@rubytech/create-sitedesk-code 0.1.514 → 0.1.515

package/payload/platform/plugins/admin/mcp/dist/specialist-registry.d.ts

@@ -0,0 +1,14 @@
+export interface SpecialistRegistryReport {
+    /** One `  <name>: <status>` line per AGENTS.md entry, in file order. */
+    lines: string[];
+    registered: number;
+    missing: number;
+    disabled: number;
+}
+export declare function classifySpecialists(opts: {
+    agentsMd: string;
+    specialistsAgentsDir: string;
+    accountDir: string;
+    chromeUp: boolean;
+}): SpecialistRegistryReport;
+//# sourceMappingURL=specialist-registry.d.ts.map

package/payload/platform/plugins/admin/mcp/dist/specialist-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"specialist-registry.d.ts","sourceRoot":"","sources":["../src/specialist-registry.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,wBAAwB;IACvC,wEAAwE;IACxE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAkBD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;CACnB,GAAG,wBAAwB,CA4B3B"}

package/payload/platform/plugins/admin/mcp/dist/specialist-registry.js

@@ -0,0 +1,57 @@
+// Task 2016 — the specialist half of `system-status`.
+//
+// Disabling an agent MOVES its file out of `specialists/agents/` (Task 1996),
+// so a walk of AGENTS.md against that directory sees an absent file and, before
+// this module, called it `missing file` — an operator action rendered as an
+// install fault. The disabled store is what tells the two apart.
+import { existsSync, readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+/** Basenames the operator switched off. An unreadable store names nothing: a
+ *  corrupt file is not evidence that an agent was disabled, and the absent file
+ *  stays `missing file`, which is the honest answer when the store cannot be
+ *  read. */
+function readDisabledStore(accountDir) {
+    const p = resolve(accountDir, "agents-disabled.json");
+    if (!existsSync(p))
+        return new Set();
+    try {
+        const parsed = JSON.parse(readFileSync(p, "utf-8"));
+        if (!Array.isArray(parsed.disabled))
+            return new Set();
+        return new Set(parsed.disabled.filter((x) => typeof x === "string"));
+    }
+    catch {
+        return new Set();
+    }
+}
+export function classifySpecialists(opts) {
+    const entries = opts.agentsMd.match(/^- \*\*specialists:([^*]+)\*\*/gm) ?? [];
+    const disabled = readDisabledStore(opts.accountDir);
+    const lines = [];
+    let missingCount = 0;
+    let disabledCount = 0;
+    for (const entry of entries) {
+        const nameMatch = entry.match(/specialists:([^*]+)/);
+        if (!nameMatch)
+            continue;
+        const name = nameMatch[1];
+        let status;
+        if (existsSync(join(opts.specialistsAgentsDir, `${name}.md`))) {
+            status =
+                name === "personal-assistant" && !opts.chromeUp
+                    ? "degraded — chrome not running"
+                    : "ok";
+        }
+        else if (disabled.has(`${name}.md`)) {
+            status = "disabled (operator)";
+            disabledCount++;
+        }
+        else {
+            status = "missing file";
+            missingCount++;
+        }
+        lines.push(`  ${name}: ${status}`);
+    }
+    return { lines, registered: lines.length, missing: missingCount, disabled: disabledCount };
+}
+//# sourceMappingURL=specialist-registry.js.map

package/payload/platform/plugins/admin/mcp/dist/specialist-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"specialist-registry.js","sourceRoot":"","sources":["../src/specialist-registry.ts"],"names":[],"mappings":"AAAA,sDAAsD;AACtD,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAChF,4EAA4E;AAC5E,iEAAiE;AACjE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAU1C;;;YAGY;AACZ,SAAS,iBAAiB,CAAC,UAAkB;IAC3C,MAAM,CAAC,GAAG,OAAO,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAC;IACtD,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAA2B,CAAC;QAC9E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,GAAG,EAAE,CAAC;QACtD,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAKnC;IACC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,kCAAkC,CAAC,IAAI,EAAE,CAAC;IAC9E,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACpD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACrD,IAAI,CAAC,SAAS;YAAE,SAAS;QACzB,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,MAAc,CAAC;QACnB,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC;YAC9D,MAAM;gBACJ,IAAI,KAAK,oBAAoB,IAAI,CAAC,IAAI,CAAC,QAAQ;oBAC7C,CAAC,CAAC,+BAA+B;oBACjC,CAAC,CAAC,IAAI,CAAC;QACb,CAAC;aAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,IAAI,KAAK,CAAC,EAAE,CAAC;YACtC,MAAM,GAAG,qBAAqB,CAAC;YAC/B,aAAa,EAAE,CAAC;QAClB,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,cAAc,CAAC;YACxB,YAAY,EAAE,CAAC;QACjB,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC;IACrC,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC;AAC7F,CAAC"}

package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: platform-architecture
 description: Use when grounding any documented-surface claim about what SiteDesk ships — plugins, skills, specialists, install/deploy flows, internals. This is the install catalogue, not evidence of what is enabled on the current account. For install state on this account, call `capabilities-here`; for documented surface, cite the `Source:` URL inline.
-content-hash: sha256:86e768fb27dbcb38fc304ace12dbca3462943fcb58435cea6925ebf2469a0647
+content-hash: sha256:414b3a1a40f8b871635c0746cd30d4ea4203fd9baa8f4727c435c75c01f9bc2a
 brand: sitedesk-code
 product-name: SiteDesk
 ---
@@ -3176,6 +3176,18 @@ and removes anything named in it, so an upgrade does not silently re-deliver a
 disabled agent. An unreadable store withholds nothing and says so: a corrupt
 file is not evidence that an agent was disabled.
 
