[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_1186":1187,"_1188":1189},"routes/_app.x.$handle.$name",{"_99":98,"_32":44,"_108":89,"_27":109,"_13":14,"_110":-5,"_11":111,"_112":113,"_114":115,"_116":117,"_118":119,"_20":-5,"_120":-5,"_121":-5,"_122":25,"_123":124,"_125":58,"_126":-5,"_127":-5,"_128":129},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_42":43,"_32":44,"_37":45,"_46":-5,"_47":25,"_48":49,"_50":49,"_51":52,"_53":-5,"_18":54,"_55":56,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":25},"version",1209,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":20,"_34":36,"_37":38,"_39":14,"_40":41,"_24":25},"previous",{"_30":31,"_32":28,"_33":20,"_34":35},"deleted",false,"deletedHere","path","SOURCE-BUNDLE.part39.txt","latestPath","fileId","27770c9c-9832-11f1-b97c-1607ee4eb77e","name","fileType","content","THE DOGS SPOT — SOURCE BUNDLE (part 39 of 40)\n\nEVERY source file in this project, engine/ included. Restoring these parts and nothing else gives\nyou a tree that builds, typechecks and runs its own test suite with no network and no val.\n\nengine/ is here as of 14 Aug 2026. It used to be left out because val 1bfa6e81-74e1-4c6c-ab32-118304a4ffff\nholds it, which was true of every engine file except engine/watch.ts: a module the val does not run,\nso it was never deployed, so it lived in one container and nothing else. A reclaim destroyed it.\nscripts/deploy.mjs --check still compares engine/ against the val file by file; that is a second\ncheck on the same files now, not the only copy of them.\n\nRESTORE (needs only node, from an empty folder). Save each part, then run this ON EACH ONE:\n\n node -e 'const fs=require(\"fs\"),p=require(\"path\");const b=fs.readFileSync(process.argv[1],\"utf8\");\n for(const s of b.split(\"\\n=====FILE \").slice(1)){const i=s.indexOf(\" =====\\n\");\n const f=s.slice(0,i),c=s.slice(i+7);fs.mkdirSync(p.dirname(f),{recursive:true});\n fs.writeFileSync(f,c.replace(/\\n$/,\"\"))}' PART.txt\n\nA record named #1, #2, ... is one FILE cut into pieces: concatenate them in order, then\nstrip one trailing newline from the last. scripts/restore.mjs does this for you.\n\nEach part is complete in itself: whole files only, no reassembly, any order.\n\nThen: node scripts/build.mjs (engine/ came out of these parts; nothing to fetch first)\n node scripts/typecheck.mjs\n node tests/run-all.mjs\n node scripts/deploy.mjs --check (pulls nothing, proves the val matches what you restored)\n node tests/negative-controls.mjs (proves the suite above can actually fail)\n\nIN THIS PART (5 of 116 files)\n handover/PLAN-TO-FINISH.md 13923 bytes fcc0735a2d00\n handover/SEND-TO-KIM.txt 6320 bytes 6529bd33d5cf\n handover/REPLY-AUG5.txt 10977 bytes 43d7d92f357b\n handover/REGISTER-AUG5.md 2928 bytes f2ef80135b0b\n handover/AMIR_TODO.md 1489 bytes 4c4d197c3c85\n\n================================================================================================\n=====FILE handover/PLAN-TO-FINISH.md =====\n# What is left, in the order it has to happen\n\nUpdated 5 August 2026, 11:50, after a night of work while you were on shift. Everything here is\neither a thing I build or a door you open.\n\n---\n\n## What changed while you were out\n\n**The test suite is back, and bigger than it was.** Deliberately not quoting a number here, because\na number in a document is a number that goes stale: run `node tests/run-all.mjs` and it tells you.\nThe part that matters is `node tests/negative-controls.mjs`. Each control breaks the code on\npurpose, in a temporary copy, and demands a *named* test go red. If the wrong test catches it, or\nnothing does, the control fails. That is the thing we did not have when three fake checks shipped.\nFour of the controls exist because they caught one of my own checks lying.\n\n**It survives a reclaim now.** `handover/SOURCE-BUNDLE.part{1,2,3}.txt` holds every file that is\nnot already on val.town, and the same three parts are stored *on the val* as inert files. The\nrestore command is in the header of each part, and I have actually run it into an empty folder and\ndiffed the result: byte identical, every file. `scripts/build.mjs` and `scripts/deploy.mjs` now\ncarry everything that used to live only in my head, including the two traps that cost time before:\nmain.ts is called `puppy_path_v1.1.ts` locally, and val.town serves you a **cached** copy after a\nwrite, so a verify-by-read straight after a deploy shows the old hash and looks like a failure.\n\n### Four real defects found and fixed\n\n1. **The watchdog was reporting different money from the dashboard.** It said 35 counter sales\n worth $23,463.99. The dashboard said 40 worth $28,035.99. I re-derived it a third time, from\n the raw journal, in Python, without looking at either implementation: **40 is right**. The\n watchdog was skipping any row that carried an email or phone, and it was subtracting a count of\n journal *rows* from a count of *payments* to get its \"unresolvable\" figure. Two different units,\n one subtraction. It now imports the same function the dashboard uses, so they cannot disagree\n again.\n\n2. **The watchdog was set to look once a day. Now hourly. DONE, no longer yours.**\n I wrote in the first version of this file that its timer \"has never fired\". That was wrong, and\n wrong in two separate ways, both of which are worth reading because they are the same mistake\n twice.\n\n Opening the schedule showed **Runs every 1 days** — deliberately, by you, a week ago (val.town\n still has the chat: *\"can you set the watchdog to daily on...\"*). So the timer was firing\n perfectly, once every 24 hours. A problem starting just after it looked could sit unnoticed\n until the next day, while the thing it watches runs hourly. **Changed to hourly. Confirmed on\n the schedule screen: \"Runs every 1 hrs\".**\n\n Then it still reported no scheduled runs, and I nearly concluded a second time that the timer\n was dead. It was not. **The counter I had built that morning was broken.** I had assumed\n val.town calls the scheduled function with no arguments; it passes one of its own, so my\n \"is this a scheduled run\" check was false every single time. The scheduled runs were in the\n plain run record one line from where I was looking. Fixed by deciding it the other way round:\n only the manual endpoint says so, everything else is scheduled. **Both directions have now been\n watched working** — a scheduled run recorded as scheduled, a hand-started one as by hand.\n\n Kim's page reads **\"Everything we run is healthy\"** for the first time.\n\n3. **The page was quoting my button presses back to Kim as the watchdog's schedule.** It said\n \"left to itself it runs about every 95 minutes\". That number was honestly measured off the\n wrong thing. Scheduled and manual runs are recorded separately now, and the page says plainly\n which it is looking at. It is in the work log as my mistake, because it was.\n\n4. **A check passed on my own comment.** `D2b.1` forbade a call, I removed the call, and wrote a\n `[was: ...]` note above it naming the call I had removed. The test matched the note and stayed\n green. Every structural check now reads the file with comments stripped, and there is a control\n that puts the forbidden text *only* inside a comment and demands the test stay green.\n\n### The go-live blocker is no longer blocked, and the third switch is built\n\n**I was wrong that this needed a new scope.** I tested a tag write and a tag delete against my own\ntest contact on the token we already have: both work, HTTP 201 and 200. The `locations/tags.readonly`\nscope only lets me *list* the account's tag vocabulary. It was never in the way.\n\nSo the tagging is built, and it is running now:\n\n- `engine/puppy-detect.ts` decides who counts as a puppy inquiry, from what they wrote when they\n got in touch. It **cannot apply a tag** and that is structural rather than a promise: the file\n contains no fetch, no client, no POST. A test asserts it and a negative control adds a fetch call\n and demands the test go red.\n- The engine calls it once per run, in **both** modes, and writes the counts down. Kim's page shows\n them, with a staleness line if the pass ever stops.\n- A full dry pass over 1,200 contacts is in `handover/Puppy-tagging-candidates.xlsx`: **39 clear,\n 55 probable, 552 not a puppy, 554 with nothing written down to judge by.** Nothing tagged.\n\n**My first version of it would have signed up three people who should not have been.** A man asking\nto *buy* a puppy, a woman *rehoming* her older dogs, and a dog described as \"3 years and 4 months\nold\" read as four months. Each is a rule now, each rule has a test, each test has a control.\n\n**Then my own test caught the years bug still present in the rewrite.** The pattern wanted\n\"3-year-old\"; \"3 years and 4 months old\" puts the word \"old\" after the months, so it fell through\nto the months branch. Fixed and pinned.\n\n**One decision is Kim's, not ours.** A one-year-old dog sits exactly on the boundary and there are\na lot of them. Her slow track covers the teenage stage, so they may well belong. It is on her page.\n\n### Two more findings, late on\n\n**Her knowledge base was edited at 02:38 this morning and nothing was watching it.** That is 22:38\nher time, so it is very likely Kim herself, and if so it is exactly what should happen. But the\nconsolidated knowledge base is what Chloe answers customers from — it carries the no-training-prices\nrule, the appointment-only rule, the no-grooming rule and \"Pup Talk\" — and we have been watching her\n165 automations for changes since 4 August while not watching the documents that decide what her\nbusiness says. The watchdog now watches both. The comparison lives in `engine/registry-diff.ts` with\nits own tests, so it is not another check that has only ever been seen not firing.\n\n**The knowledge base IS readable through the API.** The master handoff says it is UI-only; that is\nwrong, or it has changed. `GET /knowledge-base/?locationId=…` lists all eight, and `GET\n/knowledge-base/{id}` gives names, timestamps and a count of what is inside. The document *text* is\nstill not exposed, so **step 4, the \"discovery call\" wording sweep, still needs the UI** — but we now\nknow exactly what to open: the consolidated base holds 9 items (7 rich text, 1 URL, 1 table).\n\n### Two things that are better than they were\n\n- **The go-live blocker is now counted live.** The page used to say \"1,200 of your most recent\n contacts were checked\". That was a scan size dressed as an answer. GoHighLevel will filter\n contacts by tag server-side, so it now reads **all 5,544** every time the page loads. Zero carry\n the tag. Cross-checked against a full page-by-page walk of the whole contact base: the filter\n and the walk agree exactly on three other tags, so the zero is trustworthy.\n- **The five sequences Kim asked about are reviewed.** `handover/NURTURE-REVIEW-FOR-KIM.md`. They\n are live, they are busy, and the topics collide with ours. Details in that file.\n\n---\n\n## GO-LIVE IS STILL THREE SWITCHES, AND ALL THREE NOW EXIST\n\nOur system enrolls people carrying the tag `nurture - puppy`. **All 5,544 contacts checked, live,\non every page load: zero carry it, and nothing in her account applies it.** Done as two switches it\nwould go live and reach nobody, and it would look like it was working, because the engine would\nreport healthy runs with zero enrollments.\n\nThe third switch is now built and running in dry mode (see above). What is left on it is not code:\n\n1. **Amir reads the candidate list** in `handover/Puppy-tagging-candidates.xlsx` and says whether\n the 39 clear ones look right to him. That is the sanity check on my judgement, not a formality.\n2. **Kim answers the one-year-old question.** It is on her page.\n3. **Arming it** happens on the go-live call, with her watching, alongside the other two switches.\n\nNothing about it is waiting on a scope, a token, or anybody's permission any more.\n\n---\n\n## DOORS I NEED YOU TO OPEN\n\n**1. Meta: give the system user an app role.** Unchanged from before, and still the one that puts\nmoney on the page. Order matters:\n\n- Business Settings, Apps, pick one of her apps, add `dogsspot-reporting` as a user on it\n- *Then* System Users, Generate New Token, tick `ads_read` and `read_insights`\n- *Then* Add Assets, Ad Accounts, tick the account, give View Performance\n- Send me the token and I swap it in val.town in two minutes\n\n**2. GHL token scopes.** Still worth having, but **no longer blocking anything**. Four read-only\nscopes on the integration starting `pit-064237ea`, at Settings, Private Integrations. **Do not\nregenerate the token** — that changes it, which takes the engine offline *and* silently kills Kim's\ndashboard link, because her view key is derived from it.\n\n- `locations.readonly`\n- `locations/customFields.readonly`\n- `locations/tags.readonly`\n- `forms.readonly`\n\n**3. ~~The watchdog's schedule~~ — done, by me, in the val.town UI. Nothing needed from you.**\n\n**4. ~~Chrome cannot be scripted from here~~ — solved.** The AppleScript route does fail with\n\"Chrome is not running\" (that setting is off), but the **extension** route works fine and is what\nyour own master handoff already said to use. I have re-read that note and stopped treating the\nbrowser as blocked. Turning the AppleScript setting on is still worth doing one day, but nothing\nis waiting on it.\n\n**5. Sign into GoHighLevel in Chrome and stay signed in.** The session has expired. Two builds sit\nbehind it: the typing chat agent Kim asked for, and deleting the stale Voice AI widget.\n\n**6. Your retainer figure.** Still the only line item on the page with no number against it.\n\n**7. Nothing else.** Square is granted and working. val.town environment variables are set and\nverified. The Meta ad account id is in place.\n\n---\n\n## WHAT I BUILD, IN ORDER\n\n### Done since the last version of this file\n1. ~~Rebuild the test suite~~ — 11 suites, 151 checks, 30 negative controls.\n2. ~~Store it where a reclaim cannot reach it~~ — three bundle parts, on the val, restore verified\n by actually restoring.\n3. ~~Review the five no-sale sequences~~ — `handover/NURTURE-REVIEW-FOR-KIM.md`.\n\n### Next\n4. ~~The tagging mechanism~~ — built, running in dry mode, 1,200-contact review list delivered.\n What is left on it is Kim's answer on the one-year-old boundary, and Amir's read of the list.\n5. **The go-live drill**, from my own phone, in practice mode: STOP handling, reply-pause, the\n watchdog seeing it, the panel showing it. Watched end to end before anyone real is touched.\n6. **The three switches, together, with Kim watching.** Blocked on her go-live answer, her wording\n sign-off, and the email domain.\n7. **Meta spend**, once door #1 lands.\n8. **Google Ads.** Coded, never run against a live account. Still the least-finished thing I own.\n It gets an account and gets tested, or it comes off the list honestly.\n9. **The deposit automation**, scoped once I have watched a few holiday bookings move.\n10. ~~The missing call transcripts~~ — answered. The recordings are all there (54 of the 62 calls\n checked, about two and a quarter hours of audio; the 8 without are calls nobody answered).\n Transcription is a separate switch at Settings → Phone System → Voice → Call Transcription,\n about 2.4 cents per recorded minute, and it does **not** apply retroactively. It is question 13\n on Kim's page. **Candice's app stalling** is still open: her CRM holds 5,516 conversations and\n the message API takes 0.4 to 2.7 seconds each, so any screen loading them one at a time takes\n over half an hour. That is a hypothesis about somebody else's code, not a finding, and I have\n said so rather than dressing it up.\n11. **The typing chat agent**, blocked on door #5.\n12. **The knowledge-base wording sweep**: confirm \"discovery call\" appears nowhere in the KB.\n13. **Friday reports.** Renders correctly; wants a scheduled snapshot and one send Kim has\n actually received before we call it done.\n\n---\n\n## WHAT I WILL NOT DO\n\n- Contact Kim. Every question goes in the ledger.\n- Take anything out of practice mode without her word and your presence.\n- Invent a story, a testimonial, a customer or an event for the eight empty slots.\n- Type a live number into a document again. Anything countable is counted at render time.\n- Ship a finding I could not stand up. There is one in the nurture review that I dropped for\n exactly that reason, and I said so in the document rather than quietly leaving it out.\n\n---\n\n## HOW THIS ENDS\n\nGo-live is three switches thrown together on a call with Kim watching, after a drill from my own\nphone, with the email domain verified and the tagging built.\n\nThe honest state this morning: the machinery is built, verified live, and now genuinely guarded by\nchecks that have been proven able to fail. Nothing has reached a customer. The gap is three\ndecisions from her and three doors from you.\n\n\n\n=====FILE handover/SEND-TO-KIM.txt =====\nKim, everything you sent over is in. Taking your notes in order.\n\nThe puppy's name is gone from every message, all forty-one, not just the ones you were reading. You were right, and for a reason I hadn't checked until you said it: I went and counted where your inquiries actually come from, and the large majority arrive as a message on Facebook or Instagram. Those almost never carry a dog's name, so a placeholder for it was always going to sit empty most of the time. The messages don't lean on it now, they use your customer's own name instead, and I rewrote each sentence around it rather than just deleting the word, so nothing reads like it's had a hole punched in it.\n\nYou were spotting a pattern rather than two words, so I treated it as one. Potty training and yard now, and I went back through the rest of the older copy for the same thing and found a few more that read English rather than American. The newer half was already written that way, so it was only the early messages that were off. There is a check on it now, so it stays fixed rather than drifting back the next time I write something.\n\nDaycare is gone completely, and thank you for catching it, because that one was a proper mistake rather than a wording preference. It was in four separate messages offering a service you don't provide. It's the same class of error as if I'd had you offering grooming, and there's now an automatic check that fails the whole build if the word ever reappears anywhere a customer could see it.\n\nBoth of the missed-Pup-Talk messages are your version rather than mine now, near enough word for word. The text says \"just reply and I'll schedule it\". The email is your rewrite in full, including \"I know life gets busy\" and \"won't keep bugging you\". They read better than mine did, particularly the ending.\n\nThe first three weeks are attached, six pages, generated straight out of the running system rather than typed up. Same numbering you've been using, so Touch 4 is the fourth thing a customer receives. There's a longer companion with all forty-one if you ever want it, but you've already signed off the slow track and nothing in it changed, so the short one is the one to read.\n\nOn the no sale and no sale-tips nurtures. I've looked, and the useful thing to know is that you already have these running: five follow-up sequences plus two auto-responders, all published and live in your account right now. So I've deliberately not built ours, because putting another sequence next to five live ones is exactly how somebody ends up getting two sets of messages from you in an afternoon. It's the same trap as the puppy one we already have flagged. What I'd suggest is that I read the five you have and tell you which are earning their place before we build anything new. One thing already looks accidental: a workflow called \"Copy - Tips Ad campaign > Auto Responder\" is published while the original it was copied from sits in draft, which usually means somebody duplicated it to make an edit and published the wrong one.\n\nNow the holiday deposit, which is the most useful question you've asked me this week.\n\nYes, and it's closer than you'd think. You already have a product in your CRM called \"Holiday boarding deposit\" set at fifty dollars, fully configured, and it doesn't appear on a single order in the payment history I can see. Same story with \"New Client Boarding Deposit\". The reason they've never fired is that your boarding bookings go through the form on your website rather than through the CRM, so the CRM never gets the chance to take the money or to write down that it arrived. That's why it lands on somebody to check by hand.\n\nTwo ways to fix it, genuinely different sizes of job. The smaller one keeps the booking exactly where it is and records the deposit against the customer automatically once it's paid, so you get a list you can look at instead of a memory you have to trust. The bigger one moves holiday bookings so the deposit is taken as part of the booking itself, which means nobody can complete one without paying and the chasing disappears rather than getting easier. I'd want to watch how the money moves for a few days before recommending one, and I can, because the payment link into your CRM is already live.\n\nThree corrections of my own, because you should hear them from me.\n\nFirst, I was about to ask you for a Square permission you had already given me. You gave it, it's working, and payments have been flowing through it since the start of the month. I had it wrong in an earlier draft of this message and I'd rather correct it than let it stand.\n\nSecond, your dashboard had been telling you there was one person walking through the follow-up messages. There isn't. That one record is a test contact of mine with my own email on it, and the system has never once looked at a real inquiry. The page says so plainly now. Nothing went to anybody, but it was flattering itself and it shouldn't have been.\n\nThird, and this one matters for go-live. Our system only picks people up when they're tagged as a puppy inquiry, and I checked twelve hundred of your contacts: not one carries that tag, and nothing applies it. So switching ours on and the old one off isn't two moves, it's three. If we'd done the two, we'd have gone live and quietly reached nobody. That's on the list now as part of the go-live question, and it's mine to build rather than anything you need to do.\n\nThe email you sent Kristian is good. It's clearer than my draft was, and the last paragraph does the important work.\n\nTwo things I haven't got answers on yet and I'd rather say so than guess: the missing call transcripts, and Candice's app stopping when it loads messages. I have the screenshot. Both live in parts of the system I want to look at properly rather than guess at, and I'll come back on them specifically.\n\nOne last thing. Rather than keep sending you numbers in messages, there's now a page you can open any time that reads your systems the moment you load it. It shows what came in, what happened to it, what we've been doing and what's waiting on you, and it's numbered so a reply saying \"yes to 1 and 3\" is a complete answer. I'll send you the link separately so it isn't buried in this.\n\nNothing has sent to anybody. Everything stays in practice mode until you say the word.\n\nAmir\n\n\n\n=====FILE handover/REPLY-AUG5.txt =====\nKim, the person your funnel was chasing is stopped, answers to everything you asked today below, and one thing I found tonight about the red flag tag that you'll want to see.\n\nThomas first, since that was the HELP. He is out of that workflow as of 6:30 this evening and nothing else is active on his record, checked again after a full reload. Nothing new will go to him.\n\nWhat happened, in order. Your team booked his Free Training Day at 10:24 this morning, right after his Pup Talk, directly on the calendar. A few minutes later the little free training day signup page got a visit and its one question form got submitted, most likely him clicking around after the call. That page's funnel only counts a booking made through the page itself. It cannot see the calendar, so it decided he was interested and unbooked, and chased: two texts at 12:31, a voicemail at 12:41, and another text at 2:41, all grab your spot before it fills. Your screenshots caught three of the four, the 12:41 one was a voicemail drop rather than a text. Candice caught it and rang him at 4:54, which is in his thread too.\n\nTwo things worth knowing about it. First, it was not the new follow-up system. That has been in practice mode all day and has sent nothing to anyone, and I checked it live tonight before writing this. It was one of the workflows that came with your account, called \"Free Training Day abandoned booking\". Second, this is the same blind spot as the deposit: bookings made off to the side are invisible to the automations inside the CRM, and this is what that looks like when it bites. The lasting fix is one exit rule on that funnel, leave anyone who already has a Free Training Day on the calendar, and the same rule on its sibling, the small yes text one that sent the first two messages and had already finished with him by then. I can make that change with you on a call or write it up for whoever you prefer, I didn't want to edit a live workflow of yours tonight without you knowing. I also checked whether it hit anyone else: that calendar holds three bookings in all, and the other two people's threads are clean, so Thomas was the only one it reached.\n\nAnd since it's the same Thomas as this morning, George's owner: after the day he's had I would not put him on any track for now. He's booked in and your people are talking to him, which is better than any sequence.\n\nOn going live for the puppy: you were right about the mechanism, one wording detail aside, and the straight answer on tonight is not yet. The tag is \"nurture - puppy\", not just \"puppy\", and Candice used exactly the right one on Kristina this morning without being told, so it's already in her dropdown. The reason for the not yet: switching on properly is one coordinated move, ours on, the old puppy workflow off, the tagging step on, or somebody ends up with two sets of messages, which is exactly the class of accident Thomas got a taste of today. While practice mode is on, the tag queues people up but nothing sends, to anyone, full stop. And once live, the system stays quiet for anyone with a call still on the calendar until that call has an outcome, so nobody gets messaged over a booking.\n\nWalle's owner, told straight, because her day moved around. I marked her at lunchtime, before what was then her afternoon call. Since then, three things happened on her record: her Pup Talk moved to Thursday at 3:40, the puppy mark came off during the afternoon, and on this evening's call your team booked her Free Training Day for Friday morning. I don't know whose hand took the mark off and I won't guess. But where she has landed matches your own rule, anyone who books comes off the track, so I've left it exactly as it is. If you want her on the puppy messages after her visit, it's one tag to put back. So right now exactly one inquiry is marked and waiting, Kristina, and she's held anyway until her Meet and Greet on Monday resolves.\n\nThe attachment. You didn't miss it, it failed to attach, and that's twice now, which is embarrassing. Both documents are on this message and I've watched them upload this time. The short one is the first three weeks. The long one answers your question about the longer version: it's not a different sequence to choose between, it's the same one continued. The first three weeks run their course and then the taper you designed takes over automatically, once a week for a month, every two weeks for six months, then monthly indefinitely. So \"do the longer one then ease into the slow track\" is exactly what's built, nothing to decide.\n\nKristina's two records are merged, done early this afternoon. The useful detail: the two records had two different phone numbers, one digit apart. Her actual call this morning came from the number ending 4535, which proves that's the real one, so it survived and the typo is gone. The accidental do-not-disturb is off, that got switched on when the second record was created, which is why you saw it and couldn't explain it. Her Meet and Greet on Monday is untouched, her email is on the record, and both conversation histories are in one place. One judgment call I made and want you to know about: the duplicate had also been tagged into the no sale and tips nurtures. She has a booked appointment, so she's not a no sale, and carrying those tags over would have had your tips messages texting someone who's about to come in. I left them off. If you want her in tips anyway it's one click to add back.\n\nThe tag report is attached, rebuilt tonight so it matches your account as of this evening, and it turned up the thing you should actually look at. The tag \"red flag\" is not just a label. A workflow that came with your system switches on do-not-disturb for anyone who gets it. It was put on five people this week, so all five are on do-not-disturb right now and your system will not message them at all. They are listed by name in the file. And they answer your actual question about where these came from: seven people carry them, six from the missed-callers list Candice was working through yesterday and one who came in through Messenger, and every one of the seven records was touched during her calling hours yesterday afternoon. So these read like her outcome notes from working the phones, no for a no, red flag for the ones that felt off. A sensible instinct. She just may not know that red flag also silences people: if any of them were flagged by mistake, taking the tag off is not enough on its own, the do-not-disturb switch needs turning off too. The other odd ones are smaller: \"no\" is on four people and does nothing by itself, though it sits one word away from \"no sale\", which does start a nurture. And a tag called \"follow-up\" was on exactly one person when I built this afternoon's version of the file and is on nobody now. I didn't take it off, so the tidying has already started on your side. One honest limit, stated in the file too: your CRM doesn't record when a tag was applied, only that a record changed, so the file shows records touched since Monday, 167 of them, and what they carry now. On the bigger cleanup, every tag actually in use is in the file, 40 of them tonight. The dropdown also holds tags that are defined but sitting on nobody, and reading that list needs one extra permission on the connection, a two minute change in tonight's task list on my side, and the full unused-tags list follows right behind it. The cleanup itself is short and safe because nothing in use gets touched.\n\nYou're reading the no sale routing correctly. Today everyone lands in no sale-tips unless disqualified. Once we're live, the puppy tag pulls puppies onto the new track and your existing flows keep everyone else. And thank you for the history on the tips ad campaign, that the copy was Milton's and that it answers on Facebook comments as well as Messenger. That changes it from \"looks accidental\" to \"leave it alone\", and I have.\n\nThe deposit, good news: the Stripe advice didn't come from me, and whoever it came from was answering a different question. Nothing in the plan bills anyone through the CRM. Square keeps taking the money exactly as it does now, and what I'll build reads the payments as they land and does the bookkeeping automatically: deposit paid gets marked on the person, and you get one list of holiday bookings that still owe. No Stripe, nothing changes about how customers pay. On dates, one small correction so the automation never misfires: Thanksgiving is the fourth Thursday of November, the 26th this year, and it's computed fresh each year, so that curveball is handled. I'll fold it into the monthly.\n\nThe transcripts, and a correction of mine. Earlier today I told you transcription had never been switched on. That was wrong. Kristina's call from this morning has a full written transcript, I watched it render, and this afternoon's call with Thomas shows one too. So transcription works, at least sometimes, and the real question is which calls are missing theirs. The fastest way to crack it: point me at one call where the transcript should be there and isn't, or tell me roughly when they disappeared for you, and comparing that call against a transcribed one should pin the pattern down quickly. And if nothing comes to mind, just say so, and I'll walk the recorded calls myself tomorrow and bring you the list of which have transcripts and which don't.\n\nCandice's app stalling on messages I'm still on, and I'd rather say that than guess. One thing I can already measure: your account holds five and a half thousand conversations, and loading them one at a time takes long enough that anything doing so would appear to freeze. That's a suspicion about where to look, not an answer yet.\n\nAnd the page link I owed you: https://amir5--fb119304902811f182781607ee4eb77e.web.val.run?k=tds_view_795bafb78a5428f8e6ef481518c274b6\n\nBookmark that. It reads your systems the moment you open it, every count on it comes from your records rather than from anyone's memory, and each question and log line on it names the check that backs it. Tonight is already written on it: Thomas, the red flag finding, and Walle's owner coming off the track. The count of marked puppy inquiries reads your records live each time you open it.\n\nNothing has sent to anybody from the new system, today included. Three things stand between here and fully live, and they are numbered on the page: your word on the wording, the switch-over done as one move so the old puppy workflow cannot double-message anyone, the same class of accident as today's funnel, and four small settings wherever thedogsspotga.com is managed so the emails land in inboxes instead of spam. The first two happen the evening you say the word, and the texts can go live on those two alone. One more honest pointer: on that page, the access key question, the Bootcamp deposit question, and the doubled review-request automations are the three that most deserve your eyes first, and the rest can wait for you.\n\nAmir\n\n\n\n=====FILE handover/REGISTER-AUG5.md =====\n# REGISTER ADDENDUM - fleet verification, late 5 Aug (ET)\n26-agent fleet (20 sonnet verify, 4 opus adversarial, 1 opus judge, ~62 min, 642 tool calls) against live data.\n\nCONFIRMED CLEAN: Thomas timeline (every timestamp), Kristina record (all five facts), census=1 Kristina,\nred flag x5 all DND, no x4 with two non-DND, follow-up 0, 40 distinct tags (full 5,562-contact walk),\nold puppy workflow still published (cutover premise), Tresa state (tags [phone], Pup Talk Aug 6 3:40,\nFTD booked), conversations 5,534 (message says five and a half thousand), 3 go-live blockers match page.\n\nFINDINGS AND RESOLUTIONS:\n1. Three source=workflow SMS hit Thomas AFTER the 6:30 PM removal (8:00, 8:05, 9:05 PM ET). Verified by\n hand: they are the BOOKED-path confirmations for his real Aug 15 session (confirmed + spots-held +\n details), triggered by his opportunity moving to booked at 8:00 PM. Correct message type for a booked\n customer; the chase type stayed stopped. Sent message's \"Nothing new will go to him\" is literally\n false as a result; bridge note corrects it.\n2. Adversarial sweep found 76 chase texts + 24 voicemails to 27 other contacts since 14 Apr. Checked the\n booked ones by hand: Luis Colon booked Jul 13, zero chase. Destinee Patterson chased 30 May while\n UNBOOKED (funnel's intended target), booked 4 Aug - the funnel converting, not the defect. Conclusion\n of the sent message stands as scoped: Thomas is the only person chased AFTER booking. Stronger\n evidence method than the calendar-sample cited in the message; noted here.\n3. \"That calendar holds three bookings in all\" was stale by one at send: Tresa booked 6:35 PM, message\n sent 7:54 PM. Materially harmless (the fourth is Tresa, whose story the message tells). Logged.\n4. \"Practice mode... sent nothing to anyone\": engine made one SMS API call on 5 Aug 12:40 PM ET to the\n ZZTEST dummy (unroutable, failed). True for real people; wording tightened in future copy. ENGINE\n HARDENING QUEUED: add TEST_MODE guard at the sendSms call site (safety currently via contact scoping).\n5. \"Computed fresh each year\" (Thanksgiving) describes the deposit plan not yet built; present tense ran\n ahead of reality again. Building the reader includes the fourth-Thursday computation.\n6. Red flag DND nuance: 4 of 5 silenced by the workflow from clean state; the fifth (no-name record) had\n SMS-blocked themselves 20 Jul, workflow extended it to all channels 4 Aug. Message's claim literally true.\n7. Chase funnel \"Free Training Day abandoned booking\" remains PUBLISHED. Fix proposed to Kim in the sent\n message; her call, not taken unilaterally.\n8. Disk reverted to the Aug 4 snapshot a third time mid-fleet; twelve slices reported artifacts missing.\n Kim's copies live on Upwork (hash-verified before send) and everything regenerates from the val bundle\n (v203/204). Local file absence is an environment artifact, not a delivery failure.\n\n\n\n=====FILE handover/AMIR_TODO.md =====\n# AMIR - morning of 6 Aug. 4 things.\n\n## 0. State of play\nThe full reply went to Kim last night (7:54 PM ET, two bubbles, stray \"Boo\" in the middle, all\nthree files attached, every claim fleet-verified afterward). She has not answered yet. The short\nbridge note is drafted and HELD - I do not send it unless you say \"send it\". Three automated\nbooking-confirmation texts went to Thomas at 8-9 PM for his real Aug 15 session (right kind of\nmessage, from the booked-day workflow, not the chase). The chase workflow stays stopped for him.\n\n## 1. One token action in GHL (5 min, fixes the exposed key AND the missing scope)\nPrivate Integrations tab (open in Chrome) > edit the reporting integration > tick the tags-view\nscope > Save > Regenerate token > paste new token into BOTH vals' env tabs (engine + watchdog) >\nopen the dashboard link and confirm the counts load.