@rubytech/create-sitedesk-code 0.1.508 → 0.1.510

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-index-push.test.ts

@@ -45,10 +45,20 @@ afterEach(() => rmSync(dir, { recursive: true, force: true }))
 function fakeClient() {
   const calls: { sql: string; params: unknown[] }[] = []
   const rows = new Set<string>()
+  // The pointer is modelled because the flip is read back (Task 1926): a client
+  // that always answers "no pointer" would make every push read as superseded.
+  let pointer: number | null = null
   return {
     calls,
     async query(sql: string, params: unknown[] = []) {
       calls.push({ sql, params })
+      if (/SELECT\s+currentGeneration/i.test(sql)) {
+        return pointer === null ? [] : [{ currentGeneration: pointer }]
+      }
+      if (/INSERT INTO directory_state/i.test(sql)) {
+        pointer = Number(params[1])
+        return []
+      }
       // The open paren is load-bearing: `INSERT INTO directory_state` would
       // otherwise register as a row insert and inflate every count.
       if (/INSERT INTO directory \(/i.test(sql)) {
@@ -308,15 +318,24 @@ function generationClient() {
         })
         return []
       }
+      if (/SELECT\s+MAX\(generation\)/i.test(sql)) {
+        const mine = rows.filter((r) => r.accountId === String(params[0]))
+        return [{ g: mine.length ? Math.max(...mine.map((r) => r.generation)) : null }]
+      }
       if (/DELETE FROM directory\b/i.test(sql)) {
         const g = Number(params[1])
-        // Two DELETE shapes reach this client: the post-flip sweep removes
-        // every OTHER generation (`generation != ?`); the pre-stage clear
-        // (Task 1923) removes exactly THIS generation (`generation = ?`).
-        if (/generation\s*!=\s*\?/i.test(sql)) {
-          for (let i = rows.length - 1; i >= 0; i--) if (rows[i].generation !== g) rows.splice(i, 1)
-        } else {
-          for (let i = rows.length - 1; i >= 0; i--) if (rows[i].generation === g) rows.splice(i, 1)
+        // The post-flip sweep removes strictly OLDER generations
+        // (`generation < ?`, Task 1926). `generation != ?` is the shape it
+        // replaced and `generation = ?` was the Task 1923 pre-stage clear; both
+        // stay modelled so a regression to either shape is visible here.
+        for (let i = rows.length - 1; i >= 0; i--) {
+          const n = rows[i].generation
+          const hit = /generation\s*<\s*\?/i.test(sql)
+            ? n < g
+            : /generation\s*!=\s*\?/i.test(sql)
+              ? n !== g
+              : n === g
+          if (hit) rows.splice(i, 1)
         }
         return []
       }
@@ -374,12 +393,20 @@ function wedgeableClient(seed: { pointer: number; current?: string[]; orphans: s
         rows.push({ accountId, relPath, generation })
         return []
       }
+      if (/SELECT\s+MAX\(generation\)/i.test(sql)) {
+        const mine = rows.filter((r) => r.accountId === String(params[0]))
+        return [{ g: mine.length ? Math.max(...mine.map((r) => r.generation)) : null }]
+      }
       if (/DELETE FROM directory\b/i.test(sql)) {
         const g = Number(params[1])
-        if (/generation\s*!=\s*\?/i.test(sql)) {
-          for (let i = rows.length - 1; i >= 0; i--) if (rows[i].generation !== g) rows.splice(i, 1)
-        } else {
-          for (let i = rows.length - 1; i >= 0; i--) if (rows[i].generation === g) rows.splice(i, 1)
+        for (let i = rows.length - 1; i >= 0; i--) {
+          const n = rows[i].generation
+          const hit = /generation\s*<\s*\?/i.test(sql)
+            ? n < g
+            : /generation\s*!=\s*\?/i.test(sql)
+              ? n !== g
+              : n === g
+          if (hit) rows.splice(i, 1)
         }
         return []
       }
@@ -395,14 +422,18 @@ function wedgeableClient(seed: { pointer: number; current?: string[]; orphans: s
   }
 }
 
-describe('a partial stage self-heals (Task 1923)', () => {
-  it('clears orphans at the next generation, flips onto it, and logs stage-clear', async () => {
-    // Pointer at 5 naming the last good tree; three orphan rows already at
-    // generation 6 for relPaths the current walk re-stages ('output' is the
-    // walk's first row, so the current code's first INSERT is the one that
-    // collides). Without the pre-stage clear that INSERT throws on the UNIQUE
-    // constraint and the push fails, which is what froze gls-data for ~6 h on
-    // 2026-07-22.
+describe('a partial stage self-heals (Task 1923, by the Task 1926 generation claim)', () => {
+  // The wedge: a stage that died mid-batch left rows at current + 1 while the
+  // pointer stayed at current, so every later run recomputed the SAME target
+  // and its first INSERT hit UNIQUE(accountId, relPath, generation). The index
+  // froze at the stale generation until an operator hand-cleared the orphans,
+  // which is what held gls-data for ~6 h on 2026-07-22.
+  //
+  // Task 1923 healed that with a DELETE before the stage. Task 1926 heals it by
+  // claiming above the orphans instead, which needs no DELETE before the flip
+  // at all — and that pre-flip DELETE was the statement a concurrent peer could
+  // aim at the live tree.
+  it('claims above the orphans rather than colliding with them, and sweeps them after the flip', async () => {
     const c = wedgeableClient({
       pointer: 5,
       current: ['output', 'output/report.pdf', 'quotes', 'quotes/CR2969'],
@@ -412,21 +443,20 @@ describe('a partial stage self-heals (Task 1923)', () => {
     const r = await push(c, { log: (l: string) => lines.push(l) })
 
