brand-manager-worker 0.1.3 → 0.2.0

package/README.md

@@ -40,7 +40,8 @@ Everything personal is on your machine, in `~/.goosetools/brand-manager/`:
 base/       prompt files synced down from Goose Tools — don't hand-edit, they get overwritten
 voice/      how you write to brands
 playbook/   rate-card.md and your negotiation moves
-deals/      one markdown ledger per brand: terms, dates, what's outstanding
+deals/      one record per brand: current terms, dates, money, and the decisions behind them
+archive/    the long-form history, kept out of the drafting prompt
 stats/      your media-kit numbers and screenshots
 drafts.md   every reply it has drafted
 state.json  which threads it has already handled
@@ -50,6 +51,20 @@ These are ordinary files. You can open the folder in Claude Code and talk to the
 "bump my Reel rate", "what did this brand agree to?" — exactly as you would in the standalone
 brand-manager repo. The website is a view onto these files, not the other way round.
 
+A deal record is a small `<!-- brand … -->` JSON block plus a `## Decisions` log of one-liners. It
+stays small on purpose: everything in `deals/` is loaded into every draft, so a brand whose record
+bloats crowds out the others. The long history moves to `archive/` and is read only when you ask
+for it. Older `<!-- board … -->` ledgers still work and are read as-is.
+
+The same applies to what it learns from your edits. `voice/voice.md` and `playbook/negotiation.md`
+grow every time you change a draft before sending, so when one passes 40KB the worker rewrites it
+smaller — merging repeats and dropping superseded entries, never losing a distinct rule. The
+pre-compaction copy is kept in `archive/`.
+
+One field is yours alone: whether an invoice was actually paid. The agent scores how confident it
+is from the email evidence ("already processed" from a brand is not the same as money landing), and
+anything short of certain asks you rather than counting itself. Your answer then wins permanently.
+
 Your email bodies and contracts are never uploaded. What the site stores is thread metadata (who,
 subject, when), your ledgers and knowledge files, and the drafts the agent wrote.
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "brand-manager-worker",
-  "version": "0.1.3",
-  "description": "The Goose Tools brand-deal worker — your computer reads your brand email and drafts replies in your voice for goosetools.com, using your own Claude account. Drafts only; it never sends.",
+  "version": "0.2.0",
+  "description": "The Goose Tools brand-deal worker \u2014 your computer reads your brand email and drafts replies in your voice for goosetools.com, using your own Claude account. Drafts only; it never sends.",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/ernkerr/brand-manager-worker.git"