\n\n## 2. Bridge note - your call\nSend it from your phone or tell me \"send it\". Text is in the chat. It owns the Boo, corrects\n\"nothing new will go to him\" (his booking confirmations went out, the right kind), and points\nher at the red flag finding.\n\n## 3. When Kim says go on the wording\nThe switch-over is one coordinated move done together: TEST_MODE=false, old puppy workflow off,\ntagging on. Never solo.\n\n## 4. Engine hardening queued (do with me, 20 min, not urgent)\nAdd a TEST_MODE guard at the sendSms call site (today safety is contact-scoping to the dummy).\nThen the funnel exit-rule change for Kim if she says yes.\n\n\n","THE DOGS SPOT — SOURCE BUNDLE (part 39 of 47)\n\nEVERY source file in this project, engine/ included. Restoring these parts and nothing else gives\nyou a tree that builds, typechecks and runs its own test suite with no network and no val.\n\nengine/ is here as of 14 Aug 2026. It used to be left out because val 1bfa6e81-74e1-4c6c-ab32-118304a4ffff\nholds it, which was true of every engine file except engine/watch.ts: a module the val does not run,\nso it was never deployed, so it lived in one container and nothing else. A reclaim destroyed it.\nscripts/deploy.mjs --check still compares engine/ against the val file by file; that is a second\ncheck on the same files now, not the only copy of them.\n\nRESTORE (needs only node, from an empty folder). Save each part, then run this ON EACH ONE:\n\n node -e 'const fs=require(\"fs\"),p=require(\"path\");const b=fs.readFileSync(process.argv[1],\"utf8\");\n for(const s of b.split(\"\\n=====FILE \").slice(1)){const i=s.indexOf(\" =====\\n\");\n const f=s.slice(0,i),c=s.slice(i+7);fs.mkdirSync(p.dirname(f),{recursive:true});\n fs.writeFileSync(f,c.replace(/\\n$/,\"\"))}' PART.txt\n\nA record named #1, #2, ... is one FILE cut into pieces: concatenate them in order, then\nstrip one trailing newline from the last. scripts/restore.mjs does this for you.\n\nEach part is complete in itself: whole files only, no reassembly, any order.\n\nThen: node scripts/build.mjs (engine/ came out of these parts; nothing to fetch first)\n node scripts/typecheck.mjs\n node tests/run-all.mjs\n node scripts/deploy.mjs --check (pulls nothing, proves the val matches what you restored)\n node tests/negative-controls.mjs (proves the suite above can actually fail)\n\nIN THIS PART (2 of 129 files)\n handover/AWAITING-AMIR.md 3046 bytes fef6923acce8\n\n\n================================================================================================\n=====FILE handover/AWAITING-AMIR.md =====\n# AWAITING AMIR — 11 August 2026, evening\nFive things a session cannot do. Everything else on the board is done or in progress. Each of these\nneeds an account or a screen automation cannot reach. Steps are exact.\n\n## 0. NURTURE IS LIVE. This is a status line, not a task.\nSwitched on at 2026-08-11T21:25:42Z. Verified: testMode false, enrolled 2, sent 1, failed 0.\nKristina Gant received the first email, confirmed in her CRM conversation. Lisa Price correctly\ndeferred (another system had messaged her 2.6h earlier, quiet period held). The ZZTEST dummy was\nremoved from state before the flip. The kill switch is `api?k=&stop=1`; a softer lever is\n`api?k=&arm=practice`, effective next hourly pass.\n\n## 1. SWITCH OFF THE OLD WORKFLOW. UI only, five clicks. [the one go-live step left]\nWorkflow \"1. Wait 1 Day: Initial Nurture - Puppy\", id 0cf5fab6-d3ec-4206-8d46-a700dd0469b1, is still\nPublished. Kim approved switching it off. **Automation cannot reach it:** the GoHighLevel workflow\nbuilder runs in a cross origin iframe that times out under automation, and the workflow API is read\nonly on this token (list works, every write and the single get return 404). Ten routes tried.\n\nIt is not sending anything wrong right now. Kim confirmed it is dormant, and our engine's quiet\nperiod would defer rather than collide. But switch it off before new puppy volume arrives, or every\nfuture puppy inquiry could get both sequences.\n\nSteps: GoHighLevel, left menu Automation, open the folder that holds it (search \"Puppy\" once the list\nloads), open \"1. Wait 1 Day: Initial Nurture - Puppy\", top right toggle Published to Draft. Done.\n\n## 2. SEND THE TEAM EMAIL. Kim asked for it, so it is pre approved.\nTo info@thedogsspotga.com. Draft in `handover/TEAM-EMAIL-DRAFT.txt`. Send from your own email or as a\nGoHighLevel email; a session has no send-as-Amir mailbox. Same day as go live, which is today.\n\n## 3. SEND THE KRISTIAN EMAIL. One sentence. Unblocks the money matcher.\nTo solutions@moorecre8ive.com. Draft in `handover/KRISTIAN-EMAIL-DRAFT.txt`. It has been ready for\nthree days. Nothing else on the board depends on his reply, but the money matcher cannot go live\nuntil it lands.\n\n## 4. APPLY FOR THE GOOGLE ADS DEVELOPER TOKEN. Needs your Google login.\nGoogle Ads, Tools, Setup, API Center. Apply for a developer token, Basic access. Google quotes five\nbusiness days, and the clock only starts when it is submitted. Until then any date given to Kim is\ninvented. This is the one thing standing between her and a real Google timeline.\n\n## 5. LINK THE 33 PAYMENTS, THEN LET ME WRITE THEM BACK.\nThe dry run is built and ready for Kim to see (`writeback-dry-run.csv` and its summary). One case\nneeds your hands first: Caroline Riner is in Square on +19123466931 and in the CRM as \"carolyn riner\"\n(id CGpAJDIFtEPnjtD8OxQ6) on +19124328482. Merge or link those two contacts, then her $140 auto\nplaces with the rest. After Kim approves the dry run, I run the write with the Facebook side\nsuppressed so it does not misreport July sales as August.\n\n\n\n=====FILE HANDOFF.md#1 =====\n# HANDOFF — The Dog's Spot / Kim Hicks\nWritten Sunday 9 August 2026. All times in this document are **UTC unless a timezone is named**; the UK is UTC+1 in August, so 21:45Z is 22:45 in Oxford and 17:45 for Kim in Georgia. The live checks below were run at **2026-08-09T21:45:13Z**, and a second round after two cold reads at **2026-08-09T22:44:55Z** (the watchdog endpoint, the unauthenticated val reads, the `main.ts` size, the file counts). The document was finished after both.\n\nEvery fact carries a status:\n**[V]** verified live by me, with how and when · **[C]** claimed by a person or an earlier session, treated as unproven · **[U]** unknown, with what would settle it.\nA previous session saying something was done is **[C]**, never **[V]**.\n\n---\n\n## 1. START HERE\n\n1. Client is **Kim Hicks**, owner of **The Dog's Spot**, dog boarding and training, Ellabell / Savannah, Georgia. Amir Aizhigitov is a solo contractor hired through Upwork.\n2. We own the **marketing and CRM side**: ad tracking, weekly reporting, a client-facing status page, and an automated follow up messaging system. We do **not** own her custom web app or her voice agent. Not yet.\n3. The follow up system is **built, tested and deployed but has never messaged a real customer**. It sits in practice mode. **[V]** \"Built\" means the texting half; the email half is at 45 percent and has no sending domain, §5.\n4. **The single most urgent thing, and there is only one:** Kim has a call with Amir on **Monday 10 August about the money tracking**. She booked it because she did not follow the last explanation. **[U]** the time of that call. Kim's message says \"Meeting at 11am tomorrow\" without a timezone. **Do not treat this as a question to be answered later; it has no answer channel that runs on a clock.** The decision rule: the two readings are 11:00 Georgia, which is 15:00Z and 16:00 UK, and 11:00 UK, which is 10:00Z. **Amir should be ready from 09:30Z and work to 15:00Z as the assumption**; getting it wrong in the earlier direction means Kim opens a call nobody is on. **A session cannot attend a call.** What a session can finish for it, and what \"ready\" means here: the money page copied to `/mnt/user-data/outputs/`, the corrected \"18 into Customer\" wording at the top of `handover/AWAITING-AMIR.md`, and the timezone question as the first line of that same file. Nothing else about this call is a session's to do. Two other things are also called critical later in this document, the nurture go live and Kristian's answer. Both are ranked below this one in §11 and neither has a deadline attached. `QUEUE.md` has no entry for this call at all, so do not go looking for it there. If you are choosing, choose Monday's call.\n5. For that call the deliverable already exists: `/mnt/user-data/outputs/TheDogsSpot-Money-Page.html`, byte identical to `reports/money-page.html` in the repo. Every figure on it was re derived from raw and **reconciles to the cent, verified independently twice** **[V]**.\n\n **The prose on that page was wrong twice, in two successive rounds, and this is the lesson of the whole document.** First it said \"all of it attached to a named customer\" while its own table three rows down showed six payments worth $1,447.00 that were not. That was replaced with \"$1,447.00 arrived with no name at all\", **which was also wrong**: two independent cold reads pulled the six and found the bucket splits into **two different causes**, which `engine/money-match.ts` states in its own two branches at `:64` and `:68` and the page had collapsed into one. The split is in the next paragraph. A tile also said \"1,516 people your team has moved into Customer, plus one in Won and Paid\", which added one; it now reads 1,515 and 1.\n\n **The six were pulled, twice, independently, and the split is now [V]:** **$480 across three payments** carries no name on the record, and all three arrived as **invoices**, not over the counter, so do not call them till sales. **$967 across three payments names a real customer** and includes **$900 from Wendy DeShon** and two from Anna White. Those three do have cards in her CRM; what they lack is a card in the **Customer** column.\n\n **And the matcher's booking universe is not written down anywhere in the code, which is the trap under all of this.** `money-match.ts classify()` takes whatever opportunities the caller hands it and never filters by stage. Scoped to **Customer `fd821b4e-bbe6-44de-b754-fa80e4823616` plus Won and Paid `ae173310-f8b1-4399-acb7-ef1fc03d3697`, and nothing else**, it reproduces the page exactly: 15 / 0 / 15 / 6 and $7,880 / $0 / $8,237 / $1,447 **[V]**. Scoped to every board the contact appears on you get **9 / 18 / 6 / 3**, the page's promise that nobody has to pick becomes false eighteen times, and money lands on **review pipeline cards**. Whoever wires this must scope it. Say so in the code.\n\n **The lesson, and it is the most useful sentence in this file: the arithmetic on that page has been verified four times and every check passed. The prose over the arithmetic was verified zero times and was wrong twice. Check the sentences, not just the sums.** The opener in `handover/AWAITING-AMIR.md` repeated both false lines and was corrected with them.\n\n **One more thing about it will trip the call, so know it before she does.** The money page and her own card page count **different universes of Square money, from different sources**, and both are correct. The money page reads the CRM's own payment records, 232 rows, 69 of them Square, and says **6 payments worth $1,447.00** arrived with no named customer. Her card page reads the Square bridge journal through `facts.ts squareBacklog` and says **33 counter sales worth $22,651.99** are not linked, of which **29 worth $19,822.00** arrived with no name, email or phone. She has a call booked because she did not follow the last money explanation, and if she opens both pages she sees $1,447 against $19,822. **The line to say: \"Those are two different lists. One is the payments your CRM has a record of. The other is everything the till has taken, including counter sales that never became a CRM payment at all. The bigger number is the till.\"** Then offer to put them on one page.\n6. **One number Amir put in writing to her is wrong.** He told her 15 people moved into Customer since 10 July. Re derived from raw: **18 opportunities entered the Customer stage since 10 July** **[V]**, re-derived three times by independent pulls, the last after a cold read disputed it. **The 18 is solid, and here is the method so nobody lands on a different number.** Pull the **Customer stage only**, `fd821b4e-bbe6-44de-b754-fa80e4823616`, all 1,515 records page by page, and count `lastStageChangeAt >= 2026-07-10`. That is 18. **Do not add the single card sitting in Won and Paid**: it is `Laurice Test-Trieve`, created November 2025, status lost, value zero, a test record, and including it gives 19. A cold read that returned 17 had paged short. **The split is definition dependent and the wording has to be careful.** Of the 18, **12 were created on an earlier day and moved across; 6 were created and landed in Customer the same day**. On exact timestamps only **3** went straight in at creation; the other 3 were created in another stage and moved into Customer the same day, at gaps of about 5 minutes, 50 minutes and **1 hour 14 minutes**. An earlier version of this file said all three were \"within the hour\". Two were. So \"created straight in\" is true on a same-day reading and overstates by 3 on a strict one. **Say this: \"18 came into Customer since July 10. 12 moved across from an earlier step, and 6 were created and landed the same day.\"** That sentence is true under both readings. Amir decides whether that goes in writing before the call or is said during it; the draft sits in `handover/AWAITING-AMIR.md`.\n7. She is at the end of her patience with her **other** contractor, not with us. Do not confuse the two. Our standing is currently good and fragile.\n8. Nothing may be sent to Kim without Amir. Drafts go in **`handover/AWAITING-AMIR.md`**, inside the repo so the bundle carries them, with a copy in `/mnt/user-data/outputs/`. **Amir is normally the person running the session**, so \"ask Amir\" means write it in that file and say so in your reply. **If he is not in the session, that channel is a file nobody is reading**, so say so explicitly at the top of your reply rather than treating a file write as delivery. Two things must never go in that file at all, because it is bundled and the bundle is world readable: **the admin key and any other credential**. Those go to Amir directly or they wait. **Kim** is reached only through the Upwork thread, by Amir. **Kristian** is `solutions@moorecre8ive.com`, and emailing him is Amir's call, not a session's.\n9. The system has lost its working tree to container reclaims **at least four times**. The recovery path is real and tested: the SOURCE-BUNDLE parts on the val, plus the engine itself. **List them, do not assume a count.** See §13.\n10. **THE ORDER, and there is only one right order. Do these four in this sequence before anything else.**\n **a. The admin key.** It exists in exactly one unbacked file, §4, and it is the only thing on this whole board that a container reclaim destroys permanently. **It cannot go in `handover/AWAITING-AMIR.md` and it cannot go in any repo file**, because the bundle is world readable. It goes to Amir, in the session, in your reply, and nowhere else. If Amir is not present in the session, say plainly in your reply that this is outstanding and cannot be done without him.\n **b. Prove the tree.** `node scripts/deploy.mjs --check`. Changes nothing, must print \"live matches local, every file\".\n **c. Only then snapshot.** `node scripts/bundle.mjs && node scripts/deploy.mjs --bundle`. Order matters: `--bundle` overwrites the only backup you have and neither script deletes an orphaned part, so bundling a broken tree first is how you lose everything at once.\n **d. Then read** §6 promises and §7 blockers, run the live checks in §4 (with `&dry=1`, and **never** the watchdog), and open `QUEUE.md`.\n11. **What \"the single most urgent thing\" in item 4 means, precisely.** Item 4 is the most urgent thing **for the client**. Item 10a is the most urgent thing **for the systems**, because it is the only irreversible one. They do not compete: 10a takes a minute.\n\n---\n\n## 2. THE CLIENT\n\n**Who she is.** Kim Tome-Hicks, owner operator. Runs boarding, board and train, bootcamps, community classes and a subscription club. Signs off \"Kim Tome-Hicks, The Dogs Spot, Boarding and Training, Mon-Sat by appointment, CLOSED SUNDAY\". **[V]** from her Upwork messages.\n\n**Her business, measured.** ~24 dogs in house on a normal day, 50 kennels total (20 regular, 10 small, 20 special needs). Training programs priced $2,395, $3,295 and $3,795. A $500 bootcamp deposit, and a $50 per dog holiday boarding deposit. **[V]** read from her systems 9 Aug.\n\n**Two numbers in that paragraph used to be wrong and are now stated properly, because both move.** Ad spend: her own card page read **$671.74 over seven full days** at 23:06Z on 9 August **[V]**; an earlier version of this file said \"~$719 a week\", which was never a reading. Inquiries: **144 a week averaged over the first month, about 183 a week over the last month, and `POST /contacts/search` on the last seven days returns 161 or 162 depending on the hour you ask** **[V]** 9 Aug. Her card page separately shows **159 Facebook conversations started in the last seven full days**, which is an ad platform metric and **not** an inquiry count; do not merge the two. There is no single right number. **Quote a window and a source, or do not quote it.**\n\n**How she works.** She writes long, in bursts, often late at night, numbered or in blocks. She answers questions in the order asked. She checks things herself and catches real errors, including ones the CRM alone could not show. She is technically literate enough to spot a contradiction and not so technical that jargon helps.\n\n**What she cares about.** Knowing which dogs are in the building today. Not being asked twice for the same answer. Not having her staff blamed. Money she can trust. Being told when something is wrong before she finds it.\n\n**What she has objected to, specifically. [V]** from her own words in the thread:\n- British English. \"how you're getting on\" corrected to \"how it's going\".\n- The word **daycare**. She does not offer it. This is a factual error, not a preference.\n- \"I got your message\" as an opener. Her reply: \"What message am I replying to exactly?\"\n- Copy that says what a thing is **not**. \"just tell them what it is rather than what it isn't.\"\n- Negative framing. \"I'd rather remove language about what I won't do.\"\n- Being asked something she has already answered.\n\n**Her tone to us.** Direct, warm, practical. No pleasantries padding. She says \"Excellent\" and \"Exactly the right call\" when pleased and states problems flatly when not.\n\n**Temperature, honestly.** Good with us. She is furious with Kristian and has spent a week documenting his failures forensically. **Three** of our own errors reached her this week. One, the Friday report reading the wrong source field, was self caught and corrected within hours and she absorbed it without complaint. **Two are still wrong in her hands in writing**: the counter sales figure, §6.3, and the \"15 into Customer\" number, §1.6. Do not describe our error record to anyone as clean. The risk is not anger, it is one more disappointment landing on an already exhausted person.\n\n---\n\n## 3. COMMERCIALS\n\nEverything in this section is **[C]** from earlier session files, not verified against Upwork itself. Verify before quoting any of it to anyone.\n\n- **Retainer $700 a month**, described as Google $350 + Facebook $150 + GHL $200. Upwork contract **#44066641**, contract title \"GHL Expert for Meta Pixel Integration\". Started 10 July 2026 as a $30 audit and grew. **[C]** `MINED-OLD-TREES.md` §1\n- **Phase 1 nurture build, $1,850 one time**, accepted by Kim in writing 25 July. Intended to go on a **new separate contract as a single milestone**. No evidence it was ever raised. **[C]**\n- Retainer work does **not** count toward the $1,850. **[C]**\n- A future **~$1,100 a month nurture ops line** was planned for late August, after the follow up system has run 30 days live. Explicitly not to be pitched early. **[C]** **That timeline is already gone.** The engine has 0 days live as at 9 August **[V]** §5, so even a go live today puts 30 days live at about 8 September. Late August cannot happen. Say September, or say nothing.\n- **Two figures are banned from reuse** and nobody recorded why: the \"$650 to $850 Messenger figure\" and the \"543 times asked\" breed framing. **[C]**\n- **Kristian Moore / Moore Cre8ive: $11,500 fixed price**, signed 5 March 2026, still in QA. This is Kim's money, not ours, but it is the budget line that frees up if he is replaced. **[C]** `tds_docs/qa.docx`\n- **[U]** Whether the $1,850 contract was ever raised, and what milestones 5 and 6 actually are. Settled by opening Upwork contracts.\n\n**Direction of travel.** The commercial goal is to take the retainer from $700 toward $2,000 to $3,500 by absorbing the GoHighLevel estate and the voice agent after Kristian's handover, priced as a separate takeover project plus a larger retainer. Do not quote a number before seeing what is actually handed over.\n\n---\n\n## 4. THE SYSTEMS\n\n### Ours\n\n**Every live endpoint, and the list is now complete.** The first seven rows below are on val `dogsspot_puppy_path`; the Square bridge is a separate val with its own secret; the watchdog is a third val and, as of 9 Aug, **the main val's admin key works on it**. Append `?k=` to reach them.\n\n**Where the admin key actually is, and this is not what an earlier version of this file said.** It is **not** in `handover/RESUME.md`. RESUME.md only points at `DELIVERY/ENDPOINTS.md`, and that file exists in exactly one place: **`/home/claude/dogsspot/DELIVERY/ENDPOINTS.md`**, the old tree, which is **not in the bundle and not on the val**. **[V]** searched the whole tree 9 Aug. The engine stores only `NURTURE_ADMIN_KEY_SHA256`, so the key cannot be read back out of the code either. **If this container is reclaimed, the admin key is gone**, and the only way back is Amir setting a new digest in the val.town environment UI. **Kim's view key is different and is recoverable**: it is in `handover/REPLY-AUG5.txt`, which is bundled. **[V]**\n\n| Route | URL |\n|---|---|\n| run | `https://amir5--be37b5848e7611f1b9e01607ee4eb77e.web.val.run` |\n| dashboard, Kim's card page | `https://amir5--fb119304902811f182781607ee4eb77e.web.val.run` |\n| report | `https://amir5--7a35076a901f11f18a2e1607ee4eb77e.web.val.run` |\n| api | `https://amir5--ad633fec8e7311f1b8001607ee4eb77e.web.val.run` |\n| paths | `https://amir5--243d2a8e8e7811f1bbbc1607ee4eb77e.web.val.run` |\n| aged | `https://amir5--58225aaa8e7711f190c91607ee4eb77e.web.val.run` |\n| deposits | `https://amir5--2e97d0d291ad11f1a57d1607ee4eb77e.web.val.run` **never with `run=1`** |\n| Square bridge | `https://amir5--41ace24c7e2111f18c9d1607ee4eb77e.web.val.run` **separate val, separate secret** |\n\n**[V]** all read from the val's own files API, 9 Aug. The `?k=` admin key works on the seven `dogsspot_puppy_path` routes only. **The Square bridge is a separate val with its own `ADMIN_SECRET`**, masked in its environment page but present as a literal in `engine/dashboard.ts:41`, which is world readable, so it **is** obtainable. Its journal dump is `?dump=1&admin=`, and the parameter is `admin`, not `k`. Its bare URL returns a version string with no key at all, which is the fastest liveness check. Kim reaches the dashboard with her own view key, which is a different string from the admin key and is recorded in `handover/REPLY-AUG5.txt`. It is **not** in `handover/RESUME.md`; that file holds no key at all.\n\n**DO NOT CALL THE WATCHDOG ENDPOINT. Calling it is a full run, and it writes.** An earlier version of this file said \"it holds no write verbs, so calling it is a read\". That was wrong and it is the most dangerous sentence this document has ever carried. `watchdog/run.ts:19` invokes the same `watchdog()` the interval invokes. That function **sends email** (`watchdog/main.ts:597` on trouble, `:608` \"all clear\", the second gated on `getUTCDay() === 1`, which is **Monday**) and **writes blobs**: `ALERT_KEY` at `:601` and `:612`, and `CHECK_KEY` at `:619`. `CHECK_KEY` is the scan checkpoint that decides which journal rows count as new, so **a hand call silently advances it and real bridge errors since the last scheduled pass stop being new and never surface**. The alert fingerprint works the same way: fire it by hand and the next scheduled pass goes quiet. **[V]** read from source 9 Aug. **It was called by hand twice on 9 August, at 22:49:36Z and 23:14:26Z, before this was understood, so treat the alert window from 23:14Z as consumed.** You can see this without touching it: `api?k=&f=json` exposes the watchdog's own blob. **Read that blob instead of calling the endpoint.** Note that `lastTrigger` only reads `manual` until the next scheduled pass overwrites it, which is within the hour, so `scheduled` is the normal reading and is **not** evidence this warning is stale. Compare `lastAutoTs` against the hourly cadence instead.\n**To inspect it, read its source instead**, unauthenticated: `https://api.val.town/v2/vals/238d32db-e45f-493d-ae45-91cfa664542f/files/content?path=main.ts`.\n**It read wrong at 22:49Z and the diagnosis in an earlier version of this file was wrong too.** It printed the superseded 42 and $33,535.99 and asserted they were \"the same figures the dashboard shows\" when the dashboard said 33 and $22,651.99. The earlier explanation, that the watchdog \"holds its own copy of the logic\", is false: `watchdog/main.ts:299` does `await import(\"https://esm.town/v/amir5/dogsspot_puppy_path/facts.ts\")` and calls the engine's own `squareBacklog`, unpinned, and the file contains **zero** occurrences of \"totalling\" or \"totaling\" **[V]** live source read 9 Aug, byte identical to local, val version untouched since 5 Aug. **There is no copy to fix.** The two real causes are a **stale cached esm.town import** and a **different input**: the dashboard passes the live bridge dump, `watchdog/main.ts:255` passes the `m2_bridge_journal` blob. See §9.\n\n**Calling the `run` endpoint is not a health check, it is a run.** `engine/run.ts` imports the same `cron()` the scheduler calls, deliberately, so there is exactly one code path. Today that is harmless because `testMode` is true. **The moment the nurture system goes live, a bare `run` call is a real send pass.** For liveness use **`?k=&dry=1`**, which reports that the endpoint is wired and invokes nothing **[V]** `run.ts:52`. Change the habit now, not on go live day.\n\n**A green test run is not proof on its own.** §9 records that a whole suite can vanish and `run-all` still prints GREEN, and that a test can be hollowed to a stub and still print PASS. Trust `negative-controls.mjs`, which injects real faults, over `run-all.mjs`.\n\n| Piece | What it is | Where | How you know it works |\n|---|---|---|---|\n| **Nurture engine** | The follow up messaging system. 41 messages across 6 tracks. Runs on an interval. | val.town val `dogsspot_puppy_path`, id `1bfa6e81-74e1-4c6c-ab32-118304a4ffff` | **Read it without running it:** `api?k=&f=json` returns the engine's own stored last run, which showed `ok:true, v:\"1.7.1\", testMode:true` at 22:00:33Z **[V]**. A live `run` call returns `{triggeredAt, report:{...}}` with that object nested under `report`, never at the top level; an earlier version of this file quoted the nested shape as if it were the response. |\n| **Kim's card page** | Her status page. Live ad spend, questions awaiting her, a work log. | `dashboard` http route | 200 on **both** the admin key and Kim's own view key **[V]**. About 70,900 bytes and moving: it is generated per request and drifted 150 bytes inside ten minutes, and the short reads were the page carrying **\"Needs a look: the CRM is not answering\"**. **A byte count is a liveness check, not a correctness check.** Check the body for that sentence: **zero hits is healthy, one hit means the CRM feed is down.** |\n| **Weekly report** | Friday report generator | `report` http route | 200, 9,104 bytes **[V]** |\n| **api** | **The control panel. Carries the STOP switch, `&stop=1` and `&go=1`, and it is the only route on this val that writes state.** Also serves the engine's own last run as JSON with `&f=json`, which is how you read the engine without running it. | http route on the same val | 200 **[V]** |\n| **paths / aged / deposits** | Supporting read routes | http routes on the same val | all 200 **[V]** 21:45Z |\n| **Square money bridge** | Reads Square payments, writes a note on the contact, feeds the deposit tracker and a Facebook purchase signal | val `dogsspot_m2_bridge`, id `29b95261-feff-47f1-9a81-1efec1642b61` | responds \"M2/M3 bridge up (v3.8)\" **[V]** |\n| **Watchdog** | Independent checker of the engine | val `dogsspot_watchdog`, id `238d32db-e45f-493d-ae45-91cfa664542f`, endpoint `https://amir5--d05eb3b2901e11f1b0241607ee4eb77e.web.val.run` | **DO NOT CALL IT. See the warning directly below this table.** |\n| **Money matcher** | New 9 Aug. Decides which booking a payment belongs to. Dry run only, structurally cannot write. | `engine/money-match.ts`, deployed v530, not wired to any route | 14 tests pass, one greps the module for POST/PUT/PATCH/DELETE **[V]** |\n\n- **Local repo**: `/home/claude/restore`. **125 files = 56 bundled + 23 engine + 27 generated `build/` + 16 bundle parts + 3 backed up nowhere.** The three are the two derived PDFs in `handover/` and an empty evidence dump; nothing is lost if they go. **[V]** counted 9 Aug, and §13 tells you how to recount. `node scripts/deploy.mjs --check` reports **\"live matches local, every file\"** **[V]** re-run 23:06Z, 23 of 23 same. That means every **engine** file. It does not look at tests, scripts or documents, and it cannot see `NOTES-v1.4.md`, which is on the val, is not local and is not bundled, and is the one file §9 nominates as the overflow home for `main.ts` comments.\n- **Tests**: `node tests/run-all.mjs` → **18 suites, 394 assertions, 0 failed** **[V]** re-run 9 Aug, plus `typecheck: 23 engine files, 0 real errors`. `node tests/negative-controls.mjs` → **203 passed, 0 failed** **[V]** re-run in full on 9 August. The file is intact, 2,126 lines, terminates cleanly, and carries `EXPECTED_CONTROL_COUNT = 203` as its own anti truncation guard, which matters because §9 records it being silently truncated twice. Takes about 6 minutes; run it in the background.\n- **Deploy**: `node scripts/deploy.mjs --push`. **Snapshot**: `node scripts/deploy.mjs --check` first, then `node scripts/bundle.mjs && node scripts/deploy.mjs --bundle`.\n\n**The engine reads twenty one environment variables and no API lists them.** Four routes were tried and all 404, so the only way to see them is the val.town environment UI, which needs Amir. Knowing the names matters because several change behaviour silently. **[V]** grepped from `engine/*.ts` 9 Aug:\n\n`ACKNOWLEDGE_SURGE` · `BRIDGE_ADMIN` · `ENROLL_SURGE_THRESHOLD` · `FOREIGN_QUIET_HOURS` · `GADS_TOKEN` · `GHL_TOKEN` · `MAX_SENDS_PER_DAY` · `MAX_SENDS_PER_RUN` · `META_AD_ACCOUNT` · `META_TOKEN` · `MIN_SEND_GAP_HOURS` · `NURTURE_ADMIN_KEY_SHA256` · `PAUSE_TIMEOUT_DAYS` · `PHONE_DISPLAY` · `SAFETY_SWEEP_HOURS` · `SEND_WINDOW_END_HOUR` · `SEND_WINDOW_START_HOUR` · `SHORT_BOOKING_LINK` · `SMS_SUNDAY_OK` · `TAG_SOURCE_SIGNAL` · `TEST_MODE`\n\nThe five that will bite you: **`TEST_MODE`** is the go live flag, §11. **`TAG_SOURCE_SIGNAL`** overrides the enrolment tag, so §8's \"the engine uses `nurture - puppy`\" is only true while it is unset. **`ENROLL_SURGE_THRESHOLD`** defaults to 25 and holds all enrolment above it. **`SEND_WINDOW_START_HOUR` / `SEND_WINDOW_END_HOUR` / `SMS_SUNDAY_OK`** decide whether anything goes out at all at a given hour. **`GHL_TOKEN`** is the one the key rotation in §11.6 has to move, and no earlier version of this file named it.\n\n### Hers, that we touch\n\n- **GoHighLevel** is the CRM and the centre of everything. Location id `BQHJ19uohldYe3eqA0bl`, agency \"Pet Biz Experts\". Base `https://services.leadconnectorhq.com`.\n- **Square**, point of sale and card payments.\n- **Wix**, the website `thedogsspotga.com`. The booking form feeds Milton's app.\n- **Meta and Google Ads.**\n\n### Hers, that we do not own, plus one of ours that touches her customers\n\n- **Kristian's application**, `app.thedogsspotga.com`. Next.js, Clerk auth, Stripe, Supabase, Railway. Staff routes at `/dashboard`, `/bookings`, `/occupancy`; customer portal at `/portal`. **[V]** fingerprinted live.\n- **Milton's booking portal**, `book.thedogsspotga.com/app`, labelled \"Staff Booking Portal\". **This is Kim's actual source of truth for who is in the building.** **[V]**\n- **Chloe**, a voice agent that answers her phones, built by Kristian inside GoHighLevel. Becomes ours at handover.\n- **Ava**, an automated Facebook and Instagram reply bot. It runs on Kim's channels and **Amir maintains it**, so it is ours to operate. Listed here because it touches her customers, not because it is hers to fix. **[C]**\n\n### Credentials, locations only, never values\n\n**Read this before you read the list.** **The val is world readable.** `api.val.town` serves this val's file listing, `main.ts` and every SOURCE-BUNDLE part with **no Authorization header at all** **[V]** tested 9 Aug, four endpoints, HTTP 200. That is what makes disaster recovery possible, §13, and it also means **everything in the bundle is public to anyone holding the val id**. Three exposures, and one of them was closed tonight. `scripts/deploy.mjs` is bundled and carries the **val.town API token** as a literal, still exposed. `handover/REPLY-AUG5.txt` is bundled and carries **Kim's view key**, still exposed. The **live GoHighLevel token** was sitting in `MINED-OLD-TREES.md` and `handover/PLAN-TO-FINISH.md`, both bundled and therefore public; **it was redacted out of every repo file on 9 August and the bundle rewritten** **[V]**. Assume it was readable for some period and rotate anyway. This is an argument for the key rotation, §11.6, not an argument against the bundle, which is the only reason this project still exists. **Never add a secret to a bundled file**, and if you rotate, rotate to the val's environment variables, never into source.\n\n- **GoHighLevel private integration token**: in the val environments, and in the old tree at `/home/claude/dogsspot/`. **It is NOT in `scripts/deploy.mjs`**, which an earlier version of this file said; that file holds only the val.town token. **This same GHL token is the one Kim pasted into the Upwork thread on 31 July and it is still live.** **[V]**\n- **Kim's view key** is `sha256(token + \":view\")`, prefixed `tds_view_` and truncated to 32 hex, `dashboard.ts:72`. Recorded in `handover/REPLY-AUG5.txt`, which is bundled, so it is recoverable. **Deleting the GHL token silently kills her page** **[V]** reproduced, and the derivation was reproduced from first principles on 9 Aug.\n- **val.town API token**: in `scripts/deploy.mjs`, and that file is bundled and public.\n- **Nurture admin key**: **only** in `/home/claude/dogsspot/DELIVERY/ENDPOINTS.md`, which nothing backs up. See the endpoint note above and `QUEUE.md` item 0.\n- **Square bridge `ADMIN_SECRET`**: **it is published, and an earlier version of this file said the opposite.** It is a 51 character literal at `engine/dashboard.ts:41`, and that file is served by `api.val.town` with **no Authorization header**, so anyone with the val id has it. **[V]** fetched unauthenticated and used successfully against the bridge `?dump=1` route, 9 Aug. It is also in the bridge val's own environment page, masked, which is what the earlier claim was about. **Add it to the rotation blast radius in §11.6**; a rotation scoped to the old list would leave it live. When rotating, drop the literal fallback so the environment variable is required.\n- Bridge `ADMIN_SECRET`: **it is readable, see the credential list below.** An earlier version of this line said \"exposed by no API, ten routes tried\", which was true of the val's environment API and false of the code. The journal dump works: `?dump=1&admin=`, returning 760 rows **[V]** 10 Aug. **Note the parameter is `admin`, not the `k` used on every other route**; `k` returns 403 and looks like a dead end.\n- **Required GHL headers**: `User-Agent: curl/8.5.0` or you get 403. `Version: 2021-04-15` for calendars and appointments, `2021-07-28` for everything else. **[V]**\n\n---\n\n## 5. WHAT IS BUILT, HONESTLY\n\n**These percentages are internal. Never quote one to Kim, and do not assume she cannot already see one.** Her card page carries a work log in plain language; no percentage is on it today, but the page is generated from code and a careless edit could put one there tomorrow. Reporting 75 percent and then correcting it to about 40 already cost credibility once. Tell her what works and what does not, not a number.\n\n| Workstream | % | Status and receipt |\n|---|---|---|\n| Facebook ad tracking | 90 **[V]** | Live. Card page reads Meta spend per request, no cache. The missing `ads_read` permission was granted 9 Aug and watched working. |\n| Attribution, ad to lead | 60 **[V]** | The join is proven and reproduces on demand: contacts carry `attributionSource` with a medium and an `adId`. Re-derived 9 Aug on the first 100 of 161 contacts added in seven days: **77 Facebook, 5 Instagram, 71 carrying an ad id** **[V]**. An earlier reading of a different, undated week gave 149 / 117 / 10 / 97 **[C]**. The window moves, so re-derive, never quote. It was proven **by hand** and is not automated or tested. Do not describe it as built. |\n| Kim's card page | 88 **[V]** | Live on her own key, 70,875 bytes. Carries her answers so it stops re asking. |\n| Weekly report | 80 **[V]** | Corrected version built. Two bugs fixed 9 Aug, see §9. |\n| Nurture, the build | 92 **[V]** | 41 messages, her six wording changes live and byte identical to local, 16 checks pin them. |\n| **Nurture, live** | **0** **[V]** | Has never messaged a real customer. `testMode:true`. |\n| Nurture, the email half | 45 **[V]** | Texting verified. Email currently sends from a shared LeadConnector address. `GET /locations/{id}` returns `defaultEmailService: \"\"`, so no dedicated sending domain exists. |\n| Square money into the CRM | 75 **[V]** | Bridge live since 13 July and it already writes a note onto the contact. **Value** writing, the amount onto the booking, is the part not switched on, deliberately, see §7. Matcher built and tested 9 Aug. |\n| Holiday deposit, $50 a dog | 45 | Tracker exists, lists who paid and counts per dog **[C]**. Making the deposit **required** is a new build **Kim approved in writing 9 Aug [V]**, and nothing has been built since **[V]** by absence from the repo. |\n| Bootcamp deposit, $500 | 80 **[V]** | Website corrected to $500 on 2 Aug and verified. Which processor it charges is unknown. |\n| Google ad tracking | 20 **[V]** | `dashboard.ts googleWeek()` returns `null` when `GADS_TOKEN` is unset and throws when it is set; either way `dashboard.ts:504` discards the result inside a `try`. No Google figure is ever computed. **Every Google figure ever sent to Kim was typed by hand.