[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_107":108,"_109":110},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":22},"handle","amir5","name","dogsspot_puppy_path","path","SOURCE-BUNDLE.part38.txt","project",{"_23":45,"_11":12,"_34":46,"_47":-5,"_48":42,"_49":50,"_51":50,"_52":53,"_54":-5,"_55":56,"_57":58,"_59":33,"_60":-5,"_61":-5,"_62":63,"_64":65,"_66":67,"_68":69,"_70":71,"_72":-5,"_73":74,"_75":74,"_76":77,"_78":77,"_79":77,"_80":74,"_81":74,"_82":83,"_84":85,"_86":87,"_88":42},"file",{"_23":24,"_11":14,"_25":26,"_27":-5,"_28":29,"_30":31,"_32":33,"_34":35,"_36":37,"_38":17,"_39":40,"_41":42,"_43":-5,"_13":44},"permalink","https://www.val.town/x/amir5/dogsspot_puppy_path/code/SOURCE-BUNDLE.part38.txt","extension","txt","id","58a91ebc-56e2-4e15-89ed-707a84d27248","fileId","272a8e58-9832-11f1-a957-1607ee4eb77e","parentId","branchId","551774fb-a850-4c9d-94a1-d3509ddcf1b0","branchVersion",1208,"latest",true,"createdAt",["D",1786982940180],"version",4,"fileType","content","THE DOGS SPOT — SOURCE BUNDLE (part 38 of 47)\n\nEVERY source file in this project, engine/ included. Restoring these parts and nothing else gives\nyou a tree that builds, typechecks and runs its own test suite with no network and no val.\n\nengine/ is here as of 14 Aug 2026. It used to be left out because val 1bfa6e81-74e1-4c6c-ab32-118304a4ffff\nholds it, which was true of every engine file except engine/watch.ts: a module the val does not run,\nso it was never deployed, so it lived in one container and nothing else. A reclaim destroyed it.\nscripts/deploy.mjs --check still compares engine/ against the val file by file; that is a second\ncheck on the same files now, not the only copy of them.\n\nRESTORE (needs only node, from an empty folder). Save each part, then run this ON EACH ONE:\n\n node -e 'const fs=require(\"fs\"),p=require(\"path\");const b=fs.readFileSync(process.argv[1],\"utf8\");\n for(const s of b.split(\"\\n=====FILE \").slice(1)){const i=s.indexOf(\" =====\\n\");\n const f=s.slice(0,i),c=s.slice(i+7);fs.mkdirSync(p.dirname(f),{recursive:true});\n fs.writeFileSync(f,c.replace(/\\n$/,\"\"))}' PART.txt\n\nA record named #1, #2, ... is one FILE cut into pieces: concatenate them in order, then\nstrip one trailing newline from the last. scripts/restore.mjs does this for you.\n\nEach part is complete in itself: whole files only, no reassembly, any order.\n\nThen: node scripts/build.mjs (engine/ came out of these parts; nothing to fetch first)\n node scripts/typecheck.mjs\n node tests/run-all.mjs\n node scripts/deploy.mjs --check (pulls nothing, proves the val matches what you restored)\n node tests/negative-controls.mjs (proves the suite above can actually fail)\n\nIN THIS PART (3 of 129 files)\n scripts/watch-run.mjs 27955 bytes 5804e851e1ac\n watchdog/main.ts 44124 bytes ddcb8d47f63b\n watchdog/run.ts 1286 bytes 6d26da771392\n\n================================================================================================\n=====FILE scripts/watch-run.mjs =====\n#!/usr/bin/env node\n// THE EARLY WARNING RUN. Generator, 12 Aug 2026.\n//\n// WHAT THIS IS. Kim asked for \"some kind of early warning system so a five month gap like this\n// can't quietly happen again\". The gap she means: her CRM recorded no payment amounts after\n// 19 February 2026 and nobody noticed until August, because staff had started ringing sales\n// straight into the Square app and the CRM was simply cut out. Nothing errored, so nothing\n// alerted. This script pulls the live data, runs engine/watch.ts over it, and writes a short\n// report.\n//\n// READ ONLY, DEPLOYS NOTHING, SCHEDULES NOTHING. Three GETs (the CRM's payment transactions, the\n// CRM's most recent contacts, and the Square bridge's own journal) and two local files out, plus a\n// small local notes file so it can tell whether a running total ever goes backwards.\n//\n// WHY IT DOES NOT RE-DERIVE WHICH PAYMENTS ARE UNMATCHED. That rule already exists twice, in\n// engine/facts.ts squareBacklog() and in scripts/exception-report-lib.mjs, cross checked against\n// each other on every exception report run. A third hand-copy is how Kim ended up quoted a wrong\n// backlog figure in writing once already ($10,884.00 across 9 payments, engine/facts.ts:64-69).\n// So this imports unmatchedPaymentRows() from the existing library and reconciles what it derives\n// against it before anything is written (see reconcileOrDie below). This report EXTENDS the weekly\n// exception report; it does not repeat it. That one answers \"which payments did not match\". This\n// one answers \"has something stopped happening at all\".\n//\n// USAGE\n// node scripts/watch-run.mjs\n// ENV OVERRIDES (all optional)\n// WATCH_OUT_DIR default: /mnt/user-data/outputs\n// WATCH_STATE_FILE default: /reports/watch-state.json (the running totals it remembers)\n// WATCH_DATE default: today, formatted D-Mon\n// GHL_TOKEN default: read from the same place the other read only scripts read it\n// BRIDGE_URL default: read from engine/dashboard.ts\n// BRIDGE_ADMIN required for the live bridge journal; never stored in source\n// WATCH_OFFLINE_DIR offline mode: read payments.json / contacts.json / journal.json from here\n// instead of the network. Used for debugging only, never for a real report.\n// WATCH_NOW judge everything as if it were this moment, ignoring anything dated later.\n// This is how the claim \"it would have caught 19 February\" is replayed\n// against the real payment history rather than asserted.\n\nimport { spawnSync } from \"node:child_process\";\nimport { readFileSync, writeFileSync, mkdirSync, existsSync } from \"node:fs\";\nimport { join, dirname, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\n\nconst HERE = dirname(fileURLToPath(import.meta.url));\nconst ROOT = resolve(HERE, \"..\");\n\nfunction shout(msg) { console.error(`\\n!!!! ${msg} !!!!\\n`); }\nfunction die(msg) { shout(msg); process.exit(1); }\n\n// -------------------------------------------------------------------------------------------\n// STEP 0. Rebuild engine/ -> build/ before importing anything from it. Same rule and the same\n// reason as tests/run-all.mjs and scripts/exception-report.mjs: on 6 August a suite reported 270\n// assertions passing against code that had been deleted, because nobody rebuilt first. A monitor\n// running against stale logic is worse than no monitor, since its whole job is to be believed.\n// -------------------------------------------------------------------------------------------\n{\n const b = spawnSync(\"node\", [join(ROOT, \"scripts\", \"build.mjs\")], { encoding: \"utf8\", timeout: 300_000 });\n if (b.status !== 0) die(`BUILD FAILED. Refusing to run a monitor built from logic that will not compile.\\n${(b.stdout ?? \"\") + (b.stderr ?? \"\")}`.trim());\n}\n\nconst W = await import(join(ROOT, \"build\", \"watch.js\"));\nconst { unmatchedPaymentRows } = await import(join(ROOT, \"scripts\", \"exception-report-lib.mjs\"));\n\n// -------------------------------------------------------------------------------------------\n// STEP 1. Credentials. Secrets are environment-only because the deployed source is public.\n// -------------------------------------------------------------------------------------------\nconst DASHBOARD_TS = process.env.DASHBOARD_TS_PATH || join(ROOT, \"engine\", \"dashboard.ts\");\nif (!existsSync(DASHBOARD_TS)) die(`cannot find ${DASHBOARD_TS}. Restore it before running this.`);\nconst dashboardSrc = readFileSync(DASHBOARD_TS, \"utf8\");\nconst readConstFrom = (text, name) => (new RegExp(`const\\\\s+${name}\\\\s*=\\\\s*\"([^\"]+)\"`).exec(text) ?? [])[1] ?? null;\n\nconst admin = process.env.BRIDGE_ADMIN || \"\";\nif (admin.length < 24) die(\"BRIDGE_ADMIN is missing or too short. Set the rotated credential in the environment; source fallbacks are forbidden.\");\n\nconst BRIDGE = process.env.BRIDGE_URL || readConstFrom(dashboardSrc, \"BRIDGE\");\nif (!BRIDGE) die(`could not find a BRIDGE literal in ${DASHBOARD_TS}`);\nconst LOC = readConstFrom(dashboardSrc, \"LOC\");\nif (!LOC) die(`could not find the location id (LOC) in ${DASHBOARD_TS}`);\nconst GHL = readConstFrom(dashboardSrc, \"GHL\") || \"https://services.leadconnectorhq.com\";\n\n// The CRM token. Same source the other read only scripts in this tree use rather than a fresh copy.\nfunction ghlToken() {\n if (process.env.GHL_TOKEN) return process.env.GHL_TOKEN;\n for (const p of [\n \"/home/claude/dogsspot/tests/aged_audit.py\",\n \"/home/claude/dogsspot/handover/honour-optouts.py\",\n ]) {\n if (!existsSync(p)) continue;\n const m = /pit-[a-f0-9]{8}-[a-f0-9-]+/.exec(readFileSync(p, \"utf8\"));\n if (m) { console.log(`CRM token: read from ${p}`); return m[0]; }\n }\n return null;\n}\nconst TOKEN = ghlToken();\nif (!TOKEN) die(\"no CRM token found. Set GHL_TOKEN or restore the file it is normally read from.\");\n\n// The User-Agent is not decoration: this API rejects the default node fetch agent.\nconst HEADERS = { Authorization: `Bearer ${TOKEN}`, Version: \"2021-07-28\", \"User-Agent\": \"curl/8.5.0\" };\nconst OFFLINE = process.env.WATCH_OFFLINE_DIR || null;\nif (OFFLINE) console.log(`offline mode: reading fixtures from ${OFFLINE} instead of the network`);\n\nasync function getJson(url, what, headers) {\n let res;\n try { res = await fetch(url, { headers, signal: AbortSignal.timeout(45_000) }); }\n catch (e) { die(`${what} fetch threw: ${e.message}`); }\n if (!res.ok) die(`${what} fetch failed: HTTP ${res.status}`);\n return res.json();\n}\nconst offlineJson = (name) => JSON.parse(readFileSync(join(OFFLINE, name), \"utf8\"));\n\n// -------------------------------------------------------------------------------------------\n// STEP 2. THE CRM's PAYMENT TRANSACTIONS, every page. Walking every page matters: a reader that\n// stops at page one is exactly the shape of fault check 5 exists to catch, and it would be quietly\n// producing a monitor that under-reports rather than an error anybody sees.