@rubytech/create-realagent-code 0.1.578 → 0.1.579

package/payload/server/server.js

@@ -5517,11 +5517,11 @@ var require_dist7 = __commonJS({
 
 // server/index.ts
 init_dist();
-import { readFileSync as readFileSync56, existsSync as existsSync56, watchFile, readdirSync as readdirSync32, statSync as statSync30 } from "fs";
+import { readFileSync as readFileSync57, existsSync as existsSync56, watchFile, readdirSync as readdirSync33, statSync as statSync30 } from "fs";
 import { spawn as spawn3 } from "child_process";
 import { createHash as createHash8 } from "crypto";
-import { resolve as resolve51, join as join64, basename as basename17 } from "path";
-import { homedir as homedir5 } from "os";
+import { resolve as resolve51, join as join65, basename as basename17 } from "path";
+import { homedir as homedir6 } from "os";
 
 // server/lib/route-cache-watchers.ts
 init_route_cache();
@@ -6777,7 +6777,16 @@ function readCredentials() {
     expiresAt
   };
 }
-function writeOAuthCredentials(tokens) {
+function logCredentialWrite(site, refreshTokenLen) {
+  console.log(`[claude-auth] op=cred-write site=${site} refreshTokenLen=${refreshTokenLen}`);
+}
+function writeHostCredsFile(credentialsFile, blob, refreshTokenLen) {
+  const tmp = `${credentialsFile}.${process.pid}.tmp`;
+  writeFileSync2(tmp, blob, { mode: 384 });
+  renameSync(tmp, credentialsFile);
+  logCredentialWrite("login-writeback", refreshTokenLen);
+}
+function writeOAuthCredentials(tokens, site) {
   const newExpiresAt = typeof tokens.expiresIn === "number" && tokens.expiresIn > 0 ? Date.now() + tokens.expiresIn * 1e3 : Date.now() + 3600 * 1e3;
   try {
     let fileData = {};
@@ -6787,10 +6796,13 @@ function writeOAuthCredentials(tokens) {
     } catch {
     }
     const existingOauth = fileData.claudeAiOauth;
+    const existingRefresh = typeof existingOauth?.refreshToken === "string" ? existingOauth.refreshToken : "";
+    const incomingRefresh = typeof tokens.refreshToken === "string" ? tokens.refreshToken : "";
+    const blankingRefused = incomingRefresh.length === 0 && existingRefresh.length > 0;
     fileData.claudeAiOauth = {
       ...existingOauth,
       accessToken: tokens.accessToken,
-      ...tokens.refreshToken != null ? { refreshToken: tokens.refreshToken } : {},
+      ...incomingRefresh.length > 0 ? { refreshToken: incomingRefresh } : {},
       expiresAt: newExpiresAt
     };
     const tmpPath = `${CLAUDE_CREDENTIALS_FILE}.${process.pid}.tmp`;
@@ -6804,6 +6816,13 @@ function writeOAuthCredentials(tokens) {
       }
       throw writeErr;
     }
+    if (blankingRefused) {
+      console.warn(
+        `[claude-auth] op=cred-write-refused site=${site} reason=blank-refresh-token storedLen=${existingRefresh.length}`
+      );
+    }
+    const landed = fileData.claudeAiOauth.refreshToken;
+    logCredentialWrite(site, typeof landed === "string" ? landed.length : 0);
     return newExpiresAt;
   } catch (err) {
     console.error(`[claude-auth] credential write failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -6933,9 +6952,11 @@ async function doRefreshLocked() {
   }
   const newExpiresAt = writeOAuthCredentials({
     accessToken: newAccessToken,
-    refreshToken: newRefreshToken ?? creds.refreshToken,
+    // Task 2572 — `??` does not fall back on the empty string, so a response
+    // carrying `refresh_token: ""` used to overwrite a good stored token.
+    refreshToken: typeof newRefreshToken === "string" && newRefreshToken.length > 0 ? newRefreshToken : creds.refreshToken,
     expiresIn: typeof expiresIn === "number" && expiresIn > 0 ? expiresIn : void 0
-  });
+  }, "refresh");
   if (newExpiresAt) {
     console.log(`[auth-refresh] op=renewed expiresAt=${new Date(newExpiresAt).toISOString()}`);
   } else {
@@ -7240,13 +7261,30 @@ function killChromium() {
 var AUTH_TARGET_ID_FILE = resolve4(LOG_DIR, "claude-auth-target.id");
 function readAuthTargetId() {
   try {
-    const id = readFileSync4(AUTH_TARGET_ID_FILE, "utf8").trim();
+    const parts = readFileSync4(AUTH_TARGET_ID_FILE, "utf8").trim().split(/\s+/);
+    const id = parts[parts.length - 1];
     return id.length > 0 ? id : null;
   } catch {
     return null;
   }
 }
-function writeChromiumWrapper() {
+function readAuthAttemptId() {
+  try {
+    const parts = readFileSync4(AUTH_TARGET_ID_FILE, "utf8").trim().split(/\s+/);
+    return parts.length === 2 && parts[0].length > 0 ? parts[0] : null;
+  } catch {
+    return null;
+  }
+}
+async function closeAuthTarget(targetId) {
+  try {
+    const res = await fetch(`http://127.0.0.1:${CDP_PORT}/json/close/${encodeURIComponent(targetId)}`);
+    return res.ok;
+  } catch {
+    return false;
+  }
+}
+function writeChromiumWrapper(attemptId) {
   mkdirSync2(BIN_DIR, { recursive: true });
   rmSync2(AUTH_TARGET_ID_FILE, { force: true });
   const wrapperPath = resolve4(BIN_DIR, "chromium");
@@ -7257,6 +7295,9 @@ LOG_DIR="${LOG_DIR}"
 LOG="$LOG_DIR/chromium.log"
 TARGET_ID_FILE="$LOG_DIR/claude-auth-target.id"
 CDP="http://127.0.0.1:${CDP_PORT}/json/new"
+# The sign-in this wrapper was generated for. Server-minted hex from
+# randomUUID().slice(0, 8), never caller-supplied, so it carries no shell.
+ATTEMPT_ID="${attemptId}"
 
 mkdir -p "$LOG_DIR"
 echo "==== [$(date)] chromium wrapper (cdp-handover) ====" >> "$LOG"
@@ -7288,9 +7329,9 @@ if [ -z "$TARGET_ID" ]; then
   exit 65
 fi
 