** |\n| Revenue and ROAS | 25 **[V]** | **Revenue** is blocked on one field, see §7. **ROAS is blocked on two**: that field, and the spend side, where Google is a stub that throws. Kristian's answer does not finish ROAS. |\n| Her open request list | 35 | **[U]** 34 items claimed as 12 closed with proof, 6 partial, 16 open. **No register anywhere in the repo or on the val enumerates them**; this table is the only record of the split, so it has no receipt. Settled by writing the 34 out with a status each and bundling the file. |\n| Key rotation | 10 **[V]** | Not started. Blast radius mapped. |\n| Chloe and the app | 0 | Not ours until handover. |\n\n**Started and abandoned:** a plan to build the nurture system as six native GoHighLevel workflows. Abandoned because `POST /workflows/` and `GET /workflows/{id}` both 404 and the Workflows UI is an unscriptable cross origin iframe. Replaced by the external val.town engine. **[C]** and consistent with a live 404 I reproduced.\n\n---\n\n## 6. PROMISED AND NOT DELIVERED\n\n**How these were established:** the wording of each promise is **[V]** from the live Upwork thread, read in full on 9 August. Whether each is still outstanding is **[V]** by absence of the deliverable, not by trusting an earlier handover. §9 records that a previous handover claimed a message was sent that never was, so the thread is always the source, never a status file.\n\n**Not ordered by date.** **Items 2, 3 and 7 are past due. Items 1, 5 and 6 fall due Monday 10 August. Item 4 is due this coming week.**, alongside the call. Items 8 and 9 are due 11 and 12 August, are not late yet, and are blocked by the freeze without her having been told. Item 10, the Pups Club unsubscribe, is due 13 August and is blocked by nothing except nobody starting it. **Item 11 is not a promise at all, it is a correction owed, and it is due at Monday's call.** Where a date reads \"on \" it is when the promise was made; where it reads as a weekday it is when the thing is due.\n\n1. **The four DNS lines for her sending domain.** Promised \"today\" on 9 Aug, then \"tomorrow\". Cannot be produced until someone creates the dedicated sending domain in her CRM, which needs Amir's login. **[V]**\n2. **The Wix payments answer**, which processor the bootcamp deposit charges through. Promised 9 Aug. Two minutes on one screen. **[V]** still open.\n3. **The corrected counter sales number.** Amir told her 42 unmatched worth $33,535.99, then told her that was overstated. The true figure, 33 worth $22,651.99, is now live on her page but she has not been told it in a message. **[V]**\n4. **The overlap review** of five no sale and tips sequences against two auto responders. Promised \"this week\" on 9 Aug, so it is **due this coming week, not past due**. **[V]** not started.\n5. **The dates bug**, her list showing times without dates. Promised as Monday's first job on 8 Aug. **Reproduced 10 August and located to four hardcoded strings** **[V]**, see §11 item 4. Earlier versions of this file said \"never reproduced\"; nobody had looked in the copy modules.\n6. **The holiday deposit build** with nonrefundable wording, shown before it goes live. She approved it in writing 9 Aug **[V]**; that nothing has been built since is **[V]** by absence from the repo.\n7. **The key rotation.** Open since 31 July. **[V]**\n8. **Two calendars**, a Free Training Day pick up calendar and a second Pup Talk calendar for Candice. Promised \"both by Tuesday\" on 7 Aug. **Correctly blocked** by the Kristian freeze, but she has not been told they are blocked in those words.\n9. **Tag cleanup and the Free Training Day workflow rebuild.** Promised Wednesday 12 Aug. Also inside the freeze.\n10. **Pups Club self unsubscribe.** Promised Thursday 13 Aug. **[V]** not started.\n11. **The one number to correct**: \"15 moved into Customer since 10 July\" is wrong. **[V]** See §1.\n\n---\n\n## 7. WHO IS WAITING ON WHOM\n\n### She is waiting on us\n- The four DNS lines. Blocks branded email entirely.\n- The Wix processor answer. Blocks closing the bootcamp deposit item.\n- The corrected counter sales figure in a message. She has a wrong number in writing.\n- The dates bug. Promised 8 Aug, due Monday.\n- **The key rotation, open since 31 July. This is the oldest outstanding item on the account**, and it is also blocked on her, below.\n- The overlap review, the holiday deposit build, the Pups Club unsubscribe.\n\n### We are waiting on her\n- **A day and a window for the nurture switch on.** Fifteen minutes. Asked repeatedly and never answered **[V]**. This file has said five and `QUEUE.md` has said four; nobody has counted them against the thread, so **[U]** the exact number and it does not matter. What matters is that it has been asked more than once and is still open. **This is the biggest thing we are waiting on her for.** It is not the most urgent thing overall: §1 puts Monday's call above it, and §11 ranks the work eighth, because it is blocked on her word and on the freeze and Monday is neither.\n- The name of the private integration row she deleted, so the key rotation can be done safely.\n\n### We are waiting on Kristian\n- **Does his application write opportunity VALUES, or move pipeline STAGES?** Two different questions and **neither is settled**. What is settled is only that his app touches opportunities at all: he stated in writing on 7 August that it creates and updates them, which is **[C]**, his own words about his own software, never checked against the CRM. He has **not** been asked, and has not said, whether it writes the `monetaryValue` field or moves cards between stages **[U]**. Those are the two fields our matcher would touch. Until he answers, the matcher stays in dry run.\n **Why the dry run, when the matcher provably cannot overwrite:** test MM-f proves it never touches a booking that already carries a value, so it cannot destroy his data. The remaining risk is the other direction: if his app writes values on its own schedule, the two would produce a figure that changes under Kim without explanation. That is a trust problem, not a corruption one, and it is still worth one email to avoid.\n This unblocks **revenue**. It does not unblock **ROAS**, because the spend side still has Google at 20 percent with a stub that throws.\n- The handover itself: documentation, runbook, credential sheet, GitHub, Supabase, Railway. His list omits **Clerk, the environment variables, Stripe and DNS**, without which the repo is unusable. **[V]**\n\n---\n\n## 8. DECISIONS AND WHY\n\n- **External engine, not native GoHighLevel workflows.** The workflow API is unusable. Do not \"simplify\" this back into GHL. **[C]**\n- **Practice mode is the default and only the literal string `false` disarms it.** So a missing or malformed environment variable fails safe. **[V]** in source.\n- **The send guard fails closed, the kill switch fails open.** Deliberately asymmetric: an unrecoverable send to a real customer is worse than the system going quiet. **[C]**\n- **Foreign sender quiet period.** If any outbound message not from this engine is seen on a contact, sends defer. There are 95 published workflows plus Chloe plus Ava already touching these people and GoHighLevel exposes no way to check enrolment. **[C]**\n- **Per channel consent**, not the top level `dnd` flag, after live sampling found opted out contacts with `dnd:false`. **[C]**\n- **Enrolment is a human applied tag**, `nurture - puppy`, not auto discovery, because no reliable puppy signal exists in the data. Note an earlier file records the tag as `path-puppy`; the engine uses `nurture - puppy`. **[C]** contradiction, engine wins.\n- **Copy lives in its own module** so changing a sentence is never a code change. **[C]**\n- **The money matcher refuses to guess.** One open booking, it places the money. More than one, a person picks. That is Kim's own rule, in her words, 9 Aug at 22:26Z. **[V]**\n- **It never overwrites a value someone else wrote.** Enforced by test MM-f. **[V]**\n\n**Reversed decisions, and what they cost:**\n- Progress was reported to Kim as 75 percent, then corrected to about 40. **[C]**\n- A Friday report told her most of her leads had no source and none came from Facebook. Wrong field. Corrected within 12 hours. Cost: a credibility hit and a rebuilt report. **[V]**\n- A session claimed the CRM never sees Square money. Nobody had queried the notes endpoint. It was there all along. **[C]**\n- Advice to submit Upwork milestone 6 was reversed: submitting reporting work as Google Ads management with no ads work behind it. **[C]**\n\n---\n\n## 9. KNOWN PROBLEMS AND TRAPS\n\n**Environment**\n- **The container has been reclaimed at least four times.** The working tree vanishes entirely. Recovery is in §13. Rebundle the instant anything is green.\n- val.town serves a stale cached read immediately after deploy. It looks like a failed deploy. Re-read.\n- `main.ts`, which is what `engine/puppy_path_v1.1.ts` is called once deployed, is hard capped at 80,000 and sits at **79,157 characters / 79,475 bytes**, live and local agreeing exactly **[V]** measured 9 Aug. That is **843 characters or 525 bytes of headroom**, and `deploy.mjs --check` gates on the worse of the two, so **the number that matters is 525**. Two earlier versions of this file got this wrong in opposite directions by mistaking one unit for the other and then reasoning about which was \"stale\". They were never stale; they were characters and bytes. **Quote neither. Run `--check`, which prints both on every run.** The val refuses a write above the cap, and this project has separately had files silently truncated, so adding even a comment block can break a deploy. If you need room, move code into another module rather than trimming comments. The val refuses a write above the cap, and this project has separately had files silently truncated, so adding even a comment block to that file can break a deploy. `scripts/deploy.mjs --check` prints the current count on every run. If you need room, move code into another module rather than trimming comments.\n\n**Credentials**\n- **The val is world readable and the bundle is on it.** Anyone with the val id can fetch every bundle part with no credential. The bundle contains `scripts/deploy.mjs`, which holds **one** live literal, the **val.town** token, and `handover/REPLY-AUG5.txt`, which holds **Kim's view key**. **The GoHighLevel token is not in `deploy.mjs`** and never was; it was in two bundled documents and was redacted out on 9 August. **[V]** See §4.\n- **The nurture admin key has no backup.** It lives only in the old tree at `/home/claude/dogsspot/DELIVERY/ENDPOINTS.md`, and the engine holds only its digest. A reclaim loses it. **[V]**\n\n**GoHighLevel**\n- Default Python and some default user agents get 403. Send `curl/8.5.0`.\n- Two different `Version` headers by endpoint.\n- `/workflows/{id}`, `/customFields`, `/contacts/{id}/workflow` all 404 or 401 on this token. You cannot read a workflow's steps.\n- The `status` field on opportunities is dead. 0 won, ever. Everything real happens in **pipeline stages**. **[V]**\n- **Paging traps.** `report.ts` used to page the whole location 20 pages deep and filter after, reading 2,000 of 5,800 records. It printed \"2 new customers\" for a week that had 3. Always query per stage and derive page count from `meta.total`. **[V]** fixed 9 Aug.\n- Counts move. `open` was 5,622 in the morning and 5,631 at night. Always say \"as at\".\n\n**Our own code, live and unfixed**\n- **The money matcher overwrites instead of adding, when one customer pays twice toward one booking.** `engine/money-match.ts:76` writes `value: payment.amount`, so two payments resolving to the same opportunity produce two writes and the second wins. **[V]** re-derived twice on 10 August: the **15 AUTO payments land on 13 distinct opportunities**. Laurie Rubnitz has two, **$120.00 and $90.00**, both resolving to opportunity `7yES6q2kajVTQIK6tEx3`, and Ada Arroyo has a harmless $0.00 pair. So the real post run total is **$173,995.00**, not the **$174,115.00** the client page promises, and `summarise()`'s `valuedAfter.count` says 68 when the truth is 66. **No test covers this**: MM-a through MM-n contain no two payments, one booking case. **This must be fixed before the matcher is ever switched live**, because it is the exact class of bug `tests/money-truth.test.mjs` exists to catch: a per item figure summed as though the items were independent. The fix is to group payments by opportunity and write the sum, with a test that two payments to one contact with one open booking produce one write of their total. The client page now says the two are added together, so the code has to match the page.\n\n**Our own code, failures that already happened once**\n- `facts.ts squareBacklog` only examined rows where matching failed, so a payment that matched later stayed in the backlog forever. Overstated Kim's number by $10,884. **[V]** fixed 9 Aug.\n- `bundle.mjs` walked one directory level, silently dropping `tests/fixtures/`. A restored tree came back red. **[V]** fixed 9 Aug, walk is recursive.\n- A test could be hollowed to a stub and still print PASS with identical counts. Only a negative control caught it.\n- A whole suite could vanish and `run-all` still print GREEN.\n- `negative-controls.mjs` was silently truncated twice, printing nothing and exiting 0.\n- Typecheck was never running; esbuild strips types without checking them.\n\n**The watchdog printed a superseded number, and the first explanation for it was wrong**\n- At 22:49Z on 9 August it returned **42 counter sales totalling $33,535.99** and asserted they were \"the same figures the dashboard shows\". The dashboard said 33 and $22,651.99. **[V]**\n- **It does not hold a copy of that logic.** `watchdog/main.ts:299` imports `facts.ts` from esm.town at runtime and calls the engine's own `squareBacklog`, and the source comment at `:295` says that was deliberate, so that there is one computation of the fact and not two. The live file is byte identical to local and its val version has not moved since 5 August. It contains no \"totalling\" and no counter sales arithmetic of its own. **[V]** read from source 9 Aug.\n- **So there is nothing to repair in it, and repairing it is the trap.** Hardcoding a figure there creates the second source of truth the code was written to avoid. The two real causes: a **stale cached unpinned import** from esm.town, which self heals, and a **different input**, because `:255` reads the `m2_bridge_journal` blob while the dashboard reads the live bridge dump. The fix, if it recurs, is to redeploy the watchdog val or pin the import, and to make it read the same dump the dashboard reads.\n- Nobody had ever authenticated to it, so nobody had seen any of this. **When a generated sentence is wrong, find out where the number comes from before you go looking for a file to edit.**\n\n**Client facing**\n- British spellings keep reaching her. \"totalling\" was live on her own page on 9 Aug. **[V]** fixed.\n- Upwork's composer **appends** on paste rather than replacing. Clear the box first.\n- A previous handover claimed a message was sent to Kim that was never sent. Check the live thread, never the handover.\n\n**Third party**\n- Kristian's dashboard says **171 dogs in house**. Milton's portal says **24**. The facility has **50 kennels**. His sync now reports success and the number is still 171, so it is not a connection problem. **[V]** 9 Aug.\n- A $50 Base44 by Wix charge and a $39 Manychat charge have both failed repeatedly. **[V]** If Manychat runs her Facebook and SMS bots, they stop when it lapses. **[U]** which workspace it is.\n\n---\n\n## 10. RULES OF ENGAGEMENT\n\n**Never without Kim**\n- Leaving practice mode. Anything that reaches a real customer.\n\n**Never without Amir**\n- Any message to Kim. Drafts go to `handover/AWAITING-AMIR.md`.\n- Spending money, changing billing, anything irreversible without a tested rollback.\n- Anything requiring his identity or a login only he holds.\n- Editing a live workflow of hers.\n\n**The Kristian freeze**, agreed in writing 7 August between Kim and Kristian: no changes to the application, calendar mappings, workflows or Chloe configuration until his QA is documented. It protects us, because nothing found in his QA can be attributed to us. It currently blocks the two calendars, the tag cleanup, the Free Training Day rebuild, **and step c of the nurture go live runbook in §11**, until Kim exempts that one in writing.\n\n**GoHighLevel is read only from here, with four named exceptions.** The fourth is the one nobody wrote down: **every engine run in practice mode upserts a test contact into her CRM.** `resolveTestDummy()` at `puppy_path_v1.1.ts:953` does `POST /contacts/upsert` for `ZZTEST / PuppyPath-Dummy` carrying Amir's own email. It is called from exactly one place, `:1044`, inside `if (TEST_MODE)`, and it fires on the scheduled interval as well as on a manual `run`. **So it is true today and stops being true the moment §11 step b flips the flag** — at which point the run reaches real contacts instead, which is the whole point and a bigger deal. It is harmless to customers and it is not harmless to her contact table, so know it is there before you tell anyone this engine writes nothing. `POST /contacts/search` is a read that happens to use POST and is always allowed. The **Square bridge already writes a note onto a contact** and has done since 13 July; that is existing, sanctioned behaviour, not a violation. Third, **steps a and c of the go live runbook in §11 are writes**, turning her tagging on and switching one of her workflows off; they are sanctioned only with Amir present and Kim's freeze exemption in writing. Everything else is read only. Note that \"editing a live workflow of hers\" appears above under **Never without Amir**, which is the same rule seen from the other side: it is not a thing a session does alone, ever.\n\n**Lifting it for the money matcher is Amir's call, not a session's**, and only after Kristian answers §7. When it is lifted, the write is narrow, and **the scope is the part that will be got wrong**: `monetaryValue` on an opportunity that is currently zero **and is in the Customer or Won and Paid stage, never any other board**, never any other field, never a non zero value, payments to the same booking summed rather than written over each other, every write logged with the payment it came from. Wired without the stage filter it puts money on **review pipeline cards** and turns the page's \"nobody has to do anything\" into eighteen manual picks. See §1.5. Never call the deposits endpoint with `run=1`. That re collects the whole holiday deposit list from the live CRM and overwrites the stored one. It is slow, spends API quota, and has previously overwritten a complete list with a partial one at a fresh timestamp, so missing customers got no row at all.\n\n**Never say to her**\n- \"daycare\". The term is **Pup Talk** for the consultation call, never \"discovery call\".\n- Anything that blames a member of her staff. Ever, in anything she or they might read.\n- Any credential, key or admin URL.\n\n**Voice for anything she reads**\n- US spelling. Open \"Hi Kim,\". Close with a bare \"Amir\".\n- **No dashes at all.** No em dashes, no hyphens as punctuation. Phone numbers and literal product names are the only exceptions.\n- Answer in the first line. Own mistakes by name.\n\n**What counts as done**\n- Watched working live, at a timestamp you can name.\n- Every check must be able to fail, and must report how many items it inspected. **Zero inspected is a failure, never a pass.**\n- Every negative control must make one **named** test go red.\n- Every number re derived independently before it reaches her.\n- Sandbox, publish, then verify in production. Rebundle the moment it is green.\n\n---\n\n## 11. THE QUEUE\n\nRanked, and **this list is the ranking**. `QUEUE.md` carries more detail and a fuller history, but its numbers are its own and do **not** line up with the numbers here. **Never cross reference by number between the two.** Where this file cites the queue, it cites it by name.\n\n0. **Get the admin key somewhere that survives.** It exists in exactly one unbacked file, §4, and the container has been reclaimed four times. It cannot go in the bundle, because the bundle is world readable. It goes to Amir. One minute, and it expires with this container.\n0b. **Fix the watchdog.** It publishes the superseded counter sales figures and the British spelling, and asserts they match the dashboard. See §9. Nobody reads it today, which is the only reason this is not urgent.\n\n1. **Monday's money call.** Open the money page with her. Correct the \"15\" figure using the exact sentence in §1.6, which is now pasted verbatim into `handover/AWAITING-AMIR.md` §2. **[Ready: the money page exists and both copies match; the corrected wording and the timezone question are at the top of AWAITING-AMIR. What is NOT ready is anything only Amir can do, listed as §0 of that file.]**\n2. **Get Kristian's answer** on whether his app writes opportunity values or moves pipeline stages. Unblocks item 3 and the revenue half of reporting, and nothing else on this list; items 4 to 7 do not depend on him. **[U]** nobody has asked Amir to send that email, and it is his to send, §1.8. It is the cheapest unblock on the board and it is still ranked below Monday's call.\n2b. **Fix the matcher's double payment bug before anything else touches it.** `money-match.ts:76` overwrites rather than adds when one customer pays twice toward one booking. See §9. It is a dry run today so nothing is broken yet, and it would be broken the moment item 3 happens.\n3. **Switch the money matcher live** once he answers **and Amir lifts the read only rule. That is Amir's call, not a session's, §10.** Write only empty fields, log every write, keep the dry run route for proof. Done = revenue on her page.\n4. **The dates bug. Reproduced on 10 August, and it is not a rendering bug, it is hardcoded copy.** Four entries on her card page say a time with no date and phrase it relative to today, so the page tells her \"this evening\" forever: `engine/worklog.ts:283` \"It checked itself at **21:49 this evening**\" (that was 6 August), `worklog.ts:139` \"at **8:20** and my reply at **8:27**\", `worklog.ts:349` \"at **half past six this evening**\", `engine/decisions.ts:213` \"a second call from **4:54 that same afternoon**\". Neighbouring entries do carry a date, which is why it reads as a bug rather than a style. **[V]** The fix is to put the date in those four strings and to stop writing \"this evening\" into copy that outlives the evening. Promised 8 Aug as Monday's first job. The oldest outstanding item is the key rotation, item 6, open since 31 July.\n5. **Sending domain and the four DNS lines.** Needs Amir's GoHighLevel login.\n6. **Key rotation. [Blocked, twice.]** It needs the name of the private integration row Kim deleted before it can be done safely, §7, and the new link has to reach her in a message, which only Amir sends, §10. **Do not start the deletion half of this on your own.** Then: new key, move the val environments, prove her page and the report still load, then delete the old. **Three secrets are in scope, not one:** the GoHighLevel token, which the engine reads as **`GHL_TOKEN`** and which Kim herself pasted into Upwork on 31 July; the **val.town API token** literal in `scripts/deploy.mjs`; and the **Square bridge `ADMIN_SECRET`** literal at `engine/dashboard.ts:41`. All three are inside world readable files. Kim's view key is derived from the GoHighLevel token, so rotating that one is what changes her link. **Her link changes.** Her view key is derived from the token, so rotating it gives her a new URL and kills the old one. She must be sent the new link in the same message that tells her the old has stopped working, or she opens a dead page and concludes we broke it.\n7. **The Wix payments screen.** Two minutes.\n8. **Nurture go live. [Blocked.]** Needs her word, Amir present, a freeze exemption in writing for step c, and an answer to step a's **[U]**. The build is done; the email half is not, so this switches on **texting only** unless the sending domain is finished first.\n\n **Read this before the runbook. Step c switches one of Kim's GoHighLevel workflows off, and the Kristian freeze forbids workflow changes until his QA is documented.** Those collide, and resolving it is not a session's call. **Kim is a party to the freeze and can exempt this.** The go live message must ask her to confirm the freeze does not cover switching off her own unused puppy workflow. She has already said that workflow has never been used **[C]** 6 Aug, which is the argument for the exemption. Do not perform step c without that in writing.\n\n **The runbook, in order, all three inside a few minutes:**\n a. **Turn her tagging on.** Concretely: whatever applies the tag **`nurture - puppy`** to a new puppy inquiry. **[U]** which automation does this, and whether Kim switches it on herself. Settle that before go live day, because if it is a workflow it is inside the freeze too.\n b. On the val `dogsspot_puppy_path`, set environment variable **`TEST_MODE`** to the literal string **`false`**. Any other value, including empty or missing, keeps practice mode on. **[V]** `puppy_path_v1.1.ts:119`.\n c. Switch her old workflow, \"1. Wait 1 Day: Initial Nurture - Puppy\", off.\n **Verify, and an earlier version of this file had this exactly backwards, which is why it is spelled out.**\n Call the `run` endpoint. It must return `testMode:false`.\n **Expect `enrolled:1`, and treat `enrolled:0` on the first live pass as a FAILURE.** The tag `nurture - puppy` carried exactly **1** contact on 9 August, a real person, not in state **[V]**. In practice mode the engine never looks at that tag at all: `puppy_path_v1.1.ts:1042` is `if (TEST_MODE)` and sets `contactIds = [dummy.id]`, so the tag search in the `else` branch never runs. Every `enrolled:0` reading taken so far was the **dummy**, not the tagged contact. They are two different ones.\n **Ignore any send or defer logged against `ZZTEST PuppyPath-Dummy`.** It stays in state after go live and will fire regardless, so \"a send appeared in the log\" is not by itself proof that a real contact was reached. Look for the named contact.\n **Before you flip the flag, check three environment variables**, because each one silently changes what happens: `TAG_SOURCE_SIGNAL` overrides the enrolment tag entirely (`:73`\n","createdAt",["D",1786982941194],"branchVersion","branchId","551774fb-a850-4c9d-94a1-d3509ddcf1b0","id","1bfa6e81-74e1-4c6c-ab32-118304a4ffff","dogsspot_puppy_path",["D",1785429259053],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Puppy path nurture engine v1.2 — The Dogs Spot","imageUrl","d26e64e6-cd39-4be1-b5b4-1de11cc555f8","pinnedFileId","ad633fec-8e73-11f1-b800-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","019f56fd-bd59-724f-8163-80ffcf8235dd","tursoName","1bfa6e8174e14c6cab32118304a4ffff","tursoHostname","1bfa6e8174e14c6cab32118304a4ffff-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789519842404],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_99":98,"_107":103},"org",{"_99":98,"_100":101,"_102":103,"_18":54,"_104":105,"_106":25},"branch",{"_13":88,"_32":89,"_42":41,"_90":43,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":44,"_97":98},"isOwned",1233,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","amir5","handle","displayName","Amir","avatar","https://lh3.googleusercontent.com/a/ACg8ocILk3bwhcvrzozUWm7gxlKoBm7ZGtsgIkesW3ysOOsJ1rSQuA=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_42":43,"_32":44,"_37":1181,"_46":-5,"_47":25,"_48":49,"_50":49,"_51":52,"_53":-5,"_18":54,"_55":56,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":1182,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":1183,"_83":1184,"_85":1185,"_87":25},"tree",[844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927],"files",[844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927],"counts",{"_834":62,"_835":248,"_836":62,"_837":838,"_839":840},"contents",[130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_42":827,"_32":828,"_30":829,"_217":-5,"_40":41,"_39":830,"_219":58,"_37":831,"_13":62,"_33":20,"_34":832,"_24":25,"_224":-5,"_27":833},{"_42":820,"_32":821,"_30":822,"_217":-5,"_40":41,"_39":823,"_219":58,"_37":824,"_13":239,"_33":222,"_34":825,"_24":25,"_224":-5,"_27":826},{"_42":813,"_32":814,"_30":815,"_217":-5,"_40":41,"_39":816,"_219":58,"_37":817,"_13":265,"_33":20,"_34":818,"_24":25,"_224":-5,"_27":819},{"_42":806,"_32":807,"_30":808,"_217":-5,"_40":41,"_39":809,"_219":58,"_37":810,"_13":62,"_33":20,"_34":811,"_24":25,"_224":-5,"_27":812},{"_42":798,"_32":799,"_30":800,"_217":-5,"_40":41,"_39":801,"_219":58,"_37":802,"_13":803,"_33":20,"_34":804,"_24":25,"_224":-5,"_27":805},{"_42":790,"_32":791,"_30":792,"_217":-5,"_40":41,"_39":793,"_219":58,"_37":794,"_13":795,"_33":20,"_34":796,"_24":25,"_224":-5,"_27":797},{"_42":782,"_32":783,"_30":784,"_217":-5,"_40":41,"_39":785,"_219":58,"_37":786,"_13":787,"_33":20,"_34":788,"_24":25,"_224":-5,"_27":789},{"_42":774,"_32":775,"_30":776,"_217":-5,"_40":41,"_39":777,"_219":58,"_37":778,"_13":779,"_33":20,"_34":780,"_24":25,"_224":-5,"_27":781},{"_42":766,"_32":767,"_30":768,"_217":-5,"_40":41,"_39":769,"_219":58,"_37":770,"_13":771,"_33":20,"_34":772,"_24":25,"_224":-5,"_27":773},{"_42":758,"_32":759,"_30":760,"_217":-5,"_40":41,"_39":761,"_219":58,"_37":762,"_13":763,"_33":20,"_34":764,"_24":25,"_224":-5,"_27":765},{"_42":751,"_32":752,"_30":753,"_217":-5,"_40":41,"_39":754,"_219":58,"_37":755,"_13":389,"_33":20,"_34":756,"_24":25,"_224":-5,"_27":757},{"_42":743,"_32":744,"_30":745,"_217":-5,"_40":41,"_39":746,"_219":58,"_37":747,"_13":748,"_33":20,"_34":749,"_24":25,"_224":-5,"_27":750},{"_42":736,"_32":737,"_30":738,"_217":-5,"_40":41,"_39":739,"_219":58,"_37":740,"_13":499,"_33":20,"_34":741,"_24":25,"_224":-5,"_27":742},{"_42":728,"_32":729,"_30":730,"_217":-5,"_40":41,"_39":731,"_219":58,"_37":732,"_13":733,"_33":20,"_34":734,"_24":25,"_224":-5,"_27":735},{"_42":721,"_32":722,"_30":723,"_217":-5,"_40":41,"_39":724,"_219":58,"_37":725,"_13":426,"_33":20,"_34":726,"_24":25,"_224":-5,"_27":727},{"_42":713,"_32":714,"_30":715,"_217":-5,"_40":41,"_39":716,"_219":58,"_37":717,"_13":718,"_33":20,"_34":719,"_24":25,"_224":-5,"_27":720},{"_42":706,"_32":707,"_30":708,"_217":-5,"_40":41,"_39":709,"_219":58,"_37":710,"_13":295,"_33":20,"_34":711,"_24":25,"_224":-5,"_27":712},{"_42":699,"_32":700,"_30":701,"_217":-5,"_40":41,"_39":702,"_219":58,"_37":703,"_13":426,"_33":20,"_34":704,"_24":25,"_224":-5,"_27":705},{"_42":692,"_32":693,"_30":694,"_217":-5,"_40":41,"_39":695,"_219":58,"_37":696,"_13":295,"_33":20,"_34":697,"_24":25,"_224":-5,"_27":698},{"_42":685,"_32":686,"_30":687,"_217":-5,"_40":41,"_39":688,"_219":58,"_37":689,"_13":611,"_33":20,"_34":690,"_24":25,"_224":-5,"_27":691},{"_42":678,"_32":679,"_30":680,"_217":-5,"_40":41,"_39":681,"_219":58,"_37":682,"_13":324,"_33":20,"_34":683,"_24":25,"_224":-5,"_27":684},{"_42":671,"_32":672,"_30":673,"_217":-5,"_40":41,"_39":674,"_219":58,"_37":675,"_13":324,"_33":20,"_34":676,"_24":25,"_224":-5,"_27":677},{"_42":664,"_32":665,"_30":666,"_217":-5,"_40":41,"_39":667,"_219":58,"_37":668,"_13":324,"_33":20,"_34":669,"_24":25,"_224":-5,"_27":670},{"_42":657,"_32":658,"_30":659,"_217":-5,"_40":41,"_39":660,"_219":58,"_37":661,"_13":324,"_33":20,"_34":662,"_24":25,"_224":-5,"_27":663},{"_42":650,"_32":651,"_30":652,"_217":-5,"_40":41,"_39":653,"_219":25,"_37":654,"_13":324,"_33":20,"_34":655,"_24":25,"_224":-5,"_27":656},{"_42":643,"_32":644,"_30":645,"_217":-5,"_40":41,"_39":646,"_219":58,"_37":647,"_13":324,"_33":20,"_34":648,"_24":25,"_224":-5,"_27":649},{"_42":635,"_32":636,"_30":637,"_217":-5,"_40":41,"_39":638,"_219":58,"_37":639,"_13":640,"_33":20,"_34":641,"_24":25,"_224":-5,"_27":642},{"_42":628,"_32":629,"_30":630,"_217":-5,"_40":41,"_39":631,"_219":58,"_37":632,"_13":324,"_33":20,"_34":633,"_24":25,"_224":-5,"_27":634},{"_42":621,"_32":622,"_30":623,"_217":-5,"_40":41,"_39":624,"_219":58,"_37":625,"_13":324,"_33":20,"_34":626,"_24":25,"_224":-5,"_27":627},{"_42":614,"_32":615,"_30":616,"_217":-5,"_40":41,"_39":617,"_219":58,"_37":618,"_13":324,"_33":20,"_34":619,"_24":25,"_224":-5,"_27":620},{"_42":606,"_32":607,"_30":608,"_217":-5,"_40":41,"_39":609,"_219":58,"_37":610,"_13":611,"_33":20,"_34":612,"_24":25,"_224":-5,"_27":613},{"_42":599,"_32":600,"_30":601,"_217":-5,"_40":41,"_39":602,"_219":58,"_37":603,"_13":324,"_33":20,"_34":604,"_24":25,"_224":-5,"_27":605},{"_42":592,"_32":593,"_30":594,"_217":-5,"_40":41,"_39":595,"_219":58,"_37":596,"_13":324,"_33":20,"_34":597,"_24":25,"_224":-5,"_27":598},{"_42":585,"_32":586,"_30":587,"_217":-5,"_40":41,"_39":588,"_219":58,"_37":589,"_13":418,"_33":20,"_34":590,"_24":25,"_224":-5,"_27":591},{"_42":578,"_32":579,"_30":580,"_217":-5,"_40":41,"_39":581,"_219":58,"_37":582,"_13":418,"_33":20,"_34":583,"_24":25,"_224":-5,"_27":584},{"_42":571,"_32":572,"_30":573,"_217":-5,"_40":41,"_39":574,"_219":58,"_37":575,"_13":257,"_33":20,"_34":576,"_24":25,"_224":-5,"_27":577},{"_42":568,"_32":28,"_30":31,"_217":-5,"_40":41,"_39":14,"_219":58,"_37":569,"_13":257,"_33":20,"_34":36,"_24":25,"_224":-5,"_27":570},{"_42":560,"_32":561,"_30":562,"_217":-5,"_40":41,"_39":563,"_219":25,"_37":564,"_13":565,"_33":20,"_34":566,"_24":25,"_224":-5,"_27":567},{"_42":553,"_32":554,"_30":555,"_217":-5,"_40":41,"_39":556,"_219":25,"_37":557,"_13":248,"_33":20,"_34":558,"_24":25,"_224":-5,"_27":559},{"_42":545,"_32":546,"_30":547,"_217":-5,"_40":41,"_39":548,"_219":25,"_37":549,"_13":550,"_33":20,"_34":551,"_24":25,"_224":-5,"_27":552},{"_42":537,"_32":538,"_30":539,"_217":-5,"_40":41,"_39":540,"_219":25,"_37":541,"_13":542,"_33":20,"_34":543,"_24":25,"_224":-5,"_27":544},{"_42":530,"_32":531,"_30":532,"_217":-5,"_40":41,"_39":533,"_219":25,"_37":534,"_13":221,"_33":20,"_34":535,"_24":25,"_224":-5,"_27":536},{"_42":523,"_32":524,"_30":525,"_217":-5,"_40":41,"_39":526,"_219":25,"_37":527,"_13":374,"_33":20,"_34":528,"_24":25,"_224":-5,"_27":529},{"_42":516,"_32":517,"_30":518,"_217":-5,"_40":41,"_39":519,"_219":25,"_37":520,"_13":464,"_33":20,"_34":521,"_24":25,"_224":-5,"_27":522},{"_42":509,"_32":510,"_30":511,"_217":-5,"_40":41,"_39":512,"_219":58,"_37":513,"_13":62,"_33":222,"_34":514,"_24":25,"_224":-5,"_27":515},{"_42":502,"_32":503,"_30":504,"_217":-5,"_40":41,"_39":505,"_219":58,"_37":506,"_13":239,"_33":240,"_34":507,"_24":25,"_224":-5,"_27":508},{"_42":495,"_32":496,"_30":56,"_217":-5,"_40":41,"_39":497,"_219":58,"_37":498,"_13":499,"_33":240,"_34":500,"_24":25,"_224":-5,"_27":501},{"_42":488,"_32":489,"_30":490,"_217":-5,"_40":41,"_39":491,"_219":58,"_37":492,"_13":62,"_33":222,"_34":493,"_24":25,"_224":-5,"_27":494},{"_42":481,"_32":482,"_30":483,"_217":-5,"_40":41,"_39":484,"_219":58,"_37":485,"_13":418,"_33":222,"_34":486,"_24":25,"_224":-5,"_27":487},{"_42":474,"_32":475,"_30":476,"_217":-5,"_40":41,"_39":477,"_219":58,"_37":478,"_13":248,"_33":222,"_34":479,"_24":25,"_224":-5,"_27":480},{"_42":467,"_32":468,"_30":469,"_217":-5,"_40":41,"_39":470,"_219":58,"_37":471,"_13":62,"_33":222,"_34":472,"_24":25,"_224":-5,"_27":473},{"_42":459,"_32":460,"_30":461,"_217":-5,"_40":41,"_39":462,"_219":58,"_37":463,"_13":464,"_33":240,"_34":465,"_24":25,"_224":-5,"_27":466},{"_42":451,"_32":452,"_30":453,"_217":-5,"_40":41,"_39":454,"_219":58,"_37":455,"_13":456,"_33":222,"_34":457,"_24":25,"_224":-5,"_27":458},{"_42":444,"_32":445,"_30":446,"_217":-5,"_40":41,"_39":447,"_219":58,"_37":448,"_13":257,"_33":249,"_34":449,"_24":25,"_224":-5,"_27":450},{"_42":436,"_32":437,"_30":438,"_217":-5,"_40":41,"_39":439,"_219":58,"_37":440,"_13":441,"_33":240,"_34":442,"_24":25,"_224":-5,"_27":443},{"_42":429,"_32":430,"_30":431,"_217":-5,"_40":41,"_39":432,"_219":58,"_37":433,"_13":62,"_33":222,"_34":434,"_24":25,"_224":-5,"_27":435},{"_42":421,"_32":422,"_30":423,"_217":-5,"_40":41,"_39":424,"_219":25,"_37":425,"_13":426,"_33":222,"_34":427,"_24":25,"_224":-5,"_27":428},{"_42":413,"_32":414,"_30":415,"_217":-5,"_40":41,"_39":416,"_219":25,"_37":417,"_13":418,"_33":240,"_34":419,"_24":25,"_224":-5,"_27":420},{"_42":406,"_32":407,"_30":408,"_217":-5,"_40":41,"_39":409,"_219":58,"_37":410,"_13":295,"_33":222,"_34":411,"_24":25,"_224":-5,"_27":412},{"_42":399,"_32":400,"_30":401,"_217":-5,"_40":41,"_39":402,"_219":58,"_37":403,"_13":295,"_33":240,"_34":404,"_24":25,"_224":-5,"_27":405},{"_42":392,"_32":393,"_30":394,"_217":-5,"_40":41,"_39":395,"_219":25,"_37":396,"_13":239,"_33":240,"_34":397,"_24":25,"_224":-5,"_27":398},{"_42":384,"_32":385,"_30":386,"_217":-5,"_40":41,"_39":387,"_219":58,"_37":388,"_13":389,"_33":222,"_34":390,"_24":25,"_224":-5,"_27":391},{"_42":377,"_32":378,"_30":379,"_217":-5,"_40":41,"_39":380,"_219":58,"_37":381,"_13":239,"_33":222,"_34":382,"_24":25,"_224":-5,"_27":383},{"_42":369,"_32":370,"_30":371,"_217":-5,"_40":41,"_39":372,"_219":58,"_37":373,"_13":374,"_33":249,"_34":375,"_24":25,"_224":-5,"_27":376},{"_42":362,"_32":363,"_30":364,"_217":-5,"_40":41,"_39":365,"_219":58,"_37":366,"_13":239,"_33":222,"_34":367,"_24":25,"_224":-5,"_27":368},{"_42":355,"_32":356,"_30":357,"_217":-5,"_40":41,"_39":358,"_219":58,"_37":359,"_13":248,"_33":222,"_34":360,"_24":25,"_224":-5,"_27":361},{"_42":348,"_32":349,"_30":350,"_217":-5,"_40":41,"_39":351,"_219":25,"_37":352,"_13":265,"_33":240,"_34":353,"_24":25,"_224":-5,"_27":354},{"_42":341,"_32":342,"_30":343,"_217":-5,"_40":41,"_39":344,"_219":58,"_37":345,"_13":248,"_33":222,"_34":346,"_24":25,"_224":-5,"_27":347},{"_42":334,"_32":335,"_30":336,"_217":-5,"_40":41,"_39":337,"_219":58,"_37":338,"_13":248,"_33":222,"_34":339,"_24":25,"_224":-5,"_27":340},{"_42":327,"_32":328,"_30":329,"_217":-5,"_40":41,"_39":330,"_219":58,"_37":331,"_13":231,"_33":222,"_34":332,"_24":25,"_224":-5,"_27":333},{"_42":319,"_32":320,"_30":321,"_217":-5,"_40":41,"_39":322,"_219":58,"_37":323,"_13":324,"_33":222,"_34":325,"_24":25,"_224":-5,"_27":326},{"_42":312,"_32":313,"_30":314,"_217":-5,"_40":41,"_39":315,"_219":58,"_37":316,"_13":231,"_33":222,"_34":317,"_24":25,"_224":-5,"_27":318},{"_42":305,"_32":306,"_30":307,"_217":-5,"_40":41,"_39":308,"_219":58,"_37":309,"_13":248,"_33":222,"_34":310,"_24":25,"_224":-5,"_27":311},{"_42":298,"_32":299,"_30":300,"_217":-5,"_40":41,"_39":301,"_219":58,"_37":302,"_13":62,"_33":222,"_34":303,"_24":25,"_224":-5,"_27":304},{"_42":290,"_32":291,"_30":292,"_217":-5,"_40":41,"_39":293,"_219":58,"_37":294,"_13":295,"_33":222,"_34":296,"_24":25,"_224":-5,"_27":297},{"_42":282,"_32":283,"_30":284,"_217":-5,"_40":41,"_39":285,"_219":58,"_37":286,"_13":287,"_33":240,"_34":288,"_24":25,"_224":-5,"_27":289},{"_42":275,"_32":276,"_30":277,"_217":-5,"_40":41,"_39":278,"_219":58,"_37":279,"_13":239,"_33":240,"_34":280,"_24":25,"_224":-5,"_27":281},{"_42":268,"_32":269,"_30":270,"_217":-5,"_40":41,"_39":271,"_219":58,"_37":272,"_13":248,"_33":222,"_34":273,"_24":25,"_224":-5,"_27":274},{"_42":260,"_32":261,"_30":262,"_217":-5,"_40":41,"_39":263,"_219":58,"_37":264,"_13":265,"_33":222,"_34":266,"_24":25,"_224":-5,"_27":267},{"_42":252,"_32":253,"_30":254,"_217":-5,"_40":41,"_39":255,"_219":25,"_37":256,"_13":257,"_33":240,"_34":258,"_24":25,"_224":-5,"_27":259},{"_42":243,"_32":244,"_30":245,"_217":-5,"_40":41,"_39":246,"_219":25,"_37":247,"_13":248,"_33":249,"_34":250,"_24":25,"_224":-5,"_27":251},{"_42":234,"_32":235,"_30":236,"_217":-5,"_40":41,"_39":237,"_219":25,"_37":238,"_13":239,"_33":240,"_34":241,"_24":25,"_224":-5,"_27":242},{"_42":226,"_32":227,"_30":228,"_217":-5,"_40":41,"_39":229,"_219":25,"_37":230,"_13":231,"_33":222,"_34":232,"_24":25,"_224":-5,"_27":233},{"_42":214,"_32":215,"_30":216,"_217":-5,"_40":41,"_39":218,"_219":58,"_37":220,"_13":221,"_33":222,"_34":223,"_24":25,"_224":-5,"_27":225},"07bbc883-3657-42ce-a700-629b0024a8cb","worklog.ts","facd3ee8-9028-11f1-8d98-1607ee4eb77e","parentId",1117,"latest",["D",1786812154376],39,"script","// THE WORK LOG — what changed, what broke, what got fixed. v1.0, 4 Aug 2026.