\n// -------------------------------------------------------------------------------------------\nlet payments = [];\nlet paymentsTotalCount = null;\nif (OFFLINE) {\n const p = offlineJson(\"payments.json\");\n payments = p.data ?? p;\n paymentsTotalCount = p.totalCount ?? payments.length;\n} else {\n for (let offset = 0, guard = 0; guard < 60; guard++, offset += 100) {\n const body = await getJson(\n `${GHL}/payments/transactions?altId=${encodeURIComponent(LOC)}&altType=location&limit=100&offset=${offset}`,\n `payment transactions at offset ${offset}`, HEADERS);\n const page = Array.isArray(body?.data) ? body.data : [];\n if (paymentsTotalCount === null) paymentsTotalCount = Number(body?.totalCount ?? 0) || null;\n payments.push(...page);\n if (page.length < 100) break;\n }\n}\nif (!payments.length) die(\"the CRM returned ZERO payment transactions. A monitor that inspects nothing is a blind spot, not an all clear. Nothing written.\");\n{\n const ids = new Set(payments.map((p) => p?._id));\n if (ids.size !== payments.length) shout(`paging returned ${payments.length} rows but only ${ids.size} distinct ids. Duplicates across pages would inflate every count below.`);\n if (paymentsTotalCount && payments.length !== paymentsTotalCount) {\n shout(`read ${payments.length} payment rows but the CRM says it holds ${paymentsTotalCount}. Paging stopped early or the total moved while reading.`);\n }\n}\nconsole.log(`Read ${payments.length} payment transactions from the CRM (it reports ${paymentsTotalCount ?? \"an unknown\"} in total).`);\n\n// -------------------------------------------------------------------------------------------\n// STEP 3. THE CRM's MOST RECENT CONTACTS. One page, newest first: enough to measure how often new\n// people arrive, which is what makes \"the leads stopped\" visible without walking 5,700 records.\n// -------------------------------------------------------------------------------------------\nlet contacts = [], contactsTotal = null;\nif (OFFLINE) {\n const c = offlineJson(\"contacts.json\");\n contacts = c.contacts ?? c;\n contactsTotal = c.meta?.total ?? contacts.length;\n} else {\n const body = await getJson(`${GHL}/contacts/?locationId=${encodeURIComponent(LOC)}&limit=100`, \"contacts\", HEADERS);\n contacts = Array.isArray(body?.contacts) ? body.contacts : [];\n contactsTotal = Number(body?.meta?.total ?? 0) || null;\n}\nconsole.log(`Read ${contacts.length} of the most recent contact records (the CRM reports ${contactsTotal ?? \"an unknown number\"} in total).`);\n\n// -------------------------------------------------------------------------------------------\n// STEP 4. THE SQUARE BRIDGE's OWN JOURNAL. Read only, ?dump=1.\n// -------------------------------------------------------------------------------------------\nlet journal = OFFLINE\n ? offlineJson(\"journal.json\")\n : await getJson(`${BRIDGE}?dump=1&admin=${encodeURIComponent(admin)}`, \"bridge journal\", undefined);\nif (!Array.isArray(journal)) die(`the bridge journal did not come back as a list (got ${typeof journal}).`);\nif (!journal.length) shout(\"the bridge journal came back EMPTY. That is itself a finding and the bridge check below will say so, but it is worth a human's eyes now.\");\nconsole.log(`Read ${journal.length} rows from the Square bridge journal.`);\n\n// -------------------------------------------------------------------------------------------\n// STEP 5. SHAPE THE LIVE DATA INTO WHAT THE CHECKS TAKE. Every judgement lives in\n// engine/watch.ts; everything here is selection, so that nothing decides anything untested.\n// -------------------------------------------------------------------------------------------\n// WATCH_NOW EXISTS SO THE CENTRAL CLAIM CAN BE REPLAYED RATHER THAN ASSERTED. Every judgement\n// below is made against a clock this file is handed, so the same code can be pointed at the real\n// payment history as it stood on any past date and asked what it would have said that morning.\n// \"This would have caught 19 February\" is otherwise a sentence with nothing underneath it.\nconst NOW = process.env.WATCH_NOW ? Date.parse(process.env.WATCH_NOW) : Date.now();\nif (!Number.isFinite(NOW)) die(`WATCH_NOW is not a date I can read: ${process.env.WATCH_NOW}`);\nif (process.env.WATCH_NOW) console.log(`REPLAY: judging everything as if it were ${new Date(NOW).toISOString()}. Records after that moment are ignored.`);\n// A RECORD DATED AFTER THE MOMENT WE ARE JUDGING IS NOT EVIDENCE. On a live run this drops\n// nothing. On a replay it is what makes the replay honest: without it the silence check would see\n// a payment from three months after the date it is pretending to be, and report that everything\n// was fine on a morning when it was not.\nconst notAfterNow = (rows, at) => {\n const kept = rows.filter((r) => {\n const t = Date.parse(String(at(r) ?? \"\"));\n return !Number.isFinite(t) || t <= NOW;\n });\n return { kept, dropped: rows.length - kept.length };\n};\n{\n const p = notAfterNow(payments, (r) => r?.createdAt);\n const c = notAfterNow(contacts, (r) => r?.dateAdded);\n const j = notAfterNow(journal, (r) => r?.ts);\n if (p.dropped || c.dropped || j.dropped) {\n console.log(`Ignoring records dated after the moment being judged: ${p.dropped} payments, ${c.dropped} contacts, ${j.dropped} journal rows.`);\n }\n payments = p.kept; contacts = c.kept; journal = j.kept;\n if (!payments.length) die(\"after ignoring records dated later than the moment being judged, there are ZERO payment records left. Nothing to inspect is a blind spot, not an all clear.\");\n}\n\nconst REAL_MONEY = 1; // engine/payments-source.ts MIN_REAL_PAYMENT: below a dollar is a card test,\n // and a $0 row is a calendar booking artifact rather than money.\nconst amountOf = (p) => Number(p?.amount) || 0;\nconst atOf = (p) => p?.createdAt ?? null;\n\n// 5a. STREAMS FOR THE SILENCE CHECK. Each is a thing that normally produces records. The first is\n// the one that went quiet on 19 February.\nconst bySourceType = new Map();\nfor (const p of payments) {\n const st = String(p?.entitySourceType ?? \"unknown\");\n if (!bySourceType.has(st)) bySourceType.set(st, []);\n bySourceType.get(st).push(p);\n}\nconst SOURCE_NAMES = {\n invoice: \"invoices paid in your CRM\",\n calendar: \"bookings taken in your CRM\",\n funnel: \"online form payments\",\n payment_link: \"payment links\",\n manual: \"payments entered by hand\",\n};\nconst streams = [\n {\n name: \"payments with money on them in your CRM\",\n timestamps: payments.filter((p) => amountOf(p) >= REAL_MONEY).map(atOf),\n whereToLook: \"Open the Square app and check what has been taken there over the same period. If Square shows sales your CRM does not, sales are being rung up in a way that never reaches a customer record, which is exactly what happened after 19 February 2026.\",\n },\n {\n name: \"new people arriving in your CRM\",\n timestamps: contacts.map((c) => c?.dateAdded ?? null),\n whereToLook: \"Check that your website forms and ad campaigns are still switched on and still pointing at your CRM.\",\n },\n ...[...bySourceType.entries()].sort().map(([st, rows]) => ({\n name: SOURCE_NAMES[st] || `payments of type ${st}`,\n timestamps: rows.map(atOf),\n })),\n];\n\n// 5b. THE MATCH RATIO. Which payments the Square bridge saw, and which of them ever reached a\n// customer record. The unmatched set comes from the existing, tested library; this only groups.\nconst paymentIdsInJournal = new Map();\nfor (const r of journal) {\n const m = /payment\\s+(\\S+)/.exec(String(r?.note ?? \"\"));\n if (!m) continue;\n const ts = Date.parse(String(r?.ts ?? \"\"));\n const at = Number.isFinite(ts) ? ts : null;\n const prev = paymentIdsInJournal.get(m[1]);\n if (prev === undefined || (at !== null && (prev === null || at < prev))) paymentIdsInJournal.set(m[1], at);\n}\nconst unmatchedRows = unmatchedPaymentRows(journal);\nconst unmatchedIds = new Set(unmatchedRows.map((r) => r.paymentId));\n\n// RECONCILE OR DIE (LESSONS #8: reconcile any subset against its parent before it leaves the\n// building). Every payment the exception report calls unmatched must be one this run has seen. If\n// it is not, this file's grouping and the library's grouping have drifted apart and neither number\n// can be trusted.\nfunction reconcileOrDie() {\n const missing = [...unmatchedIds].filter((id) => !paymentIdsInJournal.has(id));\n if (missing.length) {\n shout(\"RECONCILIATION FAILED. The exception report's list of unmatched payments contains ids this run never saw in the journal. Nothing written.\");\n for (const id of missing.slice(0, 10)) console.error(` - ${id}`);\n process.exit(1);\n }\n console.log(`Reconciled: all ${unmatchedIds.size} payments the exception report calls unmatched are among the ${paymentIdsInJournal.size} the journal mentions.`);\n}\nreconcileOrDie();\n\nconst seen = [...paymentIdsInJournal.entries()].map(([id, atMs]) => ({ id, atMs, matched: !unmatchedIds.has(id) }));\nconst RATIO_WINDOW_DAYS = Number(process.env.WATCH_RATIO_WINDOW_DAYS || 7);\nconst RATIO_WINDOWS = Number(process.env.WATCH_RATIO_WINDOWS || 6);\nconst ratioPoints = W.ratioBuckets(seen, NOW, RATIO_WINDOW_DAYS, RATIO_WINDOWS);\n\n// 5c. THE FEBRUARY SHAPE. Activity is every payment record the CRM holds, whatever its value,\n// because a booking with $0 against it is still a dog in the building. Dollars are the real money\n// recorded against them. Read together, these two say whether the work is happening while the\n// takings are not being written down.