     expect(r.rows).toBe(7)
-    expect(c.pointerValue()).toBe(6)
-    // Nothing survives at a generation the pointer does not name.
-    expect(c.rows.every((row) => row.generation === 6)).toBe(true)
-    const clear = lines.find((l) => l.includes('op=stage-clear'))!
-    expect(clear).toContain('account=acc-1')
-    expect(clear).toContain('generation=6')
-    // Exactly the 3 orphans at generation 6, not the 4 current-tree rows the
-    // pointer names: the clear scopes to `next`, never to a reader-visible row.
-    expect(clear).toContain('cleared=3')
+    // 7, not 6: the orphans sit at 6, so this run claims the one above them.
+    expect(c.pointerValue()).toBe(7)
+    // Nothing survives at a generation the pointer does not name: the sweep
+    // took both the stale tree at 5 and the orphans at 6.
+    expect(c.rows.every((row) => row.generation === 7)).toBe(true)
+    // No statement deletes anything before the flip any more.
+    expect(lines.some((l) => l.includes('op=stage-clear'))).toBe(false)
   })
 
-  it('emits no stage-clear line on a clean cycle with no orphans', async () => {
+  it('re-stages onto a fresh generation with no orphans present', async () => {
     const c = wedgeableClient({ pointer: 5, orphans: [] })
     const lines: string[] = []
     await push(c, { log: (l: string) => lines.push(l) })
+    expect(c.pointerValue()).toBe(6)
     expect(lines.some((l) => l.includes('op=stage-clear'))).toBe(false)
   })
 })
@@ -505,3 +535,215 @@ describe('the index replace is atomic', () => {
     expect(c.calls.filter((x) => /INSERT|DELETE|directory_state/i.test(x.sql))).toEqual([])
   })
 })
+
+// Task 1926. Two pushes of ONE account are reachable: the admin server's 60s
+// loop (pushAllAccounts) and a hand-run `--account <id>` are separate OS
+// processes calling the same pushAccount, so no in-process lock can see both.
+// These tests drive both writers against ONE store and snapshot the reader's
+// view after every statement, so "never a half-built tree" stays a measured
+// property rather than a claim.
+//
+// Statement-level atomicity matches SQLite: each exec() applies whole.
+function sharedStore() {
+  const rows: { accountId: string; relPath: string; generation: number }[] = []
+  let pointer: number | null = null
+  const pointerHistory: number[] = []
+  const snapshots: string[][] = []
+  const deletesAtPointer: number[] = []
+
+  const visible = () =>
+    pointer === null
+      ? []
+      : rows.filter((r) => r.generation === pointer).map((r) => r.relPath).sort()
+
+  // The three DELETE shapes this file can issue. Order matters: `!=` and `<`
+  // must be tested before `=`, or `generation != ?` would read as an equality.
+  const deleteMatcher = (sql: string, g: number) => {
+    if (/generation\s*<\s*\?/i.test(sql)) return (n: number) => n < g
+    if (/generation\s*!=\s*\?/i.test(sql)) return (n: number) => n !== g
+    return (n: number) => n === g
+  }
+
+  return {
+    rows,
+    snapshots,
+    deletesAtPointer,
+    pointerHistory,
+    visible,
+    pointerValue: () => pointer,
+    seed(generation: number, relPaths: string[]) {
+      for (const relPath of relPaths) rows.push({ accountId: 'acc-1', relPath, generation })
+      pointer = generation
+      pointerHistory.push(generation)
+    },
+    async exec(sql: string, params: unknown[] = []) {
+      const out = await (async () => {
+        if (/SELECT\s+currentGeneration/i.test(sql)) {
+          return pointer === null ? [] : [{ currentGeneration: pointer }]
+        }
+        if (/SELECT\s+MAX\(generation\)/i.test(sql)) {
+          const mine = rows.filter((r) => r.accountId === String(params[0]))
+          return [{ g: mine.length ? Math.max(...mine.map((r) => r.generation)) : null }]
+        }
+        if (/INSERT INTO directory_state/i.test(sql)) {
+          const g = Number(params[1])
+          // The upsert's WHERE, modelled: with the guard present the pointer
+          // moves forward only. Without it, every flip lands.
+          const forwardOnly =
+            /excluded\.currentGeneration\s*>\s*directory_state\.currentGeneration/i.test(sql)
+          if (pointer === null || !forwardOnly || g > pointer) {
+            pointer = g
+            pointerHistory.push(g)
+          }
+          return []
+        }
+        if (/INSERT INTO directory \(/i.test(sql)) {
+          const accountId = String(params[0])
+          const relPath = String(params[1])
+          const generation = Number(params[6])
+          if (
+            rows.some(
+              (r) => r.accountId === accountId && r.relPath === relPath && r.generation === generation,
+            )
+          ) {
+            throw new Error(
+              'd1 query failed: HTTP 500 — UNIQUE constraint failed: directory.accountId, directory.relPath, directory.generation',
+            )
+          }
+          rows.push({ accountId, relPath, generation })
+          return []
+        }
+        if (/DELETE FROM directory\b/i.test(sql)) {
+          const g = Number(params[1])
+          const matches = deleteMatcher(sql, g)
+          // The bug's signature: a DELETE that removes rows at the generation
+          // the pointer names is a reader-visible deletion of the live tree.
+          if (pointer !== null && matches(pointer) && rows.some((r) => r.generation === pointer)) {
