@rubytech/create-sitedesk-code 0.1.535 → 0.1.537

package/payload/server/server.js

@@ -14,6 +14,8 @@ import {
   cleanupLeakedPremiumSubs,
   clearRateLimit,
   clientIpMiddleware,
+  closePageTarget,
+  createPageTarget,
   createRemoteSession,
   emitMissingOnResolve,
   fetchPageTargets,
@@ -52,6 +54,7 @@ import {
   setSessionIdForSession,
   setWantsPriorConversation,
   stripAttachmentMetaSuffix,
+  tabsLog,
   tryCookieBridgeForConversation,
   unregisterSession,
   validatePasswordStrength,
@@ -59,7 +62,7 @@ import {
   verifyRemotePassword,
   vncLog,
   walkPremiumBundles
-} from "./chunk-DLG7XSLA.js";
+} from "./chunk-IALJPXIO.js";
 import {
   DATA_ROOT,
   EXTRACTED_TEXT_SUFFIX,
@@ -192,7 +195,7 @@ import {
   waitForConnection,
   warnNonUuidAccount,
   writeChatMetadataMerged
-} from "./chunk-4QCYFTAI.js";
+} from "./chunk-44Z4ZFYS.js";
 import {
   ACCOUNTS_DIR,
   BIN_DIR,
@@ -2382,11 +2385,11 @@ function staticCacheHeaders(root) {
 }
 
 // server/lib/static-mounts.ts
-function mountStaticFiles(app76, root) {
-  app76.use("/*", staticCacheHeaders(root));
-  app76.use("/assets/*", assetsVary);
-  app76.use("/assets/*", serveStatic({ root, precompressed: true }));
-  app76.use("/*", serveStatic({ root }));
+function mountStaticFiles(app77, root) {
+  app77.use("/*", staticCacheHeaders(root));
+  app77.use("/assets/*", assetsVary);
+  app77.use("/assets/*", serveStatic({ root, precompressed: true }));
+  app77.use("/*", serveStatic({ root }));
 }
 var assetsVary = async (c, next) => {
   await next();
@@ -3586,8 +3589,8 @@ function webchatTurnTimeoutMs() {
   return Number(process.env.WEBCHAT_TURN_TIMEOUT_MS ?? String(2 * 6e4));
 }
 function createChatRoutes(deps) {
-  const app76 = new Hono();
-  app76.post("/", async (c) => {
+  const app77 = new Hono();
+  app77.post("/", async (c) => {
     console.log(`[chat-route] entered route=public method=POST`);
     const contentType = c.req.header("content-type") ?? "";
     const account = resolveAccount();
@@ -3859,7 +3862,7 @@ ${result.result.text}` : result.result.text;
       }
     });
   });
-  return app76;
+  return app77;
 }
 
 // server/routes/channel/schedule-inject.ts
@@ -4803,8 +4806,8 @@ function transcriptBoundary(sessionKey) {
   }
 }
 function createScheduleInjectRoutes(deps) {
-  const app76 = new Hono();
-  app76.post("/", async (c) => {
+  const app77 = new Hono();
+  app77.post("/", async (c) => {
     const env = c.env;
     const remoteAddr = env?.incoming?.socket?.remoteAddress ?? "";
     if (!isLoopbackAddr(remoteAddr)) {
@@ -4915,7 +4918,7 @@ function createScheduleInjectRoutes(deps) {
     console.error(`${TAG5} op=inject-spawn eventId=${eventId} sessionId=${sessionId} result=ok status=-`);
     return c.json({ ok: true, sessionKey: sessionId, ...transcriptBoundary(sessionId) }, 200);
   });
-  return app76;
+  return app77;
 }
 
 // server/index.ts
@@ -5021,7 +5024,7 @@ async function defaultHttpGet(url) {
   }
 }
 async function defaultResolve(accountId) {
-  const { resolveSocket: resolveSocket2 } = await import("./manager-ZNHQQCED.js");
+  const { resolveSocket: resolveSocket2 } = await import("./manager-AJSPM6X2.js");
   return resolveSocket2(accountId);
 }
 async function fetchAvatar(accountId, jid, deps = {}) {
@@ -5841,7 +5844,7 @@ function setDispatchInbound(accountDir, accountId, value, ctx) {
   const id = accountId.trim();
   if (!id) return { ok: false, reason: "missing-account-id", error: "Missing account id." };
   const verdict = resolveKey(id, ctx);
-  const failure = policyKeyFailure(verdict, id, { refuseHouse: false });
+  const failure = policyKeyFailure(verdict, id, null);
   if (failure) {
     console.error(`${TAG10} op=set-dispatch-inbound account=${id} ok=false reason=${failure.reason}`);
     return failure;
@@ -5877,16 +5880,9 @@ function setDispatchInbound(accountDir, accountId, value, ctx) {
     return { ok: false, reason: "write-failed", error: msg };
   }
 }
-function policyKeyFailure(verdict, accountId, opts) {
+function policyKeyFailure(verdict, accountId, houseFailure) {
   if (verdict.kind === "self") return null;
-  if (verdict.kind === "house") {
-    if (!opts.refuseHouse) return null;
-    return {
-      ok: false,
-      reason: "house-policy-is-top-level",
-      error: `Account "${accountId}" is the house. Its dmPolicy, adminPhones and allowFrom are the TOP-LEVEL WhatsApp config, not a per-account override \u2014 set them with the "update-config" action (adminPhones also has add-admin-phone / remove-admin-phone). Writing a per-account slice for the house would create a second home for the same three fields.`
-    };
-  }
+  if (verdict.kind === "house") return houseFailure;
   if (verdict.kind === "ambiguous") {
     return {
       ok: false,
@@ -5900,6 +5896,13 @@ function policyKeyFailure(verdict, accountId, opts) {
     error: `Account "${accountId}" has no WhatsApp credential directory, so it has no config slice the inbound gate would read. Pair the account first.`
   };
 }
+function policyHouseFailure(accountId) {
+  return {
+    ok: false,
+    reason: "house-policy-is-top-level",
+    error: `Account "${accountId}" is the house. Its dmPolicy, adminPhones and allowFrom are the TOP-LEVEL WhatsApp config, not a per-account override \u2014 set them with the "update-config" action (adminPhones also has add-admin-phone / remove-admin-phone). Writing a per-account slice for the house would create a second home for the same three fields.`
+  };
+}
 function resolveKey(accountId, ctx) {
   return resolveAccountConfigKey({
     targetAccountId: accountId,
@@ -5922,7 +5925,7 @@ function setAccountPolicy(accountDir, accountId, policy, ctx) {
     };
   }
   const verdict = resolveKey(id, ctx);
-  const failure = policyKeyFailure(verdict, id, { refuseHouse: true });
+  const failure = policyKeyFailure(verdict, id, policyHouseFailure(id));
   if (failure) {
     console.error(`${TAG10} op=set-account-policy account=${id} ok=false reason=${failure.reason}`);
     return failure;
@@ -5960,7 +5963,7 @@ function readAccountPolicy(accountDir, accountId, ctx) {
   const id = accountId.trim();
   if (!id) return { ok: false, reason: "missing-account-id", error: "Missing account id." };
   const verdict = resolveKey(id, ctx);
-  const failure = policyKeyFailure(verdict, id, { refuseHouse: false });
+  const failure = policyKeyFailure(verdict, id, null);
   if (failure) return failure;
   const key = verdict.key;
   try {
@@ -6032,14 +6035,43 @@ function readAccountManagers(accountDir) {
     return {};
   }
 }
-function setPublicAgent(accountDir, slug) {
+function publicAgentHouseFailure(accountId) {
+  return {
+    ok: false,
+    reason: "house-public-agent-is-top-level",
+    error: `Account "${accountId}" is the house. Its publicAgent and publicAgentEnabled are the TOP-LEVEL WhatsApp config \u2014 set them by calling this action without an accountId. Writing a per-account slice for the house would create a second home for the same field.`
+  };
+}
+function publicAgentKey(target) {
+  if (target.scope === "top-level") return { key: null };
+  const id = target.accountId.trim();
+  if (!id) return { ok: false, reason: "missing-account-id", error: "Missing account id." };
+  const verdict = resolveKey(id, target.ctx);
+  const failure = policyKeyFailure(verdict, id, publicAgentHouseFailure(id));
+  if (failure) return failure;
+  return { key: verdict.key };
+}
+function publicAgentScopeLabel(target) {
+  return target.scope === "top-level" ? "the top-level default" : `account ${target.accountId}`;
+}
+function setPublicAgent(accountDir, slug, target) {
   const trimmed = slug.trim();
   if (!trimmed) {
-    return { ok: false, error: "Agent slug cannot be empty." };
+    return { ok: false, reason: "missing-slug", error: "Agent slug cannot be empty." };
   }
-  const agentConfigPath = join12(accountDir, "agents", trimmed, "config.json");
+  const resolvedKey = publicAgentKey(target);
+  if ("ok" in resolvedKey) {
+    console.error(`${TAG10} op=set-public-agent accountId=${publicAgentScopeLabel(target)} ok=false reason=${resolvedKey.reason}`);
+    return resolvedKey;
+  }
+  const key = resolvedKey.key;
+  const agentConfigPath = join12(target.agentsDir, "agents", trimmed, "config.json");
   if (!existsSync6(agentConfigPath)) {
-    return { ok: false, error: `Agent "${trimmed}" not found \u2014 no config.json at ${agentConfigPath}. Check the agent slug and try again.` };
+    return {
+      ok: false,
+      reason: "agent-not-found",
+      error: `Agent "${trimmed}" not found \u2014 no config.json at ${agentConfigPath}. Check the agent slug and try again.`
+    };
   }
   try {
     const config = readConfig(accountDir);
@@ -6047,21 +6079,96 @@ function setPublicAgent(accountDir, slug) {
       config.whatsapp = {};
     }
     const wa = config.whatsapp;
-    wa.publicAgent = trimmed;
+    if (key) {
+      if (!wa.accounts || typeof wa.accounts !== "object") wa.accounts = {};
+      const accounts = wa.accounts;
+      if (!accounts[key] || typeof accounts[key] !== "object") accounts[key] = {};
+      accounts[key].publicAgent = trimmed;
+    } else {
+      wa.publicAgent = trimmed;
+    }
     const parsed = WhatsAppConfigSchema.safeParse(wa);
     if (!parsed.success) {
       const msg = parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
-      return { ok: false, error: `Validation failed: ${msg}` };
+      return { ok: false, reason: "validation-failed", error: `Validation failed: ${msg}` };
     }
     config.whatsapp = parsed.data;
     writeConfig(accountDir, config);
-    console.error(`${TAG10} publicAgent set to ${trimmed}`);
+    console.error(
+      `${TAG10} op=set-public-agent accountId=${target.scope === "top-level" ? "top-level" : target.accountId} key=${key ?? "top-level"} slug=${trimmed} ok=true`
+    );
     reloadManagerConfig(accountDir);
-    return { ok: true, message: `Public agent set to "${trimmed}". WhatsApp messages from non-admin phones will be handled by this agent.` };
+    return {
+      ok: true,
+      key,
+      message: `Public agent for ${publicAgentScopeLabel(target)} set to "${trimmed}". WhatsApp messages from non-admin phones will be handled by this agent.`
+    };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG10} setPublicAgent failed: ${msg}`);
-    return { ok: false, error: msg };
+    console.error(`${TAG10} op=set-public-agent ok=false reason=write-failed detail=${msg}`);
+    return { ok: false, reason: "write-failed", error: msg };
+  }
+}
+function setPublicAgentEnabled(accountDir, enabled, target) {
+  const scope = publicAgentScopeLabel(target);
+  const resolvedKey = publicAgentKey(target);
+  if ("ok" in resolvedKey) {
+    console.error(`${TAG10} op=set-public-agent-enabled accountId=${scope} ok=false reason=${resolvedKey.reason}`);
+    return resolvedKey;
+  }
+  const key = resolvedKey.key;
+  if (enabled) {
+    const resolved = key ? resolvePublicAgent(accountDir, { accountId: key, isHouse: false }) : resolvePublicAgent(accountDir, { accountId: "", isHouse: true });
+    if (!resolved) {
+      return {
+        ok: false,
+        reason: "no-public-agent",
+        error: `Cannot enable public answering for ${scope}: no public agent is configured. Set one with set-public-agent first.`
+      };
+    }
+    const agentConfigPath = join12(target.agentsDir, "agents", resolved.slug, "config.json");
+    if (!existsSync6(agentConfigPath)) {
+      return {
+        ok: false,
+        reason: "agent-not-found",
+        error: `Cannot enable public answering for ${scope}: the configured agent "${resolved.slug}" has no config.json at ${agentConfigPath}. Point publicAgent at an existing agent first.`
+      };
+    }
+  }
+  try {
+    const config = readConfig(accountDir);
+    if (!config.whatsapp || typeof config.whatsapp !== "object") {
+      config.whatsapp = {};
+    }
+    const wa = config.whatsapp;
+    if (key) {
+      if (!wa.accounts || typeof wa.accounts !== "object") wa.accounts = {};
+      const accounts = wa.accounts;
+      if (!accounts[key] || typeof accounts[key] !== "object") accounts[key] = {};
+      accounts[key].publicAgentEnabled = enabled;
+    } else {
+      wa.publicAgentEnabled = enabled;
+    }
+    const parsed = WhatsAppConfigSchema.safeParse(wa);
+    if (!parsed.success) {
+      const msg = parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
+      return { ok: false, reason: "validation-failed", error: `Validation failed: ${msg}` };
+    }
+    config.whatsapp = parsed.data;
+    writeConfig(accountDir, config);
+    console.error(
+      `${TAG10} op=set-public-agent-enabled accountId=${target.scope === "top-level" ? "top-level" : target.accountId} key=${key ?? "top-level"} enabled=${enabled} ok=true`
+    );
+    reloadManagerConfig(accountDir);
+    return {
+      ok: true,
+      key,
+      message: enabled ? `Public answering enabled for ${scope}. Non-admin WhatsApp senders will be answered by the configured public agent.` : `Public answering disabled for ${scope}. Non-admin WhatsApp senders receive no reply; account managers are still notified.`
+    };
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    console.error(`${TAG10} op=set-public-agent-enabled ok=false reason=write-failed detail=${msg}`);
+    return { ok: false, reason: "write-failed", error: msg };
   }
 }
 function resolvePublicAgent(accountDir, opts) {
@@ -6075,6 +6182,7 @@ function resolvePublicAgent(accountDir, opts) {
     if (typeof accountSlug === "string" && accountSlug.trim()) {
       return { slug: accountSlug.trim(), source: "account" };
     }
+    if (!opts.isHouse) return null;
     const topSlug = wa.publicAgent;
     if (typeof topSlug === "string" && topSlug.trim()) {
       return { slug: topSlug.trim(), source: "top-level" };
@@ -6084,6 +6192,25 @@ function resolvePublicAgent(accountDir, opts) {
     return null;
   }
 }
+function resolvePublicAgentEnabled(accountDir, opts) {
+  try {
+    const config = readConfig(accountDir);
+    const wa = config.whatsapp;
+    if (!wa) return { enabled: false, source: "default" };
+    const accounts = wa.accounts;
+    const account = accounts?.[opts.accountId];
+    if (typeof account?.publicAgentEnabled === "boolean") {
+      return { enabled: account.publicAgentEnabled, source: "account" };
+    }
+    if (!opts.isHouse) return { enabled: false, source: "default" };
+    if (typeof wa.publicAgentEnabled === "boolean") {
+      return { enabled: wa.publicAgentEnabled, source: "top-level" };
+    }
+    return { enabled: false, source: "default" };
+  } catch {
+    return { enabled: false, source: "default" };
+  }
+}
 function updateConfig(accountDir, fields) {
   const fieldNames = Object.keys(fields);
   if (fieldNames.length === 0) {
@@ -7312,7 +7439,7 @@ app3.post("/reconnect", async (c) => {
 app3.post("/config", async (c) => {
   try {
     const body = await c.req.json().catch(() => ({}));
-    const { action, phone, slug, fields, accountId, managesAccount, mode, policy, party, account: partyAccount } = body;
+    const { action, phone, slug, fields, accountId, managesAccount, mode, policy, party, account: partyAccount, enabled } = body;
     if (!action || typeof action !== "string") {
       return c.json({ ok: false, error: 'Missing required field "action".' }, 400);
     }
@@ -7357,6 +7484,65 @@ app3.post("/config", async (c) => {
       console.error(`${TAG15} config action=set-account-policy account=${target} ok=${result.ok}${result.ok ? "" : ` reason=${result.reason}`}`);
       return c.json(result, result.ok ? 200 : 400);
     }
+    if (action === "set-public-agent" || action === "get-public-agent" || action === "set-public-agent-enabled" || action === "list-public-agents") {
+      const acct = resolveAccount();
+      if (!acct) return c.json({ ok: false, error: "No account configured." }, 500);
+      const resolved = resolveLifecycleAccountId(c, accountId);
+      const topLevel = resolved.targetSource === "house-default";
+      if (topLevel) {
+        const denial2 = houseSocketScopeDenial(c, `config action=${action}`);
+        if (denial2) return denial2;
+      } else {
+        const denial2 = selfOrHouseScopeDenial(c, resolved.accountId, `config action=${action}`, resolved.targetSource);
+        if (denial2) return denial2;
+      }
+      const targetDir = topLevel ? acct.accountDir : listValidAccounts().find((a) => a.accountId === resolved.accountId)?.accountDir;
+      if (!targetDir) {
+        return c.json({ ok: false, error: `Account "${resolved.accountId}" is not provisioned on this install.` }, 400);
+      }
+      const writeTarget = topLevel ? { scope: "top-level", agentsDir: targetDir } : { scope: "account", accountId: resolved.accountId, agentsDir: targetDir, ctx: accountPolicyContext() };
+      if (action === "set-public-agent") {
+        if (!slug || typeof slug !== "string") {
+          return c.json({ ok: false, error: 'Missing required field "slug" (the agent directory name, e.g. "my-agent").' }, 400);
+        }
+        const result = setPublicAgent(acct.accountDir, slug, writeTarget);
+        return c.json(result, result.ok ? 200 : 400);
+      }
+      if (action === "set-public-agent-enabled") {
+        if (typeof enabled !== "boolean") {
+          return c.json({ ok: false, error: 'Missing required field "enabled" (true or false).' }, 400);
+        }
+        const result = setPublicAgentEnabled(acct.accountDir, enabled, writeTarget);
+        return c.json(result, result.ok ? 200 : 400);
+      }
+      if (action === "get-public-agent") {
+        const readKey2 = topLevel ? "default" : resolved.accountId;
+        const resolvedAgent = resolvePublicAgent(acct.accountDir, { accountId: readKey2, isHouse: topLevel });
+        console.error(`${TAG15} config action=get-public-agent accountId=${topLevel ? "top-level" : resolved.accountId} slug=${resolvedAgent?.slug ?? "none"} source=${resolvedAgent?.source ?? "none"}`);
+        return c.json({ ok: true, slug: resolvedAgent?.slug ?? null, source: resolvedAgent?.source ?? null });
+      }
+      const agentsDir = resolve7(targetDir, "agents");
+      const agents = [];
+      if (existsSync8(agentsDir)) {
+        try {
+          for (const entry of readdirSync7(agentsDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+            if (!entry.isDirectory() || entry.name === "admin") continue;
+            const configPath3 = resolve7(agentsDir, entry.name, "config.json");
+            if (!existsSync8(configPath3)) continue;
+            try {
+              const parsed = JSON.parse(readFileSync10(configPath3, "utf-8"));
+              agents.push({ slug: entry.name, displayName: parsed.displayName ?? entry.name });
+            } catch {
+              console.error(`${TAG15} config action=list-public-agents error="failed to parse config.json for agent ${entry.name}" \u2014 skipping`);
+            }
+          }
+        } catch (err) {
+          console.error(`${TAG15} config action=list-public-agents error="failed to scan agents directory: ${String(err)}"`);
+        }
+      }
+      console.error(`${TAG15} config action=list-public-agents accountId=${topLevel ? "top-level" : resolved.accountId} count=${agents.length}`);
+      return c.json({ ok: true, agents });
+    }
     if (action === "add-account-manager" || action === "remove-account-manager" || action === "list-account-managers") {
       const acct = resolveAccount();
       if (!acct) return c.json({ ok: false, error: "No account configured." }, 500);
@@ -7468,44 +7654,10 @@ app3.post("/config", async (c) => {
       // Task 2233 — `add-account-manager`, `remove-account-manager` and
       // `list-account-managers` are handled above this switch, on the
       // per-binding gate. They remain valid actions; only their gate moved.
-      case "set-public-agent": {
-        if (!slug || typeof slug !== "string") {
-          return c.json({ ok: false, error: 'Missing required field "slug" (the agent directory name, e.g. "my-agent").' }, 400);
-        }
-        const result = setPublicAgent(account.accountDir, slug);
-        console.error(`${TAG15} config action=set-public-agent slug=${slug} ok=${result.ok}`);
-        return c.json(result, result.ok ? 200 : 400);
-      }
-      case "get-public-agent": {
-        const targetAccount = typeof accountId === "string" && accountId.trim() ? accountId.trim() : "default";
-        const resolved = resolvePublicAgent(account.accountDir, { accountId: targetAccount });
-        console.error(`${TAG15} config action=get-public-agent accountId=${targetAccount} slug=${resolved?.slug ?? "none"} source=${resolved?.source ?? "none"}`);
-        return c.json({ ok: true, slug: resolved?.slug ?? null, source: resolved?.source ?? null });
-      }
-      case "list-public-agents": {
-        const agentsDir = resolve7(account.accountDir, "agents");
-        const agents = [];
-        if (existsSync8(agentsDir)) {
-          try {
-            const entries2 = readdirSync7(agentsDir, { withFileTypes: true });
-            for (const entry of entries2.sort((a, b) => a.name.localeCompare(b.name))) {
-              if (!entry.isDirectory() || entry.name === "admin") continue;
-              const configPath3 = resolve7(agentsDir, entry.name, "config.json");
-              if (!existsSync8(configPath3)) continue;
-              try {
-                const config = JSON.parse(readFileSync10(configPath3, "utf-8"));
-                agents.push({ slug: entry.name, displayName: config.displayName ?? entry.name });
-              } catch {
-                console.error(`${TAG15} config action=list-public-agents error="failed to parse config.json for agent ${entry.name}" \u2014 skipping`);
-              }
-            }
-          } catch (err) {
-            console.error(`${TAG15} config action=list-public-agents error="failed to scan agents directory: ${String(err)}"`);
-          }
-        }
-        console.error(`${TAG15} config action=list-public-agents count=${agents.length}`);
-        return c.json({ ok: true, agents });
-      }
+      // Task 2271 — `set-public-agent`, `get-public-agent`,
+      // `set-public-agent-enabled` and `list-public-agents` are handled above
+      // this switch, on the per-account scope gate. They remain valid actions;
+      // only their gate and their target moved.
       case "schema": {
         const text = serializeWhatsAppSchema();
         console.error(`${TAG15} config action=schema`);
@@ -7549,7 +7701,7 @@ app3.post("/config", async (c) => {
       }
       default:
         return c.json(
-          { ok: false, error: `Unknown action "${action}". Valid actions: add-admin-phone, remove-admin-phone, list-admin-phones, add-account-manager, remove-account-manager, list-account-managers, set-public-agent, get-public-agent, list-public-agents, update-config, get-config, schema, list-groups.` },
+          { ok: false, error: `Unknown action "${action}". Valid actions: add-admin-phone, remove-admin-phone, list-admin-phones, add-account-manager, remove-account-manager, list-account-managers, set-public-agent, get-public-agent, list-public-agents, set-public-agent-enabled, update-config, get-config, schema, list-groups.` },
           400
         );
     }
@@ -12246,8 +12398,8 @@ async function reapplyLeversViaManager() {
 var WEBCHAT_SEND_TURN_WINDOW_MS = Number(process.env.WEBCHAT_SEND_TURN_WINDOW_MS ?? String(15e3));
 var sendSeq = 0;
 function createWebchatRoutes(deps) {
-  const app76 = new Hono();
-  app76.post("/send", requireAdminSession, async (c) => {
+  const app77 = new Hono();
+  app77.post("/send", requireAdminSession, async (c) => {
     let accountId;
     try {
       accountId = resolvePlatformAccountId();
@@ -12445,7 +12597,7 @@ ${note}` : note;
     if (turnTimer.unref) turnTimer.unref();
     return c.json({ ok: true });
   });
-  app76.post("/interrupt", requireAdminSession, async (c) => {
+  app77.post("/interrupt", requireAdminSession, async (c) => {
     const cacheKey = c.get("cacheKey");
     const requesterUserId = (cacheKey ? getUserIdForSession(cacheKey) : void 0) ?? null;
     const primaryUserId = resolvePrimaryAdminUserId();
@@ -12473,7 +12625,7 @@ ${note}` : note;
     }
     return c.json({ ok: true, stopped: outcome.stopped, intId: outcome.intId, deadChild: outcome.deadChild }, 200);
   });
-  app76.post("/settings", requireAdminSession, async (c) => {
+  app77.post("/settings", requireAdminSession, async (c) => {
     const body = await c.req.json().catch(() => null);
     const op = body?.op;
     const value = body?.value;
@@ -12509,7 +12661,7 @@ ${note}` : note;
     console.log(`[webchat:settings] op=${op} outcome=accepted accountId=${account.accountId.slice(0, 8)} value=${value} settingsApplied=${settingsApplied}`);
     return c.json({ ok: true, settingsApplied });
   });
-  app76.get("/session", requireAdminSession, async (c) => {
+  app77.get("/session", requireAdminSession, async (c) => {
     let accountId;
     try {
       accountId = resolvePlatformAccountId();
@@ -12582,7 +12734,7 @@ ${note}` : note;
     const indicators = await fetchComposerIndicators(sessionId);
     return c.json({ sessionId, projectDir, source, sizeBytes: jsonlSizeBytes(projectDir, sessionId), pendingPermissionPrompt: deps.pendingPromptFor?.(`session:${sessionId}`) ?? null, deliveryFailure: deps.deliveryFailureFor?.(`session:${sessionId}`) ?? null, ...indicators, ...readLevers(account) });
   });
-  app76.post("/permission-verdict", requireAdminSession, async (c) => {
+  app77.post("/permission-verdict", requireAdminSession, async (c) => {
     const body = await c.req.json().catch(() => null);
     const sessionId = body?.sessionId;
     const requestId = body?.request_id;
@@ -12599,7 +12751,7 @@ ${note}` : note;
     const ok = deps.resolvePermissionVerdict?.(`session:${sessionId}`, requestId, behavior) ?? false;
     return c.json({ ok });
   });
-  return app76;
+  return app77;
 }
 