\nconst REVENUE_WINDOW_DAYS = Number(process.env.WATCH_REVENUE_WINDOW_DAYS || 28);\nconst REVENUE_WINDOWS = Number(process.env.WATCH_REVENUE_WINDOWS || 7);\nconst activity = payments.map((p) => ({\n atMs: Date.parse(String(atOf(p) ?? \"\")) || null,\n dollars: amountOf(p) >= REAL_MONEY ? amountOf(p) : 0,\n}));\nconst revenuePeriods = W.revenuePeriods(activity, NOW, REVENUE_WINDOW_DAYS, REVENUE_WINDOWS);\n\n// 5d. THE RUNNING TOTALS, and the notes file that remembers them between runs. A local file, not\n// a live system: nothing here writes to the CRM, to Square or to the bridge.\nconst STATE_FILE = process.env.WATCH_STATE_FILE || join(ROOT, \"reports\", \"watch-state.json\");\nconst MAX_SNAPSHOTS = 60;\nlet priorSnapshots = [];\nif (existsSync(STATE_FILE)) {\n try {\n const parsed = JSON.parse(readFileSync(STATE_FILE, \"utf8\"));\n priorSnapshots = Array.isArray(parsed?.snapshots) ? parsed.snapshots : [];\n console.log(`Read ${priorSnapshots.length} earlier readings of the running totals from ${STATE_FILE}.`);\n } catch (e) {\n shout(`could not read ${STATE_FILE} (${e.message}). Treating this as a first run, so nothing can be compared this time.`);\n }\n} else {\n console.log(`No earlier readings at ${STATE_FILE}: this is a first run, so the running totals have nothing to be compared against yet.`);\n}\n\nconst counters = {\n crmPaymentRecords: paymentsTotalCount ?? payments.length,\n crmPaymentDollarsLifetime: Math.round(payments.reduce((a, p) => a + (amountOf(p) >= REAL_MONEY ? amountOf(p) : 0), 0) * 100) / 100,\n crmContactRecords: contactsTotal ?? contacts.length,\n bridgeJournalRows: journal.length,\n bridgePaymentsSeen: paymentIdsInJournal.size,\n};\nconst counterLabels = {\n crmPaymentRecords: \"The number of payment records in your CRM\",\n crmPaymentDollarsLifetime: \"The total value of every payment your CRM has ever recorded\",\n crmContactRecords: \"The number of people in your CRM\",\n bridgeJournalRows: \"The number of things the Square link has written down\",\n bridgePaymentsSeen: \"The number of Square sales the link has seen\",\n};\nconst snapshots = [...priorSnapshots, { at: new Date(NOW).toISOString(), counters }].slice(-MAX_SNAPSHOTS);\n\n// -------------------------------------------------------------------------------------------\n// STEP 6. RUN THE CHECKS. Every judgement in the report below is made here and nowhere else.\n// -------------------------------------------------------------------------------------------\nconst report = W.runWatch({\n nowMs: NOW,\n streams,\n ratio: { subject: \"Square payments\", points: ratioPoints },\n revenue: { subject: \"your bookings\", periods: revenuePeriods },\n journal,\n snapshots,\n counterLabels,\n});\n\n// A CHECK THAT INSPECTED NOTHING MUST HAVE SAID SO. runWatch enforces this itself; this is the\n// second pair of eyes, because the whole report rests on it (LESSONS #2).\n{\n const blind = W.blindSpots(report.checks);\n if (blind.length) die(`${blind.length} check(s) inspected zero items and raised nothing: ${blind.map((c) => c.check).join(\", \")}. The monitor is not watching what it claims to.`);\n const quiet = report.checks.filter((c) => c.inspected === 0);\n if (quiet.length) shout(`${quiet.length} check(s) inspected zero items: ${quiet.map((c) => c.check).join(\", \")}. Each has raised a finding about itself, which is in the report.`);\n}\n\n// -------------------------------------------------------------------------------------------\n// STEP 7. WRITE IT. Client safe copy rules enforced mechanically, same two rules the weekly\n// exception report enforces, from the one shared implementation in engine/watch.ts.\n// -------------------------------------------------------------------------------------------\nconst now = new Date(NOW);\nconst MONTHS = [\"Jan\", \"Feb\", \"Mar\", \"Apr\", \"May\", \"Jun\", \"Jul\", \"Aug\", \"Sep\", \"Oct\", \"Nov\", \"Dec\"];\nconst dateSuffix = process.env.WATCH_DATE || `${now.getUTCDate()}-${MONTHS[now.getUTCMonth()]}`;\nconst md = W.watchReportMarkdown(report, `Early warning check, ${dateSuffix}`);\n{\n const problems = W.copyProblems(md);\n if (problems.length) {\n shout(\"CLIENT SAFE COPY CHECK FAILED. Nothing written.\");\n for (const p of problems) console.error(` - ${p}`);\n process.exit(1);\n }\n console.log('Client safe copy check passed: no dashes as punctuation, no \"daycare\".');\n}\n\n// -------------------------------------------------------------------------------------------\n// STEP 7b. THE PAGE THE OWNER ACTUALLY READS.\n//\n// The markdown above is the engine's own rendering and it prints its workings: \"The figures behind\n// that: records: 1, needed: 5\", \"read 790 journal rows\", and a timestamp in GMT for a business in\n// Georgia. That is a debugging view, and it went out to a client. This renders the same report as\n// something a person can read on a laptop: her own clock, no key and value pairs, no counts of\n// rows in a log she has never heard of, and every blind spot followed by the thing to do about it.\n// The engine's own view is kept and written to the repo, because when a figure is queried the\n// workings have to still exist somewhere.\n// -------------------------------------------------------------------------------------------\nconst HER_TIMEZONE = process.env.WATCH_TIMEZONE || \"America/New_York\"; // Ellabell, Georgia\nconst inHerTime = (d, opts) => new Intl.DateTimeFormat(\"en-US\", { timeZone: HER_TIMEZONE, ...opts }).format(d);\n// Day, month, year, spelled out. \"12-Aug\" is ambiguous about the year and \"08/12\" is ambiguous\n// about the month, and this file is meant to still make sense when it is opened next spring.\nconst herDate = (d) => new Intl.DateTimeFormat(\"en-GB\", { timeZone: HER_TIMEZONE, day: \"numeric\", month: \"long\", year: \"numeric\" }).format(d);\nconst herClock = (d) => inHerTime(d, { hour: \"numeric\", minute: \"2-digit\", hour12: true }).replace(/ /g, \" \").toLowerCase();\nconst countWord = (n) => ([\"no\", \"one\", \"two\", \"three\", \"four\", \"five\", \"six\", \"seven\", \"eight\", \"nine\", \"ten\"][n] ?? String(n));\n\nconst ordered = [...report.findings].sort((a, b) => {\n const rank = { urgent: 0, attention: 1, note: 2 };\n return (rank[a.severity] ?? 3) - (rank[b.severity] ?? 3);\n});\nconst loud = ordered.filter((f) => f.severity !== \"note\");\nconst notes = ordered.filter((f) => f.severity === \"note\");\nconst inspectedTotal = report.checks.reduce((a, c) => a + (c.inspected ?? 0), 0);\n\nconst clientPage = [\n `# Early warning check, ${herDate(now)}`,\n ``,\n loud.length\n ? `**${countWord(loud.length).replace(/^./, (c) => c.toUpperCase())} ${loud.length === 1 ? \"thing needs\" : \"things need\"} your attention.** They are first, below.`\n : `**Nothing in your records looks wrong.** ${countWord(report.checks.length).replace(/^./, (c) => c.toUpperCase())} checks ran and read ${inspectedTotal.toLocaleString(\"en-US\")} records between them.`,\n ``,\n `Everything below was read at ${herClock(now)} on ${herDate(now)}, your time.`,\n ``,\n ...(loud.length ? [\n `## What needs your attention`,\n ``,\n ...loud.flatMap((f) => [f.sentence, ``, f.checkFirst ? `**Start here:** ${f.checkFirst}` : ``, ``]),\n ] : []),\n ...(notes.length ? [\n `## ${countWord(notes.length).replace(/^./, (c) => c.toUpperCase())} ${notes.length === 1 ? \"thing this cannot see yet\" : \"things this cannot see yet\"}`,\n ``,\n `${notes.length === 1 ? \"This is\" : \"These are\"} not ${notes.length === 1 ? \"a problem\" : \"problems\"} with your business. ${notes.length === 1 ? \"It is\" : \"They are\"} the monitor telling you where it is not able to judge anything yet, which is worth knowing rather than reading as a clean result.`,\n ``,\n ...notes.flatMap((f) => [f.sentence, ``, f.checkFirst ? `**Start here:** ${f.checkFirst}` : ``, ``]),\n ] : []),\n `## What it looked at`,\n ``,\n `| What it watches | What it found |`,\n `|---|---|`,\n ...report.checks.map((c) => `| ${c.title} | ${c.findings.length === 0 ? \"Nothing out of the ordinary\" : `${countWord(c.findings.length)} ${c.findings.length === 1 ? \"thing\" : \"things\"} to tell you, above`} |`),\n ``,\n `## What it is still not good at`,\n ``,\n `Replayed over your own records it would have raised this in the days after 19 February 2026 rather than in August. It is also noisy: the same replay sounds an alarm in weeks when nothing was wrong, and an alarm that cries wolf trains everybody to ignore it. Quietening it down is the next job on it, and I would rather say so than have you find out.`,\n ``,\n `Amir`,\n ``,\n].filter((l) => l !== null).join(\"\\n\").replace(/\\n{3,}/g, \"\\n\\n\");\n{\n const problems = W.copyProblems(clientPage);\n if (/\\b(records|needed|rows|journal|GMT|UTC)\\s*:/i.test(clientPage)) problems.push(\"a key and value debug pair is still in the page\");\n if (/\\bGMT\\b|\\bUTC\\b/.test(clientPage)) problems.push(\"a time is stamped in GMT for a business in Georgia\");\n if (problems.length) {\n shout(\"CLIENT SAFE COPY CHECK FAILED ON THE PAGE FOR THE OWNER. Nothing written.\");\n for (const p of problems) console.error(` - ${p}`);\n process.exit(1);\n }\n console.log(`The owner's page passed: her own clock (${HER_TIMEZONE}), no key and value pairs, no dashes as punctuation.