+            deletesAtPointer.push(pointer)
+          }
+          for (let i = rows.length - 1; i >= 0; i--) if (matches(rows[i].generation)) rows.splice(i, 1)
+          return []
+        }
+        if (/SELECT COUNT/i.test(sql)) {
+          if (/generation\s*=\s*\?/i.test(sql)) {
+            const g = Number(params[1])
+            return [{ n: rows.filter((r) => r.generation === g).length }]
+          }
+          return [{ n: rows.filter((r) => r.generation === pointer).length }]
+        }
+        return []
+      })()
+      snapshots.push(visible())
+      return out
+    },
+  }
+}
+
+/** A one-shot rendezvous: `reached` settles when the writer parks, `open()` frees it. */
+function gate() {
+  let hit!: () => void
+  let open!: () => void
+  const reached = new Promise<void>((r) => (hit = r))
+  const opened = new Promise<void>((r) => (open = r))
+  return { reached, opened, hit: () => hit(), open: () => open() }
+}
+
+/** A client that parks once, either before or after the matching statement. */
+function pausingClient(
+  store: ReturnType<typeof sharedStore>,
+  g: ReturnType<typeof gate>,
+  at: { before?: (sql: string) => boolean; after?: (sql: string) => boolean },
+) {
+  let armed = true
+  const calls: { sql: string; params: unknown[] }[] = []
+  return {
+    calls,
+    async query(sql: string, params: unknown[] = []) {
+      calls.push({ sql, params })
+      if (armed && at.before?.(sql)) {
+        armed = false
+        g.hit()
+        await g.opened
+      }
+      const out = await store.exec(sql, params)
+      if (armed && at.after?.(sql)) {
+        armed = false
+        g.hit()
+        await g.opened
+      }
+      return out
+    },
+  }
+}
+
+const plainClient = (store: ReturnType<typeof sharedStore>) => ({
+  query: (sql: string, params: unknown[] = []) => store.exec(sql, params),
+})
+
+describe('two concurrent pushes of one account (Task 1926)', () => {
+  // The task file's own interleave. B reads the pointer, then stalls. A stages,
+  // flips and sweeps a whole publish. B resumes holding a stale `current`.
+  //
+  // Before the guard: B recomputed next = current + 1 = the generation the
+  // pointer now names, its pre-stage COUNT returned A's live rows, and its
+  // DELETE emptied the tree a client was reading.
+  it('a peer holding a stale pointer never empties or halves the live tree', async () => {
+    const store = sharedStore()
+    store.seed(5, ['output', 'output/report.pdf', 'quotes', 'quotes/CR2969'])
+    const g = gate()
+    const b = pausingClient(store, g, { after: (sql) => /SELECT\s+currentGeneration/i.test(sql) })
+
+    // Captured rather than awaited bare: B throwing for an unrelated reason
+    // would otherwise surface as a passing test.
+    const bRun = push(b, { log: () => {} }).catch((e: unknown) => e)
+    await g.reached
+    await push(plainClient(store), { log: () => {} })
+    g.open()
+    const bResult = await bRun
+
+    expect(bResult).not.toBeInstanceOf(Error)
+    // 4 is the seeded tree, 7 is a complete walk of the fixture. Any other
+    // count is a tree a client could see half-built.
+    expect(store.snapshots.every((s) => s.length === 4 || s.length === 7)).toBe(true)
+    expect(store.deletesAtPointer).toEqual([])
+    expect(store.visible().length).toBe(7)
+    // B resumed holding a stale pointer of 5, saw A's rows at 6 in the MAX, and
+    // claimed 7. Nothing was staged over and nothing was deleted at a live one.
+    expect(store.pointerValue()).toBe(7)
+  })
+
+  // The other order: A stages a whole generation, then stalls before its flip.
+  // B starts fresh, sees A's staged rows in the MAX, claims the generation
+  // above, and publishes. A wakes holding a generation that is now behind.
+  it('a writer overtaken while staging leaves the winner live and says so', async () => {
+    const store = sharedStore()
+    store.seed(5, ['output', 'output/report.pdf', 'quotes', 'quotes/CR2969'])
+    const g = gate()
+    const a = pausingClient(store, g, { before: (sql) => /INSERT INTO directory_state/i.test(sql) })
+    const lines: string[] = []
+
+    const aRun = push(a, { log: (l: string) => lines.push(l) })
+    await g.reached
+    await push(plainClient(store), { log: () => {} })
+    g.open()
+    const aResult = await aRun
+
+    expect(store.snapshots.every((s) => s.length === 4 || s.length === 7)).toBe(true)
+    expect(store.deletesAtPointer).toEqual([])
+    // The pointer never goes backward, which is what keeps the loser harmless.
+    expect(store.pointerHistory).toEqual([...store.pointerHistory].sort((x, y) => x - y))
+    expect(store.pointerValue()).toBe(7)
+
+    const contended = lines.find((l) => l.includes('op=stage-contended'))!
+    expect(contended).toContain('account=acc-1')
+    expect(contended).toContain('generation=6')
+    expect(contended).toContain('pointer=7')
+    expect(contended).toContain('action=superseded')
+    expect(lines.some((l) => l.includes('op=flip'))).toBe(false)
+    // No sweep and no verify from the loser: both would act on, and measure,
+    // the WINNER's tree and report a failure where nothing failed.
+    expect(a.calls.some((c) => /DELETE FROM directory/i.test(c.sql))).toBe(false)
+    expect(lines.some((l) => l.includes('op=verify'))).toBe(false)
+    expect(aResult.superseded).toBe(true)
+  })
+})