-printf '%s' "$TARGET_ID" > "$TARGET_ID_FILE"
-echo "  opened target $TARGET_ID" >> "$LOG"
-echo "[chromium-wrapper] op=cdp-handover outcome=ready targetId=$TARGET_ID" >> "$LOG"
+printf '%s %s' "$ATTEMPT_ID" "$TARGET_ID" > "$TARGET_ID_FILE"
+echo "  opened target $TARGET_ID for attempt $ATTEMPT_ID" >> "$LOG"
+echo "[chromium-wrapper] op=cdp-handover outcome=ready attempt=$ATTEMPT_ID targetId=$TARGET_ID" >> "$LOG"
 `, { mode: 493 });
   return wrapperPath;
 }
@@ -18842,7 +18883,7 @@ var quickbooks_default = app12;
 // server/routes/onboarding.ts
 init_dist();
 import { spawn, spawnSync as spawnSync2, execFileSync as execFileSync4 } from "child_process";
-import { openSync as openSync8, closeSync as closeSync8, writeFileSync as writeFileSync14, writeSync, existsSync as existsSync26, readFileSync as readFileSync32, unlinkSync as unlinkSync3, renameSync as renameSync8 } from "fs";
+import { openSync as openSync8, closeSync as closeSync8, appendFileSync as appendFileSync3, writeFileSync as writeFileSync14, writeSync, existsSync as existsSync26, readFileSync as readFileSync32, unlinkSync as unlinkSync3 } from "fs";
 import { createHash as createHash4, randomUUID as randomUUID4 } from "crypto";
 init_claude_agent();
 init_neo4j_store();
@@ -18915,8 +18956,10 @@ function bridgeKeychainToFile(deps) {
     deps.log(`[onboarding] op=login-writeback result=no-claudeAiOauth service=${JSON.stringify(service)}`);
     return { wrote: false, reason: "no-claudeAiOauth", bytes: 0, service };
   }
+  const oauth = parsed.claudeAiOauth;
+  const refreshTokenLen = typeof oauth.refreshToken === "string" ? oauth.refreshToken.length : 0;
   try {
-    deps.writeFile(blob);
+    deps.writeFile(blob, refreshTokenLen);
   } catch (err) {
     deps.log(`[onboarding] op=login-writeback result=write-failed service=${JSON.stringify(service)} err=${err instanceof Error ? err.message : String(err)}`);
     return { wrote: false, reason: "write-failed", bytes: 0, service };
@@ -19180,7 +19223,35 @@ function readUsersFile2() {
   if (!raw) return [];
   return JSON.parse(raw);
 }
-var darwinAuthChild = null;
+var pendingAuthLogin = null;
+async function endLogin(pending) {
+  if (!pending) return { priorId: null, priorPid: null, tabClosed: null };
+  let tabClosed = null;
+  const targetId = readAuthTargetId();
+  if (targetId && readAuthAttemptId() === pending.attemptId) {
+    tabClosed = await closeAuthTarget(targetId);
+  }
+  const priorPid = pending.child?.pid ?? null;
+  try {
+    pending.child?.kill("SIGTERM");
+  } catch {
+  }
+  return { priorId: pending.attemptId, priorPid, tabClosed };
+}
+function adoptOrStopChild(attemptId, child) {
+  if (pendingAuthLogin?.attemptId === attemptId) {
+    pendingAuthLogin.child = child;
+    return true;
+  }
+  try {
+    child.kill("SIGTERM");
+  } catch {
+  }
+  return false;
+}
+function formatEnded(ended) {
+  return `superseded=${ended.priorId ?? "none"} priorPid=${ended.priorPid ?? "none"} tabClosed=${ended.tabClosed === null ? "na" : ended.tabClosed}`;
+}
 var darwinCredsBefore = {};
 async function checkAuthStatus() {
   let status;
@@ -19221,7 +19292,11 @@ app13.post("/claude-auth", async (c) => {
   const remoteAddress = c.env?.incoming?.socket?.remoteAddress;
   const transport = resolveBrowserTransport(c.req.raw, remoteAddress);
   if (body.action === "stop") {
-    return c.json({ stopped: true });
+    const superseded2 = pendingAuthLogin;
+    pendingAuthLogin = null;
+    const ended2 = await endLogin(superseded2);
+    console.log(`[onboarding] op=auth-login-stop attempt=${ended2.priorId ?? "none"} outcome=${ended2.priorId ? "stopped" : "no-pending"} priorPid=${ended2.priorPid ?? "none"} tabClosed=${ended2.tabClosed === null ? "na" : ended2.tabClosed}`);
+    return c.json({ stopped: ended2.priorId !== null });
   }
   if (body.action === "logout") {
     const start = Date.now();
@@ -19246,7 +19321,7 @@ app13.post("/claude-auth", async (c) => {
   }
   if (body.action === "paste-code") {
     const code = typeof body.code === "string" ? body.code : "";
-    const child = darwinAuthChild;
+    const child = pendingAuthLogin?.child ?? null;
     if (!child || !child.stdin || child.stdin.destroyed) {
       console.log("[onboarding] op=claude-paste-code accepted=false reason=no-active-login");
       return c.json({ accepted: false, error: "No active login to paste into. Start sign-in first." }, 400);
@@ -19268,8 +19343,13 @@ app13.post("/claude-auth", async (c) => {
     const cdpReady = await ensureCdp(transport);
     return c.json({ launched: cdpReady });
   }
+  const attemptId = randomUUID4().slice(0, 8);
+  const superseded = pendingAuthLogin;
+  pendingAuthLogin = { child: null, attemptId, startedAt: Date.now() };
+  const ended = await endLogin(superseded);
   ensureLogDir();
-  writeFileSync14(logPath("claude-auth"), "");
+  appendFileSync3(logPath("claude-auth"), `==== attempt ${attemptId} ${(/* @__PURE__ */ new Date()).toISOString()} ====
+`);
   const claudeAuthLogFd = openSync8(logPath("claude-auth"), "a");
   const onClaudeOutput = (chunk) => writeSync(claudeAuthLogFd, chunk);
   if (process.platform === "darwin") {
@@ -19280,7 +19360,8 @@ app13.post("/claude-auth", async (c) => {
       stdio: ["pipe", "pipe", "pipe"]
     });
     claudeProc2.unref();
-    darwinAuthChild = claudeProc2;
+    const adopted2 = adoptOrStopChild(attemptId, claudeProc2);
+    console.log(`[onboarding] op=auth-login-start attempt=${attemptId} platform=darwin transport=native outcome=${adopted2 ? "started" : "self-superseded"} ${formatEnded(ended)}`);
     claudeProc2.stdin?.on("error", () => {
     });
     claudeProc2.stdout?.on("data", onClaudeOutput);
@@ -19292,11 +19373,9 @@ app13.post("/claude-auth", async (c) => {
         before: darwinCredsBefore,
         listMdats: listHostCredsMdats,
         readBlob: readHostCredsBlob,
-        writeFile: (blob) => {
-          const tmp = `${CLAUDE_CREDENTIALS_FILE}.${process.pid}.tmp`;
-          writeFileSync14(tmp, blob, { mode: 384 });
-          renameSync8(tmp, CLAUDE_CREDENTIALS_FILE);
-        },
+        // Task 2572 — the write itself lives in claude-auth.ts beside the other
+        // writer of this file, so both emit provenance and both are testable.
+        writeFile: (blob, refreshTokenLen) => writeHostCredsFile(CLAUDE_CREDENTIALS_FILE, blob, refreshTokenLen),
         log: (line) => console.log(line)
       });
       persistKeychainService(
@@ -19304,7 +19383,7 @@ app13.post("/claude-auth", async (c) => {
         (service) => writeFileSync14(join37(dirname13(CLAUDE_CREDENTIALS_FILE), ".keychain-service"), service, { mode: 384 }),
         (line) => console.log(line)
       );
-      if (darwinAuthChild === claudeProc2) darwinAuthChild = null;
+      if (pendingAuthLogin?.child === claudeProc2) pendingAuthLogin = null;
     });
     return c.json({ started: true, transport: "native" });
   }
@@ -19313,7 +19392,7 @@ app13.post("/claude-auth", async (c) => {
     if (!vncReady) return c.json({ error: "VNC display failed to start" }, 500);
   }
   await ensureCdp(transport);
-  const chromiumWrapper = writeChromiumWrapper();
+  const chromiumWrapper = writeChromiumWrapper(attemptId);
   const x11Env = buildX11Env(chromiumWrapper, transport);
   vncLog("claude-auth", { action: "start", transport });
   const claudeProc = spawn("claude", ["auth", "login"], {
@@ -19321,9 +19400,14 @@ app13.post("/claude-auth", async (c) => {
     stdio: ["ignore", "pipe", "pipe"]
   });
   claudeProc.unref();
+  const adopted = adoptOrStopChild(attemptId, claudeProc);
+  console.log(`[onboarding] op=auth-login-start attempt=${attemptId} platform=${process.platform} transport=${transport} outcome=${adopted ? "started" : "self-superseded"} ${formatEnded(ended)}`);
   claudeProc.stdout?.on("data", onClaudeOutput);
   claudeProc.stderr?.on("data", onClaudeOutput);
-  claudeProc.once("close", () => closeSync8(claudeAuthLogFd));
+  claudeProc.once("close", () => {
+    closeSync8(claudeAuthLogFd);
+    if (pendingAuthLogin?.child === claudeProc) pendingAuthLogin = null;
+  });
   await waitForAuthPage(2e4);
   return c.json({ started: true, transport });
 });
@@ -20003,7 +20087,7 @@ init_dist();
 init_paths();
 init_remote_auth();
 init_loop_registry();
-import { appendFileSync as appendFileSync3, existsSync as existsSync27, renameSync as renameSync9, statSync as statSync19 } from "fs";
+import { appendFileSync as appendFileSync4, existsSync as existsSync27, renameSync as renameSync9, statSync as statSync19 } from "fs";
 import { join as join38 } from "path";
 var CLIENT_ERRORS_LOG = join38(LOG_DIR, "client-errors.log");
 var MAX_LOG_SIZE = 10 * 1024 * 1024;
@@ -20149,7 +20233,7 @@ app15.post("/", async (c) => {
       const safe = typeof v === "string" ? truncate(v, 200) : typeof v === "number" || typeof v === "boolean" ? String(v) : JSON.stringify(v).slice(0, 200);
       return `${k}=${safe}`;
     }).join(" ");
-    const TAGGED_PREFIX_SOURCES = /* @__PURE__ */ new Set(["stream-log-click", "pwa", "graph-settle", "dashboard-load", "routines", "calendar-legibility"]);
+    const TAGGED_PREFIX_SOURCES = /* @__PURE__ */ new Set(["stream-log-click", "pwa", "graph-settle", "dashboard-load", "routines", "calendar-legibility", "channels-card"]);
     if (TAGGED_PREFIX_SOURCES.has(source)) {
       console.log(
         `[${source}] ts=${ts} ip=${ip} version=${version || "unknown"}${extra ? " " + extra : ""}`
@@ -20182,7 +20266,7 @@ app15.post("/", async (c) => {
         tag: typeof body.tag === "string" ? truncate(body.tag, 32) : void 0,
         status: typeof body.status === "number" ? body.status : void 0
       };
-      appendFileSync3(CLIENT_ERRORS_LOG, JSON.stringify(payload) + "\n", "utf-8");
+      appendFileSync4(CLIENT_ERRORS_LOG, JSON.stringify(payload) + "\n", "utf-8");
     } catch (err) {
       console.error(`[client-error] append failed: ${err instanceof Error ? err.message : String(err)}`);
     }
@@ -23275,18 +23359,18 @@ var ALLOWED_EVENTS = /* @__PURE__ */ new Set([
 ]);
 var app27 = new Hono();
 app27.post("/", async (c) => {
-  const TAG66 = "[admin:events]";
+  const TAG68 = "[admin:events]";
   let body;
   try {
     body = await c.req.json();
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG66} reject reason=body-not-json detail=${detail}`);
+    console.error(`${TAG68} reject reason=body-not-json detail=${detail}`);
     return c.json({ ok: false, detail: "Request body was not valid JSON" }, 400);
   }
   const event = typeof body.event === "string" ? body.event : "";
   if (!ALLOWED_EVENTS.has(event)) {
-    console.error(`${TAG66} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
+    console.error(`${TAG68} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
     return c.json({ ok: false, detail: `Event "${event}" is not allowed` }, 400);
   }
   const rawFields = body.fields && typeof body.fields === "object" ? body.fields : {};
@@ -34985,6 +35069,68 @@ function startSharedFolderCensus() {
   });
 }
 