`);\n}\n\nconst OUT_DIR = process.env.WATCH_OUT_DIR || \"/mnt/user-data/outputs\";\nmkdirSync(OUT_DIR, { recursive: true });\n// The client file is named for what it is and dated in full. \"12-Aug\" is ambiguous about the year\n// on a file somebody opens next spring.\nconst clientName = process.env.WATCH_CLIENT_FILENAME || `Early-warning-check-${herDate(now).replace(/ /g, \"-\")}.md`;\nconst mdPath = join(OUT_DIR, clientName);\nwriteFileSync(mdPath, clientPage);\n// The engine's own view and the full workings stay in the repo, not in the client's folder. A\n// page of key and value pairs and a JSON file are the wrong shape for the person this is for.\nconst WORKINGS_DIR = process.env.WATCH_WORKINGS_DIR || join(ROOT, \"reports\");\nmkdirSync(WORKINGS_DIR, { recursive: true });\nconst enginePath = join(WORKINGS_DIR, `early-warning-${dateSuffix}-workings.md`);\nconst jsonPath = join(WORKINGS_DIR, `early-warning-${dateSuffix}.json`);\nwriteFileSync(enginePath, md);\nwriteFileSync(jsonPath, JSON.stringify(report, null, 2) + \"\\n\");\n\n// The notes file is written LAST and only once everything else succeeded. If the run dies halfway\n// this reading is not recorded, so the next run still compares against the last complete one\n// rather than against a half filled snapshot.\nmkdirSync(dirname(STATE_FILE), { recursive: true });\nwriteFileSync(STATE_FILE, JSON.stringify({ snapshots }, null, 2) + \"\\n\");\n\nconsole.log(\"\");\nconsole.log(`Wrote ${mdPath} (the page for the owner)`);\nconsole.log(`Wrote ${enginePath} (the engine's own view, kept out of her folder)`);\nconsole.log(`Wrote ${jsonPath} (the full workings, kept out of her folder)`);\nconsole.log(`Wrote ${STATE_FILE} (${snapshots.length} readings kept)`);\nconsole.log(\"\");\nconsole.log(\"=========================== THE REPORT ===========================\");\nconsole.log(md);\nconsole.log(\"========================= WHAT EACH CHECK READ =========================\");\nfor (const c of report.checks) {\n console.log(`${c.check.padEnd(14)} inspected ${String(c.inspected).padStart(6)} ${c.inspectedLabel}, raised ${c.findings.length}`);\n}\nconsole.log(\"\");\nconsole.log(`SUMMARY: ${report.findings.filter((f) => f.severity === \"urgent\").length} urgent, ` +\n `${report.findings.filter((f) => f.severity === \"attention\").length} attention, ` +\n `${report.findings.filter((f) => f.severity === \"note\").length} notes, ` +\n `across ${report.checks.length} checks and ${report.inspected} records inspected.`);\n\n\n=====FILE watchdog/main.ts =====\n// dogsspot_watchdog — v1.7 (14 Aug 2026: reads Kim's own status page and checks its mode wording against the engine) / v1.6 (5 Aug 2026: knowledge-base tamper watch, shared Square figures, scheduled-vs-manual run stamps) / v1.5 (4 Aug 2026: GHL direct health + workflow tamper detection + puppy send-failure scan + panel surfacing via wd_public)\n//\n// WHY THIS EXISTS\n// Three automations run unattended against a live client account: the Pups Club announcer,\n// the reschedule notifier, and the Square/GoHighLevel revenue bridge. Every one of them fails\n// SILENTLY. A dead scheduler, a rotated token, a disabled webhook subscription and a genuinely\n// quiet trading day all look identical from the outside: nothing happens, and nobody finds out\n// until a customer complains or a month of revenue is missing from a report.\n//\n// This val is the supervisor. It reads the state the other three leave behind, applies the\n// checks a human would apply, and emails only when something is actually wrong — plus one\n// all-clear a week so that silence from the watchdog is never itself ambiguous.\n//\n// It is strictly READ-ONLY against the client's GoHighLevel account. It writes nothing but its\n// own digest blob. That is deliberate: a supervisor that can change things is a second thing\n// that can break things.\n\nimport { blob } from \"https://esm.town/v/std/blob\";\nimport { email } from \"https://esm.town/v/std/email\";\n\nconst BRIDGE_URL = \"https://amir5--41ace24c7e2111f18c9d1607ee4eb77e.web.val.run\";\n// Kim's own status page. Read, never written to, and read with the VIEW key rather than the admin\n// one so that a leak of this val's traffic could not stop her follow-up.\nconst DASHBOARD_URL = \"https://amir5--fb119304902811f182781607ee4eb77e.web.val.run\";\n\nconst DIGEST_KEY = \"wd_digest\";\nconst ALERT_KEY = \"wd_last_alert\";\nconst CHECK_KEY = \"wd_last_check\";\nconst MODE_WORDING_KEY = \"wd_mode_wording\";\n// Rendering Kim's dashboard costs a dozen or so CRM reads, so this one check is throttled rather\n// than run on every pass. What it catches is introduced by a DEPLOY, not by the passage of time,\n// so four looks a day is the right shape; the trade is written down here rather than left as a\n// number somebody has to guess at.\nconst MODE_WORDING_EVERY_MIN = 6 * 60;\n\n// v1.2 — EMAIL DISCIPLINE, learned the hard way.\n// v1.1 emailed about a createOpp error that was already fixed, simply because the error sat\n// inside a rolling 24-hour window. A monitor that reports history rather than change is a\n// monitor that gets filtered into a folder within a week. Two rules now:\n// 1. Only conditions NEWER than the previous check can raise an alarm.\n// 2. Only CRITICAL reaches the inbox. WARNING and INFO live in the digest, which is always\n// complete and always available — they are for reading on purpose, not for interrupting.\nconst NEW_ERROR_EMAIL_THRESHOLD = 3;\n\n// The two cron vals run every 15 minutes. 90 minutes of silence is ~6 missed cycles: comfortably\n// past a transient platform blip, comfortably short of a day's lost sends.\nconst CRON_STALE_MIN = 90;\n// Square is bursty. A real trading day produces traffic, but a genuinely quiet weekend does not,\n// so 72h avoids crying wolf over a slow Sunday while still catching a disabled subscription.\nconst INBOUND_STALE_H = 72;\nconst ERROR_LOOKBACK_H = 24;\n// Re-send an unchanged alert at most once a day. An alert that repeats hourly is an alert that\n// gets filtered into a folder and never read again.\nconst REALERT_H = 24;\n\ntype Sev = \"CRITICAL\" | \"WARNING\" | \"INFO\";\ninterface Finding {\n sev: Sev;\n system: string;\n what: string;\n why: string;\n}\n\nconst nowMs = Date.now();\nconst ageMin = (iso?: string) => (iso ? (nowMs - Date.parse(iso)) / 60000 : Infinity);\nconst fmtAge = (min: number) =>\n !isFinite(min)\n ? \"never\"\n : min < 60\n ? `${Math.round(min)} min ago`\n : min < 2880\n ? `${(min / 60).toFixed(1)} h ago`\n : `${(min / 1440).toFixed(1)} days ago`;\n\nasync function getBlob(key: string): Promise {\n try {\n return await blob.getJSON(key);\n } catch {\n return null;\n }\n}\n\nasync function sha256Hex(s: string): Promise {\n const b = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(s));\n return [...new Uint8Array(b)].map((x) => x.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\n/** The dashboard's work-log card is dated history and legitimately says \"practice mode was on\" of\n * July and early August. It is fenced with two HTML comments (see the note beside LOG_SHOWN in\n * engine/dashboard.ts) and the mode-wording check skips what is between them.\n * If either fence is missing the whole page is scanned instead. A check that silently stops\n * checking is the failure it exists to prevent, so it fails noisy, not quiet. */\nfunction withoutDatedHistory(html: string): { text: string; fenced: boolean } {\n const A = \"\", B = \"\";\n const i = html.indexOf(A), j = html.indexOf(B);\n if (i < 0 || j < 0 || j < i) return { text: html, fenced: false };\n return { text: html.slice(0, i) + html.slice(j + B.length), fenced: true };\n}\n\n/** A cron that stopped firing writes no new state, so staleness is the only honest signal. */\nfunction checkCron(\n name: string,\n state: { ok?: boolean; ts?: string; failed?: number; log?: string[] } | null,\n findings: Finding[],\n) {\n if (!state) {\n findings.push({\n sev: \"CRITICAL\",\n system: name,\n what: \"no state blob at all\",\n why: \"The val has never completed a run, or its state was wiped. It is not doing its job.\",\n });\n return;\n }\n const age = ageMin(state.ts);\n if (!state.ts) {\n findings.push({\n sev: \"INFO\",\n system: name,\n what: \"state has no timestamp yet\",\n why: \"Running a version from before run-timestamps were added. Staleness cannot be checked until it next runs.\",\n });\n } else if (age > CRON_STALE_MIN) {\n findings.push({\n sev: \"CRITICAL\",\n system: name,\n what: `last completed run ${fmtAge(age)}`,\n why: \"Expected every 15 minutes. The scheduler has stopped, or every run is now throwing before it can write state. Sends are being missed right now.\",\n });\n }\n if (state.ok === false) {\n findings.push({\n sev: \"CRITICAL\",\n system: name,\n what: \"last run reported ok:false\",\n why: \"The run completed but knew it had failed. Check the log field in its state blob.\",\n });\n }\n if ((state.failed ?? 0) > 0) {\n findings.push({\n sev: \"WARNING\",\n system: name,\n what: `${state.failed} message(s) failed to send on the last run`,\n why: \"A real customer did not receive a message they should have received. Worth checking who.\",\n });\n }\n}\n\n/** Recent entries in the *_last_error blobs, which the vals write on an unhandled throw. */\nasync function checkErrorBlob(name: string, key: string, findings: Finding[]) {\n const e = await getBlob<{ at?: string; error?: string }>(key);\n if (!e?.at) return;\n const age = ageMin(e.at);\n if (age < ERROR_LOOKBACK_H * 60) {\n findings.push({\n sev: \"WARNING\",\n system: name,\n what: `threw an error ${fmtAge(age)}: ${String(e.error).slice(0, 160)}`,\n why: \"That run did no work. With retries in place this should now be rare — if it repeats, it is not a transient blip.