@rubytech/create-sitedesk-code 0.1.511 → 0.1.513

package/payload/server/server.js

@@ -118,7 +118,7 @@ import {
   vncLog,
   walkPremiumBundles,
   writeAdminUserAndPerson
-} from "./chunk-2WAXM5N2.js";
+} from "./chunk-S6HYTIU3.js";
 import {
   D1_MAX_SQL_STATEMENT_BYTES,
   D1_QUERY_MAX_BODY_BYTES,
@@ -1602,10 +1602,10 @@ var require_dist5 = __commonJS({
 });
 
 // server/index.ts
-import { readFileSync as readFileSync48, existsSync as existsSync47, watchFile, readdirSync as readdirSync29, statSync as statSync21 } from "fs";
+import { readFileSync as readFileSync48, existsSync as existsSync48, watchFile, readdirSync as readdirSync29, statSync as statSync21 } from "fs";
 import { spawn as spawn3 } from "child_process";
 import { createHash as createHash8 } from "crypto";
-import { resolve as resolve45, join as join49, basename as basename14 } from "path";
+import { resolve as resolve45, join as join51, basename as basename14 } from "path";
 import { homedir as homedir4 } from "os";
 
 // server/lib/route-cache-watchers.ts
@@ -2471,6 +2471,44 @@ var assetsVary = async (c, next) => {
   if (!c.res.headers.has("Vary")) c.res.headers.set("Vary", "Accept-Encoding");
 };
 
+// server/lib/client-error-reporter.ts
+var CLIENT_ERROR_SINK_PATH = "/api/_client-error";
+var clientErrorReporterBody = `(function(){
+  var SINK=${JSON.stringify(CLIENT_ERROR_SINK_PATH)};
+  var send=function(b){
+    try{
+      fetch(SINK,{
+        method:'POST',
+        headers:{'content-type':'application/json'},
+        body:JSON.stringify(Object.assign({url:location.href,ua:navigator.userAgent,version:(window.__MAXY_VERSION__||'unknown')},b)),
+        keepalive:true
+      }).catch(function(){});
+    }catch(e){}
+  };
+  window.addEventListener('error',function(e){
+    var t=e.target;
+    if(t&&t!==window&&t.tagName)send({kind:'subresource',tag:t.tagName,url:t.src||t.href||''});
+    else send({kind:'uncaught',msg:e.message,filename:e.filename,lineno:e.lineno,colno:e.colno,stack:(e.error&&e.error.stack)||''});
+  },true);
+  window.addEventListener('unhandledrejection',function(e){
+    var r=e.reason;
+    send({kind:'unhandled-rejection',msg:String((r&&r.message)||r),stack:(r&&r.stack)||''});
+  });
+  try{
+    new PerformanceObserver(function(list){
+      list.getEntries().forEach(function(entry){
+        var p;
+        try{p=new URL(entry.name,location.href).pathname}catch(_){p=''}
+        if(p===SINK)return;
+        if(entry.responseStatus>=400)send({kind:'subresource',url:entry.name,status:entry.responseStatus});
+      });
+    }).observe({type:'resource',buffered:true});
+  }catch(e){}
+})();`;
+var clientErrorReporterScript = `<script>
+${clientErrorReporterBody}
+</script>`;
+
 // app/lib/whatsapp/inbound/media-download-guard.ts
 var TAG2 = "[media-guard]";
 var inFlight2 = 0;
@@ -5067,6 +5105,18 @@ function resolvePlatformAccountId(accountsDir = ACCOUNTS_DIR) {
   return routed ?? houseId;
 }
 
+// app/lib/whatsapp/account-id-shape.ts
+var UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function isUuidAccountId(id) {
+  return UUID_RE2.test(id);
+}
+function warnNonUuidAccount(caller2, accountId) {
+  if (isUuidAccountId(accountId)) return;
+  console.error(
+    `[whatsapp-account-scope] op=non-uuid-account caller=${caller2} accountId=${accountId}`
+  );
+}
+
 // app/lib/managed-service.ts
 import { join as join7 } from "path";
 import { readFileSync as readFileSync9 } from "fs";
@@ -6183,8 +6233,9 @@ function buildSelfChatDispatch(input) {
       isGroup: false
     }),
     media: [],
-    // Self-chat is the owner: the session scopes to the house account (Task 1383).
-    effectiveAccountId: input.accountId,
+    // Self-chat is the owner: the session scopes to the house account (Task 1383),
+    // named by its platform UUID (Task 1850).
+    effectiveAccountId: input.platformAccountId,
     // Task 1575 — self-chat is unambiguously the owner, so attribute the spawn
     // to the owner userId even when the owner phone is unbound in users.json.
     ownerSelfPhone: true
@@ -6315,20 +6366,26 @@ function resolveReadStoreKey(accountId) {
 }
 function resolveInboundPersistAccount(args) {
   const result = args.accessResult;
-  if (result?.allowed && result.reason === "account-manager" && result.effectiveAccountId) {
-    return result.effectiveAccountId;
-  }
-  return args.connPlatformAccountId;
+  const account = result?.allowed && result.reason === "account-manager" && result.effectiveAccountId ? result.effectiveAccountId : args.connPlatformAccountId;
+  warnNonUuidAccount("inbound-persist", account);
+  return account;
 }
 function resolveConversationPersistAccount(sendAccountId, counterpartyPhone) {
   const conn = findConnectionByKey(Array.from(connections2.values()), sendAccountId);
-  if (!conn) return sendAccountId;
+  if (!conn) {
+    warnNonUuidAccount("reply-append-no-connection", sendAccountId);
+    return sendAccountId;
+  }
   const access = checkDmAccess({
     senderPhone: counterpartyPhone,
     selfPhone: conn.selfPhone ?? "",
     config: whatsAppConfig,
+    // The per-number sub-config is keyed by the credential DIRNAME.
     accountConfig: whatsAppConfig.accounts?.[conn.accountId],
-    accountId: conn.accountId,
+    // Task 1850 — the account SCOPE is the platform UUID. The gate assigns this
+    // to `effectiveAccountId` for every non-manager admit, and that value reaches
+    // the graph and the spawn; the dirname is a credential path, not an account.
+    accountId: conn.platformAccountId,
     isValidAccount: (id) => isValidAccountId(id)
   });
   return resolveInboundPersistAccount({
@@ -6662,8 +6719,11 @@ function monitorInbound(conn) {
             senderPhone,
             selfPhone: conn.selfPhone ?? "",
             config: whatsAppConfig,
+            // Keyed by the credential DIRNAME — a per-number sub-config.
             accountConfig: whatsAppConfig.accounts?.[conn.accountId],
-            accountId: conn.accountId,
+            // Task 1850 — the account SCOPE is the platform UUID, never the
+            // dirname. See resolveConversationPersistAccount.
+            accountId: conn.platformAccountId,
             isValidAccount: (id) => isValidAccountId(id)
           });
           const persistAccountId = resolveInboundPersistAccount({
@@ -6856,6 +6916,7 @@ function monitorInbound(conn) {
             };
             dispatchInboundPayload(conn, buildSelfChatDispatch({
               accountId: conn.accountId,
+              platformAccountId: conn.platformAccountId,
               selfPhone: conn.selfPhone,
               remoteJid,
               text: decision.text,
@@ -7005,7 +7066,7 @@ async function handleInboundMessage(conn, msg) {
       selfPhone,
       config: whatsAppConfig,
       accountConfig: whatsAppConfig.accounts?.[conn.accountId],
-      accountId: conn.accountId,
+      accountId: conn.platformAccountId,
       isValidAccount: (id) => isValidAccountId(id),
       resolvePersonByPhone
     });
@@ -8114,6 +8175,11 @@ function createScheduleInjectRoutes(deps) {
 // server/index.ts
 var import_dist9 = __toESM(require_dist(), 1);
 
+// app/lib/whatsapp/gateway/manages-account.ts
+function managesAccountFor(effectiveAccountId, connPlatformAccountId) {
+  return effectiveAccountId === connPlatformAccountId ? "none" : effectiveAccountId;
+}
+
 // app/lib/whatsapp/socket-resolution-error.ts
 function formatPresentKeys(presentKeys) {
   return presentKeys.join(",") || "none";
@@ -11531,13 +11597,13 @@ async function runPortalIndexPush(root) {
 import { existsSync as existsSync12, readdirSync as readdirSync9, statSync as statSync5 } from "fs";
 import { join as join17 } from "path";
 var GOOGLE_PENDING_LIFETIME_SEC = 600;
-var UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var UUID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function runGooglePendingAudit(accountsDir, nowMs, emit, readMtimeMs = (path3) => statSync5(path3).mtimeMs) {
   let scanned = 0;
   let stranded = 0;
   if (existsSync12(accountsDir)) {
     for (const accountId of readdirSync9(accountsDir)) {
-      if (!UUID_RE2.test(accountId)) continue;
+      if (!UUID_RE3.test(accountId)) continue;
       const pendingPath2 = join17(accountsDir, accountId, "secrets", "google", "pending-oauth.enc");
       try {
         if (!existsSync12(pendingPath2)) continue;
@@ -11596,19 +11662,202 @@ function runReconcileLivenessAudit(statePath, nowMs, intervalMs, emit) {
 
 // server/routes/whatsapp-reader.ts
 import { readFileSync as readFileSync21, watch as watch2, statSync as statSync8, openSync, readSync, closeSync, existsSync as existsSync17, readdirSync as readdirSync14, realpathSync as realpathSync6 } from "fs";
-import { basename as basename6, dirname as dirname7, isAbsolute, join as join22, relative as relative3, resolve as resolve17, sep as sep5 } from "path";
+import { basename as basename6, dirname as dirname7, isAbsolute, join as join23, relative as relative3, resolve as resolve17, sep as sep5 } from "path";
 
 // server/routes/admin/sidebar-sessions.ts
 import { readdirSync as readdirSync12, readFileSync as readFileSync19 } from "fs";
-import { readFile as readFile4, stat as stat5 } from "fs/promises";
-import { dirname as dirname5, join as join20, resolve as resolve15 } from "path";
+import { open as open2, readFile as readFile5, stat as stat5 } from "fs/promises";
+import { dirname as dirname5, join as join21, resolve as resolve15 } from "path";
+
+// server/lib/session-title-cache.ts
+import { open, readFile as readFile4, rename as rename2, unlink as unlink3, writeFile as writeFile5 } from "fs/promises";
+import { join as join18 } from "path";
+var CACHE_FILENAME = "ai-title-cache.json";
+var tmpSeq = 0;
+function nextTmpSeq() {
+  tmpSeq = (tmpSeq + 1) % Number.MAX_SAFE_INTEGER;
+  return tmpSeq;
+}
+function errCode(err) {
+  const code = err?.code;
+  if (code) return code;
+  return err instanceof Error && err.message ? err.message : String(err);
+}
+function titleCachePath(accountDir) {
+  return join18(accountDir, CACHE_FILENAME);
+}
+function parseTitleCacheWithDropped(raw) {
+  const out = /* @__PURE__ */ new Map();
+  let dropped = 0;
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { cache: out, dropped, wellFormed: false };
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return { cache: out, dropped, wellFormed: false };
+  }
+  for (const [sessionId, value] of Object.entries(parsed)) {
+    if (!sessionId) {
+      dropped += 1;
+      continue;
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+      dropped += 1;
+      continue;
+    }
+    const v = value;
+    const aiTitle = v.aiTitle === null ? null : typeof v.aiTitle === "string" ? v.aiTitle : void 0;
+    if (aiTitle === void 0) {
+      dropped += 1;
+      continue;
+    }
+    if (typeof v.scannedBytes !== "number" || !Number.isFinite(v.scannedBytes) || v.scannedBytes < 0) {
+      dropped += 1;
+      continue;
+    }
+    out.set(sessionId, { aiTitle, scannedBytes: v.scannedBytes });
+  }
+  return { cache: out, dropped, wellFormed: true };
+}
+function parseTitleCache(raw) {
+  return parseTitleCacheWithDropped(raw).cache;
+}
+function serializeTitleCache(cache3) {
+  const obj = {};
+  for (const [sessionId, entry] of cache3) obj[sessionId] = entry;
+  return JSON.stringify(obj);
+}
+async function loadTitleCacheOutcome(accountDir) {
+  if (!accountDir) return { cache: /* @__PURE__ */ new Map(), state: "no-dir", dropped: 0 };
+  let raw;
+  try {
+    raw = await readFile4(titleCachePath(accountDir), "utf8");
+  } catch (err) {
+    const code = err.code;
+    if (code === "ENOENT") return { cache: /* @__PURE__ */ new Map(), state: "absent", dropped: 0 };
+    console.error(
+      `[session-title-cache] op=load-failed dir=${accountDir} code=${code ?? "unknown"} reason=${err instanceof Error ? err.message : String(err)}`
+    );
+    return { cache: /* @__PURE__ */ new Map(), state: "unreadable", dropped: 0 };
+  }
+  const { cache: cache3, dropped, wellFormed } = parseTitleCacheWithDropped(raw);
+  const corrupt = !wellFormed || cache3.size === 0 && dropped > 0;
+  return { cache: cache3, state: corrupt ? "corrupt" : "loaded", dropped };
+}
+async function loadTitleCache(accountDir) {
+  return (await loadTitleCacheOutcome(accountDir)).cache;
+}
+async function saveTitleCacheMerged(accountDir, updates, evict) {
+  if (updates.size === 0 && (evict === void 0 || evict.size === 0)) return 0;
+  const path3 = titleCachePath(accountDir);
+  let merged;
+  try {
+    merged = parseTitleCache(await readFile4(path3, "utf8"));
+  } catch (err) {
+    if (err.code !== "ENOENT") throw err;
+    merged = /* @__PURE__ */ new Map();
+  }
+  for (const [sessionId, entry] of updates) merged.set(sessionId, entry);
+  let evicted = 0;
+  if (evict !== void 0) {
+    for (const sessionId of evict) {
+      if (merged.delete(sessionId)) evicted += 1;
+    }
+  }
+  const tmp = `${path3}.tmp.${process.pid}.${Date.now()}.${nextTmpSeq()}`;
+  try {
+    await writeFile5(tmp, serializeTitleCache(merged), "utf8");
+    await rename2(tmp, path3);
+  } catch (err) {
+    try {
+      await unlink3(tmp);
+    } catch (cleanupErr) {
+      const code = cleanupErr.code;
+      if (code !== "ENOENT") {
+        console.error(`[session-title-cache] op=tmp-cleanup-failed path=${tmp} code=${code ?? "unknown"}`);
+      }
+    }
+    throw err;
+  }
+  return evicted;
+}
+function lastAiTitleIn(text, initial) {
+  let aiTitle = initial;
+  for (const line of text.split("\n")) {
+    if (!line || line[0] !== "{") continue;
+    let parsed;
+    try {
+      parsed = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    if (!parsed || typeof parsed !== "object") continue;
+    const row = parsed;
+    if (row.type !== "ai-title" || typeof row.aiTitle !== "string") continue;
+    const t = row.aiTitle.trim();
+    if (t) aiTitle = t;
+  }
+  return aiTitle;
+}
+function scanAiTitleFromBody(body) {
+  const lastNl = body.lastIndexOf("\n");
+  const complete = lastNl === -1 ? "" : body.slice(0, lastNl + 1);
+  return {
+    aiTitle: lastAiTitleIn(body, null),
+    scannedBytes: Buffer.byteLength(complete, "utf8")
+  };
+}
+async function scanAiTitleIncremental(path3, size, prior) {
+  const usable = prior !== void 0 && prior.scannedBytes <= size;
+  const start = usable ? prior.scannedBytes : 0;
+  const carried = usable ? prior.aiTitle : null;
+  if (start >= size) return { entry: { aiTitle: carried, scannedBytes: start }, bytesRead: 0 };
+  const length = size - start;
+  let chunk;
+  let handle2;
+  try {
+    handle2 = await open(path3, "r");
+  } catch (err) {
+    return {
+      entry: { aiTitle: carried, scannedBytes: start },
+      bytesRead: 0,
+      failure: `open ${errCode(err)}`
+    };
+  }
+  try {
+    const buf = Buffer.alloc(length);
+    const { bytesRead } = await handle2.read(buf, 0, length, start);
+    chunk = bytesRead < length ? buf.subarray(0, bytesRead) : buf;
+  } catch (err) {
+    return {
+      entry: { aiTitle: carried, scannedBytes: start },
+      bytesRead: 0,
+      failure: `read ${errCode(err)}`
+    };
+  } finally {
+    await handle2.close().catch(() => {
+    });
+  }
+  const text = chunk.toString("utf8");
+  const lastNl = text.lastIndexOf("\n");
+  const complete = lastNl === -1 ? "" : text.slice(0, lastNl + 1);
+  return {
+    entry: {
+      aiTitle: lastAiTitleIn(text, carried),
+      scannedBytes: start + Buffer.byteLength(complete, "utf8")
+    },
+    bytesRead: chunk.length
+  };
+}
 