package/worker/agent.js

@@ -69,7 +69,7 @@ function renderThread(thread) {
     .join("\n\n");
 }
 
-function buildPrompt({ thread, reason, instruction, contracts, context }) {
+function buildPrompt({ thread, reason, instruction, contracts, context, statsWindows = null }) {
   const contractBlock = contracts.length
     ? `\n\nATTACHED DOCUMENTS (extracted text — verify per the contract mode above):\n${contracts
         .map((d) => `### ${d.filename}\n${d.text.slice(0, 8000) || "(could not extract text)"}`)
@@ -118,6 +118,7 @@ function buildPrompt({ thread, reason, instruction, contracts, context }) {
     `  genuinely still missing, and skip the scoping questions entirely if it's all already answered.`,
     `- Don't re-introduce yourself or repeat points you already made earlier in the thread.`,
     ``,
+    statsWindowsBlock(statsWindows),
     `===== TONE =====`,
     `Warm and friendly first, professional underneath. Sound like a real person who is glad to hear from`,
     `them, not a terms-and-conditions bot. Open with genuine warmth, keep pushback collaborative and kind`,
@@ -126,7 +127,26 @@ function buildPrompt({ thread, reason, instruction, contracts, context }) {
     ``,
     `===== OUTPUT =====`,
     `Output ONLY a single fenced \`\`\`json block with this shape:`,
-    `{"action":"draft"|"skip","to":"<email>","subject":"Re: ...","body":"<full reply, warm + professional, no em dashes, never the phrase 'happy to explore this'>","attachments":["stats/screenshots/..."],"summary":"<one line>","flags":["<any contract/exclusivity discrepancy>"]}`,
+    `{"action":"draft"|"skip","to":"<email>","subject":"Re: ...","body":"<full reply, warm + professional, no em dashes, never the phrase 'happy to explore this'>","attachments":["stats/screenshots/..."],"summary":"<one line>","flags":["<any contract/exclusivity discrepancy>"],`,
+    `"recordUpdates":{"brand":"<brand name, matching its deal ledger>","stage":"<only if it changed>","whoseMove":"you|them",`,
+    ` "calendar":[{"key":"<stable key, reuse the existing one>","title":"...","date":"YYYY-MM-DD|null","tbd":true|false,"notes":"..."}],`,
+    ` "money":{"invoices":[{"id":"inv-1","amount":0,"status":"unpaid|paid|overdue","paidAt":null,"confidence":0.0,"evidence":"<the line that says so>"}]},`,
+    ` "exclusivity":{"status":"active|none|proposed|unknown","scope":"...","from":"YYYY-MM-DD|null","to":"YYYY-MM-DD|null"},`,
+    ` "decisions":[{"date":"YYYY-MM-DD","what":"<what was accepted or refused>","why":"<the reason worth remembering>"}]}}`,
+    ``,
+    `recordUpdates keeps the brand record current — omit it entirely when this message changed nothing.`,
+    `Only report what THIS message evidences. Never invent a date, a number or a term.`,
+    `- A date that moved: reuse the existing calendar key so it updates instead of duplicating. If they`,
+    `  pulled a date without naming a new one, set date null and tbd true — that is the honest record,`,
+    `  and "no date committed" is a thing she needs to see, not a blank.`,
+    `- Never emit "confirmed" on an invoice. That field is hers alone.`,
+    `- Payment confidence: 0.9 a payment rail (Mercury/Stripe/PayPal/bank) confirms a matching amount,`,
+    `  0.6 the brand says it was sent or processed, 0.4 she says so with nothing corroborating,`,
+    `  0.1 invoiced and silent past the due date. "Already processed" from a brand is 0.6, not paid.`,
+    `- Exclusivity status is a judgement, not prose: "active" only once a window is AGREED.`,
+    `  Asked-and-unanswered is "proposed", never "active" — the board reads active as binding.`,
+    `- Decisions are durable precedent only: what was accepted or refused and why. Not status updates,`,
+    `  not "sent a reply". If nothing was decided, omit decisions.`,
     `Rules: draft only (never send); honor the voice (no em dashes; banned phrases); reply to the latest`,
     `message using the whole thread as context (never re-ask answered questions); if an unsent draft`,
     `exists, produce a distinct second option; gifted-only -> Story mention, not a free Reel; verify any`,
@@ -139,12 +159,47 @@ function buildPrompt({ thread, reason, instruction, contracts, context }) {
  * Run the drafting agent over one thread. Returns the Decision or null on
  * failure — and null MUST mean "retry later", never "skip this thread".
  */
-export async function decide({ thread, reason, instruction = null, contracts = [] }) {
+/**
+ * Reach over several windows, from Goose Tools' own daily Instagram history.
+ *
+ * stats/latest.md holds one rolling 30-day snapshot pulled from the Graph API,
+ * which can only ever answer "the last 30 days". A brand asking for 30 days is
+ * really asking how the account performs, and the answer depends on which 30 —
+ * so quoting whichever window happens to end today can undersell her badly.
+ * The site ships these on the claim; they are a truthful menu, not a licence
+ * to cherry-pick, which is what the rule below says.
+ */
+function statsWindowsBlock(windows) {
+  if (!Array.isArray(windows) || !windows.length) return "";
+  const rows = windows.map(
+    (w) =>
+      `  ${String(w.label ?? `${w.days}d`).padEnd(10)} ${w.from} to ${w.to}` +
+      `  views ${w.views?.toLocaleString?.() ?? w.views}` +
+      `  reach ${w.reach?.toLocaleString?.() ?? w.reach}` +
+      `  engagement ${w.engagement}`,
+  );
+  return [
+    `===== REACH BY WINDOW (Goose Tools daily history) =====`,
+    ...rows,
+    `Only use these if the brand asked for numbers. Quote the window that answers`,
+    `what they actually asked, and always say which window it is. Never present a`,
+    `longer window as "the last 30 days".`,
+    ``,
+  ].join("\n");
+}
+
+export async function decide({
+  thread,
+  reason,
+  instruction = null,
+  contracts = [],
+  statsWindows = null,
+}) {
   // Live numbers before the media kit is inlined. Refreshes only when the
   // snapshot is a week old or more; a failure keeps the last one.
   if ((await refreshStatsIfStale()).refreshed) invalidateContext();
   const context = loadContext();
-  const prompt = buildPrompt({ thread, reason, instruction, contracts, context });
+  const prompt = buildPrompt({ thread, reason, instruction, contracts, context, statsWindows });
   const stdout = await oneShot(prompt, { cwd: BRAND_DIR });
   const decision = parseJson(stdout);
   if (!decision || (decision.action !== "draft" && decision.action !== "skip")) return null;