+Disabling also reconciles the admin's routing prose. `agents/admin/AGENTS.md`
+carries one `- **specialists:<name>**:` line per dispatchable specialist, and
+`agents-md-bootstrap.sh` used to only ever append, so a disabled agent stayed
+advertised and the admin dispatched to a file that was no longer there. The
+script now withholds a line for every name in the store, and both routes exec it
+after the move, so the prose is right immediately rather than after the next
+provisioning run. It emits `[agents-md] op=specialist-lines account=<id8>
+kept=<n> withheld=<comma-list|none|store-unreadable>`. `system-status` reads the
+same store, so a disabled agent reports `disabled (operator)` rather than
+`missing file`, and the header counts the two separately
+(`<n> registered, missing=<x> disabled=<y>`).
+
 **Account scope.** The route (`server/routes/admin/agents.ts`) never infers an
 account from device state. The two reads resolve from the caller's admin session
 (`requireAdminSession` + the shared `accountDirForSession` in
@@ -3191,8 +3203,8 @@ explicit `?plugin=` parameter, not inferred from `--` in the slug.
 |-------|-----------|
 | `GET /api/admin/agents` | Session-scoped. Lists the session account's public `agents/*/` dirs (never the `admin` agent), its user-created specialists from `plugins/*/agents/*.md`, and its shipped specialists, each row tagged `kind` and `origin` and carrying `risk`, `riskiestTool`, `unresolved` and `disabled`. Returns `{agents, accountId, skipped, specialistsSkipped, shippedSkipped}`. 401 when the session maps to no account. |
 | `GET /api/admin/agents/:slug` | Session-scoped. Without `?plugin=` or `?origin=`, returns a public agent's config fields + four owned docs + a `present` map (a missing or unreadable doc is `''`/`present.<role>=false`, never a 500). With `?plugin=`, that plugin's user-created specialist; with `?origin=shipped`, the shipped one. Both specialist shapes add `{risk, riskiestTool, unresolved, byTool, disabled}`, where `byTool` is one class per declared tool. Selection is explicit rather than inferred, because a premium file and a user-created specialist under a plugin of the same name produce the same slug. Unknown 404s, 401 as above. |
-| `POST /api/admin/agents/:slug/disable?accountId=` | Shipped agents only, enforced here: a slug present in none of the three shipped directories 404s. Moves the file from `specialists/agents/` to `specialists/agents-disabled/` and records the basename in the 0600 store. Returns `{ok, moved}`; `moved:false` means the agent existed only as a bundled template, so nothing was there to move and the store entry is what stops the next provisioning run delivering it. The store is read strictly before anything moves, so an unreadable store 500s with the file untouched rather than rewriting the file whole from an empty set and dropping every other disabled agent. Same `accountId` contract as delete. |
-| `POST /api/admin/agents/:slug/enable?accountId=` | Covers both of disable's outcomes. Returns `{ok, restored}`: a quarantined file moves back (`restored:true`); a bundled-only agent has nothing to move, so clearing the store entry is the whole job (`restored:false`), which is what stops provisioning withholding it. Treating that second case as "nothing to restore" made disable a one-way door. 404 only when neither directory nor store knows the agent. |
+| `POST /api/admin/agents/:slug/disable?accountId=` | Shipped agents only, enforced here: a slug present in none of the three shipped directories 404s. Moves the file from `specialists/agents/` to `specialists/agents-disabled/` and records the basename in the 0600 store. Returns `{ok, moved}`; `moved:false` means the agent existed only as a bundled template, so nothing was there to move and the store entry is what stops the next provisioning run delivering it. The store is read strictly before anything moves, so an unreadable store 500s with the file untouched rather than rewriting the file whole from an empty set and dropping every other disabled agent. Returns `routingReconciled`, which is `false` when the AGENTS.md reconcile threw: the move and the store write already happened, so the request is not failed, and the caller is told rather than left assuming the prose is correct. Same `accountId` contract as delete. |
+| `POST /api/admin/agents/:slug/enable?accountId=` | Covers both of disable's outcomes. Returns `{ok, restored}`: a quarantined file moves back (`restored:true`); a bundled-only agent has nothing to move, so clearing the store entry is the whole job (`restored:false`), which is what stops provisioning withholding it. Treating that second case as "nothing to restore" made disable a one-way door. 404 only when neither directory nor store knows the agent. Carries the same `routingReconciled` field; the restored file is what puts the routing line back. |
 | `DELETE /api/admin/agents/:slug?accountId=` | Public agents only, on the named validated account. Removes the dir after `deleteAgentProjection`; refuses the `admin` slug (403) and a missing/unknown `accountId` (400) with no write. Loud-fail: a graph-cleanup throw aborts the file removal. |
 | `POST /api/admin/agents/:slug/project?accountId=` | Re-projects the named account's on-disk agent into the graph. Same `accountId` contract as delete. |
 

package/payload/platform/plugins/admin/skills/whats-new/SKILL.md

@@ -9,6 +9,12 @@ Invoked by the admin agent directly.
 
 This is the platform's release timeline, newest first. Each entry shows the date it shipped and the version it shipped in, so you can tell the operator how current their install is. To compare, read the installed version from `capabilities-here` and match it against the versions below. Keep answers high level and in plain English; this is a summary, not a full commit log.
 
+## 2026-07-27 (0.1.515)
+
+- Disabling an agent now takes effect straight away: it is dropped from the routing table, reported as disabled rather than missing, and the agents file is reconciled on both disable and enable.
+- Scheduled WhatsApp messages and live incoming messages now work out which account they belong to through the same code, so a scheduled send cannot land on a different account than a live reply would.
+- When an account folder cannot be read at startup, the log now reports the actual error and names the files that failed to parse, instead of reporting that there are no accounts.
+
 ## 2026-07-27 (0.1.514)
 
 - Three delete and danger buttons had no visible hover state, because their hover colour resolved to white. They now have a real hover step on the colour ramp.

package/payload/platform/plugins/docs/references/admin-ui.md

@@ -223,6 +223,18 @@ and removes anything named in it, so an upgrade does not silently re-deliver a
 disabled agent. An unreadable store withholds nothing and says so: a corrupt
 file is not evidence that an agent was disabled.
 