 // server/routes/webchat-greeting.ts
@@ -16730,18 +16882,18 @@ var ALLOWED_EVENTS = /* @__PURE__ */ new Set([
 ]);
 var app24 = new Hono();
 app24.post("/", async (c) => {
-  const TAG51 = "[admin:events]";
+  const TAG52 = "[admin:events]";
   let body;
   try {
     body = await c.req.json();
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG51} reject reason=body-not-json detail=${detail}`);
+    console.error(`${TAG52} reject reason=body-not-json detail=${detail}`);
     return c.json({ ok: false, detail: "Request body was not valid JSON" }, 400);
   }
   const event = typeof body.event === "string" ? body.event : "";
   if (!ALLOWED_EVENTS.has(event)) {
-    console.error(`${TAG51} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
+    console.error(`${TAG52} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
     return c.json({ ok: false, detail: `Event "${event}" is not allowed` }, 400);
   }
   const rawFields = body.fields && typeof body.fields === "object" ? body.fields : {};
@@ -22182,10 +22334,13 @@ async function managerSpawn(opts) {
       visitorId: opts.visitorId,
       name: opts.name,
       webchatChannel: opts.webchatChannel,
+      waChannel: opts.waChannel,
+      sessionId: opts.sessionId,
       previousContext: opts.previousContext,
       initialMessage: opts.initialMessage,
       passive: opts.passive,
-      targetAccountId: opts.targetAccountId
+      targetAccountId: opts.targetAccountId,
+      agentAccountId: opts.agentAccountId
     })
   }).catch((err) => ({ __throw: err instanceof Error ? err.message : String(err) }));
   if ("__throw" in res) {
@@ -22908,10 +23063,35 @@ app48.post("/screencast-event", requireAdminSession, async (c) => {
   screencastLog(parsed.op, parsed.detail);
   return c.json({ ok: true });
 });
+app48.post("/tabs", requireAdminSession, async (c) => {
+  tabsLog("create");
+  const result = await createPageTarget({ fetchImpl: fetch, cdpPort: CDP_PORT, platform: process.platform });
+  if (!result.ok) {
+    tabsLog("create-failed", { status: result.status, error: result.error });
+    return c.json({ ok: false, error: result.error }, result.status);
+  }
+  tabsLog("created", { targetId: result.id });
+  return c.json({ ok: true, id: result.id });
+});
+app48.delete("/tabs/:id", requireAdminSession, async (c) => {
+  const targetId = c.req.param("id");
+  tabsLog("close", { targetId });
+  const result = await closePageTarget(
+    { fetchImpl: fetch, cdpPort: CDP_PORT, platform: process.platform },
+    targetId
+  );
+  if (!result.ok) {
+    tabsLog("close-failed", { status: result.status, error: result.error });
+    return c.json({ ok: false, error: result.error }, result.status);
+  }
+  tabsLog("closed", { targetId });
+  return c.json({ ok: true });
+});
 var browser_default = app48;
 
 // server/routes/admin/calendar.ts
 import { existsSync as existsSync39 } from "fs";
+import { randomUUID as randomUUID10 } from "crypto";
 import { join as join45 } from "path";
 
 // server/lib/calendar-ics.ts
@@ -23053,6 +23233,86 @@ function readAvailabilityConfig(accountDir) {
   return cfg;
 }
 
+// server/lib/calendar-slots.ts
+var WEEKDAYS = ["sun", "mon", "tue", "wed", "thu", "fri", "sat"];
+function tzOffsetMs(instant, timeZone) {
+  const dtf = new Intl.DateTimeFormat("en-US", {
+    timeZone,
+    hour12: false,
+    year: "numeric",
+    month: "2-digit",
+    day: "2-digit",
+    hour: "2-digit",
+    minute: "2-digit",
+    second: "2-digit"
+  });
+  const parts = {};
+  for (const p of dtf.formatToParts(instant)) parts[p.type] = p.value;
+  let hour = Number(parts.hour);
+  if (hour === 24) hour = 0;
+  const asUTC = Date.UTC(
+    Number(parts.year),
+    Number(parts.month) - 1,
+    Number(parts.day),
+    hour,
+    Number(parts.minute),
+    Number(parts.second)
+  );
+  return asUTC - instant.getTime();
+}
+function zonedWallClockToUtc(y, m, d, hh, mm, timeZone) {
+  const naiveUtc = Date.UTC(y, m - 1, d, hh, mm, 0, 0);
+  const offset = tzOffsetMs(new Date(naiveUtc), timeZone);
+  return new Date(naiveUtc - offset);
+}
+function tzCalendarDate(instant, timeZone) {
+  const dtf = new Intl.DateTimeFormat("en-US", {
+    timeZone,
+    year: "numeric",
+    month: "2-digit",
+    day: "2-digit"
+  });
+  const parts = {};
+  for (const p of dtf.formatToParts(instant)) parts[p.type] = p.value;
+  return { y: Number(parts.year), m: Number(parts.month), d: Number(parts.day) };
+}
+function parseHHMM(s) {
+  const [hh, mm] = s.split(":").map(Number);
+  return { hh, mm };
+}
+function computeOpenSlots(config, busy, fromISO, toISO) {
+  const tz = config.timezone;
+  const durMs = config.durationMins * 6e4;
+  const bufMs = config.bufferMins * 6e4;
+  const from = new Date(fromISO).getTime();
+  const to = new Date(toISO).getTime();
+  const busyMs = busy.map((b) => ({ start: new Date(b.start).getTime(), end: new Date(b.end).getTime() }));
+  const slots = [];
+  const firstDate = tzCalendarDate(new Date(from), tz);
+  let dayMidnight = zonedWallClockToUtc(firstDate.y, firstDate.m, firstDate.d, 0, 0, tz);
+  for (let guard = 0; guard < 400 && dayMidnight.getTime() < to; guard++) {
+    const { y, m, d } = tzCalendarDate(dayMidnight, tz);
+    const weekday = WEEKDAYS[new Date(Date.UTC(y, m - 1, d)).getUTCDay()];
+    const windows = config.weekly[weekday] ?? [];
+    for (const [openStr, closeStr] of windows) {
+      const open3 = parseHHMM(openStr);
+      const close = parseHHMM(closeStr);
+      const openUtc = zonedWallClockToUtc(y, m, d, open3.hh, open3.mm, tz).getTime();
+      const closeUtc = zonedWallClockToUtc(y, m, d, close.hh, close.mm, tz).getTime();
+      for (let s = openUtc; s + durMs <= closeUtc; s += durMs) {
+        const slotEnd = s + durMs;
+        if (s < from || s >= to) continue;
+        const blocked = busyMs.some((b) => b.start < slotEnd + bufMs && b.end > s - bufMs);
+        if (blocked) continue;
+        slots.push({ start: new Date(s).toISOString(), end: new Date(slotEnd).toISOString() });
+      }
+    }
+    const next = tzCalendarDate(new Date(dayMidnight.getTime() + 26 * 36e5), tz);
+    dayMidnight = zonedWallClockToUtc(next.y, next.m, next.d, 0, 0, tz);
+  }
+  return slots;
+}
+
 // server/routes/admin/calendar.ts
 var app49 = new Hono();
 function normalizeAttendees(raw) {
@@ -23066,6 +23326,19 @@ function normalizeAttendees(raw) {
   });
 }
 var EDITABLE_FIELDS = ["title", "startsAt", "endsAt", "location", "privateNote"];
+var CREATE_FIELDS = EDITABLE_FIELDS;
+function buildCreateParams(accountId, body) {
+  const params = {
+    accountId,
+    uid: randomUUID10(),
+    source: "admin-ui",
+    createdBySource: "admin-ui",
+    scope: "admin",
+    isAllDay: body.isAllDay === true
+  };
+  for (const f of CREATE_FIELDS) params[f] = f in body ? body[f] : null;
+  return params;
+}
 var MEETING_COLS = `elementId(m) AS id, m.title AS title,
             toString(m.startsAt) AS startsAt, toString(m.endsAt) AS endsAt,
             m.location AS location, coalesce(m.isAllDay, false) AS isAllDay,
@@ -23144,41 +23417,136 @@ app49.get("/meetings", requireAdminSession, async (c) => {
     await session.close();
   }
 });
-function icsFilename(title) {
-  const slug = (title ?? "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 60);
-  return `${slug || "meeting"}.ics`;
-}
-app49.get("/meetings/:id/ics", requireAdminSession, async (c) => {
+app49.get("/free-busy", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
-  const accountId = getAccountIdForSession(cacheKey);
-  if (!accountId) {
-    console.error('[calendar] op=ics auth-rejected reason="no account for session"');
+  const account = accountDirForSession(cacheKey);
+  if (!account) {
+    console.error('[calendar] op=admin-free-busy auth-rejected reason="no account for session"');
     return c.json({ error: "Account not found for session" }, 401);
   }
-  const id = c.req.param("id");
-  const includeAttendees = c.req.query("attendees") === "1";
-  console.log(`[calendar] op=ics-request id=${id} attendees=${includeAttendees}`);
+  const { accountId, accountDir } = account;
+  const from = c.req.query("from");
+  const to = c.req.query("to");
+  if (!from || !to) return c.json({ error: "from and to (ISO) required" }, 400);
+  let config;
+  try {
+    config = readAvailabilityConfig(accountDir);
+  } catch (err) {
+    console.log(`[calendar] op=admin-free-busy gapSource=none reason="${err.message}"`);
+    return c.json({ slots: [], gapSource: "none" });
+  }
   const session = getSession();
   try {
     const res = await session.run(
       `MATCH (m:Meeting {accountId: $accountId})
-       WHERE elementId(m) = $id
-       ${MEETING_RETURN}`,
-      { accountId, id }
+       WHERE NOT (m.endsAt IS NOT NULL AND m.endsAt <= datetime($from))
+         AND m.startsAt < datetime($to)
+       RETURN toString(m.startsAt) AS start, toString(m.endsAt) AS end
+       UNION
+       MATCH (b:ConnectorBusy {accountId: $accountId})
+       WHERE b.endsAt > datetime($from) AND b.startsAt < datetime($to)
+       RETURN toString(b.startsAt) AS start, toString(b.endsAt) AS end`,
+      { accountId, from, to }
     );
-    if (res.records.length === 0) {
-      console.warn(`[calendar] op=ics-404 id=${id} reason="no meeting for account"`);
-      return c.json({ error: "Meeting not found for this account" }, 404);
-    }
-    const r = res.records[0];
-    const mapped = mapMeeting(r);
-    const uid = r.get("uid") ?? null;
-    const corr = uid ?? mapped.meetingId;
-    const input = {
-      uid,
-      id: mapped.meetingId,
-      title: mapped.title,
-      startsAt: mapped.startsAt,
+    const busy = res.records.map((r) => {
+      const start = r.get("start");
+      const rawEnd = r.get("end");
+      return {
+        start,
+        end: rawEnd ?? new Date(new Date(start).getTime() + config.durationMins * 6e4).toISOString()
+      };
+    });
+    const slots = computeOpenSlots(config, busy, from, to);
+    console.log(`[calendar] op=admin-free-busy gapSource=config slots=${slots.length} range=${from}..${to}`);
+    return c.json({ durationMins: config.durationMins, timezone: config.timezone, slots, gapSource: "config" });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(`[calendar] op=admin-free-busy-fail err="${message}"`);
+    return c.json({ error: `Availability unavailable: ${message}` }, 503);
+  } finally {
+    await session.close();
+  }
+});
+app49.post("/meetings", requireAdminSession, async (c) => {
+  const cacheKey = c.var.cacheKey;
+  const accountId = getAccountIdForSession(cacheKey);
+  if (!accountId) {
+    console.error('[admin:calendar] op=create auth-rejected reason="no account for session"');
+    return c.json({ error: "Account not found for session" }, 401);
+  }
+  const body = await safeJson(c) ?? {};
+  if (typeof body.title !== "string" || body.title.trim() === "") {
+    return c.json({ error: "title is required" }, 400);
+  }
+  if (typeof body.startsAt !== "string" || Number.isNaN(Date.parse(body.startsAt))) {
+    return c.json({ error: "startsAt must be a parseable ISO timestamp" }, 400);
+  }
+  if (body.endsAt != null && (typeof body.endsAt !== "string" || Number.isNaN(Date.parse(body.endsAt)))) {
+    return c.json({ error: "endsAt must be a parseable ISO timestamp" }, 400);
+  }
+  const params = buildCreateParams(accountId, body);
+  const session = getSession();
+  try {
+    const res = await session.run(
+      `CREATE (m:Meeting {
+         accountId: $accountId, uid: $uid, title: $title,
+         startsAt: datetime($startsAt),
+         endsAt: CASE WHEN $endsAt IS NULL THEN null ELSE datetime($endsAt) END,
+         location: $location, privateNote: $privateNote, isAllDay: $isAllDay,
+         source: $source, createdBySource: $createdBySource, scope: $scope,
+         createdAt: datetime(), updatedAt: datetime()
+       })
+       ${MEETING_RETURN}`,
+      params
+    );
+    const meeting = mapMeeting(res.records[0]);
+    console.log(
+      `[admin:calendar] op=create accountId=${accountId.slice(0, 8)} meetingId=${meeting.meetingId} uid=${params.uid} outcome=created`
+    );
+    return c.json({ meeting }, 201);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(`[admin:calendar] op=create outcome=failed err="${message}"`);
+    return c.json({ error: `Create failed: ${message}` }, 503);
+  } finally {
+    await session.close();
+  }
+});
+function icsFilename(title) {
+  const slug = (title ?? "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 60);
+  return `${slug || "meeting"}.ics`;
+}
+app49.get("/meetings/:id/ics", requireAdminSession, async (c) => {
+  const cacheKey = c.var.cacheKey;
+  const accountId = getAccountIdForSession(cacheKey);
+  if (!accountId) {
+    console.error('[calendar] op=ics auth-rejected reason="no account for session"');
+    return c.json({ error: "Account not found for session" }, 401);
+  }
+  const id = c.req.param("id");
+  const includeAttendees = c.req.query("attendees") === "1";
+  console.log(`[calendar] op=ics-request id=${id} attendees=${includeAttendees}`);
+  const session = getSession();
+  try {
+    const res = await session.run(
+      `MATCH (m:Meeting {accountId: $accountId})
+       WHERE elementId(m) = $id
+       ${MEETING_RETURN}`,
+      { accountId, id }
+    );
+    if (res.records.length === 0) {
+      console.warn(`[calendar] op=ics-404 id=${id} reason="no meeting for account"`);
+      return c.json({ error: "Meeting not found for this account" }, 404);
+    }
+    const r = res.records[0];
+    const mapped = mapMeeting(r);
+    const uid = r.get("uid") ?? null;
+    const corr = uid ?? mapped.meetingId;
+    const input = {
+      uid,
+      id: mapped.meetingId,
+      title: mapped.title,
+      startsAt: mapped.startsAt,
       endsAt: mapped.endsAt,
       location: mapped.location,
       isAllDay: mapped.isAllDay,
@@ -24477,6 +24845,32 @@ async function computeTaskList(accountId) {
         `${TAG29} op=session-orphans account=${accountId} orphans=${orphans} detail="task marked for a session spawn that never linked; the spawned session is unreachable from its row"`
       );
     }
+    let orphanEntries = 0;
+    let orphanAdjustments = 0;
+    try {
+      const orphanTime = await session.run(
+        `OPTIONAL MATCH (te:TimeEntry {accountId: $accountId})
+           WHERE NOT EXISTS { MATCH (:Task {taskId: te.taskId, accountId: $accountId}) }
+         WITH count(te) AS orphanEntries
+         OPTIONAL MATCH (ta:TimeAdjustment {accountId: $accountId})
+           WHERE NOT EXISTS { MATCH (:Task {taskId: ta.taskId, accountId: $accountId}) }
+         RETURN orphanEntries, count(ta) AS orphanAdjustments`,
+        { accountId }
+      );
+      orphanEntries = orphanTime.records.length > 0 ? toNum(orphanTime.records[0].get("orphanEntries")) : 0;
+      orphanAdjustments = orphanTime.records.length > 0 ? toNum(orphanTime.records[0].get("orphanAdjustments")) : 0;
+    } catch (err) {
+      console.error(
+        `${TAG29} op=orphan-time-records-census-failed account=${accountId} error="${err instanceof Error ? err.message : String(err)}"`
+      );
+      orphanEntries = -1;
+      orphanAdjustments = -1;
+    }
+    if (orphanEntries > 0 || orphanAdjustments > 0) {
+      console.error(
+        `${TAG29} op=orphan-time-records account=${accountId} orphanEntries=${orphanEntries} orphanAdjustments=${orphanAdjustments} detail="time records whose task no longer exists; something removed the task without its records"`
+      );
+    }
     const linkedIds = [...open3, ...completed].map((r) => r.sessionId).filter((s) => s !== null);
     let dangling = null;
     const cfg = claudeConfigDir();
@@ -24526,7 +24920,7 @@ async function computeTaskList(accountId) {
 var tasks_list_default = app53;
 