package/worker/compact.js

@@ -0,0 +1,157 @@
+// Keeping the learned layer from eating the prompt.
+//
+// learnFromEdit appends and never removes, by design — losing a lesson is
+// worse than storing it twice. But voice.md reached 66KB and negotiation.md
+// 107KB, together 169KB of a 350KB budget, and deal records load LAST, so the
+// first overflow would drop whole brands off the end of the context.
+//
+// voice.md has been compacted by hand once already (there's a note dated
+// 2026-08-11 saying so) and then regrew to four times the size of its own
+// curated section. So this is the loop closing: compaction runs when a file
+// crosses a threshold, not when someone remembers.
+//
+// The rule is preservation, not summarization. Every distinct lesson survives;
+// what goes is the repetition, the dated scaffolding around a rule that has
+// since become general, and anything a later entry superseded. The original is
+// archived first, and a result that looks like a summary rather than a
+// rewrite is refused.
+
+import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { oneShot, parseJson } from "./claude.js";
+import { BRAND_DIR, PLAYBOOK_DIR, VOICE_DIR } from "./paths.js";
+
+/**
+ * Past this, a file is costing the deal records their place in the prompt.
+ * Set against the observed numbers: the curated part of voice.md is ~16KB, so
+ * 40KB leaves generous room for real growth before anything is touched.
+ */
+export const COMPACT_THRESHOLD = 40_000;
+
+/** The learned files worth compacting. never-words is a short list; leave it. */
+export const COMPACTABLE = [
+  { target: "voice", path: join(VOICE_DIR, "voice.md") },
+  { target: "negotiation", path: join(PLAYBOOK_DIR, "negotiation.md") },
+  { target: "rate-card", path: join(PLAYBOOK_DIR, "rate-card.md") },
+];
+
+const ARCHIVE_DIR = join(BRAND_DIR, "archive");
+
+export function sizeOf(path) {
+  try {
+    return statSync(path).size;
+  } catch {
+    return 0;
+  }
+}
+
+export function oversized() {
+  return COMPACTABLE.filter(({ path }) => sizeOf(path) > COMPACT_THRESHOLD);
+}
+
+const prompt = (label, body) =>
+  [
+    `You are compacting one of the creator's learned-knowledge files. It has grown by`,
+    `appending: every edit she made to a draft added an entry, and nothing was ever`,
+    `removed. It is now large enough to crowd her deal records out of the prompt.`,
+    ``,
+    `Rewrite it SMALLER WITHOUT LOSING A SINGLE DISTINCT RULE.`,
+    ``,
+    `What to remove:`,
+    `- Repetition. The same lesson learned from four brands is ONE rule; keep the`,
+    `  clearest statement of it and drop the rest.`,
+    `- Dated scaffolding. "### 2026-08-19 (Higgsfield — pricing refusal)" wrapping a rule`,
+    `  that is now general: keep the rule, drop the wrapper. Keep the date only where`,
+    `  it genuinely matters (a standing instruction she gave on a specific day).`,
+    `- Anything a later entry contradicts or supersedes. Later wins.`,
+    `- Examples that only restate the rule above them.`,
+    ``,
+    `What to keep, without exception:`,
+    `- Every distinct rule, preference, banned word, and standing instruction.`,
+    `- Every number: rates, floors, multipliers, windows.`,
+    `- Brand-specific facts that only apply to one counterparty, marked as such.`,
+    `- The existing top-level section structure where there is one.`,
+    ``,
+    `This is preservation, not summarizing. If you are unsure whether two entries are`,
+    `the same rule, keep both. A lost rule is a draft that sounds wrong to her again;`,
+    `a kept duplicate costs a few hundred bytes.`,
+    ``,
+    `FILE: ${label}`,
+    `=====`,
+    body,
+    `=====`,
+    ``,
+    `Output ONLY a fenced \`\`\`json block:`,
+    `{"markdown":"<the full rewritten file>","rulesBefore":<count you counted>,`,
+    ` "rulesAfter":<count in your rewrite>,"dropped":"<one line on what you merged or removed>"}`,
+  ].join("\n");
+
+/**
+ * Compact one file. Returns a result describing what happened; never throws,
+ * and never writes unless the rewrite passes the guards below.
+ */
+export async function compactFile({ target, path }) {
+  const before = readFileSync(path, "utf8");
+  // A rewrite emits the whole file, so this generates tens of thousands of
+  // characters — the 4-minute default blew up on voice.md's 66KB. It runs at
+  // most once per file per threshold crossing, so it can afford the room.
+  const out = parseJson(
+    await oneShot(prompt(`${target}.md`, before), { cwd: BRAND_DIR, timeoutMs: 20 * 60 * 1000 }),
+  );
+  const after = typeof out?.markdown === "string" ? out.markdown.trim() : "";
+
+  if (!after) return { target, ok: false, error: "no parseable rewrite" };
+
+  // Guards. An agent asked to shrink a file can decide to summarize it, and a
+  // 3KB precis of 66KB of learned voice is a catastrophic, silent loss — the
+  // archive would be the only copy and nobody would notice for weeks.
+  if (after.length < before.length * 0.25) {
+    return {
+      target,
+      ok: false,
+      error: `refused: ${before.length} -> ${after.length} bytes looks like a summary, not a rewrite`,
+    };
+  }
+  if (after.length >= before.length) {
+    return { target, ok: false, error: "refused: no smaller than the original" };
+  }
+  // The headings are the file's skeleton; losing most of them means it was
+  // restructured rather than compacted.
+  const headingsBefore = (before.match(/^##\s/gm) ?? []).length;
+  const headingsAfter = (after.match(/^##\s/gm) ?? []).length;
+  if (headingsBefore >= 4 && headingsAfter < 2) {
+    return { target, ok: false, error: "refused: lost the section structure" };
+  }
+
+  mkdirSync(ARCHIVE_DIR, { recursive: true });
+  const stamp = new Date().toISOString().slice(0, 10);
+  writeFileSync(join(ARCHIVE_DIR, `${target}-${stamp}.md`), before);
+  writeFileSync(path, `${after}\n`);
+
+  return {
+    target,
+    ok: true,
+    before: before.length,
+    after: after.length,
+    rulesBefore: out.rulesBefore ?? null,
+    rulesAfter: out.rulesAfter ?? null,
+    dropped: out.dropped ?? null,
+  };
+}
+
+/**
+ * Compact anything over the threshold. Called at the END of a scan, once —
+ * not per thread, so a scan pays for at most one of these and only on the day
+ * a file actually crosses the line.
+ */
+export async function compactIfNeeded() {
+  const results = [];
+  for (const file of oversized()) {
+    try {
+      results.push(await compactFile(file));
+    } catch (err) {
+      results.push({ target: file.target, ok: false, error: err?.message ?? String(err) });
+    }
+  }
+  return results;
+}

package/worker/context.js

@@ -51,18 +51,12 @@ export function loadContext() {
     if (c) parts.push(`### ${label}\n${c}`);
   }
 