+Disabling also reconciles the admin's routing prose. `agents/admin/AGENTS.md`
+carries one `- **specialists:<name>**:` line per dispatchable specialist, and
+`agents-md-bootstrap.sh` used to only ever append, so a disabled agent stayed
+advertised and the admin dispatched to a file that was no longer there. The
+script now withholds a line for every name in the store, and both routes exec it
+after the move, so the prose is right immediately rather than after the next
+provisioning run. It emits `[agents-md] op=specialist-lines account=<id8>
+kept=<n> withheld=<comma-list|none|store-unreadable>`. `system-status` reads the
+same store, so a disabled agent reports `disabled (operator)` rather than
+`missing file`, and the header counts the two separately
+(`<n> registered, missing=<x> disabled=<y>`).
+
 **Account scope.** The route (`server/routes/admin/agents.ts`) never infers an
 account from device state. The two reads resolve from the caller's admin session
 (`requireAdminSession` + the shared `accountDirForSession` in
@@ -238,8 +250,8 @@ explicit `?plugin=` parameter, not inferred from `--` in the slug.
 |-------|-----------|
 | `GET /api/admin/agents` | Session-scoped. Lists the session account's public `agents/*/` dirs (never the `admin` agent), its user-created specialists from `plugins/*/agents/*.md`, and its shipped specialists, each row tagged `kind` and `origin` and carrying `risk`, `riskiestTool`, `unresolved` and `disabled`. Returns `{agents, accountId, skipped, specialistsSkipped, shippedSkipped}`. 401 when the session maps to no account. |
 | `GET /api/admin/agents/:slug` | Session-scoped. Without `?plugin=` or `?origin=`, returns a public agent's config fields + four owned docs + a `present` map (a missing or unreadable doc is `''`/`present.<role>=false`, never a 500). With `?plugin=`, that plugin's user-created specialist; with `?origin=shipped`, the shipped one. Both specialist shapes add `{risk, riskiestTool, unresolved, byTool, disabled}`, where `byTool` is one class per declared tool. Selection is explicit rather than inferred, because a premium file and a user-created specialist under a plugin of the same name produce the same slug. Unknown 404s, 401 as above. |
-| `POST /api/admin/agents/:slug/disable?accountId=` | Shipped agents only, enforced here: a slug present in none of the three shipped directories 404s. Moves the file from `specialists/agents/` to `specialists/agents-disabled/` and records the basename in the 0600 store. Returns `{ok, moved}`; `moved:false` means the agent existed only as a bundled template, so nothing was there to move and the store entry is what stops the next provisioning run delivering it. The store is read strictly before anything moves, so an unreadable store 500s with the file untouched rather than rewriting the file whole from an empty set and dropping every other disabled agent. Same `accountId` contract as delete. |
-| `POST /api/admin/agents/:slug/enable?accountId=` | Covers both of disable's outcomes. Returns `{ok, restored}`: a quarantined file moves back (`restored:true`); a bundled-only agent has nothing to move, so clearing the store entry is the whole job (`restored:false`), which is what stops provisioning withholding it. Treating that second case as "nothing to restore" made disable a one-way door. 404 only when neither directory nor store knows the agent. |
+| `POST /api/admin/agents/:slug/disable?accountId=` | Shipped agents only, enforced here: a slug present in none of the three shipped directories 404s. Moves the file from `specialists/agents/` to `specialists/agents-disabled/` and records the basename in the 0600 store. Returns `{ok, moved}`; `moved:false` means the agent existed only as a bundled template, so nothing was there to move and the store entry is what stops the next provisioning run delivering it. The store is read strictly before anything moves, so an unreadable store 500s with the file untouched rather than rewriting the file whole from an empty set and dropping every other disabled agent. Returns `routingReconciled`, which is `false` when the AGENTS.md reconcile threw: the move and the store write already happened, so the request is not failed, and the caller is told rather than left assuming the prose is correct. Same `accountId` contract as delete. |
+| `POST /api/admin/agents/:slug/enable?accountId=` | Covers both of disable's outcomes. Returns `{ok, restored}`: a quarantined file moves back (`restored:true`); a bundled-only agent has nothing to move, so clearing the store entry is the whole job (`restored:false`), which is what stops provisioning withholding it. Treating that second case as "nothing to restore" made disable a one-way door. 404 only when neither directory nor store knows the agent. Carries the same `routingReconciled` field; the restored file is what puts the routing line back. |
 | `DELETE /api/admin/agents/:slug?accountId=` | Public agents only, on the named validated account. Removes the dir after `deleteAgentProjection`; refuses the `admin` slug (403) and a missing/unknown `accountId` (400) with no write. Loud-fail: a graph-cleanup throw aborts the file removal. |
 | `POST /api/admin/agents/:slug/project?accountId=` | Re-projects the named account's on-disk agent into the graph. Same `accountId` contract as delete. |
 

package/payload/platform/plugins/whatsapp/references/channels-whatsapp.md

@@ -114,7 +114,7 @@ The platform enforces this at multiple levels:
 |------|-----------|------|
 | **Self phone** | The WhatsApp account's own phone number (the phone that scanned the QR code). Self-chat only. | `phonesMatch(senderPhone, selfPhone)` in `access-control.ts` |
 | **Admin phones** | Phones listed in `adminPhones` in `account.json`. The user's personal phone is auto-registered on QR link; additional phones are added via `whatsapp-config action: "add-admin-phone"`. Their admin session is scoped to the **house** account. `adminPhones` is authoritative only on the account that owns the WhatsApp paired socket (the house): `add-admin-phone` is refused on any other account, and a list left on a non-socket (sub-)account is inert and purged at boot with `[admin-identity] op=purge-nonsocket-adminphone`. To answer "is this phone a manager?" read the house account's `adminPhones` + `accountManagers` only — never a sub-account's list. | `isAdminPhone()` in `access-control.ts` — iterates `adminPhones` |
-| **Account managers** | Phones in the `accountManagers` map (`account.json`, phone → sub-account binding), added via `whatsapp-config action: "add-account-manager"`. Scoped to the **bound sub-account**, not the house. Disjoint from `adminPhones` — a phone is a house admin or a sub-account manager, never both. Each binding has a **mode**: `active` (default) is a full admin session that can reply and manage the sub-account; `passive` is a constrained requirement-intake spawn (only `work-create`, no reply). | `managedAccountFor()` in `access-control.ts` resolves the sub-account + mode **once**; `checkDmAccess` returns `effectiveAccountId` + `passive`, and `ensureChannelSession` consumes them without re-resolving |
+| **Account managers** | Phones in the `accountManagers` map (`account.json`, phone → sub-account binding), added via `whatsapp-config action: "add-account-manager"`. Scoped to the **bound sub-account**, not the house. Disjoint from `adminPhones` — a phone is a house admin or a sub-account manager, never both. Each binding has a **mode**: `active` (default) is a full admin session that can reply and manage the sub-account; `passive` is a constrained requirement-intake spawn (only `work-create`, no reply). Like `adminPhones`, the map is authoritative only on the account that owns the paired socket: `add-account-manager` is refused on any other account with `reason: "not-socket-account"` (a binding that also names the house reports `house-account-binding` instead — the value check runs first), and a map left on a non-socket account is inert and purged at boot with `[admin-identity] op=purge-nonsocket-accountmanager`. That boot purge stands down, logging `resolver disagreement`, when the account the manager loads its config from is not the `role:"house"` account, because there the "non-socket" map is the live one. | `managedAccountFor()` in `access-control.ts` resolves the sub-account + mode **once**; `checkDmAccess` returns `effectiveAccountId` + `passive`, and `ensureChannelSession` consumes them without re-resolving |
 | **Public/unknown** | Any phone that is not self, not in `adminPhones`, and not in `accountManagers`. Subject to DM policy gating. | Everything else in `checkDmAccess()` |
 