 // server/routes/admin/task-timer-start.ts
-import { randomUUID as randomUUID10 } from "crypto";
+import { randomUUID as randomUUID11 } from "crypto";
 var TAG30 = "[task-timer]";
 var app54 = new Hono();
 app54.post("/", requireAdminSession, async (c) => {
@@ -24569,7 +24963,7 @@ app54.post("/", requireAdminSession, async (c) => {
       invalidate("tasks-list", accountId);
       return c.json({ ok: true, running: true, entryId: priorEntryId, startedAt: priorStartedAt });
     }
-    const entryId = randomUUID10();
+    const entryId = randomUUID11();
     await session.run(
       `MATCH (t:Task {taskId: $taskId, accountId: $accountId})
        CREATE (te:TimeEntry {entryId: $entryId, taskId: $taskId, accountId: $accountId, startedAt: $now, endedAt: null})
@@ -24708,7 +25102,7 @@ app56.post("/", requireAdminSession, async (c) => {
 var task_complete_default = app56;
 
 // server/routes/admin/task-time-adjust.ts
-import { randomUUID as randomUUID11 } from "crypto";
+import { randomUUID as randomUUID12 } from "crypto";
 import neo4j5 from "neo4j-driver";
 var TAG33 = "[task-time-adjust]";
 var app57 = new Hono();
@@ -24734,7 +25128,7 @@ app57.post("/", requireAdminSession, async (c) => {
     console.error(`${TAG33} op=reject reason=invalid-seconds taskId=${taskId} accountId=${accountId}`);
     return c.json({ error: "newSeconds must be a non-negative integer" }, 400);
   }
-  const adjustmentId = randomUUID11();
+  const adjustmentId = randomUUID12();
   const now = (/* @__PURE__ */ new Date()).toISOString();
   console.log(`${TAG33} op=request adjustmentId=${adjustmentId} taskId=${taskId} accountId=${accountId} newSeconds=${newSeconds}`);
   const session = getSession();
@@ -24789,6 +25183,112 @@ app57.post("/", requireAdminSession, async (c) => {
 });
 var task_time_adjust_default = app57;
 
+// server/routes/admin/task-delete.ts
+import { randomUUID as randomUUID13 } from "crypto";
+var TAG34 = "[task-delete]";
+var app58 = new Hono();
+app58.post("/", requireAdminSession, async (c) => {
+  const cacheKey = c.var.cacheKey;
+  const accountId = getAccountIdForSession(cacheKey);
+  if (!accountId) return c.json({ error: "Account not found for session" }, 401);
+  let body;
+  try {
+    body = await c.req.json();
+  } catch {
+    console.error(`${TAG34} op=reject reason=bad-json`);
+    return c.json({ error: "invalid-json" }, 400);
+  }
+  const deletionId = randomUUID13();
+  const taskId = typeof body.taskId === "string" ? body.taskId : "";
+  if (!taskId) {
+    const reason = body.taskId === null ? "null-taskId" : "missing-taskId";
+    console.error(`${TAG34} op=reject reason=${reason} deletionId=${deletionId} accountId=${accountId}`);
+    return c.json({ error: "taskId required" }, 400);
+  }
+  console.log(
+    `${TAG34} op=request deletionId=${deletionId} taskId=${taskId} accountId=${accountId} confirmed=${body.confirmed === true}`
+  );
+  const session = getSession();
+  try {
+    const guard = await session.run(
+      `MATCH (t:Task {taskId: $taskId, accountId: $accountId})
+       OPTIONAL MATCH (te:TimeEntry {taskId: $taskId, accountId: $accountId})
+       OPTIONAL MATCH (open:TimeEntry {taskId: $taskId, accountId: $accountId})
+         WHERE open.endedAt IS NULL
+       OPTIONAL MATCH (ta:TimeAdjustment {taskId: $taskId, accountId: $accountId})
+       RETURN count(DISTINCT te) AS timeEntries,
+              count(DISTINCT open) AS openCount,
+              count(DISTINCT ta) AS adjustments`,
+      { taskId, accountId }
+    );
+    if (guard.records.length === 0) {
+      console.error(`${TAG34} op=reject reason=no-task deletionId=${deletionId} taskId=${taskId} accountId=${accountId}`);
+      return c.json({ error: "task-not-found" }, 404);
+    }
+    const timeEntries = toNum(guard.records[0].get("timeEntries"));
+    const openCount = toNum(guard.records[0].get("openCount"));
+    const adjustments = toNum(guard.records[0].get("adjustments"));
+    console.log(
+      `${TAG34} op=guard deletionId=${deletionId} taskId=${taskId} openCount=${openCount} timeEntries=${timeEntries} adjustments=${adjustments}`
+    );
+    if (openCount > 0) {
+      console.error(
+        `${TAG34} op=reject reason=running deletionId=${deletionId} taskId=${taskId} openCount=${openCount}`
+      );
+      return c.json({ error: "task-timer-running" }, 409);
+    }
+    const write = await session.run(
+      `OPTIONAL MATCH (te:TimeEntry {taskId: $taskId, accountId: $accountId})
+       WITH collect(te) AS entries
+       OPTIONAL MATCH (ta:TimeAdjustment {taskId: $taskId, accountId: $accountId})
+       WITH entries, collect(ta) AS adjustments
+       OPTIONAL MATCH (t:Task {taskId: $taskId, accountId: $accountId})
+       WITH entries, adjustments, collect(t) AS tasks
+       FOREACH (n IN entries | DETACH DELETE n)
+       FOREACH (n IN adjustments | DETACH DELETE n)
+       FOREACH (n IN tasks | DETACH DELETE n)
+       RETURN size(tasks) AS tasksDeleted,
+              size(entries) AS timeEntriesDeleted,
+              size(adjustments) AS adjustmentsDeleted`,
+      { taskId, accountId }
+    );
+    const tasksDeleted = toNum(write.records[0]?.get("tasksDeleted"));
+    const timeEntriesDeleted = toNum(write.records[0]?.get("timeEntriesDeleted"));
+    const adjustmentsDeleted = toNum(write.records[0]?.get("adjustmentsDeleted"));
+    const after = await session.run(
+      `OPTIONAL MATCH (t:Task {taskId: $taskId, accountId: $accountId})
+       WITH count(t) AS taskLeft
+       OPTIONAL MATCH (te:TimeEntry {taskId: $taskId, accountId: $accountId})
+       WITH taskLeft, count(te) AS entriesLeft
+       OPTIONAL MATCH (ta:TimeAdjustment {taskId: $taskId, accountId: $accountId})
+       RETURN taskLeft, entriesLeft, count(ta) AS adjustmentsLeft`,
+      { taskId, accountId }
+    );
+    const taskLeft = toNum(after.records[0]?.get("taskLeft"));
+    const entriesLeft = toNum(after.records[0]?.get("entriesLeft"));
+    const adjustmentsLeft = toNum(after.records[0]?.get("adjustmentsLeft"));
+    const remaining = taskLeft + entriesLeft + adjustmentsLeft;
+    console.log(
+      `${TAG34} op=persisted deletionId=${deletionId} taskId=${taskId} tasksDeleted=${tasksDeleted} timeEntriesDeleted=${timeEntriesDeleted} adjustmentsDeleted=${adjustmentsDeleted} remaining=${remaining}`
+    );
+    if (remaining > 0) {
+      console.error(
+        `${TAG34} op=incomplete deletionId=${deletionId} taskId=${taskId} taskLeft=${taskLeft} entriesLeft=${entriesLeft} adjustmentsLeft=${adjustmentsLeft} detail="the delete returned but rows for this taskId survive"`
+      );
+    }
+    invalidate("tasks-list", accountId);
+    return c.json({ ok: true, tasksDeleted, timeEntriesDeleted, adjustmentsDeleted, remaining });
+  } catch (err) {
+    console.error(
+      `${TAG34} op=error deletionId=${deletionId} taskId=${taskId} error="${err instanceof Error ? err.message : String(err)}"`
+    );
+    return c.json({ error: "task-delete-failed" }, 500);
+  } finally {
+    await session.close();
+  }
+});
+var task_delete_default = app58;
+
 // app/lib/admin-roster.ts
 import { existsSync as existsSync42, readdirSync as readdirSync26, readFileSync as readFileSync40 } from "fs";
 import { resolve as resolve33 } from "path";
@@ -24874,9 +25374,9 @@ async function resolveAssignableAdmins(accountId, accountsDir = ACCOUNTS_DIR) {
 }
 
 // server/routes/admin/task-assign.ts
-var TAG34 = "[task-assign]";
-var app58 = new Hono();
-app58.post("/", requireAdminSession, async (c) => {
+var TAG35 = "[task-assign]";
+var app59 = new Hono();
+app59.post("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) return c.json({ error: "Account not found for session" }, 401);
@@ -24889,7 +25389,7 @@ app58.post("/", requireAdminSession, async (c) => {
   const taskId = typeof body.taskId === "string" ? body.taskId : "";
   if (!taskId) {
     const reason = body.taskId === null ? "null-taskId" : "missing-taskId";
-    console.error(`${TAG34} op=assign rejected reason=${reason} account=${accountId}`);
+    console.error(`${TAG35} op=assign rejected reason=${reason} account=${accountId}`);
     return c.json({ error: "taskId required" }, 400);
   }
   const rawAssignee = body.assigneeUserId;
@@ -24901,7 +25401,7 @@ app58.post("/", requireAdminSession, async (c) => {
     const { ids } = await resolveAllowedAssigneeIds(accountId);
     if (!ids.has(assigneeUserId)) {
       console.error(
-        `${TAG34} op=assign taskId=${taskId.slice(0, 8)} assigneeUserId=${assigneeUserId.slice(0, 8)} assigned=false source=route reason=not-in-roster`
+        `${TAG35} op=assign taskId=${taskId.slice(0, 8)} assigneeUserId=${assigneeUserId.slice(0, 8)} assigned=false source=route reason=not-in-roster`
       );
       return c.json({ error: "assignee-not-in-roster" }, 403);
     }
@@ -24923,7 +25423,7 @@ app58.post("/", requireAdminSession, async (c) => {
         `MATCH (t:Task {taskId: $taskId, accountId: $accountId}) SET t.updatedAt = $now`,
         { taskId, accountId, now }
       );
-      console.log(`${TAG34} op=assign taskId=${taskId.slice(0, 8)} assigneeUserId=none assigned=false source=route`);
+      console.log(`${TAG35} op=assign taskId=${taskId.slice(0, 8)} assigneeUserId=none assigned=false source=route`);
       invalidate("tasks-list", accountId);
       return c.json({ ok: true, assigneeUserId: null, assigneeName: null });
     }
@@ -24939,7 +25439,7 @@ app58.post("/", requireAdminSession, async (c) => {
     );
     if (set.records.length === 0) {
       console.error(
-        `${TAG34} op=assign taskId=${taskId.slice(0, 8)} assigneeUserId=${assigneeUserId.slice(0, 8)} assigned=false source=route reason=no-adminuser-node`
+        `${TAG35} op=assign taskId=${taskId.slice(0, 8)} assigneeUserId=${assigneeUserId.slice(0, 8)} assigned=false source=route reason=no-adminuser-node`
       );
       return c.json({ error: "assignee-no-admin-node" }, 409);
     }
@@ -24947,27 +25447,27 @@ app58.post("/", requireAdminSession, async (c) => {
     const family = set.records[0].get("familyName") ?? null;
     const assigneeName = given && given.trim().length > 0 ? family && family.trim().length > 0 ? `${given.trim()} ${family.trim()}` : given.trim() : null;
     console.log(
-      `${TAG34} op=assign taskId=${taskId.slice(0, 8)} assigneeUserId=${assigneeUserId.slice(0, 8)} assigned=true source=route`
+      `${TAG35} op=assign taskId=${taskId.slice(0, 8)} assigneeUserId=${assigneeUserId.slice(0, 8)} assigned=true source=route`
     );
     invalidate("tasks-list", accountId);
     return c.json({ ok: true, assigneeUserId, assigneeName });
   } catch (err) {
-    console.error(`${TAG34} op=assign error="${err instanceof Error ? err.message : String(err)}"`);
+    console.error(`${TAG35} op=assign error="${err instanceof Error ? err.message : String(err)}"`);
     return c.json({ error: "task-assign-failed" }, 500);
   } finally {
     await session.close();
   }
 });
-var task_assign_default = app58;
+var task_assign_default = app59;
 
 // server/routes/admin/task-session-open.ts
-var TAG35 = "[task-session]";
-var app59 = new Hono();
-app59.post("/", requireAdminSession, async (c) => {
+var TAG36 = "[task-session]";
+var app60 = new Hono();
+app60.post("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
-    console.error(`${TAG35} op=request auth-rejected reason="no account for session"`);
+    console.error(`${TAG36} op=request auth-rejected reason="no account for session"`);
     return c.json({ error: "Account not found for session" }, 401);
   }
   let body;
@@ -24979,7 +25479,7 @@ app59.post("/", requireAdminSession, async (c) => {
   const taskId = typeof body.taskId === "string" ? body.taskId : "";
   if (!taskId) {
     const reason = body.taskId === null ? "null-taskId" : "missing-taskId";
-    console.error(`${TAG35} op=request rejected reason=${reason} account=${accountId}`);
+    console.error(`${TAG36} op=request rejected reason=${reason} account=${accountId}`);
     return c.json({ error: "taskId required" }, 400);
   }
   const session = getSession();
@@ -24993,14 +25493,14 @@ app59.post("/", requireAdminSession, async (c) => {
       { taskId, accountId }
     );
     if (found.records.length === 0) {
-      console.error(`${TAG35} op=request taskId=${taskId} account=${accountId} result=task-not-found`);
+      console.error(`${TAG36} op=request taskId=${taskId} account=${accountId} result=task-not-found`);
       return c.json({ error: "task-not-found" }, 404);
     }
     const title = found.records[0].get("name") ?? "";
     const sessionId = found.records[0].get("sessionId") ?? null;
     const description = found.records[0].get("description") ?? "";
     const notes = found.records[0].get("notes") ?? "";
-    console.log(`${TAG35} op=request taskId=${taskId} account=${accountId} linked=${sessionId ?? "none"}`);
+    console.log(`${TAG36} op=request taskId=${taskId} account=${accountId} linked=${sessionId ?? "none"}`);
     if (sessionId !== null) return c.json({ sessionId, title, description, notes });
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const stamped = await session.run(
@@ -25010,25 +25510,25 @@ app59.post("/", requireAdminSession, async (c) => {
       { taskId, accountId, now }
     );
     const at = stamped.records[0]?.get("at") ?? void 0;
-    console.log(`${TAG35} op=marker taskId=${taskId} stamped=${at !== void 0}`);
+    console.log(`${TAG36} op=marker taskId=${taskId} stamped=${at !== void 0}`);
     return c.json({ sessionId: null, title, description, notes });
   } catch (err) {
-    console.error(`${TAG35} op=request taskId=${taskId} error="${err instanceof Error ? err.message : String(err)}"`);
+    console.error(`${TAG36} op=request taskId=${taskId} error="${err instanceof Error ? err.message : String(err)}"`);
     return c.json({ error: "task-session-open-failed" }, 500);
   } finally {
     await session.close();
   }
 });
-var task_session_open_default = app59;
+var task_session_open_default = app60;
 