-  // All deal ledgers (per-brand context + exclusivity-conflict checks). A
-  // mature ledger can run tens of thousands of chars; keep the head (brand,
-  // board block, terms) and the tail (newest updates), dropping the middle.
+  // All deal ledgers (per-brand context + exclusivity-conflict checks).
   if (existsSync(DEALS_DIR)) {
     for (const name of readdirSync(DEALS_DIR).filter((n) => n.endsWith(".md")).sort()) {
       const c = readIf(join(DEALS_DIR, name));
       if (!c) continue;
-      const body =
-        c.length <= LEDGER_CAP
-          ? c
-          : `${c.slice(0, 2_000)}\n\n[... ledger middle trimmed ...]\n\n${c.slice(-(LEDGER_CAP - 2_000))}`;
-      parts.push(`### DEAL LEDGER: ${name}\n${body}`);
+      parts.push(`### DEAL LEDGER: ${name}\n${ledgerExcerpt(c)}`);
     }
   }
 
@@ -75,9 +69,46 @@ export function loadContext() {
   return value;
 }
 
-const LEDGER_CAP = 8_000;
+const LEDGER_CAP = 12_000;
 const TOTAL_CAP = 350_000;
 
+const blockRe = (name) => new RegExp(`<!--\\s*${name}\\s[\\s\\S]*?-->`, "i");
+
+/**
+ * A mature ledger runs tens of thousands of chars, so it gets trimmed to a
+ * head and a tail. The terms the agent actually needs — rate, stage,
+ * exclusivity window, committed dates — live in the `board` and `calendar`
+ * blocks, and the old trim assumed those sat in the head. They don't: the
+ * agent appends updates above them, so in a long ledger they sink into the
+ * middle and were dropped. navan.md put `board` at byte 15,929 and `calendar`
+ * at 27,802 of 55,932, with only 0-2,000 and the last 6,000 kept — so every
+ * Navan and Microsoft draft was written blind to its own rate and exclusivity.
+ * Hoist both blocks to the front, then spend what's left on head and tail.
+ */
+export function ledgerExcerpt(c) {
+  if (c.length <= LEDGER_CAP) return c;
+
+  const pinned = [];
+  for (const name of ["board", "calendar"]) {
+    const m = c.match(blockRe(name));
+    if (m) pinned.push(m[0]);
+  }
+  const head = pinned.join("\n\n").slice(0, PINNED_CAP);
+
+  // Everything below shares one budget: the pinned blocks, the marker, and the
+  // two joiners all count, or 36 ledgers each overshoot and starve the prompt.
+  const rest = LEDGER_CAP - head.length - MARKER.length - 4;
+  if (rest <= 0) return head.slice(0, LEDGER_CAP);
+
+  const headLen = Math.floor(rest * 0.3);
+  const body = `${c.slice(0, headLen)}${MARKER}${c.slice(-(rest - headLen))}`;
+
+  return head ? `${head}\n\n${body}` : body;
+}
+
+const PINNED_CAP = 6_000;
+const MARKER = "\n\n[... ledger middle trimmed — terms above are authoritative ...]\n\n";
+
 /** Drop the cache — call after anything edits the personal layer. */
 export function invalidateContext() {
   cached = null;

package/worker/handlers.js

@@ -8,16 +8,18 @@
 // and nothing else touches Gmail writes. Nothing in this package references
 // Gmail's send endpoint — test/no-send.test.js enforces that by pattern.
 
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { classify, decide, learnFromEdit } from "./agent.js";
 import { extractContracts } from "./attachments.js";
 import { session, canResume } from "./claude.js";
+import { compactIfNeeded, oversized } from "./compact.js";
 import { invalidateContext } from "./context.js";
 import { appendDraftLog, lastDraftFor } from "./drafts-log.js";
 import { createReplyDraft } from "./gmail-draft.js";
 import { fetchThreads, getThread } from "./gmail.js";
 import { buildMirror } from "./mirror.js";
+import { applyPaymentConfirmation, applyRecordUpdates, resolveSlug } from "./record-write.js";
 import {
   BRAND_DIR,
   DEALS_DIR,
@@ -50,7 +52,13 @@ async function draftForThread(job, thread) {
     thread.last.attachments,
   );
   const reason = job.kind === "followup" ? "followup-due" : "new-or-reply";
-  const decision = await decide({ thread, reason, instruction: job.instruction, contracts });
+  const decision = await decide({
+    thread,
+    reason,
+    instruction: job.instruction,
+    contracts,
+    statsWindows: job.statsWindows ?? null,
+  });
   if (!decision) {
     // Parse/agent failure: retryable. Do NOT mark handled.
     return { ok: false, error: "Agent returned no parseable decision (will retry)" };
@@ -88,15 +96,37 @@ async function draftForThread(job, thread) {
   if (reason === "followup-due") state.markFollowup(thread.id, thread.last.id);
   else state.markHandled(thread.id, thread.last.id);
 
+  // Fold what the agent observed into the brand record. Same rule the learn
+  // step follows: this must never take down a draft that already succeeded —
+  // the Gmail draft is the thing she's waiting on, the bookkeeping isn't.
+  let recorded = null;
+  try {
+    const slug = resolveSlug(decision.recordUpdates?.brand ?? decision.brand, listDealSlugs());
+    if (slug) {
+      recorded = applyRecordUpdates(slug, decision.recordUpdates);
+      if (recorded) invalidateContext();
+    }
+  } catch (err) {
+    console.error(`  ! record update failed: ${err?.message ?? err}`);
+  }
+
   return {
     ok: true,
-    summary: decision.summary,
+    summary: recorded ? `${decision.summary} · record: ${recorded}` : decision.summary,
     resultBody: decision.body ?? "",
     flags: decision.flags ?? [],
     mirror: buildMirror({ threads: [thread] }),
   };
 }
 