 **Critical distinction:** The *self phone* is the paired device's number (the WhatsApp account SiteDesk controls). The *admin phone* is the user's personal phone (the phone they message *from*). These are typically different numbers. If the user's personal phone is not in `adminPhones` or `accountManagers`, their messages route as public — not admin.
@@ -139,7 +139,7 @@ A passive-bound phone that DMs a requirement gets exactly one `:Task` filed unde
 
 **Single source of truth + fail-closed.** The effective account is resolved **exactly once**, in the gate: `checkDmAccess` returns `effectiveAccountId` (the house account for owner/`adminPhones`/public, the bound sub-account for a manager), and that value threads through the inbound payload → gateway → `ensureChannelSession`, which spawns into it **without re-reading** the `accountManagers` map. There is no second resolution and no `?? accountId` house fallback: if a manager's bound sub-account is not a valid account, the inbound is **rejected** (no session spawned, no reply), never routed to the house. This closes the escalation where a divergence between two independent map reads handed a scoped manager a house-owner admin session. Observable signals: `op=account-manager-route … effectiveAccount=… source=gate` on a routed manager inbound; `op=account-manager-reject … reason=unresolved-effective-account` on the fail-closed drop; a standing `op=escalation-tripwire` belt that can only fire if a future change reintroduces the divergence. The belt compares the manager's effective account against the **house** UUID, not against the account inbound persists to — on an install that sets `channelRoutingAccountId` those differ, and a manager bound to the routing target is a legitimate binding that must admit. The binding write path now refuses a house-account binding at write time, so no new one can be created; a binding written before that refusal existed is still on disk and is what the belt catches.
 
-**The scheduler path fails closed too.** A scheduled dispatch (`POST /api/channel/schedule-inject`) reaches the same spawn machine without going through the gate, resolving its own effective account via `effectiveAccountFor`. That resolver carries the same single-source + fail-closed shape: a non-manager destination scopes to the house (an owner/admin's real scope), a valid manager scopes to the bound sub-account, and a manager whose bound sub-account is not a valid account resolves to nothing — the route **rejects** (`op=schedule-account-manager-reject … reason=unresolved-effective-account`, HTTP 403, no spawn, no reply), never routing to the house. There is no `?? accountId` fallback on this path either. Telegram scheduled dispatch is house-only by construction (no account-manager routing), so there is nothing to fail closed there.
+**The scheduler path fails closed too, and resolves the same account inbound does.** A scheduled dispatch (`POST /api/channel/schedule-inject`) reaches the same spawn machine without going through the gate, resolving its own effective account via `effectiveAccountFor`. That resolver carries the same single-source + fail-closed shape: a non-manager destination scopes to the **channel account**, a valid manager scopes to the bound sub-account, and a manager whose bound sub-account is not a valid account resolves to nothing — the route **rejects** (`op=schedule-account-manager-reject … reason=unresolved-effective-account`, HTTP 403, no spawn, no reply), never routing to the house. There is no `?? accountId` fallback on this path either. The channel account is the `channelRoutingAccountId` target when the house names a valid one and the house itself otherwise, which is exactly what a live inbound scopes to — the session id hashes the account, so a scheduled firing to a phone and that phone's own reply must resolve the same one or they become two sessions for one person. The scheduled resolver is not handed the house at all, so it cannot return it as a scope. One window is still open: the live path resolves the channel account once when the connection starts, so a repoint made while the connection is up is seen by the scheduled path first. Telegram scheduled dispatch is house-only by construction (no account-manager routing), so there is nothing to fail closed there, and Telegram scopes to the house rather than the channel account on both of its paths.
 
 **Schedule-time destination validation is a distinct, earlier layer.** The `effectiveAccountFor` resolution above runs at *fire* time to scope the spawn. Separately, when a schedule is *created or updated* (and re-checked every heartbeat by the standing audit), the scheduler validates the WhatsApp `agentDispatch` destination against the same house authority. It reads the authoritative `adminPhones` + `accountManagers` from the socket-owning **house** account — never the event's own `account.json`, whose manager map is inert — via the one shared `validateAgentDestination`. The destination's registered account (the house for an admin, the bound sub-account for a manager) must equal the account that created the schedule; the house/owner may target any registered admin or manager, a sub-account is locked to its own manager(s). A refusal names the true cause: `not-registered` (in no house list) or `cross-account destinationAccount=… scheduleAccount=…` (registered to a different account). Create-time and fire-time emit the identical reason codes, so a schedule that passes creation but later drifts is explained rather than silently dropped. This closes the bug where the validator read a sub-account's own (empty) manager map and refused a genuinely registered manager whose binding lives on the house.
 

package/payload/platform/scripts/__tests__/agents-md-bootstrap.test.sh

@@ -102,6 +102,53 @@ assert_eq "$AGENTS_LINES" "$CORE_FILES" "doctrine:agents-md-line-count-equals-co
 assert_not_contains "$TMP/agents/admin/AGENTS.md" "premium--special" "doctrine:premium-plugin-agent-skipped"
 rm -rf "$TMP"
 