\",\n });\n }\n}\n\n// `trigger` says WHO started this pass. It defaults to \"interval\" because that is how val.town\n// calls the default export: with no arguments. run.ts passes \"manual\" explicitly.\n// [was: no argument at all, so a hand-triggered run and a scheduled one left identical\n// footprints. The dashboard then measured the gaps between those footprints and told Kim\n// \"left to itself it runs about every 95 minutes\" — a sentence about a rhythm, computed from\n// stamps that were mostly me pressing the button. On 4-5 Aug the engine fired on the hour, ten\n// gaps of exactly 60 minutes, while the watchdog fired ZERO times in the same 5h18m window.\n// Its interval is not running, and nothing could say so because nothing knew the difference.]\nexport default async function watchdog(trigger?: unknown) {\n // WHO STARTED THIS PASS, decided by ELIMINATION rather than by trusting the argument.\n // [was: `trigger: \"interval\" | \"manual\" = \"interval\"`, on the assumption that val.town calls\n // the default export with no arguments so the default would apply. It does not: the scheduler\n // passes it something of its own. So `trigger === \"interval\"` was false on every scheduled\n // run, autoHistory stayed empty forever, and the dashboard reported \"nothing on a schedule has\n // been recorded\" while main.ts was firing perfectly and writing to the plain history two lines\n // later. I read that empty list and nearly concluded a second time that the timer was dead.\n // Only run.ts passes the literal string \"manual\"; anything else, including whatever the\n // platform hands us, is a scheduled run.]\n const isManual = trigger === \"manual\";\n const findings: Finding[] = [];\n // v1.5.1 (review fix #12), ONE checkpoint read and ONE scan-start stamp shared by every\n // journal scan, so rows written while this very run executes land in the NEXT window\n // instead of vanishing between two different reads of the checkpoint.\n const scanStartIso = new Date().toISOString();\n const prevCheck = await getBlob<{ ts?: string }>(CHECK_KEY);\n const sinceMsShared = prevCheck?.ts ? Date.parse(prevCheck.ts) : nowMs - ERROR_LOOKBACK_H * 3600_000;\n\n // ---- the two cron vals -------------------------------------------------\n checkCron(\"Pups Club announcer\", await getBlob(\"pups2_state\"), findings);\n checkCron(\"Reschedule notifier\", await getBlob(\"apptn_state\"), findings);\n await checkErrorBlob(\"Pups Club announcer\", \"pups2_last_error\", findings);\n await checkErrorBlob(\"Reschedule notifier\", \"apptn_last_error\", findings);\n\n // ---- Puppy Path engine (added 30 Jul — v1.4; cadence corrected v1.5, and again v1.7) ----\n // [was: \"The engine runs every 15 minutes (not hourly as first noted), so 90 min staleness =\n // six missed ticks.\" Both halves are wrong and the correction went the wrong way. Measured\n // 14 Aug 2026 over the 39 most recent gaps in `puppy_run_state.history`: 36 of them fell\n // between 60.0 and 61.0 minutes and the longest was 64.2. It runs about once an hour.\n // CRON_STALE_MIN is 90, which is shared with the two genuine 15-minute crons above, so this\n // check fires after ONE missed hourly pass plus 26 minutes of headroom rather than after\n // six missed ticks. That has not misfired yet and the observed jitter does not reach it, but\n // it is a much thinner margin than the old comment implied and it is written down here so\n // the next person sizing it is sizing it against a measurement.]\n // Its run report carries `ts` from engine v1.2+.\n checkCron(\"Puppy Path\", await getBlob(\"puppy_run_state\"), findings);\n await checkErrorBlob(\"Puppy Path\", \"puppy_last_error\", findings);\n const psum = await getBlob<{ surgeHolds?: number }>(\"puppy_summary\");\n if ((psum?.surgeHolds ?? 0) > 0) {\n findings.push({\n sev: \"WARNING\",\n system: \"Puppy Path\",\n what: `enrollment surge hold recorded (${psum!.surgeHolds} total)`,\n why: \"More tagged contacts appeared in one run than the safety threshold allows — bulk tagging suspected. Enrollment is frozen until the extra tags are removed or ACKNOWLEDGE_SURGE=true is set. Check puppy_journal.\",\n });\n }\n\n // ---- cancelled appointments that have not happened yet -----------------\n // Written by the reschedule notifier each run. Every entry is a customer who cancelled and is\n // still queued to be reminded about it, because GoHighLevel does not remove a contact from a\n // reminder workflow when the appointment is cancelled — a contact already on a wait step stays\n // there and the send fires anyway. Until an explicit workflow exit exists, this is the only\n // thing standing between that and a customer having to ask twice.\n const cf = await getBlob<{ ts?: string; n?: number; items?: any[] }>(\"apptn_cancelled_future\");\n if (cf && (cf.n ?? 0) > 0) {\n const soonest = (cf.items ?? [])\n .map((i) => i?.startTime)\n .filter(Boolean)\n .sort()[0];\n findings.push({\n sev: \"WARNING\",\n system: \"Appointments\",\n what: `${cf.n} cancelled appointment(s) still in the future${soonest ? `, soonest ${String(soonest).slice(0, 16).replace(\"T\", \" \")}` : \"\"}`,\n why: \"Each one is a customer who may still be reminded about an appointment they cancelled. Check apptn_cancelled_future for the contact ids.\",\n });\n }\n\n // ---- the bridge is reachable ------------------------------------------\n let bridgeVersion = \"unreachable\";\n try {\n const r = await fetch(BRIDGE_URL, { signal: AbortSignal.timeout(15000) });\n const t = await r.text();\n if (!r.ok) {\n findings.push({\n sev: \"CRITICAL\",\n system: \"Square bridge\",\n what: `health check returned HTTP ${r.status}`,\n why: \"Square is posting payments at an endpoint that is not answering. Revenue attribution is dead while this is true.\",\n });\n } else {\n bridgeVersion = (t.match(/v[\\d.]+/) ?? [\"?\"])[0];\n }\n } catch {\n findings.push({\n sev: \"CRITICAL\",\n system: \"Square bridge\",\n what: \"health check did not respond\",\n why: \"The endpoint Square delivers payments to is down. Every payment arriving now is being lost.\",\n });\n }\n\n // ---- is Square still delivering at all? --------------------------------\n // This is the check that did not exist before, and the one most likely to catch a silent\n // multi-week outage: a webhook subscription that has been disabled looks exactly like a\n // quiet week unless something is counting inbound requests.\n const inbound = await getBlob<{ ts?: string; n?: number }>(\"m2_last_inbound\");\n const inAge = ageMin(inbound?.ts);\n if (!inbound?.ts) {\n findings.push({\n sev: \"INFO\",\n system: \"Square bridge\",\n what: \"no inbound request recorded yet\",\n why: \"Heartbeat tracking was only just added. This clears itself the first time Square posts anything.\",\n });\n } else if (inAge > INBOUND_STALE_H * 60) {\n findings.push({\n sev: \"CRITICAL\",\n system: \"Square bridge\",\n what: `no inbound webhook for ${fmtAge(inAge)}`,\n why: \"Either the business has taken no payments at all, or the Square webhook subscription has been disabled or its URL changed. Check Square's Developer dashboard before assuming it is quiet.\",\n });\n }\n\n // ---- bridge errors, but only ones that are actually NEW -----------------\n // Anything already seen on a previous run is history, not news. This is the specific fix\n // for v1.1 alarming on a createOpp failure that the v3.7 bridge deploy had already resolved.\n const journal = (await getBlob(\"m2_bridge_journal\")) ?? [];\n const fresh = journal.filter((r) => Date.parse(r?.ts ?? 0) > sinceMsShared);\n const newErrs = fresh.filter((r) => r?.kind === \"ERROR\");\n const newNoMatch = fresh.filter((r) => r?.kind === \"NO-MATCH\" || r?.kind === \"REFUND-NO-MATCH\");\n\n if (newErrs.length) {\n findings.push({\n sev: \"WARNING\",\n system: \"Square bridge\",\n what: `${newErrs.length} NEW error(s) since the last check — latest: ${String(newErrs.at(-1)?.error).slice(0, 140)}`,\n why: \"Each one is a payment that did not get attached to a customer record. New errors after a period of quiet usually mean a fix has regressed or an upstream API has changed.\",\n });\n }\n if (newNoMatch.length) {\n findings.push({\n sev: \"INFO\",\n system: \"Square bridge\",\n what: `${newNoMatch.length} new payment(s) arrived with no contact details`,\n why: \"Expected while the Square access token is outstanding. Counted here so the backlog is visible, not because anything is broken.\",\n });\n }\n\n // ---- the POS gap, computed ONCE, in the same place everything else computes it ----------\n // Reported as INFO and never emailed: it is a known, accepted, historic condition.\n //\n // [was: this block did its own dedup and its own arithmetic, and both were wrong.\n // (1) It only counted rows carrying NEITHER an email NOR a phone, which dropped 14 of the 87\n // NO-MATCH rows — payments that are still unattributed — and reported 35 payments worth\n // $23,463.99 against a true 40 worth $28,035.99. Understated by $4,572.\n // (2) It deduped by the note TEXT rather than by payment id.\n // (3) `resolvable` counted journal ROWS and was then subtracted from a PAYMENT count, so the\n // \"21 arrived with no identifying detail\" was 35 payments minus 14 rows: two different\n // units, one subtraction, a number that meant nothing.