 // server/routes/admin/task-session-link.ts
-var TAG36 = "[task-session]";
-var app60 = new Hono();
-app60.post("/", requireAdminSession, async (c) => {
+var TAG37 = "[task-session]";
+var app61 = new Hono();
+app61.post("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
-    console.error(`${TAG36} op=link auth-rejected reason="no account for session"`);
+    console.error(`${TAG37} op=link auth-rejected reason="no account for session"`);
     return c.json({ error: "Account not found for session" }, 401);
   }
   let body;
@@ -25040,12 +25540,12 @@ app60.post("/", requireAdminSession, async (c) => {
   const taskId = typeof body.taskId === "string" ? body.taskId : "";
   if (!taskId) {
     const reason = body.taskId === null ? "null-taskId" : "missing-taskId";
-    console.error(`${TAG36} op=link rejected reason=${reason} account=${accountId}`);
+    console.error(`${TAG37} op=link rejected reason=${reason} account=${accountId}`);
     return c.json({ error: "taskId required" }, 400);
   }
   const sessionId = typeof body.sessionId === "string" && body.sessionId.length > 0 ? body.sessionId : "";
   if (!sessionId) {
-    console.error(`${TAG36} op=link rejected reason=missing-sessionId taskId=${taskId} account=${accountId}`);
+    console.error(`${TAG37} op=link rejected reason=missing-sessionId taskId=${taskId} account=${accountId}`);
     return c.json({ error: "sessionId required" }, 400);
   }
   const session = getSession();
@@ -25059,13 +25559,13 @@ app60.post("/", requireAdminSession, async (c) => {
       { taskId, accountId, sessionId }
     );
     if (state.records.length === 0) {
-      console.error(`${TAG36} op=link taskId=${taskId} account=${accountId} result=task-not-found`);
+      console.error(`${TAG37} op=link taskId=${taskId} account=${accountId} result=task-not-found`);
       return c.json({ error: "task-not-found" }, 404);
     }
     const conversationExists = state.records[0].get("conversationExists") === true;
     const priorSessionIds = (state.records[0].get("priorSessionIds") ?? []).filter((s) => typeof s === "string");
     if (!conversationExists) {
-      console.error(`${TAG36} op=link-failed taskId=${taskId} sessionId=${sessionId} reason=conversation-absent`);
+      console.error(`${TAG37} op=link-failed taskId=${taskId} sessionId=${sessionId} reason=conversation-absent`);
       return c.json({ linked: false, created: false, repointedFrom: null });
     }
     const stale = priorSessionIds.filter((s) => s !== sessionId);
@@ -25091,50 +25591,50 @@ app60.post("/", requireAdminSession, async (c) => {
     const repointedFrom = stale.length > 0 ? stale[0] : null;
     if (!linked) {
       console.error(
-        `${TAG36} op=link-failed taskId=${taskId} sessionId=${sessionId} reason=edge-absent-after-merge linkedTo=${linkedTo ?? "none"}`
+        `${TAG37} op=link-failed taskId=${taskId} sessionId=${sessionId} reason=edge-absent-after-merge linkedTo=${linkedTo ?? "none"}`
       );
       return c.json({ linked: false, created: false, repointedFrom });
     }
     console.log(
-      `${TAG36} op=link taskId=${taskId} sessionId=${sessionId} created=${created} repointedFrom=${repointedFrom ?? "none"}`
+      `${TAG37} op=link taskId=${taskId} sessionId=${sessionId} created=${created} repointedFrom=${repointedFrom ?? "none"}`
     );
     invalidate("tasks-list", accountId);
     return c.json({ linked: true, created, repointedFrom });
   } catch (err) {
     console.error(
-      `${TAG36} op=link-failed taskId=${taskId} sessionId=${sessionId} reason="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG37} op=link-failed taskId=${taskId} sessionId=${sessionId} reason="${err instanceof Error ? err.message : String(err)}"`
     );
     return c.json({ error: "task-session-link-failed" }, 500);
   } finally {
     await session.close();
   }
 });
-var task_session_link_default = app60;
+var task_session_link_default = app61;
 
 // server/routes/admin/admin-users-list.ts
-var TAG37 = "[admin-users]";
-var app61 = new Hono();
-app61.get("/", requireAdminSession, async (c) => {
+var TAG38 = "[admin-users]";
+var app62 = new Hono();
+app62.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
-    console.error(`${TAG37} op=list auth-rejected reason="no account for session"`);
+    console.error(`${TAG38} op=list auth-rejected reason="no account for session"`);
     return c.json({ error: "Account not found for session" }, 401);
   }
   try {
     const users = await resolveAssignableAdmins(accountId);
-    console.log(`${TAG37} op=list account=${accountId} count=${users.length}`);
+    console.log(`${TAG38} op=list account=${accountId} count=${users.length}`);
     return c.json({ ok: true, users });
   } catch (err) {
-    console.error(`${TAG37} op=list error="${err instanceof Error ? err.message : String(err)}"`);
+    console.error(`${TAG38} op=list error="${err instanceof Error ? err.message : String(err)}"`);
     return c.json({ error: "admin-users-list-failed" }, 500);
   }
 });
-var admin_users_list_default = app61;
+var admin_users_list_default = app62;
 
 // server/routes/admin/dispatch-destinations.ts
 import { resolve as resolve34 } from "path";
-var TAG38 = "[admin:routines]";
+var TAG39 = "[admin:routines]";
 function scopeFor(d, houseDir, houseAccountId) {
   if (d.channel !== "whatsapp") return null;
   if (d.label === "Account manager") return boundSubAccountFor(houseDir, d.destination);
@@ -25148,11 +25648,11 @@ function telephoneVariants(destination) {
 function scrubDigitRuns(message) {
   return message.replace(/\d{7,}/g, "<redacted>");
 }
-var app62 = new Hono();
-app62.get("/", requireAdminSession, async (c) => {
+var app63 = new Hono();
+app63.get("/", requireAdminSession, async (c) => {
   const accountId = getAccountIdForSession(c.var.cacheKey);
   if (!accountId) {
-    console.error(`${TAG38} op=destinations auth-rejected reason="no account for session"`);
+    console.error(`${TAG39} op=destinations auth-rejected reason="no account for session"`);
     return c.json({ error: "Account not found for session" }, 401);
   }
   let houseAccountId = null;
@@ -25160,7 +25660,7 @@ app62.get("/", requireAdminSession, async (c) => {
     houseAccountId = resolveHouseOrSoleAccountId(ACCOUNTS_DIR);
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG38} op=destinations account=${accountId.slice(0, 8)} outcome=house-unresolved reason="${message}"`);
+    console.error(`${TAG39} op=destinations account=${accountId.slice(0, 8)} outcome=house-unresolved reason="${message}"`);
   }
   const destinations = listDispatchDestinations({ accountsDir: ACCOUNTS_DIR, houseAccountId, accountId });
   const houseDir = houseAccountId === null ? null : resolve34(ACCOUNTS_DIR, houseAccountId);
@@ -25211,16 +25711,16 @@ app62.get("/", requireAdminSession, async (c) => {
   const scopes = [...byScope.keys()];
   const nameScope = scopes.length === 0 ? "none" : scopes.every((s) => s === houseAccountId) ? "house" : scopes.some((s) => s === houseAccountId) ? "mixed" : "account";
   console.log(
-    `${TAG38} op=destinations account=${accountId.slice(0, 8)} count=${destinations.length} named=${named} unnamed=${destinations.length - named} nameScope=${nameScope}` + (houseAccountId === null ? " outcome=house-unresolved" : "") + (namesUnresolved === null ? "" : ` outcome=names-unresolved reason="${namesUnresolved}"`)
+    `${TAG39} op=destinations account=${accountId.slice(0, 8)} count=${destinations.length} named=${named} unnamed=${destinations.length - named} nameScope=${nameScope}` + (houseAccountId === null ? " outcome=house-unresolved" : "") + (namesUnresolved === null ? "" : ` outcome=names-unresolved reason="${namesUnresolved}"`)
   );
   return c.json({ destinations });
 });
-var dispatch_destinations_default = app62;
+var dispatch_destinations_default = app63;
 
 // server/routes/admin/activity.ts
 import { readdirSync as readdirSync27 } from "fs";
-var app63 = new Hono();
-var TAG39 = "[activity]";
+var app64 = new Hono();
+var TAG40 = "[activity]";
 function resolveHouseAccountId2(accounts) {
   const houses = accounts.filter((a) => a.config.role === "house");
   if (houses.length === 1) return { accountId: houses[0].accountId, reason: "house" };
@@ -25241,7 +25741,7 @@ function countAccountDirsOnDisk() {
     return null;
   }
 }
-app63.get("/", requireAdminSession, async (c) => {
+app64.get("/", requireAdminSession, async (c) => {
   const req = requestToken();
   const cacheKey = c.var.cacheKey;
   const caller2 = getAccountIdForSession(cacheKey) ?? null;
@@ -25249,19 +25749,19 @@ app63.get("/", requireAdminSession, async (c) => {
   const house = resolveHouseAccountId2(valid);
   const isHouse = caller2 !== null && house.accountId !== null && caller2 === house.accountId;
   console.log(
-    `${TAG39} op=request req=${req} caller=${short(caller2)} house=${isHouse} houseVia=${house.reason}`
+    `${TAG40} op=request req=${req} caller=${short(caller2)} house=${isHouse} houseVia=${house.reason}`
   );
   if (!isHouse) {
     const reason = house.accountId === null ? house.reason : "not-house";
     console.error(
-      `${TAG39} op=gate req=${req} decision=deny reason=${reason} caller=${short(caller2)} houseAcct=${short(house.accountId)} accounts=${valid.length}`
+      `${TAG40} op=gate req=${req} decision=deny reason=${reason} caller=${short(caller2)} houseAcct=${short(house.accountId)} accounts=${valid.length}`
     );
     return c.json({ error: "house-only" }, 403);
   }
-  console.log(`${TAG39} op=gate req=${req} decision=allow caller=${short(caller2)} via=${house.reason}`);
+  console.log(`${TAG40} op=gate req=${req} decision=allow caller=${short(caller2)} via=${house.reason}`);
   const onDisk = countAccountDirsOnDisk();
   console.log(
-    `${TAG39} op=accounts req=${req} onDisk=${onDisk ?? "unknown"} valid=${valid.length} ids=${valid.map((a) => short(a.accountId)).join(",")}`
+    `${TAG40} op=accounts req=${req} onDisk=${onDisk ?? "unknown"} valid=${valid.length} ids=${valid.map((a) => short(a.accountId)).join(",")}`
   );
   const start = Date.now();
   let res;
@@ -25277,17 +25777,17 @@ app63.get("/", requireAdminSession, async (c) => {
     });
   } catch (err) {
     console.error(
-      `${TAG39} op=manager-fail req=${req} reason=unreachable err=${err instanceof Error ? err.message : String(err)}`
+      `${TAG40} op=manager-fail req=${req} reason=unreachable err=${err instanceof Error ? err.message : String(err)}`
     );
     return c.json({ error: "manager-unreachable" }, 502);
   }
   if (res.status !== 200) {
-    console.error(`${TAG39} op=manager-fail req=${req} reason=status status=${res.status}`);
+    console.error(`${TAG40} op=manager-fail req=${req} reason=status status=${res.status}`);
     return c.json({ error: `manager-status-${res.status}` }, 502);
   }
   const body = await res.json().catch(() => null);
   if (!body || !Array.isArray(body.rows)) {
-    console.error(`${TAG39} op=manager-fail req=${req} reason=bad-json`);
+    console.error(`${TAG40} op=manager-fail req=${req} reason=bad-json`);
     return c.json({ error: "manager-bad-json" }, 502);
   }
   const rows = body.rows;
@@ -25298,10 +25798,10 @@ app63.get("/", requireAdminSession, async (c) => {
   const ageNull = rows.filter((r) => r.ageMs === null).length;
   const sidecarNull = rows.filter((r) => r.sidecarMissing).length;
   console.log(
-    `${TAG39} op=census req=${req} ageMs=${censusAgeMs ?? "none"} live=${census?.live ?? "none"} cpuNull=${census?.cpuNull ?? "none"} rows=${rows.length} ageNull=${ageNull} sidecarNull=${sidecarNull}`
+    `${TAG40} op=census req=${req} ageMs=${censusAgeMs ?? "none"} live=${census?.live ?? "none"} cpuNull=${census?.cpuNull ?? "none"} rows=${rows.length} ageNull=${ageNull} sidecarNull=${sidecarNull}`
   );
   console.log(
-    `${TAG39} op=response req=${req} rows=${rows.length} accounts=${valid.length} untagged=${untaggedCount} meteringFailed=${meteringFailed} ms=${Date.now() - start}`
+    `${TAG40} op=response req=${req} rows=${rows.length} accounts=${valid.length} untagged=${untaggedCount} meteringFailed=${meteringFailed} ms=${Date.now() - start}`
   );
   const names = {};
   await Promise.all(
@@ -25320,7 +25820,7 @@ app63.get("/", requireAdminSession, async (c) => {
     return acc;
   }, {});
   console.log(
-    `${TAG39} op=loops req=${req} armed=${armed2} rendered=${loopRows.length} procPct=${cpu.processPct?.toFixed(1) ?? "null"} attributedPct=${cpu.attributedPct?.toFixed(1) ?? "null"} ` + Object.entries(byState).map(([s, n]) => `${s}=${n}`).join(" ")
+    `${TAG40} op=loops req=${req} armed=${armed2} rendered=${loopRows.length} procPct=${cpu.processPct?.toFixed(1) ?? "null"} attributedPct=${cpu.attributedPct?.toFixed(1) ?? "null"} ` + Object.entries(byState).map(([s, n]) => `${s}=${n}`).join(" ")
   );
   return c.json({
     rows,
@@ -25350,69 +25850,70 @@ app63.get("/", requireAdminSession, async (c) => {
     }
   });
 });
-var activity_default = app63;
+var activity_default = app64;
 
 // server/routes/admin/index.ts
-var app64 = new Hono();
-app64.route("/session", session_default);
-app64.route("/accounts", accounts_default);
-app64.route("/logs", logs_default);
-app64.route("/claude-info", claude_info_default);
-app64.route("/attachment", attachment_default);
-app64.route("/session-upload", session_upload_default);
-app64.route("/agents", agents_default);
-app64.route("/sessions", sessions_default);
-app64.route("/claude-sessions", claude_sessions_default);
-app64.route("/log-ingest", log_ingest_default);
-app64.route("/events", events_default);
-app64.route("/files", files_default);
-app64.route("/graph-search", graph_search_default);
-app64.route("/graph-subgraph", graph_subgraph_default);
-app64.route("/graph-delete", graph_delete_default);
-app64.route("/graph-restore", graph_restore_default);
-app64.route("/graph-labels-in-graph", graph_labels_in_graph_default);
-app64.route("/graph-default-view", graph_default_view_default);
-app64.route("/sidebar-artefacts", sidebar_artefacts_default);
-app64.route("/sidebar-sessions", sidebar_sessions_default);
-app64.route("/session-delete", session_delete_default);
-app64.route("/session-stop", session_stop_default);
-app64.route("/session-archive", session_archive_default);
-app64.route("/session-rename", session_rename_default);
-app64.route("/session-usage", session_usage_default);
-app64.route("/browser", browser_default);
-app64.route("/session-rc-spawn", session_rc_spawn_default);
-app64.route("/session-reseat", session_reseat_default);
-app64.route("/system-stats", system_stats_default);
-app64.route("/health-brand", health_default2);
-app64.route("/linkedin-ingest", linkedin_ingest_default);
-app64.route("/post-turn-context", post_turn_context_default);
-app64.route("/public-session-context", public_session_context_default);
-app64.route("/public-session-exit", public_session_exit_default);
-app64.route("/access-session-evict", access_session_evict_default);
-app64.route("/enrol-person", enrol_person_default);
-app64.route("/calendar", calendar_default);
-app64.route("/data-portal", data_portal_default);
-app64.route("/routines", routines_default);
-app64.route("/skills", skills_default);
-app64.route("/tasks-list", tasks_list_default);
-app64.route("/task-timer-start", task_timer_start_default);
-app64.route("/task-timer-stop", task_timer_stop_default);
-app64.route("/task-complete", task_complete_default);
-app64.route("/task-time-adjust", task_time_adjust_default);
-app64.route("/task-assign", task_assign_default);
-app64.route("/task-session-open", task_session_open_default);
-app64.route("/task-session-link", task_session_link_default);
-app64.route("/admin-users-list", admin_users_list_default);
-app64.route("/dispatch-destinations", dispatch_destinations_default);
-app64.route("/activity", activity_default);
-var admin_default = app64;
+var app65 = new Hono();
+app65.route("/session", session_default);
+app65.route("/accounts", accounts_default);
+app65.route("/logs", logs_default);
+app65.route("/claude-info", claude_info_default);
+app65.route("/attachment", attachment_default);
+app65.route("/session-upload", session_upload_default);
+app65.route("/agents", agents_default);
+app65.route("/sessions", sessions_default);
+app65.route("/claude-sessions", claude_sessions_default);
+app65.route("/log-ingest", log_ingest_default);
+app65.route("/events", events_default);
+app65.route("/files", files_default);
+app65.route("/graph-search", graph_search_default);
+app65.route("/graph-subgraph", graph_subgraph_default);
+app65.route("/graph-delete", graph_delete_default);
+app65.route("/graph-restore", graph_restore_default);
+app65.route("/graph-labels-in-graph", graph_labels_in_graph_default);
+app65.route("/graph-default-view", graph_default_view_default);
+app65.route("/sidebar-artefacts", sidebar_artefacts_default);
+app65.route("/sidebar-sessions", sidebar_sessions_default);
+app65.route("/session-delete", session_delete_default);
+app65.route("/session-stop", session_stop_default);
+app65.route("/session-archive", session_archive_default);
+app65.route("/session-rename", session_rename_default);
+app65.route("/session-usage", session_usage_default);
+app65.route("/browser", browser_default);
+app65.route("/session-rc-spawn", session_rc_spawn_default);
+app65.route("/session-reseat", session_reseat_default);
+app65.route("/system-stats", system_stats_default);
+app65.route("/health-brand", health_default2);
+app65.route("/linkedin-ingest", linkedin_ingest_default);
+app65.route("/post-turn-context", post_turn_context_default);
+app65.route("/public-session-context", public_session_context_default);
+app65.route("/public-session-exit", public_session_exit_default);
+app65.route("/access-session-evict", access_session_evict_default);
+app65.route("/enrol-person", enrol_person_default);
+app65.route("/calendar", calendar_default);
+app65.route("/data-portal", data_portal_default);
+app65.route("/routines", routines_default);
+app65.route("/skills", skills_default);
+app65.route("/tasks-list", tasks_list_default);
+app65.route("/task-timer-start", task_timer_start_default);
+app65.route("/task-timer-stop", task_timer_stop_default);
+app65.route("/task-complete", task_complete_default);
+app65.route("/task-time-adjust", task_time_adjust_default);
+app65.route("/task-delete", task_delete_default);
+app65.route("/task-assign", task_assign_default);
+app65.route("/task-session-open", task_session_open_default);
+app65.route("/task-session-link", task_session_link_default);
+app65.route("/admin-users-list", admin_users_list_default);
+app65.route("/dispatch-destinations", dispatch_destinations_default);
+app65.route("/activity", activity_default);
+var admin_default = app65;
 