 // ../services/claude-session-manager/src/jsonl-path.ts
 import { existsSync as existsSync14, readdirSync as readdirSync10 } from "fs";
 import { homedir } from "os";
-import { join as join18 } from "path";
+import { join as join19 } from "path";
 function findExistingJsonlForSessionId(claudeConfigDir2, sessionId) {
-  const projectsRoot = join18(claudeConfigDir2, "projects");
+  const projectsRoot = join19(claudeConfigDir2, "projects");
   if (!existsSync14(projectsRoot)) return null;
   let slugs;
   try {
@@ -11618,9 +11867,9 @@ function findExistingJsonlForSessionId(claudeConfigDir2, sessionId) {
   }
   const basename15 = `${sessionId}.jsonl`;
   for (const slug of slugs) {
-    const live = join18(projectsRoot, slug, basename15);
+    const live = join19(projectsRoot, slug, basename15);
     if (existsSync14(live)) return live;
-    const archived = join18(projectsRoot, slug, "archive", basename15);
+    const archived = join19(projectsRoot, slug, "archive", basename15);
     if (existsSync14(archived)) return archived;
   }
   return null;
@@ -11629,7 +11878,7 @@ function findExistingJsonlForSessionId(claudeConfigDir2, sessionId) {
 // app/lib/admin-identity/pin-validator.ts
 import { createHash as createHash3 } from "crypto";
 import { existsSync as existsSync15, readFileSync as readFileSync18, readdirSync as readdirSync11, statSync as statSync6 } from "fs";
-import { join as join19 } from "path";
+import { join as join20 } from "path";
 function hashPin(pin) {
   return createHash3("sha256").update(pin).digest("hex");
 }
@@ -11737,7 +11986,29 @@ function lastAssistantModel(body) {
   }
   return null;
 }
-var CLI_MARKER_PREFIXES = ["<local-command-", "<command-name>", "<command-message>"];
+async function lastAssistantModelFromTail(path3, size, maxBytes = 256 * 1024) {
+  if (size <= 0) return { model: null, bytesRead: 0 };
+  const start = Math.max(0, size - maxBytes);
+  const length = size - start;
+  let handle2;
+  try {
+    handle2 = await open2(path3, "r");
+  } catch (err) {
+    return { model: null, bytesRead: 0, failure: `open ${errCode(err)}` };
+  }
+  let chunk;
+  try {
+    const buf = Buffer.alloc(length);
+    const { bytesRead } = await handle2.read(buf, 0, length, start);
+    chunk = bytesRead < length ? buf.subarray(0, bytesRead) : buf;
+  } catch (err) {
+    return { model: null, bytesRead: 0, failure: `read ${errCode(err)}` };
+  } finally {
+    await handle2.close().catch(() => {
+    });
+  }
+  return { model: lastAssistantModel(chunk.toString("utf8")), bytesRead: chunk.length };
+}
 var ADMIN_ROLE = "admin";
 var WEBCHAT_CHANNEL = "webchat";
 var app4 = new Hono();
@@ -11750,62 +12021,69 @@ function findSessionProjectDir(sessionId) {
   const jsonlPath = findExistingJsonlForSessionId(cfg, sessionId);
   return jsonlPath ? dirname5(jsonlPath) : null;
 }
-function enumerateJsonls(projectsRoot) {
+function enumerateJsonlsWithSkips(projectsRoot) {
   const out = [];
+  let skipped = 0;
   let slugs;
   try {
     slugs = readdirSync12(projectsRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
   } catch (err) {
-    if (err.code === "ENOENT") return out;
+    if (err.code === "ENOENT") return { files: out, skipped };
     throw err;
   }
   for (const slug of slugs) {
-    const slugDir = join20(projectsRoot, slug);
+    const slugDir = join21(projectsRoot, slug);
     let entries2;
     try {
       entries2 = readdirSync12(slugDir, { withFileTypes: true });
     } catch (err) {
       const code = err.code ?? "unknown";
       console.error(`[admin-sessions-list] slug-skipped slug=${slug} code=${code}`);
+      skipped += 1;
       continue;
     }
     for (const entry of entries2) {
       if (entry.isFile() && SESSION_ID_RE.test(entry.name)) {
-        out.push({ path: join20(slugDir, entry.name), isSubagent: false, archived: false });
+        out.push({ path: join21(slugDir, entry.name), isSubagent: false, archived: false });
       } else if (entry.isDirectory() && entry.name === "subagents") {
-        const subDir = join20(slugDir, entry.name);
+        const subDir = join21(slugDir, entry.name);
         let subEntries;
         try {
           subEntries = readdirSync12(subDir, { withFileTypes: true });
         } catch (err) {
           const code = err.code ?? "unknown";
           console.error(`[admin-sessions-list] subagents-skipped slug=${slug} code=${code}`);
+          skipped += 1;
           continue;
         }
         for (const sub of subEntries) {
           if (sub.isFile() && SESSION_ID_RE.test(sub.name)) {
-            out.push({ path: join20(subDir, sub.name), isSubagent: true, archived: false });
+            out.push({ path: join21(subDir, sub.name), isSubagent: true, archived: false });
           }
         }
       } else if (entry.isDirectory() && entry.name === "archive") {
-        const archiveDir = join20(slugDir, entry.name);
+        const archiveDir = join21(slugDir, entry.name);
         let archiveEntries;
         try {
           archiveEntries = readdirSync12(archiveDir, { withFileTypes: true });
         } catch (err) {
           const code = err.code ?? "unknown";
           console.error(`[admin-sessions-list] archive-skipped slug=${slug} code=${code}`);
+          skipped += 1;
           continue;
         }
         for (const arc of archiveEntries) {
           if (arc.isFile() && SESSION_ID_RE.test(arc.name)) {
-            out.push({ path: join20(archiveDir, arc.name), isSubagent: false, archived: true });
+            out.push({ path: join21(archiveDir, arc.name), isSubagent: false, archived: true });
           }
         }
       }
     }
   }
-  return out;
+  return { files: out, skipped };
+}
+function enumerateJsonls(projectsRoot) {
+  return enumerateJsonlsWithSkips(projectsRoot).files;
 }
 async function fetchLiveSessions() {
   const out = /* @__PURE__ */ new Map();
@@ -11833,7 +12111,7 @@ function loadUserTitles(accountDir) {
   if (!accountDir) return /* @__PURE__ */ new Map();
   let raw;
   try {
-    raw = readFileSync19(join20(accountDir, "session-titles.json"), "utf8");
+    raw = readFileSync19(join21(accountDir, "session-titles.json"), "utf8");
   } catch {
     return /* @__PURE__ */ new Map();
   }
@@ -11843,7 +12121,7 @@ async function loadUserTitlesAsync(accountDir) {
   if (!accountDir) return /* @__PURE__ */ new Map();
   let raw;
   try {
-    raw = await readFile4(join20(accountDir, "session-titles.json"), "utf8");
+    raw = await readFile5(join21(accountDir, "session-titles.json"), "utf8");
   } catch {
     return /* @__PURE__ */ new Map();
   }
@@ -11884,7 +12162,7 @@ function emptySidecarMeta() {
 async function readSidecarMetaAsync(metaPath) {
   let raw;
   try {
-    raw = await readFile4(metaPath, "utf8");
+    raw = await readFile5(metaPath, "utf8");
   } catch {
     return emptySidecarMeta();
   }
@@ -11913,67 +12191,14 @@ function parseSidecarMeta(raw) {
     accountId: typeof r.accountId === "string" ? r.accountId : null
   };
 }
-function startsWithCliMarker(s) {
-  for (const p of CLI_MARKER_PREFIXES) if (s.startsWith(p)) return true;
-  return false;
-}
 function trimToTitle(raw) {
   return raw.trim().replace(/\s+/g, " ");
 }
-var CHANNEL_WRAPPER = /^<channel\b([^>]*)>\n?([\s\S]*?)\n?<\/channel>$/;
-var SOURCE_ATTR = /\bsource="([^"]+)"/;
-var CHANNEL_SOURCE_MAP = {
-  whatsapp: "whatsapp",
-  "whatsapp-channel": "whatsapp",
-  webchat: "webchat",
-  "webchat-channel": "webchat"
-};
-function stripChannelEnvelope(text) {
-  const m = text.match(CHANNEL_WRAPPER);
-  if (!m) return { inner: text, channel: null };
-  let raw = m[1].match(SOURCE_ATTR)?.[1] ?? "";
-  let inner = m[2];
-  const im = inner.match(CHANNEL_WRAPPER);
-  const innerRaw = im?.[1].match(SOURCE_ATTR)?.[1];
-  if (im && innerRaw) {
-    raw = innerRaw;
-    inner = im[2];
-  }
-  return { inner, channel: CHANNEL_SOURCE_MAP[raw] ?? (raw || null) };
-}
-function resolveTitle(body, sessionId, userTitles) {
+function resolveTitleFromParts(sessionId, userTitles, aiTitle) {
   const userTitle = userTitles.get(sessionId);
-  let aiTitle = null;
-  let firstUserMessage = null;
-  for (const line of body.split("\n")) {
-    if (!line || line[0] !== "{") continue;
-    let parsed;
-    try {
-      parsed = JSON.parse(line);
-    } catch {
-      continue;
-    }
-    if (!parsed || typeof parsed !== "object") continue;
-    const row = parsed;
-    if (row.type === "ai-title" && typeof row.aiTitle === "string") {
-      const t = row.aiTitle.trim();
-      if (t) aiTitle = t;
-      continue;
-    }
-    if (firstUserMessage === null && row.type === "user" && row.message && row.message.role === "user") {
-      const content = row.message.content;
-      if (typeof content !== "string") continue;
-      const trimmed = content.trim();
-      if (!trimmed) continue;
-      if (startsWithCliMarker(trimmed)) continue;
-      firstUserMessage = trimmed;
-    }
-  }
-  const stripped = firstUserMessage !== null ? stripChannelEnvelope(firstUserMessage) : { inner: null, channel: null };
-  const channel = stripped.channel;
-  if (userTitle) return { title: trimToTitle(userTitle), source: "user", channel };
-  if (aiTitle) return { title: trimToTitle(aiTitle), source: "ai", channel };
-  return { title: sessionId.slice(0, 8), source: "prefix", channel };
+  if (userTitle) return { title: trimToTitle(userTitle), source: "user" };
+  if (aiTitle) return { title: trimToTitle(aiTitle), source: "ai" };
+  return { title: sessionId.slice(0, 8), source: "prefix" };
 }
 app4.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
@@ -11998,8 +12223,7 @@ async function computeSessionList(scopeAccountId) {
     console.error("[admin-sessions-list] CLAUDE_CONFIG_DIR not set; returning empty list");
     return { sessions: [], accountId: scopeAccountId };
   }
-  const projectsRoot = join20(configDir2, "projects");
-  const jsonls = enumerateJsonls(projectsRoot);
+  const projectsRoot = join21(configDir2, "projects");
   const liveSessions = await fetchLiveSessions();
   const accountDir = scopeAccountId ? resolve15(ACCOUNTS_DIR, scopeAccountId) : null;
   const userTitles = await loadUserTitlesAsync(accountDir);
@@ -12029,6 +12253,24 @@ async function computeSessionList(scopeAccountId) {
   const adminUserIdBySession = /* @__PURE__ */ new Map();
   const channelSenderBySession = /* @__PURE__ */ new Map();
   const channelMissNoSender = [];
+  const titleCacheDir = account?.accountDir ?? accountDir;
+  const cacheLoad = await loadTitleCacheOutcome(titleCacheDir);
+  const titleCache = cacheLoad.cache;
+  const cacheUpdates = /* @__PURE__ */ new Map();
+  const { files: jsonls, skipped: enumSkipped } = enumerateJsonlsWithSkips(projectsRoot);
+  let enumeratedCount = 0;
+  let scopedCount = 0;
+  let titleCacheHits = 0;
+  let bodyScans = 0;
+  let titleReadFails = 0;
+  let titleBytes = 0;
+  let tailReads = 0;
+  let tailModelMiss = 0;
+  let tailReadFails = 0;
+  let tailBytes = 0;
+  let cacheWriteFails = 0;
+  let evicted = 0;
+  const walkStartedAt = Date.now();
   for (const { path: path3, isSubagent, archived } of jsonls) {
     const lastSlash = path3.lastIndexOf("/");
     const base = path3.slice(lastSlash + 1);
@@ -12039,24 +12281,40 @@ async function computeSessionList(scopeAccountId) {
       continue;
     }
     seenIds.add(sessionId);
-    let body;
+    enumeratedCount += 1;
     let mtimeMs;
+    let size;
     try {
-      body = await readFile4(path3, "utf8");
-      mtimeMs = (await stat5(path3)).mtimeMs;
+      const st = await stat5(path3);
+      mtimeMs = st.mtimeMs;
+      size = st.size;
     } catch {
       continue;
     }
-    const live = liveSessions.has(sessionId);
-    const pid = live ? liveSessions.get(sessionId) ?? null : null;
-    const resolved = resolveTitle(body, sessionId, userTitles);
-    titleSourceCounts[resolved.source] += 1;
-    const metaPath = join20(projectDir, `${sessionId}.meta.json`);
+    const metaPath = join21(projectDir, `${sessionId}.meta.json`);
     const { bridgeIds, role, channel: sidecarChannel, senderId, personId, adminUserId, accountId: rowAccountId } = await readSidecarMetaAsync(metaPath);
     if (multiAccount) {
       if (rowAccountId === null) untaggedCount += 1;
       if (rowAccountId !== scopeAccountId) continue;
     }
+    scopedCount += 1;
+    const live = liveSessions.has(sessionId);
+    const pid = live ? liveSessions.get(sessionId) ?? null : null;
+    const prior = titleCache.get(sessionId);
+    const scan = await scanAiTitleIncremental(path3, size, prior);
+    if (scan.failure) {
+      titleReadFails += 1;
+      console.error(
+        `[admin-sessions-list] op=title-scan-failed sessionId=${sessionId.slice(0, 8)} reason=${scan.failure}`
+      );
+    } else if (scan.bytesRead > 0) bodyScans += 1;
+    else if (prior !== void 0) titleCacheHits += 1;
+    titleBytes += scan.bytesRead;
+    if (!prior || prior.aiTitle !== scan.entry.aiTitle || prior.scannedBytes !== scan.entry.scannedBytes) {
+      cacheUpdates.set(sessionId, scan.entry);
+    }
+    const resolved = resolveTitleFromParts(sessionId, userTitles, scan.entry.aiTitle);
+    titleSourceCounts[resolved.source] += 1;
     if (isSessionListExcluded(role, sidecarChannel)) {
       excludedPublicWebchatCount += 1;
       continue;
@@ -12065,6 +12323,17 @@ async function computeSessionList(scopeAccountId) {
     if (adminUserId && role === ADMIN_ROLE && sidecarChannel === WEBCHAT_CHANNEL) {
       adminUserIdBySession.set(sessionId, adminUserId);
     }
+    const tail = await lastAssistantModelFromTail(path3, size);
+    if (tail.failure) {
+      tailReadFails += 1;
+      console.error(
+        `[admin-sessions-list] op=tail-read-failed sessionId=${sessionId.slice(0, 8)} reason=${tail.failure}`
+      );
+    } else {
+      if (tail.bytesRead > 0) tailReads += 1;
+      if (tail.model === null) tailModelMiss += 1;
+    }
+    tailBytes += tail.bytesRead;
     rows.push({
       sessionId,
       title: resolved.title,
@@ -12083,7 +12352,7 @@ async function computeSessionList(scopeAccountId) {
       // diverge from the sidecar (e.g. an ai-titled channel row).
       channel: sidecarChannel,
       personName: null,
-      model: lastAssistantModel(body),
+      model: tail.model,
       accountId: rowAccountId,
       senderId,
       whatsappName: null
@@ -12163,6 +12432,24 @@ async function computeSessionList(scopeAccountId) {
     console.error(`[admin-sessions-list] op=channel-name-unresolved sessionId=${m.sessionId.slice(0, 8)} channel=${m.channel} senderId= reason=no-senderId`);
   }
   rows.sort((a, b) => a.startedAt < b.startedAt ? 1 : -1);
+  const evictIds = /* @__PURE__ */ new Set();
+  if (enumSkipped === 0 && seenIds.size > 0) {
+    for (const sessionId of titleCache.keys()) if (!seenIds.has(sessionId)) evictIds.add(sessionId);
+  }
+  if (titleCacheDir && (cacheUpdates.size > 0 || evictIds.size > 0)) {
+    try {
+      evicted = await saveTitleCacheMerged(titleCacheDir, cacheUpdates, evictIds);
+    } catch (err) {
+      cacheWriteFails += 1;
+      console.error(
+        `[admin-sessions-list] op=title-cache-write-failed dir=${titleCacheDir} code=${errCode(err)} reason=${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  }
+  const bytesMB = (titleBytes + tailBytes) / (1024 * 1024);
+  console.log(
+    `[admin-sessions-list] op=list-walk enumerated=${enumeratedCount} scoped=${scopedCount} cacheLoad=${cacheLoad.state} cacheEntries=${titleCache.size} cacheDropped=${cacheLoad.dropped} titleCacheHits=${titleCacheHits} bodyScans=${bodyScans} titleReadFails=${titleReadFails} tailReads=${tailReads} tailModelMiss=${tailModelMiss} tailReadFails=${tailReadFails} titleBytesMB=${(titleBytes / (1024 * 1024)).toFixed(3)} bytesMB=${bytesMB.toFixed(3)} cacheWriteFails=${cacheWriteFails} evicted=${evicted} enumSkipped=${enumSkipped} ms=${Date.now() - walkStartedAt}`
+  );
   console.log(
     `[admin-sessions-list] rows=${rows.length} live=${liveCount} subagents=${subagentCount} archived=${archivedCount} channelInList=whatsapp:${channelInList.whatsapp},telegram:${channelInList.telegram},webchat:${channelInList.webchat} channelNameCandidates=${channelNameCandidates} channelNamesResolved=${channelNamesResolved} (operator=${operatorResolvedCount} store=${storeResolvedCount}) unknownChannel=${unknownChannelCount} excludedPublicWebchat=${excludedPublicWebchatCount} titles user=${titleSourceCounts.user} ai=${titleSourceCounts.ai} first=${titleSourceCounts["first-message"]} prefix=${titleSourceCounts.prefix} personNames=${personNameCount} adminNames=${adminNameCount} accountId=${scopeAccountId ? scopeAccountId.slice(0, 8) : "unset"}`
   );
@@ -12194,15 +12481,15 @@ var WEBCHAT_REPLY_TOOL = "mcp__webchat-channel__reply";
 var CHANNEL_REPLY_TOOL = "mcp__channel__reply";
 var CHANNEL_REPLY_DOCUMENT_TOOL = "mcp__channel__reply-document";
 var SEND_USER_FILE_TOOL = "SendUserFile";
-var CLI_MARKER_PREFIXES2 = ["<local-command-", "<command-name>", "<command-message>"];
+var CLI_MARKER_PREFIXES = ["<local-command-", "<command-name>", "<command-message>"];
 var HARNESS_LIFECYCLE_PREFIXES = ["<task-notification>"];
 var CC_IMAGE_VISION_HINT = /^\[Image:[^\]]*Multiply coordinates by [\d.]+ to map to original image\.\]$/;
 var COMPACT_SUMMARY_PREFIX = "This session is being continued from a previous conversation that ran out of context.";
 function isCompactSummaryRow(row, content) {
   return row.isCompactSummary === true || content !== null && content.startsWith(COMPACT_SUMMARY_PREFIX);
 }
-var CHANNEL_WRAPPER2 = /^<channel\b([^>]*)>\n?([\s\S]*?)\n?<\/channel>$/;
-var SOURCE_ATTR2 = /\bsource="([^"]+)"/;
+var CHANNEL_WRAPPER = /^<channel\b([^>]*)>\n?([\s\S]*?)\n?<\/channel>$/;
+var SOURCE_ATTR = /\bsource="([^"]+)"/;
 var SOURCE_MAP = {
   whatsapp: "whatsapp",
   "whatsapp-channel": "whatsapp",
@@ -12212,18 +12499,18 @@ var SOURCE_MAP = {
   "webchat-channel": "webchat"
 };
 function isScheduleSource(text) {
-  const m = text.match(CHANNEL_WRAPPER2);
+  const m = text.match(CHANNEL_WRAPPER);
   if (!m) return false;
-  return m[1].match(SOURCE_ATTR2)?.[1] === "schedule";
+  return m[1].match(SOURCE_ATTR)?.[1] === "schedule";
 }
 function unwrapChannel(text) {
-  const m = text.match(CHANNEL_WRAPPER2);
+  const m = text.match(CHANNEL_WRAPPER);
   if (!m) return { text };
-  let source = SOURCE_MAP[m[1].match(SOURCE_ATTR2)?.[1] ?? ""];
+  let source = SOURCE_MAP[m[1].match(SOURCE_ATTR)?.[1] ?? ""];
   let inner = m[2];
-  const im = inner.match(CHANNEL_WRAPPER2);
+  const im = inner.match(CHANNEL_WRAPPER);
   if (im) {
-    const innerSource = SOURCE_MAP[im[1].match(SOURCE_ATTR2)?.[1] ?? ""];
+    const innerSource = SOURCE_MAP[im[1].match(SOURCE_ATTR)?.[1] ?? ""];
     if (innerSource) {
       source = innerSource;
       inner = im[2];
@@ -12395,7 +12682,7 @@ function parseTranscript(lines, queuedPendingSuppress = /* @__PURE__ */ new Map(
     }
     if (row.type === "queue-operation" && row.operation === "enqueue") {
       const content = asString(row.content);
-      if (content !== null && CHANNEL_WRAPPER2.test(content)) {
+      if (content !== null && CHANNEL_WRAPPER.test(content)) {
         const u = unwrapChannel(content);
         turnCtx.lastChannelSource = u.source;
         if (!isScheduleSource(content)) {
@@ -12428,7 +12715,7 @@ function parseTranscript(lines, queuedPendingSuppress = /* @__PURE__ */ new Map(
     }
     const text = asString(msg.content);
     if (text === null) continue;
-    if (CLI_MARKER_PREFIXES2.some((p) => text.startsWith(p))) continue;
+    if (CLI_MARKER_PREFIXES.some((p) => text.startsWith(p))) continue;
     if (HARNESS_LIFECYCLE_PREFIXES.some((p) => text.startsWith(p))) continue;
     if (CC_IMAGE_VISION_HINT.test(text)) continue;
     const isChannel = row.isMeta === true && typeof row.origin === "object" && row.origin !== null && row.origin.kind === "channel" || // Native Claude Code channels (maxy-lite) journal the delivery twin as a PLAIN
@@ -12436,7 +12723,7 @@ function parseTranscript(lines, queuedPendingSuppress = /* @__PURE__ */ new Map(
     // `isMeta`/`origin` stamp. Detect it by the wrapper so it is treated as the
     // channel twin and consumes the enqueue row's suppression — otherwise the
     // enqueue row AND this row both render and every channel message doubles.
-    CHANNEL_WRAPPER2.test(text);
+    CHANNEL_WRAPPER.test(text);
     if (isChannel) {
       const u = unwrapChannel(text);
       turnCtx.lastChannelSource = u.source;
@@ -12454,7 +12741,7 @@ function parseTranscript(lines, queuedPendingSuppress = /* @__PURE__ */ new Map(
 