+// app/lib/cred-refresh-census.ts
+init_loop_registry();
+import { readdirSync as readdirSync31, readFileSync as readFileSync53 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join59 } from "path";
+var TAG60 = "[claude-auth]";
+function refreshTokenLength(raw) {
+  let data;
+  try {
+    data = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  const oauth = data.claudeAiOauth;
+  if (!oauth || typeof oauth !== "object") return null;
+  return typeof oauth.refreshToken === "string" ? oauth.refreshToken.length : null;
+}
+function surveyBrandCredentials(home) {
+  let entries2;
+  try {
+    entries2 = readdirSync31(home);
+  } catch {
+    return [];
+  }
+  const rows = [];
+  for (const entry2 of entries2.sort()) {
+    if (!entry2.startsWith(".")) continue;
+    let raw;
+    try {
+      raw = readFileSync53(join59(home, entry2, ".claude", ".credentials.json"), "utf-8");
+    } catch {
+      continue;
+    }
+    rows.push({ brand: entry2.slice(1), refreshTokenLen: refreshTokenLength(raw) });
+  }
+  return rows;
+}
+function isBlank(row) {
+  return row.refreshTokenLen === null || row.refreshTokenLen === 0;
+}
+function censusResult(rows) {
+  if (rows.length === 0) return "no-brands-found";
+  return rows.some(isBlank) ? "blank-tokens" : "ok";
+}
+function runCredRefreshCensus(home = homedir5()) {
+  const rows = surveyBrandCredentials(home);
+  const blank = rows.filter(isBlank).length;
+  const detail = rows.map((r) => `${r.brand}:${r.refreshTokenLen === null ? "unreadable" : r.refreshTokenLen}`).join(",");
+  console.log(
+    `${TAG60} op=cred-refresh-census result=${censusResult(rows)} brands=${rows.length} blank=${blank} detail=${detail}`
+  );
+  return `${rows.length} brand(s), ${blank} blank`;
+}
+function startCredRefreshCensus() {
+  registerLoop({
+    name: "cred-refresh-census",
+    intervalMs: 60 * 60 * 1e3,
+    firstRunDelayMs: 0,
+    run: () => runCredRefreshCensus()
+  });
+}
+
 // app/lib/file-watcher.ts
 init_data_path();
 import * as fsp2 from "fs/promises";
@@ -35222,7 +35368,7 @@ init_account();
 init_neo4j_store();
 import { readdir as readdir7, readFile as readFile12, rename as rename5, writeFile as writeFile5, unlink as unlink4 } from "fs/promises";
 import { existsSync as existsSync50 } from "fs";
-import { join as join59 } from "path";
+import { join as join60 } from "path";
 var ADMIN_ROLE2 = "admin";
 var WEBCHAT_CHANNEL2 = "webchat";
 var SESSION_META_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.meta\.json$/i;
@@ -35267,7 +35413,7 @@ async function collectLiveSidecars(projectsRoot) {
   }
   for (const slug of slugs) {
     if (!slug.isDirectory()) continue;
-    const slugDir = join59(projectsRoot, slug.name);
+    const slugDir = join60(projectsRoot, slug.name);
     let entries2;
     try {
       entries2 = await readdir7(slugDir, { withFileTypes: true });
@@ -35276,9 +35422,9 @@ async function collectLiveSidecars(projectsRoot) {
     }
     for (const entry2 of entries2) {
       if (entry2.isFile() && SESSION_META_RE.test(entry2.name)) {
-        out.push(join59(slugDir, entry2.name));
+        out.push(join60(slugDir, entry2.name));
       } else if (entry2.isDirectory() && entry2.name === "subagents") {
-        const subDir = join59(slugDir, entry2.name);
+        const subDir = join60(slugDir, entry2.name);
         let subs;
         try {
           subs = await readdir7(subDir, { withFileTypes: true });
@@ -35286,7 +35432,7 @@ async function collectLiveSidecars(projectsRoot) {
           continue;
         }
         for (const s of subs) {
-          if (s.isFile() && SESSION_META_RE.test(s.name)) out.push(join59(subDir, s.name));
+          if (s.isFile() && SESSION_META_RE.test(s.name)) out.push(join60(subDir, s.name));
         }
       }
     }
@@ -35298,7 +35444,7 @@ function shortId(path) {
   return base.slice(0, 8);
 }
 async function migrateAdminWebchatSidecars(opts = {}) {
-  const projectsRoot = opts.projectsRoot ?? (process.env.CLAUDE_CONFIG_DIR ? join59(process.env.CLAUDE_CONFIG_DIR, "projects") : null) ?? "";
+  const projectsRoot = opts.projectsRoot ?? (process.env.CLAUDE_CONFIG_DIR ? join60(process.env.CLAUDE_CONFIG_DIR, "projects") : null) ?? "";
   const usersFile = opts.usersFile ?? USERS_FILE;
   const accountId = opts.accountId ?? resolveAccount()?.accountId ?? null;
   const resolveName = opts.resolveName ?? defaultResolveName;
@@ -35376,7 +35522,7 @@ async function migrateAdminWebchatSidecars(opts = {}) {
 init_account();
 import { readdir as readdir8, readFile as readFile13, rename as rename6, writeFile as writeFile6, unlink as unlink5 } from "fs/promises";
 import { existsSync as existsSync51 } from "fs";
-import { join as join60 } from "path";
+import { join as join61 } from "path";
 var SESSION_META_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.meta\.json$/i;
 function projectSlugForCwd(cwd) {
   return cwd.replace(/\//g, "-");
@@ -35422,7 +35568,7 @@ async function collectSidecars(projectsRoot) {
   }
   for (const slug of slugs) {
     if (!slug.isDirectory()) continue;
-    const slugDir = join60(projectsRoot, slug.name);
+    const slugDir = join61(projectsRoot, slug.name);
     let entries2;
     try {
       entries2 = await readdir8(slugDir, { withFileTypes: true });
@@ -35431,9 +35577,9 @@ async function collectSidecars(projectsRoot) {
     }
     for (const entry2 of entries2) {
       if (entry2.isFile() && SESSION_META_RE2.test(entry2.name)) {
-        out.push({ path: join60(slugDir, entry2.name), slug: slug.name });
+        out.push({ path: join61(slugDir, entry2.name), slug: slug.name });
       } else if (entry2.isDirectory() && (entry2.name === "subagents" || entry2.name === "archive")) {
-        const subDir = join60(slugDir, entry2.name);
+        const subDir = join61(slugDir, entry2.name);
         let subs;
         try {
           subs = await readdir8(subDir, { withFileTypes: true });
@@ -35442,7 +35588,7 @@ async function collectSidecars(projectsRoot) {
         }
         for (const s of subs) {
           if (s.isFile() && SESSION_META_RE2.test(s.name)) {
-            out.push({ path: join60(subDir, s.name), slug: slug.name });
+            out.push({ path: join61(subDir, s.name), slug: slug.name });
           }
         }
       }
@@ -35451,7 +35597,7 @@ async function collectSidecars(projectsRoot) {
   return out;
 }
 async function migrateSidecarAccountIds(opts = {}) {
-  const projectsRoot = opts.projectsRoot ?? (process.env.CLAUDE_CONFIG_DIR ? join60(process.env.CLAUDE_CONFIG_DIR, "projects") : null) ?? "";
+  const projectsRoot = opts.projectsRoot ?? (process.env.CLAUDE_CONFIG_DIR ? join61(process.env.CLAUDE_CONFIG_DIR, "projects") : null) ?? "";
   const accounts = opts.accounts ?? listValidAccounts();
   const result = {
     scanned: 0,
@@ -35546,13 +35692,13 @@ var InboundHub = class {
     if (s.subscriber && s.ready) {
       if (payload.accountId !== s.accountId) this.crossAccountDelivered++;
       s.subscriber(payload);
-      s.inFlight.push({ payload, state: "drained", enqueuedAt: now, drainedAt: now });
+      s.inFlight.push({ payload, state: "drained", enqueuedAt: now, drainedAt: now, spawnUndeliveredAt: null });
       return;
     }
     if (this.subscriberAccounts(payload.senderId).some((a) => a !== payload.accountId)) {
       this.crossAccountQueued++;
     }
-    s.inFlight.push({ payload, state: "queued", enqueuedAt: now, drainedAt: null });
+    s.inFlight.push({ payload, state: "queued", enqueuedAt: now, drainedAt: null, spawnUndeliveredAt: null });
   }
   /** This account's channel server for the sender connected. Register the
    *  subscriber but do NOT drain yet — the drain waits for markReady so nothing
@@ -35611,13 +35757,16 @@ var InboundHub = class {
    *     is attached -> inbound-undelivered (the readiness handoff broke);
    *   - a still-queued message older than queuedThresholdMs with NO subscriber
    *     attached -> spawn-undelivered (the channel server never attached: spawn
-   *     failed, or the session ended and never resumed);
+   *     failed, or the session ended and never resumed). Task 2575 — reported
+   *     ONCE and RETAINED, because the gateway retries the spawn for it;
+   *   - a still-queued message with NO subscriber older than giveUpMs ->
+   *     spawn-given-up (Task 2575: the retry window closed), removed;
    *   - a drained message unacked past ackThresholdMs -> drain-undelivered (the
    *     channel server never confirmed receipt — the silent cold-start drop).
    *  Task 2290 — "a subscriber" means one attached for the SAME account, so a
    *  message waiting on its own account's cold start is not masked by another
    *  account's live subscriber on the same phone. Each message is emitted at
-   *  most once (removed when emitted). */
+   *  most once per kind; every kind but spawn-undelivered removes it. */
   sweep(now, t) {
     const events = [];
     for (const s of this.senders.values()) {
@@ -35627,9 +35776,17 @@ var InboundHub = class {
           events.push({ kind: "inbound-undelivered", accountId, senderId, waMessageId: e.payload.waMessageId, ageMs: now - e.enqueuedAt });
           return false;
         }
-        if (e.state === "queued" && !s.subscriber && now - e.enqueuedAt > t.queuedThresholdMs) {
-          events.push({ kind: "spawn-undelivered", accountId, senderId, waMessageId: e.payload.waMessageId, ageMs: now - e.enqueuedAt });
-          return false;
+        if (e.state === "queued" && !s.subscriber) {
+          const age = now - e.enqueuedAt;
+          if (age > t.giveUpMs) {
+            events.push({ kind: "spawn-given-up", accountId, senderId, waMessageId: e.payload.waMessageId, ageMs: age });
+            return false;
+          }
+          if (age > t.queuedThresholdMs && e.spawnUndeliveredAt == null) {
+            e.spawnUndeliveredAt = now;
+            events.push({ kind: "spawn-undelivered", accountId, senderId, waMessageId: e.payload.waMessageId, ageMs: age });
+          }
+          return true;
         }
         if (e.state === "drained" && e.drainedAt != null && now - e.drainedAt > t.ackThresholdMs) {
           events.push({ kind: "drain-undelivered", accountId, senderId, waMessageId: e.payload.waMessageId, ageMs: now - e.drainedAt });
@@ -35640,6 +35797,23 @@ var InboundHub = class {
     }
     return events;
   }
+  /** Task 2575 — every key holding queued work with NO subscriber whose oldest
+   *  message is older than `thresholdMs`. This is the population a refused spawn
+   *  leaves behind: the gateway's sweep re-invokes the retained spawn arguments
+   *  for each one. Read-only — it emits nothing and mutates nothing, so calling
+   *  it cannot consume a terminal event the sweep is about to report. */
+  heldSpawns(now, thresholdMs) {
+    const out = [];
+    for (const s of this.senders.values()) {
+      if (s.subscriber) continue;
+      const queued = s.inFlight.filter((e) => e.state === "queued");
+      if (queued.length === 0) continue;
+      const oldestAgeMs = Math.max(...queued.map((e) => now - e.enqueuedAt));
+      if (oldestAgeMs <= thresholdMs) continue;
+      out.push({ accountId: s.accountId, senderId: s.senderId, oldestAgeMs, count: queued.length });
+    }
+    return out;
+  }
   /** Task 2290 — every account holding a live subscriber for this phone, sorted.
    *  Read-only. Feeds the cross-account field on the inbound log line and the
    *  queued census, so a phone shared across accounts is greppable at the moment
@@ -36142,6 +36316,7 @@ init_loop_registry();
 var QUEUED_THRESHOLD_MS = 3e4;
 var ACK_THRESHOLD_MS = 3e4;
 var SWEEP_INTERVAL_MS = 15e3;
+var GIVE_UP_MS = 3e5;
 var MEDIA_STANZA_STALE_MS = 12e4;
 var WaGateway = class {
   constructor(deps) {
@@ -36163,6 +36338,14 @@ var WaGateway = class {
   // effective session account — the file-path validation scope.
   docContexts = /* @__PURE__ */ new Map();
   spawning = /* @__PURE__ */ new Set();
+  /** Task 2575 — the arguments of the last `ensureChannelSession` call per hub
+   *  key, so the sweep can re-invoke a spawn that was refused. The refusal is not
+   *  visible here — `ensureChannelSession` returns void and server/index.ts logs
+   *  and returns on the `{ error }` envelope — so the retry keys off queue state
+   *  (a queued message with no subscriber), which is the observable consequence
+   *  of the refusal. `attempts` is the per-key retry counter that rides the log
+   *  line, reset whenever a fresh inbound takes the spawn path. */
+  heldSpawnArgs = /* @__PURE__ */ new Map();
   seq = 0;
   // Task 2110 — senderId -> the arrival ms of every still-unemitted non-audio
   // media stanza for that sender, oldest first. This is the race window: a reply
@@ -36299,7 +36482,8 @@ var WaGateway = class {
   reconcile(now) {
     const events = this.hub.sweep(now, {
       queuedThresholdMs: QUEUED_THRESHOLD_MS,
-      ackThresholdMs: ACK_THRESHOLD_MS
+      ackThresholdMs: ACK_THRESHOLD_MS,
+      giveUpMs: GIVE_UP_MS
     });
     for (const e of events) {
       console.error(
@@ -36321,6 +36505,53 @@ var WaGateway = class {
     );
     return events;
   }
+  /** Task 2575 — re-invoke the retained spawn for every key holding queued work
+   *  with no channel server attached. Driven by startSweeper() beside reconcile();
+   *  called directly with an injected clock in tests. Returns the number of
+   *  ensureChannelSession calls made.
+   *
+   *  This is the missing action behind `op=spawn-undelivered`. Before it, that
+   *  line was emitted and nothing consumed it: on 2026-08-08 it fired for wa-1 at
+   *  ageMs=37743 and the message was never delivered.
+   *
+   *  A retry while auth is still dead re-enters the same refusal and returns; the
+   *  cost is one refusal line plus one op=spawn-retry line per key per sweep,
+   *  bounded by the hub's 5-minute give-up. */
+  async retryHeldSpawns(now) {
+    const held = this.hub.heldSpawns(now, QUEUED_THRESHOLD_MS);
+    let calls = 0;
+    for (const h of held) {
+      const key2 = hubKey(h.accountId, h.senderId);
+      if (this.spawning.has(key2)) continue;
+      const entry2 = this.heldSpawnArgs.get(key2);
+      if (!entry2) {
+        console.error(
+          `[whatsapp-native] op=spawn-retry-skipped senderId=${h.senderId} accountId=${h.accountId} ageMs=${h.oldestAgeMs} queued=${h.count} reason=no-args`
+        );
+        continue;
+      }
+      entry2.attempts++;
+      this.spawning.add(key2);
+      calls++;
+      try {
+        await this.deps.ensureChannelSession(entry2.args);
+        console.error(
+          `[whatsapp-native] op=spawn-retry senderId=${h.senderId} accountId=${h.accountId} attempt=${entry2.attempts} ageMs=${h.oldestAgeMs} queued=${h.count} ok=true`
+        );
+      } catch (err) {
+        console.error(
+          `[whatsapp-native] op=spawn-retry senderId=${h.senderId} accountId=${h.accountId} attempt=${entry2.attempts} ageMs=${h.oldestAgeMs} queued=${h.count} ok=false reason=${err instanceof Error ? err.message : String(err)}`
+        );
+      } finally {
+        this.spawning.delete(key2);
+      }
+    }
+    const heldKeys = new Set(held.map((h) => hubKey(h.accountId, h.senderId)));
+    for (const k of [...this.heldSpawnArgs.keys()]) {
+      if (!heldKeys.has(k) && !this.spawning.has(k)) this.heldSpawnArgs.delete(k);
+    }
+    return calls;
+  }
   /** Arm the periodic reconciliation sweep in the long-lived UI process.
    *
    *  Task 1814 — armed through the registry, so it appears on /activity. This
@@ -36338,9 +36569,14 @@ var WaGateway = class {
     return registerLoop({
       name: "whatsapp-native-sweep",
       intervalMs,
-      run: () => {
-        const events = this.reconcile(Date.now());
-        return events.length > 0 ? `${events.length} terminal events` : void 0;
+      run: async () => {
+        const now = Date.now();
+        const events = this.reconcile(now);
+        const retried = await this.retryHeldSpawns(now);
+        const parts = [];
+        if (events.length > 0) parts.push(`${events.length} terminal events`);
+        if (retried > 0) parts.push(`${retried} spawn retries`);
+        return parts.length > 0 ? parts.join(", ") : void 0;
       }
     });
   }
@@ -36448,33 +36684,35 @@ var WaGateway = class {
       console.error(
         `[whatsapp-native] op=spawn-trigger senderId=${senderId} accountId=${input.effectiveAccountId}`
       );
+      const spawnArgs = {
+        accountId: input.accountId,
+        effectiveAccountId: input.effectiveAccountId,
+        senderId,
+        role: input.role ?? "admin",
+        personId: input.personId ?? null,
+        gatewayUrl: this.deps.gatewayUrl,
+        serverPath: this.deps.serverPath,
+        // Task 1575 — the gate's owner-self verdict; drives owner attribution
+        // for an unbound owner self-phone at the spawn site.
+        ownerSelfPhone: input.ownerSelfPhone,
+        // Task 2262 — resolved once in onMessage; its presence routes this
+        // spawn to /public-spawn under the named public agent.
+        publicAgentSlug: input.publicAgentSlug,
+        // Task 2281 — the correlation id, so the spawn outcome lines join the
+        // rest of this inbound's lifeline. Only this call site takes it: the
+        // passive branch above never reaches the public spawn, which is where
+        // op=spawn-ok and op=spawn-failed are emitted.
+        inboundId: input.inboundId,
+        // Task 2234 — the registered-party label, forwarded verbatim so the
+        // spawn env carries WA_SENDER_PARTY. Undefined for every other sender.
+        // Only this call site takes it: the passive branch above hardcodes
+        // role:'admin', and a registered party is public, so the combination
+        // cannot arise there.
+        party: input.party
+      };
+      this.heldSpawnArgs.set(spawnKey, { args: spawnArgs, attempts: 0 });
       try {
-        await this.deps.ensureChannelSession({
-          accountId: input.accountId,
-          effectiveAccountId: input.effectiveAccountId,
-          senderId,
-          role: input.role ?? "admin",
-          personId: input.personId ?? null,
-          gatewayUrl: this.deps.gatewayUrl,
-          serverPath: this.deps.serverPath,
-          // Task 1575 — the gate's owner-self verdict; drives owner attribution
-          // for an unbound owner self-phone at the spawn site.
-          ownerSelfPhone: input.ownerSelfPhone,
-          // Task 2262 — resolved once in onMessage; its presence routes this
-          // spawn to /public-spawn under the named public agent.
-          publicAgentSlug: input.publicAgentSlug,
-          // Task 2281 — the correlation id, so the spawn outcome lines join the
-          // rest of this inbound's lifeline. Only this call site takes it: the
-          // passive branch above never reaches the public spawn, which is where
-          // op=spawn-ok and op=spawn-failed are emitted.
-          inboundId: input.inboundId,
-          // Task 2234 — the registered-party label, forwarded verbatim so the
-          // spawn env carries WA_SENDER_PARTY. Undefined for every other sender.
-          // Only this call site takes it: the passive branch above hardcodes
-          // role:'admin', and a registered party is public, so the combination
-          // cannot arise there.
-          party: input.party
-        });
+        await this.deps.ensureChannelSession(spawnArgs);
       } finally {
         this.spawning.delete(spawnKey);
       }
@@ -37002,8 +37240,41 @@ function createWebchatChannelRoutes(deps) {
 }
 