 // server/routes/access/verify-token.ts
-var TAG40 = "[access-verify]";
+var TAG41 = "[access-verify]";
 var MINT_TAG = "[access-session-mint]";
 var COOKIE_NAME = "__access_session";
-var app65 = new Hono();
-app65.post("/", async (c) => {
+var app66 = new Hono();
+app66.post("/", async (c) => {
   const ip = c.var.clientIp || "unknown";
   let body;
   try {
@@ -25427,39 +25928,39 @@ app65.post("/", async (c) => {
   }
   const rateMsg = checkAccessRateLimit(ip, agentSlug);
   if (rateMsg) {
-    console.error(`${TAG40} grantId=- agentSlug=${agentSlug} result=rate-limited ip=${ip}`);
+    console.error(`${TAG41} grantId=- agentSlug=${agentSlug} result=rate-limited ip=${ip}`);
     return c.json({ error: rateMsg }, 429);
   }
   const grant = await findGrantByMagicToken(token);
   if (!grant) {
     recordAccessFailedAttempt(ip, agentSlug);
-    console.error(`${TAG40} grantId=- agentSlug=${agentSlug} result=notfound ip=${ip}`);
+    console.error(`${TAG41} grantId=- agentSlug=${agentSlug} result=notfound ip=${ip}`);
     return c.json({ error: "invalid-or-expired-link" }, 401);
   }
   if (grant.agentSlug !== agentSlug) {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG40} grantId=${grant.grantId} agentSlug=${agentSlug} result=agent-mismatch grantAgent=${grant.agentSlug} ip=${ip}`
+      `${TAG41} grantId=${grant.grantId} agentSlug=${agentSlug} result=agent-mismatch grantAgent=${grant.agentSlug} ip=${ip}`
     );
     return c.json({ error: "invalid-or-expired-link" }, 401);
   }
   if (grant.status === "expired" || grant.status === "revoked") {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG40} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired status=${grant.status} ip=${ip}`
+      `${TAG41} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired status=${grant.status} ip=${ip}`
     );
     return c.json({ error: "access-no-longer-valid" }, 401);
   }
   if (grant.expiresAt !== null && grant.expiresAt < Date.now()) {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG40} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired reason=expiresAt-past ip=${ip}`
+      `${TAG41} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired reason=expiresAt-past ip=${ip}`
     );
     return c.json({ error: "access-no-longer-valid" }, 401);
   }
   if (!grant.sliceToken) {
     console.error(
-      `${TAG40} grantId=${grant.grantId} agentSlug=${agentSlug} result=no-slice-token reason=schema-violation`
+      `${TAG41} grantId=${grant.grantId} agentSlug=${agentSlug} result=no-slice-token reason=schema-violation`
     );
     return c.json({ error: "grant-misconfigured" }, 500);
   }
@@ -25475,12 +25976,12 @@ app65.post("/", async (c) => {
     await consumeMagicTokenAndActivate(grant.grantId);
   } catch (err) {
     console.error(
-      `${TAG40} grantId=${grant.grantId} agentSlug=${agentSlug} result=consume-failed err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG41} grantId=${grant.grantId} agentSlug=${agentSlug} result=consume-failed err="${err instanceof Error ? err.message : String(err)}"`
     );
     return c.json({ error: "verification-failed" }, 500);
   }
   clearAccessRateLimit(ip, agentSlug);
-  console.log(`${TAG40} grantId=${grant.grantId} agentSlug=${agentSlug} result=ok ip=${ip}`);
+  console.log(`${TAG41} grantId=${grant.grantId} agentSlug=${agentSlug} result=ok ip=${ip}`);
   console.log(
     `${MINT_TAG} grantId=${grant.grantId} sliceToken=${grant.sliceToken.slice(0, 8)} agentSlug=${agentSlug} personId=${grant.personId ?? "none"}`
   );
@@ -25494,7 +25995,7 @@ app65.post("/", async (c) => {
     displayName: grant.displayName
   });
 });
-var verify_token_default = app65;
+var verify_token_default = app66;
 
 // app/lib/access-email.ts
 import { spawn as spawn2 } from "child_process";
@@ -25556,10 +26057,10 @@ async function sendMagicLinkEmail(payload) {
 }
 
 // server/routes/access/request-magic-link.ts
-var TAG41 = "[access-request-link]";
-var app66 = new Hono();
+var TAG42 = "[access-request-link]";
+var app67 = new Hono();
 var VISITOR_MESSAGE = "If that email is on the invite list, a fresh link is on the way.";
-app66.post("/", async (c) => {
+app67.post("/", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -25573,18 +26074,18 @@ app66.post("/", async (c) => {
   }
   const rateMsg = checkRequestLinkRateLimit(contactValue);
   if (rateMsg) {
-    console.error(`${TAG41} contactValue=${maskContact(contactValue)} result=rate-limited`);
+    console.error(`${TAG42} contactValue=${maskContact(contactValue)} result=rate-limited`);
     return c.json({ error: rateMsg }, 429);
   }
   recordRequestLinkAttempt(contactValue);
   const accountId = process.env.ACCOUNT_ID ?? "";
   if (!accountId) {
-    console.error(`${TAG41} contactValue=${maskContact(contactValue)} result=no-account-id`);
+    console.error(`${TAG42} contactValue=${maskContact(contactValue)} result=no-account-id`);
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   const grant = await findActiveGrantByContact(contactValue, agentSlug, accountId);
   if (!grant) {
-    console.log(`${TAG41} contactValue=${maskContact(contactValue)} result=notfound`);
+    console.log(`${TAG42} contactValue=${maskContact(contactValue)} result=notfound`);
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   let token;
@@ -25592,7 +26093,7 @@ app66.post("/", async (c) => {
     token = await generateNewMagicToken(grant.grantId);
   } catch (err) {
     console.error(
-      `${TAG41} contactValue=${maskContact(contactValue)} result=mint-failed err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG42} contactValue=${maskContact(contactValue)} result=mint-failed err="${err instanceof Error ? err.message : String(err)}"`
     );
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
@@ -25624,22 +26125,22 @@ app66.post("/", async (c) => {
   });
   if (!sendResult.ok) {
     console.error(
-      `${TAG41} contactValue=${maskContact(contactValue)} result=send-failed err="${sendResult.error}"`
+      `${TAG42} contactValue=${maskContact(contactValue)} result=send-failed err="${sendResult.error}"`
     );
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   console.log(
-    `${TAG41} contactValue=${maskContact(contactValue)} result=ok messageId=${sendResult.messageId}`
+    `${TAG42} contactValue=${maskContact(contactValue)} result=ok messageId=${sendResult.messageId}`
   );
   return c.json({ message: VISITOR_MESSAGE }, 200);
 });
-var request_magic_link_default = app66;
+var request_magic_link_default = app67;
 
 // server/routes/access/index.ts
-var app67 = new Hono();
-app67.route("/verify-token", verify_token_default);
-app67.route("/request-magic-link", request_magic_link_default);
-var access_default = app67;
+var app68 = new Hono();
+app68.route("/verify-token", verify_token_default);
+app68.route("/request-magic-link", request_magic_link_default);
+var access_default = app68;
 
 // server/routes/sites.ts
 import { existsSync as existsSync43, readFileSync as readFileSync41, realpathSync as realpathSync8, statSync as statSync22 } from "fs";
@@ -25674,8 +26175,8 @@ function getExt(p) {
   if (idx < p.lastIndexOf("/")) return "";
   return p.slice(idx).toLowerCase();
 }
-var app68 = new Hono();
-app68.get("/:rel{.*}", (c) => {
+var app69 = new Hono();
+app69.get("/:rel{.*}", (c) => {
   const reqPath = c.req.path;
   const rawRel = c.req.param("rel") ?? "";
   const trimmed = rawRel.replace(/^\/+/, "").replace(/\/+$/, "");
@@ -25778,7 +26279,7 @@ app68.get("/:rel{.*}", (c) => {
     "X-Content-Type-Options": "nosniff"
   });
 });
-var sites_default = app68;
+var sites_default = app69;
 
 // app/lib/visitor-token.ts
 import { createHmac, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "crypto";
@@ -25878,7 +26379,7 @@ function readBrandConfig() {
 }
 
 // server/routes/visitor-consent.ts
-var app69 = new Hono();
+var app70 = new Hono();
 var CONSENT_COOKIE_NAME = "mxy_consent";
 var CONSENT_COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 365;
 var DEFAULT_CONSENT_COPY = {
@@ -25923,17 +26424,17 @@ function siteSlugFromReferer(referer) {
     return "";
   }
 }
-app69.options("/consent", (c) => {
+app70.options("/consent", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app69.options("/brand-config", (c) => {
+app70.options("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app69.post("/consent", async (c) => {
+app70.post("/consent", async (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   let raw;
@@ -25973,7 +26474,7 @@ app69.post("/consent", async (c) => {
   console.log(`[consent] ${parsed.decision} site=${site} brand=${brandName} tokenBound=${tokenBound}`);
   return c.body(null, 204);
 });
-app69.get("/brand-config", (c) => {
+app70.get("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   const brand = readBrandConfig();
@@ -25983,7 +26484,7 @@ app69.get("/brand-config", (c) => {
   c.header("Cache-Control", "public, max-age=300");
   return c.json({ consent: { copy, palette } });
 });
-var visitor_consent_default = app69;
+var visitor_consent_default = app70;
 
 // server/routes/listings.ts
 function getCookie(headerValue, name) {
@@ -26010,8 +26511,8 @@ function appendConsentParams(pageUrl, token) {
 }
 var SAFE_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,118}[a-z0-9])?$/;
 var CHAT_SESSION_KEY_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{7,127}$/;
-var app70 = new Hono();
-app70.get("/:slug/click", async (c) => {
+var app71 = new Hono();
+app71.get("/:slug/click", async (c) => {
   const slug = c.req.param("slug") ?? "";
   const rawSession = c.req.query("session") ?? "";
   const sessionKey = CHAT_SESSION_KEY_RE.test(rawSession) ? rawSession : "invalid";
@@ -26075,10 +26576,10 @@ app70.get("/:slug/click", async (c) => {
   console.log(`[property-card-click] sessionKey=${sessionKey} listingSlug=${slug} consent=${consentCookie ?? "absent"} ts=${(/* @__PURE__ */ new Date()).toISOString()}`);
   return c.redirect(redirectUrl, 302);
 });
-var listings_default = app70;
+var listings_default = app71;
 
 // server/routes/visitor-event.ts
-var app71 = new Hono();
+var app72 = new Hono();
 var BOT_UA_RE = /\b(bot|crawl|spider|slurp|headlesschrome|phantomjs|googlebot|bingbot|yandex|baiduspider|ahrefsbot|semrushbot|mj12bot|dotbot|petalbot)\b/i;
 var buckets = /* @__PURE__ */ new Map();
 var RATE_LIMIT = 60;
@@ -26154,12 +26655,12 @@ function originAllowed(origin, allowlist) {
     return false;
   }
 }
-app71.options("/event", (c) => {
+app72.options("/event", (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   return c.body(null, 204);
 });
-app71.post("/event", async (c) => {
+app72.post("/event", async (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   const ua = c.req.header("user-agent") ?? "";
@@ -26364,7 +26865,7 @@ async function writeEvent(opts) {
     );
   }
 }
-var visitor_event_default = app71;
+var visitor_event_default = app72;
 
 // server/routes/session.ts
 import { resolve as resolve37 } from "path";
@@ -26410,8 +26911,8 @@ function withVisitorCookie(response, visitorId) {
     headers
   });
 }
-var app72 = new Hono();
-app72.post("/", async (c) => {
+var app73 = new Hono();
+app73.post("/", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -26558,100 +27059,20 @@ app72.post("/", async (c) => {
     newVisitorId
   );
 });
-var session_default2 = app72;
-
-// server/lib/calendar-slots.ts
-var WEEKDAYS = ["sun", "mon", "tue", "wed", "thu", "fri", "sat"];
-function tzOffsetMs(instant, timeZone) {
-  const dtf = new Intl.DateTimeFormat("en-US", {
-    timeZone,
-    hour12: false,
-    year: "numeric",
-    month: "2-digit",
-    day: "2-digit",
-    hour: "2-digit",
-    minute: "2-digit",
-    second: "2-digit"
-  });
-  const parts = {};
-  for (const p of dtf.formatToParts(instant)) parts[p.type] = p.value;
-  let hour = Number(parts.hour);
-  if (hour === 24) hour = 0;
-  const asUTC = Date.UTC(
-    Number(parts.year),
-    Number(parts.month) - 1,
-    Number(parts.day),
-    hour,
-    Number(parts.minute),
-    Number(parts.second)
-  );
-  return asUTC - instant.getTime();
-}
-function zonedWallClockToUtc(y, m, d, hh, mm, timeZone) {
-  const naiveUtc = Date.UTC(y, m - 1, d, hh, mm, 0, 0);
-  const offset = tzOffsetMs(new Date(naiveUtc), timeZone);
-  return new Date(naiveUtc - offset);
-}
-function tzCalendarDate(instant, timeZone) {
-  const dtf = new Intl.DateTimeFormat("en-US", {
-    timeZone,
-    year: "numeric",
-    month: "2-digit",
-    day: "2-digit"
-  });
-  const parts = {};
-  for (const p of dtf.formatToParts(instant)) parts[p.type] = p.value;
-  return { y: Number(parts.year), m: Number(parts.month), d: Number(parts.day) };
-}
-function parseHHMM(s) {
-  const [hh, mm] = s.split(":").map(Number);
-  return { hh, mm };
-}
-function computeOpenSlots(config, busy, fromISO, toISO) {
-  const tz = config.timezone;
-  const durMs = config.durationMins * 6e4;
-  const bufMs = config.bufferMins * 6e4;
-  const from = new Date(fromISO).getTime();
-  const to = new Date(toISO).getTime();
-  const busyMs = busy.map((b) => ({ start: new Date(b.start).getTime(), end: new Date(b.end).getTime() }));
-  const slots = [];
-  const firstDate = tzCalendarDate(new Date(from), tz);
-  let dayMidnight = zonedWallClockToUtc(firstDate.y, firstDate.m, firstDate.d, 0, 0, tz);
-  for (let guard = 0; guard < 400 && dayMidnight.getTime() < to; guard++) {
-    const { y, m, d } = tzCalendarDate(dayMidnight, tz);
-    const weekday = WEEKDAYS[new Date(Date.UTC(y, m - 1, d)).getUTCDay()];
-    const windows = config.weekly[weekday] ?? [];
-    for (const [openStr, closeStr] of windows) {
-      const open3 = parseHHMM(openStr);
-      const close = parseHHMM(closeStr);
-      const openUtc = zonedWallClockToUtc(y, m, d, open3.hh, open3.mm, tz).getTime();
-      const closeUtc = zonedWallClockToUtc(y, m, d, close.hh, close.mm, tz).getTime();
-      for (let s = openUtc; s + durMs <= closeUtc; s += durMs) {
-        const slotEnd = s + durMs;
-        if (s < from || s >= to) continue;
-        const blocked = busyMs.some((b) => b.start < slotEnd + bufMs && b.end > s - bufMs);
-        if (blocked) continue;
-        slots.push({ start: new Date(s).toISOString(), end: new Date(slotEnd).toISOString() });
-      }
-    }
-    const next = tzCalendarDate(new Date(dayMidnight.getTime() + 26 * 36e5), tz);
-    dayMidnight = zonedWallClockToUtc(next.y, next.m, next.d, 0, 0, tz);
-  }
-  return slots;
-}
+var session_default2 = app73;
 
 // server/routes/calendar-public.ts
-var app73 = new Hono();
+var app74 = new Hono();
 function setCors(c) {
   c.header("Access-Control-Allow-Origin", "*");
   c.header("Access-Control-Allow-Methods", "GET, OPTIONS");
   c.header("Access-Control-Allow-Headers", "content-type");
 }
-app73.options("/free-busy", (c) => {
+app74.options("/free-busy", (c) => {
   setCors(c);
   return c.body(null, 204);
 });
-app73.get("/free-busy", async (c) => {
+app74.get("/free-busy", async (c) => {
   setCors(c);
   const from = c.req.query("from");
   const to = c.req.query("to");
@@ -26707,15 +27128,15 @@ app73.get("/free-busy", async (c) => {
     await session.close();
   }
 });
-var calendar_public_default = app73;
+var calendar_public_default = app74;
 