 // app/lib/whatsapp-reader/enrich-attachments.ts
 import { readFileSync as readFileSync20, readdirSync as readdirSync13, existsSync as existsSync16, statSync as statSync7, realpathSync as realpathSync5 } from "fs";
-import { basename as basename5, dirname as dirname6, join as join21, resolve as resolve16, sep as sep4 } from "path";
+import { basename as basename5, dirname as dirname6, join as join22, resolve as resolve16, sep as sep4 } from "path";
 var ADMIN_UPLOAD_PATH = /\/uploads\/(?!public\/)([0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})\//gi;
 function adminAttachmentIds(text) {
   const ids = [];
@@ -12467,7 +12754,7 @@ function adminAttachmentIds(text) {
 function adminAttachmentsFromText(text, uploadsBase) {
   const out = [];
   for (const id of adminAttachmentIds(text)) {
-    const meta = readAttachmentMeta(join21(uploadsBase, id));
+    const meta = readAttachmentMeta(join22(uploadsBase, id));
     if (meta) out.push(meta);
   }
   return out;
@@ -12517,7 +12804,7 @@ function claudeUploadAttachmentsFromText(text, sessionId) {
 function readSidecar(dir, attachmentId) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync20(join21(dir, `${attachmentId}.meta.json`), "utf8"));
+    parsed = JSON.parse(readFileSync20(join22(dir, `${attachmentId}.meta.json`), "utf8"));
   } catch {
     return null;
   }
@@ -12546,7 +12833,7 @@ function listSessionAttachmentsInDir(dir) {
   }
   const sidecars = [];
   for (const name of entries2) {
-    const sidecar = readSidecar(join21(dir, name), name);
+    const sidecar = readSidecar(join22(dir, name), name);
     if (sidecar) sidecars.push(sidecar);
   }
   sidecars.sort((a, b) => a.storedAt.localeCompare(b.storedAt));
@@ -12706,25 +12993,59 @@ app5.get("/conversations", requireAdminSession, async (c) => {
   }
   const cfg = claudeConfigDir();
   if (!cfg) return c.json({ conversations: [] });
-  const projectsRoot = join22(cfg, "projects");
+  const projectsRoot = join23(cfg, "projects");
   const userTitles = loadUserTitles(ACCOUNTS_DIR ?? null);
   const rows = [];
   let sessionRowsExcludedUntagged = 0;
+  const account = multiAccount ? validAccounts.find((a) => a.accountId === scopeAccountId) ?? null : resolveAccount();
+  const titleCache = await loadTitleCache(account?.accountDir ?? null);
+  const titleCacheUpdates = /* @__PURE__ */ new Map();
+  let enumeratedCount = 0;
+  let bodyReadCount = 0;
+  let bodyReadFails = 0;
+  let titleCacheHits = 0;
+  let bodyScans = 0;
+  const walkStartedAt = Date.now();
+  const untaggedSenders = /* @__PURE__ */ new Set();
   for (const { path: path3 } of enumerateJsonls(projectsRoot)) {
+    enumeratedCount += 1;
     const sessionId = basename6(path3).replace(/\.jsonl$/, "");
     const projectDir = dirname7(path3);
-    const meta = readSidecarMeta(join22(projectDir, `${sessionId}.meta.json`));
+    const meta = readSidecarMeta(join23(projectDir, `${sessionId}.meta.json`));
     if (!isReaderChannelSession(meta.role, meta.channel)) continue;
     if (multiAccount) {
-      if (meta.accountId === null) sessionRowsExcludedUntagged += 1;
+      if (meta.accountId === null) {
+        sessionRowsExcludedUntagged += 1;
+        if (meta.senderId) untaggedSenders.add(meta.senderId);
+      }
       if (meta.accountId !== scopeAccountId) continue;
     }
     let body = "";
+    let bodyRead = false;
     try {
       body = readFileSync21(path3, "utf8");
-    } catch {
+      bodyRead = true;
+      bodyReadCount += 1;
+    } catch (err) {
+      bodyReadFails += 1;
+      console.error(
+        `[wa-reader] op=body-read-failed sessionId=${sessionId.slice(0, 8)} code=${errCode(err)}`
+      );
+    }
+    let aiTitle = null;
+    if (bodyRead) {
+      const cached3 = titleCache.get(sessionId);
+      if (cached3 && cached3.scannedBytes === Buffer.byteLength(body, "utf8")) {
+        aiTitle = cached3.aiTitle;
+        titleCacheHits += 1;
+      } else {
+        const scanned = scanAiTitleFromBody(body);
+        aiTitle = scanned.aiTitle;
+        titleCacheUpdates.set(sessionId, scanned);
+        bodyScans += 1;
+      }
     }
-    const { title } = resolveTitle(body, sessionId, userTitles);
+    const { title } = resolveTitleFromParts(sessionId, userTitles, aiTitle);
     const turns = parseTranscript(body.split("\n"));
     const lastMessageAt = lastTurnTs(turns);
     const modelGated = isModelGated(turns);
@@ -12742,8 +13063,24 @@ app5.get("/conversations", requireAdminSession, async (c) => {
       model: lastAssistantModel(body)
     });
   }
+  if (sessionRowsExcludedUntagged > 0) {
+    console.log(
+      `[wa-reader] op=untagged-sidecars count=${sessionRowsExcludedUntagged} senders=${[...untaggedSenders].sort().join(",")} route=conversations`
+    );
+  }
   const sessionRows = selectReaderChannelSessions(rows).filter((r) => r.channel !== "whatsapp");
-  const account = multiAccount ? validAccounts.find((a) => a.accountId === scopeAccountId) ?? null : resolveAccount();
+  if (account && titleCacheUpdates.size > 0) {
+    try {
+      await saveTitleCacheMerged(account.accountDir, titleCacheUpdates);
+    } catch (err) {
+      console.error(
+        `[wa-reader] op=title-cache-write-failed dir=${account.accountDir} reason=${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  }
+  console.log(
+    `[wa-reader] op=list-walk enumerated=${enumeratedCount} read=${bodyReadCount} readFails=${bodyReadFails} titleCacheHits=${titleCacheHits} bodyScans=${bodyScans} ms=${Date.now() - walkStartedAt}`
+  );
   let users = [];
   if (account) {
     try {
@@ -12844,24 +13181,61 @@ app5.get("/conversations-all", requireAdminSession, async (c) => {
   const { value, state } = await getOrCompute("conversations-all", houseId, async () => {
     const cfg = claudeConfigDir();
     if (!cfg) return { conversations: [] };
-    const projectsRoot = join22(cfg, "projects");
+    const projectsRoot = join23(cfg, "projects");
     const userTitles = loadUserTitles(ACCOUNTS_DIR ?? null);
     const validAccounts = listValidAccounts();
     const validIds = new Set(validAccounts.map((a) => a.accountId));
     const houseIds = new Set(validAccounts.filter((a) => a.config.role === "house").map((a) => a.accountId));
     const rawByAccount = /* @__PURE__ */ new Map();
+    const cachesByAccount = /* @__PURE__ */ new Map();
+    const accountDirById = new Map(validAccounts.map((a) => [a.accountId, a.accountDir]));
+    let enumeratedCount = 0;
+    let bodyReadCount = 0;
+    let bodyReadFails = 0;
+    let titleCacheHits = 0;
+    let bodyScans = 0;
+    const walkStartedAt = Date.now();
+    let untaggedCount = 0;
+    const untaggedSenders = /* @__PURE__ */ new Set();
     for (const { path: path3 } of enumerateJsonls(projectsRoot)) {
+      enumeratedCount += 1;
       const sessionId = basename6(path3).replace(/\.jsonl$/, "");
       const projectDir = dirname7(path3);
-      const meta = readSidecarMeta(join22(projectDir, `${sessionId}.meta.json`));
+      const meta = readSidecarMeta(join23(projectDir, `${sessionId}.meta.json`));
       if (!isReaderChannelSession(meta.role, meta.channel)) continue;
-      if (meta.accountId === null || !validIds.has(meta.accountId)) continue;
+      if (meta.accountId === null) {
+        untaggedCount += 1;
+        if (meta.senderId) untaggedSenders.add(meta.senderId);
+        continue;
+      }
+      if (!validIds.has(meta.accountId)) continue;
       let body = "";
+      let bodyRead = false;
       try {
         body = readFileSync21(path3, "utf8");
-      } catch {
+        bodyRead = true;
+        bodyReadCount += 1;
+      } catch (err) {
+        bodyReadFails += 1;
+        console.error(`[wa-reader] op=body-read-failed sessionId=${sessionId.slice(0, 8)} code=${errCode(err)}`);
+      }
+      let aiTitle = null;
+      if (bodyRead) {
+        let cache3 = cachesByAccount.get(meta.accountId);
+        if (cache3 === void 0) {
+          cache3 = await loadTitleCache(accountDirById.get(meta.accountId) ?? null);
+          cachesByAccount.set(meta.accountId, cache3);
+        }
+        const cached3 = cache3.get(sessionId);
+        if (cached3 && cached3.scannedBytes === Buffer.byteLength(body, "utf8")) {
+          aiTitle = cached3.aiTitle;
+          titleCacheHits += 1;
+        } else {
+          aiTitle = scanAiTitleFromBody(body).aiTitle;
+          bodyScans += 1;
+        }
       }
-      const { title } = resolveTitle(body, sessionId, userTitles);
+      const { title } = resolveTitleFromParts(sessionId, userTitles, aiTitle);
       const turns = parseTranscript(body.split("\n"));
       const row = {
         sessionId,
@@ -12879,6 +13253,14 @@ app5.get("/conversations-all", requireAdminSession, async (c) => {
       list.push(row);
       rawByAccount.set(meta.accountId, list);
     }
+    console.log(
+      `[wa-reader] op=list-walk enumerated=${enumeratedCount} read=${bodyReadCount} readFails=${bodyReadFails} titleCacheHits=${titleCacheHits} bodyScans=${bodyScans} ms=${Date.now() - walkStartedAt}`
+    );
+    if (untaggedCount > 0) {
+      console.log(
+        `[wa-reader] op=untagged-sidecars count=${untaggedCount} senders=${[...untaggedSenders].sort().join(",")} route=conversations-all`
+      );
+    }
     let users = [];
     try {
       users = readUsersFile(USERS_FILE) ?? [];
@@ -13018,7 +13400,7 @@ function openTaskKey(turns) {
 }
 function readSubagentMeta(dir, hex) {
   try {
-    const m = JSON.parse(readFileSync21(join22(dir, `agent-${hex}.meta.json`), "utf8"));
+    const m = JSON.parse(readFileSync21(join23(dir, `agent-${hex}.meta.json`), "utf8"));
     if (typeof m.agentType === "string" && typeof m.description === "string" && typeof m.toolUseId === "string") {
       return { agentType: m.agentType, description: m.description, toolUseId: m.toolUseId };
     }
@@ -13050,7 +13432,7 @@ function runActivityTick(c) {
     let size = 0;
     let mtimeMs = 0;
     try {
-      const st = statSync8(join22(c.subagentsDir, name));
+      const st = statSync8(join23(c.subagentsDir, name));
       size = st.size;
       mtimeMs = st.mtimeMs;
     } catch {
@@ -13095,11 +13477,11 @@ app5.get("/stream", requireAdminSession, (c) => {
   const sessionId = c.req.query("sessionId") ?? "";
   const projectDir = c.req.query("projectDir") ?? "";
   const cfg = claudeConfigDir();
-  const projectsRoot = cfg ? resolve17(join22(cfg, "projects")) : null;
+  const projectsRoot = cfg ? resolve17(join23(cfg, "projects")) : null;
   if (!cfg || !projectsRoot || !SESSION_ID_RE2.test(sessionId)) {
     return c.json({ error: "bad session reference" }, 400);
   }
-  const jsonlPath = resolve17(join22(projectDir, `${sessionId}.jsonl`));
+  const jsonlPath = resolve17(join23(projectDir, `${sessionId}.jsonl`));
   if (!jsonlPath.startsWith(projectsRoot + sep5)) {
     return c.json({ error: "bad session reference" }, 400);
   }
@@ -13126,7 +13508,7 @@ data: ${JSON.stringify(turn)}
       let offset = resumeOffset(lastEventId, fileEnd0);
       console.log(`[wa-stream] op=open conn=${connId} sessionId=${sessionId} channel=reader resume=${offset}`);
       const sessionKey = c.req.query("session_key") ?? "";
-      const subagentsDir = resolve17(join22(projectDir, sessionId, "subagents"));
+      const subagentsDir = resolve17(join23(projectDir, sessionId, "subagents"));
       console.log(
         `[webchat-activity] op=watch-subagents key=${sessionKey} dir=${subagentsDir} exists=${existsSync17(subagentsDir)}`
       );
@@ -13255,7 +13637,7 @@ app5.get("/directives", requireAdminSession, (c) => {
     const pid = Number(pidPart);
     let len = 0;
     try {
-      len = statSync8(join22(dir, name)).size;
+      len = statSync8(join23(dir, name)).size;
     } catch {
     }
     return { name, secs, pid, ts: Number.isFinite(secs) ? new Date(secs * 1e3).toISOString() : null, len };
@@ -13270,7 +13652,7 @@ app5.get("/directive", requireAdminSession, (c) => {
   }
   const dir = directiveStoreDir(sessionId);
   if (!dir) return c.json({ error: "no account" }, 404);
-  const path3 = resolve17(join22(dir, name));
+  const path3 = resolve17(join23(dir, name));
   if (!path3.startsWith(dir + sep5)) return c.json({ error: "bad reference" }, 400);
   let body;
   try {
@@ -13328,7 +13710,7 @@ app5.get("/store-stream", requireAdminSession, (c) => {
       console.log(`[wa-reader] op=store-quote msgId=${r.msgKeyId} quoted=${!!q2}`);
     }
     if (r.attachmentId) {
-      const meta = readAttachmentMeta(join22(uploadsBase, r.attachmentId));
+      const meta = readAttachmentMeta(join23(uploadsBase, r.attachmentId));
       if (meta) return { ...turn, attachments: [meta] };
     }
     return turn;
@@ -13709,7 +14091,7 @@ var whatsapp_reader_default = app5;
 
 // server/routes/public-reader.ts
 import { statSync as statSync9, openSync as openSync2, readSync as readSync2, closeSync as closeSync2, watch as watch3, readFileSync as readFileSync22, readdirSync as readdirSync15 } from "fs";
-import { basename as basename7, dirname as dirname8, join as join23, resolve as resolve18, sep as sep6 } from "path";
+import { basename as basename7, dirname as dirname8, join as join24, resolve as resolve18, sep as sep6 } from "path";
 