\n//\n// WHY: Kim's dashboard answers \"is it working\" from live data. It cannot answer \"what have you\n// actually been doing\" or \"did something break last week\" from live data, because those are\n// events, not states. This file is the event trail: append-only, plain English, dated.\n//\n// THE RULE: every entry describes something that DEMONSTRABLY happened, with the evidence\n// alongside it. No entry is written for work that was merely intended. If a claim here cannot\n// be checked, it does not go here. Kim reads this; it is the receipts column of the retainer.\n//\n// TWO SOURCES:\n// 1. SEEDED (below): work done by hand, each line traceable to a verification run.\n// 2. AUTOMATIC: the watchdog appends \"broke\"/\"recovered\" pairs to the `tds_worklog` blob, so\n// an outage at 3am and its recovery both appear without anyone remembering to write them.\n\nexport type WorkEntry = {\n at: string; // ISO date (day precision is fine; this is a human timeline)\n // v1.2. A reader noticed that \"Fixed: this page used to state a number nobody measured\" (mine)\n // and \"Fixed: your website was charging half the deposit\" (hers, worth thousands) wore the same\n // label in the same colour, so my errors were hiding among her wins. `mine` is now its own kind\n // and its own word. Her words: \"Separate the two columns and I'll trust the page more, not less.\"\n kind: \"fixed\" | \"built\" | \"found\" | \"broke\" | \"recovered\" | \"changed\" | \"mine\";\n what: string; // one plain sentence, Kim's vocabulary\n evidence?: string; // how it was checked. Optional only for \"broke\" (the alarm IS the evidence)\n};\n\n// Seeded history. Everything below was verified on the date shown; the evidence column names\n// the check. Newest first is handled by the renderer, so this list stays chronological.\nexport const SEEDED: WorkEntry[] = [\n {\n at: \"2026-07-30\",\n kind: \"built\",\n what: \"The puppy follow-up system was built and switched into practice mode, where it does everything except actually send.\",\n evidence: \"It has been running on its own since, writing down every decision it makes. Its first practice run is still on file.\",\n },\n {\n at: \"2026-08-02\",\n kind: \"built\",\n what: \"Candace's welcome email was written and sent so she could start on the phones with the full picture.\",\n evidence: \"Sent 2 August; it is in the sent folder.\",\n },\n {\n at: \"2026-08-02\",\n kind: \"found\",\n what: \"Your website was charging a $250 Bootcamp deposit instead of $500. It was hidden inside the booking form's own settings, which is why nobody could find it.\",\n evidence: \"Fixed and published; the whole live site was then searched for '$250' and it appears nowhere.\",\n },\n {\n at: \"2026-08-02\",\n kind: \"found\",\n what: \"There are 17 Bootcamp bookings on record, from 19 December to 25 July, every one of them taken while the deposit was set to $250. What is not yet known is which of them actually paid one, and that means matching each booking against the payment records.\",\n evidence: \"Counted from your own booking records. An earlier version of this note asked you for a payment permission to finish the job; that was wrong and it is corrected here, because you had already granted it and it has been working since 1 August. Matching the bookings to the payments is work rather than a blocker, and it has not been done yet.\",\n },\n {\n at: \"2026-08-03\",\n kind: \"fixed\",\n what: \"29 people who had texted STOP were never marked do-not-contact in the CRM, so they could still have been messaged.\",\n evidence: \"All 29 marked, then all 29 read back one at a time through the CRM's own records on 4 August. 29 of 29 confirmed, none missed.\",\n },\n {\n at: \"2026-08-03\",\n kind: \"mine\",\n what: \"Three of the people who had texted STOP were on a call list I had already sent to your front desk. That was my mistake. The list was pulled and rebuilt the same day, but whether anyone had already called those three is not something I can see from here, and it is worth asking the desk.\",\n evidence: \"The rebuilt list has every STOP and every gate arrival removed, with a second tab naming exactly who came off it and why. The three names are in that tab, so the desk can be asked about those three specifically.\",\n },\n {\n at: \"2026-08-03\",\n kind: \"changed\",\n what: \"The puppy follow-up messages were updated with your notes: the toy advice now explains the why, and the Pup Talk asks came down from six to four.\",\n evidence: \"The PDF you signed off was generated straight from the live system, not from a draft.\",\n },\n {\n at: \"2026-08-04\",\n kind: \"built\",\n what: \"The slow track you asked for is built: weekly for a month, then every two weeks for six months, then monthly. No sales asks anywhere on it.\",\n evidence: \"29 messages, all written out in the PDF for your sign-off. Nothing sends until you say go.\",\n },\n {\n at: \"2026-08-04\",\n kind: \"mine\",\n what: \"The follow-up system was running slightly older wording than the version you approved. It now runs exactly what you read.\",\n evidence: \"Compared the live wording against the wording you approved, character by character; they now match.\",\n },\n {\n at: \"2026-08-04\",\n kind: \"fixed\",\n what: \"A security review found that text typed by a customer into their own name could end up treated as code inside an email we send, rather than as words. Nobody had done it, and it cannot happen now. Two other holes were found and closed in the same review, one of them in the key that protects the page you are reading.\",\n evidence: \"It came out of an adversarial review alongside two other security findings, and each of the three now has its own automatic check, and those checks are run before anything goes anywhere near your account. For this one that means names holding dollar signs, angle brackets, quotes and stray markup. The old page key was checked afterwards and is dead.\",\n },\n {\n at: \"2026-08-04\",\n kind: \"built\",\n // [was: \"...looks over the whole setup ON A TIMER and raises an alarm...\". Every word about\n // what it checks was verified and still stands. The two words about the timer were not, and\n // on 5 August the timer turned out never to have fired. Kim has read this line. It is\n // corrected here rather than deleted, and the 5 August entry above carries the current state.]\n what: \"A second, separate system now looks over the whole setup and raises an alarm if anything stops working, including if somebody else quietly changes one of your CRM automations.\",\n evidence: \"Run live and watched end to end. It takes a fingerprint of your CRM automations each time it looks, so a change to any one of them shows up as a change rather than as silence. What was NOT checked at the time was whether it starts itself on a schedule. It does not; see 5 August.\",\n },\n {\n at: \"2026-08-04\",\n kind: \"found\",\n what: \"Your CRM still has an old puppy follow-up automation switched on. If our new one went live alongside it, new inquiries would get two sets of messages from you on the same day.\",\n evidence: \"Read all 165 automations in your account. Switching ours on and that one off has to happen together, and it needs your say-so.\",\n },\n {\n at: \"2026-08-04\",\n kind: \"found\",\n what: \"Your CRM records where nearly every inquiry came from, but not in the column it shows you. The column you can see is blank for four out of five people; the record underneath places all of them.\",\n evidence: \"Checked across a full week of inquiries: the column you can see named about one in five of them, the record underneath named every single one. That is where the Facebook and Instagram numbers above come from, and they are recounted every time you open this page.\",\n },\n {\n at: \"2026-08-04\",\n kind: \"mine\",\n what: \"This page used to tell you the follow-up system checks in every 15 minutes. Nobody had ever measured that, and it was not true. It now times itself and reports the rhythm it actually keeps.\",\n evidence: \"The page was saying 'last checked 26 minutes ago' and 'it runs every 15 minutes' at the same time, which cannot both be right. It now measures the gaps between runs and reports what it sees.\",\n },\n {\n at: \"2026-08-01\",\n kind: \"mine\",\n what: \"I sent you a draft of the follow-up messages as though it were the finished thing, and you spent an evening reading the wrong version. That was mine, and the replacement was generated from the live system so it could not happen the same way twice.\",\n evidence: \"Every write-up you have had since is generated from the running system rather than typed, so what you read is what would send.\",\n },\n {\n at: \"2026-08-02\",\n kind: \"mine\",\n what: \"I gave you a missed-calls figure that was too high, because it was counting people arriving at the gate as well as people calling. You spotted it before I did.\",\n evidence: \"Recounted with gate arrivals excluded, and the same exclusion now runs on every list that comes out of here.\",\n },\n {\n at: \"2026-08-03\",\n kind: \"mine\",\n what: \"I told you a list had been deleted and then left the old one sitting in your Drive for a day. Two versions of the same list is exactly the confusion I was trying to save you from.\",\n evidence: \"The old one is in the trash and the folder was checked afterwards; only one version exists.\",\n },\n {\n at: \"2026-08-03\",\n kind: \"mine\",\n what: \"You asked me something at 8:20 that morning and my reply at 8:27 answered everything except that. Answered since.\",\n evidence: \"Both messages re-read against each other so the gap could be found rather than assumed.\",\n },\n {\n at: \"2026-08-04\",\n kind: \"found\",\n what: \"Once it was measured, the follow-up system turned out to be running about hourly and the watchdog slower still, rather than four times an hour as this page used to claim. Nothing is harmed by that, because the messages are scheduled by the day, but it was worth knowing rather than assuming.\",\n evidence: \"Both were watched without being touched, then run by hand to confirm the code itself was healthy. Both ran cleanly. Do not read the rhythm off this line: the health card above measures the gaps between actual runs and prints what it currently observes, which is the only figure either of us should trust.\",\n },\n {\n at: \"2026-08-04\",\n kind: \"mine\",\n what: \"The count of new customers on this page was reading low. It was looking at only the most recent slice of your records, which missed anyone who first got in touch a while ago and only became a customer this week.\",\n evidence: \"The whole Customer list is now read every time rather than the first slice of it, in about a second. For the last seven days that changed the figure from 2 to 5.\",\n },\n {\n at: \"2026-08-05\",\n kind: \"found\",\n what: \"The second system that checks the first one was set to look once a day, not once an hour. It has been changed to hourly. Nothing was broken; it was just looking far less often than the things it watches can go wrong.\",\n evidence: \"Read off its own settings screen: it said once every 1 days, and its last run had been 13 hours earlier. The follow-up system runs on the hour, so a problem starting just after the checker looked could have sat unnoticed until the next day. It now runs hourly, which matches what it is checking. Everything it looks at was still being looked at throughout.\",\n },\n {\n at: \"2026-08-05\",\n kind: \"mine\",\n what: \"This page told you the checker runs itself about every 95 minutes. That came from the times Amir had started it by hand, so it was a real measurement of the wrong thing. I then went further and wrote that its timer was not firing at all. That was wrong twice over: it was firing, and the only reason my new counter showed nothing was that the counter itself was broken.\",\n evidence: \"The two kinds of run are recorded separately now, and both were watched working before this was written: a scheduled run recorded as scheduled, a hand-started one as by hand. The page no longer guesses at causes either. It reports what it has and has not seen and leaves the diagnosing to a person, which is what I should have done before writing that sentence the first time.\",\n },\n {\n at: \"2026-08-05\",\n kind: \"mine\",\n what: \"Two of our systems were describing the same pile of unmatched counter sales with different figures. One said 35 sales worth $23,463.99, the other said 40 worth $28,035.99.\",\n evidence: \"The payment records were counted again from scratch, a third time and by a different method: 40 is correct. The lower figure came from skipping some sales and from subtracting two things that were not the same kind of thing. Both systems now read the same single count, so they cannot disagree again.\",\n },\n {\n at: \"2026-08-05\",\n kind: \"found\",\n what: \"On your missing call transcripts, a correction of ours. This page said earlier that day that transcription had never been switched on. That was wrong: a call from that morning was opened and its full written transcript was watched rendering. Transcription works, at least sometimes, so the real question is which calls are missing theirs.\",\n evidence: \"The wrong version was reasoned from the reading connection, which never carries transcripts, and that gap was mistaken for the transcripts not existing. The corrected question is on the list above: one example from Kim of a call that should have a transcript and does not is the fastest way to pin down the pattern.\",\n },\n {\n at: \"2026-08-05\",\n kind: \"built\",\n what: \"The missing third step is built. Something now works out which of your inquiries is about a puppy, and it runs alongside everything else so you can see what it would do before it does anything.\",\n evidence: \"It has applied nothing and it cannot: the part that decides has no way to change anything in your account, which is checked automatically. Its first run over your most recent contacts is on the question list above, with its own numbers. A full pass over 1,200 of your records is written up separately for Amir to check line by line.\",\n },\n {\n at: \"2026-08-05\",\n kind: \"mine\",\n what: \"My first attempt at spotting a puppy inquiry would have signed up three people who should not have been: a man asking to buy a puppy, a woman rehoming her older dogs, and a dog described as three years and four months old that got read as four months.\",\n evidence: \"Each of those three is now a rule, each rule has a test, and each test has a check that breaks the rule on purpose and demands the test notice. None of them reached anybody, because nothing has been switched on.\",\n },\n {\n at: \"2026-08-05\",\n kind: \"found\",\n what: \"One of your knowledge bases was edited at around half past ten the night before, and nothing was keeping an eye on it. If that was you, everything is fine and this is just us noticing.\",\n evidence: \"The consolidated one, which is what Chloe answers customers from. Nothing on our side touched it. Until the following morning we were watching your 165 automations for changes but not the documents that decide what your business actually says, which was a gap.\",\n },\n {\n at: \"2026-08-05\",\n kind: \"built\",\n what: \"Your knowledge bases are now watched the same way your automations are. If one of them changes, it gets written down with what moved and when, whoever did it.\",\n evidence: \"Running live. It cannot read the wording inside the documents, only that something changed and which one, so it will not police your writing. The part that spots a change is tested on its own, including the case that matters most: a document edited in place, where nothing is added and nothing is removed.\",\n },\n {\n at: \"2026-08-05\",\n kind: \"mine\",\n what: \"The counter I built to prove the checker keeps its own time was itself broken, and it made a healthy system look dead. It recorded nothing for scheduled runs, so the page reported none had happened while they were happening every hour.\",\n evidence: \"Found by opening the running record rather than trusting my own counter: the scheduled runs were there, one line away from where I was looking. Both kinds of run have now been watched being recorded correctly, one of each, before this was written down.\",\n },\n {\n at: \"2026-08-05\",\n kind: \"fixed\",\n what: \"The two contact records for Kristina were merged into one, exactly as you asked. The phone number that survived is the one she actually rang from, the accidental do-not-disturb is off, her Meet and Greet is untouched, and the typo number is gone.\",\n evidence: \"Her inbound call that morning proves which number is real, so that one was kept. The duplicate had also been dropped into the no-sale and tips nurtures, which would have messaged a person who has an appointment booked on Monday; those did not carry over, and one click puts them back if wanted.\",\n },\n {\n at: \"2026-08-05\",\n kind: \"built\",\n what: \"The first two real puppy inquiries are marked and waiting: Walle's owner, whose Pup Talk was that afternoon, and Kristina, who was marked that morning. Nothing sends to either of them while practice mode is on, and the system deliberately stays quiet for anyone with a call still on the calendar.\",\n evidence: \"Both are visible in the count on this page, which reads your records live. The one switch that remains is the practice-mode switch, and that gets thrown deliberately, not quietly.\",\n },\n {\n at: \"2026-08-05\",\n kind: \"changed\",\n what: \"Walle's owner came off the puppy track before it ever sent her anything, and that is the agreed rule working: she booked. Her Free Training Day is on the calendar for Friday morning, her Pup Talk moved to Thursday afternoon, and during those changes the puppy mark came off her record. One inquiry is marked and waiting now, Kristina.\",\n evidence: \"Read live from her record on the evening of 5 August: the Friday booking is on the calendar, the mark is off, and the count on this page reflects whatever is true when you open it. If she should get the puppy messages after her visit anyway, putting the mark back is one click.\",\n },\n {\n at: \"2026-08-05\",\n kind: \"found\",\n what: \"The tag red flag turns out to be wired to a workflow that came with your system: anyone who gets that tag is switched to do-not-disturb. It was put on five people this week, and all five are on do-not-disturb right now, which means nothing will message them.\",\n evidence: \"Each of the five records was opened and read live on the evening of 5 August, and every one shows do-not-disturb on. They are listed by name in the tag report. Taking the tag off does not switch do-not-disturb back off on its own.\",\n },\n {\n at: \"2026-08-07\",\n kind: \"mine\",\n what: \"Two customers could have dropped off your deposit list without anything looking wrong. You have two boarding calendars because a customer can be on either one, and the list is both of them put together. If one calendar failed to answer — a bad connection is enough, and there was no retry — the shorter list was saved over the full one with a fresh timestamp. Anyone who only appears on the calendar that failed was not marked unknown. They were simply gone.\",\n evidence: \"Reproduced end to end before it was fixed: a run reading one of the two calendars dropped a real customer and was still accepted for saving. It now refuses to replace a saved list with one that saw fewer calendars, so the page goes visibly older instead of quietly shorter. A calendar you actually delete still saves normally, and the first run of all still saves even if a calendar is down, because a partial list with a warning on it beats no list.\",\n },\n {\n at: \"2026-08-07\",\n kind: \"mine\",\n what: \"Where two of your bookings sat on the same day, which one the deposit counted against was decided by the order the bookings happened to come back in. Nothing was ever double counted, but a row could move between 'Payment on file' and 'Worth a look' from one hour to the next with nothing changing on your account. The oldest payment now settles the oldest stay, every time.\",\n evidence: \"Found by shuffling the same customer's bookings and payments 841,000 times and comparing the answers. It also fixed a second case: two deposits paid weeks apart, where spending the newer one first left the later stay looking unpaid when it had been paid all along.\",\n },\n {\n at: \"2026-08-07\",\n kind: \"mine\",\n what: \"The deposit page said a missing deposit might have been paid by cash. Your money page lists four ways to pay and cash is not one of them, so that was sending you to look somewhere that does not exist. It names Venmo, Zelle and cheque now, which are the three your card system genuinely cannot see.\",\n evidence: \"Checked against your own money page, which lists Card, Venmo, Zelle and Cheque and nothing else.\",\n },\n {\n at: \"2026-08-08\",\n kind: \"mine\",\n what: \"Friday's report said 120 of your 149 new people had no source recorded and none came from Facebook. That was wrong, and it was wrong because it read the one box in your CRM that is usually empty instead of the ad-tracking record that sits on every one of them. The truth: 117 of the 149 came from Facebook and 10 more from Instagram, and most carry the exact ad that brought them in. A corrected report is owed and coming.\",\n evidence: \"Re-pulled twice on 9 August by two people working separately, from two different doors into your CRM, and the two answers matched to the digit: 117 Facebook, 10 Instagram, none without a tracking record.\",\n },\n {\n at: \"2026-08-08\",\n kind: \"built\",\n what: \"The Friday report went over: what the ads cost, what came in, and where the money side still cannot be answered from your CRM. One line in it was wrong and was corrected the same night, and that correction is the entry above.\",\n evidence: \"Sent on Upwork Friday 11:46 PM with the five page report attached at 12:03. Both are in the thread.\",\n },\n {\n at: \"2026-08-09\",\n kind: \"built\",\n what: \"Facebook finally lets this page read your ad spend. The permission that was missing since the connection was first built is granted, so the advertising card below now shows real dollars from Facebook's own records every time the page loads, instead of saying it is not allowed to look.\",\n evidence: \"Watched working today: the page read $671.72 of spend and 159 started conversations for the last 7 full days, straight from the ad platform, minutes after the permission went on.\",\n },\n {\n at: \"2026-08-09\",\n kind: \"changed\",\n what: \"Your Wednesday answers are in the copy. Message two now opens on the welcome instead of 'I got your message'. Nothing says 'pitch' anymore, it just says what a Pup Talk is. The 'I won't chase you' lines are gone and the 'call any time' lines stay. 'Getting on' reads 'going'. The July and August notes carry the water warning for hot days, and August mentions school going back.\",\n evidence: \"Each change is pinned by its own automated check, so the wording cannot quietly drift back. The two write-ups you have were regenerated from the changed copy today.\",\n },\n {\n at: \"2026-08-09\",\n kind: \"found\",\n what: \"You asked Thursday for two calendars, a Free Training Day pick up and a second Pup Talk calendar for Candace, both by Tuesday. Then Friday evening you and Kristian agreed nothing changes in calendars or workflows until his handover is checked and written down. Those two collide, so the calendars wait for your word rather than being built into a freeze you asked for.\",\n evidence: \"Both are in writing: your Thursday messages on Upwork, and the Friday emails where the freeze was agreed.\",\n },\n {\n at: \"2026-08-06\",\n kind: \"built\",\n what: \"The deposit list keeps itself up to date on its own now. It checked itself at 21:49 that evening with nobody asking it to, and it will do that every hour.\",\n evidence: \"Watched, not assumed. It refreshed by itself at 20:49 and again at 21:49 on 6 August, and the page records which schedule did it so there is no guessing. If a refresh ever fails, the page says how long ago it last managed one and warns you before you act on a name that might be a day old.\",\n },\n {\n at: \"2026-08-06\",\n kind: \"mine\",\n what: \"I had the deposit check charging $50 a stay. Your own money page says $50 per dog, and it was sitting in the handover pack the whole time. Jeffrey Musselwhite has three dogs in over Thanksgiving: that is $150, and one $50 payment would have marked the whole stay settled and taken him off your list.\",\n evidence: \"Fixed and checked against your live account at 20:31 on 6 August. His row now reads $150.00, three dogs at $50. It settles on one payment for the full amount, or on one $50 payment per dog, and on nothing else.\",\n },\n {\n at: \"2026-08-06\",\n kind: \"mine\",\n what: \"The deposit page was telling you a missing deposit might have been paid in cash or over the phone. Your website takes Venmo, Zelle and cheques as well, and none of those reach the card system either. It now names all three, because knowing where else to look is the difference between a ten-second check and a phone call.\",\n evidence: \"Taken from your own money page: card is the only route that matches itself to a customer record automatically. Venmo, Zelle to your email address, and cheques by post all land somewhere this cannot see.\",\n },\n {\n at: \"2026-08-06\",\n kind: \"built\",\n what: \"The holiday deposit check you asked for is on your page. It reads both boarding calendars for Thanksgiving week and 20 December to 2 January, puts one customer's dogs on one line, leaves out your regular weekly bookings and anything cancelled, and shows which stays have a card payment on file. Right now that is two stays, both worth a look.\",\n evidence: \"It ran against your live account at 15:42 on 6 August and the list came back in under three seconds. Jeffrey Musselwhite's three dogs on 25 November show as one stay, not three, and Enzo's standing Friday slot is left out even though it lands inside every holiday window. It will never say somebody has not paid: a deposit handed over in cash or taken on the phone does not reach the card system, so this is a shortlist to look at.\",\n },\n {\n at: \"2026-08-06\",\n kind: \"found\",\n what: \"Your card payments do reach your CRM after all, in two different shapes, and one of them was invisible to me until that morning. Some land as a plain payment line; others land as a till payment matched to a card payment later. I had only been reading the first kind.\",\n evidence: \"Both shapes are sitting on the same customer's record right now with the same $35 on them and two different reference numbers. If somebody's only record had been the second kind, the deposit check would have shown them as having nothing on file. It reads both now, and where the same money appears twice it is counted once rather than doubled.\",\n },\n {\n at: \"2026-08-06\",\n kind: \"mine\",\n what: \"Twice today I had the deposit check guessing which card payment was the deposit, and twice it was wrong in the direction that costs you money. The first version treated any payment between the booking and the stay as the deposit, so a customer's $355 training package marked their $50 as settled. The second only looked at the ten days around the booking, which then missed a real $50 paid eight days later.\",\n evidence: \"It has stopped guessing. A stay is only marked settled by a card payment for exactly $50. Everything else on the account near that stay is listed with its date and amount and left for you to judge, which is the two-second version of what you were doing by hand. A wrong 'worth a look' costs you a glance. A wrong 'settled' costs you fifty dollars and you never find out.\",\n },\n {\n at: \"2026-08-06\",\n kind: \"built\",\n what: \"The deposit list now knows how long a stay actually is, by reading your pick-up calendars as well as your drop-off ones. Jeffrey's three dogs show as 25 to 28 November rather than a single day, and anybody who drops off before a holiday and stays through it now appears at all.\",\n evidence: \"A drop-off booking in your system is a ten minute slot, so on its own it cannot say how long a dog stays. Checked against your live calendars on 6 August: Ghost and Chewy drop off on the 25th and are collected on the 28th, and only the pick-up calendar says so. If a pick-up calendar does not answer, the page says so rather than quietly showing a shorter list.\",\n },\n {\n at: \"2026-08-06\",\n kind: \"mine\",\n what: \"The first time the deposit check ran for real it was about to tell you your card payments had stopped working, on the strength of two customers with nothing on file. Two quiet customers is a normal week, not an outage. I had written the warning to fire whenever nobody at all had a payment, without asking how many people that was.\",\n evidence: \"Caught by watching the first live run at 15:41 on 6 August rather than by reading the code. It now needs at least five customers checked before it will suggest anything is wrong with the payment feed, and the second run at 15:42 gave you the plain list instead of the warning.\",\n },\n {\n at: \"2026-08-06\",\n kind: \"mine\",\n what: \"I told you the customer chased after booking was the only one it had ever happened to. That was wrong, and I said it with more confidence than my checking deserved. Four people were chased after they had already booked, going back to April: Brianna Badger, Janiya Williams, Michelle Burkard and Thomas.\",\n evidence: \"The first answer came from looking at two people with upcoming bookings. The real one comes from every Free Training Day booking you have ever taken, 80 of them across 69 people, each checked against their own messages. Three of the four came to their session anyway. Michelle's first booking was cancelled after her chase and she rebooked five days later, which is an order of events rather than a proven cause.\",\n },\n {\n at: \"2026-08-06\",\n kind: \"found\",\n what: \"Your missing call transcripts, with one thing I got ahead of myself on. No transcript exists on any call older than about three months, and since then almost everything with speech on it has been written down. I told you that was the date transcription got switched on. I cannot actually tell that from here.\",\n evidence: \"207 calls were opened one at a time, everything inside your hundred most recently active conversations, and each was asked directly for its transcript and its recording. Before 11 May: 45 calls, none transcribed, though 38 of them still play their audio. From 11 May: 162 calls, 127 transcribed. Of the 35 without, 31 were nobody answering and 2 failed to connect. In that sample one call was recorded and never written down, on 4 August at 11:09 in the morning. The honest part: the oldest transcript we can find is 87 days old, which is either the day it was switched on or the age at which transcripts get deleted. Those look identical from here. If they expire, you are losing a month of call history every month, so it matters. One query in a week settles it: if the oldest surviving transcript has moved forward, they expire. That check is now on the list.\",\n },\n {\n at: \"2026-08-06\",\n kind: \"built\",\n what: \"While practice mode is on, the parts that actually send a text or an email now refuse anyone except the single test record, and they refuse from a standing start rather than after being told who is safe.\",\n evidence: \"The refusal sits inside the sending functions themselves, so it holds even if something upstream enrolled the wrong person by mistake. It is switched on and running now. There is a test that proves it, and a second check that deletes the guard on purpose and demands that test go red.\",\n },\n {\n at: \"2026-08-05\",\n kind: \"fixed\",\n what: \"A customer who had already booked his Free Training Day got chased by an older funnel to book one, two texts, a voicemail and another text, because that funnel only counts bookings made through its own page and cannot see the calendar. He was taken out of it at half past six that evening.\",\n evidence: \"His record shows no active workflows since the removal, checked after a full page reload. At the time this was written I had checked the two other people with upcoming bookings and found them clean. That was too small a check to carry the sentence it was carrying, and the entry above from 6 August corrects it: four people have been chased after booking, not one. The follow-up system on this page had nothing to do with it: practice mode was on all day and it sent nothing, checked live the same evening.\",\n },\n // THE GO-LIVE. Written 14 Aug 2026, dated to the day it happened. The 5 August entry above,\n // which says nothing sends while practice mode is on, is left exactly as it was: it was true on\n // 5 August and a work log that edits its own past is not a work log. This is its successor.\n {\n at: \"2026-08-11\",\n kind: \"changed\",\n what: \"The puppy follow-up system came out of practice mode and went live on the evening of 11 August, with your written go-ahead that day, and it has been sending to real people ever since. Two people joined it that evening and both have since had the first two messages. The 5 August note saying nothing sends to anybody while practice mode is on was true on 5 August; this is where it stopped being true.\",\n evidence: \"Open your control panel and the banner across the top says the word LIVE where it used to say PRACTICE MODE. It reads that from the system's own record every time the page loads, so it is not a note somebody typed and forgot. Both of those two people joined at 5:25 in the afternoon on 11 August, Georgia time. To see the messages rather than take my word for it, open either of them in Conversations in your CRM: the texts are sitting in the thread with the date and time on each one.\",\n },\n {\n at: \"2026-08-14\",\n kind: \"mine\",\n what: \"For three days after it went live, this page kept telling you it had not been switched on. Four things on it said so: the question card asking when we should do the switch-on together, the line under the wording question saying it still does not send, the line under the domain question saying texting can still go live on its own, and the line at the very top saying three questions were holding up go-live. All four were written before 11 August and not one of them was rewritten when the day came. They are corrected now, and what actually happened is the 11 August entry.\",\n evidence: \"The system's own record has read live rather than practice since 11 August, and the last message to each of those two people went out on 12 August, so the page was disagreeing with the machine it was describing for three days in writing to you. The four sentences are named above rather than quietly swapped out, because you should be able to hold what you read earlier in the week against what this page says now. Nothing was sent or held back because of the wording; what it cost you was three days of not being able to trust the page.