+/** Ledger slugs on disk — the set a draft's brand name may resolve to. */
+function listDealSlugs() {
+  if (!existsSync(DEALS_DIR)) return [];
+  return readdirSync(DEALS_DIR)
+    .filter((n) => n.endsWith(".md"))
+    .map((n) => n.replace(/\.md$/, ""));
+}
+
 /** kind: draft | followup — one thread, threadId pinned by the job. */
 export async function runDraft(job) {
   if (!job.gmailAccessToken) return noGmail();
@@ -126,7 +156,6 @@ export async function runScan(job) {
       const last = thread.last;
       if (last.fromMe && !state.isLearned(thread.id, last.id)) {
         const original = lastDraftFor(thread.id);
-        state.markLearned(thread.id, last.id);
         if (original) {
           const learned = await learnFromEdit({
             subject: thread.subject,
@@ -136,6 +165,10 @@ export async function runScan(job) {
           });
           if (learned && !/no durable lesson/i.test(learned)) lines.push(`voice learned — ${learned}`);
         }
+        // Mark only once the lesson is actually saved. Marking first meant a
+        // crash or timeout mid-learn burned that message permanently: it stays
+        // flagged as learned, and the edit it carried can never be mined again.
+        state.markLearned(thread.id, last.id);
       }
     } catch {
       // Learning must never block drafting.
@@ -161,6 +194,23 @@ export async function runScan(job) {
     }
   }
 
+  // Once per scan, after the drafting is done, and only on the day a learned
+  // file actually crosses the threshold. learnFromEdit appends and never
+  // removes, so without this voice.md and negotiation.md grow until the deal
+  // records — which load last — start falling off the end of the prompt.
+  if (oversized().length) {
+    try {
+      for (const r of await compactIfNeeded()) {
+        if (r.ok) lines.push(`compacted ${r.target}.md — ${r.before} -> ${r.after} bytes`);
+        else console.error(`  ! compaction skipped ${r.target}: ${r.error}`);
+      }
+      invalidateContext();
+    } catch (err) {
+      // Same rule as learning: never take down a scan that has already drafted.
+      console.error(`  ! compaction failed: ${err?.message ?? err}`);
+    }
+  }
+
   return {
     ok: true,
     summary: lines.length ? lines.join(" · ").slice(0, 1900) : "No new brand mail needing a draft.",
@@ -169,6 +219,23 @@ export async function runScan(job) {
   };
 }
 
+/** kind: compact — squeeze the learned layer on demand. */
+export async function runCompact() {
+  const results = await compactIfNeeded();
+  invalidateContext();
+
+  if (!results.length) return { ok: true, summary: "Nothing over the size threshold." };
+  const failed = results.filter((r) => !r.ok);
+  return {
+    ok: failed.length < results.length,
+    summary: results
+      .map((r) => (r.ok ? `${r.target}: ${r.before} -> ${r.after}` : `${r.target}: ${r.error}`))
+      .join(" · "),
+    error: failed.length === results.length ? failed[0].error : undefined,
+    mirror: buildMirror({ threads: [] }),
+  };
+}
+
 /**
  * kind: chat — a real, resumable Claude session scoped to the brand
  * directory. This is the "talk to it like in Claude Code" surface: it can
@@ -373,7 +440,18 @@ export async function runStats(job) {
 
 /** kind: edit — apply a website edit to the local file. Deterministic, no Claude. */
 export async function runEdit(job) {
-  const { target, body } = job.payload ?? {};
+  const { target, body, confirmPayment } = job.payload ?? {};
+
+  // "Were you actually paid?" answered on the website. The only fact that
+  // starts there rather than here, so it has to land in the file.
+  if (confirmPayment && typeof target === "string" && target.startsWith("deals/")) {
+    const slug = target.slice(6);
+    const done = applyPaymentConfirmation(slug, confirmPayment);
+    if (!done) return { ok: false, error: `could not confirm payment on '${target}'` };
+    invalidateContext();
+    return { ok: true, summary: done, mirror: buildMirror({ threads: [] }) };
+  }
+
   const files = {
     voice: join(VOICE_DIR, "voice.md"),
     "never-words": join(VOICE_DIR, "never-words.md"),

package/worker/index.js

@@ -17,6 +17,7 @@ import { setAgent } from "./claude.js";
 import {
   runChat,
   runDraft,
+  runCompact,
   runEdit,
   runLearn,
   runScan,
@@ -75,6 +76,8 @@ async function handle(job) {
       return runStats(job);
     case "edit":
       return runEdit(job);
+    case "compact":
+      return runCompact(job);
     // Brand Outreach (its own tool on the site; same worker, same token).
     case "outreach-chat":
       return runOutreachChat(job);