package/payload/platform/plugins/cloudflare/mcp/__tests__/schema-exposed-dirs.test.ts

@@ -68,6 +68,27 @@ describe('resolveExposedDirs', () => {
     }
   })
 
+  it('does not read a declared file as a plugin-owned dir', () => {
+    // Task 1902 — the plugin-owned region also carries file lines now. This is
+    // the client-facing copy of the parser, kept separately from
+    // platform/lib/account-schema-regions, so it needs its own case: a file must
+    // never enter pluginOwned, and asking to expose one must not expose it. The
+    // trailing slash inside the backticks is the discriminator.
+    const withFile = [
+      '<!-- plugin-owned-dirs:start -->',
+      '## Plugin-owned top-level entries',
+      '',
+      '- `sites/` — Owned by the cloudflare plugin.',
+      '- `data-portal.json` — the account data-portal index.',
+      '<!-- plugin-owned-dirs:end -->',
+    ].join('\n')
+    const r = resolveExposedDirs(schema({ ontology: ONTOLOGY, pluginOwned: withFile }), [
+      'data-portal.json',
+    ])
+    expect(r.pluginOwned).toEqual(['sites'])
+    expect(r.exposed).not.toContain('data-portal.json')
+  })
+
   it('reports a plugin-owned collision and keeps the dir out of exposed', () => {
     const collide = ONTOLOGY.replace('`quotes/`', '`sites/`').replace('Quotation', 'Site')
     const r = resolveExposedDirs(schema({ ontology: collide, pluginOwned: PLUGIN_OWNED }))

package/payload/platform/plugins/cloudflare/skills/data-portal/schema.sql

@@ -150,10 +150,11 @@ CREATE UNIQUE INDEX IF NOT EXISTS auth_attempts_scope_window ON auth_attempts (s
 -- No backfill follows it: the push replaces every row each cycle.
 --
 -- `generation` is which staging round a row belongs to (Task 1910). The push
--- writes the next generation, flips the pointer below in ONE statement, then
--- deletes rows of earlier generations. Uniqueness is scoped by generation
--- because two of them hold the same relPath between the write and the flip;
--- UNIQUE (accountId, relPath) would reject the staged write outright.
+-- claims a generation above every generation the account already holds, writes
+-- the whole tree there, moves the pointer below in ONE forward-only statement,
+-- then deletes strictly older generations (Task 1926). Uniqueness is scoped by
+-- generation because two of them hold the same relPath between the write and
+-- the flip; UNIQUE (accountId, relPath) would reject the staged write outright.
 --   ALTER TABLE directory ADD COLUMN generation INTEGER NOT NULL DEFAULT 0;
 CREATE TABLE IF NOT EXISTS directory (
   id         INTEGER PRIMARY KEY AUTOINCREMENT,

package/payload/platform/plugins/docs/references/admin-ui.md

@@ -236,8 +236,8 @@ explicit `?plugin=` parameter, not inferred from `--` in the slug.
 