\",\n },\n {\n at: \"2026-08-14\",\n kind: \"mine\",\n what: \"Your control panel could tell you the follow-up system was not running when it was running perfectly. It used to expect a check four times an hour, so any gap past an hour turned the top of that page red and told you to call Amir. The system actually checks about once an hour, and the ordinary gap between checks runs a few minutes either side of that, so the red could appear for a minute or two and clear itself with nothing wrong.\",\n evidence: \"Measured from the system's own list of when it last checked itself, which your control panel already shows: over the most recent 39 gaps the longest was 64 minutes, and four of them ran past the point where the old warning would have fired, for about five minutes in total. It now waits for two checks to be missed before it says anything, and the sentence it prints says once an hour rather than the old wrong number.\",\n },\n // 14 AUGUST, SECOND PASS. Everything below was found by reading the live control panel line by\n // line and holding each sentence against the code that decides it. Four of them were instructions\n // to Kim that would not have worked, and those are the ones that matter: a wrong number on a page\n // is embarrassing, but an instruction that does nothing costs her an afternoon and her trust.\n {\n at: \"2026-08-14\",\n kind: \"mine\",\n what: \"The tile on your control panel that counts people the system could not reach told you to fix their details in your CRM. Doing that would have changed nothing. Once the system had given up on somebody, nothing you could do put them back on the follow-up: they were locked out for 60 days no matter what you fixed. The way back in now works, and the tile tells you the three steps in the order that works.\",\n evidence: \"The tile reads zero today, so nobody has been left stuck by this. It was found by reading the enrolment code rather than by waiting for it to bite: the check that decides who may join skipped anybody the system already had a record of, and that record is exactly what it writes when it gives up. Amir has since changed the engine so that fixing the record and re-tagging really does bring somebody back, and there is an automated check that breaks on purpose if that stops being true. The order matters and the tile now says so: put a phone number or an email address on the record first, then take the tag off, because doing it the other way round looks like nothing happened.\",\n },\n {\n at: \"2026-08-14\",\n kind: \"mine\",\n what: \"The same tile also told you it never resets. It does reset: the system clears somebody out 60 days after it stopped trying to reach them, and the count comes down then. It now says that instead.\",\n evidence: \"The 60 days is in the housekeeping step the system runs at the end of every check, and there is an automated check that fails if that step is ever removed. What the old sentence was reaching for is still true and still said: unlike the Problems today tile beside it, this one does not go back to zero at midnight.\",\n },\n {\n at: \"2026-08-14\",\n kind: \"mine\",\n what: \"The instruction on your control panel for taking one person off every track was wrong in two ways. It said switching on Do Not Disturb takes them off everything, permanently, within about an hour. Your CRM has three Do Not Disturb switches on a contact, not one: a main one, and separate ones for texts and for emails. Only the main one stops everything, and the other two stop just the thing they name, so switching off texts would have left the emails running. The hour was wrong too: the system does not look at somebody again until their next message is due, which can be up to a day.\",\n evidence: \"Your own contact records are the reason this was worth correcting rather than a hypothetical: several of them carry the texts-only switch turned on while the main switch is off, which is the exact combination the old sentence got wrong. Nobody was messaged in the gap, and nobody could have been, because the only moment the system would send to a person is the same moment it re-reads their switches, so this cost you nothing and was still not true. Both points are now spelled out on the page, including which switch is the one that stops everything.\",\n },\n {\n at: \"2026-08-14\",\n kind: \"mine\",\n what: \"Your list of the last things the system did had been taken over by one line repeating. 39 of the 40 rows were the same sentence, once an hour for two days: one person who already has a booking, being passed over again on every check. Everything else the system had done was pushed off the end of the page where you could not see it. Repeats are now folded into a single row that says how many times and over what period, and the page states the sum so you can check nothing was dropped.\",\n evidence: \"You can see this for yourself against what the page looked like on 13 August: the same table now shows the repeat once, with its count, and the note under it says how many rows and how many folded repeats add up to how many entries. Amir has separately stopped the system writing the same line over and over in the first place, so the list fills up with real history from here. The list also now shows times in Georgia time; before this it printed them four hours ahead, so a message sent at five in the afternoon read as nine at night.\",\n },\n {\n at: \"2026-08-14\",\n kind: \"changed\",\n what: \"The shouting is gone from your control panel. Every heading on it was being forced into capitals, and the banner said RUNNING NORMALLY, so you asked us to stop. Headings and labels are in ordinary sentence case now.\",\n evidence: \"It was one line of styling turning all of the headings into capitals rather than anything typed that way, which is why it was consistent and why fixing it fixed all of them at once. The two words spelled FAILED in the middle of a sentence were typed, and those are corrected separately.\",\n },\n {\n at: \"2026-08-14\",\n kind: \"fixed\",\n what: \"Your status page was one failed read away from telling you the follow-up was still in practice mode. It would only have shown while nobody was partway through the sequence, which is why it had not happened yet, and it was the same false sentence you were shown from 11 to 14 August arriving by a different route. The page can now say it does not know, and says that instead of guessing.\",\n evidence: \"It was found by reading the page's own logic rather than by it happening to you: the box that names practice or live was already careful, but the paragraph two lines under it was reading a different record and defaulting to practice when that record did not answer. Both now depend on the same check. There is an automated test that puts the page in exactly that state and demands it say it could not tell, and a second check that removes the fix on purpose and requires the first one to go red.\",\n },\n];\n\nexport function mergeLog(seeded: WorkEntry[], live: WorkEntry[] | null | undefined): WorkEntry[] {\n const all = [...seeded, ...(Array.isArray(live) ? live : [])];\n const seen = new Set();\n const out: WorkEntry[] = [];\n for (const e of all) {\n if (!e || typeof e.at !== \"string\" || typeof e.what !== \"string\" || !e.what.trim()) continue;\n // v1.1 (review #6): dedupe on the FULL sentence. A 60-character prefix collapsed two\n // different outages on the same day into one row, so the second incident never reached Kim.\n const key = `${e.at}|${e.kind}|${e.what}|${e.evidence ?? \"\"}`;\n if (seen.has(key)) continue;\n seen.add(key);\n out.push(e);\n }\n // newest first. Within one day the LATEST-added entry leads, so a broke/recovered pair on the\n // same date reads \"back to normal\" above \"broke\", which is the order a human wants to see.\n return out\n .map((e, i) => ({ e, i }))\n .sort((a, b) => (a.e.at === b.e.at ? b.i - a.i : (b.e.at > a.e.at ? 1 : -1)))\n .map((x) => x.e);\n}\n\nexport const KIND_LABEL: Record = {\n mine: \"My mistake\",\n fixed: \"Fixed\",\n built: \"Built\",\n found: \"Found\",\n broke: \"Broke\",\n recovered: \"Back to normal\",\n changed: \"Changed\",\n};\n","label",[215],"8d0c3f6c-e271-4930-ab57-a3273ef44085","watch.ts","ff74119a-9822-11f1-b353-1607ee4eb77e",1139,["D",1786905790121],3,"// THE EARLY WARNING MONITOR. v1.0, 12 Aug 2026. Rebuilt 14 Aug 2026 from tests/watch.test.mjs.\n//\n// WHAT THIS IS FOR. On 19 February 2026 this account's CRM stopped recording payment amounts.\n// Bookings carried on arriving at full volume; the dollars written against them went to zero.\n// Nothing failed, so nothing errored, so nothing alerted, and every count on every page stayed\n// healthy. It ran for five months and cost a five-figure sum before a human happened to look.\n//\n// THE RULE THAT FOLLOWS FROM THAT (LESSONS #12): an absence raises no error, so something has to\n// watch the place where a thing used to be. Volume and value are watched TOGETHER, because either\n// one on its own reads as an ordinary business having an ordinary month.\n//\n// FIVE CHECKS, EACH MEASURED AGAINST THE SOURCE'S OWN HISTORY rather than against a number\n// somebody typed:\n// 1. silenceFindings a source that normally produces records has produced none for\n// longer than its own normal quiet spell.\n// 2. matchRatioFindings payments still arriving, the matched share collapsing against its\n// own recent baseline.\n// 3. revenueChannelFindings activity continuing while the money against it goes to zero. This\n// is the February shape, and it is the reason the file exists.\n// 4. bridgeFindings the Square link erroring now, or its journal no longer growing.\n// 5. backwardsFindings a figure that can only ever grow has gone backwards, which usually\n// means a source was swapped, truncated, or read from somewhere else.\n//\n// THREE DESIGN RULES THIS FILE IS BUILT AROUND, each of them paid for:\n//\n// A CHECK THAT INSPECTED ZERO ITEMS RAISES A FINDING ABOUT ITSELF (LESSONS #2). This project has\n// already shipped an audit that scanned zero files and reported all clear. On a monitor that is\n// worse than useless: \"nothing wrong\" and \"nothing looked at\" render identically on the page, and\n// the second one reads as reassurance. So every check returns the size of what it read, every\n// check that read nothing says so in an urgent finding, and blindSpots() is the backstop that\n// refuses to let a silent zero through.\n//\n// A BASELINE BELOW A MINIMUM POPULATION SAYS \"CANNOT JUDGE\" OUT LOUD (LESSONS #13). Replayed\n// against the real history as it stood on 15 March 2026 the revenue check fired and produced\n// \"47 bookings were recorded, which is the same as usual or more, and the money came to $50.00.\n// Over the 6 periods before it the usual figures were 2 bookings and $550.00.\" The arithmetic was\n// right and the sentence was nonsense, because the baseline was this account's first weeks in the\n// CRM. A sentence that reads as a glitch spends the credibility the real alarm will need, so a\n// thin baseline is declared unjudgeable rather than either accusing or passing.\n//\n// EVERY SENTENCE IS GENERATED FROM THE VALUES IT DESCRIBES (engine/facts.ts, header). Nothing in\n// here types a figure alongside the number it is meant to describe. Change an input and the words\n// move with it, or the two can silently disagree, which is how every wrong claim in this project\n// got out.\n//\n// CLIENT COPY RULES, enforced mechanically by copyProblems() over the generated report: no dashes\n// used as punctuation, and never the name of a service this business does not offer.\n//\n// READ ONLY. Nothing in this file fetches, writes, deploys or schedules anything. It is handed\n// data by scripts/watch-run.mjs and hands back a report.\n\n// ---------------------------------------------------------------------------------------------\n// THE SHAPES\n// ---------------------------------------------------------------------------------------------\n\n/** urgent: look today. attention: look this week. note: the monitor talking about itself. */\nexport type Severity = \"urgent\" | \"attention\" | \"note\";\n\nexport type Finding = {\n check: string; // which check raised it, so the report can group them\n severity: Severity;\n sentence: string; // plain words, generated from `numbers`, safe to send\n numbers: Record; // the figures the sentence was built from\n checkFirst: string; // the first thing to open, in her words not mine\n};\n\nexport type CheckResult = {\n check: string;\n title: string; // how the check is named in the report\n inspected: number; // HOW MUCH IT READ. Zero is a finding, never a pass.\n inspectedLabel: string; // what those items are, for the sentence that reports it\n measured: Record; // the workings, kept so a queried figure can be traced\n findings: Finding[];\n};\n\nexport type WatchReport = {\n generatedAt: string;\n headline: string;\n inspected: number;\n checks: CheckResult[];\n findings: Finding[];\n};\n\nexport type Stream = { name: string; timestamps: unknown; whereToLook?: string };\nexport type RatioPoint = { label?: string; endMs?: number; total: number; matched: number };\nexport type RevenuePeriod = { label?: string; endMs?: number; activity: number; dollars: number };\nexport type Snapshot = { at?: string; counters?: Record };\n\nexport type WatchInput = {\n nowMs?: unknown;\n streams?: unknown;\n ratio?: { subject?: string; points?: unknown } | null;\n revenue?: { subject?: string; periods?: unknown } | null;\n journal?: unknown;\n snapshots?: unknown;\n counterLabels?: Record | null;\n};\n\nconst HOUR = 3_600_000;\n\n// ---------------------------------------------------------------------------------------------\n// THE CONSTANTS, and why each one is the number it is. Every one of these is a judgement about\n// how loud this thing should be, so each is named, exported and testable rather than buried at a\n// call site where nobody can find it to argue with it.\n// ---------------------------------------------------------------------------------------------\n\n/** Below this many records a source has no rhythm worth quoting, and saying so is the honest move. */\nexport const MIN_RECORDS_FOR_RHYTHM = 5;\n\n/**\n * Only the most recent gaps are measured. A source that changes pace has to be able to\n * re-baseline: the payment feed moved from weekly invoicing to daily card takings in June, and a\n * rhythm averaged over all of history would still be judging today against a habit it dropped.\n */\nexport const MAX_GAPS_CONSIDERED = 30;\n\n/**\n * THE QUIET SPELL, not the longest outage. Read against the MAXIMUM gap in history, one bad\n * fortnight silently raises the bar past which any future outage would be reported: the next one\n * has to beat a record before anybody hears about it. The 90th percentile says \"longer than\n * almost every quiet spell this source normally has\" and cannot be dragged by a single hole.\n */\nexport const QUIET_QUANTILE = 0.9;\nexport const QUIET_MULTIPLE = 1.5; // half again past its own worst ordinary silence\nexport const NORMAL_MULTIPLE = 3; // or three times its ordinary gap, whichever is longer\n\n/**\n * THE OVERNIGHT FLOOR. New contact records arrive about every 25 minutes during the day and stop\n * at night. Judged on gaps alone that source is \"silent for twenty times its normal gap\" at 3am\n * every single night, and a report that cries wolf every morning is a report nobody opens on the\n * morning it is right. 26 hours clears a night, a weekend morning and a public holiday opening.\n */\nexport const MIN_EXPECT_HOURS = 26;\n\n/** Twice past the point where it became out of character is today's problem, not this week's. */\nexport const URGENT_MULTIPLE = 2;\n\n/** A collapse is a third of the baseline share gone AND ten points of it in absolute terms. */\nexport const RATIO_RELATIVE_FALL = 0.33;\nexport const RATIO_ABSOLUTE_FALL = 0.1;\n/** Half the baseline share gone is not a wobble, it is a fault, and it is today's problem. */\nexport const RATIO_URGENT_RELATIVE_FALL = 0.5;\n/** A verdict on two payments is not a verdict. Below this the check says so instead. */\nexport const RATIO_MIN_LATEST = 5;\n\n/** Four fifths of the usual money gone. A half is a trading question; this is a plumbing one. */\nexport const REVENUE_DOLLAR_FALL = 0.8;\n/** ...while at least half the usual amount of work still arrived. Both halves, or it is a slow month. */\nexport const REVENUE_ACTIVITY_HELD = 0.5;\n/** LESSONS #13. A baseline of two records a period cannot carry an accusation. */\nexport const REVENUE_MIN_BASELINE_ACTIVITY = 5;\n/** Fewer periods than this and there is no \"usual\" to compare the latest one against. */\nexport const REVENUE_MIN_PERIODS = 4;\n\n/**\n * The bridge is judged on its RECENT rows only. This journal holds 265 failures from three bad\n * days in July that were found and fixed. A check that fires on any error ever recorded is red\n * forever, and a permanently red check is a switched off one.\n */\nexport const BRIDGE_RECENT_ROWS = 100;\nexport const BRIDGE_ERROR_SHARE_URGENT = 0.2;\n\n// ---------------------------------------------------------------------------------------------\n// SAYING THINGS. Every one of these turns a value into words. Nothing below ever types a figure\n// beside the number it describes, which is the whole of engine/facts.ts in one rule.\n// ---------------------------------------------------------------------------------------------\n\nconst MONTH_NAMES = [\"January\", \"February\", \"March\", \"April\", \"May\", \"June\",\n \"July\", \"August\", \"September\", \"October\", \"November\", \"December\"];\n\n/** A duration in words that fit its size: minutes for an hour, hours for a day, days beyond that. */\nexport function sayGap(hours: unknown): string {\n const h = Number(hours);\n if (!Number.isFinite(h)) return \"an unknown length of time\";\n if (h <= 1) return `${Math.round(h * 60)} minutes`;\n if (h < 48) return `${Math.round(h)} hours`;\n const days = Math.round(h / 24);\n if (days < 60) return `${days} days`;\n // Past two months \"97 days\" stops meaning anything to a reader, so the months are said too.\n // Both figures, never the months alone: the day count is the one that can be checked.\n const months = Math.round(days / 30.44);\n return `${days} days, which is about ${months} months`;\n}\n\n/** A date a person can read, in UTC so a replay of a past morning says the same thing every time. */\nexport function sayDate(ms: unknown): string {\n const t = Number(ms);\n if (!Number.isFinite(t)) return \"a date this could not read\";\n const d = new Date(t);\n if (Number.isNaN(d.getTime())) return \"a date this could not read\";\n return `${d.getUTCDate()} ${MONTH_NAMES[d.getUTCMonth()]} ${d.getUTCFullYear()}`;\n}\n\n/** Money, always to the cent and always with its thousands separators. */\nexport function money(n: unknown): string {\n const v = Number(n);\n if (!Number.isFinite(v)) return \"an amount this could not read\";\n const [whole, frac] = Math.abs(v).toFixed(2).split(\".\");\n return `${v < 0 ? \"minus \" : \"\"}$${whole.replace(/\\B(?=(\\d{3})+(?!\\d))/g, \",\")}.${frac}`;\n}\n\nconst WORDS = [\"no\", \"one\", \"two\", \"three\", \"four\", \"five\", \"six\", \"seven\", \"eight\", \"nine\", \"ten\"];\nconst countWord = (n: number) => WORDS[n] ?? String(n);\nconst capitalise = (s: string) => s.replace(/^./, (c) => c.toUpperCase());\nconst plural = (n: number, one: string, many: string) => (n === 1 ? one : many);\nconst commas = (n: number) => Number(n ?? 0).toLocaleString(\"en-US\");\nconst percent = (x: number) => `${Math.round(x * 100)}%`;\n\n/** The subject as a bare noun: \"your bookings\" is what she calls them, \"bookings\" is what counts them. */\nconst unitOf = (subject: string) => String(subject ?? \"records\").replace(/^(your|the)\\s+/i, \"\");\n\n// ---------------------------------------------------------------------------------------------\n// THE MEASUREMENT. A rhythm read off the source itself.\n//\n// Everything else in this file rests on this function, so it is worth saying what it deliberately\n// does NOT do. It does not take a threshold. It does not know what kind of source it is looking\n// at. It reads the gaps between the things that actually arrived and reports how long this source\n// normally goes quiet for. A monitor built on typed thresholds is a monitor that is wrong for\n// every source but the one somebody had in mind when they typed it.\n// ---------------------------------------------------------------------------------------------\n\nexport type Rhythm = {\n records: number; // how many readable timestamps went into this\n gapsUsed: number; // how many gaps the figures below were measured from\n normalGapH: number; // the median gap: what \"usually\" means for this source\n quietGapH: number; // its ordinary worst quiet spell, at the 90th percentile\n longestGapH: number; // the worst hole in the history it was given, reported and NOT used\n expectByH: number; // past this it is out of character for this source\n};\n\n/** Every readable timestamp in a list, as milliseconds, oldest first. Unreadable ones are dropped. */\nexport function readTimes(list: unknown): number[] {\n if (!Array.isArray(list)) return [];\n const out: number[] = [];\n for (const v of list) {\n // A number is already milliseconds; anything else has to survive Date.parse to count.\n const t = typeof v === \"number\" ? v : Date.parse(String(v ?? \"\"));\n if (Number.isFinite(t)) out.push(t as number);\n }\n // SORTED, ALWAYS. The live feed comes back newest first, fixtures come back oldest first, and a\n // jittered series is in neither order. Measuring gaps off an unsorted list produces negative\n // gaps and a median that means nothing.\n return out.sort((a, b) => a - b);\n}\n\n/**\n * The rhythm of a source, or null when there is not enough of it to have one.\n *\n * Null is a real answer here, not a failure: it is what makes \"there is not enough history to\n * judge this\" sayable out loud instead of being rounded to either an alarm or an all clear.\n */\nexport function rhythmOf(list: unknown): Rhythm | null {\n const times = readTimes(list);\n if (times.length < MIN_RECORDS_FOR_RHYTHM) return null;\n const allGaps: number[] = [];\n for (let i = 1; i < times.length; i++) allGaps.push((times[i] - times[i - 1]) / HOUR);\n if (!allGaps.length) return null;\n // RECENT HISTORY ONLY, so a source that changes pace re-baselines instead of being judged\n // forever against a habit it has dropped.\n const gaps = allGaps.slice(-MAX_GAPS_CONSIDERED);\n const normalGapH = quantile(gaps, 0.5) as number;\n const quietGapH = quantile(gaps, QUIET_QUANTILE) as number;\n // The longest gap is REPORTED so it can be looked at, and deliberately not used as the\n // yardstick. See QUIET_QUANTILE above for what happens when it is.\n const longestGapH = Math.max(...allGaps);\n const expectByH = Math.max(quietGapH * QUIET_MULTIPLE, normalGapH * NORMAL_MULTIPLE, MIN_EXPECT_HOURS);\n return { records: times.length, gapsUsed: gaps.length, normalGapH, quietGapH, longestGapH, expectByH };\n}\n\n/** The value at a quantile, interpolated. Null on an empty list, never a confident zero. */\nexport function quantile(values: number[], q: number): number | null {\n if (!Array.isArray(values) || !values.length) return null;\n const a = [...values].sort((x, y) => x - y);\n const pos = (a.length - 1) * q;\n const lo = Math.floor(pos);\n const hi = Math.ceil(pos);\n if (lo === hi) return a[lo];\n return a[lo] + (a[hi] - a[lo]) * (pos - lo);\n}\n\n/** urgent once it is twice past the point where it stopped being in character, attention before. */\nconst escalate = (ageH: number, expectByH: number): Severity =>\n (ageH >= expectByH * URGENT_MULTIPLE ? \"urgent\" : \"attention\");\n\n// ---------------------------------------------------------------------------------------------\n// A CHECK THAT READ NOTHING.\n//\n// This is the single most important function in the file, which is why it is this near the top.\n// Every check routes its empty case through it, so there is exactly one place where \"I inspected\n// nothing\" is turned into words, and exactly one place to break in order to prove the whole\n// arrangement still works (tests/negative-controls.mjs does exactly that).\n// ---------------------------------------------------------------------------------------------\nexport function blindCheck(check: string, title: string, inspectedLabel: string, why: string, checkFirst: string): CheckResult {\n return {\n check,\n title,\n inspected: 0,\n inspectedLabel,\n measured: { inspected: 0 },\n // SEVERITY STAYS \"urgent\" AND SIX TESTS HOLD IT THERE (W10, W19, W26, W31, W37, W42). A check\n // that read nothing must never be quiet. What was wrong was not the severity, it was the\n // HEADLINE: it counted blind spots as business problems and said \"two things need you to look at\n // today\" when both were unwired checks. That is fixed in headlineFor and in the section split\n // below, which separate \"a check found a fault\" from \"a check could not look\" WITHOUT making the\n // second one quiet. Relabelling this to \"note\" was tried on 16 Aug and the tests rejected it,\n // correctly: it is the guarantee, not the wording.\n findings: [{ check, severity: \"urgent\", sentence: why, numbers: { inspected: 0 }, checkFirst }],\n };\n}\n\n/**\n * THE BACKSTOP. Any check that inspected nothing and said nothing about it. This should always be\n * empty, because every check above routes its empty case through blindCheck. It is here because\n * \"should always be empty\" is exactly the kind of claim that quietly stops being true, and\n * scripts/watch-run.mjs refuses to write a report while this returns anything.\n */\nexport function blindSpots(checks: unknown): CheckResult[] {\n return (Array.isArray(checks) ? checks : []).filter((c) => c && c.inspected === 0 && (!c.findings || c.findings.length === 0));\n}\n\n// ---------------------------------------------------------------------------------------------\n// CHECK 1: SILENCE WHERE THERE SHOULD BE NOISE. This is the 19 February check.\n//\n// A source that normally produces records has produced none for longer than it normally goes\n// quiet. Every source is judged against its own rhythm: the payment feed against the payment\n// feed's habits, the fortnightly form payments against the fortnightly form payments'. Judging\n// them all by one clock is how the fortnightly source becomes a false alarm every fortnight.\n// ---------------------------------------------------------------------------------------------\n\nconst SILENCE = \"silence\";\nconst SILENCE_TITLE = \"Sources that have gone quiet\";\nconst SILENCE_LABEL = \"timestamps\";\n\nexport function silenceFindings(streams: unknown, nowMs: unknown): CheckResult {\n const now = Number(nowMs);\n const list = (Array.isArray(streams) ? streams : []) as Stream[];\n const prepared = list.map((s) => ({\n name: String(s?.name ?? \"a source with no name\"),\n whereToLook: typeof s?.whereToLook === \"string\" ? s.whereToLook : null,\n times: readTimes(s?.timestamps),\n }));\n const inspected = prepared.reduce((a, s) => a + s.times.length, 0);\n\n if (!Number.isFinite(now) || inspected === 0) {\n return blindCheck(SILENCE, SILENCE_TITLE, SILENCE_LABEL,\n `This check read nothing at all, so it cannot tell you whether anything has stopped arriving. ` +\n `A check that inspects nothing is a blind spot, not a clean result, and it is being reported as one.`,\n `Check that the connection to your CRM is still working, then run this again. Until it reads something, ` +\n `treat the sources it was meant to watch as unwatched rather than healthy.`);\n }\n\n const findings: Finding[] = [];\n const perSource: Record[] = [];\n\n for (const s of prepared) {\n const r = rhythmOf(s.times);\n if (r === null) {\n // NOT A SILENT PASS. A source nothing can be measured on is a source nothing is watching,\n // and she should be told that in the same breath as she is told everything else is fine.\n findings.push({\n check: SILENCE,\n severity: \"note\",\n sentence:\n `There is not enough history for ${s.name} to say what normal looks like: ${s.times.length} ` +\n `${plural(s.times.length, \"record\", \"records\")}, where this needs ${MIN_RECORDS_FOR_RHYTHM} before it can ` +\n `measure a rhythm. Nothing is watching this source yet, which is worth knowing rather than reading as a clean result.`,\n numbers: { source: s.name, records: s.times.length, needed: MIN_RECORDS_FOR_RHYTHM },\n checkFirst:\n `Nothing to do today. Once ${MIN_RECORDS_FOR_RHYTHM} records have arrived here this will start ` +\n `watching it on its own, and until then treat it as unwatched.`,\n });\n perSource.push({ source: s.name, records: s.times.length, rhythm: \"not enough history\" });\n continue;\n }\n const lastMs = s.times[s.times.length - 1];\n const ageH = (now - lastMs) / HOUR;\n perSource.push({\n source: s.name,\n records: r.records,\n normalGapH: Math.round(r.normalGapH * 10) / 10,\n quietGapH: Math.round(r.quietGapH * 10) / 10,\n expectByH: Math.round(r.expectByH * 10) / 10,\n quietForHours: Math.round(ageH * 10) / 10,\n });\n if (ageH <= r.expectByH) continue;\n const severity = escalate(ageH, r.expectByH);\n // THE FIRST MOVE. A stream that knows where its own answer lives brings its own sentence:\n // scripts/watch-run.mjs hands the payment feed one, because that is the stream whose silence\n // means what February meant. Everything else gets this, which is the same move generalised.\n const checkFirst = s.whereToLook ??\n `Open the Square app and compare what it has taken since ${sayDate(lastMs)} against what your CRM shows for ` +\n `${s.name}. If Square has money the CRM does not, sales are being rung up in a way that never reaches a customer record.`;\n findings.push({\n check: SILENCE,\n severity,\n sentence:\n `Nothing has come through from ${s.name} for ${sayGap(ageH)}. The last one was on ${sayDate(lastMs)}. ` +\n `Before that this source produced something every ${sayGap(r.normalGapH)} on average, and the longest it ` +\n `normally stays quiet is ${sayGap(r.quietGapH)}, so this is well outside its own habits rather than outside ` +\n `a figure somebody chose.`,\n numbers: {\n source: s.name,\n lastRecordAt: new Date(lastMs).toISOString(),\n quietForHours: Math.round(ageH * 10) / 10,\n normalGapHours: Math.round(r.normalGapH * 10) / 10,\n quietGapHours: Math.round(r.quietGapH * 10) / 10,\n outOfCharacterAfterHours: Math.round(r.expectByH * 10) / 10,\n recordsMeasured: r.records,\n },\n checkFirst,\n });\n }\n\n return {\n check: SILENCE,\n title: SILENCE_TITLE,\n inspected,\n inspectedLabel: SILENCE_LABEL,\n measured: { sources: prepared.length, timestamps: inspected, perSource },\n findings,\n };\n}\n\n// ---------------------------------------------------------------------------------------------\n// CHECK 2: A RATIO COLLAPSE. Payments still arrive; the share of them reaching a customer record\n// falls away against its own recent baseline.\n//\n// THE TRAP THIS CHECK HAS TO AVOID, and the reason W17 exists: nought matched out of nought\n// arriving is not nought percent matching. Calling it a collapse raises a second alarm for one\n// fault and names the wrong cause, sending her to look at the matcher when the payments never\n// arrived at all.\n// ---------------------------------------------------------------------------------------------\n\nconst RATIO = \"match-ratio\";\nconst RATIO_TITLE = \"Payments reaching a customer record\";\nconst RATIO_LABEL = \"payments\";\n\nexport function matchRatioFindings(points: unknown, subject: unknown): CheckResult {\n const what = String(subject ?? \"payments\");\n const list = (Array.isArray(points) ? points : []) as RatioPoint[];\n const clean = list.map((p) => ({\n label: String(p?.label ?? \"a window\"),\n endMs: Number(p?.endMs),\n total: Math.max(0, Number(p?.total) || 0),\n matched: Math.max(0, Number(p?.matched) || 0),\n }));\n const inspected = clean.reduce((a, p) => a + p.total, 0);\n\n if (inspected === 0) {\n return blindCheck(RATIO, RATIO_TITLE, RATIO_LABEL,\n `This check read no ${what} at all, so it cannot tell you whether they are still reaching a customer record. ` +\n `A check that inspects nothing is a blind spot, not a clean result, and it is being reported as one.`,\n `Check that the Square link is still running and still writing to its own log, then run this again.`);\n }\n\n const latest = clean[clean.length - 1];\n const base = clean.slice(0, -1);\n const baseTotal = base.reduce((a, p) => a + p.total, 0);\n const baseMatched = base.reduce((a, p) => a + p.matched, 0);\n const measured: Record = {\n windows: clean.length,\n payments: inspected,\n latestTotal: latest.total,\n latestMatched: latest.matched,\n baselineTotal: baseTotal,\n baselineMatched: baseMatched,\n };\n const result = (findings: Finding[]): CheckResult =>\n ({ check: RATIO, title: RATIO_TITLE, inspected, inspectedLabel: RATIO_LABEL, measured, findings });\n\n if (baseTotal === 0) {\n return result([{\n check: RATIO,\n severity: \"note\",\n sentence:\n `There is no earlier run of ${what} to compare the latest ${commas(latest.total)} against, so this cannot ` +\n `judge whether the share reaching a customer record has moved. It will be able to from the next run on.`,\n numbers: { subject: what, latestTotal: latest.total, baselineTotal: baseTotal, windows: clean.length },\n checkFirst: `Nothing to do today. This needs one more period of history before it can say anything useful here.`,\n }]);\n }\n\n if (latest.total === 0) {\n // AN ABSENCE, DESCRIBED AS AN ABSENCE. Never as a collapse to nought percent.\n return result([{\n check: RATIO,\n severity: \"note\",\n sentence:\n `No ${what} arrived at all in the latest window, so there is nothing to work out a share from. ` +\n `That is a different problem from the ones this check watches for, and the list of sources that have gone ` +\n `quiet is where it will show up.`,\n numbers: { subject: what, latestTotal: 0, baselineTotal: baseTotal, windows: clean.length },\n checkFirst:\n `Look at the sources that have gone quiet, further up. If nothing there names ${what}, open the Square app ` +\n `and check whether any sale has been taken at all in the last week.`,\n }]);\n }\n\n if (latest.total < RATIO_MIN_LATEST) {\n // LESSONS #13, in its other shape. A verdict on two payments is not a verdict.\n return result([{\n check: RATIO,\n severity: \"note\",\n sentence:\n `Only ${commas(latest.total)} ${plural(latest.total, \"payment\", \"payments\")} arrived in the latest window, ` +\n `which is too few to judge a matching rate on. This needs at least ${RATIO_MIN_LATEST} before it will call ` +\n `a fall in the share reaching a customer record, because a wrong alarm here spends the attention a real one will need.`,\n numbers: { subject: what, latestTotal: latest.total, needed: RATIO_MIN_LATEST, baselineTotal: baseTotal },\n checkFirst: `Nothing to do today. This will judge the share again as soon as a normal week's worth of payments has arrived.`,\n }]);\n }\n\n const baseShare = baseMatched / baseTotal;\n const latestShare = latest.matched / latest.total;\n const relativeFall = baseShare > 0 ? (baseShare - latestShare) / baseShare : 0;\n const absoluteFall = baseShare - latestShare;\n const fires = relativeFall >= RATIO_RELATIVE_FALL && absoluteFall >= RATIO_ABSOLUTE_FALL;\n measured.baselineSharePercent = Math.round(baseShare * 100);\n measured.latestSharePercent = Math.round(latestShare * 100);\n if (!fires) return result([]);\n\n const latestUnmatched = latest.total - latest.matched;\n return result([{\n check: RATIO,\n severity: relativeFall >= RATIO_URGENT_RELATIVE_FALL ? \"urgent\" : \"attention\",\n sentence:\n `${capitalise(what)} are still arriving, and the share of them reaching a customer record has fallen from ` +\n `${percent(baseShare)} to ${percent(latestShare)}. In the latest window ${commas(latestUnmatched)} of ` +\n `${commas(latest.total)} reached nobody at all. The money is still being taken; it is the record of who paid it ` +\n `that is going missing.`,\n numbers: {\n subject: what,\n latestTotal: latest.total,\n latestMatched: latest.matched,\n latestUnmatched,\n latestSharePercent: Math.round(latestShare * 100),\n baselineSharePercent: Math.round(baseShare * 100),\n baselineTotal: baseTotal,\n windowsCompared: clean.length,\n },\n checkFirst:\n `Open the Square link's own log and look at the most recent entries for a sale that did not find a customer. ` +\n `The weekly exception report lists every one of them by name and amount, and that is the list to work from.`,\n }]);\n}\n\n// ---------------------------------------------------------------------------------------------\n// CHECK 3: A REVENUE CHANNEL GOING QUIET WHILE THE ACTIVITY CONTINUES. THE FEBRUARY SHAPE.\n//\n// This is the one the whole file exists for. Six ordinary periods of about 45 bookings and about\n// $7,000 taken, then a period in which the same number of bookings arrived and not one dollar was\n// recorded against them. The live account did exactly that: 48 payment records and $7,386.50 in\n// February, then 37 records and $0.00 in March, 21 and $0.00 in April, 18 and $0.00 in May.\n//\n// BOTH HALVES OR NOTHING. Money down and work down together is a slow month, which she can\n// already see out of the window, and raising it would be inventing an alarm about business\n// conditions. Money down while the work held is a plumbing fault, and she cannot see that at all.\n// ---------------------------------------------------------------------------------------------\n\nconst REVENUE = \"revenue-quiet\";\nconst REVENUE_TITLE = \"Money recorded against the work\";\nconst REVENUE_LABEL = \"records of activity\";\n\nexport function revenueChannelFindings(periods: unknown, subject: unknown): CheckResult {\n const what = String(subject ?? \"your bookings\");\n const unit = unitOf(what);\n const list = (Array.isArray(periods) ? periods : []) as RevenuePeriod[];\n const clean = list.map((p) => ({\n label: String(p?.label ?? \"a period\"),\n endMs: Number(p?.endMs),\n activity: Math.max(0, Number(p?.activity) || 0),\n dollars: Math.max(0, Number(p?.dollars) || 0),\n }));\n const inspected = clean.reduce((a, p) => a + p.activity, 0);\n\n if (inspected === 0) {\n return blindCheck(REVENUE, REVENUE_TITLE, REVENUE_LABEL,\n `This check read no record of any work at all, so it cannot tell you whether the money against it is being ` +\n `written down. A check that inspects nothing is a blind spot, not a clean result, and it is being reported as one.