 // app/lib/whatsapp-reader/delivered-kinds.ts
 var PUBLIC_DELIVERED_KINDS = /* @__PURE__ */ new Set([
@@ -13783,10 +14165,10 @@ function enumeratePublicRows() {
   const cfg = claudeConfigDir();
   if (!cfg) return [];
   const rows = [];
-  for (const { path: path3 } of enumerateJsonls(join23(cfg, "projects"))) {
+  for (const { path: path3 } of enumerateJsonls(join24(cfg, "projects"))) {
     const sessionId = basename7(path3).replace(/\.jsonl$/, "");
     const projectDir = dirname8(path3);
-    const meta = readSidecarMeta(join23(projectDir, `${sessionId}.meta.json`));
+    const meta = readSidecarMeta(join24(projectDir, `${sessionId}.meta.json`));
     rows.push({
       sessionId,
       projectDir,
@@ -13862,15 +14244,15 @@ app6.get("/stream", (c) => {
   const sessionId = c.req.query("sessionId") ?? "";
   const projectDir = c.req.query("projectDir") ?? "";
   const cfg = claudeConfigDir();
-  const projectsRoot = cfg ? resolve18(join23(cfg, "projects")) : null;
+  const projectsRoot = cfg ? resolve18(join24(cfg, "projects")) : null;
   if (!cfg || !projectsRoot || !SESSION_ID_RE2.test(sessionId)) {
     return c.json({ error: "bad session reference" }, 400);
   }
-  const jsonlPath = resolve18(join23(projectDir, `${sessionId}.jsonl`));
+  const jsonlPath = resolve18(join24(projectDir, `${sessionId}.jsonl`));
   if (!jsonlPath.startsWith(projectsRoot + sep6)) {
     return c.json({ error: "bad session reference" }, 400);
   }
-  const meta = readSidecarMeta(join23(projectDir, `${sessionId}.meta.json`));
+  const meta = readSidecarMeta(join24(projectDir, `${sessionId}.meta.json`));
   const isPublicWebchat = meta.role === "public" && meta.channel === "webchat";
   const owns = visitor.kind === "person" ? meta.personId === visitor.personId : meta.personId === null && meta.visitorId === visitor.visitorId;
   if (!(isPublicWebchat && owns)) {
@@ -14007,16 +14389,16 @@ var public_reader_default = app6;
 
 // server/routes/webchat.ts
 import { basename as basename8, dirname as dirname9 } from "path";
-import { join as join26 } from "path";
+import { join as join27 } from "path";
 import { existsSync as existsSync19, readdirSync as readdirSync17, readFileSync as readFileSync25, renameSync as renameSync4, statSync as statSync10, writeFileSync as writeFileSync9 } from "fs";
 
 // server/canonical-webchat-override.ts
 import { readFileSync as readFileSync23, writeFileSync as writeFileSync7, renameSync as renameSync2 } from "fs";
-import { join as join24 } from "path";
+import { join as join25 } from "path";
 var FILE = "canonical-webchat-session.json";
 var UUID2 = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
 function canonicalOverridePath(accountDir) {
-  return join24(accountDir, FILE);
+  return join25(accountDir, FILE);
 }
 function readRaw(accountDir) {
   try {
@@ -14121,7 +14503,7 @@ function isNewSessionEffortLevel(value) {
 
 // ../services/claude-session-manager/src/sidecar-store.ts
 import { existsSync as existsSync18, mkdirSync as mkdirSync4, readdirSync as readdirSync16, readFileSync as readFileSync24, renameSync as renameSync3, unlinkSync as unlinkSync2, writeFileSync as writeFileSync8 } from "fs";
-import { join as join25 } from "path";
+import { join as join26 } from "path";
 function escapeRegExp(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -14129,7 +14511,7 @@ function createSidecarStore(config) {
   const { suffix, validate: validate2 } = config;
   const suffixRe = new RegExp(`${escapeRegExp(suffix)}$`);
   function pathFor(sessionsDir, id) {
-    return join25(sessionsDir, `${id}${suffix}`);
+    return join26(sessionsDir, `${id}${suffix}`);
   }
   function write(sessionsDir, id, record) {
     mkdirSync4(sessionsDir, { recursive: true });
@@ -14173,7 +14555,7 @@ function createSidecarStore(config) {
     const out = [];
     for (const name of names) {
       if (!suffixRe.test(name)) continue;
-      const path3 = join25(sessionsDir, name);
+      const path3 = join26(sessionsDir, name);
       let raw;
       try {
         raw = readFileSync24(path3, "utf8");
@@ -14250,13 +14632,13 @@ var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9
 function locateSession(sessionId) {
   const dir = findSessionProjectDir(sessionId);
   if (!dir) return { projectDir: null, channel: null, accountId: null };
-  const meta = readSidecarMeta(join26(dir, `${sessionId}.meta.json`));
+  const meta = readSidecarMeta(join27(dir, `${sessionId}.meta.json`));
   return { projectDir: dir, channel: meta.channel, accountId: meta.accountId };
 }
 function locateSidecar(sessionId) {
   const cfg = claudeConfigDir();
   if (!cfg) return null;
-  const projectsRoot = join26(cfg, "projects");
+  const projectsRoot = join27(cfg, "projects");
   let slugs;
   try {
     slugs = readdirSync17(projectsRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
@@ -14264,7 +14646,7 @@ function locateSidecar(sessionId) {
     return null;
   }
   for (const slug of slugs) {
-    const metaPath = join26(projectsRoot, slug, `${sessionId}.meta.json`);
+    const metaPath = join27(projectsRoot, slug, `${sessionId}.meta.json`);
     if (existsSync19(metaPath)) return readSidecarMeta(metaPath);
   }
   return null;
@@ -14274,7 +14656,7 @@ function readTargetOwner(sessionId) {
   if (sidecar !== null) return { found: true, owner: sidecar.adminUserId };
   const { projectDir } = locateSession(sessionId);
   if (projectDir !== null) {
-    return { found: true, owner: readSidecarMeta(join26(projectDir, `${sessionId}.meta.json`)).adminUserId };
+    return { found: true, owner: readSidecarMeta(join27(projectDir, `${sessionId}.meta.json`)).adminUserId };
   }
   return { found: false, owner: null };
 }
@@ -14282,7 +14664,7 @@ function readSourceRowMeta(sessionId) {
   const sidecar = locateSidecar(sessionId);
   if (sidecar !== null) return sidecar;
   const { projectDir } = locateSession(sessionId);
-  if (projectDir !== null) return readSidecarMeta(join26(projectDir, `${sessionId}.meta.json`));
+  if (projectDir !== null) return readSidecarMeta(join27(projectDir, `${sessionId}.meta.json`));
   return null;
 }
 function ownedByRequester(owner, requesterUserId, primaryUserId) {
@@ -14295,7 +14677,7 @@ function sessionSidecarExists(sessionId) {
 function jsonlSizeBytes(projectDir, sessionId) {
   if (projectDir === null) return null;
   try {
-    return statSync10(join26(projectDir, `${sessionId}.jsonl`)).size;
+    return statSync10(join27(projectDir, `${sessionId}.jsonl`)).size;
   } catch {
     return null;
   }
@@ -14423,10 +14805,10 @@ function latestAdminWebchatSessionId(requesterUserId, primaryUserId, scopeAccoun
   const cfg = claudeConfigDir();
   if (!cfg) return null;
   let best = null;
-  for (const { path: path3, isSubagent, archived } of enumerateJsonls(join26(cfg, "projects"))) {
+  for (const { path: path3, isSubagent, archived } of enumerateJsonls(join27(cfg, "projects"))) {
     if (isSubagent || archived) continue;
     const id = basename8(path3).slice(0, -".jsonl".length);
-    const meta = readSidecarMeta(join26(dirname9(path3), `${id}.meta.json`));
+    const meta = readSidecarMeta(join27(dirname9(path3), `${id}.meta.json`));
     if (meta.role !== "admin" || meta.channel !== "webchat") continue;
     if (multiAccount && meta.accountId !== scopeAccountId) continue;
     let mtimeMs;
@@ -14730,7 +15112,7 @@ ${note}` : note;
       console.error(`[webchat:settings] op=${op} outcome=refused value=${value} accountId=none reason=no-account-for-session`);
       return c.json({ error: "account unresolved" }, 503);
     }
-    const accountJsonPath = join26(account.accountDir, "account.json");
+    const accountJsonPath = join27(account.accountDir, "account.json");
     try {
       const parsed = JSON.parse(readFileSync25(accountJsonPath, "utf8"));
       if (op === "model") parsed.adminModel = value;
@@ -14778,7 +15160,7 @@ ${note}` : note;
         const cfg2 = claudeConfigDir();
         if (cfg2) {
           const source2 = resolveBridgeSource(
-            join26(cfg2, "sessions"),
+            join27(cfg2, "sessions"),
             target,
             (id) => locateSession(id).projectDir !== null
           );
@@ -14805,7 +15187,7 @@ ${note}` : note;
     const cfg = claudeConfigDir();
     let projectDir = null;
     if (cfg) {
-      for (const { path: path3 } of enumerateJsonls(join26(cfg, "projects"))) {
+      for (const { path: path3 } of enumerateJsonls(join27(cfg, "projects"))) {
         if (basename8(path3) === `${sessionId}.jsonl`) {
           projectDir = dirname9(path3);
           break;
@@ -14813,7 +15195,7 @@ ${note}` : note;
       }
     }
     if (source === "latest" && requesterUserId !== null) {
-      const owner = readSidecarMeta(join26(projectDir ?? "", `${sessionId}.meta.json`)).adminUserId;
+      const owner = readSidecarMeta(join27(projectDir ?? "", `${sessionId}.meta.json`)).adminUserId;
       if (owner !== null && owner !== requesterUserId && requesterUserId !== primaryUserId) {
         console.error(`[webchat:inbound] op=session-resolve-foreign key=${sessionId.slice(0, 8)} owner=${owner.slice(0, 8)} requester=${requesterUserId.slice(0, 8)}`);
       }
@@ -14846,7 +15228,7 @@ import { resolve as resolve19 } from "path";
 
 // app/lib/claude-agent/specialist-roster.ts
 import { existsSync as existsSync20, readFileSync as readFileSync26, readdirSync as readdirSync18 } from "fs";
-import { join as join27 } from "path";
+import { join as join28 } from "path";
 function field(fm, name) {
   const m = fm.match(new RegExp(`^${name}:\\s*(.*?)\\r?$`, "m"));
   if (!m) return null;
@@ -14865,7 +15247,7 @@ function readSpecialistRoster(specialistsDir) {
     if (!file.endsWith(".md")) continue;
     let raw;
     try {
-      raw = readFileSync26(join27(specialistsDir, file), "utf-8");
+      raw = readFileSync26(join28(specialistsDir, file), "utf-8");
     } catch (err) {
       skipped.push({ file, reason: err instanceof Error ? err.message : String(err) });
       continue;
@@ -14982,7 +15364,7 @@ var webchat_greeting_default = app7;
 
 // server/routes/telegram.ts
 import { homedir as homedir2 } from "os";
-import { resolve as resolve20, join as join28 } from "path";
+import { resolve as resolve20, join as join29 } from "path";
 import { existsSync as existsSync21, readFileSync as readFileSync27 } from "fs";
 
 // app/lib/telegram/gateway/instance.ts
@@ -15042,7 +15424,7 @@ function routeTelegramUpdate(input) {
 var TAG30 = "[telegram-inbound]";
 function configDirName() {
   const platformRoot5 = process.env.MAXY_PLATFORM_ROOT ?? resolve20(process.cwd(), "..");
-  const brandPath = join28(platformRoot5, "config", "brand.json");
+  const brandPath = join29(platformRoot5, "config", "brand.json");
   if (existsSync21(brandPath)) {
     try {
       return JSON.parse(readFileSync27(brandPath, "utf-8")).configDir ?? ".maxy";
@@ -15131,16 +15513,16 @@ app8.post("/", async (c) => {
 var telegram_default = app8;
 
 // server/routes/quickbooks.ts
-import { join as join29 } from "path";
+import { join as join30 } from "path";
 import { existsSync as existsSync22, readFileSync as readFileSync28, writeFileSync as writeFileSync10, mkdirSync as mkdirSync5, rmSync, renameSync as renameSync5 } from "fs";
 var TAG31 = "[quickbooks]";
 var INTUIT_TOKEN_URL = "https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer";
 var STATE_RE = /^[A-Za-z0-9_-]+$/;
 function pendingPath(accountDir, state) {
-  return join29(accountDir, "secrets", "quickbooks-pending", `${state}.json`);
+  return join30(accountDir, "secrets", "quickbooks-pending", `${state}.json`);
 }
 function storePath(accountDir) {
-  return join29(accountDir, "secrets", "quickbooks.json");
+  return join30(accountDir, "secrets", "quickbooks.json");
 }
 async function completeConsent(args) {
   const { accountDir, code, realmId } = args;
@@ -15207,7 +15589,7 @@ async function completeConsent(args) {
       refreshTokenExpiry: now + (body.x_refresh_token_expires_in ?? 864e4) * 1e3,
       lastRefresh: now
     };
-    mkdirSync5(join29(accountDir, "secrets"), { recursive: true });
+    mkdirSync5(join30(accountDir, "secrets"), { recursive: true });
     writeFileSync10(storePath(accountDir), JSON.stringify(store2, null, 2), { mode: 384 });
     const persisted = JSON.parse(readFileSync28(storePath(accountDir), "utf-8")).connections?.[realmId]?.refreshToken === body.refresh_token;
     console.error(`${TAG31} op=token-exchange realmId=${realmId} persisted=${persisted}`);
@@ -15249,7 +15631,7 @@ function claudeBin() {
 }
 
 // server/routes/onboarding.ts
-import { dirname as dirname11, join as join31 } from "path";
+import { dirname as dirname11, join as join32 } from "path";
 
 // app/lib/claude-keychain.ts
 import { execFileSync as execFileSync3 } from "child_process";
@@ -15379,7 +15761,7 @@ function readHostCredsBlob(service) {
 
 // ../lib/admins-write/src/index.ts
 import { existsSync as existsSync23, readFileSync as readFileSync29, writeFileSync as writeFileSync11, renameSync as renameSync6, mkdirSync as mkdirSync6, readdirSync as readdirSync19, statSync as statSync11, appendFileSync as appendFileSync3 } from "fs";
-import { dirname as dirname10, join as join30 } from "path";
+import { dirname as dirname10, join as join31 } from "path";
 function id8(value) {
   return value.slice(0, 8);
 }
@@ -15452,7 +15834,7 @@ function writeAdminEntry(input) {
     return result;
   }
   try {
-    const accountJsonPath = join30(input.accountDir, "account.json");
+    const accountJsonPath = join31(input.accountDir, "account.json");
     if (!existsSync23(accountJsonPath)) {
       throw new Error(`account.json not found at ${accountJsonPath}`);
     }
@@ -15500,13 +15882,13 @@ function computeAdminStoreDivergence(input) {
     }
     for (const entry of entries2) {
       if (entry.startsWith(".")) continue;
-      const accountDir = join30(input.accountsDir, entry);
+      const accountDir = join31(input.accountsDir, entry);
       try {
         if (!statSync11(accountDir).isDirectory()) continue;
       } catch {
         continue;
       }
-      const accountJsonPath = join30(accountDir, "account.json");
+      const accountJsonPath = join31(accountDir, "account.json");
       if (!existsSync23(accountJsonPath)) continue;
       let admins = [];
       try {
@@ -15684,7 +16066,7 @@ app10.post("/claude-auth", async (c) => {
       });
       persistKeychainService(
         writebackResult,
-        (service) => writeFileSync12(join31(dirname11(CLAUDE_CREDENTIALS_FILE), ".keychain-service"), service, { mode: 384 }),
+        (service) => writeFileSync12(join32(dirname11(CLAUDE_CREDENTIALS_FILE), ".keychain-service"), service, { mode: 384 }),
         (line) => console.log(line)
       );
       if (darwinAuthChild === claudeProc2) darwinAuthChild = null;
@@ -15950,8 +16332,8 @@ var onboarding_default = app10;
 
 // server/routes/client-error.ts
 import { appendFileSync as appendFileSync4, existsSync as existsSync25, renameSync as renameSync8, statSync as statSync12 } from "fs";
-import { join as join32 } from "path";
-var CLIENT_ERRORS_LOG = join32(LOG_DIR, "client-errors.log");
+import { join as join33 } from "path";
+var CLIENT_ERRORS_LOG = join33(LOG_DIR, "client-errors.log");
 var MAX_LOG_SIZE = 10 * 1024 * 1024;
 var MAX_BODY_SIZE = 8 * 1024;
 var MAX_STACK_LEN = 2e3;
@@ -16340,12 +16722,12 @@ import { resolve as resolve21, basename as basename9 } from "path";
 
 // app/lib/logs-read-resolve.ts
 import { existsSync as existsSync26 } from "fs";
-import { join as join33 } from "path";
+import { join as join34 } from "path";
 function resolveSessionLogPaths(filename, logDirs) {
   const tried = [filename];
   const hits = [];
   for (const dir of logDirs) {
-    const fullPath = join33(dir, filename);
+    const fullPath = join34(dir, filename);
     if (existsSync26(fullPath)) {
       hits.push({ path: fullPath, dir });
     }
@@ -16527,7 +16909,7 @@ app15.get("/", requireAdminSession, (c) => {
 var claude_info_default = app15;
 