 | Route | Behaviour |
 |-------|-----------|
-| `GET /api/admin/agents` | Session-scoped. Lists the session account's public `agents/*/` dirs (never the `admin` agent), its user-created specialists from `plugins/*/agents/*.md`, and its shipped specialists, each row tagged `kind` and `origin` and carrying `risk`, `worstTool`, `unresolved` and `disabled`. Returns `{agents, accountId, skipped, specialistsSkipped, shippedSkipped}`. 401 when the session maps to no account. |
-| `GET /api/admin/agents/:slug` | Session-scoped. Without `?plugin=` or `?origin=`, returns a public agent's config fields + four owned docs + a `present` map (a missing or unreadable doc is `''`/`present.<role>=false`, never a 500). With `?plugin=`, that plugin's user-created specialist; with `?origin=shipped`, the shipped one. Both specialist shapes add `{risk, worstTool, unresolved, byTool, disabled}`, where `byTool` is one class per declared tool. Selection is explicit rather than inferred, because a premium file and a user-created specialist under a plugin of the same name produce the same slug. Unknown 404s, 401 as above. |
+| `GET /api/admin/agents` | Session-scoped. Lists the session account's public `agents/*/` dirs (never the `admin` agent), its user-created specialists from `plugins/*/agents/*.md`, and its shipped specialists, each row tagged `kind` and `origin` and carrying `risk`, `riskiestTool`, `unresolved` and `disabled`. Returns `{agents, accountId, skipped, specialistsSkipped, shippedSkipped}`. 401 when the session maps to no account. |
+| `GET /api/admin/agents/:slug` | Session-scoped. Without `?plugin=` or `?origin=`, returns a public agent's config fields + four owned docs + a `present` map (a missing or unreadable doc is `''`/`present.<role>=false`, never a 500). With `?plugin=`, that plugin's user-created specialist; with `?origin=shipped`, the shipped one. Both specialist shapes add `{risk, riskiestTool, unresolved, byTool, disabled}`, where `byTool` is one class per declared tool. Selection is explicit rather than inferred, because a premium file and a user-created specialist under a plugin of the same name produce the same slug. Unknown 404s, 401 as above. |
 | `POST /api/admin/agents/:slug/disable?accountId=` | Shipped agents only, enforced here: a slug present in none of the three shipped directories 404s. Moves the file from `specialists/agents/` to `specialists/agents-disabled/` and records the basename in the 0600 store. Returns `{ok, moved}`; `moved:false` means the agent existed only as a bundled template, so nothing was there to move and the store entry is what stops the next provisioning run delivering it. The store is read strictly before anything moves, so an unreadable store 500s with the file untouched rather than rewriting the file whole from an empty set and dropping every other disabled agent. Same `accountId` contract as delete. |
 | `POST /api/admin/agents/:slug/enable?accountId=` | Covers both of disable's outcomes. Returns `{ok, restored}`: a quarantined file moves back (`restored:true`); a bundled-only agent has nothing to move, so clearing the store entry is the whole job (`restored:false`), which is what stops provisioning withholding it. Treating that second case as "nothing to restore" made disable a one-way door. 404 only when neither directory nor store knows the agent. |
 | `DELETE /api/admin/agents/:slug?accountId=` | Public agents only, on the named validated account. Removes the dir after `deleteAgentProjection`; refuses the `admin` slug (403) and a missing/unknown `accountId` (400) with no write. Loud-fail: a graph-cleanup throw aborts the file removal. |
@@ -267,10 +267,15 @@ Agents page survived undiagnosed on a multi-account install.
   `reason=<graph-cleanup-failed|rm-error>` on failure (files preserved on a
   graph-cleanup throw).
 - `op=classify account=<id8> agent=<name> origin=<shipped|public|specialist>
-  risk=<green|amber|red> worstTool=<tool> tools=<n> unresolved=<comma-list|none>
+  risk=<green|amber|red> riskiestTool=<tool> tools=<n> unresolved=<comma-list|none>
   disabled=<bool>` — one line per classified agent per listing, so it fires on
-  every page load. `worstTool` makes a wrong class diagnosable without
-  re-deriving it. **A non-empty `unresolved=` is the one to act on**: the agent
+  every page load. `riskiestTool` makes a wrong class diagnosable without
+  re-deriving it. Its value is the FULL canonical tool name, while the card
+  renders only the segment after the plugin prefix. One load
+  showing `riskiest tool: memory-update` on the card and
+  `riskiestTool=mcp__plugin_memory_memory__memory-update` on this line is the
+  confirmation that both derive from one value.
+  **A non-empty `unresolved=` is the one to act on**: the agent
   is forced red, and the cause is that the built-in table or the registry
   mapping has drifted, not that the agent changed.
 - `op=risk-surface status=load-failed reason=<msg>` — the plugin registry did

package/payload/platform/plugins/docs/references/troubleshooting.md

@@ -283,7 +283,7 @@ If the initial Cloudflare login fails during setup, {{productName}} will fall ba
 
 `maxy-edge.service` (always-on front door) classifies upstream errors and serves a brand-aware response. There are two distinct user-visible shapes; the right one depends on what failed.
 