\n // The dashboard already computed this correctly from engine/facts.ts. Two computations of one\n // fact is how the wrong number reached a client message in the first place, so this one is\n // deleted rather than repaired: the watchdog now reads the same function the page reads.\n // Verified 5 Aug against an independent third derivation of the raw journal in Python:\n // 40 payments, $28,035.99, 10 with a trail worth $4,418.99, 30 without worth $23,617.00.]\n //\n // Imported dynamically and unpinned, on purpose. Unpinned so it always matches what the\n // dashboard is showing Kim; dynamic so that if esm.town is having a moment, the watchdog says\n // it could not read the figure instead of dying or, worse, reporting a stale one.\n const backlog = await (async () => {\n try {\n const m = await import(\"https://esm.town/v/amir5/dogsspot_puppy_path/facts.ts\");\n return { ok: true as const, b: m.squareBacklog(journal), say: m.squareSentence as (x: unknown) => string };\n } catch (e) {\n return { ok: false as const, err: String((e as Error)?.message ?? e).slice(0, 200) };\n }\n })();\n\n if (!backlog.ok) {\n findings.push({\n sev: \"WARNING\",\n system: \"Square bridge\",\n what: \"The counter-sale backlog could not be computed this pass\",\n why: `The shared figures module would not load (${backlog.err}). No number is reported rather than a stale or invented one. One pass failing is a blip; several in a row is worth a look.`,\n });\n } else if (backlog.b && backlog.b.payments > 0) {\n findings.push({\n sev: \"INFO\",\n system: \"Square bridge\",\n // No number in `what`. Every figure lives in one generated sentence below, so there is no\n // second place for one of them to drift.\n what: \"Counter sales are recorded but not linked to a name\",\n why: backlog.say(backlog.b) + \" Historic backlog, not a live defect, and the same figures the dashboard shows.\",\n });\n }\n\n // ---- is the GoHighLevel token still alive? -----------------------------\n // Deliberately inferred rather than tested directly. val.town scopes environment variables\n // per val, so giving this watchdog its own copy of the GoHighLevel token would mean a second\n // place the client's credentials live, for no gain. The two cron vals already authenticate\n // against that account every 15 minutes and record what they got back — so their telemetry\n // IS the token check. A dead token cannot produce a healthy calendar count.\n const pupsS = await getBlob(\"pups2_state\");\n const apptnS = await getBlob(\"apptn_state\");\n const calCount = apptnS?.calendars ?? 0;\n const evCount = (apptnS?.events ?? 0) + (pupsS?.events ?? 0);\n const bothFresh = ageMin(pupsS?.ts) < CRON_STALE_MIN && ageMin(apptnS?.ts) < CRON_STALE_MIN;\n if (bothFresh && calCount === 0 && evCount === 0) {\n findings.push({\n sev: \"CRITICAL\",\n system: \"GoHighLevel access\",\n what: \"both crons ran but read zero calendars and zero appointments\",\n why: \"That combination means authentication, not a quiet week — a quiet week still returns the calendar list. The shared token has almost certainly been revoked or expired. Every automation is down until it is replaced.\",\n });\n }\n // Surface any authentication failure the crons logged against individual calendars. A 401 on\n // one calendar while others succeed is a permissions scope problem, not a dead token, and the\n // two need very different responses.\n for (const [nm, st] of [[\"Pups Club announcer\", pupsS], [\"Reschedule notifier\", apptnS]] as const) {\n const authLog = (st?.log ?? []).filter((l: string) => /\\b40[13]\\b/.test(l));\n if (authLog.length) {\n findings.push({\n sev: \"WARNING\",\n system: nm,\n what: `authentication refused on ${authLog.length} calendar(s): ${String(authLog[0]).slice(0, 120)}`,\n why: \"Other calendars in the same run worked, so this is that calendar's permissions rather than the token itself. Appointments on it are invisible to the automation until it is fixed.\",\n });\n }\n }\n\n // ---- v1.5: puppy engine send failures, NEW ones only --------------------\n // The engine journals send_failed per contact. History is not news (same discipline as the\n // bridge errors above): only rows newer than the previous watchdog pass can raise anything.\n {\n const pj = (await getBlob(\"puppy_journal\")) ?? [];\n const newFails = pj.filter((r) => Date.parse(r?.ts ?? 0) > sinceMsShared && /fail|error/i.test(String(r?.event ?? \"\")));\n if (newFails.length >= 1) {\n findings.push({\n sev: newFails.length >= 3 ? \"CRITICAL\" : \"WARNING\",\n system: \"Puppy Path\",\n what: `${newFails.length} NEW failed action(s) in the engine journal — latest: ${String(newFails.at(-1)?.detail ?? \"\").slice(0, 120)}`,\n why: \"Each row is a message or check that did not complete. The engine retries by design, but new failures after quiet usually mean a credential, a rate limit, or an API change.\",\n });\n }\n }\n\n // ---- v1.7: DOES KIM'S PAGE AGREE WITH THE ENGINE ABOUT WHETHER IT IS SENDING? ---------------\n // THE FAILURE THIS EXISTS FOR, and it is not hypothetical. The engine went live on the evening\n // of 11 August. Kim's status page went on telling her, for three days, that the messages \"stay\n // in practice mode and nobody is messaged by them\", while two real people were partway through\n // them. Nothing in this file noticed, because nothing in this file had ever read a customer-\n // facing page. Every other check here reads state; this one reads what the client is told.\n //\n // It is deliberately a check on WORDS, not on a flag. The mode flag was correct the whole time.\n // What was wrong was the English wrapped around it, and English is what she acts on. A page that\n // is wrong about whether it is messaging her customers is the same failure that lost her last\n // supplier, wearing the opposite sign.\n //\n // CRITICAL, so it emails: there is no version of \"the live system tells the client it is not\n // live\" that should sit in a digest waiting to be read on purpose.\n let modeWording = \"not reached\";\n try {\n const runState = await getBlob<{ testMode?: unknown }>(\"puppy_run_state\");\n if (runState?.testMode !== false) {\n // Nothing to contradict. Practice-mode wording is correct in practice mode, and an engine\n // that has not reported a mode gets no opinion from us either way.\n modeWording = runState?.testMode === true\n ? \"not applicable, the engine reports practice mode\"\n : \"not applicable, the engine has not reported a mode\";\n } else {\n const gate = await getBlob<{ ts?: string }>(MODE_WORDING_KEY);\n const sinceLast = ageMin(gate?.ts);\n if (sinceLast < MODE_WORDING_EVERY_MIN) {\n modeWording = `skipped this pass, last read ${fmtAge(sinceLast)}`;\n } else {\n // The view key, derived exactly as engine/api.ts and engine/dashboard.ts derive it, from\n // the CRM token this watchdog already resolves. No second secret, and no admin key here.\n let tok = Deno.env.get(\"GHL_TOKEN\");\n if (!tok) tok = (await getBlob<{ ghlToken?: string }>(\"puppy_config\"))?.ghlToken ?? undefined;\n if (!tok) {\n modeWording = \"skipped, no token to build the view link from\";\n findings.push({\n sev: \"INFO\", system: \"Kim's status page\",\n what: \"the mode-wording check could not build a view link\",\n why: \"No CRM token was available to this val, so the page was not read. The engine's own mode flag is still checked everywhere else.\",\n });\n } else {\n const viewKey = \"tds_view_\" + (await sha256Hex(tok + \":view\")).slice(0, 32);\n const r = await fetch(`${DASHBOARD_URL}?k=${encodeURIComponent(viewKey)}`, { signal: AbortSignal.timeout(25000) });\n if (!r.ok) {\n modeWording = `http ${r.status}`;\n findings.push({\n sev: r.status === 401 ? \"WARNING\" : \"CRITICAL\",\n system: \"Kim's status page\",\n what: `the page returned HTTP ${r.status} to the view link`,\n why: r.status === 401\n ? \"The view key is derived from the CRM token. A 401 usually means that token was rotated and the view links Kim and her staff hold have changed with it. Nothing is sending wrongly; her page may simply not open for her.\"\n : \"This is the page Kim opens to see whether her follow-up is working. It is not answering. She cancelled her last supplier over exactly this kind of silence.\",\n });\n } else {\n const body = await r.text();\n const { text, fenced } = withoutDatedHistory(body);\n const hits = text.match(/practice mode/gi) ?? [];\n modeWording = `read ${body.length} chars, dated history ${fenced ? \"fenced off\" : \"NOT FENCED, whole page scanned\"}, ${hits.length} present-tense mention(s) of practice mode`;\n if (hits.length > 0) {\n findings.push({\n sev: \"CRITICAL\",\n system: \"Kim's status page\",\n what: `the engine reports LIVE and her page says \"practice mode\" ${hits.length} time(s)${fenced ? \"\" : \" (the dated-history fence is missing from the page, so this count includes the work log and may be innocent)\"}`,\n why: \"The system is sending to real customers and the page she reads says it is not. This is the 11 August failure repeating: for three days her page told her nobody was being messaged while two people were partway through the sequence. Fix the wording on the page, not the flag on the engine.\",\n });\n }\n }\n await blob.setJSON(MODE_WORDING_KEY, { ts: new Date().toISOString(), result: modeWording }).catch(() => {});\n }\n }\n }\n } catch (e) {\n // Same discipline as the knowledge-base watch below: a check that quietly did not run is worse\n // than one that ran and found nothing, because only one of them is distinguishable from health.