 // server/routes/admin/attachment.ts
-import { readFile as readFile5, readdir as readdir2 } from "fs/promises";
+import { readFile as readFile6, readdir as readdir2 } from "fs/promises";
 import { existsSync as existsSync28 } from "fs";
 import { resolve as resolve22 } from "path";
 var app16 = new Hono();
@@ -16538,15 +16920,15 @@ function uploadsDirFor2(accountId, attachmentId) {
 app16.get("/:attachmentId", requireAdminSession, async (c) => {
   const attachmentId = c.req.param("attachmentId");
   const cacheKey = c.var.cacheKey;
-  const shortId2 = attachmentId.slice(0, 8);
+  const shortId3 = attachmentId.slice(0, 8);
   const shortSession = (c.req.query("session_key") ?? "").slice(0, 8);
   const pinnedAccountId = getAccountIdForSession(cacheKey);
   if (!pinnedAccountId) {
-    console.log(`[admin-attachment] op=miss attachmentId=${shortId2} session=${shortSession} status=401 reason=no-account`);
+    console.log(`[admin-attachment] op=miss attachmentId=${shortId3} session=${shortSession} status=401 reason=no-account`);
     return new Response("Unauthorized", { status: 401 });
   }
   if (!ATTACHMENT_ID_RE3.test(attachmentId)) {
-    console.log(`[admin-attachment] op=miss attachmentId=${shortId2} session=${shortSession} status=404 reason=bad-id`);
+    console.log(`[admin-attachment] op=miss attachmentId=${shortId3} session=${shortSession} status=404 reason=bad-id`);
     return new Response("Not found", { status: 404 });
   }
   let accountId = pinnedAccountId;
@@ -16566,7 +16948,7 @@ app16.get("/:attachmentId", requireAdminSession, async (c) => {
   }
   const shortPinned = pinnedAccountId.slice(0, 8);
   const crossAccountNote = found && accountId !== pinnedAccountId ? ` resolvedAccount=${accountId.slice(0, 8)}` : "";
-  console.log(`[admin-attachment] op=lookup attachmentId=${shortId2} session=${shortSession} pinnedAccount=${shortPinned} found=${found}${crossAccountNote}`);
+  console.log(`[admin-attachment] op=lookup attachmentId=${shortId3} session=${shortSession} pinnedAccount=${shortPinned} found=${found}${crossAccountNote}`);
   if (!found) {
     return new Response("Not found", { status: 404 });
   }
@@ -16576,7 +16958,7 @@ app16.get("/:attachmentId", requireAdminSession, async (c) => {
   }
   let meta;
   try {
-    meta = JSON.parse(await readFile5(metaPath, "utf-8"));
+    meta = JSON.parse(await readFile6(metaPath, "utf-8"));
   } catch {
     return new Response("Not found", { status: 404 });
   }
@@ -16586,11 +16968,11 @@ app16.get("/:attachmentId", requireAdminSession, async (c) => {
     return new Response("Not found", { status: 404 });
   }
   const filePath = resolve22(dir, dataFile);
-  const buffer = await readFile5(filePath);
+  const buffer = await readFile6(filePath);
   const inlineSafe = isInlineSafeMime(meta.mimeType);
   const safeName = meta.filename.replace(/["\\\r\n]/g, "_");
   if (!inlineSafe) {
-    console.log(`[admin-attachment] op=served attachmentId=${shortId2} disposition=attachment reason=non-preview-mime mime=${meta.mimeType}`);
+    console.log(`[admin-attachment] op=served attachmentId=${shortId3} disposition=attachment reason=non-preview-mime mime=${meta.mimeType}`);
   }
   return new Response(new Uint8Array(buffer), {
     headers: {
@@ -16604,7 +16986,7 @@ app16.get("/:attachmentId", requireAdminSession, async (c) => {
 var attachment_default = app16;
 
 // server/routes/admin/session-upload.ts
-import { readFile as readFile6 } from "fs/promises";
+import { readFile as readFile7 } from "fs/promises";
 import { existsSync as existsSync29, statSync as statSync14 } from "fs";
 var app17 = new Hono();
 app17.get("/", requireAdminSession, async (c) => {
@@ -16634,7 +17016,7 @@ app17.get("/", requireAdminSession, async (c) => {
   const inlineSafe = isInlineSafeMime(mimeType);
   const safeName = file.replace(/["\\\r\n]/g, "_");
   console.log(`[session-upload] op=served session=${short2} file=${file} disposition=${inlineSafe ? "inline" : "attachment"} mime=${mimeType}`);
-  const buffer = await readFile6(resolution.absolute);
+  const buffer = await readFile7(resolution.absolute);
   return new Response(new Uint8Array(buffer), {
     headers: {
       "Content-Type": mimeType,
@@ -16653,7 +17035,7 @@ import { readdirSync as readdirSync22, readFileSync as readFileSync33, existsSyn
 // ../services/claude-session-manager/src/tool-surface.ts
 import { readFileSync as readFileSync32, readdirSync as readdirSync21, statSync as statSync15, existsSync as existsSync30 } from "fs";
 import { createHash as createHash5 } from "crypto";
-import { join as join34 } from "path";
+import { join as join35 } from "path";
 
 // ../services/claude-session-manager/src/canonical-tool-names.ts
 function canonicalToolName(plugin, tool) {
@@ -16906,13 +17288,13 @@ function loadToolSurface(pluginsRoots) {
   const riskByTool = /* @__PURE__ */ new Map();
   const manifestPaths = /* @__PURE__ */ new Map();
   const loadOne = (pluginsRoot, plugin) => {
-    const pluginDir = join34(pluginsRoot, plugin);
+    const pluginDir = join35(pluginsRoot, plugin);
     try {
       if (!statSync15(pluginDir).isDirectory()) return;
     } catch {
       return;
     }
-    const manifestPath = join34(pluginDir, "PLUGIN.md");
+    const manifestPath = join35(pluginDir, "PLUGIN.md");
     if (!existsSync30(manifestPath)) return;
     const raw = readFileSync32(manifestPath, "utf-8");
     const frontmatter = extractFrontmatter(raw, plugin);
@@ -16958,9 +17340,9 @@ function loadToolSurface(pluginsRoots) {
   for (const root of roots) {
     const entries2 = readdirSync21(root).sort();
     for (const plugin of entries2) {
-      const pluginDir = join34(root, plugin);
+      const pluginDir = join35(root, plugin);
       loadOne(root, plugin);
-      const subRoot = join34(pluginDir, "plugins");
+      const subRoot = join35(pluginDir, "plugins");
       let subEntries;
       try {
         if (!statSync15(subRoot).isDirectory()) continue;
@@ -18228,7 +18610,7 @@ var sessions_default = app19;
 
 // app/lib/claude-agent/spawn-context.ts
 import { existsSync as existsSync33, readFileSync as readFileSync34, readdirSync as readdirSync23, statSync as statSync16 } from "fs";
-import { dirname as dirname12, resolve as resolve24, join as join35 } from "path";
+import { dirname as dirname12, resolve as resolve24, join as join36 } from "path";
 async function resolveOwnerProfileBlock(accountId, userId) {
   if (!userId) return { ok: false, reason: "missing-user-id" };
   try {
@@ -18269,8 +18651,8 @@ function frontmatterField(manifest, field2) {
 function extractPluginToolDescriptions(pluginDir) {
   const out = /* @__PURE__ */ new Map();
   const candidates = [
-    join35(pluginDir, "mcp/dist/index.js"),
-    join35(pluginDir, "mcp/src/index.ts")
+    join36(pluginDir, "mcp/dist/index.js"),
+    join36(pluginDir, "mcp/src/index.ts")
   ];
   let raw = null;
   for (const path3 of candidates) {
@@ -18328,7 +18710,7 @@ function listPluginDirs(accountPluginsDir) {
   const platformPlugins = resolve24(PLATFORM_ROOT, "plugins");
   if (existsSync33(platformPlugins)) {
     for (const name of readdirSync23(platformPlugins)) {
-      const dir = join35(platformPlugins, name);
+      const dir = join36(platformPlugins, name);
       try {
         if (statSync16(dir).isDirectory()) out.set(name, dir);
       } catch {
@@ -18338,11 +18720,11 @@ function listPluginDirs(accountPluginsDir) {
   const premiumRoot = resolve24(dirname12(PLATFORM_ROOT), "premium-plugins");
   if (existsSync33(premiumRoot)) {
     for (const bundle of readdirSync23(premiumRoot)) {
-      const bundlePlugins = join35(premiumRoot, bundle, "plugins");
+      const bundlePlugins = join36(premiumRoot, bundle, "plugins");
       if (!existsSync33(bundlePlugins)) continue;
       try {
         for (const name of readdirSync23(bundlePlugins)) {
-          const dir = join35(bundlePlugins, name);
+          const dir = join36(bundlePlugins, name);
           try {
             if (statSync16(dir).isDirectory()) out.set(name, dir);
           } catch {
@@ -18356,7 +18738,7 @@ function listPluginDirs(accountPluginsDir) {
     try {
       for (const name of readdirSync23(accountPluginsDir)) {
         if (out.has(name)) continue;
-        const dir = join35(accountPluginsDir, name);
+        const dir = join36(accountPluginsDir, name);
         try {
           if (statSync16(dir).isDirectory()) out.set(name, dir);
         } catch {
@@ -18375,7 +18757,7 @@ function listAccountPluginNames(accountPluginsDir) {
   try {
     return readdirSync23(accountPluginsDir).filter((name) => {
       try {
-        return statSync16(join35(accountPluginsDir, name)).isDirectory();
+        return statSync16(join36(accountPluginsDir, name)).isDirectory();
       } catch {
         return false;
       }
@@ -18418,7 +18800,7 @@ function computeActivePlugins(accountId) {
   for (const name of emitNames) {
     const dir = pluginDirs.get(name);
     if (!dir) continue;
-    const fm = readFrontmatter(join35(dir, "PLUGIN.md"));
+    const fm = readFrontmatter(join36(dir, "PLUGIN.md"));
     if (!fm) continue;
     const description = frontmatterField(`---
 ${fm}
@@ -18435,7 +18817,7 @@ ${fm}
       `plugin-manifest-tool-coverage plugin=${name} tools=${tools.length} with-desc=${withDesc}`
     );
     if (toolNames.length > 0 && descMap.size === 0) {
-      const hasSource = existsSync33(join35(dir, "mcp/dist/index.js")) || existsSync33(join35(dir, "mcp/src/index.ts"));
+      const hasSource = existsSync33(join36(dir, "mcp/dist/index.js")) || existsSync33(join36(dir, "mcp/src/index.ts"));
       if (hasSource) {
         console.warn(
           `[spawn-context] WARN plugin=${name} mcp source present but tool-description regex matched zero entries \u2014 SDK upgrade may have changed the registration shape`
@@ -18445,7 +18827,7 @@ ${fm}
     const skillPaths = parseSkillPathsFromFrontmatter(fm);
     const skills = [];
     for (const relPath of skillPaths) {
-      const skillPath = join35(dir, relPath);
+      const skillPath = join36(dir, relPath);
       const skillFm = readFrontmatter(skillPath);
       if (!skillFm) continue;
       const skillName = frontmatterField(`---
@@ -18489,7 +18871,7 @@ function computeSpecialistDomains(accountId) {
   const out = [];
   for (const file of entries2.sort()) {
     if (!file.endsWith(".md")) continue;
-    const fm = readFrontmatter(join35(specialistsDir, file));
+    const fm = readFrontmatter(join36(specialistsDir, file));
     if (!fm) continue;
     const wrapped = `---
 ${fm}
@@ -18885,10 +19267,10 @@ var events_default = app22;
 
 // server/routes/admin/files.ts
 import { createReadStream as createReadStream2, createWriteStream as createWriteStream2, existsSync as existsSync35 } from "fs";
-import { readdir as readdir4, readFile as readFile8, stat as stat7, mkdir as mkdir4, unlink as unlink3, rename as rename2, rmdir } from "fs/promises";
+import { readdir as readdir4, readFile as readFile9, stat as stat7, mkdir as mkdir4, unlink as unlink4, rename as rename3, rmdir } from "fs/promises";
 import { realpathSync as realpathSync7 } from "fs";
 import { randomUUID as randomUUID10 } from "crypto";
-import { basename as basename11, dirname as dirname13, join as join37, relative as relative5, resolve as resolve27, sep as sep8 } from "path";
+import { basename as basename11, dirname as dirname13, join as join38, relative as relative5, resolve as resolve27, sep as sep8 } from "path";
 import { Readable as Readable2 } from "stream";
 
 // ../lib/graph-trash/src/index.ts
@@ -19125,7 +19507,7 @@ async function restoreNode(params) {
 }
 
 // app/lib/file-delete-cascade.ts
-var UUID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function parseAttachmentPath(relPath) {
   const segments = relPath.split("/").filter(Boolean);
   if (segments.length !== 5) return null;
@@ -19133,7 +19515,7 @@ function parseAttachmentPath(relPath) {
   const accountId = segments[1];
   const attachmentId = segments[3];
   const filename = segments[4];
-  if (!UUID_RE3.test(accountId) || !UUID_RE3.test(attachmentId)) return null;
+  if (!UUID_RE4.test(accountId) || !UUID_RE4.test(attachmentId)) return null;
   const dot = filename.lastIndexOf(".");
   if (dot === -1) return null;
   const stem = filename.slice(0, dot);
@@ -19206,7 +19588,7 @@ async function cascadeDeleteDocument(params) {
 
 // app/lib/file-index.ts
 import * as fsp from "fs/promises";
-import { resolve as resolve26, relative as relative4, join as join36, basename as basename10, extname as extname2, sep as sep7 } from "path";
+import { resolve as resolve26, relative as relative4, join as join37, basename as basename10, extname as extname2, sep as sep7 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
@@ -19288,7 +19670,7 @@ async function extractPdf(absolute) {
   return stdout.trim();
 }
 async function ocrPdf(absolute) {
-  const outPdf = join36(tmpdir2(), `file-index-ocr-${process.pid}-${Date.now()}.pdf`);
+  const outPdf = join37(tmpdir2(), `file-index-ocr-${process.pid}-${Date.now()}.pdf`);
   try {
     await execFileAsync2(
       "ocrmypdf",
@@ -19350,7 +19732,7 @@ async function readDisplayName(absolute) {
   const stem = dot === -1 ? base : base.slice(0, dot);
   if (base === `${stem}.meta.json`) return null;
   try {
-    const raw = await fsp.readFile(join36(dir, `${stem}.meta.json`), "utf-8");
+    const raw = await fsp.readFile(join37(dir, `${stem}.meta.json`), "utf-8");
     const meta = JSON.parse(raw);
     const dn = meta.displayName ?? meta.filename;
     return typeof dn === "string" && dn.length > 0 ? dn : null;
@@ -19371,7 +19753,7 @@ async function walkSubtree(root, dataRoot, out) {
   for (const entry of entries2) {
     if (entry.isSymbolicLink()) continue;
     if (entry.isDirectory() && entry.name === ".uploads-tmp") continue;
-    const abs = join36(root, entry.name);
+    const abs = join37(root, entry.name);
     if (entry.isDirectory()) {
       const sub = await walkSubtree(abs, dataRoot, out);
       if (!sub.clean) clean = false;
@@ -19741,10 +20123,10 @@ function classifyAccountRoot(schemaMd, rootEntries) {
 