+# Case 5 (Task 2016) — a name in the disabled store gets no routing line.
+TMP=$(make_account)
+bash "$BOOTSTRAP" "$TMP" >/dev/null
+printf '{"disabled":["beta-specialist.md"]}\n' > "$TMP/agents-disabled.json"
+OUT=$(bash "$BOOTSTRAP" "$TMP")
+assert_not_contains "$TMP/agents/admin/AGENTS.md" "- **specialists:beta-specialist**: " "withhold:beta-line-gone"
+assert_contains "$TMP/agents/admin/AGENTS.md" "- **specialists:alpha-specialist**: " "withhold:alpha-kept"
+assert_contains "$TMP/agents/admin/AGENTS.md" "- **specialists:gamma-specialist**: " "withhold:gamma-kept"
+assert_matches "$OUT" "op=specialist-lines account=[^ ]+ kept=2 withheld=beta-specialist" "withhold:log-line"
+
+# Case 6 (Task 2016) — clearing the store restores the line on the next run.
+printf '{"disabled":[]}\n' > "$TMP/agents-disabled.json"
+OUT=$(bash "$BOOTSTRAP" "$TMP")
+assert_contains "$TMP/agents/admin/AGENTS.md" "- **specialists:beta-specialist**: " "restore:beta-back"
+assert_matches "$OUT" "op=specialist-lines account=[^ ]+ kept=3 withheld=none" "restore:log-line"
+rm -rf "$TMP"
+
+# Case 7 (Task 2016) — a malformed store removes nothing and says so. A corrupt
+# file is not evidence that an agent was disabled.
+TMP=$(make_account)
+bash "$BOOTSTRAP" "$TMP" >/dev/null
+printf '{ not json' > "$TMP/agents-disabled.json"
+OUT=$(bash "$BOOTSTRAP" "$TMP")
+assert_contains "$TMP/agents/admin/AGENTS.md" "- **specialists:alpha-specialist**: " "badstore:alpha-kept"
+assert_contains "$TMP/agents/admin/AGENTS.md" "- **specialists:beta-specialist**: " "badstore:beta-kept"
+assert_matches "$OUT" "op=specialist-lines account=[^ ]+ kept=3 withheld=store-unreadable" "badstore:log-line"
+rm -rf "$TMP"
+
+# Case 8 (Task 2016) — a store entry that breaks the `[a-z][a-z0-9-]*` name
+# convention is ignored, never interpolated into the matcher. `.*` would
+# otherwise match every specialist line and delete the whole routing table.
+TMP=$(make_account)
+bash "$BOOTSTRAP" "$TMP" >/dev/null
+printf '{"disabled":[".*.md"]}\n' > "$TMP/agents-disabled.json"
+OUT=$(bash "$BOOTSTRAP" "$TMP")
+assert_contains "$TMP/agents/admin/AGENTS.md" "- **specialists:alpha-specialist**: " "badname:alpha-kept"
+assert_contains "$TMP/agents/admin/AGENTS.md" "- **specialists:beta-specialist**: " "badname:beta-kept"
+assert_contains "$TMP/agents/admin/AGENTS.md" "- **specialists:gamma-specialist**: " "badname:gamma-kept"
+assert_matches "$OUT" "op=specialist-lines account=[^ ]+ kept=3 withheld=none" "badname:log-line"
+rm -rf "$TMP"
+
+# Case 9 (Task 2016) — no store on disk is the cold-install path.
+TMP=$(make_account)
+OUT=$(bash "$BOOTSTRAP" "$TMP")
+assert_matches "$OUT" "op=specialist-lines account=[^ ]+ kept=3 withheld=none" "nostore:log-line"
+rm -rf "$TMP"
+
 echo
 echo "PASS: $PASS, FAIL: $FAIL"
 if [ "$FAIL" -gt 0 ]; then

package/payload/platform/scripts/lib/agents-md-bootstrap.sh

@@ -10,9 +10,19 @@
 # matches `^- **specialists:<name>**:` are preserved verbatim (operator-tuned
 # lines never get clobbered); missing entries are appended.
 #
-# Emits one stdout observability line, two-space indented to match the
+# A name in <account_dir>/agents-disabled.json (Task 2016) gets no routing line:
+# an existing one is removed and the walk below skips it. The store is the
+# operator's intent, so this holds even in the drift state where the file is
+# still live — the standing agent-parity check is what reports that drift. An
+# unreadable store withholds nothing, matching provision-account-dir.sh: a
+# corrupt file is not evidence that an agent was disabled. A store entry that
+# breaks the name convention below is ignored rather than interpolated: `.*`
+# would otherwise match every routing line and take the whole table with it.
+#
+# Emits two stdout observability lines, two-space indented to match the
 # surrounding setup-account.sh log style:
 #   "  [admin-bootstrap] AGENTS.md specialists=<n> appended=<m> existing=<k>"
+#   "  [agents-md] op=specialist-lines account=<id8> kept=<n> withheld=<comma-list|none|store-unreadable>"
 #
 # Names must follow the `[a-z][a-z0-9-]*` convention so direct interpolation
 # in the regex matcher is safe.
@@ -27,6 +37,48 @@ if [ ! -f "$AGENTS_MD" ]; then
   printf '# Installed Roles\n\nDispatch via the Agent tool with `subagent_type: "specialists:{name}"`.\n\n' > "$AGENTS_MD"
 fi
 
+# --- Disabled-agent reconcile (Task 2016) ------------------------------------
+_store="$ACCOUNT_DIR/agents-disabled.json"
+_withheld_names=""
+_withheld_field="none"
+if [ -f "$_store" ]; then
+  if _withheld_names=$(python3 -c '
+import json, re, sys
+try:
+    parsed = json.load(open(sys.argv[1]))
+except Exception:
+    raise SystemExit(1)
+names = parsed.get("disabled")
+if not isinstance(names, list):
+    raise SystemExit(1)
+for n in sorted(names):
+    if isinstance(n, str) and n.endswith(".md") and re.fullmatch(r"[a-z][a-z0-9-]*", n[:-3]):
+        print(n[:-3])
+' "$_store" 2>/dev/null); then
+    if [ -n "$_withheld_names" ]; then
+      _withheld_field=$(echo "$_withheld_names" | paste -sd, -)
+    fi
+  else
+    _withheld_names=""
+    _withheld_field="store-unreadable"
+  fi
+fi
+
+_is_withheld() {
+  [ -n "$_withheld_names" ] || return 1
+  printf '%s\n' "$_withheld_names" | grep -qxF -- "$1"
+}
+
+if [ -n "$_withheld_names" ]; then
+  while IFS= read -r _w; do
+    [ -n "$_w" ] || continue
+    if grep -qE "^- \*\*specialists:${_w}\*\*:" "$AGENTS_MD"; then
+      grep -vE "^- \*\*specialists:${_w}\*\*:" "$AGENTS_MD" > "$AGENTS_MD.tmp" || true
+      mv "$AGENTS_MD.tmp" "$AGENTS_MD"
+    fi
+  done <<< "$_withheld_names"
+fi
+
 _specialists=0
 _appended=0
 _existing=0
@@ -38,6 +90,7 @@ for specialist in "$ACCOUNT_DIR/specialists/agents/"*.md; do
   _name=$(sed -n 's/^name: *//p' "$specialist" | head -1)
   _desc=$(sed -n 's/^description: *"*//p' "$specialist" | sed 's/"$//' | head -1)
   [ -z "$_name" ] && continue
+  if _is_withheld "$_name"; then continue; fi
   _specialists=$((_specialists + 1))
   if grep -qE "^- \*\*specialists:${_name}\*\*:" "$AGENTS_MD"; then
     _existing=$((_existing + 1))
@@ -47,3 +100,7 @@ for specialist in "$ACCOUNT_DIR/specialists/agents/"*.md; do
   _appended=$((_appended + 1))
 done
 echo "  [admin-bootstrap] AGENTS.md specialists=$_specialists appended=$_appended existing=$_existing"
+
+_kept=$(grep -cE '^- \*\*specialists:' "$AGENTS_MD" || true)
+_id8=$(basename "$ACCOUNT_DIR" | cut -c1-8)
+echo "  [agents-md] op=specialist-lines account=$_id8 kept=$_kept withheld=$_withheld_field"