\n modeWording = `failed: ${String((e as Error)?.message ?? e).slice(0, 120)}`;\n findings.push({\n sev: \"WARNING\", system: \"Kim's status page\",\n what: \"the mode-wording check did not run this pass\",\n why: `${modeWording}. Nothing is broken in Kim's account because of this; it means nobody is checking that her page agrees with the engine until it runs again.`,\n });\n }\n\n // Set by the knowledge-base watch below and reported in the digest, so \"it ran and saw eight\"\n // is visible rather than inferred from the absence of an alarm.\n let kbWatch = \"not reached\";\n // ---- v1.5: GoHighLevel reachable + workflow registry tamper check -------\n // Direct read, token from the SAME blob the engine already uses (puppy_config) or env — no\n // new place for credentials to live. Answers two questions nothing else answered: is the CRM\n // API itself up, and did anyone add/remove/publish/unpublish a workflow since the last look.\n // The second matters because a second contractor works in this account: a silently published\n // nurture is exactly how double-sends start.\n try {\n let tok = Deno.env.get(\"GHL_TOKEN\");\n if (!tok) tok = (await getBlob<{ ghlToken?: string }>(\"puppy_config\"))?.ghlToken ?? undefined;\n if (!tok) {\n findings.push({ sev: \"INFO\", system: \"GoHighLevel access\", what: \"no token available to the watchdog\", why: \"Direct reachability and workflow tamper checks skipped. The inferred token check above still runs.\" });\n } else {\n const wr = await fetch(\"https://services.leadconnectorhq.com/workflows/?locationId=BQHJ19uohldYe3eqA0bl\", {\n headers: { Authorization: `Bearer ${tok}`, Version: \"2021-04-15\", \"User-Agent\": \"curl/8.5.0\" },\n signal: AbortSignal.timeout(20000),\n });\n if (!wr.ok) {\n findings.push({\n sev: \"CRITICAL\", system: \"GoHighLevel access\",\n what: `workflow list read returned HTTP ${wr.status}`,\n why: \"The CRM API refused a read that worked before. Token revoked, scope changed, or platform outage — every automation reads this account, so treat as down until confirmed otherwise.\",\n });\n } else {\n const wfs = (await wr.json())?.workflows ?? [];\n const reg = wfs.map((w: any) => [w.id, w.name, w.status, String(w.updatedAt ?? w.dateUpdated ?? \"\")]).sort();\n const enc = new TextEncoder().encode(JSON.stringify(reg));\n const hashBuf = await crypto.subtle.digest(\"SHA-256\", enc);\n const hash = [...new Uint8Array(hashBuf)].map((b) => b.toString(16).padStart(2, \"0\")).join(\"\").slice(0, 16);\n const published = wfs.filter((w: any) => w.status === \"published\").length;\n const prev = await getBlob<{ hash?: string; count?: number; published?: number; names?: Record }>(\"wd_wf_registry\");\n const names: Record = {};\n // v1.5.1 (fix #14), updatedAt travels in the name string so an EDITED-in-place workflow\n // (same name, same status, new content) shows up as a named change, not a blank alarm.\n for (const w of wfs) names[w.id] = `${w.name} [${w.status}] @${String(w.updatedAt ?? w.dateUpdated ?? \"\").slice(0, 16)}`;\n if (wfs.length === 0 && (prev?.count ?? 0) > 0) {\n // v1.5.1 (fix #13), a malformed-but-200 response must not wipe the baseline and fire\n // a bogus \"everything removed\" alarm followed by \"everything added\" on recovery.\n findings.push({ sev: \"WARNING\", system: \"GoHighLevel workflows\", what: \"workflow list came back EMPTY on a 200 response\", why: \"Almost certainly a transient API glitch. The tamper baseline was NOT overwritten; if this repeats across passes, treat it as an outage.\" });\n } else if (prev?.hash && prev.hash !== hash) {\n const prevIds = new Set(Object.keys(prev.names ?? {}));\n const nowIds = new Set(Object.keys(names));\n const added = [...nowIds].filter((i) => !prevIds.has(i)).map((i) => names[i]);\n const removed = [...prevIds].filter((i) => !nowIds.has(i)).map((i) => (prev.names ?? {})[i]);\n const changed = [...nowIds].filter((i) => prevIds.has(i) && (prev.names ?? {})[i] !== names[i]).map((i) => `${(prev.names ?? {})[i]} -> ${names[i]}`);\n findings.push({\n sev: \"CRITICAL\", system: \"GoHighLevel workflows\",\n what: `the workflow registry CHANGED (${prev.count} -> ${wfs.length} workflows, ${prev.published} -> ${published} published). Added: ${added.slice(0, 3).join(\"; \") || \"none\"}. Removed: ${removed.slice(0, 3).join(\"; \") || \"none\"}. Changed: ${changed.slice(0, 3).join(\"; \") || \"none\"}`,\n why: \"Nobody on this project changed workflows. If this was not Kim or Kristian acting deliberately, something is editing the account. A newly PUBLISHED nurture can double-message customers the engine also handles. This alert emails immediately and the change is kept in wd_wf_changes.\",\n });\n // v1.5.1 (fix #10), append-only evidence trail, capped at the newest 20 changes, so\n // the single-blob digest overwrite can never destroy what changed and when.\n const hist = (await getBlob(\"wd_wf_changes\")) ?? [];\n hist.push({ ts: new Date().toISOString(), from: prev.hash, to: hash, added, removed, changed });\n await blob.setJSON(\"wd_wf_changes\", hist.slice(-20)).catch(() => {});\n await blob.setJSON(\"wd_wf_registry\", { ts: new Date().toISOString(), hash, count: wfs.length, published, names });\n } else if (wfs.length > 0 || (prev?.count ?? 0) === 0) {\n await blob.setJSON(\"wd_wf_registry\", { ts: new Date().toISOString(), hash, count: wfs.length, published, names });\n }\n }\n\n // ---- v1.6: the KNOWLEDGE BASES, watched the same way as the workflows ----------------\n // `kbWatch` ends up in the digest snapshot so a human can see, at a glance, that this ran\n // and what it saw. A check whose only evidence is the absence of an alarm is not evidence.\n // WHY. The consolidated knowledge base is what Chloe answers customers from. It carries the\n // rules that cost the client relationship if they slip: no training prices, opening hours\n // never without the appointment-only line, no grooming, \"Pup Talk\" and never \"discovery\n // call\". It was edited at 02:38 on 5 August, by somebody, and nothing noticed. Workflows\n // have been watched since v1.5; the documents that decide what Kim's business SAYS were not.\n //\n // The API gives names, timestamps and a count of what is inside each base, but not the text\n // of the documents. So this cannot check the wording. It can say \"something changed, here,\n // on this date\", which turns a silent edit into a question somebody asks.\n try {\n const kr = await fetch(\"https://services.leadconnectorhq.com/knowledge-base/?locationId=BQHJ19uohldYe3eqA0bl\", {\n headers: { Authorization: `Bearer ${tok}`, Version: \"2021-07-28\", \"User-Agent\": \"curl/8.5.0\" },\n signal: AbortSignal.timeout(12000),\n });\n if (!kr.ok) kbWatch = `http ${kr.status}`;\n else {\n const kbs = (await kr.json())?.data?.knowledgeBases ?? [];\n kbWatch = `read ${kbs.length} knowledge base(s)`;\n const names: Record = {};\n for (const k of kbs) names[k.id] = `${k.name} @${String(k.updatedAt ?? \"\").slice(0, 16)}`;\n const prev = await getBlob<{ names?: Record; count?: number }>(\"wd_kb_registry\");\n // The comparison itself lives in engine/registry-diff.ts and is unit-tested there, so it\n // is not a check that has only ever been seen not firing. Imported unpinned, same as the\n // Square figures, so there is one implementation rather than two that can drift apart.\n const rd = await import(\"https://esm.town/v/amir5/dogsspot_puppy_path/registry-diff.ts\");\n if (rd.looksLikeAGlitch(kbs.length, prev?.count)) {\n findings.push({ sev: \"WARNING\", system: \"GoHighLevel knowledge bases\", what: \"the knowledge base list came back EMPTY on a 200 response\", why: \"Almost certainly a transient API glitch. The baseline was NOT overwritten, so the next good pass will not fire a bogus 'everything came back' alarm.\" });\n } else if (prev?.names) {\n const c = rd.registryDiff(prev.names, names);\n if (c.changed) {\n findings.push({\n sev: \"WARNING\",\n system: \"GoHighLevel knowledge bases\",\n what: \"a knowledge base changed since the last look\",\n why: rd.registrySentence(c, \"her knowledge bases\") +\n \" This is what Chloe answers customers from, so a change here changes what the business says. Worth asking who made it and re-reading the wording rules against it. Not an alarm on its own: Kim edits her own knowledge base and that is exactly as it should be.\",\n });\n const hist = (await getBlob(\"wd_kb_changes\")) ?? [];\n hist.push({ ts: new Date().toISOString(), added: c.added, removed: c.removed, edited: c.edited });\n await blob.setJSON(\"wd_kb_changes\", hist.slice(-20)).catch(() => {});\n }\n await blob.setJSON(\"wd_kb_registry\", { ts: new Date().toISOString(), count: kbs.length, names });\n } else if (kbs.length) {\n await blob.setJSON(\"wd_kb_registry\", { ts: new Date().toISOString(), count: kbs.length, names });\n }\n }\n } catch (e) {\n // NOT SWALLOWED SILENTLY. The dynamic import can fail, the endpoint can move, and a bare\n // catch here would mean the knowledge-base watch was simply not running while everything\n // downstream reported healthy. That is the same shape as the dry tagging pass, which was\n // deployed, hash-verified, green on every test and dead for three deploys because nothing\n // checked that the code had actually executed.\n kbWatch = `failed: ${String((e as Error)?.message ?? e).slice(0, 120)}`;\n findings.push({\n sev: \"WARNING\", system: \"GoHighLevel knowledge bases\",\n what: \"the knowledge-base watch did not run this pass\",\n why: `${kbWatch}. Nothing is broken in Kim's account because of this; it means nobody is watching her knowledge bases until it runs again. Several passes in a row is worth a look.