`,\n `Check that the connection to your CRM is still working, then run this again. This is the check that would ` +\n `have caught the five month gap, so it reading nothing matters more than most.`);\n }\n\n const latest = clean[clean.length - 1];\n const base = clean.slice(0, -1);\n const measured: Record = {\n periods: clean.length,\n recordsOfActivity: inspected,\n latestActivity: latest.activity,\n latestDollars: latest.dollars,\n };\n const result = (findings: Finding[]): CheckResult =>\n ({ check: REVENUE, title: REVENUE_TITLE, inspected, inspectedLabel: REVENUE_LABEL, measured, findings });\n\n if (clean.length < REVENUE_MIN_PERIODS) {\n return result([{\n check: REVENUE,\n severity: \"note\",\n sentence:\n `There are only ${clean.length} periods of history for ${what}, and this needs ${REVENUE_MIN_PERIODS} before ` +\n `it can say what a normal period looks like. It cannot judge the latest one yet, and guessing would be worse ` +\n `than saying so.`,\n numbers: { subject: what, periods: clean.length, needed: REVENUE_MIN_PERIODS },\n checkFirst: `Nothing to do today. This will start judging as soon as there are ${REVENUE_MIN_PERIODS} periods to read.`,\n }]);\n }\n\n // THE BASELINE IS A MEDIAN, not an average. One freak month with a $4,000 boarding block in it\n // drags an average up and makes every ordinary month afterwards look like a collapse.\n const baseActivity = quantile(base.map((p) => p.activity), 0.5) as number;\n const baseDollars = Math.round((quantile(base.map((p) => p.dollars), 0.5) as number) * 100) / 100;\n measured.usualActivity = Math.round(baseActivity);\n measured.usualDollars = baseDollars;\n\n if (baseActivity < REVENUE_MIN_BASELINE_ACTIVITY) {\n // LESSONS #13, the sentence that reads as a glitch. Right arithmetic, no denominator.\n return result([{\n check: REVENUE,\n severity: \"note\",\n sentence:\n `Over the ${base.length} periods before the latest one, ${what} ran at about ${Math.round(baseActivity)} ` +\n `${unit} a period, which is too little to say what a normal period looks like. This cannot judge the latest ` +\n `period against a baseline that thin, and it would rather tell you so than put a figure in front of you that ` +\n `reads as a glitch.`,\n numbers: {\n subject: what,\n usualActivity: Math.round(baseActivity),\n needed: REVENUE_MIN_BASELINE_ACTIVITY,\n latestActivity: latest.activity,\n latestDollars: latest.dollars,\n periods: clean.length,\n },\n checkFirst:\n `Nothing to do today. Once this channel has run at ${REVENUE_MIN_BASELINE_ACTIVITY} or more records a period ` +\n `for a few periods, this will start judging it properly.`,\n }]);\n }\n\n if (!(baseDollars > 0)) {\n // THE HONEST LIMIT OF THIS CHECK, said out loud rather than left to be discovered. Once every\n // period in view is already at zero there is nothing left to fall from, and silence here would\n // read as a clean bill of health for the exact fault this check was built for.\n return result([{\n check: REVENUE,\n severity: \"note\",\n sentence:\n `Over the ${base.length} periods before the latest one, no money at all was recorded against ${what}, so there ` +\n `is no normal level for this one to have fallen from. This cannot judge whether anything is wrong here: a fault ` +\n `that has run long enough to become the baseline stops looking like a fall. Take this as the monitor saying it ` +\n `is blind on this channel, not as an all clear.`,\n numbers: {\n subject: what,\n usualDollars: baseDollars,\n latestActivity: latest.activity,\n latestDollars: latest.dollars,\n periods: clean.length,\n },\n checkFirst:\n `Open the Square app and total what it has taken over the last few months, then compare that with what your ` +\n `CRM shows for the same months. If Square has money the CRM does not, the two have been disconnected for ` +\n `longer than this report can see.`,\n }]);\n }\n\n const dollarFall = 1 - latest.dollars / baseDollars;\n const activityHeld = latest.activity >= baseActivity * REVENUE_ACTIVITY_HELD;\n measured.dollarFallPercent = Math.round(dollarFall * 100);\n measured.activityHeld = activityHeld;\n\n if (dollarFall < REVENUE_DOLLAR_FALL || !activityHeld) {\n return result([]);\n }\n\n const usualActivity = Math.round(baseActivity);\n const shareOfMoneyMissing = Math.round(dollarFall * 100);\n const heldPhrase = latest.activity >= baseActivity\n ? \"as many as usual or more\"\n : `${Math.round((latest.activity / baseActivity) * 100)}% of the usual number`;\n const sentence =\n `In the latest period ${commas(latest.activity)} ${unit} were recorded, which is ${heldPhrase}, ` +\n `and the money recorded against them came to ${money(latest.dollars)}. ` +\n `Over the ${base.length} periods before it the usual figures were ${commas(usualActivity)} ${unit} and ` +\n `${money(baseDollars)}. The work carried on and ${shareOfMoneyMissing}% of the money that normally comes with it ` +\n `was never written down, which means it is being taken somewhere your CRM never hears about.`;\n\n return result([{\n check: REVENUE,\n severity: \"urgent\",\n sentence,\n numbers: {\n subject: what,\n latestActivity: latest.activity,\n latestDollars: latest.dollars,\n usualActivity,\n usualDollars: baseDollars,\n shareOfMoneyMissing,\n periodsCompared: clean.length,\n },\n checkFirst:\n `Open the Square app and total what it has taken over the same period. If Square shows sales your CRM does not, ` +\n `sales are being rung up in a way that never reaches a customer record, which is exactly what happened after ` +\n `19 February 2026.`,\n }]);\n}\n\n// ---------------------------------------------------------------------------------------------\n// CHECK 4: THE BRIDGE ITSELF. The Square link either erroring right now, or no longer writing\n// anything down at all.\n//\n// TWO FAULTS, TWO SENTENCES. \"It is failing\" and \"it has stopped\" are different problems with\n// different first moves, and collapsing them into one alarm sends her to the wrong place.\n// ---------------------------------------------------------------------------------------------\n\nconst BRIDGE = \"bridge\";\nconst BRIDGE_TITLE = \"The Square link\";\nconst BRIDGE_LABEL = \"journal rows\";\n\nconst isErrorRow = (r: any) =>\n String(r?.kind ?? \"\").toUpperCase() === \"ERROR\" || (typeof r?.error === \"string\" && r.error.length > 0);\n\nexport function bridgeFindings(rows: unknown, nowMs: unknown): CheckResult {\n const now = Number(nowMs);\n const list = Array.isArray(rows) ? rows : [];\n const inspected = list.length;\n\n if (!Number.isFinite(now) || inspected === 0) {\n return blindCheck(BRIDGE, BRIDGE_TITLE, BRIDGE_LABEL,\n `The Square link's own log came back with nothing in it that could be read, so this cannot tell you whether ` +\n `the link is working. A check that inspects nothing is a blind spot, not a clean result, and an unreadable log ` +\n `is the loudest thing in this report rather than the quietest.`,\n `Open the Square link's own page and check it answers at all. If it does and the log is genuinely empty, ` +\n `every sale taken since it last wrote something down is unaccounted for.`);\n }\n\n // Rows with a readable date, oldest first. The rest are counted and reported, never guessed at.\n const stamped = (list as any[])\n .map((r) => ({ row: r, ms: Date.parse(String(r?.ts ?? \"\")) }))\n .filter((x) => Number.isFinite(x.ms))\n .sort((a, b) => a.ms - b.ms);\n\n const measured: Record = {\n rows: inspected,\n rowsWithATimestamp: stamped.length,\n };\n const result = (findings: Finding[]): CheckResult =>\n ({ check: BRIDGE, title: BRIDGE_TITLE, inspected, inspectedLabel: BRIDGE_LABEL, measured, findings });\n\n if (stamped.length === 0) {\n return result([{\n check: BRIDGE,\n severity: \"urgent\",\n sentence:\n `The Square link's log has ${commas(inspected)} ${plural(inspected, \"entry\", \"entries\")} in it and not one of ` +\n `them carries a date this can read. Without dates there is no way to tell a link that stopped last night from ` +\n `one that stopped in March, so this is being raised rather than passed over.`,\n numbers: { rows: inspected, rowsWithATimestamp: 0 },\n checkFirst:\n `Open the Square link's own log and look at the newest few entries. If they carry no time against them, the ` +\n `link is writing in a shape this report cannot read and that needs fixing before any of it can be believed.`,\n }]);\n }\n\n // ONLY THE RECENT ROWS. See BRIDGE_RECENT_ROWS: a check that fires on any error ever recorded is\n // red forever, and 265 failures from three fixed days in July would keep it that way.\n const recent = stamped.slice(-BRIDGE_RECENT_ROWS);\n const recentSet = new Set(recent);\n const errorsInRecentRows = recent.filter((x) => isErrorRow(x.row)).length;\n const errorsBeforeThat = stamped.filter((x) => !recentSet.has(x) && isErrorRow(x.row)).length;\n const errorShare = recent.length ? errorsInRecentRows / recent.length : 0;\n measured.recentRows = recent.length;\n measured.errorsInRecentRows = errorsInRecentRows;\n measured.errorsBeforeThat = errorsBeforeThat;\n\n const findings: Finding[] = [];\n\n if (errorsInRecentRows > 0) {\n findings.push({\n check: BRIDGE,\n severity: errorShare >= BRIDGE_ERROR_SHARE_URGENT ? \"urgent\" : \"attention\",\n sentence:\n `The Square link is failing as it runs. ${commas(errorsInRecentRows)} of its last ${commas(recent.length)} ` +\n `entries are failures, which is ${percent(errorShare)} of them. Every one of those is a sale that reached ` +\n `Square and did not reach a customer record in your CRM.`,\n numbers: {\n errorsInRecentRows,\n recentRows: recent.length,\n errorSharePercent: Math.round(errorShare * 100),\n errorsBeforeThat,\n },\n checkFirst:\n `The weekly exception report lists every sale that did not reach a customer record, by name and amount. ` +\n `Work from that list rather than from the log itself, and send me the report if the same name keeps appearing.`,\n });\n }\n\n const r = rhythmOf(stamped.map((x) => x.ms));\n const lastMs = stamped[stamped.length - 1].ms;\n const ageH = (now - lastMs) / HOUR;\n measured.quietForHours = Math.round(ageH * 10) / 10;\n if (r === null) {\n findings.push({\n check: BRIDGE,\n severity: \"note\",\n sentence:\n `The Square link's log holds only ${commas(stamped.length)} dated ${plural(stamped.length, \"entry\", \"entries\")}, ` +\n `which is too little for this to know how often it normally writes something. It cannot yet tell a quiet link ` +\n `from a stopped one.`,\n numbers: { rowsWithATimestamp: stamped.length, needed: MIN_RECORDS_FOR_RHYTHM },\n checkFirst: `Nothing to do today. This will be able to judge the link once its log has a little more history in it.`,\n });\n } else {\n measured.expectByH = Math.round(r.expectByH * 10) / 10;\n if (ageH > r.expectByH) {\n findings.push({\n check: BRIDGE,\n severity: escalate(ageH, r.expectByH),\n sentence:\n `The Square link has written nothing down for ${sayGap(ageH)}. The last thing it recorded was on ` +\n `${sayDate(lastMs)}. It normally writes something every ${sayGap(r.normalGapH)}, so it has not simply gone ` +\n `quiet, it has stopped. Anything taken in Square since then has not reached your CRM.`,\n numbers: {\n quietForHours: Math.round(ageH * 10) / 10,\n lastRowAt: new Date(lastMs).toISOString(),\n normalGapHours: Math.round(r.normalGapH * 10) / 10,\n outOfCharacterAfterHours: Math.round(r.expectByH * 10) / 10,\n rowsWithATimestamp: stamped.length,\n },\n checkFirst:\n `Open the Square link's own page and check it answers. If it does, take one card payment in Square and see ` +\n `whether it appears against a customer in your CRM within a few minutes.`,\n });\n }\n }\n\n return result(findings);\n}\n\n// ---------------------------------------------------------------------------------------------\n// CHECK 5: A FIGURE THAT SHOULD ONLY EVER GROW HAS GONE BACKWARDS.\n//\n// Lifetime totals only go up. When one comes back smaller, the reading is being taken from\n// somewhere else: a source was swapped, a query was cut at a date, a page walk stopped early. Each\n// of those has produced a wrong number in front of this client already, and each was invisible at\n// the time because the smaller figure was perfectly plausible on its own.\n//\n// A FIGURE THAT STOPS BEING REPORTED IS THE SAME DISEASE. It hides exactly what a fall hides, and\n// it looks like nothing at all on a page that only prints what it has.\n// ---------------------------------------------------------------------------------------------\n\nconst BACKWARDS = \"backwards\";\nconst BACKWARDS_TITLE = \"Running totals that should only grow\";\nconst BACKWARDS_LABEL = \"running totals\";\n\nexport function backwardsFindings(snapshots: unknown, labels: unknown): CheckResult {\n const named = (labels ?? {}) as Record;\n const nameOf = (key: string) => String(named?.[key] ?? key);\n const list = (Array.isArray(snapshots) ? snapshots : []) as Snapshot[];\n\n if (list.length === 0) {\n return blindCheck(BACKWARDS, BACKWARDS_TITLE, BACKWARDS_LABEL,\n `This check has no readings of your running totals at all, so it cannot tell whether any of them has gone ` +\n `backwards. A check that inspects nothing is a blind spot, not a clean result, and it is being reported as one.`,\n `Check that the file this keeps its earlier readings in still exists and can be read. Until it can, a total ` +\n `that shrinks will pass unnoticed.`);\n }\n\n const previous = list[list.length - 2];\n const current = list[list.length - 1];\n\n if (list.length < 2) {\n // A FIRST RUN IS NOT A CLEAN RUN. It compared nothing, so it says it compared nothing. This is\n // a note rather than an alarm because there is nothing wrong here, but it is still a finding,\n // because \"nothing to compare\" printed as blank space reads as \"everything checks out\".\n return {\n check: BACKWARDS,\n title: BACKWARDS_TITLE,\n inspected: 0,\n inspectedLabel: BACKWARDS_LABEL,\n measured: { readings: list.length, compared: 0 },\n findings: [{\n check: BACKWARDS,\n severity: \"note\",\n sentence:\n `This is the first time these running totals have been written down, so there is nothing yet to compare ` +\n `them against. That is not a clean result, it is an empty one, and from the next run on any figure that ` +\n `goes backwards will be named here.`,\n numbers: { readings: list.length, compared: 0 },\n checkFirst: `Nothing to do today. Run this again tomorrow and it will have something to compare against.`,\n }],\n };\n }\n\n const prevCounters = (previous?.counters ?? {}) as Record;\n const curCounters = (current?.counters ?? {}) as Record;\n const keys = [...new Set([...Object.keys(prevCounters), ...Object.keys(curCounters)])];\n const inspected = keys.length;\n const prevAt = Date.parse(String(previous?.at ?? \"\"));\n\n if (inspected === 0) {\n return blindCheck(BACKWARDS, BACKWARDS_TITLE, BACKWARDS_LABEL,\n `The last two readings of your running totals carry no figures at all, so there was nothing to compare. ` +\n `A check that inspects nothing is a blind spot, not a clean result, and it is being reported as one.`,\n `Check that the file this keeps its earlier readings in has not been emptied or overwritten.`);\n }\n\n const findings: Finding[] = [];\n for (const key of keys) {\n const before = Number(prevCounters[key]);\n const after = curCounters[key] === undefined || curCounters[key] === null ? null : Number(curCounters[key]);\n if (!Number.isFinite(before)) continue; // nothing to fall FROM: not a finding, just no history\n if (after === null || !Number.isFinite(after as number)) {\n findings.push({\n check: BACKWARDS,\n severity: \"attention\",\n sentence:\n `${nameOf(key)} was being reported and now is not. It read ${commas(before)} on ${sayDate(prevAt)} and the ` +\n `latest reading does not carry it at all. A figure that stops being reported hides exactly what a figure ` +\n `going backwards hides, so it is raised the same way.`,\n numbers: { counter: key, label: nameOf(key), previous: before, current: null, previousAt: previous?.at ?? null },\n checkFirst:\n `Check whether whatever produces this figure answered at all on the last run. A reading that failed and a ` +\n `reading of nought look the same on a page and mean opposite things.`,\n });\n continue;\n }\n if ((after as number) >= before) continue;\n const fell = before - (after as number);\n findings.push({\n check: BACKWARDS,\n severity: \"urgent\",\n sentence:\n `${nameOf(key)} has gone backwards. It read ${commas(before)} on ${sayDate(prevAt)} and reads ` +\n `${commas(after as number)} now, a fall of ${commas(fell)}. Figures like this only ever go up, so a fall means ` +\n `it is being read from somewhere different: a source swapped, a list cut short, or a page walk that stopped ` +\n `early and reported what it had as the whole.`,\n numbers: {\n counter: key,\n label: nameOf(key),\n previous: before,\n current: after,\n fell,\n previousAt: previous?.at ?? null,\n currentAt: current?.at ?? null,\n },\n checkFirst:\n `Do not act on any figure derived from this one until it is explained. Send me this report and I will read ` +\n `the same total straight from the system that owns it.`,\n });\n }\n\n return {\n check: BACKWARDS,\n title: BACKWARDS_TITLE,\n inspected,\n inspectedLabel: BACKWARDS_LABEL,\n measured: { readings: list.length, compared: inspected, comparedAgainst: previous?.at ?? null },\n findings,\n };\n}\n\n// ---------------------------------------------------------------------------------------------\n// THE BUCKETING. Dates cut into windows, which is arithmetic and therefore testable.\n//\n// A RECORD WITH NO READABLE DATE IS NEVER INVENTED INTO A WINDOW. Dropping it understates a\n// window; guessing at it corrupts the baseline every later judgement is made against.\n// ---------------------------------------------------------------------------------------------\n\n/** Payments the bridge saw, cut into equal windows ending now, oldest window first. */\nexport function ratioBuckets(seen: unknown, nowMs: unknown, windowDays: number, windows: number): RatioPoint[] {\n const now = Number(nowMs);\n const spanMs = Math.max(1, Number(windowDays) || 1) * 24 * HOUR;\n const n = Math.max(1, Math.floor(Number(windows) || 1));\n const points = Array.from({ length: n }, (_, i) => {\n const endMs = now - (n - 1 - i) * spanMs;\n return { label: `the ${windowDays} days to ${sayDate(endMs)}`, endMs, total: 0, matched: 0 };\n });\n if (!Number.isFinite(now)) return points;\n for (const p of (Array.isArray(seen) ? seen : []) as any[]) {\n const at = Number(p?.atMs);\n if (!Number.isFinite(at)) continue;\n const back = Math.floor((now - at) / spanMs);\n if (back < 0 || back >= n) continue;\n const point = points[n - 1 - back];\n point.total += 1;\n if (p?.matched === true) point.matched += 1;\n }\n return points;\n}\n\n/** Records of work and the money against them, summed into equal windows, oldest window first. */\nexport function revenuePeriods(records: unknown, nowMs: unknown, windowDays: number, windows: number): RevenuePeriod[] {\n const now = Number(nowMs);\n const spanMs = Math.max(1, Number(windowDays) || 1) * 24 * HOUR;\n const n = Math.max(1, Math.floor(Number(windows) || 1));\n const periods = Array.from({ length: n }, (_, i) => {\n const endMs = now - (n - 1 - i) * spanMs;\n return { label: `the ${windowDays} days to ${sayDate(endMs)}`, endMs, activity: 0, dollars: 0 };\n });\n if (!Number.isFinite(now)) return periods;\n for (const rec of (Array.isArray(records) ? records : []) as any[]) {\n const at = Number(rec?.atMs);\n if (!Number.isFinite(at)) continue;\n const back = Math.floor((now - at) / spanMs);\n if (back < 0 || back >= n) continue;\n const period = periods[n - 1 - back];\n period.activity += 1;\n period.dollars += Number(rec?.dollars) || 0;\n }\n // Rounded to the cent at the end, not per addition: summing floats and rounding once is the only\n // version whose total matches what the CRM itself reports.\n for (const p of periods) p.dollars = Math.round(p.dollars * 100) / 100;\n return periods;\n}\n\n// ---------------------------------------------------------------------------------------------\n// THE WHOLE RUN.\n// ---------------------------------------------------------------------------------------------\n\nexport function runWatch(input: WatchInput): WatchReport {\n // A RUN THAT WAS NEVER TOLD THE TIME JUDGES NOTHING.\n //\n // The dangerous shape this refuses: a replay with a mistyped date silently reporting on today,\n // under a heading naming the date it was asked about, with every figure wrong and nothing in the\n // document able to see it. Inventing a clock here would be the one mistake this whole file could\n // make that nobody downstream could catch.\n const now = input?.nowMs;\n if (!Number.isFinite(now)) {\n return {\n generatedAt: \"not known\",\n headline: \"This check could not run, because it was not told what the time is.\",\n inspected: 0,\n checks: [],\n findings: [{\n check: \"clock\",\n severity: \"urgent\",\n sentence:\n `This run was not told what the time is, so it has judged nothing at all. Every figure in this report is ` +\n `measured against a moment, and inventing one would have produced a page of confident numbers about the ` +\n `wrong day. Nothing here is an all clear.`,\n numbers: { nowMs: String(now), inspected: 0 },\n checkFirst:\n `Run this again with the date it is meant to judge. If this was a replay of a past morning, check the date ` +\n `that was typed for it.`,\n }],\n };\n }\n const at = now as number;\n\n const checks: CheckResult[] = [\n silenceFindings(input?.streams, at),\n matchRatioFindings(input?.ratio?.points, input?.ratio?.subject ?? \"payments\"),\n revenueChannelFindings(input?.revenue?.periods, input?.revenue?.subject ?? \"your bookings\"),\n bridgeFindings(input?.journal, at),\n backwardsFindings(input?.snapshots, input?.counterLabels ?? {}),\n ];\n\n const inspected = checks.reduce((a, c) => a + (c.inspected ?? 0), 0);\n // MOST SEVERE FIRST, so the first thing she reads is the worst thing. A stable sort inside a\n // severity band keeps the checks in the order they ran, which is the order the report explains.\n const rank: Record = { urgent: 0, attention: 1, note: 2 };\n const findings = checks\n .flatMap((c) => c.findings.map((f) => ({ ...f, check: f.check ?? c.check })))\n .map((f, i) => ({ f, i }))\n .sort((a, b) => ((rank[a.f.severity] ?? 3) - (rank[b.f.severity] ?? 3)) || (a.i - b.i))\n .map((x) => x.f);\n\n return {\n generatedAt: new Date(at).toISOString(),\n headline: headlineFor(findings, checks, inspected),\n inspected,\n checks,\n findings,\n };\n}\n\n/**\n * The one line at the top. It leads with what has to happen today, and it never says a reassuring\n * thing about a run that could not see anything: \"nothing wrong\" and \"nothing looked at\" have to\n * be different sentences or the second one does the damage of the first.\n */\nexport function headlineFor(findings: Finding[], checks: CheckResult[], inspected: number): string {\n // v1.1 (16 Aug) — a finding from a check that read NOTHING is counted as a blind spot, never as a\n // problem with the business. Same rule as the section split in watchReportMarkdown; the two must\n // agree or the headline promises something the body does not contain.\n const isBlind = (f: Finding) => Number(f.numbers?.inspected) === 0;\n const n = (s: Severity) => findings.filter((f) => f.severity === s && !isBlind(f)).length;\n const urgent = n(\"urgent\");\n const attention = n(\"attention\");\n const notes = findings.filter((f) => f.severity === \"note\" || isBlind(f)).length;\n if (urgent) {\n return `${capitalise(countWord(urgent))} ${plural(urgent, \"thing needs\", \"things need\")} you to look at today` +\n `${attention ? `, and ${countWord(attention)} more ${plural(attention, \"is\", \"are\")} worth a look this week` : \"\"}.`;\n }\n if (attention) {\n return `${capitalise(countWord(attention))} ${plural(attention, \"thing is\", \"things are\")} worth a look this week.`;\n }\n if (notes) {\n // W42: when NOTHING could be read, \"nothing looks wrong\" is a reassuring sentence about a run\n // that judged nothing. Lead with the blindness instead. Only say the reassuring half when at\n // least one check actually read something and came back clean.\n const readSomething = checks.filter((c) => Number(c?.inspected) > 0).length;\n if (!readSomething) {\n return `Nothing could be checked. ${capitalise(countWord(notes))} ` +\n `${plural(notes, \"check\", \"checks\")} read no data at all, so this run judges nothing either way.`;\n }\n return `Nothing looks wrong in what could be checked, and ${countWord(notes)} ` +\n `${plural(notes, \"thing\", \"things\")} this monitor cannot see yet.`;\n }\n return `Nothing looks wrong. ${capitalise(countWord(checks.length))} checks ran and read ` +\n `${commas(inspected)} records between them.`;\n}\n\n// ---------------------------------------------------------------------------------------------\n// THE COPY SHE READS.\n//\n// TWO RULES, ENFORCED MECHANICALLY, and they run over the GENERATED report rather than over any\n// source file, because the sentences are built at run time and a rule that only reads source\n// cannot see them.\n// ---------------------------------------------------------------------------------------------\n\n/** One entry per rule broken, so an em dash and a spaced hyphen in one page are one problem, not two. */\nexport function copyProblems(text: unknown): string[] {\n const s = String(text ?? \"\");\n const out: string[] = [];\n // The name of a service this business does not offer. She asked for it never to appear.\n if (/\\bday\\s?care\\b/i.test(s)) out.push(\"names a service this business does not offer\");\n // A dash used as punctuation, in any of its forms. Hyphens INSIDE words are fine and common:\n // \"well known\" hyphenated, a phone number, a field name. Only a dash standing alone counts.\n if (/(^|\\s)[-–—](\\s|$)|[–—]/.test(s)) out.push(\"uses a dash as punctuation\");\n return out;\n}\n\n/**\n * THE ENGINE'S OWN VIEW of the report: every finding, the figures behind it, and what every check\n * read including the checks that found nothing.\n *\n * WHY THE CHECKS THAT FOUND NOTHING ARE PRINTED. A report that prints only problems gives the\n * reader no way to tell \"checked and clean\" from \"checked nothing\", and that exact confusion is\n * what let February run for five months.\n *\n * This is the workings, not the page for the owner. scripts/watch-run.mjs renders her page from\n * the same report object and keeps this one in the repo, so a queried figure can still be traced.\n */\nexport function watchReportMarkdown(report: WatchReport, title: unknown): string {\n const heading = String(title ?? \"Early warning check\");\n const findings = Array.isArray(report?.findings) ? report.findings : [];\n const checks = Array.isArray(report?.checks) ? report.checks : [];\n // v1.1 (16 Aug) — THE SPLIT IS \"DID IT READ ANYTHING\", NOT SEVERITY ALONE. A blind check keeps\n // severity \"urgent\" (six tests hold that, and it must never go quiet), but it is not a fault in\n // the business and it must not be filed as one. Before this, the report opened \"Two things need\n // you to look at today\" when both were checks that had never been wired up — the exact shape of\n // failure this page exists to prevent, pointed inward.\n const readNothing = (f: Finding) => Number(f.numbers?.inspected) === 0;\n const loud = findings.filter((f) => f.severity !== \"note\" && !readNothing(f));\n const notes = findings.filter((f) => f.severity === \"note\" || readNothing(f));\n const band: Record = {\n urgent: \"Look at this today\",\n attention: \"Worth a look this week\",\n note: \"The monitor talking about itself\",\n };\n const figures = (o: Record) =>\n Object.entries(o ?? {})\n .filter(([, v]) => v !== undefined && (typeof v !== \"object\" || v === null))\n .map(([k, v]) => `${k}: ${v === null ? \"not known\" : String(v)}`)\n .join(\", \");\n\n const out: string[] = [];\n out.push(`# ${heading}`);\n out.push(\"\");\n out.push(report?.headline ?? \"\");\n out.push(\"\");\n out.push(`Read at ${report?.generatedAt ?? \"not known\"}. ${commas(report?.inspected ?? 0)} records inspected across ${checks.length} checks.`);\n out.push(\"\");\n\n const say = (f: Finding) => {\n out.push(`### ${band[f.severity] ?? f.severity}. ${f.check}`);\n out.push(\"\");\n out.push(f.sentence);\n out.push(\"\");\n const fig = figures(f.numbers);\n if (fig) { out.push(`The figures behind that: ${fig}`); out.push(\"\"); }\n if (f.checkFirst) { out.push(`Check first: ${f.checkFirst}`); out.push(\"\"); }\n };\n\n if (loud.length) {\n out.push(`## What needs your attention`);\n out.push(\"\");\n for (const f of loud) say(f);\n }\n if (notes.length) {\n out.push(`## What this monitor cannot see yet`);\n out.push(\"\");\n out.push(\n `These are not problems with the business. They are the monitor saying where it is unable to judge anything, ` +\n `which is worth knowing rather than reading as a clean result.`);\n out.push(\"\");\n for (const f of notes) say(f);\n }\n\n out.push(`## What every check read, including the ones that found nothing`);\n out.push(\"\");\n for (const c of checks) {\n out.push(`${c.title}: read ${commas(c.inspected ?? 0)} ${c.inspectedLabel}, and raised ` +\n `${commas(c.findings?.length ?? 0)} ${plural(c.findings?.length ?? 0, \"finding\", \"findings\")}.`);\n const fig = figures(c.measured);\n if (fig) out.push(`The figures behind that: ${fig}`);\n out.push(\"\");\n }\n\n const blind = blindSpots(checks);\n out.push(`## Whether this report can be believed`);\n out.push(\"\");\n out.push(blind.length\n ? `${capitalise(countWord(blind.length))} ${plural(blind.length, \"check\", \"checks\")} inspected nothing and said ` +\n `nothing about it, which means this report is not watching what it claims to. Do not read it as a clean result.`\n : `Every check above reported the size of what it read, and every check that read nothing said so in its own ` +\n `finding rather than passing silently. A check that inspects nothing is a blind spot, not an all clear, and ` +\n `that is the one rule this whole report rests on.`);\n out.push(\"\");\n\n return out.join(\"\\n\").replace(/\\n{3,}/g, \"\\n\\n\");\n}\n",[227],"688e5db6-6ef1-4ce7-9e68-debe3b68e8bb","watch-view.ts","d0159a5c-98c4-11f1-99c3-1607ee4eb77e",1168,["D",1786979142676],2,"http","// READING THE EARLY-WARNING MONITOR. v1.0, 15 Aug 2026.\n//\n// engine/watch-cron.ts runs on an interval and writes one blob. An interval on val.town has no\n// endpoint, so without this file the report would exist and be unreadable — which is a different\n// way of arriving at exactly the state this whole exercise is correcting: something that is built,\n// and running, and nobody can see.\n//\n// TWO SHAPES. `?f=json` for machines and for a future dashboard tile; the default is the plain\n// markdown the report already knows how to write about itself, because the audience for an early\n// warning is a person deciding whether to act on it, not a parser.\n//\n// THE AGE IS THE HEADLINE. A monitor that stopped last Tuesday and a monitor that says \"all clear\"\n// look identical if you only print the findings. So the first thing this route says is how old the\n// report is and whether the last run actually succeeded, ABOVE the findings, every time.\n\nimport { watchReportMarkdown } from \"./watch.ts\";\nimport { WATCH_BLOB, type WatchBlob } from \"./watch-cron.ts\";\n\n/** A run older than this has almost certainly stopped rather than been quiet. The interval is\n * hourly; a day and a half of silence is not a scheduling wobble. */\nconst STALE_HOURS = 36;\n\nasync function sha256Hex(s: string): Promise {\n const b = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(s));\n return [...new Uint8Array(b)].map((x) => x.toString(16).padStart(2, \"0\")).join(\"\");\n}\nasync function authorised(k: string): Promise {\n const configured = Deno.env.get(\"NURTURE_ADMIN_KEY_SHA256\");\n if (!k || !configured || !/^[0-9a-f]{64}$/i.test(configured)) return false;\n const got = await sha256Hex(k);\n const want = configured.toLowerCase();\n if (got.length !== want.length) return false;\n let d = 0;\n for (let i = 0; i < got.length; i++) d |= got.charCodeAt(i) ^ want.charCodeAt(i);\n return d === 0;\n}\n\nexport default async function (req: Request): Promise {\n const u = new URL(req.url);\n if (!(await authorised(u.searchParams.get(\"k\") ?? \"\"))) return new Response(\"Not found\", { status: 404 });\n\n let stored: WatchBlob | null = null;\n try {\n const { blob } = await import(\"https://esm.town/v/std/blob\");\n stored = (await blob.getJSON(WATCH_BLOB).catch(() => null)) as WatchBlob | null;\n } catch { /* fall through to the never-run answer below */ }\n\n if (!stored) {\n const body = { ok: false, state: \"never-run\", what: \"The early-warning monitor has not completed a run yet.\" };\n return u.searchParams.get(\"f\") === \"json\"\n ? Response.json(body, { status: 200 })\n : new Response(`${body.what}\\n`, { headers: { \"Content-Type\": \"text/plain; charset=utf-8\" } });\n }\n\n const ageH = (Date.now() - Date.parse(stored.builtAt)) / 3_600_000;\n const health = {\n reportAgeHours: +ageH.toFixed(1),\n stale: ageH > STALE_HOURS,\n lastRunOk: stored.lastRun?.ok ?? null,\n lastRunAt: stored.lastRun?.at ?? null,\n lastRunError: stored.lastRun?.error || null,\n // Said out loud so nobody has to infer it from an absence. See watch-cron.ts's header.\n coverage:\n \"Runs automatically: the February shape (activity against dollars), the silence check on CRM \" +\n \"payments and new contacts, and the running totals. NOT run automatically: the Square \" +\n \"match-ratio and bridge-journal checks, which need the Square bridge and are still \" +\n \"scripts/watch-run.mjs by hand. Uninspected checks appear in the findings as blind spots.\",\n };\n\n if (u.searchParams.get(\"f\") === \"json\") {\n return Response.json({ ok: true, health, inspected: stored.inspected, report: stored.report, snapshots: stored.snapshots });\n }\n\n const head = [\n `Report built ${stored.builtAt} (${health.reportAgeHours}h ago)${health.stale ? \" ***STALE — THE MONITOR HAS PROBABLY STOPPED***\" : \"\"}`,\n `Last run ${health.lastRunOk ? \"succeeded\" : `FAILED: ${health.lastRunError}`} at ${health.lastRunAt}`,\n `Inspected ${stored.inspected?.transactions ?? 0} payment records across ${stored.inspected?.pages ?? 0} page(s)` +\n (stored.inspected?.truncated ? \" — TRUNCATED, raise PAGE_CAP\" : \"\"),\n health.coverage,\n \"\",\n ].join(\"\\n\");\n\n return new Response(head + watchReportMarkdown(stored.report, \"The Dogs Spot — early warning\"), {\n headers: { \"Content-Type\": \"text/plain; charset=utf-8\" },\n });\n}\n",[235],"3d600f37-f3b5-4b9e-8fa7-bd1735599520","watch-cron.ts","cfa8812e-98c4-11f1-9f38-1607ee4eb77e",1111,["D",1786810792463],1,"interval","// THE EARLY-WARNING MONITOR, ACTUALLY RUNNING. v1.0, 15 Aug 2026.\n//\n// WHY THIS FILE HAD TO EXIST, stated plainly because it is a correction and not a feature.\n//\n// Kim asked, on 12 Aug: find out what broke on 19 February, and build exception monitoring so a\n// five-month gap cannot happen again. She was told in writing on 14 Aug:\n//\n// \"Exception monitoring is built and running.\"\n//\n// The first half was true. The second half was not. engine/watch.ts is real, tested (50 assertions,\n// including a replay of the actual February records that raises the alarm on 23 Feb), and had\n// **zero callers anywhere in the tree**. It is absent from the TYPES map in scripts/deploy.mjs, so\n// it deployed to the val as an inert `script`: no interval, no endpoint, nothing to invoke it. Its\n// only runner, scripts/watch-run.mjs, says so in its own header — \"READ ONLY, DEPLOYS NOTHING,\n// SCHEDULES NOTHING\" — and needs a human at a laptop. scripts/restore.mjs already called watch.ts\n// \"the one the val cannot supply\". The codebase knew. The client was told otherwise.\n//\n// This file is the interval that makes the sentence true.\n//\n// WHAT IT DOES AND DOES NOT COVER, so that the same claim is not made twice.\n//\n// The February failure had a specific shape: the work kept happening and the money stopped being\n// written down. That is revenueChannelFindings — activity against dollars over rolling windows —\n// and it needs only the CRM's own payment records, which this file can read on a schedule.\n//\n// It does NOT run the match-ratio check. That one compares what the Square bridge saw against what\n// reached a customer record, and it needs the bridge journal plus the exception-report library that\n// lives on the scripts side. Rather than quietly omit it, the report SAYS it was not inspected:\n// runWatch's own blind-spot machinery turns an uninspected check into a visible line rather than a\n// silent pass. A monitor that hides what it did not look at is the failure it exists to prevent.\n//\n// IT READS AND IT WRITES ONE BLOB. There is no path from here to a message, a tag, a charge or a\n// customer record. The GHL token is used on GET only.\n//\n// IT NEVER SHOUTS AND IT NEVER INVENTS. If the CRM is unreachable it logs, leaves the last report\n// exactly where it was, and records the failure. The view route says how old the report is, so a\n// dead monitor degrades into a visibly stale timestamp instead of into silence that reads as calm.\n\nimport { runWatch, revenuePeriods, type WatchReport } from \"./watch.ts\";\n\nconst LOC = \"BQHJ19uohldYe3eqA0bl\";\nconst GHL = \"https://services.leadconnectorhq.com\";\n// Cloudflare in front of the CRM refuses non-browser clients inconsistently; every read in this\n// project sends a Chrome UA for that reason.\nconst UA =\n \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\";\n\nexport const WATCH_BLOB = \"watch_report\";\n/** Rolling windows for the February shape. 28 days x 7 covers half a year, which is the length of\n * the gap that actually happened — a monitor with a shorter memory than the failure is decoration. */\nexport const REVENUE_WINDOW_DAYS = 28;\nexport const REVENUE_WINDOWS = 7;\n/** Running totals kept between runs, so \"the number went down\" is answerable. */\nexport const MAX_SNAPSHOTS = 60;\n/** Below this a transaction is a $0 placeholder — a booking with nothing in the amount box, which is\n * precisely the February symptom. It still counts as ACTIVITY; it contributes no DOLLARS. */\nexport const REAL_MONEY = 0.01;\n/** Pages of 100. 