package/payload/platform/services/claude-session-manager/dist/config.d.ts

@@ -74,12 +74,24 @@ export type AccountDirDiagnosis = {
     kind: 'resolved';
     dir: string;
 }
-/** No directory under `accountsRoot` holds an `account.json` — including the
- *  cases where the root is absent or unreadable. A genuinely empty registry. */
+/** No directory under `accountsRoot` holds an `account.json`, and the root is
+ *  either absent (`ENOENT`) or present and holding none. A genuinely empty
+ *  registry, which is the installer's job to fill. `ENOENT` also covers a
+ *  symlink at `data/accounts` pointing nowhere, which reads as absent. */
  | {
     kind: 'no-accounts';
     accountsRoot: string;
 }
+/** `accountsRoot` could not be enumerated: `readdirSync` failed with a code
+ *  other than `ENOENT`. Task 2031 — the registry is unknown, not empty, so
+ *  its count is not zero and the installer remedy does not apply. An ownership
+ *  or permission mismatch on `data/accounts` is the routine outcome of moving
+ *  an install between machines. */
+ | {
+    kind: 'accounts-root-unreadable';
+    accountsRoot: string;
+    errno: string;
+}
 /** No account carries `role:"house"` and more than one candidate exists, so
  *  the pre-migration single-account tolerance cannot apply. */
  | {
@@ -97,8 +109,9 @@ export type AccountDirDiagnosis = {
  *  managed-service model: the single `role:"house"` account, or the sole
  *  account in the pre-migration window (before `setup-account.sh` stamps the
  *  role). Mirrors the installer's `resolveInstallAccountId` so the runtime reads
- *  the same account the installer wrote. Reports no accounts and the two genuine
- *  drift conditions (zero-house with >1 candidate, multiple houses) as distinct
+ *  the same account the installer wrote. Reports no accounts, an unreadable
+ *  accounts root, and the two genuine drift conditions (zero-house with >1
+ *  candidate, multiple houses) as distinct
  *  kinds; the caller surfaces `account-dir-unresolved` naming the kind and
  *  refuses to start, and the boot census (`[account-registry] op=census`) makes
  *  the drift visible in journalctl.
@@ -114,17 +127,18 @@ export declare function diagnoseAccountDir(platformRoot: string): AccountDirDiag
 export declare function resolveAccountDir(platformRoot: string): string | null;
 /** The `account-dir-unresolved` boot-refusal message for a non-resolving
  *  diagnosis. Every branch keeps the `account-dir-unresolved` token so existing
- *  greps still hit, and carries `reason=<kind>` so the three failures are
+ *  greps still hit, and carries `reason=<kind>` so the four failures are
  *  distinguishable from the log line alone. Only `no-accounts` names the
  *  installer: on the two drift branches re-running it adds another account and
- *  deepens the fault. Throws on a resolved diagnosis — there is no failure to
- *  describe, and silently returning prose would let a caller print it. */
+ *  deepens the fault, and on an unreadable root it cannot repair the read.
+ *  Throws on a resolved diagnosis — there is no failure to describe, and
+ *  silently returning prose would let a caller print it. */
 export declare function formatAccountDirUnresolved(d: AccountDirDiagnosis): string;
-/** Registry census — house / client / total counts of the valid accounts under
- *  `accountsRoot`. A dir counts when it holds a parseable `account.json`;
- *  `clients` counts `role:"client"`, and an account with any other or absent
- *  role (the pre-migration unlabelled window) is neither house nor client but
- *  still counted in `total`. Reads roles fresh — house designation is
+/** Registry census — house / client / total counts of the accounts under
+ *  `accountsRoot`. A dir counts when it holds an `account.json`, parseable or
+ *  not; `clients` counts `role:"client"`, and an account with any other or
+ *  absent role (the pre-migration unlabelled window) is neither house nor
+ *  client but still counted in `total`. Reads roles fresh — house designation is
  *  runtime-mutable via the lifecycle tools. Mirrors `resolveAccountDir`'s inline
  *  scan (the manager has no rootDir-clean import path for the account-enumeration
  *  lib). A missing accounts root reads as an empty registry, not a throw. */
@@ -132,12 +146,34 @@ export interface RegistryCensus {
     houses: number;
     clients: number;
     total: number;
+    /** Task 2031 — the `account.json` files whose role could not be read, each
+     *  with the reason. Counted in `total`, the same way a role-less `{}` already
+     *  is, so this census and `diagnoseAccountDir` agree on how many accounts
+     *  exist. `detail` carries the actual error rather than assuming one, so the
+     *  log never claims a file's JSON is malformed when the file could not be
+     *  opened at all. */
+    unreadable: Array<{
+        path: string;
+        detail: string;
+    }>;
+    /** Task 2031 — the errno when `accountsRoot` itself could not be enumerated,
+     *  else null. `ENOENT` is not one: an absent root is an empty registry, so
+     *  its zeros are facts. For any other code the counts are all zero and are
+     *  NOT facts, and `formatRegistryCensus` renders the failure in their place. */
+    rootErrno: string | null;
 }
 export declare function censusAccountsRoot(accountsRoot: string): RegistryCensus;
 /** The standing census log line body. `houses != 1` is the drift signature the
  *  boot emitter checks. Pure formatter so the emitter and its test share one
  *  wording. */
 export declare function formatRegistryCensus(c: RegistryCensus): string;
+/** The `op=census-drift` FATAL body, or null when there is no drift to report.
+ *  Pure so the boot emitter and its test share one rule. `houses` is a fact only
+ *  when the root was readable: on a read failure every count is zero, and
+ *  FATAL-logging "exactly one house is required" against those zeros would
+ *  assert a house count nobody measured (Task 2031). That case is already
+ *  reported by `formatRegistryCensus` on the `op=census` line. */
+export declare function formatCensusDrift(c: RegistryCensus, accountsRoot: string): string | null;
 /** True iff `accountId` is the install's house account, by the same resolution
  *  the boot path uses (single role:"house", or the sole pre-migration account).
  *  Returns false on drift (zero-house-with->1-candidate, or multiple houses),

