDir, "agents");
+          const agentsRoot = join65(a.accountDir, "agents");
           if (!existsSync56(agentsRoot)) return { accountId: a.accountId, slugs: [] };
-          const slugs = readdirSync32(agentsRoot, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name).filter((slug) => isActiveAgentSlug(a.accountDir, slug));
+          const slugs = readdirSync33(agentsRoot, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name).filter((slug) => isActiveAgentSlug(a.accountDir, slug));
           return { accountId: a.accountId, slugs };
         })
       });
@@ -41894,7 +42543,7 @@ registerLoop({
 var USERS_RECONCILE_INTERVAL_MS = 60 * 60 * 1e3;
 function countUsersRows() {
   if (!existsSync56(USERS_FILE)) return 0;
-  const raw = readFileSync56(USERS_FILE, "utf-8").trim();
+  const raw = readFileSync57(USERS_FILE, "utf-8").trim();
   if (!raw) return 0;
   const users = JSON.parse(raw);
   return users.filter((u) => typeof u.userId === "string").length;
@@ -41925,6 +42574,7 @@ registerLoop({
 });
 startGraphHealthTimer();
 startSharedFolderCensus();
+startCredRefreshCensus();
 void migrateUploads().catch((err) => console.error(`[uploads-migrate] failed err="${err instanceof Error ? err.message : String(err)}"`)).finally(() => {
   void startFileWatcher().catch((err) => {
     console.error(`[file-watcher] start-failed err="${err instanceof Error ? err.message : String(err)}"`);
@@ -41979,7 +42629,7 @@ function whatsappSender(accountId, key2) {
   };
 }
 function telegramOriginTarget(key2) {
-  return telegramGateway.liveReplyTarget(key2);
+  return answeringOriginTarget(telegramGateway.liveReplyTarget(key2), key2, noteAnswered);
 }
 var configDirForWhatsApp = basename17(MAXY_DIR) || ".maxy";
 var bootAccount = resolveAccount();
@@ -42047,7 +42697,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve51(process.env.MAXY_PLATFORM_ROOT ?? join64(__dirname, "..")),
+  platformRoot: resolve51(process.env.MAXY_PLATFORM_ROOT ?? join65(__dirname, "..")),
   accountConfig: bootAccountConfig,
   // Task 2074 — enrich with the sub-account name and fan out to every open
   // admin SSE stream. Fire-and-forget: the manager's persist path must not