package/worker/record-write.js

@@ -0,0 +1,154 @@
+// Writing observations back into a brand record.
+//
+// The drafting pass used to be read-only: decide() runs tools-off, so a scan
+// that produced ten replies updated zero files. When Heli pulled the Navan
+// go-live at 08:25 on the morning it was due, the agent drafted a reply about
+// it and the calendar block kept the dead date forever.
+//
+// Rather than pay for a second, tool-enabled agent pass per thread, the draft
+// decision carries a `recordUpdates` object and this merges it in with plain
+// code. Same run, no extra call, no added latency — and because the merge is
+// deterministic it can't wander off and rewrite prose it wasn't asked to.
+
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { DEALS_DIR } from "./paths.js";
+import { appendDecisions, mergeRecord, parseRecord, serializeRecord } from "./record.js";
+
+const SLUG_RE = /^[a-z0-9-]+$/;
+
+/** Guess a ledger filename from a brand name: "Navan Edge" -> "navan-edge". */
+export function slugify(brand) {
+  return String(brand ?? "")
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-|-$/g, "");
+}
+
+/**
+ * Find the ledger a brand name belongs to without creating one by accident.
+ * An exact slug hit wins; otherwise a prefix match, so a draft that says
+ * "Navan" still lands on navan.md. Returns null when nothing matches — the
+ * caller must not invent a file, because a typo'd brand name would otherwise
+ * quietly fork a deal into two records.
+ */
+export function resolveSlug(brand, known) {
+  const slug = slugify(brand);
+  if (!slug) return null;
+  if (known.includes(slug)) return slug;
+  return known.find((k) => k.startsWith(slug) || slug.startsWith(k)) ?? null;
+}
+
+/**
+ * Apply `recordUpdates` to deals/<slug>.md.
+ *
+ * Returns a short description of what changed, or null if nothing did — the
+ * caller logs it against the draft so a surprising edit is traceable to the
+ * email that caused it.
+ */
+export function applyRecordUpdates(slug, updates) {
+  if (!SLUG_RE.test(slug ?? "")) return null;
+  if (!updates || typeof updates !== "object") return null;
+
+  const path = join(DEALS_DIR, `${slug}.md`);
+  if (!existsSync(path)) return null;
+
+  const md = readFileSync(path, "utf8");
+  const { record, decisions } = parseRecord(md);
+  if (!record) return null;
+
+  const { decisions: incoming, ...rest } = updates;
+  const nextRecord = mergeRecord(record, rest);
+  const nextDecisions = appendDecisions(decisions, Array.isArray(incoming) ? incoming : []);
+
+  const changed = summarize(record, nextRecord, decisions.length, nextDecisions.length);
+  if (!changed) return null;
+
+  writeFileSync(
+    path,
+    serializeRecord({
+      record: nextRecord,
+      decisions: nextDecisions,
+      archiveRef: existsSync(join(DEALS_DIR, "..", "archive", `${slug}.md`))
+        ? `archive/${slug}.md`
+        : null,
+    }),
+  );
+  return changed;
+}
+
+/**
+ * Record her answer to "were you actually paid?".
+ *
+ * This is the only fact in the system that starts on the website, so it has to
+ * end up in the file or the mirror becomes storage. mergeRecord() then treats
+ * `confirmed` as untouchable, so the agent re-reading the same ambiguous email
+ * can't flip it back.
+ */
+export function applyPaymentConfirmation(slug, { invoiceId, paid }) {
+  if (!SLUG_RE.test(slug ?? "")) return null;
+
+  const path = join(DEALS_DIR, `${slug}.md`);
+  if (!existsSync(path)) return null;
+
+  const md = readFileSync(path, "utf8");
+  const { record, decisions } = parseRecord(md);
+  if (!record) return null;
+
+  const invoices = record.money?.invoices ?? [];
+  const i = invoices.findIndex((inv) => inv.id === invoiceId);
+  if (i === -1) return null;
+
+  const next = {
+    ...record,
+    money: {
+      ...record.money,
+      invoices: invoices.map((inv, n) =>
+        n === i
+          ? {
+              ...inv,
+              confirmed: paid,
+              // The stamp is what makes the confirmation real — sanitizeInvoice
+              // discards a `confirmed` that arrives without it.
+              confirmedAt: new Date().toISOString(),
+              status: paid ? "paid" : "unpaid",
+              // Her word is the ceiling on certainty, not the agent's guess.
+              confidence: 1,
+              evidence: `Confirmed by hand on ${new Date().toISOString().slice(0, 10)}: ${
+                paid ? "paid" : "not paid"
+              }. Previously: ${inv.evidence ?? "no evidence recorded"}`,
+            }
+          : inv,
+      ),
+    },
+  };
+
+  writeFileSync(path, serializeRecord({ record: next, decisions, archiveRef: archiveRefFor(slug) }));
+  return `${slug} ${invoiceId}: ${paid ? "confirmed paid" : "confirmed NOT paid"}`;
+}
+
+function archiveRefFor(slug) {
+  return existsSync(join(DEALS_DIR, "..", "archive", `${slug}.md`)) ? `archive/${slug}.md` : null;
+}
+
+function summarize(before, after, beforeDecisions, afterDecisions) {
+  const bits = [];
+  if (before.stage !== after.stage) bits.push(`stage ${before.stage ?? "?"} -> ${after.stage}`);
+  if (before.whoseMove !== after.whoseMove) bits.push(`move -> ${after.whoseMove}`);
+
+  const dateChanges = (after.calendar ?? []).filter((e) => {
+    const old = (before.calendar ?? []).find((o) => o.key === e.key);
+    return !old || old.date !== e.date || old.tbd !== e.tbd;
+  }).length;
+  if (dateChanges) bits.push(`${dateChanges} date(s)`);
+
+  const invChanges = (after.money?.invoices ?? []).filter((inv) => {
+    const old = (before.money?.invoices ?? []).find((o) => o.id === inv.id);
+    return !old || old.status !== inv.status;
+  }).length;
+  if (invChanges) bits.push(`${invChanges} invoice(s)`);
+
+  if (afterDecisions > beforeDecisions) bits.push(`+${afterDecisions - beforeDecisions} decision(s)`);
+
+  return bits.length ? bits.join(", ") : null;
+}