package/payload/platform/services/claude-session-manager/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,yBAAyB,CAAA;AAGhC,MAAM,WAAW,cAAe,SAAQ,WAAW;IACjD;;4DAEwD;IACxD,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;CACjC;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB;;;;0BAIsB;IACtB,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB;;4EAEwE;IACxE,aAAa,EAAE,MAAM,CAAA;IACrB;;;gEAG4D;IAC5D,eAAe,EAAE,MAAM,CAAA;IACvB;;2EAEuE;IACvE,WAAW,EAAE,MAAM,CAAA;IACnB;;0EAEsE;IACtE,iBAAiB,EAAE,MAAM,CAAA;IACzB,IAAI,EAAE,cAAc,CAAA;IACpB;;;;;;;8BAO0B;IAC1B,UAAU,EAAE,MAAM,CAAA;IAClB;;;qDAGiD;IACjD,iBAAiB,EAAE,iBAAiB,CAAA;IACpC;;gFAE4E;IAC5E,gBAAgB,EAAE,MAAM,CAAA;IACxB;;;6CAGyC;IACzC,SAAS,EAAE,MAAM,CAAA;CAClB;AAyJD;;;;;;;iCAOiC;AACjC,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE;AACnC;gFACgF;GAC9E;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE;AAC/C;+DAC+D;GAC7D;IAAE,IAAI,EAAE,sBAAsB,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAE;AAChF,oDAAoD;GAClD;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAAA;AAEzE;;;;;;;;;;;;;;uEAcuE;AACvE,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,mBAAmB,CAoC5E;AAED;kFACkF;AAClF,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGrE;AAED;;;;;;0EAM0E;AAC1E,wBAAgB,0BAA0B,CAAC,CAAC,EAAE,mBAAmB,GAAG,MAAM,CAwBzE;AAED;;;;;;;6EAO6E;AAC7E,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;CACd;AAED,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,cAAc,CAyBvE;AAED;;eAEe;AACf,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,cAAc,GAAG,MAAM,CAE9D;AAED;;;+EAG+E;AAC/E,wBAAgB,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAI/E;AAED;;;;;gEAKgE;AAChE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,OAAO,CAAA;IAChB,YAAY,EAAE,OAAO,CAAA;CACtB,GAAG,MAAM,GAAG,IAAI,CAGhB;AAED;;;;;;iBAMiB;AACjB,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,OAAO,EAAE,MAAM,EAAE,EACjB,KAAK,EAAE,MAAM,GAAG,IAAI,GACnB,IAAI,CAIN;AAED;;;;;;;;;;;iBAWiB;AACjB,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAChD,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;IACpC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;IAC/B,WAAW,EAAE,OAAO,CAAA;IACpB,MAAM,EAAE,OAAO,CAAA;CAChB,GAAG,MAAM,CAGT;AAED;;;;;;;kCAOkC;AAClC,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI/F;AAUD,wBAAgB,UAAU,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,aAAa,CAwE9E"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,yBAAyB,CAAA;AAGhC,MAAM,WAAW,cAAe,SAAQ,WAAW;IACjD;;4DAEwD;IACxD,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;CACjC;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB;;;;0BAIsB;IACtB,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB;;4EAEwE;IACxE,aAAa,EAAE,MAAM,CAAA;IACrB;;;gEAG4D;IAC5D,eAAe,EAAE,MAAM,CAAA;IACvB;;2EAEuE;IACvE,WAAW,EAAE,MAAM,CAAA;IACnB;;0EAEsE;IACtE,iBAAiB,EAAE,MAAM,CAAA;IACzB,IAAI,EAAE,cAAc,CAAA;IACpB;;;;;;;8BAO0B;IAC1B,UAAU,EAAE,MAAM,CAAA;IAClB;;;qDAGiD;IACjD,iBAAiB,EAAE,iBAAiB,CAAA;IACpC;;gFAE4E;IAC5E,gBAAgB,EAAE,MAAM,CAAA;IACxB;;;6CAGyC;IACzC,SAAS,EAAE,MAAM,CAAA;CAClB;AAyJD;;;;;;;iCAOiC;AACjC,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE;AACnC;;;0EAG0E;GACxE;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE;AAC/C;;;;mCAImC;GACjC;IAAE,IAAI,EAAE,0BAA0B,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE;AAC3E;+DAC+D;GAC7D;IAAE,IAAI,EAAE,sBAAsB,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAE;AAChF,oDAAoD;GAClD;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAAA;AAEzE;;;;;;;;;;;;;;;uEAeuE;AACvE,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,mBAAmB,CAyC5E;AAED;kFACkF;AAClF,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGrE;AAED;;;;;;;4DAO4D;AAC5D,wBAAgB,0BAA0B,CAAC,CAAC,EAAE,mBAAmB,GAAG,MAAM,CAgCzE;AAED;;;;;;;6EAO6E;AAC7E,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb;;;;;yBAKqB;IACrB,UAAU,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACnD;;;oFAGgF;IAChF,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CACzB;AAED,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,cAAc,CAyCvE;AAED;;eAEe;AACf,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,cAAc,GAAG,MAAM,CAS9D;AAED;;;;;kEAKkE;AAClE,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOxF;AAED;;;+EAG+E;AAC/E,wBAAgB,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAI/E;AAED;;;;;gEAKgE;AAChE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,OAAO,CAAA;IAChB,YAAY,EAAE,OAAO,CAAA;CACtB,GAAG,MAAM,GAAG,IAAI,CAGhB;AAED;;;;;;iBAMiB;AACjB,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,OAAO,EAAE,MAAM,EAAE,EACjB,KAAK,EAAE,MAAM,GAAG,IAAI,GACnB,IAAI,CAIN;AAED;;;;;;;;;;;iBAWiB;AACjB,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAChD,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;IACpC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;IAC/B,WAAW,EAAE,OAAO,CAAA;IACpB,MAAM,EAAE,OAAO,CAAA;CAChB,GAAG,MAAM,CAGT;AAED;;;;;;;kCAOkC;AAClC,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI/F;AAUD,wBAAgB,UAAU,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,aAAa,CAwE9E"}