 // server/routes/admin/files.ts
 var UPLOAD_TMP_DIR = ".uploads-tmp";
-var UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var UUID_RE5 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function readMeta(absDir, baseName) {
   try {
-    const raw = await readFile8(join37(absDir, `${baseName}.meta.json`), "utf8");
+    const raw = await readFile9(join38(absDir, `${baseName}.meta.json`), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed?.filename === "string") {
       return { filename: parsed.filename, mimeType: typeof parsed.mimeType === "string" ? parsed.mimeType : void 0 };
@@ -19763,10 +20145,10 @@ async function readAccountNames() {
     return map;
   }
   for (const name of names) {
-    if (!UUID_RE4.test(name)) continue;
+    if (!UUID_RE5.test(name)) continue;
     const configPath2 = resolve27(accountsDir, name, "account.json");
     try {
-      const raw = await readFile8(configPath2, "utf8");
+      const raw = await readFile9(configPath2, "utf8");
       const parsed = JSON.parse(raw);
       if (typeof parsed?.name === "string" && parsed.name.length > 0) {
         map.set(name, parsed.name);
@@ -19798,8 +20180,8 @@ async function servableFilesIn(dirAbs, uuid) {
   return out;
 }
 async function enrich(absolute, entry, accountNames) {
-  if (entry.kind === "directory" && UUID_RE4.test(entry.name)) {
-    const dirAbs = join37(absolute, entry.name);
+  if (entry.kind === "directory" && UUID_RE5.test(entry.name)) {
+    const dirAbs = join38(absolute, entry.name);
     const meta = await readMeta(dirAbs, entry.name);
     if (meta?.filename) {
       const servable = await servableFilesIn(dirAbs, entry.name);
@@ -19808,7 +20190,7 @@ async function enrich(absolute, entry, accountNames) {
         let size = null;
         let modifiedAt = entry.modifiedAt;
         try {
-          const st = await stat7(join37(dirAbs, innerName));
+          const st = await stat7(join38(dirAbs, innerName));
           size = st.size;
           modifiedAt = st.mtime.toISOString();
         } catch {
@@ -19833,7 +20215,7 @@ async function enrich(absolute, entry, accountNames) {
   if (entry.kind === "file") {
     const dot = entry.name.lastIndexOf(".");
     const base = dot === -1 ? entry.name : entry.name.slice(0, dot);
-    if (UUID_RE4.test(base)) {
+    if (UUID_RE5.test(base)) {
       const meta = await readMeta(absolute, base);
       if (meta?.filename) {
         entry.displayName = meta.filename;
@@ -19846,7 +20228,7 @@ async function enrich(absolute, entry, accountNames) {
 function buildDisplayPath(relPath, accountNames) {
   if (relPath === "." || relPath === "") return [];
   return relPath.split("/").filter(Boolean).map((seg) => {
-    const dn = UUID_RE4.test(seg) ? accountNames.get(seg) : void 0;
+    const dn = UUID_RE5.test(seg) ? accountNames.get(seg) : void 0;
     return dn ? { name: seg, displayName: dn } : { name: seg };
   });
 }
@@ -19858,13 +20240,13 @@ function parseGroupPath(raw, sessionAccountId) {
   }
   const segs = trimmed.split("/").filter(Boolean);
   if (segs.length !== 3) return null;
-  if (segs[0] !== "accounts" || !UUID_RE4.test(segs[1])) return null;
+  if (segs[0] !== "accounts" || !UUID_RE5.test(segs[1])) return null;
   if (segs[2] !== "@home" && segs[2] !== "@system") return null;
   return { view: segs[2].slice(1), accountRel: `accounts/${segs[1]}` };
 }
 function isAccountRoot(relPath) {
   const segs = relPath.split("/").filter(Boolean);
-  return segs.length === 2 && segs[0] === "accounts" && UUID_RE4.test(segs[1]);
+  return segs.length === 2 && segs[0] === "accounts" && UUID_RE5.test(segs[1]);
 }
 function sortDirEntries(entries2) {
   entries2.sort((a, b) => {
@@ -19912,11 +20294,11 @@ function isProtectedFromRename(relPath) {
   if (segments.length === 3 && segments[0] === "accounts" && segments[2] === "uploads") {
     return true;
   }
-  if (segments.length === 4 && segments[0] === "accounts" && segments[2] === "uploads" && UUID_RE4.test(segments[3])) {
+  if (segments.length === 4 && segments[0] === "accounts" && segments[2] === "uploads" && UUID_RE5.test(segments[3])) {
     return true;
   }
   if (parseAttachmentPath(relPath) !== null) return true;
-  if (UUID_RE4.test(base.replace(/\.meta\.json$/, "")) && base.endsWith(".meta.json")) {
+  if (UUID_RE5.test(base.replace(/\.meta\.json$/, "")) && base.endsWith(".meta.json")) {
     return true;
   }
   return false;
@@ -19992,16 +20374,16 @@ app23.get("/", requireAdminSession, async (c) => {
     const isAccountParent = segs.length === 1 && segs[0] === "accounts";
     const entries2 = [];
     for (const name of names) {
-      if (UUID_RE4.test(name.replace(/\.meta\.json$/, "")) && name.endsWith(".meta.json")) {
+      if (UUID_RE5.test(name.replace(/\.meta\.json$/, "")) && name.endsWith(".meta.json")) {
         continue;
       }
-      if (isAccountParent && UUID_RE4.test(name) && name !== accountId) {
+      if (isAccountParent && UUID_RE5.test(name) && name !== accountId) {
         continue;
       }
       const childRel = relPath === "" || relPath === "." ? name : `${relPath}/${name}`;
       const protectedEntry = isProtectedFromDeletion(childRel).protected;
       try {
-        const entryPath = join37(absolute, name);
+        const entryPath = join38(absolute, name);
         const s = await stat7(entryPath);
         entries2.push({
           name,
@@ -20030,7 +20412,7 @@ app23.get("/", requireAdminSession, async (c) => {
     const displayPath = buildDisplayPath(relPath, accountNames);
     if (groupReq || isAccountRoot(relPath)) {
       const acctId = relPath.split("/")[1] ?? accountId;
-      const schemaMd = await readFile8(join37(absolute, "SCHEMA.md"), "utf8").catch(() => null);
+      const schemaMd = await readFile9(join38(absolute, "SCHEMA.md"), "utf8").catch(() => null);
       const groups = classifyAccountRoot(schemaMd, entries2.map((e) => e.name));
       console.error(
         `[data-schema] op=classify account=${acctId} status=${groups.parsed ? "ok" : "parse-failed"} reason=${groups.reason} entries=${entries2.length} home=${groups.home.join(",") || "none"} system=${groups.system.length} unknown=${groups.unknown.join(",") || "none"}`
@@ -20068,7 +20450,7 @@ app23.get("/", requireAdminSession, async (c) => {
       for (const name of homeDirs) {
         const base = byName.get(name);
         try {
-          const dirents = await readdir4(join37(absolute, name), { withFileTypes: true });
+          const dirents = await readdir4(join38(absolute, name), { withFileTypes: true });
           const visible = dirents.filter((d) => !d.name.startsWith("."));
           visible.sort((a, b) => {
             const ad = a.isDirectory() ? 0 : 1;
@@ -20133,7 +20515,7 @@ app23.get("/download", requireAdminSession, async (c) => {
       console.error(`[data] op=scratchpad-no-session sessionId="${sessionId.slice(0, 8)}\u2026"`);
       return c.json({ error: "Not found" }, 404);
     }
-    const meta = readSidecarMeta(join37(projectDir, `${sessionId}.meta.json`));
+    const meta = readSidecarMeta(join38(projectDir, `${sessionId}.meta.json`));
     if (!meta.accountId || meta.accountId !== accountId) {
       console.error(`[data] account-scope-blocked root="scratchpad" sessionId="${sessionId.slice(0, 8)}\u2026" account=${accountId.slice(0, 8)}\u2026`);
       return c.json({ error: "Not found" }, 404);
@@ -20228,7 +20610,7 @@ async function* walkRegularFiles(dirAbsolute) {
   const dirents = await readdir4(dirAbsolute, { withFileTypes: true });
   for (const d of dirents) {
     if (d.isSymbolicLink()) continue;
-    const child = join37(dirAbsolute, d.name);
+    const child = join38(dirAbsolute, d.name);
     if (d.isDirectory()) {
       yield* walkRegularFiles(child);
       continue;
@@ -20257,7 +20639,7 @@ app23.get("/download-zip", requireAdminSession, async (c) => {
     if (entries2.length >= maxFiles) return c.json({ error: `Too many files (max ${maxFiles})` }, 413);
     total += size;
     if (total > maxTotalBytes) return c.json({ error: "Selection too large to zip" }, 413);
-    entries2.push({ name: member, data: await readFile8(absolute) });
+    entries2.push({ name: member, data: await readFile9(absolute) });
     return null;
   };
   for (const rawPath of rawPaths) {
@@ -20338,7 +20720,7 @@ async function resolveUploadTarget(c, accountId, uid) {
   const base = resolveOwnAccountWrite(rawDir, accountId, "POST /api/admin/files/upload");
   if (!base.ok) return { ok: false, status: base.status, error: base.error };
   const relDir = relpath ? dirname13(relpath) : ".";
-  const destRel = relDir === "." ? base.relative : join37(base.relative, relDir);
+  const destRel = relDir === "." ? base.relative : join38(base.relative, relDir);
   if (crossesForeignAccountPartition(destRel, accountId)) {
     console.error(`[data] account-scope-blocked endpoint="POST /api/admin/files/upload" path="${destRel}" account=${accountId.slice(0, 8)}\u2026`);
     return { ok: false, status: 404, error: "Not found" };
@@ -20410,7 +20792,7 @@ app23.post("/upload", requireAdminSession, async (c) => {
       out.once("close", () => res());
       out.destroy();
     });
-    await unlink3(tmpPath).catch(() => {
+    await unlink4(tmpPath).catch(() => {
     });
     const tempRemoved = !existsSync35(tmpPath);
     console.error(`[data-upload] op=cleanup uid=${uid} tempRemoved=${tempRemoved}`);
@@ -20456,7 +20838,7 @@ app23.post("/upload", requireAdminSession, async (c) => {
       out.once("error", rej);
       out.end(() => res());
     });
-    await rename2(tmpPath, destPath);
+    await rename3(tmpPath, destPath);
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     console.error(`[data-upload] op=error uid=${uid} err="${message}" token=${token} rel="${relpath ?? ""}"`);
@@ -20484,7 +20866,7 @@ async function discardChunkUpload(uploadId, state) {
     state.out.once("close", () => res());
     state.out.destroy();
   });
-  await unlink3(state.tmpPath).catch(() => {
+  await unlink4(state.tmpPath).catch(() => {
   });
   const tempRemoved = !existsSync35(state.tmpPath);
   console.error(`[data-upload] op=cleanup uid=${uploadId} tempRemoved=${tempRemoved}`);
@@ -20612,11 +20994,11 @@ async function acceptChunk(c, uploadId, state, seq, body, ceiling) {
         state.out.once("error", rej);
         state.out.end(() => res());
       });
-      await rename2(state.tmpPath, state.destPath);
+      await rename3(state.tmpPath, state.destPath);
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
       console.error(`[data-upload] op=error uid=${uploadId} err="${message}" token=${state.token} rel="${state.relpath ?? ""}"`);
-      await unlink3(state.tmpPath).catch(() => {
+      await unlink4(state.tmpPath).catch(() => {
       });
       return c.json({ error: message }, 500);
     }
@@ -20668,7 +21050,7 @@ async function sweepStaleUploadTemps() {
     }
     for (const name of entries2) {
       try {
-        await unlink3(resolve27(tmpDir, name));
+        await unlink4(resolve27(tmpDir, name));
         removed++;
       } catch {
       }
@@ -20715,17 +21097,17 @@ app23.delete("/", requireAdminSession, async (c) => {
     const dot = base.lastIndexOf(".");
     const stem = dot === -1 ? base : base.slice(0, dot);
     const containerDir = dirname13(absolute);
-    const sidecarPath = UUID_RE4.test(stem) && base !== `${stem}.meta.json` ? join37(containerDir, `${stem}.meta.json`) : null;
-    const isAttachmentContainer = UUID_RE4.test(stem) && basename11(containerDir) === stem;
-    await unlink3(absolute);
+    const sidecarPath = UUID_RE5.test(stem) && base !== `${stem}.meta.json` ? join38(containerDir, `${stem}.meta.json`) : null;
+    const isAttachmentContainer = UUID_RE5.test(stem) && basename11(containerDir) === stem;
+    await unlink4(absolute);
     if (sidecarPath) {
       try {
-        await unlink3(sidecarPath);
+        await unlink4(sidecarPath);
       } catch {
       }
     }
     if (isAttachmentContainer) {
-      await unlink3(join37(containerDir, `${stem}${EXTRACTED_TEXT_SUFFIX}`)).catch(() => {
+      await unlink4(join38(containerDir, `${stem}${EXTRACTED_TEXT_SUFFIX}`)).catch(() => {
       });
       await rmdir(containerDir).catch(() => {
       });
@@ -20832,7 +21214,7 @@ app23.post("/rename", requireAdminSession, async (c) => {
       if (e.code === "ENOENT") collision = false;
     }
     if (collision) return c.json({ error: "A file or folder with that name already exists" }, 409);
-    await rename2(src.absolute, destAbs);
+    await rename3(src.absolute, destAbs);
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") return c.json({ error: "Not found" }, 404);
@@ -21835,7 +22217,7 @@ function isHiddenByDefault(label) {
 // server/lib/top-level-labels.ts
 var import_dist5 = __toESM(require_dist4(), 1);
 import { readdirSync as readdirSync24, readFileSync as readFileSync36 } from "fs";
-import { join as join38, resolve as resolve28 } from "path";
+import { join as join39, resolve as resolve28 } from "path";
 var STATIC_TOP_LEVEL_LABELS = Object.freeze(
   /* @__PURE__ */ new Set([
     // Base-schema infra (schema-base.md has no top-level section).
@@ -21939,7 +22321,7 @@ function parseTopLevelLabels(content) {
 }
 function resolveReferencesDir() {
   if (process.env.MAXY_PLATFORM_ROOT) {
-    return join38(process.env.MAXY_PLATFORM_ROOT, "plugins", "memory", "references");
+    return join39(process.env.MAXY_PLATFORM_ROOT, "plugins", "memory", "references");
   }
   return resolve28(import.meta.dirname, "../../../plugins/memory/references");
 }
@@ -21949,7 +22331,7 @@ function parseTableTopLevelLabels(referencesDir) {
   try {
     const fileNames = readdirSync24(referencesDir).filter((f) => f.startsWith("schema-") && f.endsWith(".md")).sort();
     for (const fileName of fileNames) {
-      const content = readFileSync36(join38(referencesDir, fileName), "utf-8");
+      const content = readFileSync36(join39(referencesDir, fileName), "utf-8");
       const parsed = parseTopLevelLabels(content);
       if (parsed.length > 0) contributingFiles.push(fileName);
       for (const label of parsed) labels.add(label);
@@ -23288,11 +23670,11 @@ var sidebar_artefacts_default = app30;
 
 // server/channel-session-override.ts
 import { readFileSync as readFileSync37, writeFileSync as writeFileSync14, renameSync as renameSync10 } from "fs";
-import { join as join39 } from "path";
+import { join as join40 } from "path";
 var FILE2 = "channel-session-override.json";
 var UUID3 = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
 function channelOverridePath(accountDir) {
-  return join39(accountDir, FILE2);
+  return join40(accountDir, FILE2);
 }
 function senderKey(channel, senderId) {
   return `${channel}:${senderId}`;
@@ -23688,24 +24070,24 @@ var session_rc_spawn_default = app36;
 import { randomUUID as randomUUID12 } from "crypto";
 
 // server/wa-descriptor.ts
-import { resolve as resolve30, join as join40 } from "path";
+import { resolve as resolve30, join as join41 } from "path";
 function waGatewayUrl() {
   return `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`;
 }
 function waServerPath() {
-  return process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve30(process.env.MAXY_PLATFORM_ROOT ?? join40(__dirname, ".."), "services/whatsapp-channel/dist/server.js");
+  return process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve30(process.env.MAXY_PLATFORM_ROOT ?? join41(__dirname, ".."), "services/whatsapp-channel/dist/server.js");
 }
 function waChannelDescriptor(senderId) {
   return { senderId, gatewayUrl: waGatewayUrl(), serverPath: waServerPath() };
 }
 
 // server/telegram-descriptor.ts
-import { resolve as resolve31, join as join41 } from "path";
+import { resolve as resolve31, join as join42 } from "path";
 function telegramGatewayUrl() {
   return `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`;
 }
 function telegramServerPath() {
-  return process.env.MAXY_TELEGRAM_CHANNEL_SERVER_PATH ?? resolve31(process.env.MAXY_PLATFORM_ROOT ?? join41(__dirname, ".."), "services/telegram-channel/dist/server.js");
+  return process.env.MAXY_TELEGRAM_CHANNEL_SERVER_PATH ?? resolve31(process.env.MAXY_PLATFORM_ROOT ?? join42(__dirname, ".."), "services/telegram-channel/dist/server.js");
 }
 function telegramChannelDescriptor(senderId) {
   return { senderId, gatewayUrl: telegramGatewayUrl(), serverPath: telegramServerPath() };
@@ -23870,7 +24252,7 @@ app37.post("/", requireAdminSession, async (c) => {
 var session_reseat_default = app37;
 
 // server/routes/admin/system-stats.ts
-import { readFile as readFile9 } from "fs/promises";
+import { readFile as readFile10 } from "fs/promises";
 import { cpus, loadavg, totalmem, freemem } from "os";
 function parseCpuStat(blob) {
   const line = blob.split("\n", 1)[0] ?? "";
@@ -23914,11 +24296,11 @@ function parseMeminfo(blob) {
 }
 var SAMPLE_DELAY_MS = 100;
 async function sampleLinux() {
-  const a = parseCpuStat(await readFile9("/proc/stat", "utf-8"));
+  const a = parseCpuStat(await readFile10("/proc/stat", "utf-8"));
   await new Promise((r) => setTimeout(r, SAMPLE_DELAY_MS));
-  const b = parseCpuStat(await readFile9("/proc/stat", "utf-8"));
-  const meminfo = parseMeminfo(await readFile9("/proc/meminfo", "utf-8"));
-  const loadavgRaw = (await readFile9("/proc/loadavg", "utf-8")).trim();
+  const b = parseCpuStat(await readFile10("/proc/stat", "utf-8"));
+  const meminfo = parseMeminfo(await readFile10("/proc/meminfo", "utf-8"));
+  const loadavgRaw = (await readFile10("/proc/loadavg", "utf-8")).trim();
   const [l1, l5, l15] = loadavgRaw.split(/\s+/, 3).map(Number);
   if (![l1, l5, l15].every(Number.isFinite)) {
     throw new Error(`malformed /proc/loadavg: ${loadavgRaw}`);
@@ -23992,10 +24374,10 @@ var system_stats_default = app38;
 
 // server/routes/admin/health.ts
 import { existsSync as existsSync37, readFileSync as readFileSync38 } from "fs";
-import { resolve as resolve32, join as join42 } from "path";
+import { resolve as resolve32, join as join43 } from "path";
 var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve32(process.cwd(), "..");
 var brandHostname = "maxy";
-var brandJsonPath = join42(PLATFORM_ROOT6, "config", "brand.json");
+var brandJsonPath = join43(PLATFORM_ROOT6, "config", "brand.json");
 if (existsSync37(brandJsonPath)) {
   try {
     const brand = JSON.parse(readFileSync38(brandJsonPath, "utf-8"));
@@ -24785,7 +25167,7 @@ var browser_default = app46;
 
 // server/routes/admin/calendar.ts
 import { existsSync as existsSync38 } from "fs";
-import { join as join44 } from "path";
+import { join as join45 } from "path";
 
 // server/lib/calendar-ics.ts
 var CRLF = "\r\n";
@@ -24885,7 +25267,7 @@ function countVEvents(ics) {
 
 // server/lib/calendar-availability.ts
 import { readFileSync as readFileSync39 } from "fs";
-import { join as join43 } from "path";
+import { join as join44 } from "path";
 var AVAILABILITY_FILENAME = "calendar-availability.json";
 var REQUIRED_KEYS = [
   "timezone",
@@ -24894,7 +25276,7 @@ var REQUIRED_KEYS = [
   "weekly"
 ];
 function readAvailabilityConfig(accountDir) {
-  const path3 = join43(accountDir, AVAILABILITY_FILENAME);
+  const path3 = join44(accountDir, AVAILABILITY_FILENAME);
   let raw;
   try {
     raw = readFileSync39(path3, "utf-8");
@@ -25257,7 +25639,7 @@ app47.get("/booking-link", requireAdminSession, (c) => {
   }
   const id82 = account.accountId.slice(0, 8);
   try {
-    if (!existsSync38(join44(account.accountDir, AVAILABILITY_FILENAME))) {
+    if (!existsSync38(join45(account.accountDir, AVAILABILITY_FILENAME))) {
       console.log(`[calendar] op=booking-link accountId=${id82} bookingDomain=none source=availability-config`);
       return c.json({ bookingDomain: null });
     }
@@ -25657,7 +26039,7 @@ async function computeTaskList(accountId) {
       { accountId }
     );
     const graphTotal = totalResult.records.length > 0 ? toNum(totalResult.records[0].get("total")) : 0;
-    const open = [];
+    const open3 = [];
     const completed = [];
     let missingTaskId = 0;
     let missingCreatedAt = 0;
@@ -25692,7 +26074,7 @@ async function computeTaskList(accountId) {
         assigneeName
       };
       if (COMPLETED.has(status)) completed.push(row);
-      else if (!HIDDEN_FROM_OPEN.has(status)) open.push(row);
+      else if (!HIDDEN_FROM_OPEN.has(status)) open3.push(row);
     }
     const returned = result.records.length;
     if (returned < graphTotal) {
@@ -25701,9 +26083,9 @@ async function computeTaskList(accountId) {
       );
     }
     console.log(
-      `${TAG40} op=list account=${accountId} returned=${returned} graphTotal=${graphTotal} open=${open.length} completed=${completed.length} missingTaskId=${missingTaskId} missingCreatedAt=${missingCreatedAt} assigned=${assigned}`
+      `${TAG40} op=list account=${accountId} returned=${returned} graphTotal=${graphTotal} open=${open3.length} completed=${completed.length} missingTaskId=${missingTaskId} missingCreatedAt=${missingCreatedAt} assigned=${assigned}`
     );
-    return { open, completed };
+    return { open: open3, completed };
   } catch (err) {
     console.error(`${TAG40} op=list error="${err instanceof Error ? err.message : String(err)}"`);
     return null;
@@ -25744,14 +26126,14 @@ app51.post("/", requireAdminSession, async (c) => {
       console.error(`${TAG41} op=start taskId=${taskId} accountId=${accountId} result=task-not-found`);
       return c.json({ error: "task-not-found" }, 404);
     }
-    const open = await session.run(
+    const open3 = await session.run(
       `MATCH (te:TimeEntry {accountId: $accountId, taskId: $taskId}) WHERE te.endedAt IS NULL
        RETURN te.entryId AS entryId, te.startedAt AS startedAt
        ORDER BY te.startedAt LIMIT 1`,
       { accountId, taskId }
     );
-    const priorEntryId = open.records[0]?.get("entryId");
-    const priorStartedAt = open.records[0]?.get("startedAt");
+    const priorEntryId = open3.records[0]?.get("entryId");
+    const priorStartedAt = open3.records[0]?.get("startedAt");
     if (priorEntryId) {
       console.log(`${TAG41} op=start taskId=${taskId} accountId=${accountId} result=already-running`);
       invalidate("tasks-list", accountId);
@@ -25799,14 +26181,14 @@ app52.post("/", requireAdminSession, async (c) => {
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const session = getSession();
   try {
-    const open = await session.run(
+    const open3 = await session.run(
       `MATCH (te:TimeEntry {taskId: $taskId, accountId: $accountId}) WHERE te.endedAt IS NULL
        RETURN te.entryId AS entryId, te.startedAt AS startedAt
        ORDER BY te.startedAt LIMIT 1`,
       { taskId, accountId }
     );
-    const entryId = open.records[0]?.get("entryId");
-    const startedAt = open.records[0]?.get("startedAt");
+    const entryId = open3.records[0]?.get("entryId");
+    const startedAt = open3.records[0]?.get("startedAt");
     if (!entryId || !startedAt) {
       const cur = await session.run(
         `MATCH (t:Task {taskId: $taskId, accountId: $accountId})
@@ -26807,7 +27189,7 @@ var VISITOR_COOKIE_MAX_AGE_SECONDS = Math.floor(DEFAULT_TTL_MS / 1e3);
 