package/worker/record.js

@@ -0,0 +1,264 @@
+// The brand record — what replaced the ledger journal.
+//
+// A ledger used to be a chronological log the agent appended to forever.
+// navan.md reached 56KB across 44 dated headings, including entries explicitly
+// marked as superseded ("CORRECTED below, this read was wrong"), all of it
+// spent out of a shared 350k prompt budget. Of that, perhaps 3KB could ever
+// inform a future draft.
+//
+// A record is the opposite: current state, and the decisions that constrain
+// the next one. Two parts, both small.
+//
+//   <!-- brand {...} -->   machine-readable current state, rewritten in place
+//   ## Decisions           append-only one-liners — the durable precedent
+//
+// The narrative moves to archive/<slug>.md, which is NOT loaded into drafting
+// context. Chat can still read it when she asks for history.
+//
+// Why a JSON block inside markdown rather than a real database: these files are
+// hers. "Open Claude Code in this folder and talk to it" has to keep working,
+// and the website is a projection of the files, never the owner of them.
+
+/** Stages the board understands. Kept in sync with goosetools' BRAND_STAGES. */
+export const STAGES = [
+  "inbound",
+  "negotiating",
+  "contract",
+  "producing",
+  "posted",
+  "awaiting_pay",
+  "paid",
+  "declined",
+  "cancelled",
+];
+
+// The live ledgers drifted: the agent wrote whatever stage word fit the moment.
+const STAGE_ALIASES = {
+  scoping: "negotiating",
+  "in production": "producing",
+  "in-production": "producing",
+  signed: "contract",
+  dead: "declined",
+  rejected: "declined",
+  gifting: "inbound",
+  live: "posted",
+};
+
+export function normalizeStage(raw) {
+  if (!raw) return null;
+  const s = String(raw).trim().toLowerCase().replace(/\s+/g, " ");
+  if (STAGES.includes(s)) return s;
+  return STAGE_ALIASES[s] ?? s;
+}
+
+/**
+ * `confirmed` is the creator's answer and nobody else's: true, false, or null
+ * for "never asked". The agent has no business writing it — but it did, twice
+ * in one migration (a bare `false` on Navan, a date string on Microsoft), and
+ * either one silences the "were you actually paid?" prompt for that invoice
+ * and then freezes the value against every later update.
+ *
+ * A type check can't catch it: the agent's `false` and her "no" are the same
+ * boolean. So a confirmation only counts when it carries `confirmedAt`, which
+ * applyPaymentConfirmation() stamps and nothing else writes. Provenance, not
+ * shape — which also means a record hand-edited in a terminal needs the stamp
+ * too, and that is the right trade for a field this load-bearing.
+ */
+export function sanitizeInvoice(inv) {
+  if (!inv || typeof inv !== "object") return inv;
+  const vouched = typeof inv.confirmed === "boolean" && typeof inv.confirmedAt === "string";
+  return vouched ? inv : { ...inv, confirmed: null, confirmedAt: null };
+}
+
+const blockRe = (name) => new RegExp(`<!--\\s*${name}\\s([\\s\\S]*?)-->`, "i");
+
+/**
+ * Read one `<!-- name {...} -->` block. Returns null rather than throwing:
+ * these blocks are model-written, and a malformed one must degrade to "we
+ * don't know" instead of taking down a scan.
+ */
+export function readBlock(md, name) {
+  const m = String(md ?? "").match(blockRe(name));
+  if (!m) return null;
+  try {
+    return JSON.parse(m[1]);
+  } catch {
+    return null;
+  }
+}
+
+/** Replace a block in place, or append one if the file has none. */
+export function writeBlock(md, name, value) {
+  const body = `<!-- ${name}\n${JSON.stringify(value, null, 2)}\n-->`;
+  const src = String(md ?? "");
+  return blockRe(name).test(src) ? src.replace(blockRe(name), body) : `${src.trimEnd()}\n\n${body}\n`;
+}
+
+const DECISION_RE = /^[-*]\s+(\d{4}-\d{2}-\d{2})\s*·\s*(.+)$/;
+
+/** One line per decision: `- 2026-07-15 · accepted $14,000 · 2yr paid usage` */
+export function parseDecisions(md) {
+  const section = String(md ?? "").split(/^##\s+Decisions\s*$/im)[1];
+  if (!section) return [];
+
+  const out = [];
+  for (const line of section.split("\n")) {
+    if (/^##\s/.test(line)) break; // next heading ends the section
+    const m = line.trim().match(DECISION_RE);
+    if (m) {
+      const [what, ...why] = m[2].split("·").map((s) => s.trim());
+      out.push({ date: m[1], what, why: why.join(" · ") || null });
+    }
+  }
+  return out;
+}
+
+export function renderDecisions(decisions) {
+  return decisions
+    .slice()
+    .sort((a, b) => a.date.localeCompare(b.date))
+    .map((d) => `- ${d.date} · ${[d.what, d.why].filter(Boolean).join(" · ")}`)
+    .join("\n");
+}
+
+/**
+ * Read a record from either format. Files migrate one at a time and a scan can
+ * hit an un-migrated one at any point, so the legacy `board` + `calendar` pair
+ * has to keep working until every file has moved over.
+ */
+export function parseRecord(md) {
+  const src = String(md ?? "");
+  const brand = readBlock(src, "brand");
+
+  if (brand) {
+    return {
+      record: { ...brand, stage: normalizeStage(brand.stage), money: sanitizeMoney(brand.money) },