package/payload/platform/services/claude-session-manager/dist/config.js

@@ -137,8 +137,9 @@ function resolveLanIPv4() {
  *  managed-service model: the single `role:"house"` account, or the sole
  *  account in the pre-migration window (before `setup-account.sh` stamps the
  *  role). Mirrors the installer's `resolveInstallAccountId` so the runtime reads
- *  the same account the installer wrote. Reports no accounts and the two genuine
- *  drift conditions (zero-house with >1 candidate, multiple houses) as distinct
+ *  the same account the installer wrote. Reports no accounts, an unreadable
+ *  accounts root, and the two genuine drift conditions (zero-house with >1
+ *  candidate, multiple houses) as distinct
  *  kinds; the caller surfaces `account-dir-unresolved` naming the kind and
  *  refuses to start, and the boot census (`[account-registry] op=census`) makes
  *  the drift visible in journalctl.
@@ -155,10 +156,16 @@ export function diagnoseAccountDir(platformRoot) {
     try {
         entries = readdirSync(accountsRoot);
     }
-    catch {
-        // absent or unreadable root — indistinguishable from an empty registry to
-        // the operator, and the installer wording is right for both.
-        return { kind: 'no-accounts', accountsRoot };
+    catch (err) {
+        // Task 2031 — `ENOENT` is the only code that means the root is absent, and
+        // an absent root is an empty registry. Every other code means something is
+        // at that path and could not be read, where reporting "no account.json
+        // exists, run the installer" states the opposite of the filesystem and
+        // prescribes a remedy that cannot repair a read failure.
+        const code = err.code;
+        if (code === 'ENOENT')
+            return { kind: 'no-accounts', accountsRoot };
+        return { kind: 'accounts-root-unreadable', accountsRoot, errno: code ?? 'unknown' };
     }
     const candidates = [];
     const houses = [];
@@ -200,11 +207,12 @@ export function resolveAccountDir(platformRoot) {
 }
 /** The `account-dir-unresolved` boot-refusal message for a non-resolving
  *  diagnosis. Every branch keeps the `account-dir-unresolved` token so existing
- *  greps still hit, and carries `reason=<kind>` so the three failures are
+ *  greps still hit, and carries `reason=<kind>` so the four failures are
  *  distinguishable from the log line alone. Only `no-accounts` names the
  *  installer: on the two drift branches re-running it adds another account and
- *  deepens the fault. Throws on a resolved diagnosis — there is no failure to
- *  describe, and silently returning prose would let a caller print it. */
+ *  deepens the fault, and on an unreadable root it cannot repair the read.
+ *  Throws on a resolved diagnosis — there is no failure to describe, and
+ *  silently returning prose would let a caller print it. */
 export function formatAccountDirUnresolved(d) {
     const prefix = `[claude-session-manager] account-dir-unresolved reason=${d.kind}:`;
     switch (d.kind) {
@@ -213,6 +221,12 @@ export function formatAccountDirUnresolved(d) {
         case 'no-accounts':
             return (`${prefix} no <installDir>/data/accounts/<uuid>/account.json under ${d.accountsRoot}. ` +
                 'The installer (setup-account.sh / writeInstallDefaults) must run before manager start.');
+        case 'accounts-root-unreadable':
+            return (`${prefix} ${d.accountsRoot} exists but could not be read (errno=${d.errno}). ` +
+                'The registry is unknown, not empty: check ownership and permissions on that ' +
+                'directory and its parents, or retry if the errno is transient, then start the ' +
+                'manager again. Accounts already there are untouched, ' +
+                'so do not run the installer, which cannot repair a read failure.');
         case 'zero-house-ambiguous':
             return (`${prefix} ${d.candidateIds.length} accounts under ${d.accountsRoot} and none carries role:"house": ` +
                 `${d.candidateIds.join(', ')}. Exactly one must be stamped role:"house" before the manager can start.`);
@@ -227,12 +241,19 @@ export function censusAccountsRoot(accountsRoot) {
     try {
         entries = readdirSync(accountsRoot);
     }
-    catch {
-        return { houses: 0, clients: 0, total: 0 };
+    catch (err) {
+        // Task 2031 — same split as `diagnoseAccountDir`: only `ENOENT` means the
+        // root is absent, which is an empty registry. Any other code leaves the
+        // registry unknown, and reporting houses=0 clients=0 total=0 for it states
+        // the opposite of the filesystem on a line that re-emits every 300s.
+        const code = err.code;
+        const rootErrno = code === 'ENOENT' ? null : (code ?? 'unknown');
+        return { houses: 0, clients: 0, total: 0, unreadable: [], rootErrno };
     }
     let houses = 0;
     let clients = 0;
     let total = 0;
+    const unreadable = [];
     for (const entry of entries) {
         const configPath = join(accountsRoot, entry, 'account.json');
         if (!existsSync(configPath))
@@ -241,8 +262,17 @@ export function censusAccountsRoot(accountsRoot) {
         try {
             cfg = JSON.parse(readFileSync(configPath, 'utf-8'));
         }
-        catch {
-            // unparseable account.json — excluded from the registry entirely
+        catch (err) {
+            // Task 2031 — an account.json whose role cannot be read is an account
+            // whose role is unknown, not an account that is absent.
+            // `diagnoseAccountDir` already counts it as a candidate; excluding it here
+            // made one boot emit total=1 beside a diagnosis naming two accounts. The
+            // cause (parse failure or read failure) is carried, not assumed.
+            total++;
+            unreadable.push({
+                path: configPath,
+                detail: err instanceof Error ? err.message : String(err),
+            });
             continue;
         }
         total++;
@@ -251,13 +281,33 @@ export function censusAccountsRoot(accountsRoot) {
         else if (cfg.role === 'client')
             clients++;
     }
-    return { houses, clients, total };
+    return { houses, clients, total, unreadable, rootErrno: null };
 }
 /** The standing census log line body. `houses != 1` is the drift signature the
  *  boot emitter checks. Pure formatter so the emitter and its test share one
  *  wording. */
 export function formatRegistryCensus(c) {
-    return `op=census houses=${c.houses} clients=${c.clients} total=${c.total}`;
+    // Task 2031 — an unreadable root has no counts to state, so the line reports
+    // the read failure instead of three zeros that would read as an empty
+    // registry.
+    if (c.rootErrno !== null)
+        return `op=census root-unreadable errno=${c.rootErrno}`;
+    return (`op=census houses=${c.houses} clients=${c.clients} total=${c.total} ` +
+        `unreadable=${c.unreadable.length}`);
+}
+/** The `op=census-drift` FATAL body, or null when there is no drift to report.
+ *  Pure so the boot emitter and its test share one rule. `houses` is a fact only
+ *  when the root was readable: on a read failure every count is zero, and
+ *  FATAL-logging "exactly one house is required" against those zeros would
+ *  assert a house count nobody measured (Task 2031). That case is already
+ *  reported by `formatRegistryCensus` on the `op=census` line. */
+export function formatCensusDrift(c, accountsRoot) {
+    if (c.rootErrno !== null)
+        return null;
+    if (c.houses === 1)
+        return null;
+    return (`op=census-drift FATAL houses=${c.houses} clients=${c.clients} total=${c.total} ` +
+        `accountsRoot=${accountsRoot} — exactly one role:"house" account is required`);
 }
 /** True iff `accountId` is the install's house account, by the same resolution
  *  the boot path uses (single role:"house", or the sole pre-migration account).