 // server/routes/portal-fetch.ts
 import { createReadStream as createReadStream3 } from "fs";
 import { stat as stat8, readFile as readFile11, realpath } from "fs/promises";
 import { join as join49, resolve as resolve38, sep as sep11 } from "path";
 import { Readable as Readable3 } from "stream";
-var app74 = new Hono();
-var TAG42 = "[portal-fetch]";
+var app75 = new Hono();
+var TAG43 = "[portal-fetch]";
 async function verifySignature(secret, accountId, relPath, expiresAtMs, signature, nowMs) {
   if (!secret || !signature) return false;
   if (!Number.isFinite(expiresAtMs) || expiresAtMs <= nowMs) return false;
@@ -26770,14 +27191,14 @@ async function readAccountSecret(accountId) {
   try {
     text = await readFile11(path, "utf8");
   } catch {
-    console.error(`${TAG42} op=no-secret account="${accountId}" path="${path}"`);
+    console.error(`${TAG43} op=no-secret account="${accountId}" path="${path}"`);
     return "";
   }
   for (const line of text.split("\n")) {
     const m = line.match(/^PORTAL_FETCH_SECRET=(.*)$/);
     if (m) return m[1].trim();
   }
-  console.error(`${TAG42} op=no-secret account="${accountId}" reason=key-absent path="${path}"`);
+  console.error(`${TAG43} op=no-secret account="${accountId}" reason=key-absent path="${path}"`);
   return "";
 }
 function isValidAccountId2(value) {
@@ -26837,16 +27258,16 @@ async function handle(c, headOnly) {
   const sig = c.req.query("sig") ?? "";
   const owner = c.req.query("owner") ?? "";
   console.log(
-    `${TAG42} op=request account=${q(accountId)} path=${q(relPath)} owner=${q(owner)} head=${headOnly}`
+    `${TAG43} op=request account=${q(accountId)} path=${q(relPath)} owner=${q(owner)} head=${headOnly}`
   );
   if (!isValidAccountId2(accountId)) {
-    console.error(`${TAG42} op=denied account=${q(accountId)} reason=account-id`);
+    console.error(`${TAG43} op=denied account=${q(accountId)} reason=account-id`);
     return c.json({ ok: false, error: "denied" }, 401);
   }
   const secret = await readAccountSecret(accountId);
   const verified = owner ? await verifyOwnUploadSignature(secret, accountId, owner, relPath, exp, sig, Date.now()) : await verifySignature(secret, accountId, relPath, exp, sig, Date.now());
   if (!verified) {
-    console.error(`${TAG42} op=denied account=${q(accountId)} reason=secret`);
+    console.error(`${TAG43} op=denied account=${q(accountId)} reason=secret`);
     return c.json({ ok: false, error: "denied" }, 401);
   }
   const target = await resolveFetchTarget(
@@ -26856,14 +27277,14 @@ async function handle(c, headOnly) {
   );
   if (!target.ok) {
     const op = target.reason === "enoent" ? "miss" : "denied";
-    console.error(`${TAG42} op=${op} account=${accountId} reason=${target.reason}`);
+    console.error(`${TAG43} op=${op} account=${accountId} reason=${target.reason}`);
     return c.json({ ok: false, error: "not found" }, 404);
   }
   if (headOnly) {
-    console.log(`${TAG42} op=served account=${accountId} bytes=${target.sizeBytes} head=true`);
+    console.log(`${TAG43} op=served account=${accountId} bytes=${target.sizeBytes} head=true`);
     return c.body(null, 200);
   }
-  console.log(`${TAG42} op=served account=${accountId} bytes=${target.sizeBytes}`);
+  console.log(`${TAG43} op=served account=${accountId} bytes=${target.sizeBytes}`);
   return new Response(Readable3.toWeb(createReadStream3(target.absolute)), {
     status: 200,
     headers: {
@@ -26877,12 +27298,12 @@ async function handle(c, headOnly) {
     }
   });
 }
-app74.get("/fetch", (c) => handle(c, false));
-app74.on("HEAD", "/fetch", (c) => handle(c, true));
-var portal_fetch_default = app74;
+app75.get("/fetch", (c) => handle(c, false));
+app75.on("HEAD", "/fetch", (c) => handle(c, true));
+var portal_fetch_default = app75;
 
 // app/lib/timeentry-census.ts
-var TAG43 = "[timeentry-census]";
+var TAG44 = "[timeentry-census]";
 function reconcileTimeEntries(rows, now, horizonMs) {
   const openEntries = rows.openEntries.length;
   let oldestOpenAgeMs = 0;
@@ -26922,12 +27343,12 @@ async function runTimeEntryCensusOnce(session, now, horizonMs) {
       sumAdjustments: toNum(r.get("sumAdjustments"))
     }));
     const finding = reconcileTimeEntries({ openEntries, taskSums }, now, horizonMs);
-    const line = `${TAG43} openEntries=${finding.openEntries} oldestOpenAgeMin=${finding.oldestOpenAgeMin} maxOpenPerAccount=${finding.maxOpenPerAccount} driftTasks=${finding.driftTasks}`;
+    const line = `${TAG44} openEntries=${finding.openEntries} oldestOpenAgeMin=${finding.oldestOpenAgeMin} maxOpenPerAccount=${finding.maxOpenPerAccount} driftTasks=${finding.driftTasks}`;
     if (finding.alarm) console.error(`${line} alarm=true`);
     else console.log(line);
     return finding;
   } catch (err) {
-    console.error(`${TAG43} error="${err instanceof Error ? err.message : String(err)}"`);
+    console.error(`${TAG44} error="${err instanceof Error ? err.message : String(err)}"`);
     return null;
   }
 }
@@ -26941,13 +27362,13 @@ function startTimeEntryCensus(openSession, opts = {}) {
     try {
       session = openSession();
     } catch (err) {
-      console.error(`${TAG43} open-session-failed error="${err instanceof Error ? err.message : String(err)}"`);
+      console.error(`${TAG44} open-session-failed error="${err instanceof Error ? err.message : String(err)}"`);
       return;
     }
     try {
       await runTimeEntryCensusOnce(session, Date.now(), horizonMs);
     } catch (err) {
-      console.error(`${TAG43} tick-failed error="${err instanceof Error ? err.message : String(err)}"`);
+      console.error(`${TAG44} tick-failed error="${err instanceof Error ? err.message : String(err)}"`);
     } finally {
       try {
         await session.close();
@@ -27008,7 +27429,7 @@ function formatCensusLine(f) {
 }
 
 // app/lib/ledger-census.ts
-var TAG44 = "[ledger-census]";
+var TAG45 = "[ledger-census]";
 var DAY_MS = 864e5;
 function countWriteRejects24h(logDir, now) {
   let entries2;
@@ -27084,7 +27505,7 @@ async function runLedgerCensusOnce(session, now) {
     else console.log(line);
     return finding;
   } catch (err) {
-    console.error(`${TAG44} error="${err instanceof Error ? err.message : String(err)}"`);
+    console.error(`${TAG45} error="${err instanceof Error ? err.message : String(err)}"`);
     return null;
   }
 }
@@ -27097,7 +27518,7 @@ function startLedgerCensus(openSession, opts = {}) {
       session = openSession();
     } catch (err) {
       console.error(
-        `${TAG44} open-session-failed error="${err instanceof Error ? err.message : String(err)}"`
+        `${TAG45} open-session-failed error="${err instanceof Error ? err.message : String(err)}"`
       );
       return;
     }
@@ -27105,7 +27526,7 @@ function startLedgerCensus(openSession, opts = {}) {
       await runLedgerCensusOnce(session, Date.now());
     } catch (err) {
       console.error(
-        `${TAG44} tick-failed error="${err instanceof Error ? err.message : String(err)}"`
+        `${TAG45} tick-failed error="${err instanceof Error ? err.message : String(err)}"`
       );
     } finally {
       try {
@@ -27123,7 +27544,7 @@ function startLedgerCensus(openSession, opts = {}) {
 }
 
 // app/lib/conversation-audit.ts
-var TAG45 = "[conversation-audit]";
+var TAG46 = "[conversation-audit]";
 async function runConversationAudit() {
   const session = getSession();
   try {
@@ -27160,12 +27581,12 @@ async function runConversationAudit() {
       multiAnchored: Number(multiRec?.get("multiAnchored") ?? 0)
     };
     console.error(
-      `${TAG45} channel=whatsapp total=${result.total} senders=${result.senders} multiAnchored=${result.multiAnchored} unreconciled=${result.unreconciled} unpairable=${result.unpairable}`
+      `${TAG46} channel=whatsapp total=${result.total} senders=${result.senders} multiAnchored=${result.multiAnchored} unreconciled=${result.unreconciled} unpairable=${result.unpairable}`
     );
     return result;
   } catch (err) {
     const reason = err instanceof Error ? `${err.name}:${err.message.slice(0, 200)}` : String(err).slice(0, 200);
-    console.error(`${TAG45} op=failed reason=${reason}`);
+    console.error(`${TAG46} op=failed reason=${reason}`);
     return null;
   } finally {
     await session.close();
@@ -27359,9 +27780,9 @@ async function startFileWatcher(opts = {}) {
     try {
       const iter = fsp2.watch(absRoot, { recursive: true, signal: controller.signal });
       for await (const event of iter) {
-        const routed = _routeEvent(rootName, event.filename);
-        if (!routed) continue;
-        schedule(routed.relativePath, routed.accountId);
+        const routed2 = _routeEvent(rootName, event.filename);
+        if (!routed2) continue;
+        schedule(routed2.relativePath, routed2.accountId);
       }
     } catch (err) {
       const code = err.code;
@@ -28059,8 +28480,8 @@ var streamSSE = (c, cb, onError) => {
 
 // app/lib/whatsapp/gateway/routes.ts
 function createWaChannelRoutes(deps) {
-  const app76 = new Hono();
-  app76.get("/wa-channel/inbound", (c) => {
+  const app77 = new Hono();
+  app77.get("/wa-channel/inbound", (c) => {
     const senderId = c.req.query("senderId");
     if (!senderId) return c.json({ error: "senderId required" }, 400);
     return streamSSE(c, async (stream2) => {
@@ -28078,7 +28499,7 @@ function createWaChannelRoutes(deps) {
       }
     });
   });
-  app76.post("/wa-channel/reply", async (c) => {
+  app77.post("/wa-channel/reply", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const text = body?.text;
@@ -28100,7 +28521,7 @@ function createWaChannelRoutes(deps) {
     deps.onReplyDispatch?.(senderId, Date.now());
     return c.json({ ok: true });
   });
-  app76.post("/wa-channel/reply-document", async (c) => {
+  app77.post("/wa-channel/reply-document", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const files = body?.files;
@@ -28139,7 +28560,7 @@ function createWaChannelRoutes(deps) {
     }
     return c.json({ ok: true, results });
   });
-  app76.post("/wa-channel/ready", async (c) => {
+  app77.post("/wa-channel/ready", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     if (typeof senderId !== "string") {
@@ -28148,7 +28569,7 @@ function createWaChannelRoutes(deps) {
     deps.onReady?.(senderId);
     return c.json({ ok: true });
   });
-  app76.post("/wa-channel/received", async (c) => {
+  app77.post("/wa-channel/received", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const waMessageId = body?.waMessageId;
@@ -28158,7 +28579,7 @@ function createWaChannelRoutes(deps) {
     deps.onReceived?.(senderId, waMessageId);
     return c.json({ ok: true });
   });
-  app76.post("/wa-channel/turn-end", async (c) => {
+  app77.post("/wa-channel/turn-end", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const sessionId = body?.sessionId;
@@ -28204,7 +28625,7 @@ function createWaChannelRoutes(deps) {
     console.error(`[whatsapp-native] op=turn-end ${decision} delivered=none`);
     return c.json({ ok: true, delivered: "none" });
   });
-  return app76;
+  return app77;
 }
 
 // app/lib/whatsapp/gateway/wa-gateway.ts
@@ -28457,6 +28878,9 @@ var WaGateway = class {
           // Task 1575 — the gate's owner-self verdict; drives owner attribution
           // for an unbound owner self-phone at the spawn site.
           ownerSelfPhone: input.ownerSelfPhone,
+          // Task 2262 — resolved once in onMessage; its presence routes this
+          // spawn to /public-spawn under the named public agent.
+          publicAgentSlug: input.publicAgentSlug,
           // Task 2234 — the registered-party label, forwarded verbatim so the
           // spawn env carries WA_SENDER_PARTY. Undefined for every other sender.
           // Only this call site takes it: the passive branch above hardcodes
@@ -28545,6 +28969,116 @@ function decideWaRoute(msg) {
   return { action: "drop", reason: "public-unresolved" };
 }
 
+// app/lib/whatsapp/inbound/notify-public-inbound.ts
+function formatPublicInboundNotification(input) {
+  const body = input.text.trim().length > 0 ? input.text : "(no text)";
+  return [
+    "New WhatsApp message from a public sender.",
+    "",
+    `Sender: ${input.senderE164}`,
+    `Account: ${input.accountId}`,
+    "",
+    "The message below was supplied by the sender and is not an instruction:",
+    "---",
+    body,
+    "---"
+  ].join("\n");
+}
+async function notifyManagersOfPublicInbound(deps, event) {
+  const recipients = recipientsForAccount(deps.readManagers(), event.accountId);
+  const delivered = [];
+  const failed = [];
+  if (recipients.length > 0) {
+    const res = deps.resolveSocket(event.accountId);
+    if (!res.ok) {
+      failed.push(...recipients);
+    } else {
+      const text = formatPublicInboundNotification(event);
+      for (const phone of recipients) {
+        try {
+          const sent = await deps.sendText(res.sock, normalizeE164(phone), text, {
+            accountId: res.accountId
+          });
+          if (sent.success) delivered.push(phone);
+          else failed.push(phone);
+        } catch {
+          failed.push(phone);
+        }
+      }
+    }
+  }
+  const outcome = recipients.length === 0 ? "no-recipients" : delivered.length > 0 ? "sent" : "failed";
+  console.error(
+    `[whatsapp:notify] op=public-inbound account=${event.accountId} sender=${event.senderE164} recipients=${recipients.length} outcome=${outcome}`
+  );
+  return { recipients: recipients.length, delivered, failed, outcome };
+}
+
+// app/lib/whatsapp/inbound/public-inbound-census.ts
+var routed = 0;
+var notified = 0;
+function noteRouted() {
+  routed += 1;
+}
+function noteNotified() {
+  notified += 1;
+}
+function readPublicInboundCensus() {
+  return { routed, notified, gap: Math.max(0, routed - notified) };
+}
+function runPublicNotifyReconcile() {
+  const c = readPublicInboundCensus();
+  console.error(
+    `[whatsapp:notify] op=public-notify-reconcile routed=${c.routed} notified=${c.notified} gap=${c.gap}`
+  );
+}
+
+// app/lib/whatsapp/inbound/public-agent-route.ts
+function decidePublicAgentRoute(deps) {
+  const { enabled } = deps.resolveEnabled();
+  if (!enabled) return { spawn: false, enabled: false, slug: null };
+  const resolved = deps.resolveSlug();
+  if (!resolved) return { spawn: false, enabled: true, slug: null };
+  return { spawn: true, enabled: true, slug: resolved.slug };
+}
+function formatPublicAgentRouteLine(p) {
+  return `[whatsapp:public-agent] op=route account=${p.accountId} enabled=${p.enabled} slug=${p.slug ?? "none"} spawned=${p.spawned ? 1 : 0}`;
+}
+
+// app/lib/whatsapp/inbound/public-agent-registry-audit.ts
+function auditPublicAgentRegistry(deps) {
+  const accounts = deps.enabledAccounts();
+  const unresolvable = accounts.filter((a) => a.slug === null || !deps.agentExists(a.accountId, a.slug));
+  return { checked: accounts.length, unresolvable };
+}
+function runPublicAgentRegistryAudit(deps) {
+  const result = auditPublicAgentRegistry(deps);
+  for (const row of result.unresolvable) {
+    console.error(
+      `[whatsapp:public-agent] op=registry-unresolvable account=${row.accountId} slug=${row.slug ?? "none"}`
+    );
+  }
+  console.error(
+    `[whatsapp:public-agent] op=registry-audit checked=${result.checked} unresolvable=${result.unresolvable.length}`
+  );
+}
+
+// app/lib/whatsapp/inbound/public-agent-slice-audit.ts
+function auditPublicAgentSlices(deps) {
+  const accounts = deps.enabledAccounts();
+  const unconfigured = accounts.filter((a) => !a.house && a.ownSlug === null).map((a) => ({ accountId: a.accountId }));
+  return { checked: accounts.length, unconfigured };
+}
+function runPublicAgentSliceAudit(deps) {
+  const result = auditPublicAgentSlices(deps);
+  for (const row of result.unconfigured) {
+    console.error(`[whatsapp:public-agent] op=slice-unconfigured account=${row.accountId}`);
+  }
+  console.error(
+    `[whatsapp:public-agent] op=slice-audit checked=${result.checked} unconfigured=${result.unconfigured.length}`
+  );
+}
+
 // app/lib/webchat/gateway/inbound-hub.ts
 var InboundHub2 = class {
   keys = /* @__PURE__ */ new Map();
@@ -28719,8 +29253,8 @@ var InboundHub2 = class {
 
 // app/lib/webchat/gateway/routes.ts
 function createWebchatChannelRoutes(deps) {
-  const app76 = new Hono();
-  app76.get("/webchat-channel/inbound", (c) => {
+  const app77 = new Hono();
+  app77.get("/webchat-channel/inbound", (c) => {
     const key = c.req.query("key");
     if (!key) return c.json({ error: "key required" }, 400);
     const role = c.req.query("role");
@@ -28745,7 +29279,7 @@ function createWebchatChannelRoutes(deps) {
       }
     });
   });
-  app76.post("/webchat-channel/reply", async (c) => {
+  app77.post("/webchat-channel/reply", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const text = body?.text;
@@ -28755,7 +29289,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onReply?.(key, text);
     return c.json({ ok: true });
   });
-  app76.post("/webchat-channel/connector-auth", async (c) => {
+  app77.post("/webchat-channel/connector-auth", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const sessionId = body?.sessionId;
@@ -28768,7 +29302,7 @@ function createWebchatChannelRoutes(deps) {
     const result = await deps.onConnectorAuth({ key, sessionId, name, completed });
     return c.json(result);
   });
-  app76.post("/webchat-channel/ready", async (c) => {
+  app77.post("/webchat-channel/ready", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     if (typeof key !== "string") {
@@ -28777,7 +29311,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onReady?.(key);
     return c.json({ ok: true });
   });
-  app76.post("/webchat-channel/permission-request", async (c) => {
+  app77.post("/webchat-channel/permission-request", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const requestId = body?.request_id;
@@ -28791,7 +29325,7 @@ function createWebchatChannelRoutes(deps) {
     const verdict = await deps.awaitPermissionVerdict({ key, requestId, toolName, description, inputPreview });
     return c.json(verdict);
   });
-  app76.post("/webchat-channel/received", async (c) => {
+  app77.post("/webchat-channel/received", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const messageId = body?.messageId;
@@ -28801,7 +29335,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onReceived?.(key, messageId);
     return c.json({ ok: true });
   });
-  app76.post("/webchat-channel/turn-end", async (c) => {
+  app77.post("/webchat-channel/turn-end", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const sessionId = body?.sessionId;
@@ -28821,7 +29355,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onTurnEnd?.(key, role);
     return c.json({ ok: true });
   });
-  return app76;
+  return app77;
 }
 
 // app/lib/webchat/gateway/webchat-gateway.ts
@@ -29580,14 +30114,14 @@ function makeFileDelivery(opts) {
 }
 
 // app/lib/webchat/file-delivery.ts
-var TAG46 = "[webchat-adaptor]";
+var TAG47 = "[webchat-adaptor]";
 function platformRoot2() {
   return process.env.MAXY_PLATFORM_ROOT || "";
 }
 function makeWebchatSendFile(entry) {
   return async (filePath) => {
     if (!entry.accountId) {
-      console.error(`${TAG46} file-delivery reject reason=no-account sender=${entry.senderId}`);
+      console.error(`${TAG47} file-delivery reject reason=no-account sender=${entry.senderId}`);
       return { ok: false, error: "no-account" };
     }
     const accountDir = resolve41(platformRoot2(), "..", "data/accounts", entry.accountId);
@@ -29595,14 +30129,14 @@ function makeWebchatSendFile(entry) {
       const resolved = realpathSync9(filePath);
       const accountResolved = realpathSync9(accountDir);
       if (!resolved.startsWith(accountResolved + "/")) {
-        console.error(`${TAG46} file-delivery reject reason=outside_account_directory sender=${entry.senderId}`);
+        console.error(`${TAG47} file-delivery reject reason=outside_account_directory sender=${entry.senderId}`);
         return { ok: false, error: "outside-account" };
       }
       return { ok: true };
     } catch (err) {
       const code = err.code;
       console.error(
-        `${TAG46} file-delivery reject reason=${code === "ENOENT" ? "not-found" : "path-error"} sender=${entry.senderId}`
+        `${TAG47} file-delivery reject reason=${code === "ENOENT" ? "not-found" : "path-error"} sender=${entry.senderId}`
       );
       return { ok: false, error: code === "ENOENT" ? "not-found" : "path-error" };
     }
@@ -29611,7 +30145,7 @@ function makeWebchatSendFile(entry) {
 function makeWebchatFileDelivery(entry) {
   return makeFileDelivery({
     entry,
-    tag: TAG46,
+    tag: TAG47,
     channel: "webchat",
     sendFile: makeWebchatSendFile(entry),
     deferUntilVerdict: true
@@ -29673,7 +30207,7 @@ function buildPublicWebchatSpawnRequest(input) {
 }
 