-**Branded holding page (brand logo + "Starting") for ~10 s during an upgrade — this is expected and self-healing.** The edge process binds the public port immediately, but `maxy.service` (the upstream UI) takes ~10 s after restart to apply the neo4j schema and mount its 11 routes. Any browser navigation that lands during that window gets a self-contained HTML holding page that polls `/api/health` and reloads automatically once the upstream binds. The page renders the brand logo (inlined as a base64 data URI at edge boot from `<install>/server/public/brand/<assets.logo>`) and the brand display/body fonts (loaded from fonts.googleapis.com) — both paths bypass the unavailable upstream so the page never makes a same-origin asset fetch. When `brand.logoContainsName` is true the logo replaces the productName text; otherwise the page falls back to "{{productName}} is starting". No operator action required. The diagnostic line in `~/.maxy/logs/edge.log` is `[edge] upstream http error path=… err=connect ECONNREFUSED 127.0.0.1:<UPSTREAM_PORT> err-class=econnrefused-coldstart upstream=…` and disappears as soon as upstream binds. Boot-time confirmation that the logo resolved: `[edge] brand=<name> holding-logo=inlined assets-dir=<path>` — `holding-logo=missing` means the logo file wasn't found at `assets-dir`, the page degrades to text-only.
+**Branded holding page (brand logo + "Starting") for ~10 s during an upgrade — this is expected and self-healing.** The edge process binds the public port immediately, but `maxy.service` (the upstream UI) takes ~10 s after restart to apply the neo4j schema and mount its 11 routes. Any browser navigation that lands during that window gets a self-contained HTML holding page that polls `/api/health` and reloads automatically once the upstream binds. The page renders the brand logo (inlined as a base64 data URI at edge boot from `<install>/server/public/brand/<assets.logo>`) and the brand display/body fonts (loaded from fonts.googleapis.com) — both paths bypass the unavailable upstream so the page never makes a same-origin asset fetch. When `brand.logoContainsName` is true the logo replaces the productName text; otherwise the page falls back to "{{productName}} is starting". No operator action required. The diagnostic line in `~/.maxy/logs/edge.log` is `[edge] ts=<ISO-8601> upstream http error path=… err=connect ECONNREFUSED 127.0.0.1:<UPSTREAM_PORT> err-class=econnrefused-coldstart upstream=…` and disappears as soon as upstream binds. `ts=` is what lets a run of these be read as an outage with a start, an end and a duration, and cross-read against `journalctl --user -u <brand>-code.service`; `path=` carries the endpoint only, never the query string, because this line fires on paths whose query can hold a download signature, an OAuth code, or a customer phone number. Boot-time confirmation that the logo resolved: `[edge] brand=<name> holding-logo=inlined assets-dir=<path>` — `holding-logo=missing` means the logo file wasn't found at `assets-dir`, the page degrades to text-only.
 
 **Branded plain-text 502 ("Bad Gateway ({{productName}} unavailable)") — real upstream failure, not cold-start.** Any error class other than `ECONNREFUSED` (timeouts, resets, host-unreachable) returns the existing 502 path. The diagnostic line carries `err-class=other`. Read the log with `tail -200 ~/.maxy/logs/edge.log | rg 'err-class=other'` and check `~/.maxy/logs/server.log` for upstream stack traces — the upstream itself is the source.
 

package/payload/platform/plugins/scheduling/PLUGIN.md

@@ -1,6 +1,7 @@
 ---
 name: scheduling
 description: "Calendar and scheduling — create events, manage appointments, set up recurring triggers."
+account-owned-files: [{"file": "calendar-availability.json", "description": "The booking page's availability config, written by the publish-availability script and read by the live booking page."}]
 tools:
   - name: schedule-event
     publicAllowlist: false

package/payload/platform/scripts/__tests__/account-schema-owned-dirs.test.sh

@@ -10,8 +10,10 @@ REAL_PROJECT_DIR="$(cd "$PLAT_SCRIPTS/.." && pwd)"
 REAL_TEMPLATE="$REAL_PROJECT_DIR/templates/account-schema/SCHEMA.md"
 REAL_PREMIUM="$(cd "$REAL_PROJECT_DIR/.." && pwd)/premium-plugins"
 PASS=0; FAIL=0; FAILED=()
-assert_grep()   { if printf '%s' "$2" | grep -qF "$1"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); FAILED+=("$3: expected to find [$1]"); fi; }
-assert_nogrep() { if printf '%s' "$2" | grep -qF "$1"; then FAIL=$((FAIL+1)); FAILED+=("$3: expected NOT to find [$1]"); else PASS=$((PASS+1)); fi; }
+# `--` so a pattern that starts with a hyphen (a region line: "- `x.json` — …")
+# is read as the pattern, not as a grep option.
+assert_grep()   { if printf '%s' "$2" | grep -qF -- "$1"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); FAILED+=("$3: expected to find [$1]"); fi; }
+assert_nogrep() { if printf '%s' "$2" | grep -qF -- "$1"; then FAIL=$((FAIL+1)); FAILED+=("$3: expected NOT to find [$1]"); else PASS=$((PASS+1)); fi; }
 assert_eq()     { if [ "$1" = "$2" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); FAILED+=("$3: expected [$2] got [$1]"); fi; }
 assert_dir()    { if [ -d "$1" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); FAILED+=("$2: expected directory [$1]"); fi; }
 assert_nodir()  { if [ -d "$1" ]; then FAIL=$((FAIL+1)); FAILED+=("$2: expected NO directory [$1]"); else PASS=$((PASS+1)); fi; }
@@ -57,7 +59,7 @@ assert_grep "op=seed-owned-dirs" "$OUT" "sd-seed-log"
 assert_grep "added=quoting" "$OUT" "sd-added-quoting"
 ALLOWED="$(awk '/^```allowed-top-level$/{f=1;next} /^```$/{f=0} f' "$A_SD/SCHEMA.md")"
 assert_grep "quoting" "$ALLOWED" "sd-allowlist-has-quoting"
-assert_grep "Plugin-owned top-level workspaces" "$(cat "$A_SD/SCHEMA.md")" "sd-descriptive-section"
+assert_grep "Plugin-owned top-level entries" "$(cat "$A_SD/SCHEMA.md")" "sd-descriptive-section"
 assert_grep "plugin-owned-dirs:start" "$(cat "$A_SD/SCHEMA.md")" "sd-marker"
 