237 transactions live on 15 Aug 2026; the cap is a runaway guard, not a limit. */\nexport const PAGE_CAP = 40;\n\nexport type WatchBlob = {\n report: WatchReport;\n builtAt: string;\n inspected: { transactions: number; pages: number; truncated: boolean };\n lastRun: { at: string; ok: boolean; ms: number; error: string };\n snapshots: { at: string; counters: Record }[];\n};\n\nasync function ghlToken(): Promise {\n const env = Deno.env.get(\"GHL_TOKEN\");\n if (env) return env;\n const { blob } = await import(\"https://esm.town/v/std/blob\");\n const cfg = (await blob.getJSON(\"puppy_config\").catch(() => null)) as { ghlToken?: string } | null;\n return cfg?.ghlToken ?? \"\";\n}\n\n/** Every payment record the CRM holds, newest first, paged. GET only. */\nexport async function readTransactions(\n get: (url: string) => Promise,\n): Promise<{ rows: { atMs: number | null; dollars: number }[]; count: number; pages: number; truncated: boolean }> {\n const rows: { atMs: number | null; dollars: number }[] = [];\n let pages = 0, offset = 0, more = true;\n while (more && pages < PAGE_CAP) {\n const page = await get(`${GHL}/payments/transactions?altId=${LOC}&altType=location&limit=100&offset=${offset}`);\n const data: any[] = page?.data ?? [];\n for (const t of data) {\n // A failed charge is not revenue and never was. It IS activity — somebody tried to pay — but\n // counting it as dollars would mask exactly the gap this check looks for.\n const ok = String(t?.status ?? \"\") === \"succeeded\";\n const amt = Number(t?.amount);\n const at = Date.parse(String(t?.createdAt ?? \"\"));\n rows.push({\n atMs: Number.isFinite(at) ? at : null,\n dollars: ok && Number.isFinite(amt) && amt >= REAL_MONEY ? amt : 0,\n });\n }\n pages++;\n offset += data.length;\n more = data.length === 100;\n }\n return { rows, count: rows.length, pages, truncated: more };\n}\n\n/**\n * Newest contact-creation timestamps, for the silence check.\n *\n * BOUNDED ON PURPOSE. The full walk is 58 pages of 100 on this account and it runs hourly; the\n * silence check only asks \"has this gone quiet\", which is a question about the recent end of the\n * list. Three pages is roughly twelve days of intake at the observed 25/day and is plenty to notice\n * a stop. It is NOT enough to count anything, and nothing here tries to.\n */\nexport async function readContactTimes(get: (url: string) => Promise, pages = 3): Promise {\n const out: number[] = [];\n let url: string | null = `${GHL}/contacts/?locationId=${LOC}&limit=100`;\n for (let i = 0; i < pages && url; i++) {\n const page: any = await get(url);\n for (const c of page?.contacts ?? []) {\n const at = Date.parse(String(c?.dateAdded ?? \"\"));\n if (Number.isFinite(at)) out.push(at);\n }\n url = page?.meta?.nextPageUrl ?? null;\n }\n return out;\n}\n\nexport default async function (): Promise {\n const t0 = Date.now();\n let blob: any = null;\n try {\n blob = (await import(\"https://esm.town/v/std/blob\")).blob;\n const prev = (await blob.getJSON(WATCH_BLOB).catch(() => null)) as WatchBlob | null;\n\n const token = await ghlToken();\n if (!token) throw new Error(\"no GHL token in env or puppy_config blob\");\n const get = async (url: string) => {\n const r = await fetch(url, {\n headers: { Authorization: `Bearer ${token}`, Version: \"2021-07-28\", \"User-Agent\": UA, Accept: \"application/json\" },\n });\n if (!r.ok) throw new Error(`${r.status} ${url.slice(0, 110)}`);\n return r.json();\n };\n\n const now = Date.now();\n const tx = await readTransactions(get);\n\n // A RUN THAT READ NOTHING MUST NOT OVERWRITE A RUN THAT READ SOMETHING. Zero transactions from a\n // CRM that held 237 yesterday is a read failure wearing the costume of a quiet month, and\n // publishing it as a report would be the February mistake committed by the monitor itself.\n if (tx.count === 0 && (prev?.inspected?.transactions ?? 0) > 0) {\n throw new Error(`read 0 transactions but the last good run read ${prev!.inspected.transactions}; refusing to publish`);\n }\n\n const periods = revenuePeriods(tx.rows, now, REVENUE_WINDOW_DAYS, REVENUE_WINDOWS);\n const txTimes = tx.rows.map((r) => r.atMs).filter((x): x is number => Number.isFinite(x as number));\n const counters = {\n crmPaymentRecords: tx.count,\n crmPaymentDollarsLifetime:\n Math.round(tx.rows.reduce((a, r) => a + r.dollars, 0) * 100) / 100,\n };\n const snapshots = [...(prev?.snapshots ?? []), { at: new Date(now).toISOString(), counters }].slice(-MAX_SNAPSHOTS);\n\n // The silence check gets the two streams this file can honestly read. A stream that fails to\n // read is OMITTED rather than passed in empty: an empty list would read as \"nothing has arrived\",\n // which is the alarm, and raising it because of our own read failure is crying wolf.\n const streams: { name: string; timestamps: number[]; whereToLook?: string }[] = [\n { name: \"payments recorded in your CRM\", timestamps: txTimes, whereToLook: \"Payments in GoHighLevel\" },\n ];\n try {\n const contactTimes = await readContactTimes(get);\n if (contactTimes.length) {\n streams.push({ name: \"new people arriving in your CRM\", timestamps: contactTimes, whereToLook: \"Contacts in GoHighLevel\" });\n }\n } catch (e) {\n console.log(`[watch] contact stream unreadable, omitted rather than reported as silent: ${String(e).slice(0, 120)}`);\n }\n\n const report = runWatch({\n nowMs: now,\n streams,\n // Deliberately not passed: ratio and journal. Both need the Square bridge, which this file\n // cannot reach. Each becomes a visible \"not inspected\" line via blindSpots rather than an\n // invisible pass. See the header.\n revenue: { subject: \"your bookings\", periods },\n snapshots,\n counterLabels: {\n crmPaymentRecords: \"The number of payment records in your CRM\",\n crmPaymentDollarsLifetime: \"The total value of every payment your CRM has ever recorded\",\n },\n });\n\n const next: WatchBlob = {\n report,\n builtAt: new Date(now).toISOString(),\n inspected: { transactions: tx.count, pages: tx.pages, truncated: tx.truncated },\n lastRun: { at: new Date(now).toISOString(), ok: true, ms: Date.now() - t0, error: \"\" },\n snapshots,\n };\n await blob.setJSON(WATCH_BLOB, next);\n\n const urgent = (report.findings ?? []).filter((f: any) => f.severity === \"urgent\").length;\n const attention = (report.findings ?? []).filter((f: any) => f.severity === \"attention\").length;\n console.log(`[watch] ${tx.count} transactions, ${report.findings?.length ?? 0} finding(s) — ${urgent} urgent, ${attention} attention. ${report.headline}`);\n } catch (e) {\n const msg = String(e).slice(0, 240);\n console.log(`[watch] run failed: ${msg}`);\n // Record the failure ON the last good report rather than replacing it. A monitor whose own\n // failures are invisible is worth less than no monitor, because it is trusted.\n try {\n if (blob) {\n const prev = (await blob.getJSON(WATCH_BLOB).catch(() => null)) as WatchBlob | null;\n if (prev) {\n await blob.setJSON(WATCH_BLOB, {\n ...prev,\n lastRun: { at: new Date().toISOString(), ok: false, ms: Date.now() - t0, error: msg },\n });\n }\n }\n } catch { /* a cache that will not persist must not turn one failure into two */ }\n }\n}\n",[244],"9e51d817-cbdc-42a1-b4e8-c984b3c7a9d0","tracking.ts","e66f0424-98cd-11f1-9ee4-1607ee4eb77e",1176,["D",1786982812384],4,"// ONE PAGE FOR ALL THREE CHANNELS, IN AND OUT. v1.0, 15 Aug 2026.\n//\n// WHAT KIM ACTUALLY ASKED FOR, three times, in three different sets of words:\n//\n// \"how do we verify that Facebook is actually receiving and using the information we're sending\n// back from the CRM... I want to be able to see what information is going the other direction —\n// from GHL back to Facebook — and know that it's working correctly\" [12 Aug]\n// \"getting Google onto the same person-in-the-CRM attribution footing as Facebook is on the list.\n// Can you give me a timeline for when you expect to have that piece in place?\" [12 Aug]\n// \"some kind of early-warning system so a five-month gap like this can't quietly happen again\"\n// [12 Aug]\n//\n// Three questions, one shape: FOR EACH CHANNEL, IS DATA MOVING IN BOTH DIRECTIONS, AND WHEN DID IT\n// LAST MOVE? Every piece already existed on separate pages and in separate blobs. Nothing joined\n// them, so answering her needed four URLs and a person who knew which four.\n//\n// THE RULE THIS PAGE IS BUILT ON, and it is the same rule as the early-warning monitor: a channel\n// this page CANNOT read is shown as unreadable, never as healthy. The five-month Square gap\n// happened because a silence looked like a calm. Blank is not green here; blank is grey and says\n// so.\n//\n// WHAT IT CAN AND CANNOT SEE, stated once here so the page never has to imply otherwise:\n// * INBOUND, all three channels: fully readable. It is the CRM's own attribution data.\n// * OUTBOUND to Google: readable. The conversion feed writes its own build log to a blob.\n// * OUTBOUND to Facebook: readable from the bridge's PII-free Meta Graph API response journal.\n// An events_received receipt proves Meta accepted the server event; it does not prove Meta\n// later used that event for attribution or optimisation, and the page says so explicitly.\n// * SQUARE: readable through the CRM's payment records, which is the direction that broke in\n// February and the direction that matters.\n//\n// READ ONLY. GET against GoHighLevel, plus two blobs written by other files. No write path exists.\n\nimport { cacheIntegrity, diagnoseSupply, feedState, SCHEDULE_STALL_DAYS, type Cache as FeedCache } from \"./gads-feed.ts\";\nimport { GOOGLE_ADS_BLOB, snapshotFreshness, type GoogleAdsSnapshot } from \"./google-ads-ingest.ts\";\nimport { WATCH_BLOB, type WatchBlob } from \"./watch-cron.ts\";\n\nconst LOC = \"BQHJ19uohldYe3eqA0bl\";\nconst GHL = \"https://services.leadconnectorhq.com\";\nconst BRIDGE = \"https://amir5--41ace24c7e2111f18c9d1607ee4eb77e.web.val.run\";\nconst UA =\n \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\";\n\n/** How far back \"recent\" reaches. Long enough that a quiet week is not an alarm, short enough that\n * a month-long outage cannot hide inside it. */\nconst WINDOW_DAYS = 30;\n/** Contact pages to walk. 100 per page; 20 pages covers well beyond the requested 30 days at the\n * observed volume while retaining a hard safety bound for a human-facing page. */\nconst PAGES = 20;\n/** A channel that has sent nothing for this long is not quiet, it has stopped. */\nconst SILENT_DAYS = 7;\n/** The monitor is hourly. Match its dedicated view: 36 hours is stale, not a scheduling wobble. */\nexport const MONITOR_MAX_AGE_MS = 36 * 3_600_000;\nconst FUTURE_TOLERANCE_MS = 5 * 60_000;\n// Immutable first-run receipt observed directly in Google Ads Uploads after the secured recurring\n// schedule was created. It proves the file format and conversion actions were accepted once; it is\n// never presented as proof that a later automatic run succeeded.\nconst INITIAL_GOOGLE_UPLOAD_RECEIPT = {\n at: \"2026-08-17T15:30:46.000Z\", successful: 13, failed: 0, source: \"Google Ads Uploads UI\",\n} as const;\n\nconst GOOD = \"#0ca30c\", WARN = \"#fab219\", CRIT = \"#d03b3b\", GREY = \"#898781\";\n\nasync function sha256Hex(s: string): Promise {\n const b = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(s));\n return [...new Uint8Array(b)].map((x) => x.toString(16).padStart(2, \"0\")).join(\"\");\n}\nconst constantTimeEqual = (a: string, b: string): boolean => {\n let difference = a.length ^ b.length;\n for (let i = 0; i < Math.min(a.length, b.length); i++) difference |= a.charCodeAt(i) ^ b.charCodeAt(i);\n return difference === 0;\n};\nasync function isAdmin(k: string): Promise {\n const expected = (Deno.env.get(\"NURTURE_ADMIN_KEY_SHA256\") ?? \"\").trim().toLowerCase();\n return !!k && /^[0-9a-f]{64}$/.test(expected) && constantTimeEqual(await sha256Hex(k), expected);\n}\nexport async function viewerKeyForToken(tok: string): Promise {\n return \"tds_view_\" + (await sha256Hex(tok + \":view\")).slice(0, 32);\n}\nasync function isViewer(k: string): Promise {\n const tok = await ghlToken();\n return !!tok && !!k && constantTimeEqual(k, await viewerKeyForToken(tok));\n}\nasync function ghlToken(): Promise {\n return (Deno.env.get(\"GHL_TOKEN\") ?? \"\").trim();\n}\n\nconst esc = (s: unknown) =>\n String(s ?? \"\").replace(/[&<>\"']/g, (c) => ({ \"&\": \"&\", \"<\": \"<\", \">\": \">\", '\"': \""\", \"'\": \"'\" }[c] as string));\n\nexport type Channel = {\n name: string;\n /** Leads arriving FROM the channel INTO the CRM. */\n inbound: { n: number | null; withId: number | null; lastAt: number | null; note: string };\n /** Outcomes going back OUT to the channel. null when this page cannot see it. */\n outbound: { state: string; detail: string; lastAt: number | null } | null;\n verdict: { colour: string; word: string; line: string };\n};\n\nexport type TimestampFreshness = {\n state: \"fresh\" | \"stale\" | \"future\" | \"missing\" | \"invalid\";\n at: number | null;\n ageMs: number | null;\n};\n\nexport type MetaReceipt = {\n state: \"fresh\" | \"stale\" | \"missing\" | \"invalid\";\n accepted: number;\n failed: number;\n lastAcceptedAt: number | null;\n reason: string;\n};\n\n/** One clock contract for every stored source. Future data is never treated as extra-fresh. */\nexport function timestampFreshness(\n iso: string | null | undefined,\n nowMs: number,\n maxAgeMs: number,\n): TimestampFreshness {\n if (!iso) return { state: \"missing\", at: null, ageMs: null };\n const at = Date.parse(iso);\n if (!Number.isFinite(at) || !Number.isFinite(nowMs) || !Number.isFinite(maxAgeMs) || maxAgeMs < 0) {\n return { state: \"invalid\", at: null, ageMs: null };\n }\n if (at > nowMs + FUTURE_TOLERANCE_MS) return { state: \"future\", at, ageMs: at - nowMs };\n const ageMs = Math.max(0, nowMs - at);\n return { state: ageMs <= maxAgeMs ? \"fresh\" : \"stale\", at, ageMs };\n}\n\n/** Reduce the bridge's PII-free response journal into the one fact this page may claim: Meta's\n * API accepted a live server event. `resp` is the Graph API's `events_received`; a test event is\n * never allowed to prove production health, and acceptance is never described as downstream use. */\nexport function metaReceiptFromJournal(raw: unknown, nowMs: number): MetaReceipt {\n if (!Array.isArray(raw)) {\n return { state: \"invalid\", accepted: 0, failed: 0, lastAcceptedAt: null, reason: \"the bridge journal is not an array\" };\n }\n let accepted = 0, failed = 0, malformed = 0, lastAcceptedAt: number | null = null;\n for (const row of raw) {\n if (!row || typeof row !== \"object\" || (row as any).test === true) continue;\n const kind = String((row as any).kind ?? \"\");\n if (kind === \"CAPI-ERROR\") { failed++; continue; }\n if (kind !== \"CAPI-PURCHASE\") continue;\n const at = Date.parse(String((row as any).ts ?? \"\"));\n const received = Number((row as any).resp);\n if (!Number.isFinite(at) || at > nowMs + FUTURE_TOLERANCE_MS || !Number.isFinite(received) || received < 1) {\n malformed++;\n continue;\n }\n accepted++;\n if (lastAcceptedAt === null || at > lastAcceptedAt) lastAcceptedAt = at;\n }\n if (accepted === 0) {\n return {\n state: malformed ? \"invalid\" : \"missing\", accepted, failed, lastAcceptedAt,\n reason: malformed ? `${malformed} Meta acceptance receipt${malformed === 1 ? \" is\" : \"s are\"} malformed` : \"no live Meta acceptance receipt exists\",\n };\n }\n const stale = nowMs - lastAcceptedAt! > SILENT_DAYS * 86_400_000;\n return {\n state: stale ? \"stale\" : \"fresh\", accepted, failed, lastAcceptedAt,\n reason: `${accepted} live Purchase event${accepted === 1 ? \"\" : \"s\"} accepted by Meta's API${failed ? `; ${failed} failure receipt${failed === 1 ? \"\" : \"s\"} also recorded` : \"\"}`,\n };\n}\n\nasync function readMetaReceipt(nowMs: number): Promise {\n const secret = (Deno.env.get(\"BRIDGE_ADMIN\") ?? \"\").trim();\n if (!secret) return { state: \"invalid\", accepted: 0, failed: 0, lastAcceptedAt: null, reason: \"bridge credential unavailable\" };\n try {\n const r = await fetch(`${BRIDGE}?dump=1&admin=${encodeURIComponent(secret)}`, { signal: AbortSignal.timeout(15_000) });\n if (!r.ok) return { state: \"invalid\", accepted: 0, failed: 0, lastAcceptedAt: null, reason: `bridge returned ${r.status}` };\n return metaReceiptFromJournal(await r.json(), nowMs);\n } catch {\n return { state: \"invalid\", accepted: 0, failed: 0, lastAcceptedAt: null, reason: \"bridge did not answer\" };\n }\n}\n\nconst GOOGLE_ANY_ID = /(?:\"[A-Za-z_]*(?:gclid|gbraid|wbraid)\"\\s*:\\s*\"[A-Za-z0-9_-]{20,200}\"|(?:gclid|gbraid|wbraid)(?:=|%3D|%253D)[A-Za-z0-9_-]{20,200})/i;\nconst GOOGLE_GCLID = /(?:\"[A-Za-z_]*gclid\"\\s*:\\s*\"[A-Za-z0-9_-]{20,200}\"|gclid(?:=|%3D|%253D)[A-Za-z0-9_-]{20,200})/i;\nconst FACEBOOK_ID = /(?:\"(?:ad_?id|adId|fbclid)\"\\s*:\\s*\"[^\"\\s]+\"|fbclid(?:=|%3D|%253D)[^&\"\\s]+)/i;\n\n/**\n * Classify one contact's origin from whatever the CRM happens to carry.\n *\n * WHY THE WHOLE RECORD IS SERIALISED RATHER THAN READ FIELD BY FIELD. GoHighLevel puts attribution\n * in at least four shapes depending on which endpoint answered — attributions[], attributionSource,\n * lastAttributionSource, and a pageUrl carrying the query string. The list endpoint and the detail\n * endpoint never return the same shape. A matcher that knows one of them is one refactor from\n * finding nothing, which is exactly what happened to the Google click-id matcher in July.\n */\nexport function classify(raw: string, tags: string[]): \"google\" | \"facebook\" | \"other\" {\n const t = tags.map((x) => String(x).toLowerCase());\n if (GOOGLE_ANY_ID.test(raw)) return \"google\";\n if (t.includes(\"facebook-ads\") || t.includes(\"messenger\") || t.includes(\"instagram messenger\")) return \"facebook\";\n if (/fbclid|\"facebook\"|\"instagram\"|paid social/i.test(raw)) return \"facebook\";\n if (/\"google\"|utm_source[\"\\s:=]+google/i.test(raw)) return \"google\";\n return \"other\";\n}\n\n/** Origin and upload eligibility are different facts. A later Google visit may add a GCLID to an\n * old direct/Facebook contact; it makes that contact potentially return-eligible, but it does not\n * rewrite who originally acquired them. Prefer GHL's explicit first attribution when present. */\nexport function classifyFirstTouch(contact: any): \"google\" | \"facebook\" | \"other\" {\n const attributions = Array.isArray(contact?.attributions) ? contact.attributions : [];\n const first = attributions.find((a: any) => a?.isFirst === true)\n ?? contact?.firstAttributionSource\n ?? contact?.attributionSource\n ?? null;\n if (first) return classify(JSON.stringify(first), contact?.tags ?? []);\n return classify(JSON.stringify(contact ?? {}), contact?.tags ?? []);\n}\n\n/** Does this contact carry the id that makes it ATTRIBUTABLE, not merely sourced? */\nexport function hasAdId(raw: string, kind: string): boolean {\n if (kind === \"google\") return GOOGLE_GCLID.test(raw);\n if (kind === \"facebook\") return FACEBOOK_ID.test(raw);\n return false;\n}\n\nconst ago = (ms: number | null) => {\n if (!ms) return \"never\";\n const h = (Date.now() - ms) / 3_600_000;\n if (h < 1) return \"under an hour ago\";\n if (h < 48) return `${Math.round(h)} hours ago`;\n return `${Math.round(h / 24)} days ago`;\n};\n\nexport default async function (req: Request): Promise {\n const u = new URL(req.url);\n const k = u.searchParams.get(\"k\") ?? \"\";\n const admin = await isAdmin(k);\n const viewer = !admin && await isViewer(k);\n if (!admin && !viewer) return new Response(\"Not found\", { status: 404 });\n if (req.method !== \"GET\" && req.method !== \"HEAD\") return new Response(\"Not found\", { status: 404 });\n // Kim's derived viewer key can render the human page, but it cannot expose the machine-readable\n // payload. The JSON route remains an administrative diagnostic surface only.\n if (u.searchParams.get(\"f\") === \"json\" && !admin) return new Response(\"Not found\", { status: 404 });\n\n const now = Date.now();\n const checkedAt = new Date(now).toISOString();\n const cutoff = now - WINDOW_DAYS * 86_400_000;\n const errors: string[] = [];\n const metaReceiptPromise = readMetaReceipt(now);\n\n // ── INBOUND: who has arrived, from where, carrying what. ───────────────────────────────────────\n const counts: Record = {\n google: { n: 0, withId: 0, lastAt: null },\n facebook: { n: 0, withId: 0, lastAt: null },\n other: { n: 0, withId: 0, lastAt: null },\n };\n let scanned = 0, reachedCutoff = false, contactsReadable = false;\n try {\n const token = await ghlToken();\n if (!token) throw new Error(\"no CRM token available\");\n let url: string | null = `${GHL}/contacts/?locationId=${LOC}&limit=100`;\n const seenPages = new Set(), seenContacts = new Set();\n for (let p = 0; p < PAGES && url && !reachedCutoff; p++) {\n const target = new URL(url, GHL);\n if (target.origin !== GHL || !target.pathname.startsWith(\"/contacts/\")) throw new Error(\"unsafe contacts pagination URL\");\n if (seenPages.has(target.toString())) throw new Error(\"contacts pagination repeated a page\");\n seenPages.add(target.toString());\n const r = await fetch(target.toString(), {\n headers: { Authorization: `Bearer ${token}`, Version: \"2021-07-28\", \"User-Agent\": UA, Accept: \"application/json\" },\n });\n if (!r.ok) throw new Error(`contacts ${r.status}`);\n const page: any = await r.json();\n if (!page || !Array.isArray(page.contacts)) throw new Error(\"contacts response has no contacts array\");\n for (const c of page.contacts) {\n const id = String(c?.id ?? \"\").trim();\n if (!id) throw new Error(\"contact has no stable id\");\n if (seenContacts.has(id)) throw new Error(\"contact pagination returned a duplicate id\");\n seenContacts.add(id);\n const added = Date.parse(String(c?.dateAdded ?? \"\"));\n if (!Number.isFinite(added) || added > now + FUTURE_TOLERANCE_MS) throw new Error(`contact ${id} has an invalid dateAdded`);\n if (added < cutoff) { reachedCutoff = true; break; }\n scanned++;\n const raw = JSON.stringify(c);\n const kind = classifyFirstTouch(c);\n const slot = counts[kind];\n slot.n++;\n if (hasAdId(raw, kind)) slot.withId++;\n if (Number.isFinite(added) && (slot.lastAt === null || added > slot.lastAt)) slot.lastAt = added;\n }\n const next = page?.meta?.nextPageUrl ?? null;\n if (next !== null && typeof next !== \"string\") throw new Error(\"contacts response has an invalid next page\");\n if (next) {\n const nextUrl = new URL(next, GHL);\n if (nextUrl.origin !== GHL || !nextUrl.pathname.startsWith(\"/contacts/\")) throw new Error(\"unsafe contacts pagination URL\");\n url = nextUrl.toString();\n } else url = null;\n }\n contactsReadable = reachedCutoff || url === null;\n if (!contactsReadable) {\n errors.push(`The CRM contact walk hit its ${PAGES}-page safety cap before reaching ${WINDOW_DAYS} days; inbound channel counts are unknown.`);\n }\n } catch (e) {\n errors.push(`Could not read the CRM's recent contacts: ${String(e).slice(0, 140)}`);\n }\n\n // ── OUTBOUND + the Square direction: read from what the other two jobs already recorded. ───────\n type StoredRead = { readable: boolean; value: unknown; error: string };\n const unread: StoredRead = { readable: false, value: null, error: \"stored source is unavailable\" };\n let feedRead = unread, watchRead = unread, adsRead = unread;\n try {\n const { blob } = await import(\"https://esm.town/v/std/blob\");\n const readOne = async (key: string): Promise => {\n try { return { readable: true, value: (await blob.getJSON(key)) ?? null, error: \"\" }; }\n catch (e) { return { readable: false, value: null, error: String(e).replace(/^Error:\\s*/, \"\").slice(0, 120) }; }\n };\n [feedRead, watchRead, adsRead] = await Promise.all([\n readOne(\"gads_feed_cache\"), readOne(WATCH_BLOB), readOne(GOOGLE_ADS_BLOB),\n ]);\n } catch (e) {\n const why = String(e).replace(/^Error:\\s*/, \"\").slice(0, 120);\n feedRead = { ...unread, error: why };\n watchRead = { ...unread, error: why };\n adsRead = { ...unread, error: why };\n }\n\n if (!feedRead.readable) errors.push(`Could not read the Google conversion feed receipt: ${feedRead.error}.`);\n if (!adsRead.readable) errors.push(`Could not read the Google campaign snapshot: ${adsRead.error}.`);\n if (!watchRead.readable) errors.push(`Could not read the Square monitor receipt: ${watchRead.error}.`);\n\n const feedCheck = cacheIntegrity(feedRead.value, now, feedRead.readable);\n const feed: FeedCache | null = feedCheck.cache;\n const feedReadable = feedCheck.state === \"valid\";\n if (feedRead.readable && !feedReadable) errors.push(`Google conversion feed receipt is ${feedCheck.state}: ${feedCheck.reason}`);\n\n const adsCheck = snapshotFreshness(adsRead.value, now);\n const ads: GoogleAdsSnapshot | null = adsCheck.snapshot;\n const adsReadable = adsRead.readable && adsCheck.state !== \"invalid\";\n const adsFresh = adsRead.readable && adsCheck.state === \"fresh\";\n\n const rawWatch = watchRead.value as WatchBlob | null;\n const watchBuiltAt = timestampFreshness(rawWatch?.builtAt, now, MONITOR_MAX_AGE_MS);\n const watchRunAt = timestampFreshness(rawWatch?.lastRun?.at, now, MONITOR_MAX_AGE_MS);\n const watchShapeValid = !!rawWatch && typeof rawWatch === \"object\" && !Array.isArray(rawWatch) &&\n !!rawWatch.lastRun && typeof rawWatch.lastRun.ok === \"boolean\" && typeof rawWatch.lastRun.error === \"string\" &&\n Number.isFinite(rawWatch.lastRun.ms) && rawWatch.lastRun.ms >= 0 &&\n !!rawWatch.inspected && Number.isInteger(rawWatch.inspected.transactions) && rawWatch.inspected.transactions >= 0 &&\n Number.isInteger(rawWatch.inspected.pages) && rawWatch.inspected.pages >= 0 && typeof rawWatch.inspected.truncated === \"boolean\" &&\n Array.isArray(rawWatch.snapshots) && !!rawWatch.report && typeof rawWatch.report === \"object\" &&\n Array.isArray((rawWatch.report as any).findings) &&\n watchBuiltAt.state !== \"missing\" && watchBuiltAt.state !== \"invalid\" && watchBuiltAt.state !== \"future\" &&\n watchRunAt.state !== \"missing\" && watchRunAt.state !== \"invalid\" && watchRunAt.state !== \"future\";\n const watch = watchShapeValid ? rawWatch : null;\n // A recent failed run updates lastRun.at but deliberately leaves the last complete report alone.\n // Grade successful evidence by builtAt, while still validating both clocks above.\n const monitorFreshness = timestampFreshness(watch?.builtAt, now, MONITOR_MAX_AGE_MS);\n const monitorReadable = watchRead.readable && watchShapeValid;\n if (watchRead.readable && !watchShapeValid) errors.push(\"The Square monitor receipt is malformed.\");\n\n const metaReceipt = await metaReceiptPromise;\n if (metaReceipt.state === \"invalid\") errors.push(`Could not verify Meta's server-event receipt: ${metaReceipt.reason}.`);\n\n const silent = (lastAt: number | null) => lastAt !== null && now - lastAt > SILENT_DAYS * 86_400_000;\n\n const channels: Channel[] = [];\n\n // The HTML cards and JSON view expose the same campaign/schedule facts. Keep them in one scope\n // so the endpoint typechecks and the two representations cannot drift apart.\n const adsAt = ads?.generatedAt ? Date.parse(ads.generatedAt) : null;\n const enabled = ads?.campaigns?.filter((x) => x.status === \"ENABLED\") ?? [];\n const dailyBudget = enabled.reduce((n, x) => n + x.dailyBudget, 0);\n // Spend can occur before a campaign is paused. Budgets are enabled-only; observed spend is not.\n const spendToday = ads?.campaigns?.reduce((n, x) => n + x.today.cost, 0) ?? 0;\n const lastScheduled = feed?.fetches?.find((f) => f.source === \"google-schedule\") ?? null;\n const scheduleFreshness = timestampFreshness(lastScheduled?.at, now, SCHEDULE_STALL_DAYS * 86_400_000);\n const schedule = scheduleFreshness.state === \"missing\" ? \"not scheduled\"\n : scheduleFreshness.state === \"fresh\" ? \"healthy\"\n : scheduleFreshness.state === \"stale\" ? \"stalled\" : \"unknown\";\n\n // GOOGLE\n {\n const c = counts.google;\n const supply = diagnoseSupply(feed);\n const state = feedState(feed, now);\n const rows = feed?.rows ?? 0;\n const builtAt = feed?.builtAt ? Date.parse(feed.builtAt) : null;\n const campaignLine = ads\n ? `${enabled.length} enabled campaign${enabled.length === 1 ? \"\" : \"s\"}, ${ads.currency} ${dailyBudget.toFixed(2)}/day in configured budgets, ${ads.currency} ${spendToday.toFixed(2)} spent today. Source: Google Ads Script, as at ${ads.generatedAt} (${adsCheck.state}, ${ago(adsAt)}).`\n : `Google Ads Script snapshot: ${adsCheck.state}. ${adsCheck.reason}`;\n const googleSourcesReadable = feedReadable && adsReadable;\n const out = googleSourcesReadable ? {\n state: state.state,\n detail: `${rows} conversion row${rows === 1 ? \" is\" : \"s are\"} built (${ago(builtAt)}). Source: GoHighLevel recurring conversion feed receipt, as at ${feed?.builtAt || \"not available\"}. ` +\n `Google scheduled fetch: ${schedule}${lastScheduled ? `, last seen ${ago(Date.parse(lastScheduled.at))}` : \"\"}. ` +\n `Google accepted the initial secured import: ${INITIAL_GOOGLE_UPLOAD_RECEIPT.successful} successful and ${INITIAL_GOOGLE_UPLOAD_RECEIPT.failed} failed at ${INITIAL_GOOGLE_UPLOAD_RECEIPT.at}. ` +\n `A future automatic run still needs its own Upload History receipt. ${campaignLine} ${state.why}`,\n lastAt: lastScheduled ? Date.parse(lastScheduled.at) : builtAt,\n } : {\n state: \"unknown\",\n detail: `The conversion feed receipt or Google Ads Script snapshot is unavailable or invalid, so outbound Google health is unknown. Feed: ${feedCheck.state}. Campaign snapshot: ${adsCheck.state}.`,\n lastAt: null,\n };\n const bad = !contactsReadable || !googleSourcesReadable || !supply.healthy || c.n === 0 || silent(c.lastAt) || schedule !== \"healthy\" || !adsFresh;\n channels.push({\n name: \"Google\",\n inbound: {\n n: contactsReadable ? c.n : null, withId: contactsReadable ? c.withId : null, lastAt: contactsReadable ? c.lastAt : null,\n note: !contactsReadable\n ? `The CRM contact history could not be read completely, so Google inbound counts are unknown. Source: GoHighLevel contacts, checked ${checkedAt}.`\n : c.n === 0\n ? `No Google-sourced enquiry has arrived in the window this page looks at. Source: GoHighLevel contacts, as at ${checkedAt}.`\n : `${c.withId} of ${c.n} carry the click id that lets an outcome be sent back. Source: GoHighLevel contacts, as at ${checkedAt}.`,\n },\n outbound: out,\n verdict: !contactsReadable || !googleSourcesReadable\n ? { colour: GREY, word: \"Cannot tell\", line: \"One or more required data sources could not be read completely.\" }\n : bad\n ? { colour: c.n === 0 ? WARN : CRIT, word: c.n === 0 ? \"Quiet\" : \"Needs a look\", line: schedule === \"not scheduled\" ? \"Google's recurring conversion upload is not scheduled yet.\" : !adsFresh ? \"The live Google campaign snapshot is missing or stale.\" : state.why }\n : { colour: GOOD, word: \"Working\", line: \"Enquiries arrive with click ids, Google is fetching the conversion file, and campaign data is fresh. Import acceptance remains separately labelled until Google receipts it.\" },\n });\n }\n\n // FACEBOOK — inbound from CRM attribution; outbound from the bridge's PII-free Graph API receipts.\n {\n const c = counts.facebook;\n const metaReadable = metaReceipt.state !== \"invalid\";\n const metaFresh = metaReceipt.state === \"fresh\";\n channels.push({\n name: \"Facebook and Instagram\",\n inbound: {\n n: contactsReadable ? c.n : null, withId: contactsReadable ? c.withId : null, lastAt: contactsReadable ? c.lastAt : null,\n note: !contactsReadable\n ? `The CRM contact history could not be read completely, so Facebook and Instagram inbound counts are unknown. Source: GoHighLevel contacts, checked ${checkedAt}.`\n : c.n === 0\n ? `No Facebook or Instagram enquiry has arrived in the window this page looks at. Source: GoHighLevel contacts, as at ${checkedAt}.`\n : `${c.withId} of ${c.n} carry the advert id. The rest are people who messaged directly, replied to a comment, or came through the profile — there is no advert id because there was no advert click. Source: GoHighLevel contacts, as at ${checkedAt}.`,\n },\n outbound: metaReadable ? {\n state: metaFresh ? \"Accepted by Meta\" : metaReceipt.state === \"stale\" ? \"Receipt is old\" : \"No receipt yet\",\n detail: metaReceipt.state === \"missing\"\n ? \"The bridge journal is readable but contains no live Meta acceptance receipt.\"\n : `${metaReceipt.reason}. Latest accepted event ${ago(metaReceipt.lastAcceptedAt)}. Source: Meta Graph API response journal. This proves receipt, not whether Meta later used the event for optimisation.`,\n lastAt: metaReceipt.lastAcceptedAt,\n } : {\n state: \"unknown\", detail: `The Meta response journal could not be verified: ${metaReceipt.reason}.`, lastAt: null,\n },\n verdict: !contactsReadable || !metaReadable\n ? { colour: GREY, word: \"Cannot tell\", line: !contactsReadable ? \"The CRM contact history could not be read completely.\" : \"The Meta response journal could not be verified.\" }\n : c.n === 0\n ? { colour: WARN, word: \"Quiet\", line: \"Nothing has come in from Facebook in the window.\" }\n : !metaFresh\n ? { colour: CRIT, word: \"Needs a look\", line: metaReceipt.state === \"missing\" ? \"No live Meta API acceptance receipt exists.\" : \"The latest Meta API acceptance receipt is more than seven days old.\" }\n : silent(c.lastAt)\n ? { colour: CRIT, word: \"Stopped\", line: `Nothing new for ${ago(c.lastAt)}.` }\n : { colour: GOOD, word: \"Working\", line: \"Enquiries are reaching the CRM and Meta is accepting server-side Purchase events.\" },\n });\n }\n\n // SQUARE — the direction that broke in February.\n {\n const b = watch?.report as any;\n const findings = (Array.isArray(b?.findings) ? b.findings : []) as any[];\n const urgent = findings.filter((f) => f?.severity === \"urgent\").length;\n const builtAt = watch?.builtAt ? Date.parse(watch.builtAt) : null;\n const tx = watch?.inspected?.transactions ?? 0;\n const lastCounters = watch?.snapshots?.[watch.snapshots.length - 1]?.counters;\n const rawDollars = lastCounters?.crmPaymentDollarsLifetime;\n const dollars = Number.isFinite(rawDollars) && rawDollars >= 0 ? rawDollars : null;\n const runSucceeded = monitorReadable && watch!.lastRun.ok;\n const readable = runSucceeded && monitorFreshness.state === \"fresh\" && watchRunAt.state === \"fresh\";\n const zeroEvidence = readable && (tx === 0 || dollars === null || dollars === 0);\n const monitorProblem = !monitorReadable\n ? \"The stored early-warning receipt is unavailable or malformed.\"\n : !watch!.lastRun.ok\n ? (watch!.lastRun.error || \"The latest early-warning run failed.\")\n : monitorFreshness.state !== \"fresh\" || watchRunAt.state !== \"fresh\"\n ? `The early-warning check is ${monitorFreshness.state === \"fresh\" ? watchRunAt.state : monitorFreshness.state}; its last complete report is ${ago(monitorFreshness.at)}.`\n : \"\";\n channels.push({\n name: \"Square and your CRM\",\n inbound: {\n n: monitorReadable ? tx : null, withId: monitorReadable ? 0 : null, lastAt: monitorReadable ? builtAt : null,\n note: readable\n ? `${tx} payment records read, last checked ${ago(builtAt)}.` +\n (dollars !== null ? ` They carry $${dollars.toLocaleString()} of recorded value between them.` : \"\") +\n ` Source: GoHighLevel payment monitor, as at ${watch?.builtAt}.`\n : `${monitorProblem} This cannot be judged as working.`,\n },\n outbound: null,\n verdict: !readable\n ? { colour: GREY, word: \"Cannot tell\", line: monitorProblem }\n : urgent > 0\n ? { colour: CRIT, word: \"Needs a look\", line: `${urgent} thing${urgent === 1 ? \"\" : \"s\"} the early-warning check wants a person to see.` }\n : zeroEvidence\n ? { colour: CRIT, word: \"Needs a look\", line: tx === 0 ? \"The monitor read zero payment records; that is not evidence the Square link is working.\" : \"Payment records were found, but no reliable positive amount is recorded.\" }\n : { colour: GOOD, word: \"Working\", line: \"Payments are reaching the CRM and the amounts are being recorded.\" },\n });\n }\n\n if (u.searchParams.get(\"f\") === \"json\") {\n return Response.json({\n ok: errors.length === 0 && contactsReadable && feedReadable && adsFresh && metaReceipt.state === \"fresh\" && monitorReadable &&\n monitorFreshness.state === \"fresh\" && !!watch?.lastRun.ok,\n windowDays: WINDOW_DAYS, contactsScanned: scanned, reachedCutoff,\n channels, errors,\n googleAds: ads ? {\n source: \"Google Ads Script\",\n generatedAt: ads.generatedAt,\n freshness: adsCheck.state,\n fresh: adsFresh,\n enabledCampaigns: enabled.map((x) => ({ name: x.name, dailyBudget: x.dailyBudget, today: x.today, last7Days: x.last7Days })),\n configuredDailyBudget: +dailyBudget.toFixed(2),\n spendToday: +spendToday.toFixed(2),\n schedule,\n accepted: {\n scope: \"initial secured import\",\n successful: INITIAL_GOOGLE_UPLOAD_RECEIPT.successful,\n failed: INITIAL_GOOGLE_UPLOAD_RECEIPT.failed,\n at: INITIAL_GOOGLE_UPLOAD_RECEIPT.at,\n source: INITIAL_GOOGLE_UPLOAD_RECEIPT.source,\n latestAutomaticRun: \"unknown until Google Upload History supplies a receipt\",\n },\n } : { source: \"Google Ads Script\", generatedAt: null, freshness: adsCheck.state, detail: adsCheck.reason },\n squareMonitor: {\n source: \"GoHighLevel payment monitor\",\n asAt: watch?.lastRun?.at ?? watch?.builtAt ?? null,\n freshness: monitorFreshness.state,\n },\n metaConversions: {\n source: \"Meta Graph API response journal\",\n state: metaReceipt.state,\n acceptedLiveEvents: metaReceipt.accepted,\n failedEvents: metaReceipt.failed,\n lastAcceptedAt: metaReceipt.lastAcceptedAt === null ? null : new Date(metaReceipt.lastAcceptedAt).toISOString(),\n proves: \"Meta accepted the server event\",\n doesNotProve: \"Meta used the event for attribution or optimisation\",\n },\n sources: {\n inboundAttribution: { source: \"GoHighLevel contacts\", asAt: contactsReadable ? checkedAt : null },\n googleConversions: { source: \"GoHighLevel recurring conversion feed receipt\", asAt: feed?.builtAt || null, integrity: feedCheck.state },\n },\n cannotSee: [\"Whether Meta used an accepted conversion event for attribution or optimisation. API acceptance proves receipt, not downstream use.\"],\n }, { headers: { \"Cache-Control\": \"no-store\", \"X-Content-Type-Options\": \"nosniff\" } });\n }\n\n const row = (ch: Channel) => `\n