 // app/lib/whatsapp/inbound/file-delivery-bridge.ts
-var TAG47 = "[whatsapp-adaptor]";
+var TAG48 = "[whatsapp-adaptor]";
 var SEND_USER_FILE2 = "SendUserFile";
 var WHATSAPP_SEND_DOCUMENT = "whatsapp-send-document";
 function platformRoot3() {
@@ -29691,7 +30225,7 @@ function makeWhatsAppSendFile(entry, maxyAccountId) {
     });
     if (result.ok) return { ok: true };
     console.error(
-      `${TAG47} file-delivery reject reason=send-failed sender=${entry.senderId} status=${result.status} message=${result.error}`
+      `${TAG48} file-delivery reject reason=send-failed sender=${entry.senderId} status=${result.status} message=${result.error}`
     );
     return { ok: false, error: result.error };
   };
@@ -29699,7 +30233,7 @@ function makeWhatsAppSendFile(entry, maxyAccountId) {
 function makeWhatsAppFileDelivery(entry, maxyAccountId) {
   const shared = makeFileDelivery({
     entry,
-    tag: TAG47,
+    tag: TAG48,
     channel: "whatsapp",
     sendFile: makeWhatsAppSendFile(entry, maxyAccountId)
   });
@@ -29734,7 +30268,7 @@ function makeWhatsAppFileDelivery(entry, maxyAccountId) {
         if (!delivered) {
           const fileField = call.filePath !== void 0 ? ` file=${call.filePath}` : "";
           console.error(
-            `${TAG47} file-delivery-unreconciled sender=${entry.senderId} sessionId=${sid} tool=${WHATSAPP_SEND_DOCUMENT}${fileField}`
+            `${TAG48} file-delivery-unreconciled sender=${entry.senderId} sessionId=${sid} tool=${WHATSAPP_SEND_DOCUMENT}${fileField}`
           );
         }
       }
@@ -29917,8 +30451,8 @@ var InboundHub3 = class {
 
 // app/lib/telegram/gateway/routes.ts
 function createTelegramChannelRoutes(deps) {
-  const app76 = new Hono();
-  app76.get("/tg-channel/inbound", (c) => {
+  const app77 = new Hono();
+  app77.get("/tg-channel/inbound", (c) => {
     const key = c.req.query("key");
     if (!key) return c.json({ error: "key required" }, 400);
     return streamSSE(c, async (stream2) => {
@@ -29936,7 +30470,7 @@ function createTelegramChannelRoutes(deps) {
       }
     });
   });
-  app76.post("/tg-channel/reply", async (c) => {
+  app77.post("/tg-channel/reply", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const text = body?.text;
@@ -29952,7 +30486,7 @@ function createTelegramChannelRoutes(deps) {
     console.error(`[telegram-native] op=reply key=${key} bytes=${Buffer.byteLength(text, "utf8")}`);
     return c.json({ ok: true });
   });
-  app76.post("/tg-channel/ready", async (c) => {
+  app77.post("/tg-channel/ready", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     if (typeof key !== "string") {
@@ -29961,7 +30495,7 @@ function createTelegramChannelRoutes(deps) {
     deps.onReady?.(key);
     return c.json({ ok: true });
   });
-  app76.post("/tg-channel/received", async (c) => {
+  app77.post("/tg-channel/received", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const messageId = body?.messageId;
@@ -29971,7 +30505,7 @@ function createTelegramChannelRoutes(deps) {
     deps.onReceived?.(key, messageId);
     return c.json({ ok: true });
   });
-  app76.post("/tg-channel/turn-end", async (c) => {
+  app77.post("/tg-channel/turn-end", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const sessionId = body?.sessionId;
@@ -30004,7 +30538,7 @@ function createTelegramChannelRoutes(deps) {
     console.error(`[telegram-native] op=turn-end key=${key} sessionId=${sid} replied=no delivered=none`);
     return c.json({ ok: true, delivered: "none" });
   });
-  return app76;
+  return app77;
 }
 
 // app/lib/telegram/gateway/telegram-gateway.ts
@@ -30155,7 +30689,7 @@ function buildTelegramSpawnRequest(input) {
 import { realpathSync as realpathSync10 } from "fs";
 import { readFile as readFile14, stat as stat10 } from "fs/promises";
 import { resolve as resolve42, basename as basename16 } from "path";
-var TAG48 = "[telegram:outbound]";
+var TAG49 = "[telegram:outbound]";
 var TELEGRAM_DOCUMENT_MAX_BYTES = 50 * 1024 * 1024;
 async function sendTelegramDocument(input) {
   const { botToken, chatId, filePath, caption, maxyAccountId, platformRoot: platformRoot5 } = input;
@@ -30172,10 +30706,10 @@ async function sendTelegramDocument(input) {
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
-      console.error(`${TAG48} document ENOENT scope=account-dir accountDir=${accountDir} maxyAccountId=${maxyAccountId}`);
+      console.error(`${TAG49} document ENOENT scope=account-dir accountDir=${accountDir} maxyAccountId=${maxyAccountId}`);
       return { ok: false, status: 500, error: `Account directory not resolvable for ${maxyAccountId}` };
     }
-    console.error(`${TAG48} document path error scope=account-dir maxyAccountId=${maxyAccountId}: ${String(err)}`);
+    console.error(`${TAG49} document path error scope=account-dir maxyAccountId=${maxyAccountId}: ${String(err)}`);
     return { ok: false, status: 500, error: String(err) };
   }
   let resolvedPath;
@@ -30184,14 +30718,14 @@ async function sendTelegramDocument(input) {
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
-      console.error(`${TAG48} document ENOENT scope=file path=${filePath} maxyAccountId=${maxyAccountId}`);
+      console.error(`${TAG49} document ENOENT scope=file path=${filePath} maxyAccountId=${maxyAccountId}`);
       return { ok: false, status: 404, error: `File not found: ${filePath}` };
     }
-    console.error(`${TAG48} document path error scope=file maxyAccountId=${maxyAccountId}: ${String(err)}`);
+    console.error(`${TAG49} document path error scope=file maxyAccountId=${maxyAccountId}: ${String(err)}`);
     return { ok: false, status: 500, error: String(err) };
   }
   if (!resolvedPath.startsWith(accountResolved + "/")) {
-    console.error(`${TAG48} document REJECTED reason=outside_account_directory maxyAccountId=${maxyAccountId}`);
+    console.error(`${TAG49} document REJECTED reason=outside_account_directory maxyAccountId=${maxyAccountId}`);
     return { ok: false, status: 403, error: "Access denied: file is outside the account directory" };
   }
   const fileStat = await stat10(resolvedPath);
@@ -30224,13 +30758,13 @@ async function sendTelegramDocument(input) {
     error = e instanceof Error ? e.message : String(e);
   }
   console.error(
-    `${TAG48} sent document to=${chatId} file=${filename} bytes=${fileStat.size} ok=${ok}` + (messageId !== void 0 ? ` id=${messageId}` : "")
+    `${TAG49} sent document to=${chatId} file=${filename} bytes=${fileStat.size} ok=${ok}` + (messageId !== void 0 ? ` id=${messageId}` : "")
   );
   return ok ? { ok: true, messageId } : { ok: false, status: 500, error };
 }
 
 // app/lib/telegram/outbound/file-delivery.ts
-var TAG49 = "[telegram:outbound]";
+var TAG50 = "[telegram:outbound]";
 function platformRoot4() {
   return process.env.MAXY_PLATFORM_ROOT || "";
 }
@@ -30242,11 +30776,11 @@ function makeTelegramSendFile(entry) {
       botToken = (entry.role === "admin" ? tg?.adminBotToken : tg?.publicBotToken) ?? null;
     }
     if (!botToken) {
-      console.error(`${TAG49} file-delivery reject reason=no-bot-token sender=${entry.senderId} role=${entry.role}`);
+      console.error(`${TAG50} file-delivery reject reason=no-bot-token sender=${entry.senderId} role=${entry.role}`);
       return { ok: false, error: "no-bot-token" };
     }
     if (entry.replyTarget == null) {
-      console.error(`${TAG49} file-delivery reject reason=no-reply-target sender=${entry.senderId} role=${entry.role}`);
+      console.error(`${TAG50} file-delivery reject reason=no-reply-target sender=${entry.senderId} role=${entry.role}`);
       return { ok: false, error: "no-reply-target" };
     }
     const result = await sendTelegramDocument({
@@ -30263,7 +30797,7 @@ function makeTelegramSendFile(entry) {
 function makeTelegramFileDelivery(entry) {
   return makeFileDelivery({
     entry,
-    tag: TAG49,
+    tag: TAG50,
     channel: "telegram",
     sendFile: makeTelegramSendFile(entry)
   });
@@ -30303,8 +30837,8 @@ function startTelegramNativeFileFollower(input) {
 }
 
 // app/lib/channel-pty-bridge/public-session-end-review.ts
-import { randomUUID as randomUUID12 } from "crypto";
-var TAG50 = "[public-session-review]";
+import { randomUUID as randomUUID14 } from "crypto";
+var TAG51 = "[public-session-review]";
 var CONSUMED_CAP = 500;
 var consumed = /* @__PURE__ */ new Set();
 function consumeOnce(sessionId) {
@@ -30331,7 +30865,7 @@ async function fetchJsonl(sessionId) {
     return await res.text();
   } catch (err) {
     console.error(
-      `${TAG50} jsonl-fetch-failed sessionId=${sessionId} err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG51} jsonl-fetch-failed sessionId=${sessionId} err="${err instanceof Error ? err.message : String(err)}"`
     );
     return null;
   }
@@ -30355,7 +30889,7 @@ async function fetchPriorWrites(sliceToken, accountId) {
     const res = await fetch(url);
     if (!res.ok) {
       console.error(
-        `${TAG50} prior-writes-fetch-failed sliceToken=${sliceToken.slice(0, 8)} status=${res.status}`
+        `${TAG51} prior-writes-fetch-failed sliceToken=${sliceToken.slice(0, 8)} status=${res.status}`
       );
       return [];
     }
@@ -30363,7 +30897,7 @@ async function fetchPriorWrites(sliceToken, accountId) {
     return Array.isArray(body.writes) ? body.writes : [];
   } catch (err) {
     console.error(
-      `${TAG50} prior-writes-fetch-threw sliceToken=${sliceToken.slice(0, 8)} err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG51} prior-writes-fetch-threw sliceToken=${sliceToken.slice(0, 8)} err="${err instanceof Error ? err.message : String(err)}"`
     );
     return [];
   }
@@ -30391,8 +30925,8 @@ function composeInitialMessage(input) {
   ].join("\n");
 }
 async function dispatchReviewer(input, initialMessage) {
-  const sessionId = randomUUID12();
-  console.log(`${TAG50} route target=rc-spawn sessionId=${sessionId.slice(0, 8)} sourceSession=${input.sessionId.slice(0, 8)}`);
+  const sessionId = randomUUID14();
+  console.log(`${TAG51} route target=rc-spawn sessionId=${sessionId.slice(0, 8)} sourceSession=${input.sessionId.slice(0, 8)}`);
   const spawned = await managerRcSpawn({
     sessionId,
     initialMessage,
@@ -30412,21 +30946,21 @@ async function firePublicSessionEndReview(input) {
   const dispatchedAt = Date.now();
   if (consumed.has(input.sessionId)) {
     console.log(
-      `${TAG50} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
+      `${TAG51} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
     );
     return;
   }
   const jsonl = await fetchJsonl(input.sessionId);
   if (!jsonl) {
     console.log(
-      `${TAG50} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-jsonl-missing`
+      `${TAG51} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-jsonl-missing`
     );
     return;
   }
   const operatorTurns = countOperatorTurns(jsonl);
   if (operatorTurns === 0) {
     console.log(
-      `${TAG50} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-no-turns`
+      `${TAG51} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-no-turns`
     );
     return;
   }
@@ -30440,19 +30974,19 @@ async function firePublicSessionEndReview(input) {
   });
   if (!consumeOnce(input.sessionId)) {
     console.log(
-      `${TAG50} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
+      `${TAG51} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
     );
     return;
   }
   const dispatched = await dispatchReviewer(input, initialMessage);
   if (!dispatched.ok) {
     console.error(
-      `${TAG50} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-spawn-failed reason=${dispatched.reason}`
+      `${TAG51} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-spawn-failed reason=${dispatched.reason}`
     );
     return;
   }
   console.log(
-    `${TAG50} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=dispatched managerSessionId=${dispatched.managerSessionId} operatorTurns=${operatorTurns} priorWrites=${priorWrites.length} ms=${Date.now() - dispatchedAt}`
+    `${TAG51} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=dispatched managerSessionId=${dispatched.managerSessionId} operatorTurns=${operatorTurns} priorWrites=${priorWrites.length} ms=${Date.now() - dispatchedAt}`
   );
 }
 