 # --- idempotency: second merge is byte-identical ---
@@ -73,7 +75,7 @@ export PROJECT_DIR="$T_MX/platform"
 merge_owned_dirs_into_schema "$A_MX" >/dev/null
 ALLOWED_MX="$(awk '/^```allowed-top-level$/{f=1;next} /^```$/{f=0} f' "$A_MX/SCHEMA.md")"
 assert_nogrep "quoting" "$ALLOWED_MX" "mx-no-quoting"
-assert_nogrep "Plugin-owned top-level workspaces" "$(cat "$A_MX/SCHEMA.md")" "mx-no-section"
+assert_nogrep "Plugin-owned top-level entries" "$(cat "$A_MX/SCHEMA.md")" "mx-no-section"
 
 # --- platform plugins declare pages (storage-broker) + archive (memory) ---
 # Task 1891: these two plugin-owned root dirs must land in the allowed block so
@@ -287,5 +289,111 @@ B_P="$(shasum "$A_P/SCHEMA.md" | awk '{print $1}')"
 merge_owned_dirs_into_schema "$A_P" >/dev/null
 assert_eq "$(shasum "$A_P/SCHEMA.md" | awk '{print $1}')" "$B_P" "prune-idempotent"
 
+# --- account-owned-files: a declared file joins the same allowed block ---
+# The block is a flat list of names and already carries SCHEMA.md and
+# account.json, so a file needs no second surface. A second plugin declares a
+# malformed value: its key is skipped and the valid declaration still merges.
+TF="$(mktemp -d)"
+mkdir -p "$TF/platform/plugins/filer" "$TF/platform/plugins/broken" \
+         "$TF/platform/config" "$TF/platform/templates/account-schema"
+cp "$REAL_TEMPLATE" "$TF/platform/templates/account-schema/SCHEMA.md"
+printf '{"installDir":"files-brand","shipsPremiumBundles":[]}\n' > "$TF/platform/config/brand.json"
+printf -- '---\nname: filer\naccount-owned-files: [{"file": "x.json", "description": "Filer index."}]\n---\n' \
+  > "$TF/platform/plugins/filer/PLUGIN.md"
+printf -- '---\nname: broken\naccount-owned-files: [{"file": "y.json"\n---\n' \
+  > "$TF/platform/plugins/broken/PLUGIN.md"
+A_TF="$(mktemp -d)"; cp "$TF/platform/templates/account-schema/SCHEMA.md" "$A_TF/SCHEMA.md"
+export PROJECT_DIR="$TF/platform"
+OUT_TF="$(merge_owned_dirs_into_schema "$A_TF")"
+ALLOWED_TF="$(awk '/^```allowed-top-level$/{f=1;next} /^```$/{f=0} f' "$A_TF/SCHEMA.md")"
+assert_grep "x.json" "$ALLOWED_TF" "files-allowlist-has-x"
+assert_nogrep "y.json" "$ALLOWED_TF" "files-malformed-skipped"
+assert_grep "added=x.json" "$OUT_TF" "files-added-logged"
+# A file renders without the trailing slash a dir gets; three parsers read that
+# slash to tell a bucket from anything else.
+assert_grep '- `x.json` — Filer index.' "$(cat "$A_TF/SCHEMA.md")" "files-region-no-slash"
+assert_nogrep '- `x.json/`' "$(cat "$A_TF/SCHEMA.md")" "files-region-not-a-dir"
+RC_TF="$(PROJECT_DIR="$PROJECT_DIR" python3 "$PLAT_SCRIPTS/lib/account-schema-owned-dirs.py" reconcile "$A_TF")"
+assert_grep "ownedFile=x.json present=true" "$RC_TF" "files-reconcile-line"
+B_TF="$(shasum "$A_TF/SCHEMA.md" | awk '{print $1}')"
+merge_owned_dirs_into_schema "$A_TF" >/dev/null
+assert_eq "$(shasum "$A_TF/SCHEMA.md" | awk '{print $1}')" "$B_TF" "files-idempotent"
+
+# A dir declaration keeps its slash and its ownedDir= reconcile line.
+TD="$(mktemp -d)"
+mkdir -p "$TD/platform/plugins/dirred" "$TD/platform/config" "$TD/platform/templates/account-schema"
+cp "$REAL_TEMPLATE" "$TD/platform/templates/account-schema/SCHEMA.md"
+printf '{"installDir":"dirs-brand","shipsPremiumBundles":[]}\n' > "$TD/platform/config/brand.json"
+printf -- '---\nname: dirred\naccount-owned-dirs: [{"dir": "widgets", "description": "Widget workspace."}]\n---\n' \
+  > "$TD/platform/plugins/dirred/PLUGIN.md"
+A_TD="$(mktemp -d)"; cp "$TD/platform/templates/account-schema/SCHEMA.md" "$A_TD/SCHEMA.md"
+export PROJECT_DIR="$TD/platform"
+merge_owned_dirs_into_schema "$A_TD" >/dev/null
+assert_grep '- `widgets/` — Widget workspace.' "$(cat "$A_TD/SCHEMA.md")" "dirs-region-keeps-slash"
+RC_TD="$(PROJECT_DIR="$PROJECT_DIR" python3 "$PLAT_SCRIPTS/lib/account-schema-owned-dirs.py" reconcile "$A_TD")"
+assert_grep "ownedDir=widgets present=true" "$RC_TD" "dirs-reconcile-line"
+
+# --- a malformed ELEMENT skips its whole key, not just that element ---
+# json.loads succeeds and the first entry is well-formed, so an append-as-you-go