 // app/lib/webchat/gateway/resolve-turn-answer.ts
-import { existsSync as existsSync52, openSync as openSync9, readSync as readSync8, closeSync as closeSync9, readdirSync as readdirSync31 } from "fs";
-import { join as join61 } from "path";
+import { existsSync as existsSync52, openSync as openSync9, readSync as readSync8, closeSync as closeSync9, readdirSync as readdirSync32 } from "fs";
+import { join as join62 } from "path";
+
+// app/lib/channel-delivery/outbound-guard.ts
+var INTERNAL_LEAK_PATTERNS = [
+  { name: "task-id", re: /\bTasks?[\s-]+\d{2,4}\b/g },
+  { name: "media-path", re: /\/tmp\/maxy-media[A-Za-z0-9_./-]*/g },
+  { name: "repo-path", re: /\bplatform\/[A-Za-z0-9_./-]+/g },
+  { name: "bundle", re: /\bserver\.(?:js|cjs|mjs)\b/g },
+  { name: "source-file", re: /\b[A-Za-z0-9_-]+\.tsx?\b/g },
+  { name: "log-tag", re: /\[[a-z]+(?:-[a-z]+)+\]/g },
+  { name: "op-tag", re: /\bop=[a-z][a-z-]*\b/g }
+];
+function redactInternalLeaks(text) {
+  const redactions = [];
+  let clean = text;
+  for (const { name, re } of INTERNAL_LEAK_PATTERNS) {
+    clean = clean.replace(re, (m) => {
+      redactions.push({ pattern: name, match: m });
+      return "[redacted]";
+    });
+  }
+  return { clean, redactions };
+}
+function guardOutbound(senderId, text) {
+  const { clean, redactions } = redactInternalLeaks(text);
+  for (const r of redactions) {
+    console.error(
+      `[channel-guard] op=redact senderId=${senderId} pattern=${r.pattern} bytes=${Buffer.byteLength(r.match, "utf8")}`
+    );
+  }
+  return clean;
+}
+
+// app/lib/webchat/gateway/resolve-turn-answer.ts
 function resolveTurnAnswer(p) {
   if (!SESSION_ID_RE2.test(p.sessionId)) return "";
   const path = findJsonl(p.projectsRoot, p.sessionId);
@@ -37028,18 +37299,18 @@ function resolveTurnAnswer(p) {
   for (const turn of turns) {
     if (turn.kind === "agent-webchat-final" || turn.kind === "agent-reply") parts.push(turn.text);
   }
-  return segmentText(parts.join("\n\n")).join("\n\n");
+  return segmentText(guardOutbound(p.senderId, parts.join("\n\n"))).join("\n\n");
 }
 function findJsonl(projectsRoot, sessionId) {
   if (!existsSync52(projectsRoot)) return null;
   let slugs;
   try {
-    slugs = readdirSync31(projectsRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+    slugs = readdirSync32(projectsRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
   } catch {
     return null;
   }
   for (const slug of slugs) {
-    const live = join61(projectsRoot, slug, `${sessionId}.jsonl`);
+    const live = join62(projectsRoot, slug, `${sessionId}.jsonl`);
     if (existsSync52(live)) return live;
   }
   return null;
@@ -37187,7 +37458,7 @@ var WebchatGateway = class _WebchatGateway {
     if (rec) rec.lastActivityAt = Date.now();
     const awaiter = this.replyAwaiters.get(key2);
     const projectsRoot = this.deps.publicProjectsRoot?.() ?? "";
-    const text = projectsRoot ? resolveTurnAnswer({ ...turn, projectsRoot }) : "";
+    const text = projectsRoot ? resolveTurnAnswer({ ...turn, senderId: keyDisplay(key2), projectsRoot }) : "";
     const bytes = Buffer.byteLength(text, "utf8");
     const deliveredAt = this.lastDeliveredAt.get(key2);
     const latency = deliveredAt != null ? Date.now() - deliveredAt : -1;
@@ -37682,37 +37953,6 @@ var AnswerAccumulator = class {
   }
 };
 
-// app/lib/channel-delivery/outbound-guard.ts
-var INTERNAL_LEAK_PATTERNS = [
-  { name: "task-id", re: /\bTasks?[\s-]+\d{2,4}\b/g },
-  { name: "media-path", re: /\/tmp\/maxy-media[A-Za-z0-9_./-]*/g },
-  { name: "repo-path", re: /\bplatform\/[A-Za-z0-9_./-]+/g },
-  { name: "bundle", re: /\bserver\.(?:js|cjs|mjs)\b/g },
-  { name: "source-file", re: /\b[A-Za-z0-9_-]+\.tsx?\b/g },
-  { name: "log-tag", re: /\[[a-z]+(?:-[a-z]+)+\]/g },
-  { name: "op-tag", re: /\bop=[a-z][a-z-]*\b/g }
-];
-function redactInternalLeaks(text) {
-  const redactions = [];
-  let clean = text;
-  for (const { name, re } of INTERNAL_LEAK_PATTERNS) {
-    clean = clean.replace(re, (m) => {
-      redactions.push({ pattern: name, match: m });
-      return "[redacted]";
-    });
-  }
-  return { clean, redactions };
-}
-function guardOutbound(senderId, text) {
-  const { clean, redactions } = redactInternalLeaks(text);
-  for (const r of redactions) {
-    console.error(
-      `[channel-guard] op=redact senderId=${senderId} pattern=${r.pattern} bytes=${Buffer.byteLength(r.match, "utf8")}`
-    );
-  }
-  return clean;
-}
-
 // app/lib/channel-delivery/emitter.ts
 function followerPendingMaxMs() {
   return Number(process.env.CHANNEL_PTY_FOLLOWER_PENDING_MAX_MS ?? String(3e5));
@@ -38054,14 +38294,14 @@ function makeFileDelivery(opts) {
 }
 
 // app/lib/webchat/file-delivery.ts
-var TAG60 = "[webchat-adaptor]";
+var TAG61 = "[webchat-adaptor]";
 function platformRoot2() {
   return process.env.MAXY_PLATFORM_ROOT || "";
 }
 function makeWebchatSendFile(entry2) {
   return async (filePath) => {
     if (!entry2.accountId) {
-      console.error(`${TAG60} file-delivery reject reason=no-account sender=${entry2.senderId}`);
+      console.error(`${TAG61} file-delivery reject reason=no-account sender=${entry2.senderId}`);
       return { ok: false, error: "no-account" };
     }
     const accountDir = resolve47(platformRoot2(), "..", "data/accounts", entry2.accountId);
@@ -38069,14 +38309,14 @@ function makeWebchatSendFile(entry2) {
       const resolved = realpathSync9(filePath);
       const accountResolved = realpathSync9(accountDir);
       if (!resolved.startsWith(accountResolved + "/")) {
-        console.error(`${TAG60} file-delivery reject reason=outside_account_directory sender=${entry2.senderId}`);
+        console.error(`${TAG61} file-delivery reject reason=outside_account_directory sender=${entry2.senderId}`);
         return { ok: false, error: "outside-account" };
       }
       return { ok: true };
     } catch (err) {
       const code = err.code;
       console.error(
-        `${TAG60} file-delivery reject reason=${code === "ENOENT" ? "not-found" : "path-error"} sender=${entry2.senderId}`
+        `${TAG61} file-delivery reject reason=${code === "ENOENT" ? "not-found" : "path-error"} sender=${entry2.senderId}`
       );
       return { ok: false, error: code === "ENOENT" ? "not-found" : "path-error" };
     }
@@ -38085,7 +38325,7 @@ function makeWebchatSendFile(entry2) {
 function makeWebchatFileDelivery(entry2) {
   return makeFileDelivery({
     entry: entry2,
-    tag: TAG60,
+    tag: TAG61,
     channel: "webchat",
     sendFile: makeWebchatSendFile(entry2),
     deferUntilVerdict: true
@@ -38165,7 +38405,7 @@ function buildPublicWebchatSpawnRequest(input) {
 }
 
 // app/lib/whatsapp/inbound/file-delivery-bridge.ts
-var TAG61 = "[whatsapp-adaptor]";
+var TAG62 = "[whatsapp-adaptor]";
 var SEND_USER_FILE2 = "SendUserFile";
 var WHATSAPP_SEND_DOCUMENT = "whatsapp-send-document";
 function platformRoot3() {
@@ -38183,7 +38423,7 @@ function makeWhatsAppSendFile(entry2, maxyAccountId) {
     });
     if (result.ok) return { ok: true };
     console.error(
-      `${TAG61} file-delivery reject reason=send-failed sender=${entry2.senderId} status=${result.status} message=${result.error}`
+      `${TAG62} file-delivery reject reason=send-failed sender=${entry2.senderId} status=${result.status} message=${result.error}`
     );
     return { ok: false, error: result.error };
   };
@@ -38191,7 +38431,7 @@ function makeWhatsAppSendFile(entry2, maxyAccountId) {
 function makeWhatsAppFileDelivery(entry2, maxyAccountId) {
   const shared = makeFileDelivery({
     entry: entry2,
-    tag: TAG61,
+    tag: TAG62,
     channel: "whatsapp",
     sendFile: makeWhatsAppSendFile(entry2, maxyAccountId)
   });
@@ -38226,7 +38466,7 @@ function makeWhatsAppFileDelivery(entry2, maxyAccountId) {
         if (!delivered) {
           const fileField = call.filePath !== void 0 ? ` file=${call.filePath}` : "";
           console.error(
-            `${TAG61} file-delivery-unreconciled sender=${entry2.senderId} sessionId=${sid} tool=${WHATSAPP_SEND_DOCUMENT}${fileField}`
+            `${TAG62} file-delivery-unreconciled sender=${entry2.senderId} sessionId=${sid} tool=${WHATSAPP_SEND_DOCUMENT}${fileField}`
           );
         }
       }
@@ -38391,6 +38631,34 @@ function whatsappDoorLabel(doorId) {
   return decoded ? `${id82(decoded.accountId)}:${id82(decoded.senderId)}` : id82(doorId);
 }
 