 // app/lib/brand-config.ts
 import { existsSync as existsSync42, readFileSync as readFileSync44 } from "fs";
-import { join as join45 } from "path";
+import { join as join46 } from "path";
 var cached2 = null;
 var cachedAttempted = false;
 function readBrandConfig() {
@@ -26815,7 +27197,7 @@ function readBrandConfig() {
   cachedAttempted = true;
   const platformRoot5 = process.env.MAXY_PLATFORM_ROOT;
   if (!platformRoot5) return null;
-  const brandPath = join45(platformRoot5, "config", "brand.json");
+  const brandPath = join46(platformRoot5, "config", "brand.json");
   if (!existsSync42(brandPath)) return null;
   try {
     cached2 = JSON.parse(readFileSync44(brandPath, "utf-8"));
@@ -27317,7 +27699,7 @@ var visitor_event_default = app65;
 // server/routes/session.ts
 import { resolve as resolve37 } from "path";
 import { existsSync as existsSync43, writeFileSync as writeFileSync16, mkdirSync as mkdirSync10 } from "fs";
-var UUID_RE5 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var UUID_RE6 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function writeBrandingCache(accountId, agentSlug, branding) {
   try {
     const cacheDir = resolve37(MAXY_DIR, "branding-cache", accountId);
@@ -27332,7 +27714,7 @@ function parseVisitorCookie2(cookieHeader) {
   const match = cookieHeader.match(/(?:^|;\s*)maxy_visitor=([^;]*)/);
   if (!match) return null;
   const value = decodeURIComponent(match[1]).trim();
-  return UUID_RE5.test(value) ? value : null;
+  return UUID_RE6.test(value) ? value : null;
 }
 function parseAccessSessionId2(cookieHeader) {
   if (!cookieHeader) return null;
@@ -27430,7 +27812,7 @@ app66.post("/", async (c) => {
       );
     }
   }
-  if (body.session_key && typeof body.session_key === "string" && UUID_RE5.test(body.session_key)) {
+  if (body.session_key && typeof body.session_key === "string" && UUID_RE6.test(body.session_key)) {
     if (visitorId) {
       const recent = await findRecentConversation(visitorId, accountId, agentSlug).catch(() => null);
       if (recent) {
@@ -27570,9 +27952,9 @@ function computeOpenSlots(config, busy, fromISO, toISO) {
     const weekday = WEEKDAYS[new Date(Date.UTC(y, m - 1, d)).getUTCDay()];
     const windows = config.weekly[weekday] ?? [];
     for (const [openStr, closeStr] of windows) {
-      const open = parseHHMM(openStr);
+      const open3 = parseHHMM(openStr);
       const close = parseHHMM(closeStr);
-      const openUtc = zonedWallClockToUtc(y, m, d, open.hh, open.mm, tz).getTime();
+      const openUtc = zonedWallClockToUtc(y, m, d, open3.hh, open3.mm, tz).getTime();
       const closeUtc = zonedWallClockToUtc(y, m, d, close.hh, close.mm, tz).getTime();
       for (let s = openUtc; s + durMs <= closeUtc; s += durMs) {
         const slotEnd = s + durMs;
@@ -27659,8 +28041,8 @@ var calendar_public_default = app67;
 
 // server/routes/portal-fetch.ts
 import { createReadStream as createReadStream3 } from "fs";
-import { stat as stat9, readFile as readFile10, realpath } from "fs/promises";
-import { join as join46, resolve as resolve38, sep as sep10 } from "path";
+import { stat as stat9, readFile as readFile11, realpath } from "fs/promises";
+import { join as join47, resolve as resolve38, sep as sep10 } from "path";
 import { Readable as Readable3 } from "stream";
 var app68 = new Hono();
 var TAG50 = "[portal-fetch]";
@@ -27716,7 +28098,7 @@ async function readAccountSecret(accountId) {
   const path3 = resolve38(DATA_ROOT, "accounts", accountId, "secrets", "data-portal.env");
   let text;
   try {
-    text = await readFile10(path3, "utf8");
+    text = await readFile11(path3, "utf8");
   } catch {
     console.error(`${TAG50} op=no-secret account="${accountId}" path="${path3}"`);
     return "";
@@ -27733,7 +28115,7 @@ function isValidAccountId2(value) {
 }
 async function readExposeFolders2(accountDir) {
   try {
-    const cfg = JSON.parse(await readFile10(join46(accountDir, "data-portal.json"), "utf8"));
+    const cfg = JSON.parse(await readFile11(join47(accountDir, "data-portal.json"), "utf8"));
     return Array.isArray(cfg?.exposeFolders) ? cfg.exposeFolders.filter((f) => typeof f === "string") : [];
   } catch {
     return [];
@@ -27742,7 +28124,7 @@ async function readExposeFolders2(accountDir) {
 async function resolveFetchTarget(accountDir, relPath, ownerId) {
   let schemaText = null;
   try {
-    schemaText = await readFile10(join46(accountDir, "SCHEMA.md"), "utf8");
+    schemaText = await readFile11(join47(accountDir, "SCHEMA.md"), "utf8");
   } catch {
     schemaText = null;
   }
@@ -27913,7 +28295,7 @@ function startTimeEntryCensus(openSession, opts = {}) {
 
 // app/lib/ledger-census.ts
 import { readdirSync as readdirSync28, readFileSync as readFileSync45, statSync as statSync19 } from "fs";
-import { join as join47 } from "path";
+import { join as join48 } from "path";
 
 // ../lib/ledger-core/dist/reconcile.js
 var LEDGER_INDEX_NAMES = [
@@ -27967,7 +28349,7 @@ function countWriteRejects24h(logDir, now) {
   }
   let total = 0;
   for (const name of entries2) {
-    const path3 = join47(logDir, name);
+    const path3 = join48(logDir, name);
     try {
       if (now - statSync19(path3).mtimeMs > DAY_MS) continue;
       for (const line of readFileSync45(path3, "utf8").split("\n")) {
@@ -28341,7 +28723,7 @@ async function startFileWatcher(opts = {}) {
 }
 
 // app/lib/migrate-uploads.ts
-import { mkdir as mkdir6, readdir as readdir6, rename as rename3, rm as rm3 } from "fs/promises";
+import { mkdir as mkdir6, readdir as readdir6, rename as rename4, rm as rm3 } from "fs/promises";
 import { dirname as dirname15, relative as relative7, resolve as resolve40 } from "path";
 var ACCOUNT_UUID_RE5 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function walkFiles(dir) {
@@ -28375,7 +28757,7 @@ async function relocateTree(srcDir, destDir, dataRoot, accountId, session) {
     const suffix = relative7(srcDir, oldAbs);
     const newAbs = resolve40(destDir, suffix);
     await mkdir6(dirname15(newAbs), { recursive: true });
-    await rename3(oldAbs, newAbs);
+    await rename4(oldAbs, newAbs);
     moved++;
     const oldRel = relative7(dataRoot, oldAbs);
     const newRel = relative7(dataRoot, newAbs);
@@ -28464,9 +28846,9 @@ async function migrateUploads(opts = {}) {
 }
 
 // app/lib/migrate-admin-webchat-sidecars.ts
-import { readdir as readdir7, readFile as readFile11, rename as rename4, writeFile as writeFile5, unlink as unlink4 } from "fs/promises";
+import { readdir as readdir7, readFile as readFile12, rename as rename5, writeFile as writeFile6, unlink as unlink5 } from "fs/promises";
 import { existsSync as existsSync44 } from "fs";
-import { join as join48 } from "path";
+import { join as join49 } from "path";
 var ADMIN_ROLE2 = "admin";
 var WEBCHAT_CHANNEL2 = "webchat";
 var SESSION_META_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.meta\.json$/i;
@@ -28477,7 +28859,7 @@ var defaultResolveName = async (_accountId, userId) => {
 async function readRaw3(path3) {
   let raw;
   try {
-    raw = await readFile11(path3, "utf8");
+    raw = await readFile12(path3, "utf8");
   } catch {
     return null;
   }
@@ -28491,11 +28873,11 @@ async function readRaw3(path3) {
 async function writeRaw(path3, obj) {
   const tmp = `${path3}.tmp.${process.pid}.${Date.now()}`;
   try {
-    await writeFile5(tmp, JSON.stringify(obj, null, 2), "utf8");
-    await rename4(tmp, path3);
+    await writeFile6(tmp, JSON.stringify(obj, null, 2), "utf8");
+    await rename5(tmp, path3);
   } catch (err) {
     try {
-      if (existsSync44(tmp)) await unlink4(tmp);
+      if (existsSync44(tmp)) await unlink5(tmp);
     } catch {
     }
     throw err;
@@ -28511,7 +28893,7 @@ async function collectLiveSidecars(projectsRoot) {
   }
   for (const slug of slugs) {
     if (!slug.isDirectory()) continue;
-    const slugDir = join48(projectsRoot, slug.name);
+    const slugDir = join49(projectsRoot, slug.name);
     let entries2;
     try {
       entries2 = await readdir7(slugDir, { withFileTypes: true });
@@ -28520,9 +28902,9 @@ async function collectLiveSidecars(projectsRoot) {
     }
     for (const entry of entries2) {
       if (entry.isFile() && SESSION_META_RE.test(entry.name)) {
-        out.push(join48(slugDir, entry.name));
+        out.push(join49(slugDir, entry.name));
       } else if (entry.isDirectory() && entry.name === "subagents") {
-        const subDir = join48(slugDir, entry.name);
+        const subDir = join49(slugDir, entry.name);
         let subs;
         try {
           subs = await readdir7(subDir, { withFileTypes: true });
@@ -28530,7 +28912,7 @@ async function collectLiveSidecars(projectsRoot) {
           continue;
         }
         for (const s of subs) {
-          if (s.isFile() && SESSION_META_RE.test(s.name)) out.push(join48(subDir, s.name));
+          if (s.isFile() && SESSION_META_RE.test(s.name)) out.push(join49(subDir, s.name));
         }
       }
     }
@@ -28542,7 +28924,7 @@ function shortId(path3) {
   return base.slice(0, 8);
 }
 async function migrateAdminWebchatSidecars(opts = {}) {
-  const projectsRoot = opts.projectsRoot ?? (process.env.CLAUDE_CONFIG_DIR ? join48(process.env.CLAUDE_CONFIG_DIR, "projects") : null) ?? "";
+  const projectsRoot = opts.projectsRoot ?? (process.env.CLAUDE_CONFIG_DIR ? join49(process.env.CLAUDE_CONFIG_DIR, "projects") : null) ?? "";
   const usersFile = opts.usersFile ?? USERS_FILE;
   const accountId = opts.accountId ?? resolveAccount()?.accountId ?? null;
   const resolveName = opts.resolveName ?? defaultResolveName;
@@ -28616,6 +28998,129 @@ async function migrateAdminWebchatSidecars(opts = {}) {
   return result;
 }
 
+// app/lib/migrate-sidecar-account-ids.ts
+import { readdir as readdir8, readFile as readFile13, rename as rename6, writeFile as writeFile7, unlink as unlink6 } from "fs/promises";
+import { existsSync as existsSync45 } from "fs";
+import { join as join50 } from "path";
+var SESSION_META_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.meta\.json$/i;
+function projectSlugForCwd(cwd) {
+  return cwd.replace(/\//g, "-");
+}
+async function readRaw4(path3) {
+  let raw;
+  try {
+    raw = await readFile13(path3, "utf8");
+  } catch {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    return parsed && typeof parsed === "object" ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+async function writeRaw2(path3, obj) {
+  const tmp = `${path3}.tmp.${process.pid}.${Date.now()}`;
+  try {
+    await writeFile7(tmp, JSON.stringify(obj, null, 2), "utf8");
+    await rename6(tmp, path3);
+  } catch (err) {
+    try {
+      if (existsSync45(tmp)) await unlink6(tmp);
+    } catch {
+    }
+    throw err;
+  }
+}
+function shortId2(path3) {
+  const base = path3.slice(path3.lastIndexOf("/") + 1).replace(/\.meta\.json$/, "");
+  return base.slice(0, 8);
+}
+async function collectSidecars(projectsRoot) {
+  const out = [];
+  let slugs;
+  try {
+    slugs = await readdir8(projectsRoot, { withFileTypes: true });
+  } catch {
+    return out;
+  }
+  for (const slug of slugs) {
+    if (!slug.isDirectory()) continue;
+    const slugDir = join50(projectsRoot, slug.name);
+    let entries2;
+    try {
+      entries2 = await readdir8(slugDir, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries2) {
+      if (entry.isFile() && SESSION_META_RE2.test(entry.name)) {
+        out.push({ path: join50(slugDir, entry.name), slug: slug.name });
+      } else if (entry.isDirectory() && (entry.name === "subagents" || entry.name === "archive")) {
+        const subDir = join50(slugDir, entry.name);
+        let subs;
+        try {
+          subs = await readdir8(subDir, { withFileTypes: true });
+        } catch {
+          continue;
+        }
+        for (const s of subs) {
+          if (s.isFile() && SESSION_META_RE2.test(s.name)) {
+            out.push({ path: join50(subDir, s.name), slug: slug.name });
+          }
+        }
+      }
+    }
+  }
+  return out;
+}
+async function migrateSidecarAccountIds(opts = {}) {
+  const projectsRoot = opts.projectsRoot ?? (process.env.CLAUDE_CONFIG_DIR ? join50(process.env.CLAUDE_CONFIG_DIR, "projects") : null) ?? "";
+  const accounts = opts.accounts ?? listValidAccounts();
+  const result = {
+    scanned: 0,
+    backfilled: 0,
+    skippedHasId: 0,
+    skippedUnknownSlug: 0,
+    verified: 0
+  };
+  if (!projectsRoot) {
+    console.error("[sidecar-account-backfill] skip reason=no-projects-root");
+    return result;
+  }
+  const accountBySlug = /* @__PURE__ */ new Map();
+  for (const a of accounts) accountBySlug.set(projectSlugForCwd(a.accountDir), a.accountId);
+  for (const { path: path3, slug } of await collectSidecars(projectsRoot)) {
+    const raw = await readRaw4(path3);
+    if (!raw) continue;
+    result.scanned++;
+    if (typeof raw.accountId === "string" && raw.accountId.length > 0) {
+      result.skippedHasId++;
+      continue;
+    }
+    const accountId = accountBySlug.get(slug);
+    if (!accountId) {
+      result.skippedUnknownSlug++;
+      console.error(`[sidecar-account-backfill] skip sessionId=${shortId2(path3)} reason=slug-not-in-registry slug=${slug}`);
+      continue;
+    }
+    raw.accountId = accountId;
+    await writeRaw2(path3, raw);
+    result.backfilled++;
+    const back = await readRaw4(path3);
+    if (back && back.accountId === accountId) {
+      result.verified++;
+    } else {
+      console.error(`[sidecar-account-backfill] post-write-verify-failed sessionId=${shortId2(path3)} accountId=${accountId.slice(0, 8)}`);
+    }
+  }
+  console.error(
+    `[sidecar-account-backfill] op=sidecar-account scanned=${result.scanned} backfilled=${result.backfilled} skipped-has-id=${result.skippedHasId} skipped-unknown-slug=${result.skippedUnknownSlug} verified=${result.verified}`
+  );
+  return result;
+}
+
 // app/lib/whatsapp/gateway/inbound-hub.ts
 var InboundHub = class {
   senders = /* @__PURE__ */ new Map();
@@ -30841,7 +31346,7 @@ function buildTelegramSpawnRequest(input) {
 
 // app/lib/telegram/outbound/send-document.ts
 import { realpathSync as realpathSync10 } from "fs";
-import { readFile as readFile12, stat as stat11 } from "fs/promises";
+import { readFile as readFile14, stat as stat11 } from "fs/promises";
 import { resolve as resolve42, basename as basename13 } from "path";
 var TAG56 = "[telegram:outbound]";
 var TELEGRAM_DOCUMENT_MAX_BYTES = 50 * 1024 * 1024;
@@ -30891,7 +31396,7 @@ async function sendTelegramDocument(input) {
     };
   }
   const filename = basename13(resolvedPath);
-  const buffer = Buffer.from(await readFile12(resolvedPath));
+  const buffer = Buffer.from(await readFile14(resolvedPath));
   const form = new FormData();
   form.append("chat_id", String(chatId));
   if (caption) form.append("caption", caption);
@@ -31245,12 +31750,12 @@ function warnOnChannelAdminBindingDrift() {
 }
 