`,\n });\n }\n }\n } catch (e) {\n findings.push({ sev: \"WARNING\", system: \"GoHighLevel access\", what: `direct reachability check failed: ${String(e).slice(0, 100)}`, why: \"Could not confirm the CRM API is up. If the crons are also stale this is an outage; if they are fresh it is likely a transient timeout.\" });\n }\n\n // ---- assemble ----------------------------------------------------------\n const rank: Record = { CRITICAL: 0, WARNING: 1, INFO: 2 };\n findings.sort((a, b) => rank[a.sev] - rank[b.sev]);\n const worst: Sev | \"OK\" = findings.find((f) => f.sev === \"CRITICAL\")\n ? \"CRITICAL\"\n : findings.find((f) => f.sev === \"WARNING\")\n ? \"WARNING\"\n : findings.length\n ? \"INFO\"\n : \"OK\";\n\n const digest = {\n ts: new Date().toISOString(),\n worst,\n bridgeVersion,\n findings,\n snapshot: {\n pups: pupsS,\n apptn: apptnS,\n lastInbound: inbound,\n journalRows: journal.length,\n knowledgeBases: kbWatch,\n // \"It ran and saw nothing\" and \"it never ran\" must not look alike in here.\n modeWording,\n },\n };\n await blob.setJSON(DIGEST_KEY, digest);\n\n // v1.5 — one tiny public-facing summary the control panel renders in plain English, so Kim\n // can see that an independent second system is checking the first one. No details here beyond\n // a headline; the digest carries the full findings for whoever investigates.\n // v1.5.2 — the watchdog's own footprints. The dashboard used to grade this system purely on the\n // contents of its last report, so a watchdog that had silently stopped an hour ago still showed\n // a green tick on the strength of a stale \"nothing wrong\". It now reports how punctual the\n // watchdog has actually been, measured from these stamps rather than asserted by anyone.\n let wdHistory: string[] = [];\n let autoHistory: string[] = [];\n try {\n const prevPub = await blob.getJSON(\"wd_public\").catch(() => null);\n wdHistory = Array.isArray(prevPub?.history) ? prevPub.history.filter((x: unknown) => typeof x === \"string\") : [];\n if (!wdHistory.length && typeof prevPub?.ts === \"string\") wdHistory = [prevPub.ts];\n autoHistory = Array.isArray(prevPub?.autoHistory) ? prevPub.autoHistory.filter((x: unknown) => typeof x === \"string\") : [];\n } catch { /* never fail a watchdog run over its own bookkeeping */ }\n if (wdHistory[wdHistory.length - 1] !== digest.ts) wdHistory.push(digest.ts);\n // ONLY a scheduled pass counts towards the rhythm. A cadence measured over button presses is a\n // measurement of the person pressing the button.\n if (!isManual && autoHistory[autoHistory.length - 1] !== digest.ts) autoHistory.push(digest.ts);\n\n await blob.setJSON(\"wd_public\", {\n ts: digest.ts,\n history: wdHistory.slice(-40),\n autoHistory: autoHistory.slice(-40),\n // The last time it ran WITHOUT being asked. Null means it has never run on its own, which is\n // a different and much worse thing than \"it is a bit late\".\n lastAutoTs: autoHistory.length ? autoHistory[autoHistory.length - 1] : null,\n lastTrigger: isManual ? \"manual\" : \"scheduled\",\n worst,\n headline:\n worst === \"OK\"\n ? \"The independent watchdog checked everything and found nothing wrong.\"\n : worst === \"INFO\"\n ? \"The watchdog is running; only informational notes on file, nothing wrong.\"\n : worst === \"WARNING\"\n ? `The watchdog flagged ${findings.filter((f) => f.sev === \"WARNING\").length} thing(s) for Amir to look at. Anything urgent turns this line red and says to call him; this is the level below that.`\n : \"The watchdog found a problem and has alerted Amir. If this stays red for more than an hour, call him.\",\n }).catch(() => {});\n\n // ---- decide whether to actually email ----------------------------------\n // CRITICAL always reaches the inbox. A run of genuinely new bridge errors does too, because\n // a fix regressing is worth interrupting someone for. Everything else waits in the digest.\n const criticals = findings.filter((f) => f.sev === \"CRITICAL\");\n const worthWaking = criticals.length > 0 || newErrs.length >= NEW_ERROR_EMAIL_THRESHOLD;\n\n // v1.5.1 (review fix #11), ages and counts stripped before fingerprinting: \"1.6 h ago\"\n // becoming \"1.8 h ago\" is the same condition, and re-emailing it every pass trains the\n // inbox to ignore the address. REALERT_H still re-sends an unchanged alert daily.\n const stableWhat = (s: string) => s.replace(/\\d+(?:\\.\\d+)?\\s*(?:h|min|minute|hour|day)s?\\b/g, \"N\").replace(/\\d{4}-\\d{2}-\\d{2}[T ][\\d:.]+Z?/g, \"T\").slice(0, 60);\n const fingerprint = worthWaking\n ? criticals.map((f) => `${f.system}:${stableWhat(f.what)}`).join(\"|\") +\n (newErrs.length >= NEW_ERROR_EMAIL_THRESHOLD ? `|errors` : \"\")\n : \"\";\n\n const last = await getBlob<{ fp?: string; ts?: string }>(ALERT_KEY);\n const changed = fingerprint !== (last?.fp ?? \"\");\n const stale = ageMin(last?.ts) > REALERT_H * 60;\n const isMonday = new Date().getUTCDay() === 1;\n\n let sent = false;\n if (fingerprint && (changed || stale)) {\n // CRITICAL and WARNING only in the body. INFO is digest-only by design — a known,\n // accepted condition restated in an alert email is how alerts stop being read.\n const body = findings\n .filter((f) => f.sev !== \"INFO\")\n .map((f) => `[${f.sev}] ${f.system}\\n ${f.what}\\n ${f.why}`)\n .join(\"\\n\\n\");\n await email({\n subject: `Dogs Spot systems — action needed`,\n text: `${body}\\n\\n---\\nChecked ${digest.ts}\\nBridge ${bridgeVersion} · journal ${journal.length} rows\\nOnly conditions newer than the previous check can trigger this email. Warnings and notes that did not meet that bar are in the digest, not here.`,\n });\n await blob.setJSON(ALERT_KEY, { fp: fingerprint, ts: digest.ts });\n sent = true;\n } else if (!fingerprint && isMonday && ageMin(last?.ts) > 6 * 24 * 60) {\n const notes = findings.length\n ? `\\n\\nOpen items, none urgent:\\n` +\n findings.map((f) => ` · ${f.system} — ${f.what}`).join(\"\\n\")\n : \"\";\n await email({\n subject: \"Dogs Spot systems — all clear\",\n text: `Nothing wrong across the announcer, the reschedule notifier and the Square bridge.${notes}\\n\\nChecked ${digest.ts}\\nBridge ${bridgeVersion} · journal ${journal.length} rows\\n\\nWeekly confirmation that the watchdog itself is alive.`,\n });\n await blob.setJSON(ALERT_KEY, { fp: \"\", ts: digest.ts });\n sent = true;\n }\n\n // Stamp the checkpoint LAST, so a crash mid-run does not silently swallow new errors.\n // v1.5.1 (fix #12), the checkpoint is the SCAN START: rows journaled while this run was\n // executing stay newer than the stamp and surface on the next pass instead of vanishing.\n await blob.setJSON(CHECK_KEY, { ts: scanStartIso });\n\n return { ...digest, emailed: sent };\n}\n\n\n\n=====FILE watchdog/run.ts =====\n// CHECK NOW — manual trigger for the watchdog, mirroring the engine's run.ts pattern.\n// Same admin key as the control panel, digest-only in source, one code path: this imports the\n// exact watchdog() the scheduler calls. Added v1.5 so a deploy can be verified the minute it\n// ships instead of waiting for the next scheduled pass.\nimport watchdog from \"./main.ts\";\n\nconst KEY_SHA256 = \"48cd12465712045f70247da1689eeb198a4ce2d98416d8e52fb844581f044f15\";\nasync function sha256Hex(s: string): Promise {\n const b = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(s));\n return [...new Uint8Array(b)].map((x) => x.toString(16).padStart(2, \"0\")).join(\"\");\n}\nexport default async function (req: Request): Promise {\n const k = new URL(req.url).searchParams.get(\"k\") || \"\";\n const expected = Deno.env.get(\"NURTURE_ADMIN_KEY_SHA256\") || KEY_SHA256;\n if ((await sha256Hex(k)) !== expected) {\n return new Response(\"Not found\", { status: 401 });\n }\n // \"manual\" so this press does not get counted as the watchdog keeping its own schedule.\n const out = await watchdog(\"manual\");\n return new Response(JSON.stringify({ triggeredAt: new Date().toISOString(), result: out ?? \"ran\" }, null, 2), {\n headers: { \"content-type\": \"application/json\" },\n });\n}\n\n\n","deleted",false,"label",[14],"1bfa6e81-74e1-4c6c-ab32-118304a4ffff",["D",1785429259053],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Puppy path nurture engine v1.2 — The Dogs Spot","imageUrl","userId","d26e64e6-cd39-4be1-b5b4-1de11cc555f8","pinnedFileId","ad633fec-8e73-11f1-b800-1607ee4eb77e","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019f56fd-bd59-724f-8163-80ffcf8235dd","tursoName","1bfa6e8174e14c6cab32118304a4ffff","tursoHostname","1bfa6e8174e14c6cab32118304a4ffff-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789519842404],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_106":102},"org",{"_9":10,"_99":100,"_101":102,"_55":56,"_103":104,"_105":42},"branch",{"_36":89,"_11":90,"_23":29,"_91":45,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":12,"_98":10},"isOwned",1233,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Amir","avatar","https://lh3.googleusercontent.com/a/ACg8ocILk3bwhcvrzozUWm7gxlKoBm7ZGtsgIkesW3ysOOsJ1rSQuA=s96-c","tier","free","canRestrictVals","profileImageUrl","ctx",{"_82":-5,"_140":141,"_142":143,"_144":145,"_146":42,"_147":42,"_148":42,"_149":33,"_150":-5,"_151":-7,"_152":-7,"_153":63,"_154":42,"_155":42,"_156":-5,"_157":42,"_158":42,"_159":42,"_160":-5},"ENV",{"_111":112,"_113":114,"_115":90,"_116":117,"_118":119,"_120":121,"_122":123,"_124":125,"_126":127,"_128":129,"_130":131,"_132":133,"_134":135,"_136":137,"_138":139},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]