+// app/lib/channel-delivery/refusal-notice.ts
+var TAG63 = "[channel-delivery]";
+var notified = /* @__PURE__ */ new Set();
+function refusalNoticeText(reason) {
+  return reason === "claude-auth-dead" ? "Your message arrived but no assistant could be started: the Claude sign-in on this install is not active. An operator has to sign in again; send this again once they have." : `Your message arrived but no assistant could be started (${reason}). Nothing was lost; try again shortly.`;
+}
+async function sendRefusalNotice(input) {
+  if (notified.has(input.doorId)) return;
+  const fields = `channel=${input.channel} sender=${input.sender} reason=${input.reason}`;
+  if (!input.send) {
+    console.error(`${TAG63} op=refusal-notice-failed ${fields} error=no-target`);
+    return;
+  }
+  try {
+    await input.send(guardOutbound(input.sender, refusalNoticeText(input.reason)));
+  } catch (e) {
+    console.error(
+      `${TAG63} op=refusal-notice-failed ${fields} error=${e instanceof Error ? e.message : String(e)}`
+    );
+    return;
+  }
+  notified.add(input.doorId);
+  console.error(`${TAG63} op=refusal-notice ${fields} status=${input.status}`);
+}
+function clearRefusalNotice(doorId) {
+  notified.delete(doorId);
+}
+
 // app/lib/telegram/gateway/inbound-hub.ts
 var InboundHub3 = class {
   keys = /* @__PURE__ */ new Map();
@@ -38411,9 +38679,9 @@ var InboundHub3 = class {
     const s = this.state(payload.key);
     if (s.subscriber && s.ready) {
       s.subscriber(payload);
-      s.inFlight.push({ payload, state: "drained", enqueuedAt: now, drainedAt: now });
+      s.inFlight.push({ payload, state: "drained", enqueuedAt: now, drainedAt: now, spawnUndeliveredAt: null });
     } else {
-      s.inFlight.push({ payload, state: "queued", enqueuedAt: now, drainedAt: null });
+      s.inFlight.push({ payload, state: "queued", enqueuedAt: now, drainedAt: null, spawnUndeliveredAt: null });
     }
   }
   /** A key's channel server connected. Register the subscriber but do NOT
@@ -38473,9 +38741,18 @@ var InboundHub3 = class {
    *  that never reached the agent:
    *   - a still-queued message older than queuedThresholdMs WHILE a subscriber
    *     is attached -> inbound-undelivered (the readiness handoff broke);
+   *   - a still-queued message older than queuedThresholdMs with NO subscriber
+   *     attached -> spawn-undelivered (the channel server never attached: the
+   *     spawn was refused, or the session ended and never resumed). Task 2575 —
+   *     this case did not exist on this door at all before, which is why tg-1
+   *     survived the 2026-08-08 outage unreported. Reported ONCE and RETAINED,
+   *     because the gateway retries the spawn for it;
+   *   - a still-queued message with NO subscriber older than giveUpMs ->
+   *     spawn-given-up (Task 2575: the retry window closed), removed;
    *   - a drained message unacked past ackThresholdMs -> drain-undelivered (the
    *     channel server never confirmed receipt — the silent cold-start drop).
-   *  Each message is emitted at most once (removed when emitted). */
+   *  Each message is emitted at most once per kind; every kind but
+   *  spawn-undelivered removes it. */
   sweep(now, t) {
     const events = [];
     for (const [key2, s] of this.keys) {
@@ -38484,6 +38761,18 @@ var InboundHub3 = class {
           events.push({ kind: "inbound-undelivered", key: key2, messageId: e.payload.messageId, ageMs: now - e.enqueuedAt });
           return false;
         }
+        if (e.state === "queued" && !s.subscriber) {
+          const age = now - e.enqueuedAt;
+          if (age > t.giveUpMs) {
+            events.push({ kind: "spawn-given-up", key: key2, messageId: e.payload.messageId, ageMs: age });
+            return false;
+          }
+          if (age > t.queuedThresholdMs && e.spawnUndeliveredAt == null) {
+            e.spawnUndeliveredAt = now;
+            events.push({ kind: "spawn-undelivered", key: key2, messageId: e.payload.messageId, ageMs: age });
+          }
+          return true;
+        }
         if (e.state === "drained" && e.drainedAt != null && now - e.drainedAt > t.ackThresholdMs) {
           events.push({ kind: "drain-undelivered", key: key2, messageId: e.payload.messageId, ageMs: now - e.drainedAt });
           return false;
@@ -38493,6 +38782,23 @@ var InboundHub3 = class {
     }
     return events;
   }
+  /** Task 2575 — every key holding queued work with NO subscriber whose oldest
+   *  message is older than `thresholdMs`. The gateway's sweep re-invokes the
+   *  retained spawn arguments for each one. Read-only — it emits nothing and
+   *  mutates nothing, so calling it cannot consume a terminal event the sweep is
+   *  about to report. */
+  heldSpawns(now, thresholdMs) {
+    const out = [];
+    for (const [key2, s] of this.keys) {
+      if (s.subscriber) continue;
+      const queued = s.inFlight.filter((e) => e.state === "queued");
+      if (queued.length === 0) continue;
+      const oldestAgeMs = Math.max(...queued.map((e) => now - e.enqueuedAt));
+      if (oldestAgeMs <= thresholdMs) continue;
+      out.push({ key: key2, oldestAgeMs, count: queued.length });
+    }
+    return out;
+  }
   /** Whether a key currently has a live channel server attached. The gateway
    *  uses this to decide whether an inbound needs a cold-start spawn/resume. */
   hasSubscriber(key2) {
@@ -38666,6 +38972,7 @@ init_loop_registry();
 var QUEUED_THRESHOLD_MS3 = 3e4;
 var ACK_THRESHOLD_MS3 = 3e4;
 var SWEEP_INTERVAL_MS3 = 15e3;
+var GIVE_UP_MS2 = 3e5;
 function telegramSubjectSessionId(input) {
   if (input.role === "admin") {
     const adminUserId = input.adminUserId ?? void 0;
@@ -38679,16 +38986,6 @@ var TelegramGateway = class {
   }
   hub = new InboundHub3();
   replies = /* @__PURE__ */ new Map();
-  /** Task 2559 — the keys whose last inbound was `role:'admin'`. The follower
-   *  census's bound set is the doors that SHOULD have a reader, and a public
-   *  Telegram session is given none by design: the public branch of
-   *  `buildTelegramEnsureSession` returns before the attach block, because the
-   *  file follower is an admin surface. Including a public key would report it
-   *  missing on every tick for ever and stop `missing=` ever reaching zero,
-   *  which is the one signal the census exists to give. Removed on a public
-   *  inbound, because the role is read from account config on every inbound and
-   *  a bot can be flipped between the two. */
-  adminKeys = /* @__PURE__ */ new Set();
   spawning = /* @__PURE__ */ new Set();
   /** Task 2428 — keys whose channel server signalled ready while their spawn was
    *  still in flight. The harness discards a channel notification that arrives
@@ -38699,6 +38996,14 @@ var TelegramGateway = class {
    *  `resume-bound`. Holding the signal here rather than draining leaves
    *  `hub.ready` false, so every message in the window queues and none is lost. */
   readyWhileSpawning = /* @__PURE__ */ new Set();
+  /** Task 2575 — the arguments of the last `ensureChannelSession` call per key,
+   *  so the sweep can re-invoke a spawn that was refused. The refusal is not
+   *  visible here — `ensureChannelSession` returns void and the refusal sites in
+   *  server/telegram-ensure-session.ts log and return — so the retry keys off
+   *  queue state, the observable consequence of the refusal. `attempts` is the
+   *  per-key retry counter that rides the log line, reset whenever a fresh
+   *  inbound takes the spawn path. */
+  heldSpawnArgs = /* @__PURE__ */ new Map();
   seq = 0;
   /** Hono sub-app exposing the loopback channel routes; mount on the UI app. */
   routes() {
@@ -38745,7 +39050,8 @@ var TelegramGateway = class {
   reconcile(now) {
     const events = this.hub.sweep(now, {
       queuedThresholdMs: QUEUED_THRESHOLD_MS3,
-      ackThresholdMs: ACK_THRESHOLD_MS3
+      ackThresholdMs: ACK_THRESHOLD_MS3,
+      giveUpMs: GIVE_UP_MS2
     });
     for (const e of events) {
       console.error(
@@ -38754,6 +39060,49 @@ var TelegramGateway = class {
     }
     return events;
   }
+  /** Task 2575 — re-invoke the retained spawn for every key holding queued work
+   *  with no channel server attached. Driven by startSweeper() beside reconcile();
+   *  called directly with an injected clock in tests. Returns the number of
+   *  ensureChannelSession calls made.
+   *
+   *  This door kept its held message across the 2026-08-08 outage but still
+   *  waited 4m41s for it, because the drain fires only when a later inbound
+   *  spawns successfully. This is the trigger that removes that wait. */
+  async retryHeldSpawns(now) {
+    const held = this.hub.heldSpawns(now, QUEUED_THRESHOLD_MS3);
+    let calls = 0;
+    for (const h of held) {
+      if (this.spawning.has(h.key)) continue;
+      const entry2 = this.heldSpawnArgs.get(h.key);
+      if (!entry2) {
+        console.error(
+          `[telegram-native] op=spawn-retry-skipped key=${h.key} ageMs=${h.oldestAgeMs} queued=${h.count} reason=no-args`
+        );
+        continue;
+      }
+      entry2.attempts++;
+      this.spawning.add(h.key);
+      calls++;
+      try {
+        await this.deps.ensureChannelSession(entry2.args);
+        console.error(
+          `[telegram-native] op=spawn-retry key=${h.key} attempt=${entry2.attempts} ageMs=${h.oldestAgeMs} queued=${h.count} ok=true`
+        );
+      } catch (err) {
+        console.error(
+          `[telegram-native] op=spawn-retry key=${h.key} attempt=${entry2.attempts} ageMs=${h.oldestAgeMs} queued=${h.count} ok=false reason=${err instanceof Error ? err.message : String(err)}`
+        );
+      } finally {
+        this.spawning.delete(h.key);
+        if (this.readyWhileSpawning.delete(h.key)) this.drain(h.key);
+      }
+    }
+    const heldKeys = new Set(held.map((h) => h.key));
+    for (const k of [...this.heldSpawnArgs.keys()]) {
+      if (!heldKeys.has(k) && !this.spawning.has(k)) this.heldSpawnArgs.delete(k);
+    }
+    return calls;
+  }
   /** Arm the periodic reconciliation sweep in the long-lived UI process.
    *
    *  Task 1814 — armed through the registry, so it appears on /activity. This
@@ -38771,9 +39120,14 @@ var TelegramGateway = class {
     return registerLoop({
       name: "telegram-native-sweep",
       intervalMs,
-      run: () => {
-        const events = this.reconcile(Date.now());
-        return events.length > 0 ? `${events.length} terminal events` : void 0;
+      run: async () => {
+        const now = Date.now();
+        const events = this.reconcile(now);
+        const retried = await this.retryHeldSpawns(now);
+        const parts = [];
+        if (events.length > 0) parts.push(`${events.length} terminal events`);
+        if (retried > 0) parts.push(`${retried} spawn retries`);
+        return parts.length > 0 ? parts.join(", ") : void 0;
       }
     });
   }
@@ -38800,8 +39154,6 @@ var TelegramGateway = class {
     const willDeliverNow = this.hub.isReady(key2);
     const source = input.source ?? "user";
     this.replies.set(key2, input.reply);
-    if (input.role === "admin") this.adminKeys.add(key2);
-    else this.adminKeys.delete(key2);
     let standingRules;
     if (input.role === "admin" && this.deps.fetchStandingRules) {
       const res = await this.deps.fetchStandingRules(input.accountId);
@@ -38847,21 +39199,23 @@ var TelegramGateway = class {
       this.spawning.add(key2);
       console.error(`[telegram-native] op=spawn-trigger key=${key2} botId=${input.botId} role=${input.role}`);
       noteSpawnAttempt2(input.botId);
+      const spawnArgs = {
+        accountId: input.accountId,
+        accountDir: input.accountDir,
+        botId: input.botId,
+        botToken: input.botToken,
+        agentSlug: input.agentSlug,
+        channelKey: key2,
+        senderId: input.senderId,
+        role: input.role,
+        personId: input.personId ?? null,
+        chatId: input.chatId,
+        gatewayUrl: this.deps.gatewayUrl,
+        serverPath: this.deps.serverPath
+      };
+      this.heldSpawnArgs.set(key2, { args: spawnArgs, attempts: 0 });
       try {
-        await this.deps.ensureChannelSession({
-          accountId: input.accountId,
-          accountDir: input.accountDir,
-          botId: input.botId,
-          botToken: input.botToken,
-          agentSlug: input.agentSlug,
-          channelKey: key2,
-          senderId: input.senderId,
-          role: input.role,
-          personId: input.personId ?? null,
-          chatId: input.chatId,
-          gatewayUrl: this.deps.gatewayUrl,
-          serverPath: this.deps.serverPath
-        });
+        await this.deps.ensureChannelSession(spawnArgs);
       } finally {
         this.spawning.delete(key2);
         if (this.readyWhileSpawning.delete(key2)) this.drain(key2);
@@ -38876,17 +39230,21 @@ var TelegramGateway = class {
   liveReplyTarget(key2) {
     return this.replies.get(key2) ?? null;
   }
-  /** Task 2559 — every admin door this gateway currently holds a live delivery
-   *  closure for, as the `<botId>:<senderId>` channel key the follower registry
-   *  keys on. The twin of `WaGateway.boundTargets()`: the census reconciles
-   *  against exactly this set, so "should have a reader" and "can be sent to"
-   *  are one fact and cannot drift. A key `parseTelegramChannelKey` rejects is
-   *  the pre-2368 bare-sender shape, skipped rather than halved at an arbitrary
-   *  offset, which would yield a door id nothing keys on. */
+  /** Task 2559 — every door this gateway currently holds a live delivery closure
+   *  for, as the `<botId>:<senderId>` channel key the follower registry keys on.
+   *  The twin of `WaGateway.boundTargets()`: the census reconciles against
+   *  exactly this set, so "should have a reader" and "can be sent to" are one
+   *  fact and cannot drift. A key `parseTelegramChannelKey` rejects is the
+   *  pre-2368 bare-sender shape, skipped rather than halved at an arbitrary
+   *  offset, which would yield a door id nothing keys on.
+   *
+   *  Task 2541 — every role, not admin only. 2559 filtered public keys out of
+   *  this set because a public session was given no reader; it has one now, so
+   *  the filter would hide the door instead of the absence. That is what it did:
+   *  `bound=1 attached=1 missing=0` printed on every tick while a public
+   *  visitor's answer reached no chat at all. */
   boundTargets() {
-    return [...this.replies.keys()].filter(
-      (key2) => this.adminKeys.has(key2) && parseTelegramChannelKey(key2) !== null
-    );
+    return [...this.replies.keys()].filter((key2) => parseTelegramChannelKey(key2) !== null);
   }
   async sendOutbound(key2, text) {
     const reply = this.replies.get(key2);
@@ -38928,7 +39286,7 @@ function buildTelegramSpawnRequest(input) {
 }
 