+      decisions: parseDecisions(src),
+      legacy: false,
+    };
+  }
+
+  const board = readBlock(src, "board");
+  const calendar = readBlock(src, "calendar");
+  if (!board && !calendar) return { record: null, decisions: parseDecisions(src), legacy: true };
+
+  return { record: fromLegacyBoard(board ?? {}, calendar), decisions: [], legacy: true };
+}
+
+function sanitizeMoney(money) {
+  if (!money || typeof money !== "object") return money ?? null;
+  return { ...money, invoices: (money.invoices ?? []).map(sanitizeInvoice) };
+}
+
+/** Lift the old board block into a record. Terms stay strings — see below. */
+export function fromLegacyBoard(board, calendar) {
+  const agencyRaw = typeof board.agency === "string" ? board.agency.trim() : "";
+  // Live data writes "Freeman & Forrest · Rebekah Greene" in one string.
+  const [agencyName, agencyContact] = agencyRaw.split("·").map((s) => s.trim());
+
+  return {
+    brand: board.brand ?? null,
+    agency: agencyName ? { name: agencyName, contact: agencyContact || null } : null,
+    contacts: board.contact ? [board.contact] : [],
+    stage: normalizeStage(board.stage),
+    whoseMove: board.whoseMove ?? null,
+    deal: {
+      // Deliberately not parsed into a number here. The live values include
+      // "asked $2,000, countered $1,200" and "$3.7-4.4K (quoted)" — turning
+      // those into one integer would invent a fact. The migration pass reads
+      // them with judgement; this path only reshapes what is already there.
+      rate: board.rate ?? null,
+      deliverables: board.deliverables ?? null,
+      usage: board.usage ?? null,
+      postWindow: board.postWindow ?? null,
+    },
+    exclusivity: board.exclusivity ? { raw: board.exclusivity } : null,
+    money: null,
+    calendar: Array.isArray(calendar) ? calendar : [],
+    flags: Array.isArray(board.flags) ? board.flags : [],
+  };
+}
+
+export function serializeRecord({ record, decisions = [], archiveRef = null }) {
+  const parts = [`# ${record.brand ?? "Untitled"}`, "", writeBlock("", "brand", record).trim()];
+
+  if (decisions.length) parts.push("", "## Decisions", "", renderDecisions(decisions));
+  if (archiveRef) parts.push("", `_History: ${archiveRef}_`);
+
+  return `${parts.join("\n")}\n`;
+}
+
+/**
+ * Merge what the drafting agent observed into the stored record.
+ *
+ * Upserts by stable key so a re-observed date updates in place instead of
+ * accumulating duplicates. Two things are never overwritten: a payment Erin
+ * confirmed by hand, and a decision already on the log.
+ */
+export function mergeRecord(record, updates) {
+  if (!updates) return record;
+  const next = { ...record };
+
+  for (const k of ["stage", "whoseMove", "status"]) {
+    if (updates[k] != null) next[k] = k === "stage" ? normalizeStage(updates[k]) : updates[k];
+  }
+  if (updates.deal) next.deal = { ...(next.deal ?? {}), ...updates.deal };
+  if (updates.exclusivity) next.exclusivity = { ...(next.exclusivity ?? {}), ...updates.exclusivity };
+  if (Array.isArray(updates.flags)) next.flags = updates.flags;
+
+  if (Array.isArray(updates.calendar)) {
+    next.calendar = upsertBy(next.calendar ?? [], updates.calendar, "key");
+  }
+
+  if (updates.money) {
+    const prev = next.money ?? { invoices: [] };
+    next.money = {
+      ...prev,
+      ...updates.money,
+      invoices: upsertBy(prev.invoices ?? [], (updates.money.invoices ?? []).map(dropConfirmed), "id", (old, incoming) =>
+        // She answered "was I actually paid?" by hand. The agent re-reading the
+        // same ambiguous email must not quietly flip it back. This is the Navan
+        // Edge case: she believed she'd been paid and hadn't.
+        old.confirmed != null ? { ...incoming, ...pick(old, ["confirmed", "status", "paidAt"]) } : { ...old, ...incoming },
+      ),
+    };
+  }
+
+  return next;
+}
+
+/** An incoming update may never carry `confirmed` — only the creator sets it. */
+function dropConfirmed(inv) {
+  if (!inv || typeof inv !== "object") return inv;
+  const { confirmed, ...rest } = inv;
+  return rest;
+}
+
+function upsertBy(existing, incoming, key, resolve) {
+  const out = existing.slice();
+  for (const item of incoming) {
+    if (item?.[key] == null) continue;
+    const i = out.findIndex((e) => e?.[key] === item[key]);
+    if (i === -1) out.push(item);
+    else out[i] = resolve ? resolve(out[i], item) : { ...out[i], ...item };
+  }
+  return out;
+}
+
+function pick(obj, keys) {
+  return Object.fromEntries(keys.filter((k) => obj[k] !== undefined).map((k) => [k, obj[k]]));
+}
+
+/** Append decisions, skipping any we already recorded on the same date. */
+export function appendDecisions(existing, incoming = []) {
+  const seen = new Set(existing.map((d) => `${d.date}|${d.what?.toLowerCase()}`));
+  const out = existing.slice();
+  for (const d of incoming) {
+    if (!d?.date || !d?.what) continue;
+    const k = `${d.date}|${String(d.what).toLowerCase()}`;
+    if (seen.has(k)) continue;
+    seen.add(k);
+    out.push(d);
+  }
+  return out;
+}