+# parse would merge a.json and silently drop c.json. A half-merged declaration is
+# worse than none: the dropped name reports as a stray forever with no line
+# anywhere saying its declaration failed.
+TP="$(mktemp -d)"
+mkdir -p "$TP/platform/plugins/partial" "$TP/platform/plugins/good" \
+         "$TP/platform/config" "$TP/platform/templates/account-schema"
+cp "$REAL_TEMPLATE" "$TP/platform/templates/account-schema/SCHEMA.md"
+printf '{"installDir":"partial-brand","shipsPremiumBundles":[]}\n' > "$TP/platform/config/brand.json"
+printf -- '---\nname: partial\naccount-owned-files: [{"file": "a.json"}, "b.json", {"file": "c.json"}]\n---\n' \
+  > "$TP/platform/plugins/partial/PLUGIN.md"
+printf -- '---\nname: good\naccount-owned-files: [{"file": "d.json", "description": "Good."}]\n---\n' \
+  > "$TP/platform/plugins/good/PLUGIN.md"
+A_TP="$(mktemp -d)"; cp "$TP/platform/templates/account-schema/SCHEMA.md" "$A_TP/SCHEMA.md"
+export PROJECT_DIR="$TP/platform"
+merge_owned_dirs_into_schema "$A_TP" >/dev/null
+ALLOWED_TP="$(awk '/^```allowed-top-level$/{f=1;next} /^```$/{f=0} f' "$A_TP/SCHEMA.md")"
+assert_nogrep "a.json" "$ALLOWED_TP" "partial-first-entry-skipped"
+assert_nogrep "c.json" "$ALLOWED_TP" "partial-later-entry-skipped"
+assert_grep "d.json" "$ALLOWED_TP" "partial-sibling-plugin-still-merges"
+
+# --- a name carrying a path separator is refused ---
+# The trailing slash inside the backticks is what tells a bucket from a file in
+# the descriptive region, and the fence entry must match a readdir name. A
+# declared "foo/" would render as a bucket line and never match anything.
+TS_="$(mktemp -d)"
+mkdir -p "$TS_/platform/plugins/slashed" "$TS_/platform/config" "$TS_/platform/templates/account-schema"
+cp "$REAL_TEMPLATE" "$TS_/platform/templates/account-schema/SCHEMA.md"
+printf '{"installDir":"slash-brand","shipsPremiumBundles":[]}\n' > "$TS_/platform/config/brand.json"
+printf -- '---\nname: slashed\naccount-owned-files: [{"file": "foo/", "description": "Bad."}]\naccount-owned-dirs: [{"dir": "bar/baz", "description": "Bad."}]\n---\n' \
+  > "$TS_/platform/plugins/slashed/PLUGIN.md"
+A_TS="$(mktemp -d)"; cp "$TS_/platform/templates/account-schema/SCHEMA.md" "$A_TS/SCHEMA.md"
+export PROJECT_DIR="$TS_/platform"
+merge_owned_dirs_into_schema "$A_TS" >/dev/null
+assert_nogrep "foo/" "$(cat "$A_TS/SCHEMA.md")" "slash-file-refused"
+assert_nogrep "bar/baz" "$(cat "$A_TS/SCHEMA.md")" "slash-dir-refused"
+
+# --- shipped declarations reach an account's allowed block ---
+# Symlink the real plugin dirs so the case exercises the shipped PLUGIN.md
+# frontmatter, the same way the Task 1891 pages/archive case does.
+T_SHIP="$(make_tree '[]')"
+for _p in business-assistant cloudflare scheduling admin; do
+  ln -s "$REAL_PROJECT_DIR/plugins/$_p" "$T_SHIP/platform/plugins/$_p"
+done
+A_SHIP="$(make_account "$T_SHIP")"
+export PROJECT_DIR="$T_SHIP/platform"
+merge_owned_dirs_into_schema "$A_SHIP" >/dev/null
+ALLOWED_SHIP="$(awk '/^```allowed-top-level$/{f=1;next} /^```$/{f=0} f' "$A_SHIP/SCHEMA.md")"
+# The four channel/session files are written by the session manager and the UI
+# server on every brand, so they are declared on admin, which no brand excludes.
+# realagent-code and property-administrators exclude the telegram plugin from
+# their payload (brands/*/brand.json) while still constructing the telegram store
+# (services/claude-session-manager/src/index.ts), so a declaration on the telegram
+# plugin would leave those two brands reporting a permanent false stray. This
+# tree deliberately omits whatsapp and telegram to prove the reach.
+for _n in e-sign data-portal.json calendar-availability.json wa-channel-bindings.json \
+          telegram-channel-bindings.json webchat-channel-bindings.json \
+          canonical-webchat-session.json session-titles.json agents-disabled.json; do
+  assert_grep "$_n" "$ALLOWED_SHIP" "ship-allow-$_n"
+done
+
 echo "PASS=$PASS FAIL=$FAIL"
 if [ "$FAIL" -ne 0 ]; then printf '%s\n' "${FAILED[@]}"; exit 1; fi