 // server/telegram-ensure-session.ts
-var TAG62 = "[telegram-inbound]";
+var TAG64 = "[telegram-inbound]";
 function buildTelegramEnsureSession(deps) {
   return async (input) => {
     const req = buildTelegramSpawnRequest({
@@ -38942,6 +39300,18 @@ function buildTelegramEnsureSession(deps) {
       // Task 1789 — admin rows only; see the WhatsApp twin.
       overrideSessionId: input.role === "admin" ? deps.resolveSessionOverride(input.accountId, input.channelKey) : null
     });
+    const notifySend = async (text) => {
+      const sent = await deps.sendText(input.botToken, Number(input.chatId), text);
+      if (!sent.ok) throw new Error(sent.error ?? "send failed");
+    };
+    const notifyRefused = (result2) => sendRefusalNotice({
+      channel: "telegram",
+      doorId: req.channelKey,
+      sender: req.channelKey,
+      reason: result2.error,
+      status: result2.status,
+      send: notifySend
+    });
     if (input.role === "public") {
       const result2 = await deps.managerRcSpawn({
         senderId: req.channelKey,
@@ -38959,15 +39329,24 @@ function buildTelegramEnsureSession(deps) {
           `[telegram-native] op=spawn-failed botId=${input.botId} key=${req.channelKey} role=public agent=${input.agentSlug} error=${result2.error} status=${result2.status}`
         );
         noteSpawnFailed2(input.botId);
+        await notifyRefused(result2);
         return;
       }
       console.error(
-        `${TAG62} op=telegram-spawn-door botId=${input.botId} role=public door=rc agent=${input.agentSlug}`
+        `${TAG64} op=telegram-spawn-door botId=${input.botId} role=public door=rc agent=${input.agentSlug}`
       );
       console.error(
-        `${TAG62} op=spawn botId=${input.botId} sessionId=${result2.sessionId} targetAccountId=${input.accountId} role=public`
+        `${TAG64} op=spawn botId=${input.botId} sessionId=${result2.sessionId} targetAccountId=${input.accountId} role=public`
       );
       noteSpawnOk2(input.botId);
+      clearRefusalNotice(req.channelKey);
+      deps.followers.attach({
+        sessionId: result2.sessionId,
+        senderId: req.channelKey,
+        accountId: input.accountId,
+        chatId: input.chatId,
+        botToken: input.botToken
+      });
       return;
     }
     const result = await deps.managerRcSpawn(req);
@@ -38976,12 +39355,14 @@ function buildTelegramEnsureSession(deps) {
         `[telegram-native] op=spawn-failed botId=${input.botId} key=${req.channelKey} role=admin error=${result.error} status=${result.status}`
       );
       noteSpawnFailed2(input.botId);
+      await notifyRefused(result);
       return;
     }
     console.error(
-      `${TAG62} op=spawn botId=${input.botId} sessionId=${req.sessionId} targetAccountId=${input.accountId} role=admin`
+      `${TAG64} op=spawn botId=${input.botId} sessionId=${req.sessionId} targetAccountId=${input.accountId} role=admin`
     );
     noteSpawnOk2(input.botId);
+    clearRefusalNotice(req.channelKey);
     deps.followers.attach({
       sessionId: req.sessionId,
       senderId: req.channelKey,
@@ -38997,7 +39378,7 @@ init_attachments();
 import { realpathSync as realpathSync10 } from "fs";
 import { readFile as readFile14, stat as stat10 } from "fs/promises";
 import { resolve as resolve48, basename as basename16 } from "path";
-var TAG63 = "[telegram:outbound]";
+var TAG65 = "[telegram:outbound]";
 var TELEGRAM_DOCUMENT_MAX_BYTES = 50 * 1024 * 1024;
 async function sendTelegramDocument(input) {
   const { botToken, chatId, filePath, caption, maxyAccountId, platformRoot: platformRoot5 } = input;
@@ -39014,10 +39395,10 @@ async function sendTelegramDocument(input) {
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
-      console.error(`${TAG63} document ENOENT scope=account-dir accountDir=${accountDir} maxyAccountId=${maxyAccountId}`);
+      console.error(`${TAG65} document ENOENT scope=account-dir accountDir=${accountDir} maxyAccountId=${maxyAccountId}`);
       return { ok: false, status: 500, error: `Account directory not resolvable for ${maxyAccountId}` };
     }
-    console.error(`${TAG63} document path error scope=account-dir maxyAccountId=${maxyAccountId}: ${String(err)}`);
+    console.error(`${TAG65} document path error scope=account-dir maxyAccountId=${maxyAccountId}: ${String(err)}`);
     return { ok: false, status: 500, error: String(err) };
   }
   let resolvedPath;
@@ -39026,14 +39407,14 @@ async function sendTelegramDocument(input) {
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
-      console.error(`${TAG63} document ENOENT scope=file path=${filePath} maxyAccountId=${maxyAccountId}`);
+      console.error(`${TAG65} document ENOENT scope=file path=${filePath} maxyAccountId=${maxyAccountId}`);
       return { ok: false, status: 404, error: `File not found: ${filePath}` };
     }
-    console.error(`${TAG63} document path error scope=file maxyAccountId=${maxyAccountId}: ${String(err)}`);
+    console.error(`${TAG65} document path error scope=file maxyAccountId=${maxyAccountId}: ${String(err)}`);
     return { ok: false, status: 500, error: String(err) };
   }
   if (!resolvedPath.startsWith(accountResolved + "/")) {
-    console.error(`${TAG63} document REJECTED reason=outside_account_directory maxyAccountId=${maxyAccountId}`);
+    console.error(`${TAG65} document REJECTED reason=outside_account_directory maxyAccountId=${maxyAccountId}`);
     return { ok: false, status: 403, error: "Access denied: file is outside the account directory" };
   }
   const fileStat = await stat10(resolvedPath);
@@ -39066,24 +39447,24 @@ async function sendTelegramDocument(input) {
     error = e instanceof Error ? e.message : String(e);
   }
   console.error(
-    `${TAG63} sent document to=${chatId} file=${filename} bytes=${fileStat.size} ok=${ok2}` + (messageId !== void 0 ? ` id=${messageId}` : "")
+    `${TAG65} sent document to=${chatId} file=${filename} bytes=${fileStat.size} ok=${ok2}` + (messageId !== void 0 ? ` id=${messageId}` : "")
   );
   return ok2 ? { ok: true, messageId } : { ok: false, status: 500, error };
 }
 
 // app/lib/telegram/outbound/file-delivery.ts
-var TAG64 = "[telegram:outbound]";
+var TAG66 = "[telegram:outbound]";
 function platformRoot4() {
   return process.env.MAXY_PLATFORM_ROOT || "";
 }
 function makeTelegramSendFile(entry2, botToken) {
   return async (filePath, caption) => {
     if (!botToken) {
-      console.error(`${TAG64} file-delivery reject reason=no-bot-token sender=${entry2.senderId} role=${entry2.role}`);
+      console.error(`${TAG66} file-delivery reject reason=no-bot-token sender=${entry2.senderId} role=${entry2.role}`);
       return { ok: false, error: "no-bot-token" };
     }
     if (entry2.replyTarget == null) {
-      console.error(`${TAG64} file-delivery reject reason=no-reply-target sender=${entry2.senderId} role=${entry2.role}`);
+      console.error(`${TAG66} file-delivery reject reason=no-reply-target sender=${entry2.senderId} role=${entry2.role}`);
       return { ok: false, error: "no-reply-target" };
     }
     const result = await sendTelegramDocument({
@@ -39100,7 +39481,7 @@ function makeTelegramSendFile(entry2, botToken) {
 function makeTelegramFileDelivery(entry2, botToken) {
   return makeFileDelivery({
     entry: entry2,
-    tag: TAG64,
+    tag: TAG66,
     channel: "telegram",
     sendFile: makeTelegramSendFile(entry2, botToken)
   });
@@ -39190,7 +39571,7 @@ init_webchat();
 // app/lib/channel-pty-bridge/public-session-end-review.ts
 init_src3();
 import { randomUUID as randomUUID14 } from "crypto";
-var TAG65 = "[public-session-review]";
+var TAG67 = "[public-session-review]";
 var CONSUMED_CAP = 500;
 var consumed = /* @__PURE__ */ new Set();
 function consumeOnce(sessionId) {
@@ -39217,7 +39598,7 @@ async function fetchJsonl(sessionId) {
     return await res.text();
   } catch (err) {
     console.error(
-      `${TAG65} jsonl-fetch-failed sessionId=${sessionId} err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG67} jsonl-fetch-failed sessionId=${sessionId} err="${err instanceof Error ? err.message : String(err)}"`
     );
     return null;
   }
@@ -39241,7 +39622,7 @@ async function fetchPriorWrites(sliceToken, accountId) {
     const res = await fetch(url);
     if (!res.ok) {
       console.error(
-        `${TAG65} prior-writes-fetch-failed sliceToken=${sliceToken.slice(0, 8)} status=${res.status}`
+        `${TAG67} prior-writes-fetch-failed sliceToken=${sliceToken.slice(0, 8)} status=${res.status}`
       );
       return [];
     }
@@ -39249,7 +39630,7 @@ async function fetchPriorWrites(sliceToken, accountId) {
     return Array.isArray(body.writes) ? body.writes : [];
   } catch (err) {
     console.error(
-      `${TAG65} prior-writes-fetch-threw sliceToken=${sliceToken.slice(0, 8)} err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG67} prior-writes-fetch-threw sliceToken=${sliceToken.slice(0, 8)} err="${err instanceof Error ? err.message : String(err)}"`
     );
     return [];
   }
@@ -39278,7 +39659,7 @@ function composeInitialMessage(input) {
 }
 async function dispatchReviewer(input, initialMessage) {
   const sessionId = randomUUID14();
-  console.log(`${TAG65} route target=rc-spawn sessionId=${sessionId.slice(0, 8)} sourceSession=${input.sessionId.slice(0, 8)}`);
+  console.log(`${TAG67} route target=rc-spawn sessionId=${sessionId.slice(0, 8)} sourceSession=${input.sessionId.slice(0, 8)}`);
   const spawned = await managerRcSpawn({
     sessionId,
     initialMessage,
@@ -39302,21 +39683,21 @@ async function firePublicSessionEndReview(input) {
   const dispatchedAt = Date.now();
   if (consumed.has(input.sessionId)) {
     console.log(
-      `${TAG65} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
+      `${TAG67} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
     );
     return;
   }
   const jsonl = await fetchJsonl(input.sessionId);
   if (!jsonl) {
     console.log(
-      `${TAG65} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-jsonl-missing`
+      `${TAG67} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-jsonl-missing`
     );
     return;
   }
   const operatorTurns = countOperatorTurns(jsonl);
   if (operatorTurns === 0) {
     console.log(
-      `${TAG65} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-no-turns`
+      `${TAG67} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-no-turns`
     );
     return;
   }
@@ -39330,19 +39711,19 @@ async function firePublicSessionEndReview(input) {
   });
   if (!consumeOnce(input.sessionId)) {
     console.log(
-      `${TAG65} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
+      `${TAG67} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
     );
     return;
   }
   const dispatched = await dispatchReviewer(input, initialMessage);
   if (!dispatched.ok) {
     console.error(
-      `${TAG65} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-spawn-failed reason=${dispatched.reason}`
+      `${TAG67} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-spawn-failed reason=${dispatched.reason}`
     );
     return;
   }
   console.log(
-    `${TAG65} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=dispatched managerSessionId=${dispatched.managerSessionId} operatorTurns=${operatorTurns} priorWrites=${priorWrites.length} ms=${Date.now() - dispatchedAt}`
+    `${TAG67} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=dispatched managerSessionId=${dispatched.managerSessionId} operatorTurns=${operatorTurns} priorWrites=${priorWrites.length} ms=${Date.now() - dispatchedAt}`
   );
 }
 