 // server/lib/booking-site-accounts.ts
-import { existsSync as existsSync45, readFileSync as readFileSync46 } from "fs";
+import { existsSync as existsSync46, readFileSync as readFileSync46 } from "fs";
 import { resolve as resolve43 } from "path";
 function listBookingSiteAccounts(accounts) {
   return accounts.filter((a) => {
     const availPath = resolve43(a.accountDir, "calendar-availability.json");
-    if (!existsSync45(availPath)) return false;
+    if (!existsSync46(availPath)) return false;
     try {
       const cfg = JSON.parse(readFileSync46(availPath, "utf-8"));
       return typeof cfg.bookingDbName === "string" && cfg.bookingDbName.length > 0;
@@ -31290,7 +31795,7 @@ function broadcastAdminShutdown(reason) {
 
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash7, verify as cryptoVerify } from "crypto";
-import { existsSync as existsSync46, readFileSync as readFileSync47, statSync as statSync20 } from "fs";
+import { existsSync as existsSync47, readFileSync as readFileSync47, statSync as statSync20 } from "fs";
 import { resolve as resolve44 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
@@ -31339,7 +31844,7 @@ function resolveEntitlement(brand, account) {
     return logResolved(implicitTrust(account), null);
   }
   const entitlementPath = resolve44(brand.configDir, "entitlement.json");
-  if (!existsSync46(entitlementPath)) {
+  if (!existsSync47(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
   const stat12 = statSync20(entitlementPath);
@@ -31530,12 +32035,12 @@ function clientFrom(c) {
 }
 installMediaDownloadGuard();
 var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT || "";
-var BRAND_JSON_PATH = PLATFORM_ROOT8 ? join49(PLATFORM_ROOT8, "config", "brand.json") : "";
+var BRAND_JSON_PATH = PLATFORM_ROOT8 ? join51(PLATFORM_ROOT8, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", marketingUrl: "https://getmaxy.com" };
-if (BRAND_JSON_PATH && !existsSync47(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && !existsSync48(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
 }
-if (BRAND_JSON_PATH && existsSync47(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync48(BRAND_JSON_PATH)) {
   try {
     const parsed = JSON.parse(readFileSync48(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
@@ -31569,10 +32074,10 @@ var brandLoginOpts = {
   appleTouchIconPath: brandAppIcon512Path,
   themeColor: BRAND.defaultColors?.primary
 };
-var ALIAS_DOMAINS_PATH = join49(homedir4(), BRAND.configDir, "alias-domains.json");
+var ALIAS_DOMAINS_PATH = join51(homedir4(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
-    if (!existsSync47(ALIAS_DOMAINS_PATH)) return null;
+    if (!existsSync48(ALIAS_DOMAINS_PATH)) return null;
     const parsed = JSON.parse(readFileSync48(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
@@ -31648,7 +32153,7 @@ var waGateway = new WaGateway({
   fetchStandingRules: fetchAccountStandingRules,
   resolveSessionOverride: (accountId, senderId) => resolveChannelOverride(accountId, "whatsapp", senderId),
   gatewayUrl: `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`,
-  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve45(process.env.MAXY_PLATFORM_ROOT ?? join49(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
+  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve45(process.env.MAXY_PLATFORM_ROOT ?? join51(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
   // Task 751 / 1390 — file delivery on the native channel. `maxyAccountId` (the
   // path-validation scope) is the sender's effective SESSION account, resolved
   // once at the inbound gate and threaded here via the gateway's per-sender doc
@@ -31663,11 +32168,12 @@ var waGateway = new WaGateway({
       caption,
       accountId,
       maxyAccountId,
-      platformRoot: resolve45(process.env.MAXY_PLATFORM_ROOT ?? join49(__dirname, ".."))
+      platformRoot: resolve45(process.env.MAXY_PLATFORM_ROOT ?? join51(__dirname, ".."))
     });
     return result.ok ? { ok: true, messageId: result.messageId } : { ok: false, error: result.error };
   },
   ensureChannelSession: async ({ accountId, effectiveAccountId, senderId, role, personId, gatewayUrl, serverPath, passive, text, msgId, ownerSelfPhone, replyContext }) => {
+    warnNonUuidAccount("channel-spawn", effectiveAccountId);
     if (passive) {
       const phoneHash = createHash8("sha256").update(senderId).digest("hex").slice(0, 12);
       const prompt = (text ?? "").trim();
@@ -31716,7 +32222,7 @@ var waGateway = new WaGateway({
       return;
     }
     if (role === "admin") {
-      const managesAccount = effectiveAccountId !== accountId ? effectiveAccountId : "none";
+      const managesAccount = managesAccountFor(effectiveAccountId, resolveReadStoreKey(accountId));
       console.error(`[whatsapp-native] op=account-manager-route senderId=${senderId} managesAccount=${managesAccount} effectiveAccount=${effectiveAccountId} source=gate`);
     }
     const req = buildWaSpawnRequest({
@@ -31781,7 +32287,7 @@ function runDuplicateSenderAudit() {
   try {
     const configDir2 = process.env.CLAUDE_CONFIG_DIR;
     if (!configDir2) return;
-    const projectsRoot = join49(configDir2, "projects");
+    const projectsRoot = join51(configDir2, "projects");
     const records = [];
     for (const { path: jsonlPath, isSubagent, archived } of enumerateJsonls(projectsRoot)) {
       if (isSubagent || archived) continue;
@@ -32356,7 +32862,7 @@ app69.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync47(filePath)) {
+  if (!existsSync48(filePath)) {
     console.error(`[agent-assets] serve slug=${slug} file=${filename} status=404`);
     return c.text("Not found", 404);
   }
@@ -32386,7 +32892,7 @@ app69.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync47(filePath)) {
+  if (!existsSync48(filePath)) {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
@@ -32406,7 +32912,7 @@ app69.route("/v", visitor_consent_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
-if (BRAND_JSON_PATH && existsSync47(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync48(BRAND_JSON_PATH)) {
   try {
     const fullBrand = JSON.parse(readFileSync48(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
@@ -32435,7 +32941,7 @@ var brandScript = `<script>window.__BRAND__=${JSON.stringify({
 var brandThemeColor = BRAND.defaultColors?.primary ?? "#000000";
 var brandBackgroundColor = BRAND.defaultColors?.background ?? "#ffffff";
 var brandAppIconsExist = [brandAppIcon192Path, brandAppIcon512Path, brandMaskableIconPath].every(
-  (p) => existsSync47(resolve45(process.cwd(), "public", p.replace(/^\//, "")))
+  (p) => existsSync48(resolve45(process.cwd(), "public", p.replace(/^\//, "")))
 );
 var SW_SOURCE = (() => {
   try {
@@ -32447,8 +32953,8 @@ var SW_SOURCE = (() => {
 function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT8) return "unknown";
-    const versionFile = join49(PLATFORM_ROOT8, "config", `.${BRAND.hostname}-version`);
-    if (!existsSync47(versionFile)) return "unknown";
+    const versionFile = join51(PLATFORM_ROOT8, "config", `.${BRAND.hostname}-version`);
+    if (!existsSync48(versionFile)) return "unknown";
     const content = readFileSync48(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
@@ -32457,36 +32963,6 @@ function readInstalledVersion() {
 }
 var INSTALLED_VERSION = readInstalledVersion();
 var versionScript = `<script>window.__MAXY_VERSION__=${JSON.stringify(INSTALLED_VERSION)}</script>`;
-var clientErrorReporterScript = `<script>
-(function(){
-  var send=function(b){
-    try{
-      fetch('/api/_client-error',{
-        method:'POST',
-        headers:{'content-type':'application/json'},
-        body:JSON.stringify(Object.assign({url:location.href,ua:navigator.userAgent,version:(window.__MAXY_VERSION__||'unknown')},b)),
-        keepalive:true
-      }).catch(function(){});
-    }catch(e){}
-  };
-  window.addEventListener('error',function(e){
-    var t=e.target;
-    if(t&&t!==window&&t.tagName)send({kind:'subresource',tag:t.tagName,url:t.src||t.href||''});
-    else send({kind:'uncaught',msg:e.message,filename:e.filename,lineno:e.lineno,colno:e.colno,stack:(e.error&&e.error.stack)||''});
-  },true);
-  window.addEventListener('unhandledrejection',function(e){
-    var r=e.reason;
-    send({kind:'unhandled-rejection',msg:String((r&&r.message)||r),stack:(r&&r.stack)||''});
-  });
-  try{
-    new PerformanceObserver(function(list){
-      list.getEntries().forEach(function(entry){
-        if(entry.responseStatus>=400)send({kind:'subresource',url:entry.name,status:entry.responseStatus});
-      });
-    }).observe({type:'resource',buffered:true});
-  }catch(e){}
-})();
-</script>`;
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
@@ -32507,12 +32983,12 @@ ${clientErrorReporterScript}
   return html;
 }
 function loadBrandingCache(agentSlug) {
-  const configDir2 = join49(homedir4(), BRAND.configDir);
+  const configDir2 = join51(homedir4(), BRAND.configDir);
   try {
     const accountId = getDefaultAccountId();
     if (!accountId) return null;
-    const cachePath = join49(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
-    if (!existsSync47(cachePath)) return null;
+    const cachePath = join51(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
+    if (!existsSync48(cachePath)) return null;
     return JSON.parse(readFileSync48(cachePath, "utf-8"));
   } catch {
     return null;
@@ -32760,10 +33236,10 @@ var hostname = process.env.HOSTNAME ?? "127.0.0.1";
 var httpServer = serve({ fetch: app69.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
-  const reconcilePlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join49(__dirname, "..");
+  const reconcilePlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join51(__dirname, "..");
   const reconcileScript = resolve45(reconcilePlatformRoot, "plugins/scheduling/mcp/dist/scripts/reconcile-bookings.js");
   const runReconcile = (ctx) => {
-    if (!existsSync47(reconcileScript)) return;
+    if (!existsSync48(reconcileScript)) return;
     try {
       const child = spawn3(process.execPath, [reconcileScript], {
         env: { ...process.env, PLATFORM_ROOT: reconcilePlatformRoot },
@@ -32783,7 +33259,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     detached: true,
     run: runReconcile
   });
-  const reconcileStatePath = join49(MAXY_DIR, "booking-reconcile-state.json");
+  const reconcileStatePath = join51(MAXY_DIR, "booking-reconcile-state.json");
   registerLoop({
     name: "calendar-reconcile-liveness",
     intervalMs: 6e5,
@@ -32801,7 +33277,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 }
 {
   const DREAM_CYCLE_SWEEP_INTERVAL_MS = 36e5;
-  const dreamPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join49(__dirname, "..");
+  const dreamPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join51(__dirname, "..");
   const dreamSweepScript = resolve45(dreamPlatformRoot, "plugins/memory/mcp/dist/scripts/dream-cycle-sweep.js");
   registerLoop({
     name: "dream-cycle-sweep",
@@ -32809,7 +33285,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     firstRunDelayMs: 3e4,
     detached: true,
     run: (ctx) => {
-      if (!existsSync47(dreamSweepScript)) return;
+      if (!existsSync48(dreamSweepScript)) return;
       try {
         const child = spawn3(process.execPath, [dreamSweepScript], {
           env: { ...process.env, PLATFORM_ROOT: dreamPlatformRoot },
@@ -32825,11 +33301,11 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const outlookPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join49(__dirname, "..");
+  const outlookPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join51(__dirname, "..");
   const outlookScript = resolve45(outlookPlatformRoot, "plugins/outlook/mcp/dist/scripts/complete-registration.js");
   const OUTLOOK_COMPLETE_INTERVAL_MS = 3e4;
   const runOutlookComplete = (ctx) => {
-    if (!existsSync47(outlookScript)) return;
+    if (!existsSync48(outlookScript)) return;
     try {
       const child = spawn3(process.execPath, [outlookScript], {
         env: { ...process.env, PLATFORM_ROOT: outlookPlatformRoot },
@@ -32851,19 +33327,19 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const auditRoot = process.env.MAXY_PLATFORM_ROOT ?? join49(__dirname, "..");
+  const auditRoot = process.env.MAXY_PLATFORM_ROOT ?? join51(__dirname, "..");
   const strandedAccountsDir = resolve45(auditRoot, "..", "data/accounts");
   const STRANDED_AUDIT_INTERVAL_MS = 3e5;
   const STRANDED_AGE_MS = 16 * 6e4;
   const STRANDED_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
   const runStrandedAudit = () => {
     try {
-      if (!existsSync47(strandedAccountsDir)) return;
+      if (!existsSync48(strandedAccountsDir)) return;
       const now = Date.now();
       for (const name of readdirSync29(strandedAccountsDir)) {
         if (!STRANDED_UUID_RE.test(name)) continue;
         const pendingPath2 = resolve45(strandedAccountsDir, name, "secrets/outlook/pending-devicecode.enc");
-        if (!existsSync47(pendingPath2)) continue;
+        if (!existsSync48(pendingPath2)) continue;
         const ageMs2 = now - statSync21(pendingPath2).mtimeMs;
         if (ageMs2 > STRANDED_AGE_MS) {
           console.error(`[outlook-mcp] devicecode-stranded account=${name} ageSec=${Math.floor(ageMs2 / 1e3)}`);
@@ -32881,7 +33357,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const googleRoot = process.env.MAXY_PLATFORM_ROOT ?? join49(__dirname, "..");
+  const googleRoot = process.env.MAXY_PLATFORM_ROOT ?? join51(__dirname, "..");
   const googleAccountsDir = resolve45(googleRoot, "..", "data/accounts");
   const GOOGLE_PENDING_AUDIT_INTERVAL_MS = 3e5;
   const runGooglePendingAuditSafe = () => {
@@ -32900,7 +33376,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   const googleAuditScript = resolve45(googleRoot, "plugins/google/mcp/dist/scripts/account-audit.js");
   const GOOGLE_ACCOUNT_AUDIT_INTERVAL_MS = 36e5;
   const runGoogleAccountAudit = (ctx) => {
-    if (!existsSync47(googleAuditScript)) return;
+    if (!existsSync48(googleAuditScript)) return;
     try {
       const child = spawn3(process.execPath, [googleAuditScript], {
         env: { ...process.env, PLATFORM_ROOT: googleRoot },
@@ -32925,7 +33401,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join49(__dirname, "..");
+  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join51(__dirname, "..");
   const STORAGE_AUDIT_INTERVAL_MS = 3e5;
   const runStorageAuditSafe = () => runStorageAudit(auditPlatformRoot).catch((err) => {
     console.error(`[storage-audit] error="${err.message}"`);
@@ -32971,7 +33447,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const publishPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join49(__dirname, "..");
+  const publishPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join51(__dirname, "..");
   const publishScript = resolve45(publishPlatformRoot, "plugins/scheduling/mcp/dist/scripts/publish-availability.js");
   const PUBLISH_INTERVAL_MS = 3e5;
   const bookingAccounts = () => {
@@ -32983,7 +33459,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     }
   };
   const spawnPublish = (account, ctx) => {
-    if (!existsSync47(publishScript)) return;
+    if (!existsSync48(publishScript)) return;
     try {
       const child = spawn3(process.execPath, [publishScript], {
         env: {
@@ -33005,7 +33481,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     const availPath = resolve45(account.accountDir, "calendar-availability.json");
     let hasBookingSite = false;
     try {
-      if (existsSync47(availPath)) {
+      if (existsSync48(availPath)) {
         const cfg = JSON.parse(readFileSync48(availPath, "utf-8"));
         hasBookingSite = typeof cfg.bookingDbName === "string" && cfg.bookingDbName.length > 0;
       }
@@ -33014,7 +33490,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     if (!hasBookingSite) return;
     const statePath = resolve45(account.accountDir, "state", "booking-availability", "last-publish.json");
     let lastSuccessAt = null;
-    if (existsSync47(statePath)) {
+    if (existsSync48(statePath)) {
       try {
         const rec = JSON.parse(readFileSync48(statePath, "utf-8"));
         lastSuccessAt = rec.lastSuccessAt ?? null;
@@ -33048,12 +33524,12 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 startTimeEntryCensus(() => getSession());
 startLedgerCensus(() => getSession());
 {
-  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join49(__dirname, "..");
+  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join51(__dirname, "..");
   const auditScript = resolve45(auditPlatformRoot, "plugins/connector/mcp/dist/scripts/audit-connectors.js");
   const auditLogDir = process.env.LOG_DIR ?? LOG_DIR;
   const CONNECTOR_AUDIT_INTERVAL_MS = 3e5;
   const runConnectorAudit = (ctx) => {
-    if (!existsSync47(auditScript)) return;
+    if (!existsSync48(auditScript)) return;
     try {
       const child = spawn3(process.execPath, [auditScript], {
         env: { ...process.env, PLATFORM_ROOT: auditPlatformRoot, LOG_DIR: auditLogDir },
@@ -33171,7 +33647,7 @@ try {
 var ADMINUSER_RECONCILE_INTERVAL_MS = 60 * 60 * 1e3;
 async function runAdminUserReconcileTick() {
   try {
-    if (!existsSync47(USERS_FILE)) {
+    if (!existsSync48(USERS_FILE)) {
       console.error("[adminuser-self-heal] skip reason=no-users-file");
       return;
     }
@@ -33222,7 +33698,7 @@ registerLoop({
 });
 var USERS_RECONCILE_INTERVAL_MS = 60 * 60 * 1e3;
 function countUsersRows() {
-  if (!existsSync47(USERS_FILE)) return 0;
+  if (!existsSync48(USERS_FILE)) return 0;
   const raw = readFileSync48(USERS_FILE, "utf-8").trim();
   if (!raw) return 0;
   const users = JSON.parse(raw);
@@ -33273,7 +33749,7 @@ registerLoop({
     throw err;
   })
 });
-void migrateAdminWebchatSidecars().catch((err) => console.error(`[sidecar-backfill] failed err="${err instanceof Error ? err.message : String(err)}"`));
+void migrateAdminWebchatSidecars().catch((err) => console.error(`[sidecar-backfill] failed err="${err instanceof Error ? err.message : String(err)}"`)).then(() => migrateSidecarAccountIds()).catch((err) => console.error(`[sidecar-account-backfill] failed err="${err instanceof Error ? err.message : String(err)}"`));
 try {
   const accounts = enumerateValidAccountIds(getAccountsDirFromEnv());
   console.error(`[graph-health] account-enumeration accounts=${accounts.length}`);
@@ -33356,7 +33832,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve45(process.env.MAXY_PLATFORM_ROOT ?? join49(__dirname, "..")),
+  platformRoot: resolve45(process.env.MAXY_PLATFORM_ROOT ?? join51(__dirname, "..")),
   accountConfig: bootAccountConfig,
   onMessage: async (msg) => {
     if (isObserveAccount(msg.accountId)) {