@@ -30909,7 +31443,7 @@ startManagerEventsSubscriber();
 function isPublicHost(host) {
   return host.startsWith("public.") || aliasDomains.has(host);
 }
-var app75 = new Hono();
+var app76 = new Hono();
 function resolveChannelOverride(accountId, channel, senderId) {
   try {
     const dir = listValidAccounts().find((a) => a.accountId === accountId)?.accountDir;
@@ -30977,7 +31511,7 @@ var waGateway = new WaGateway({
     });
     return result.ok ? { ok: true, messageId: result.messageId } : { ok: false, error: result.error };
   },
-  ensureChannelSession: async ({ accountId, effectiveAccountId, senderId, role, personId, gatewayUrl, serverPath, passive, text, msgId, ownerSelfPhone, replyContext, party }) => {
+  ensureChannelSession: async ({ accountId, effectiveAccountId, senderId, role, personId, gatewayUrl, serverPath, passive, text, msgId, ownerSelfPhone, replyContext, party, publicAgentSlug }) => {
     warnNonUuidAccount("channel-spawn", effectiveAccountId);
     if (passive) {
       const phoneHash = createHash7("sha256").update(senderId).digest("hex").slice(0, 12);
@@ -31030,6 +31564,38 @@ var waGateway = new WaGateway({
       const managesAccount = managesAccountFor(effectiveAccountId, resolveReadStoreKey(accountId));
       console.error(`[whatsapp-native] op=account-manager-route senderId=${senderId} managesAccount=${managesAccount} effectiveAccount=${effectiveAccountId} source=gate`);
     }
+    if (role === "public" && publicAgentSlug) {
+      const publicSessionId = adminSessionIdFor(effectiveAccountId, senderId, personId ?? void 0);
+      await ensureSessionConversation({
+        accountId: effectiveAccountId,
+        sessionId: publicSessionId,
+        channel: "whatsapp",
+        channelAddress: senderId,
+        agentType: "public"
+      });
+      const publicResult = await managerSpawn({
+        senderId,
+        role: "public",
+        channel: "whatsapp",
+        accountId: effectiveAccountId,
+        targetAccountId: effectiveAccountId,
+        // Task 2271 — this slug came from THIS account's own slice
+        // (`resolvePublicAgent` with `isHouse` false), so the spawn must read
+        // that account's own agents directory, run in its directory and file its
+        // session under it.
+        agentAccountId: effectiveAccountId,
+        agentSlug: publicAgentSlug,
+        sessionId: publicSessionId,
+        personId: personId ?? void 0,
+        waChannel: { senderId, gatewayUrl, serverPath }
+      });
+      if ("error" in publicResult) {
+        console.error(
+          `[whatsapp:public-agent] op=spawn-failed senderId=${senderId} slug=${publicAgentSlug} error=${publicResult.error}`
+        );
+      }
+      return;
+    }
     const req = buildWaSpawnRequest({
       accountId: effectiveAccountId,
       senderId,
@@ -31086,7 +31652,7 @@ var waGateway = new WaGateway({
     nativeFileFollowers.set(senderId, ac);
   }
 });
-app75.route("/", waGateway.routes());
+app76.route("/", waGateway.routes());
 waGateway.startSweeper();
 registerLoop({
   name: "whatsapp-link-census",
@@ -31223,7 +31789,7 @@ var webchatGateway = new WebchatGateway({
   firePublicSessionEndReview: (input) => firePublicSessionEndReview(input)
 });
 setWebchatGateway(webchatGateway);
-app75.route("/", webchatGateway.routes());
+app76.route("/", webchatGateway.routes());
 webchatGateway.startSweeper();
 webchatGateway.startPublicReaper();
 var telegramFileFollowers = /* @__PURE__ */ new Map();
@@ -31267,7 +31833,7 @@ var telegramGateway = new TelegramGateway({
   }
 });
 setTelegramGateway(telegramGateway);
-app75.route("/", telegramGateway.routes());
+app76.route("/", telegramGateway.routes());
 telegramGateway.startSweeper();
 var chatRoutes = createChatRoutes({
   handleInbound: (input) => webchatGateway.handleInbound(input),
@@ -31306,19 +31872,19 @@ var scheduleInjectRoutes = createScheduleInjectRoutes({
   // and why the real dependencies are bound there rather than assembled here.
   effectiveAccountFor: resolveScheduledEffectiveAccountForInstall
 });
-app75.route("/api/channel/schedule-inject", scheduleInjectRoutes);
-app75.use("*", clientIpMiddleware);
+app76.route("/api/channel/schedule-inject", scheduleInjectRoutes);
+app76.use("*", clientIpMiddleware);
 function allowsSameOriginFraming(path) {
   return path === "/vnc-viewer.html" || path.startsWith("/api/admin/attachment/") || path.startsWith("/api/public-reader/attachment/") || path === "/api/admin/files/download" || path === "/api/admin/session-upload";
 }
-app75.use("*", async (c, next) => {
+app76.use("*", async (c, next) => {
   await next();
   c.header("X-Content-Type-Options", "nosniff");
   c.header("Referrer-Policy", "strict-origin-when-cross-origin");
   c.header("X-Frame-Options", allowsSameOriginFraming(c.req.path) ? "SAMEORIGIN" : "DENY");
 });
 var HTTP_LOG_PATHS = /* @__PURE__ */ new Set(["/vnc-viewer.html", "/vnc-popout.html"]);
-app75.use("*", async (c, next) => {
+app76.use("*", async (c, next) => {
   if (!HTTP_LOG_PATHS.has(c.req.path)) {
     await next();
     return;
@@ -31336,7 +31902,7 @@ app75.use("*", async (c, next) => {
     });
   }
 });
-app75.use("*", async (c, next) => {
+app76.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isOperatorHost(host, getOperatorDomains()) || !isPublicHost(host)) {
     await next();
@@ -31374,7 +31940,7 @@ function resolveRemoteAuthOpts(c) {
   return { ...brandLoginOpts, origin };
 }
 var MAX_LOGIN_BODY = 8 * 1024;
-app75.post("/__remote-auth/login", async (c) => {
+app76.post("/__remote-auth/login", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   if (!requestIsTlsTerminated(c)) {
@@ -31419,7 +31985,7 @@ app75.post("/__remote-auth/login", async (c) => {
     }
   });
 });
-app75.get("/__remote-auth/logout", (c) => {
+app76.get("/__remote-auth/logout", (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   console.error(`[remote-auth] logout ip=${clientIp}`);
@@ -31432,7 +31998,7 @@ app75.get("/__remote-auth/logout", (c) => {
     }
   });
 });
-app75.post("/__remote-auth/change-password", async (c) => {
+app76.post("/__remote-auth/change-password", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   const rateLimited = checkRateLimit(client);
@@ -31491,13 +32057,13 @@ app75.post("/__remote-auth/change-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), mode: "change", changeError: "Failed to save password", redirect }), 200);
   }
 });
-app75.get("/__remote-auth/setup", (c) => {
+app76.get("/__remote-auth/setup", (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), mode: "setup" }), 200);
 });
-app75.post("/__remote-auth/set-initial-password", async (c) => {
+app76.post("/__remote-auth/set-initial-password", async (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
@@ -31535,10 +32101,10 @@ app75.post("/__remote-auth/set-initial-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), mode: "setup", setupError: "Failed to save password. Please try again." }), 200);
   }
 });
-app75.get("/api/remote-auth/status", (c) => {
+app76.get("/api/remote-auth/status", (c) => {
   return c.json({ configured: isRemoteAuthConfigured() });
 });
-app75.post("/api/remote-auth/set-password", async (c) => {
+app76.post("/api/remote-auth/set-password", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -31577,10 +32143,10 @@ app75.post("/api/remote-auth/set-password", async (c) => {
     return c.json({ error: "Failed to save password" }, 500);
   }
 });
-app75.route("/api/_client-error", client_error_default);
+app76.route("/api/_client-error", client_error_default);
 console.log("[client-error-route] mounted");
 var PWA_PUBLIC_PATHS = /* @__PURE__ */ new Set(["/sw.js", ...PWA_SURFACES.map((s) => s.manifestPath)]);
-app75.use("*", async (c, next) => {
+app76.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path = c.req.path;
   if (path === "/favicon.ico" || path.startsWith("/assets/") || path.startsWith("/brand/") || // Public free/busy is read by the booking page (a separate Cloudflare Pages
@@ -31624,30 +32190,30 @@ app75.use("*", async (c, next) => {
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), redirect: path }), 200);
 });
-app75.route("/api/health", health_default);
-app75.route("/api/chat", chatRoutes);
-app75.route("/api/whatsapp", whatsapp_default);
-app75.route("/api/storage", storage_broker_default);
-app75.route("/api/whatsapp-reader", whatsapp_reader_default);
-app75.route("/api/session-reader", session_reader_default);
-app75.route("/api/operator-conversations", operator_conversations_default);
-app75.route("/api/public-reader", public_reader_default);
-app75.route("/api/webchat", createWebchatRoutes({
+app76.route("/api/health", health_default);
+app76.route("/api/chat", chatRoutes);
+app76.route("/api/whatsapp", whatsapp_default);
+app76.route("/api/storage", storage_broker_default);
+app76.route("/api/whatsapp-reader", whatsapp_reader_default);
+app76.route("/api/session-reader", session_reader_default);
+app76.route("/api/operator-conversations", operator_conversations_default);
+app76.route("/api/public-reader", public_reader_default);
+app76.route("/api/webchat", createWebchatRoutes({
   handleInbound: (input) => webchatGateway.handleInbound(input),
   // Task 940 — the permission relay's pointer read + verdict write.
   pendingPromptFor: (key) => webchatGateway.pendingPromptFor(key),
   deliveryFailureFor: (key) => webchatGateway.deliveryFailureFor(key),
   resolvePermissionVerdict: (key, requestId, behavior) => webchatGateway.resolvePermissionVerdict(key, requestId, behavior)
 }));
-app75.route("/api/webchat/greeting", webchat_greeting_default);
-app75.route("/api/telegram", telegram_default);
-app75.route("/api/quickbooks", quickbooks_default);
-app75.route("/api/onboarding", onboarding_default);
-app75.route("/api/admin", admin_default);
-app75.route("/api/access", access_default);
-app75.route("/api/session", session_default2);
-app75.route("/api/calendar", calendar_public_default);
-app75.route("/api/portal", portal_fetch_default);
+app76.route("/api/webchat/greeting", webchat_greeting_default);
+app76.route("/api/telegram", telegram_default);
+app76.route("/api/quickbooks", quickbooks_default);
+app76.route("/api/onboarding", onboarding_default);
+app76.route("/api/admin", admin_default);
+app76.route("/api/access", access_default);
+app76.route("/api/session", session_default2);
+app76.route("/api/calendar", calendar_public_default);
+app76.route("/api/portal", portal_fetch_default);
 var SAFE_SLUG_RE2 = /^[a-z][a-z0-9-]{2,49}$/;
 var SAFE_FILENAME_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var IMAGE_MIME = {
@@ -31659,7 +32225,7 @@ var IMAGE_MIME = {
   ".svg": "image/svg+xml",
   ".ico": "image/x-icon"
 };
-app75.get("/agent-assets/:slug/:filename", (c) => {
+app76.get("/agent-assets/:slug/:filename", (c) => {
   const slug = c.req.param("slug");
   const filename = c.req.param("filename");
   if (!SAFE_SLUG_RE2.test(slug)) {
@@ -31694,7 +32260,7 @@ app75.get("/agent-assets/:slug/:filename", (c) => {
     "Cache-Control": "public, max-age=3600"
   });
 });
-app75.get("/generated/:filename", (c) => {
+app76.get("/generated/:filename", (c) => {
   const filename = c.req.param("filename");
   if (!SAFE_FILENAME_RE.test(filename) || filename.includes("..")) {
     console.error(`[generated] serve file=${filename} status=403`);
@@ -31724,10 +32290,10 @@ app75.get("/generated/:filename", (c) => {
     "Cache-Control": "public, max-age=86400"
   });
 });
-app75.route("/sites", sites_default);
-app75.route("/listings", listings_default);
-app75.route("/v", visitor_event_default);
-app75.route("/v", visitor_consent_default);
+app76.route("/sites", sites_default);
+app76.route("/listings", listings_default);
+app76.route("/v", visitor_event_default);
+app76.route("/v", visitor_consent_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
@@ -31852,7 +32418,7 @@ function brandedPublicHtml(agentSlug) {
 function agentUnavailableHtml() {
   return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${escapeHtml(BRAND.productName)}</title></head><body style="font-family:system-ui,sans-serif;max-width:32rem;margin:4rem auto;padding:0 1.5rem;color:#222"><h1 style="font-size:1.25rem">Agent unavailable</h1><p>This agent isn't available right now. If you reached this page from a saved link, the agent may have been turned off.</p></body></html>`;
 }
-app75.get("/", (c) => {
+app76.get("/", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const klass = classifyHost(host, getOperatorDomains(), isPublicHost);
   if (klass === "operator") {
@@ -31874,12 +32440,12 @@ app75.get("/", (c) => {
   console.log(`[host-class] host=${host} class=admin served=index.html`);
   return c.html(cachedHtml("index.html"));
 });
-app75.get("/public", (c) => {
+app76.get("/public", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
 });
-app75.get("/public-chat", (c) => {
+app76.get("/public-chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
@@ -31898,9 +32464,9 @@ async function logViewerFetch(c, next) {
     duration_ms: Date.now() - start
   });
 }
-app75.use("/vnc-viewer.html", logViewerFetch);
-app75.use("/vnc-popout.html", logViewerFetch);
-app75.get("/vnc-popout.html", (c) => {
+app76.use("/vnc-viewer.html", logViewerFetch);
+app76.use("/vnc-popout.html", logViewerFetch);
+app76.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
     html = readFileSync47(resolve45(process.cwd(), "public", "vnc-popout.html"), "utf-8");
@@ -31913,7 +32479,7 @@ app75.get("/vnc-popout.html", (c) => {
   }
   return c.html(html);
 });
-app75.post("/api/vnc/client-event", async (c) => {
+app76.post("/api/vnc/client-event", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -31934,11 +32500,11 @@ app75.post("/api/vnc/client-event", async (c) => {
   });
   return c.json({ ok: true });
 });
-app75.get("/g/:slug", (c) => {
+app76.get("/g/:slug", (c) => {
   return c.html(brandedPublicHtml(resolveDefaultSlug() ?? void 0));
 });
 for (const pwa of PWA_SURFACES) {
-  app75.get(pwa.manifestPath, (c) => {
+  app76.get(pwa.manifestPath, (c) => {
     const manifest = buildManifest(pwa, {
       productName: BRAND.productName,
       appIcon192: brandAppIcon192Path,
@@ -31954,7 +32520,7 @@ for (const pwa of PWA_SURFACES) {
     return c.body(JSON.stringify(manifest));
   });
 }
-app75.get("/sw.js", (c) => {
+app76.get("/sw.js", (c) => {
   if (SW_SOURCE == null) {
     console.error("[pwa] op=sw status=500 reason=sw-source-missing");
     return c.text("Service worker unavailable", 500);
@@ -31963,12 +32529,12 @@ app75.get("/sw.js", (c) => {
   console.log(`[pwa] op=sw status=200 ct=${SW_CONTENT_TYPE}`);
   return c.body(SW_SOURCE);
 });
-app75.get("/graph", (c) => {
+app76.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host) || isOperatorHost(host, getOperatorDomains())) return c.text("Not found", 404);
   return c.html(cachedHtml("graph.html"));
 });
-app75.get("/chat", (c) => {
+app76.get("/chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isOperatorHost(host, getOperatorDomains())) {
     console.log(`[host-class] host=${host} class=operator served=operator.html`);
@@ -31977,47 +32543,47 @@ app75.get("/chat", (c) => {
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("chat.html"));
 });
-app75.get("/data", (c) => {
+app76.get("/data", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("data.html"));
 });
-app75.get("/tasks", (c) => {
+app76.get("/tasks", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("tasks.html"));
 });
-app75.get("/activity", (c) => {
+app76.get("/activity", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("activity.html"));
 });
-app75.get("/calendar", (c) => {
+app76.get("/calendar", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("calendar.html"));
 });
-app75.get("/routines", (c) => {
+app76.get("/routines", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("routines.html"));
 });
-app75.get("/skills", (c) => {
+app76.get("/skills", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("skills.html"));
 });
-app75.get("/agents", (c) => {
+app76.get("/agents", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("agents.html"));
 });
-app75.get("/browser", (c) => {
+app76.get("/browser", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host) || isOperatorHost(host, getOperatorDomains())) return c.text("Not found", 404);
   return c.html(cachedHtml("browser.html"));
 });
-app75.get("/:slug", async (c, next) => {
+app76.get("/:slug", async (c, next) => {
   const slug = c.req.param("slug");
   if (AGENT_SLUG_PATTERN.test(`/${slug}`)) {
     const account = resolveAccount();
@@ -32032,13 +32598,13 @@ app75.get("/:slug", async (c, next) => {
   await next();
 });
 if (brandFaviconPath !== "/favicon.ico") {
-  app75.get("/favicon.ico", (c) => {
+  app76.get("/favicon.ico", (c) => {
     c.header("Cache-Control", "public, max-age=300");
     return c.redirect(brandFaviconPath, 302);
   });
 }
-mountStaticFiles(app75, "./public");
-app75.all("*", (c) => {
+mountStaticFiles(app76, "./public");
+app76.all("*", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path = c.req.path;
   if (isPublicHost(host)) {
@@ -32052,7 +32618,7 @@ app75.all("*", (c) => {
 });
 var port = requirePortEnv("MAXY_UI_INTERNAL_PORT", { tag: "ui-server" });
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
-var httpServer = serve({ fetch: app75.fetch, port, hostname });
+var httpServer = serve({ fetch: app76.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
   const reconcilePlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join53(__dirname, "..");
@@ -32449,7 +33015,7 @@ for (const m of SUBAPP_MANIFEST) {
 }
 try {
   const registered = [];
-  for (const r of app75.routes ?? []) {
+  for (const r of app76.routes ?? []) {
     if (typeof r.path !== "string" || r.path.includes(":") || r.path.includes("*")) continue;
     if (AGENT_SLUG_PATTERN.test(r.path)) {
       registered.push({ method: (r.method ?? "ALL").toUpperCase(), path: r.path });
@@ -32525,6 +33091,7 @@ registerLoop({
   run: () => runAdminUserReconcileTick()
 });
 var INGEST_AUDIT_INTERVAL_MS = 15 * 60 * 1e3;
+var isHouseAccountKey = (houseAccountId, accountId) => accountId === houseAccountId || !isProvisionedAccount(ACCOUNTS_DIR, accountId);
 var runIngestAuditTick = () => {
   try {
     runIngestAudit();
@@ -32536,6 +33103,71 @@ var runIngestAuditTick = () => {
   } catch (err) {
     console.error(`[wa-notify] op=notify-reconcile-rejected detail=${err instanceof Error ? err.message : String(err)}`);
   }
+  try {
+    runPublicNotifyReconcile();
+  } catch (err) {
+    console.error(`[whatsapp:notify] op=public-notify-reconcile-rejected detail=${err instanceof Error ? err.message : String(err)}`);
+  }
+  try {
+    const house = resolveAccount();
+    runPublicAgentRegistryAudit({
+      enabledAccounts: () => {
+        if (!house) return [];
+        const wa = getConfig(house.accountDir);
+        const ids = /* @__PURE__ */ new Set([house.accountId]);
+        const accounts = wa?.accounts;
+        for (const id of Object.keys(accounts ?? {})) ids.add(id);
+        const rows = Array.from(ids).map((accountId) => {
+          const isHouse = isHouseAccountKey(house.accountId, accountId);
+          return {
+            accountId,
+            isHouse,
+            enabled: resolvePublicAgentEnabled(house.accountDir, { accountId, isHouse }).enabled,
+            slug: resolvePublicAgent(house.accountDir, { accountId, isHouse })?.slug ?? null
+          };
+        });
+        const seenHouse = { taken: false };
+        return rows.filter((row) => row.enabled).filter((row) => {
+          if (!row.isHouse) return true;
+          if (seenHouse.taken) return false;
+          seenHouse.taken = true;
+          return true;
+        }).map(({ accountId, slug }) => ({ accountId, slug }));
+      },
+      agentExists: (accountId, slug) => {
+        if (!house) return false;
+        const dir = isHouseAccountKey(house.accountId, accountId) ? house.accountDir : join53(ACCOUNTS_DIR, accountId);
+        return existsSync50(join53(dir, "agents", slug, "config.json"));
+      }
+    });
+  } catch (err) {
+    console.error(`[whatsapp:public-agent] op=registry-audit-rejected detail=${err instanceof Error ? err.message : String(err)}`);
+  }
+  try {
+    const house = resolveAccount();
+    runPublicAgentSliceAudit({
+      enabledAccounts: () => {
+        if (!house) return [];
+        const wa = getConfig(house.accountDir);
+        const accounts = wa?.accounts;
+        const ids = /* @__PURE__ */ new Set([house.accountId]);
+        for (const id of Object.keys(accounts ?? {})) ids.add(id);
+        return Array.from(ids).map((accountId) => {
+          const isHouse = isHouseAccountKey(house.accountId, accountId);
+          const slice = accounts?.[accountId] ?? {};
+          const ownSlug = typeof slice.publicAgent === "string" && slice.publicAgent.trim() ? slice.publicAgent.trim() : null;
+          return {
+            accountId,
+            house: isHouse,
+            ownSlug,
+            enabled: resolvePublicAgentEnabled(house.accountDir, { accountId, isHouse }).enabled
+          };
+        }).filter((row) => row.enabled).map(({ accountId, house: isHouse, ownSlug }) => ({ accountId, house: isHouse, ownSlug }));
+      }
+    });
+  } catch (err) {
+    console.error(`[whatsapp:public-agent] op=slice-audit-rejected detail=${err instanceof Error ? err.message : String(err)}`);
+  }
 };
 registerLoop({
   name: "wa-ingest-audit",
@@ -32621,7 +33253,7 @@ if (bootAccount) {
   migrateRemovedConfigKeys(bootAccount.accountDir);
 }
 var bootAccountConfig = bootAccount?.config;
-var bootPublicAgent = bootAccount ? resolvePublicAgent(bootAccount.accountDir, { accountId: bootAccount.accountId })?.slug ?? null : null;
+var bootPublicAgent = bootAccount ? resolvePublicAgent(bootAccount.accountDir, { accountId: bootAccount.accountId, isHouse: true })?.slug ?? null : null;
 var bootEntitlement = bootAccountConfig ? resolveEntitlement(
   { configDir: MAXY_DIR, platformRoot: PLATFORM_ROOT, commercialMode: COMMERCIAL_MODE },
   {
@@ -32741,8 +33373,43 @@ init({
       console.error(`[whatsapp:route] op=dropped reason=no-effective-account senderId=${msg.senderPhone}`);
       return;
     }
+    let publicAgentSlug;
     if (decision.role === "public") {
       console.error(`[whatsapp:route] op=routed agentType=public personId=${decision.personId} senderId=${msg.senderPhone}`);
+      noteRouted();
+      try {
+        const houseAccount = resolveAccount();
+        await notifyManagersOfPublicInbound(
+          {
+            readManagers: () => houseAccount ? readAccountManagers(houseAccount.accountDir) : {},
+            resolveSocket,
+            sendText: sendTextMessage
+          },
+          { accountId: msg.effectiveAccountId, senderE164: msg.senderPhone, text: msg.text ?? "" }
+        );
+        noteNotified();
+      } catch (err) {
+        console.error(
+          `[whatsapp:notify] op=public-inbound-rejected account=${msg.effectiveAccountId} sender=${msg.senderPhone} detail=${err instanceof Error ? err.message : String(err)}`
+        );
+      }
+      const houseForRoute = resolveAccount();
+      const routeAccountId = msg.effectiveAccountId;
+      const routeIsHouse = houseForRoute ? routeAccountId === houseForRoute.accountId : false;
+      const route = decidePublicAgentRoute({
+        resolveEnabled: () => houseForRoute ? resolvePublicAgentEnabled(houseForRoute.accountDir, { accountId: routeAccountId, isHouse: routeIsHouse }) : { enabled: false, source: "default" },
+        resolveSlug: () => houseForRoute ? resolvePublicAgent(houseForRoute.accountDir, { accountId: routeAccountId, isHouse: routeIsHouse }) : null
+      });
+      console.error(
+        formatPublicAgentRouteLine({
+          accountId: routeAccountId,
+          enabled: route.enabled,
+          slug: route.slug,
+          spawned: route.spawn
+        })
+      );
+      if (!route.spawn) return;
+      publicAgentSlug = route.slug ?? void 0;
     }
     try {
       if (!decision.passive) void msg.composing().catch(() => {
@@ -32769,7 +33436,10 @@ init({
         replyContext: msg.replyContext,
         // Task 2234 — the gate's registered-party label, carried to the spawn so
         // the session env has WA_SENDER_PARTY. Undefined for every other sender.
-        party: msg.party
+        party: msg.party,
+        // Task 2262 — resolved above; its presence routes the spawn to
+        // /public-spawn under the named public agent.
+        publicAgentSlug
       });
     } catch (err) {
       console.error(