@@ -39494,7 +39875,7 @@ init_account();
 
 // server/telegram-audit.ts
 import { statSync as statSync28 } from "fs";
-import { join as join62 } from "path";
+import { join as join63 } from "path";
 init_channel_key();
 init_sidebar_sessions();
 function buildTelegramAuditLines(input) {
@@ -39560,7 +39941,7 @@ function countTelegramSessionsForAccount(accountId) {
 function* walkTelegramSidecars() {
   const cfg = claudeConfigDir();
   if (!cfg) return;
-  const projectsRoot = join62(cfg, "projects");
+  const projectsRoot = join63(cfg, "projects");
   for (const { path } of enumerateSessionSidecars(projectsRoot)) {
     const meta = readSidecarMeta(path);
     if (meta.channel !== "telegram" || !meta.accountId) continue;
@@ -39595,15 +39976,15 @@ function answeringOriginTarget(send, key2, noteAnswered3) {
 }
 
 // server/telegram-migrate.ts
-import { readFileSync as readFileSync53, writeFileSync as writeFileSync19, existsSync as existsSync53, renameSync as renameSync11, mkdirSync as mkdirSync11 } from "fs";
-import { dirname as dirname18, join as join63 } from "path";
+import { readFileSync as readFileSync54, writeFileSync as writeFileSync19, existsSync as existsSync53, renameSync as renameSync11, mkdirSync as mkdirSync11 } from "fs";
+import { dirname as dirname18, join as join64 } from "path";
 function migrateTelegramTwoSlot(input) {
   const out = [];
   for (const account of input.accounts) {
-    const configPath3 = join63(account.accountDir, "account.json");
+    const configPath3 = join64(account.accountDir, "account.json");
     let config;
     try {
-      config = JSON.parse(readFileSync53(configPath3, "utf-8"));
+      config = JSON.parse(readFileSync54(configPath3, "utf-8"));
     } catch {
       console.error(`[telegram-audit] op=migrate-unreadable accountId=${account.accountId}`);
       continue;
@@ -39705,14 +40086,14 @@ function backfillMisfiledRecords(params) {
 init_message_store();
 
 // server/lib/booking-site-accounts.ts
-import { existsSync as existsSync54, readFileSync as readFileSync54 } from "fs";
+import { existsSync as existsSync54, readFileSync as readFileSync55 } from "fs";
 import { resolve as resolve49 } from "path";
 function listBookingSiteAccounts(accounts) {
   return accounts.filter((a) => {
     const availPath = resolve49(a.accountDir, "calendar-availability.json");
     if (!existsSync54(availPath)) return false;
     try {
-      const cfg = JSON.parse(readFileSync54(availPath, "utf-8"));
+      const cfg = JSON.parse(readFileSync55(availPath, "utf-8"));
       return typeof cfg.bookingDbName === "string" && cfg.bookingDbName.length > 0;
     } catch {
       return false;
@@ -39757,7 +40138,7 @@ init_paths();
 
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash7, verify as cryptoVerify } from "crypto";
-import { existsSync as existsSync55, readFileSync as readFileSync55, statSync as statSync29 } from "fs";
+import { existsSync as existsSync55, readFileSync as readFileSync56, statSync as statSync29 } from "fs";
 import { resolve as resolve50 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
@@ -39821,7 +40202,7 @@ function resolveEntitlement(brand, account) {
 function verifyAndResolve(brand, entitlementPath, account) {
   let pubkeyPem;
   try {
-    pubkeyPem = readFileSync55(pubkeyPath(brand), "utf-8");
+    pubkeyPem = readFileSync56(pubkeyPath(brand), "utf-8");
   } catch (err) {
     return logResolved(anonymousFallback("pubkey-missing"), {
       reason: "pubkey-missing"
@@ -39835,7 +40216,7 @@ function verifyAndResolve(brand, entitlementPath, account) {
   }
   let envelope;
   try {
-    envelope = JSON.parse(readFileSync55(entitlementPath, "utf-8"));
+    envelope = JSON.parse(readFileSync56(entitlementPath, "utf-8"));
   } catch {
     return logResolved(anonymousFallback("malformed"), { reason: "malformed" });
   }
@@ -39997,14 +40378,14 @@ function clientFrom(c) {
 }
 installMediaDownloadGuard();
 var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT || "";
-var BRAND_JSON_PATH = PLATFORM_ROOT6 ? join64(PLATFORM_ROOT6, "config", "brand.json") : "";
+var BRAND_JSON_PATH = PLATFORM_ROOT6 ? join65(PLATFORM_ROOT6, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", marketingUrl: "https://getmaxy.com" };
 if (BRAND_JSON_PATH && !existsSync56(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
 }
 if (BRAND_JSON_PATH && existsSync56(BRAND_JSON_PATH)) {
   try {
-    const parsed = JSON.parse(readFileSync56(BRAND_JSON_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync57(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
   } catch (err) {
     console.error(`[brand] Failed to parse brand.json: ${err.message}`);
@@ -40036,11 +40417,11 @@ var brandLoginOpts = {
   appleTouchIconPath: brandAppIcon512Path,
   themeColor: BRAND.defaultColors?.primary
 };
-var ALIAS_DOMAINS_PATH = join64(homedir5(), BRAND.configDir, "alias-domains.json");
+var ALIAS_DOMAINS_PATH = join65(homedir6(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
     if (!existsSync56(ALIAS_DOMAINS_PATH)) return null;
-    const parsed = JSON.parse(readFileSync56(ALIAS_DOMAINS_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync57(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
       return null;
@@ -40181,7 +40562,7 @@ var waGateway = new WaGateway({
   // resolver and `fanTargetsFor` is a constructor dep, not a callable method.
   fanTargetsFor: whatsappFanTargets,
   gatewayUrl: `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`,
-  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve51(process.env.MAXY_PLATFORM_ROOT ?? join64(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
+  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve51(process.env.MAXY_PLATFORM_ROOT ?? join65(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
   // Task 751 / 1390 — file delivery on the native channel. `maxyAccountId` (the
   // path-validation scope) is the sender's effective SESSION account, resolved
   // once at the inbound gate and threaded here via the gateway's per-sender doc
@@ -40196,7 +40577,7 @@ var waGateway = new WaGateway({
       caption,
       accountId,
       maxyAccountId,
-      platformRoot: resolve51(process.env.MAXY_PLATFORM_ROOT ?? join64(__dirname, ".."))
+      platformRoot: resolve51(process.env.MAXY_PLATFORM_ROOT ?? join65(__dirname, ".."))
     });
     return result.ok ? { ok: true, messageId: result.messageId } : { ok: false, error: result.error };
   },
@@ -40286,11 +40667,20 @@ var waGateway = new WaGateway({
           `[whatsapp:public-agent] op=spawn-failed inboundId=${inboundId} senderId=${senderId} slug=${publicAgentSlug} error=${publicResult.error}`
         );
         noteSpawnFailed();
+        await sendRefusalNotice({
+          channel: "whatsapp",
+          doorId: whatsappDoorId({ effectiveAccountId, senderId }),
+          sender: senderId,
+          reason: publicResult.error,
+          status: publicResult.status,
+          send: waGateway.liveReplyTarget(effectiveAccountId, senderId)
+        });
       } else {
         console.error(
           `[whatsapp:public-agent] op=spawn-ok inboundId=${inboundId} senderId=${senderId} slug=${publicAgentSlug} ms=${Date.now() - publicSpawnStartedAt}`
         );
         noteSpawnOk();
+        clearRefusalNotice(whatsappDoorId({ effectiveAccountId, senderId }));
       }
       return;
     }
@@ -40329,8 +40719,17 @@ var waGateway = new WaGateway({
     const result = await managerRcSpawn({ ...req, userId, party });
     if ("error" in result) {
       console.error(`[whatsapp-native] spawn-failed senderId=${senderId} role=${role} error=${result.error} status=${result.status}`);
+      await sendRefusalNotice({
+        channel: "whatsapp",
+        doorId: whatsappDoorId({ effectiveAccountId, senderId }),
+        sender: senderId,
+        reason: result.error,
+        status: result.status,
+        send: waGateway.liveReplyTarget(effectiveAccountId, senderId)
+      });
       return;
     }
+    clearRefusalNotice(whatsappDoorId({ effectiveAccountId, senderId }));
     nativeFileFollowers.attach({
       sessionId: req.sessionId,
       senderId,
@@ -40353,7 +40752,7 @@ function runDuplicateSenderAudit() {
   try {
     const configDir = process.env.CLAUDE_CONFIG_DIR;
     if (!configDir) return;
-    const projectsRoot = join64(configDir, "projects");
+    const projectsRoot = join65(configDir, "projects");
     const records2 = [];
     for (const { path: jsonlPath, isSubagent, archived } of enumerateJsonls(projectsRoot)) {
       if (isSubagent || archived) continue;
@@ -40405,7 +40804,7 @@ var webchatGateway = new WebchatGateway({
   // rather than hanging the POST.
   publicProjectsRoot: () => {
     const cfg = claudeConfigDir();
-    return cfg ? join64(cfg, "projects") : "";
+    return cfg ? join65(cfg, "projects") : "";
   },
   gatewayUrl: webchatGatewayUrl(),
   serverPath: webchatServerPath(),
@@ -40562,6 +40961,8 @@ var telegramGateway = new TelegramGateway({
     managerRcSpawn,
     managerSpawn,
     resolveSessionOverride: (accountId, channelKey) => resolveChannelOverride(accountId, "telegram", channelKey),
+    // Task 2573 — the send the refusal notice goes out on.
+    sendText: sendTelegramText,
     followers: telegramFileFollowers
   })
 });
@@ -41047,7 +41448,7 @@ app80.get("/agent-assets/:slug/:filename", (c) => {
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[agent-assets] serve slug=${slug} file=${filename} status=200`);
-  const body = readFileSync56(filePath);
+  const body = readFileSync57(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=3600"
@@ -41077,7 +41478,7 @@ app80.get("/generated/:filename", (c) => {
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[generated] serve file=${filename} status=200`);
-  const body = readFileSync56(filePath);
+  const body = readFileSync57(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=86400"
@@ -41092,7 +41493,7 @@ var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
 if (BRAND_JSON_PATH && existsSync56(BRAND_JSON_PATH)) {
   try {
-    const fullBrand = JSON.parse(readFileSync56(BRAND_JSON_PATH, "utf-8"));
+    const fullBrand = JSON.parse(readFileSync57(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
     brandIconPath = fullBrand.assets?.icon ? `/brand/${fullBrand.assets.icon}` : brandLogoPath;
   } catch {
@@ -41123,7 +41524,7 @@ var brandAppIconsExist = [brandAppIcon192Path, brandAppIcon512Path, brandMaskabl
 );
 var SW_SOURCE = (() => {
   try {
-    return readFileSync56(resolve51(process.cwd(), "public", "sw.js"), "utf-8");
+    return readFileSync57(resolve51(process.cwd(), "public", "sw.js"), "utf-8");
   } catch {
     return null;
   }
@@ -41131,9 +41532,9 @@ var SW_SOURCE = (() => {
 function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT6) return "unknown";
-    const versionFile = join64(PLATFORM_ROOT6, "config", `.${BRAND.hostname}-version`);
+    const versionFile = join65(PLATFORM_ROOT6, "config", `.${BRAND.hostname}-version`);
     if (!existsSync56(versionFile)) return "unknown";
-    const content = readFileSync56(versionFile, "utf-8").trim();
+    const content = readFileSync57(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
     return "unknown";
@@ -41144,7 +41545,7 @@ var versionScript = `<script>window.__MAXY_VERSION__=${JSON.stringify(INSTALLED_
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync56(resolve51(process.cwd(), "public", file), "utf-8");
+    html = readFileSync57(resolve51(process.cwd(), "public", file), "utf-8");
     const productNameEsc = escapeHtml(BRAND.productName);
     html = html.replace(/<title>([^<]*)<\/title>/, (_match, inner) => `<title>${escapeHtml(inner).replace(/Maxy/g, productNameEsc)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
@@ -41161,14 +41562,14 @@ ${clientErrorReporterScript}
   return html;
 }
 function loadBrandingCache(agentSlug) {
-  const configDir = join64(homedir5(), BRAND.configDir);
+  const configDir = join65(homedir6(), BRAND.configDir);
   try {
     const verdict = resolvePublicAddressFromDisk(agentSlug);
     const accountId = verdict.kind === "served" ? verdict.owner.accountId : getDefaultAccountId();
     if (!accountId) return null;
-    const cachePath = join64(configDir, "branding-cache", accountId, `${agentSlug}.json`);
+    const cachePath = join65(configDir, "branding-cache", accountId, `${agentSlug}.json`);
     if (!existsSync56(cachePath)) return null;
-    return JSON.parse(readFileSync56(cachePath, "utf-8"));
+    return JSON.parse(readFileSync57(cachePath, "utf-8"));
   } catch {
     return null;
   }
@@ -41263,7 +41664,7 @@ app80.use("/vnc-popout.html", logViewerFetch);
 app80.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync56(resolve51(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync57(resolve51(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -41417,7 +41818,7 @@ var hostname = process.env.HOSTNAME ?? "127.0.0.1";
 var httpServer = serve({ fetch: app80.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
-  const reconcilePlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join64(__dirname, "..");
+  const reconcilePlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join65(__dirname, "..");
   const reconcileScript = resolve51(reconcilePlatformRoot, "plugins/scheduling/mcp/dist/scripts/reconcile-bookings.js");
   const runReconcile = (ctx) => {
     if (!existsSync56(reconcileScript)) return;
@@ -41440,7 +41841,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     detached: true,
     run: runReconcile
   });
-  const reconcileStatePath = join64(MAXY_DIR, "booking-reconcile-state.json");
+  const reconcileStatePath = join65(MAXY_DIR, "booking-reconcile-state.json");
   registerLoop({
     name: "calendar-reconcile-liveness",
     intervalMs: 6e5,
@@ -41458,7 +41859,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 }
 {
   const DREAM_CYCLE_SWEEP_INTERVAL_MS = 36e5;
-  const dreamPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join64(__dirname, "..");
+  const dreamPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join65(__dirname, "..");
   const dreamSweepScript = resolve51(dreamPlatformRoot, "plugins/memory/mcp/dist/scripts/dream-cycle-sweep.js");
   registerLoop({
     name: "dream-cycle-sweep",
@@ -41482,7 +41883,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const outlookPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join64(__dirname, "..");
+  const outlookPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join65(__dirname, "..");
   const outlookScript = resolve51(outlookPlatformRoot, "plugins/outlook/mcp/dist/scripts/complete-registration.js");
   const OUTLOOK_COMPLETE_INTERVAL_MS = 3e4;
   const runOutlookComplete = (ctx) => {
@@ -41508,7 +41909,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const auditRoot = process.env.MAXY_PLATFORM_ROOT ?? join64(__dirname, "..");
+  const auditRoot = process.env.MAXY_PLATFORM_ROOT ?? join65(__dirname, "..");
   const strandedAccountsDir = resolve51(auditRoot, "..", "data/accounts");
   const STRANDED_AUDIT_INTERVAL_MS = 3e5;
   const STRANDED_AGE_MS = 16 * 6e4;
@@ -41517,7 +41918,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     try {
       if (!existsSync56(strandedAccountsDir)) return;
       const now = Date.now();
-      for (const name of readdirSync32(strandedAccountsDir)) {
+      for (const name of readdirSync33(strandedAccountsDir)) {
         if (!STRANDED_UUID_RE.test(name)) continue;
         const pendingPath2 = resolve51(strandedAccountsDir, name, "secrets/outlook/pending-devicecode.enc");
         if (!existsSync56(pendingPath2)) continue;
@@ -41538,7 +41939,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const googleRoot = process.env.MAXY_PLATFORM_ROOT ?? join64(__dirname, "..");
+  const googleRoot = process.env.MAXY_PLATFORM_ROOT ?? join65(__dirname, "..");
   const googleAccountsDir = resolve51(googleRoot, "..", "data/accounts");
   const GOOGLE_PENDING_AUDIT_INTERVAL_MS = 3e5;
   const runGooglePendingAuditSafe = () => {
@@ -41582,7 +41983,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join64(__dirname, "..");
+  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join65(__dirname, "..");
   const STORAGE_AUDIT_INTERVAL_MS = 3e5;
   const runStorageAuditSafe = () => runStorageAudit(auditPlatformRoot).catch((err) => {
     console.error(`[storage-audit] error="${err.message}"`);
@@ -41618,7 +42019,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     accounts: listValidAccounts().map((a) => ({ accountId: a.accountId, accountDir: a.accountDir })),
     secretPathFor: secretPath,
     legacySecretPathFor: (botType, accountId) => resolve51(
-      homedir5(),
+      homedir6(),
       configDirName2(),
       `${botType === "admin" ? ".telegram-admin-webhook-secret" : ".telegram-webhook-secret"}.${accountId}`
     ),
@@ -41641,7 +42042,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     const lastByBot = newestTelegramSessionByBot();
     let secretFilesOnDisk = [];
     try {
-      secretFilesOnDisk = readdirSync32(telegramSecretsDir());
+      secretFilesOnDisk = readdirSync33(telegramSecretsDir());
     } catch {
     }
     const lines = buildTelegramAuditLines({
@@ -41784,7 +42185,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const publishPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join64(__dirname, "..");
+  const publishPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join65(__dirname, "..");
   const publishScript = resolve51(publishPlatformRoot, "plugins/scheduling/mcp/dist/scripts/publish-availability.js");
   const PUBLISH_INTERVAL_MS = 3e5;
   const bookingAccounts = () => {
@@ -41819,7 +42220,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     let hasBookingSite = false;
     try {
       if (existsSync56(availPath)) {
-        const cfg = JSON.parse(readFileSync56(availPath, "utf-8"));
+        const cfg = JSON.parse(readFileSync57(availPath, "utf-8"));
         hasBookingSite = typeof cfg.bookingDbName === "string" && cfg.bookingDbName.length > 0;
       }
     } catch {
@@ -41829,7 +42230,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     let lastSuccessAt = null;
     if (existsSync56(statePath)) {
       try {
-        const rec = JSON.parse(readFileSync56(statePath, "utf-8"));
+        const rec = JSON.parse(readFileSync57(statePath, "utf-8"));
         lastSuccessAt = rec.lastSuccessAt ?? null;
       } catch {
         console.error(`[calendar-availability] op=audit accountId=${account.accountId} snapshotAgeMs=na reason=bad-state-file`);
@@ -41864,7 +42265,7 @@ startDispatchCensus(() => getSession());
 startDispatchFieldCensus(() => getSession());
 startDispatchTgCensus(() => getSession());
 {
-  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join64(__dirname, "..");
+  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join65(__dirname, "..");
   const auditScript = resolve51(auditPlatformRoot, "plugins/connector/mcp/dist/scripts/audit-connectors.js");
   const auditLogDir = process.env.LOG_DIR ?? LOG_DIR;
   const CONNECTOR_AUDIT_INTERVAL_MS = 3e5;
@@ -41995,7 +42396,7 @@ async function runAdminUserReconcileTick() {
       console.error("[adminuser-self-heal] skip reason=no-users-file");
       return;
     }
-    const usersRaw = readFileSync56(USERS_FILE, "utf-8").trim();
+    const usersRaw = readFileSync57(USERS_FILE, "utf-8").trim();
     if (!usersRaw) {
       console.error("[adminuser-self-heal] skip reason=empty-users-file");
       return;
@@ -42077,8 +42478,8 @@ var runIngestAuditTick = () => {
       },
       agentExists: (accountId, slug) => {
         if (!house) return false;
-        const dir = isHouseAccountKey(house.accountId, accountId) ? house.accountDir : join64(ACCOUNTS_DIR, accountId);
-        return existsSync56(join64(dir, "agents", slug, "config.json"));
+        const dir = isHouseAccountKey(house.accountId, accountId) ? house.accountDir : join65(ACCOUNTS_DIR, accountId);
+        return existsSync56(join65(dir, "agents", slug, "config.json"));
       }
     });
   } catch (err) {
@@ -42126,9 +42527,9 @@ registerLoop({
       runPublicAddressCollisionAudit({
         houseAccountId: () => resolveAccount()?.accountId ?? null,
         activeSlugs: () => listValidAccounts().map((a) => {
-          const agentsRoot = join64(a.accountDir, "agents");
+          const agentsRoot = join65(a.accountDir, "agents");
           if (!existsSync56(agentsRoot)) return { accountId: a.accountId, slugs: [] };
-          const slugs = readdirSync32(agentsRoot, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name).filter((slug) => isActiveAgentSlug(a.accountDir, slug));
+          const slugs = readdirSync33(agentsRoot, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name).filter((slug) => isActiveAgentSlug(a.accountDir, slug));
           return { accountId: a.accountId, slugs };
         })
       });
@@ -42142,7 +42543,7 @@ registerLoop({
 var USERS_RECONCILE_INTERVAL_MS = 60 * 60 * 1e3;
 function countUsersRows() {
   if (!existsSync56(USERS_FILE)) return 0;
-  const raw = readFileSync56(USERS_FILE, "utf-8").trim();
+  const raw = readFileSync57(USERS_FILE, "utf-8").trim();
   if (!raw) return 0;
   const users = JSON.parse(raw);
   return users.filter((u) => typeof u.userId === "string").length;
@@ -42173,6 +42574,7 @@ registerLoop({
 });
 startGraphHealthTimer();
 startSharedFolderCensus();
+startCredRefreshCensus();
 void migrateUploads().catch((err) => console.error(`[uploads-migrate] failed err="${err instanceof Error ? err.message : String(err)}"`)).finally(() => {
   void startFileWatcher().catch((err) => {
     console.error(`[file-watcher] start-failed err="${err instanceof Error ? err.message : String(err)}"`);
@@ -42295,7 +42697,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve51(process.env.MAXY_PLATFORM_ROOT ?? join64(__dirname, "..")),
+  platformRoot: resolve51(process.env.MAXY_PLATFORM_ROOT ?? join65(__dirname, "..")),
   accountConfig: bootAccountConfig,
   // Task 2074 — enrich with the sub-account name and fan out to every open
   // admin SSE stream. Fire-and-forget: the manager's persist path must not