${esc(ch.name)}

${esc(ch.verdict.word)}

${esc(ch.verdict.line)}

Coming in

${ch.inbound.n === null ? \"Unknown\" : ch.inbound.n}

${esc(ch.inbound.note)} Last one ${esc(ago(ch.inbound.lastAt))}.

Going back out

\n ${ch.outbound\n ? `

${esc(ch.outbound.state)}

${esc(ch.outbound.detail)}

`\n : `

Not shown here

This page cannot confirm what the other system received, so it does not claim to. The early-warning check covers this direction.

`}\n

`;\n\n const html = `\nWhere your leads come from, and what goes back\n

Where your leads come from, and what goes back

The last ${WINDOW_DAYS} days. ${contactsReadable ? `${scanned} recent enquiries read` : \"CRM contact history incomplete; inbound counts are unknown\"}.\nChecked ${esc(new Date(now).toISOString().replace(\"T\", \" \").slice(0, 16))} UTC.

\n${errors.length ? `

Part of this page could not be read, so treat what is missing as unknown rather than fine.

${errors.map((e) => `

${esc(e)}

`).join(\"\")}

` : \"\"}\n${channels.map(row).join(\"\")}\n

What this page deliberately does not claim

A channel this page cannot read is shown as unreadable, never as healthy. That is the whole reason it\nexists: the five month gap in your Square figures was invisible because silence looked like calm. Blank is grey here, and it says so.

For Facebook and Instagram, a successful API receipt proves Meta accepted the event. It does not prove Meta later used it for attribution or optimisation.

`;\n\n return new Response(req.method === \"HEAD\" ? null : html, { headers: {\n \"Content-Type\": \"text/html; charset=utf-8\", \"Cache-Control\": \"no-store\", \"X-Content-Type-Options\": \"nosniff\",\n } });\n}\n",[253],"c195bcad-6c44-41e3-84ec-3a7d93528aa8","taper-messages.ts","65f1a7b2-900c-11f1-948d-1607ee4eb77e",456,["D",1786285581663],11,"// SLOW TRACK (TAPER) — message copy module. Companion to puppy-messages.ts.\n// Spec is Kim's own, verbatim from her Upwork message 3 Aug 2026, 8:11 PM:\n// \"I'd like something to taper off rather than just drop. Something like a text or email\n// once a week for month then every two weeks for 6 months then every month moving forward.\"\n// Committed shape (confirmed back to her, 8:27 PM): after the 21-day main sequence ends —\n// weekly x4, then fortnightly x13 (~6 months), then monthly indefinitely.\n// HARD RULE, promised to Kim in writing: NO ask attached to any taper message. No booking\n// links, no CTAs, no phone-number pushes — replying to the message itself is the only channel\n// offered. \"The job of that track is that\n// when they finally do need training or boarding, you're the name they already know.\"\n// Same engine rules underneath: reply -> paused for a human; booking -> off the track;\n// STOP -> never contacted again. All enforced engine-side, same as the main sequence.\n\nimport { PHONE_DISPLAY, type MessageTemplate } from \"./puppy-messages.ts\";\n\n// Offsets are hours RELATIVE TO SLOW-TRACK ENTRY (the moment main-8 fires, day 21 absolute).\n// Weekly: rel days 7 / 14 / 21 / 28 = absolute days 28 / 35 / 42 / 49\n// Fortnightly: rel days 42 .. 210 (13 x 14) = absolute days 63 .. 231\n// Monthly: rel day 240 onward, every 30 = absolute day 261 onward, forever\n\nexport const SLOW_WEEKLY: MessageTemplate[] = [\n {\n id: \"slow_w-1\",\n channel: \"email\",\n offsetHours: 168, // rel day 7\n subject: \"The teenage phase is coming (this is normal too)\",\n previewText: \"Somewhere between six and twelve months, trained puppies act untrained. Here's why.\",\n bodyTemplate: `Hi {{FIRST_NAME}},\n\nOne thing I wish more people were warned about: somewhere between six and twelve months, your dog will probably go through a teenage phase. The recall that was working stops working. The chewing comes back. A dog who knew \"sit\" looks at you like they've never heard the word.\n\nThis isn't your training failing, and it isn't the puppy teething back again - that part really does settle, like I said in the early emails. This is adolescence: hormones and a growing brain re-testing every rule, exactly like human teenagers do. Dogs who were doing great at five months often look like a mess at eight, and the owners who don't know it's a phase assume they've done something wrong.\n\nTwo things carry you through it: keep the routines boring and consistent even when they seem pointless, and keep rewarding the behavior you want as if your dog were still tiny. It passes. The dogs who come out of it best are the ones whose people didn't give up on the rules halfway through.\n\n{{STORY:teenage}}\n\nReply anytime - a real person reads these.\n\nKim\nThe Dogs Spot`,\n },\n {\n id: \"slow_w-2\",\n channel: \"sms\",\n offsetHours: 336, // rel day 14\n bodyTemplate: `Hi {{FIRST_NAME}}, Kim at The Dogs Spot. A tip that saves furniture: rotate your dog's toys - keep most in a closet and swap a few out every couple of days. Old toys become new again, and a dog with something interesting to chew rarely invents their own project. Reply anytime.`,\n },\n {\n id: \"slow_w-3\",\n channel: \"email\",\n offsetHours: 504, // rel day 21\n subject: \"Socialization doesn't stop - it just changes shape\",\n previewText: \"The window closes, but the habit shouldn't.\",\n bodyTemplate: `Hi {{FIRST_NAME}},\n\nWhen your dog was tiny, the job was meeting the world before the socialization window closed. That window does close - but the habit shouldn't. A dog who met the mail carrier calmly at twelve weeks can still decide the mail carrier is suspicious at eight months if the meetings stop.\n\nThe maintenance version is lighter than the puppy version. A different walking route once a week. Ten minutes watching the world go by outside a coffee shop. A calm hello with a steady adult dog now and then. You're just keeping the file open: people, dogs, noises, places, all still no big deal.\n\nThe dogs who stay easy in public are almost never the ones with the most training. They're the ones whose world stayed wide.\n\nKim\nThe Dogs Spot`,\n },\n {\n id: \"slow_w-4\",\n channel: \"sms\",\n offsetHours: 672, // rel day 28\n bodyTemplate: `Hi {{FIRST_NAME}}, Kim here. A two-minute recall game that works: someone holds your dog, you walk away looking excited, then call once and celebrate like they won the lottery when they arrive. Dogs repeat what pays.`,\n },\n];\n\nexport const SLOW_FORTNIGHTLY: MessageTemplate[] = [\n {\n id: \"slow_f-1\",\n channel: \"email\",\n offsetHours: 1008, // rel day 42\n subject: \"Teaching your dog that alone is fine\",\n previewText: \"Separation ease is trained, not hoped for.\",\n bodyTemplate: `Hi {{FIRST_NAME}},\n\nThe single most underrated skill for a young dog: being alone and being fine about it. It doesn't happen by accident - dogs are social animals, and a dog who is never alone learns that alone is alarming.\n\nBuild it in small doses. Leave for two minutes and come back before any fuss starts, then five, then twenty. Keep departures and returns boring - no big goodbyes, no big reunions. A stuffed chew or a lick mat that only appears when you leave turns your exit into a good sign instead of a bad one.\n\nThe goal isn't a dog who tolerates your absence. It's a dog who hears the keys and thinks \"snack time\", then has a nap.\n\n{{STORY:alone_time}}\n\nKim\nThe Dogs Spot`,\n },\n {\n id: \"slow_f-2\",\n channel: \"sms\",\n offsetHours: 1344, // rel day 56\n bodyTemplate: `Hi {{FIRST_NAME}}, Kim here. Loose-leash tip: the moment the leash goes tight, stop walking. Move again only when it slackens. Boring, repetitive, and it works better than any gadget - pulling stops paying, so pulling stops. Reply if it stalls.`,\n },\n {\n id: \"slow_f-3\",\n channel: \"email\",\n offsetHours: 1680, // rel day 70\n subject: \"Vet visits without the drama\",\n previewText: \"Five minutes of practice at home changes every appointment for life.\",\n bodyTemplate: `Hi {{FIRST_NAME}},\n\nA dog's opinion of the vet is mostly formed before anything medical ever happens. You can shape it at home, five minutes at a time.\n\nHandle your dog's paws, ears and mouth while they're relaxed - a touch, then a treat, done before they mind. Pop them on a table or a mat, brief and calm, same deal. If you're ever passing your vet's clinic, walk in, let the front desk say hello and hand over a treat, and leave. Visits where nothing happens are what make the real ones manageable.\n\nA dog who's been handled kindly a hundred times at home barely notices an examination. One who's only ever grabbed when something hurts learns the opposite lesson.\n\n{{STORY:vet_visits}}\n\nKim\nThe Dogs Spot`,\n },\n {\n id: \"slow_f-4\",\n channel: \"sms\",\n offsetHours: 2016, // rel day 84\n bodyTemplate: `Hi {{FIRST_NAME}}, Kim at The Dogs Spot. If your dog goes wild in the evenings - the witching hour is real. It's usually overtiredness, not excess energy. A chew and enforced quiet time settles it faster than another walk. Reply if evenings are still chaos, happy to help.`,\n },\n {\n id: \"slow_f-5\",\n channel: \"email\",\n offsetHours: 2352, // rel day 98\n subject: \"The off switch\",\n previewText: \"The most useful thing a dog can learn isn't a trick.\",\n bodyTemplate: `Hi {{FIRST_NAME}},\n\nThe most useful thing your dog can learn isn't a trick - it's an off switch. A dog who can lie on a mat and do nothing while life happens around them gets taken everywhere. A dog who can't gets left at home, which shrinks their world and makes everything harder.\n\nTeach it like anything else. A mat or a bed, a treat for lying on it, then gradually longer stays and gradually more interesting distractions - someone walking past, the doorbell, dinner being eaten. Reward calm, quietly, before they break. Minutes a day, and within a few weeks you have a dog you can take to a restaurant patio.\n\nIt's not glamorous. It changes more about daily life than any other single thing you can train.\n\n{{STORY:settle}}\n\nKim\nThe Dogs Spot`,\n },\n {\n id: \"slow_f-6\",\n channel: \"sms\",\n offsetHours: 2688, // rel day 112\n bodyTemplate: `Hi {{FIRST_NAME}}, Kim here. Jumping on guests fix: have visitors ignore your dog completely until all four paws are on the floor, then greet warmly. Attention is what they're after. Give it for standing, never for jumping. Consistency from everyone is the whole trick.`,\n },\n {\n id: \"slow_f-7\",\n channel: \"email\",\n offsetHours: 3024, // rel day 126\n subject: \"Dog parks: the honest version\",\n previewText: \"When they help, when they don't, and what to watch.\",\n bodyTemplate: `Hi {{FIRST_NAME}},\n\nDog parks divide opinion, so here's the honest version: they're brilliant for some dogs and genuinely bad for others, and the difference isn't friendliness - it's what happens there.\n\nWatch play, not intentions. Good play has role swaps: chaser becomes chased, wrestler ends up underneath, both dogs keep opting back in. If your dog is always the one being chased, or hiding under benches, or the one doing all the pinning, it isn't play anymore, and every bad visit teaches something you'll later have to untrain.\n\nThe useful test: call your dog out of play now and then, reward, release back. If you can't call them out, the park is training them - just not in the direction you want. A few good dogs beat a big crowd of random ones.\n\n{{STORY:dog_parks}}\n\nKim\nThe Dogs Spot`,\n },\n {\n id: \"slow_f-8\",\n channel: \"sms\",\n offsetHours: 3360, // rel day 140\n bodyTemplate: `Hi {{FIRST_NAME}}, it's Kim. While I'm thinking about it: feed your dog a few meals in the parked car, engine off, before expecting calm car rides. Cars should predict good things, not just vet trips. Short happy drives to nowhere do the same job. Tell me how it goes, I read these.`,\n },\n {\n id: \"slow_f-9\",\n channel: \"email\",\n offsetHours: 3696, // rel day 154\n subject: \"Boredom looks a lot like bad behavior\",\n previewText: \"Ten minutes of nose work tires a dog more than an hour of fetch.\",\n bodyTemplate: `Hi {{FIRST_NAME}},\n\nMost \"bad behavior\" in young dogs is unemployment. A dog with nothing to do writes their own job description, and it usually involves your baseboards.\n\nThe fix isn't always more exercise - physical exercise builds fitness, and a fitter dog just has more stamina for mischief. Mental work is what actually tires them. Scatter your dog's food in the grass instead of a bowl and let them sniff it out. Hide treats around one room. A snuffle mat, a frozen Kong, a cardboard box with food inside it to be destroyed. Ten minutes of nose work drains more out of a dog than an hour of fetch, because sniffing is thinking.\n\nA tired dog is a good dog, but the right kind of tired is mental. It's also the cheapest training aid there is.\n\n{{STORY:nose_work}}\n\nKim\nThe Dogs Spot`,\n },\n {\n id: \"slow_f-10\",\n channel: \"sms\",\n offsetHours: 4032, // rel day 168\n bodyTemplate: `Hi {{FIRST_NAME}}, Kim here. Brushing habit worth keeping: one minute after dinner, every day, treat at the end. Daily and brief beats weekly and a wrestle - and you'll spot lumps, ticks and sore spots before they're problems. Reply anytime.`,\n },\n {\n id: \"slow_f-11\",\n channel: \"email\",\n offsetHours: 4368, // rel day 182\n subject: \"Two dogs meeting on leash: what's actually going on\",\n previewText: \"What a tight leash does to friendly dogs, and the walk-along trick.\",\n bodyTemplate: `Hi {{FIRST_NAME}},\n\nA strange thing you'll notice: two perfectly friendly dogs can bristle at each other on leash when the same two would be fine loose. It isn't contrariness. The leash changes the conversation.\n\nDogs read each other sideways - they approach in curves, sniff rears, keep options open. A tight leash forces a head-on approach with no escape route, which in dog language reads as confrontation. The tension travels down the leash too: you tighten up, and your dog decides there must be something to tense about.\n\nWhat helps: keep the leash loose even when it takes nerve, approach in an arc rather than straight on, and if you want two dogs to make friends, walk them side by side in the same direction first and let the sniffing happen on the move. Side by side works. Head-on mostly doesn't.\n\n{{STORY:leash_meetings}}\n\nKim\nThe Dogs Spot`,\n },\n {\n id: \"slow_f-12\",\n channel: \"sms\",\n offsetHours: 4704, // rel day 196\n bodyTemplate: `Hi {{FIRST_NAME}}, it's Kim again. One that surprises people: use part of your dog's daily ration as training treats instead of adding extras on top. Same calories, more practice, no expanding waistline. The dog doesn't know the difference - it all counts as winning.`,\n },\n {\n id: \"slow_f-13\",\n channel: \"email\",\n offsetHours: 5040, // rel day 210\n subject: \"From here on, about once a month\",\n previewText: \"The rhythm changes, the door stays open.\",\n bodyTemplate: `Hi {{FIRST_NAME}},\n\nQuick housekeeping note rather than advice this time: I've been in your inbox every couple of weeks since your dog was small, and from here I'll drop to about once a month - short, seasonal, still a thirty-second read, I promise.\n\nBy now most of the foundations are in: the world stayed wide, alone is fine, the leash is mostly loose, and the teenage phase either happened or is happening and will pass either way.\n\nIf anything ever comes up in between - a behavior that's new, a question that nags - reply to any of these. A real person reads them, always has.\n\nKim\nThe Dogs Spot`,\n },\n];\n\n// Monthly bank — chosen by the CALENDAR MONTH the send lands in (0 = Jan .. 11 = Dec),\n// so the seasonal ones land in season regardless of when the contact entered the track.\n// This is what was promised to Kim: \"seasonal where it fits: settling a dog over the\n// holidays, heat and paws in July, fireworks.\" offsetHours on these entries is ignored\n// by the scheduler (cadence is every 720h from rel day 240); template chosen by month.\n//\n// v1.7.2, 9 Aug 2026 — two additions she asked for 6 Aug, verbatim: \"water intoxication note +\n// kids back to school in August -> July/Aug puppy nurture\" (handover/UPWORK-THREAD-FULL-9AUG.md,\n// 9:07 PM 6 Aug). Water intoxication is now the closing note in July, alongside the heat and\n// fireworks copy she already signed off (both left untouched). Back-to-school is now August's own\n// note rather than September's: Kim's own phrasing places it \"in August\", and school-starting-back\n// is the bigger routine shock than the algae warning that was previously August's only content, so\n// August moved from SMS to email to give both the room they need — a plain factual change (a\n// channel and a word count), not a change to anything she asked for. The algae warning was not\n// removed; nothing she approved was cut, only added to. NOT changed: September, which still carries\n// its own back-to-school note. The two now sit back-to-back with overlapping subject matter — flagged\n// for Kim/Amir rather than silently rewritten, the same way the phone-number choice above was left\n// for a decision rather than guessed at.\nexport const SLOW_MONTHLY_BANK: MessageTemplate[] = [\n {\n id: \"slow_m-jan\",\n channel: \"email\",\n offsetHours: 0,\n subject: \"January: the quiet month is a training month\",\n previewText: \"Short days, big opportunity.\",\n bodyTemplate: `Hi {{FIRST_NAME}},\n\nJanuary is short walks and dark evenings, which makes it a surprisingly good training month. Five minutes of indoor work a day, a settle on the mat or some paw-and-ear handling practice, carries further than one heroic cold-weather hike a week.\n\nGeorgia winters are mild, but a cold snap still ices a morning path now and then - so a quick paw check after those walks is smart.\n\nKim\nThe Dogs Spot`,\n },\n {\n id: \"slow_m-feb\",\n channel: \"sms\",\n offsetHours: 0,\n bodyTemplate: `Hi {{FIRST_NAME}}, Kim at The Dogs Spot. Wet-weather boredom builds mischief - a stuffed Kong from the freezer or dinner scattered in a snuffle mat gets you a calm evening. Mental work counts double in February. Reply anytime.`,\n },\n {\n id: \"slow_m-mar\",\n channel: \"email\",\n offsetHours: 0,\n subject: \"Spring: the world wakes up, so does the sniffing\",\n previewText: \"Let the nose have its season.\",\n bodyTemplate: `Hi {{FIRST_NAME}},\n\nEverything smells new in spring, and you'll feel it down the leash. Rather than fight it, give sniffing its own time: pick a stretch of the walk where your dog sets the pace and the route, nose down, no agenda. Sniffing is a dog reading the news, and ten minutes of it settles them more than double the distance at a march.\n\nOne more spring thing: tick season opens now. A quick run of the hands after grassy walks catches them early.\n\nKim\nThe Dogs Spot`,\n },\n {\n id: \"slow_m-apr\",\n channel: \"sms\",\n offsetHours: 0,\n bodyTemplate: `Hi {{FIRST_NAME}}, Kim here. Spring reminder, same one every year: chocolate is flat-out dangerous for dogs. If there's been an egg hunt anywhere near your yard, a nose will find what the kids missed, sometimes weeks later. Keep the candy high and the vet's number where you can find it.`,\n },\n {\n id: \"slow_m-may\",\n channel: \"email\",\n offsetHours: 0,\n subject: \"Before summer: build the water habit\",\n previewText: \"Warm-weather prep is easier before it's hot.\",\n bodyTemplate: `Hi {{FIRST_NAME}},\n\nA little prep now makes summer easier. Get your dog used to drinking on walks - carry water and offer it before they seem thirsty, so it's routine by the time it matters. If a kiddie pool or the sprinkler might feature, introduce them gently now while they're novelty rather than necessity.\n\nAnd as the winter coat blows out, a few minutes of brushing a day now saves your furniture a month of fur. One thing to know before summer: never shave a double-coated breed to cool them down - that coat insulates against heat as well as cold, and they're worse off without it.\n\nKim\nThe Dogs Spot`,\n },\n {\n id: \"slow_m-jun\",\n channel: \"sms\",\n offsetHours: 0,\n bodyTemplate: `Hi {{FIRST_NAME}}, Kim at The Dogs Spot. Summer rule of thumb: put the back of your hand on the pavement for seven seconds. Too hot for your hand, too hot for your dog's paws - walk early or late instead. Any summer questions, just reply.`,\n },\n {\n id: \"slow_m-jul\",\n channel: \"email\",\n offsetHours: 0,\n subject: \"July: heat, paws and fireworks\",\n previewText: \"The two summer hazards, and the one that sneaks up.\",\n bodyTemplate: `Hi {{FIRST_NAME}},\n\nJuly's the month I nag about heat. Dogs don't sweat like we do - they cool by panting, which stops working in a hot car in minutes, even parked in shade with windows cracked. Walks move to early morning or late evening, water goes everywhere you go, and pavement gets the seven-second hand test before your dog's paws touch it.\n\nThe one that sneaks up: fireworks around the Fourth. If your dog is nervous of bangs, plan the evening - walk before dark, close curtains, put on some background noise, and let them den up wherever they choose. Comforting a scared dog doesn't reward fear, whatever the old advice said. Sit with them.\n\nOne more worth knowing: a dog who's been fetching from the lake or biting at the hose for a long stretch can swallow more water than their body can handle, and it comes on fast. Water intoxication is rare, but a dog who's wobbly, bloated, or vomiting after a long swim needs a vet call right away, not a wait-and-see.\n\nKim\nThe Dogs Spot`,\n },\n {\n id: \"slow_m-aug\",\n channel: \"email\",\n offsetHours: 0,\n subject: \"August: pond safety, and the house about to get quiet\",\n previewText: \"Two things worth knowing before the month's out.\",\n bodyTemplate: `Hi {{FIRST_NAME}},\n\nTwo August things. Lakes and ponds can grow blue-green algae late in the summer - it's toxic to dogs, sometimes fatal. If the water looks like pea soup or has a scum line, your dog stays out, no exceptions.\n\nThe other one sneaks up on dogs more than people expect: school starting back. It rearranges a dog's whole day at once - the house empties out, walks shift earlier or later, and the kids who were around all summer are suddenly gone for hours. A bit of extra chewing or barking this month is usually just the adjustment talking, not a step backward.\n\nEase it in the same way you'd build alone-time from scratch: short practice absences before the real ones start, something good that only shows up when the house empties, and low-key comings and goings. A few practice runs the week before beats a hard first day.\n\nKim\nThe Dogs Spot`,\n },\n {\n id: \"slow_m-sep\",\n channel: \"email\",\n offsetHours: 0,\n subject: \"September: the routine change nobody warns dogs about\",\n previewText: \"Back-to-school hits dogs too.\",\n bodyTemplate: `Hi {{FIRST_NAME}},\n\nSeptember quietly rearranges a dog's whole day: the house empties, walks move, the kids who were constant company vanish for hours. Dogs don't read calendars, so the change lands without warning, and a bit of chewing or barking that starts this month is usually the adjustment talking.\n\nEase it the same way you built alone-time in the first place: short practice absences, something good that only appears when the house empties, and low-key exits. A week of short practice runs saves a month of stress.\n\nKim\nThe Dogs Spot`,\n },\n {\n id: \"slow_m-oct\",\n channel: \"sms\",\n offsetHours: 0,\n bodyTemplate: `Hi {{FIRST_NAME}}, Kim here. Halloween heads-up: the doorbell going all evening plus strangers in masks is a lot for most dogs. A chew in a back room with the radio on beats managing the door. And candy, especially sugar-free with xylitol, is dangerous for dogs - keep the bowl high.`,\n },\n {\n id: \"slow_m-nov\",\n channel: \"email\",\n offsetHours: 0,\n subject: \"November: guests, feasts and a dog with opinions\",\n previewText: \"Getting ahead of the holiday chaos.\",\n bodyTemplate: `Hi {{FIRST_NAME}},\n\nThe holiday season starts here, and for your dog it mostly means two things: the house fills with people, and the house fills with food at nose height.\n\nThe settle-on-a-mat work comes into its own now - a dog with a place to be, and something to chew there, rides out a busy dinner far better than one loose in the middle of it all. Brief the guests too: no feeding from plates, however charming the eyes. Rich, fatty leftovers are one of the most common reasons dogs see an emergency vet this time of year. The big ones to keep off the floor: onions, grapes and raisins, and any cooked bone.\n\nA walk before guests arrive takes the edge off everything.\n\n{{STORY:holidays}}\n\nKim\nThe Dogs Spot`,\n },\n {\n id: \"slow_m-dec\",\n channel: \"email\",\n offsetHours: 0,\n subject: \"Settling a dog over the holidays\",\n previewText: \"Trees, tinsel, visitors and routine.\",\n bodyTemplate: `Hi {{FIRST_NAME}},\n\nDecember, quickly, because you're busy: keep your dog's routine as boring as you can manage while everything else changes - same meal times, same walks, same bedtime. Dogs take their stability from routine, and a steady dog copes with a chaotic house far better than the other way around.\n\nTree-wise: chocolate decorations are a vet visit waiting to happen, tinsel and ribbon are surgery if swallowed, and a curious tail plus low ornaments ends how you'd expect. Hang anything precious or edible high.\n\nHowever the season goes, thank you for letting me stay in your inbox this year. Reply anytime - a real person reads these, holidays included.\n\nKim\nThe Dogs Spot`,\n },\n];\n\n// ---- scheduler helpers (pure, testable) ---------------------------------------------------------\n\nexport const SLOW_WEEKLY_COUNT = 4;\nexport const SLOW_FORTNIGHTLY_COUNT = 13;\nexport const SLOW_MONTHLY_START_REL_HOURS = 5760; // rel day 240 (abs day 261)\nexport const SLOW_MONTHLY_INTERVAL_HOURS = 720; // 30 days\n\n// Given how many slow-track messages have already been sent to a contact, return the next\n// one: its template (or, for monthly, the bank + a note to pick by landing month) and its\n// offsetHours relative to slow-track entry. Returns null never — the track is indefinite.\nexport function nextSlowTouch(sentCount: number): {\n phase: \"weekly\" | \"fortnightly\" | \"monthly\";\n template: MessageTemplate | null; // null for monthly — engine picks by landing month\n offsetHours: number;\n} {\n if (sentCount < SLOW_WEEKLY_COUNT) {\n return { phase: \"weekly\", template: SLOW_WEEKLY[sentCount], offsetHours: 168 * (sentCount + 1) };\n }\n const f = sentCount - SLOW_WEEKLY_COUNT;\n if (f < SLOW_FORTNIGHTLY_COUNT) {\n return { phase: \"fortnightly\", template: SLOW_FORTNIGHTLY[f], offsetHours: 672 + 336 * (f + 1) };\n }\n const m = sentCount - SLOW_WEEKLY_COUNT - SLOW_FORTNIGHTLY_COUNT;\n return {\n phase: \"monthly\",\n template: null,\n offsetHours: SLOW_MONTHLY_START_REL_HOURS + SLOW_MONTHLY_INTERVAL_HOURS * m,\n };\n}\n\n// Monthly template for a given send date (calendar-month keyed, so seasonal copy lands in season).\nexport function monthlyTemplateFor(sendDate: Date): MessageTemplate {\n return SLOW_MONTHLY_BANK[sendDate.getMonth()];\n}\n\n// v1.7.1 — same, but never the same message twice in a row. The 30-day grid drifts through the\n// calendar, so two consecutive sends can land in one calendar month (the 1st and the 31st):\n// without this the identical email goes out twice, and December's \"thank you for letting me stay\n// in your inbox this year\" twice in a month reads as a broken robot. If this month's template was\n// the last thing sent, serve next month's instead.\nexport function monthlyTemplateAvoidingRepeat(sendDate: Date, lastSentId: string | null | undefined): MessageTemplate {\n const tpl = SLOW_MONTHLY_BANK[sendDate.getMonth()];\n return lastSentId && tpl.id === lastSentId ? SLOW_MONTHLY_BANK[(sendDate.getMonth() + 1) % 12] : tpl;\n}\n",[261],"6aae7f90-4aa2-435b-aa46-20df99b87c14","send.ts","c6db9d7a-99a4-11f1-9c1f-1607ee4eb77e",1166,["D",1786979139323],"// SEND LAYER — the IO half of the puppy engine, lifted out of puppy_path_v1.1.ts on 16 Aug 2026.\n//\n// WHY THIS FILE EXISTS. puppy_path_v1.1.ts deploys to val.town as main.ts, which is capped at 80,000\n// characters. It reached 79,907 — 93 to spare — and a one-line journal fix that day came in 448 over\n// and had to be rewritten twice to fit. Past that point the cap stops being a constraint and starts\n// deciding what the product is allowed to do. Moving the IO layer out BUYS room instead of spending\n// it, and it is the right half to move: it is the part with no branching logic to get wrong.\n//\n// WHAT IS HERE: every function that talks to GoHighLevel over HTTP, plus the practice-mode guard\n// that decides whether a send is allowed at all. WHAT IS NOT: the state machine, the decision rules,\n// the pacing gates. Those are pure logic, they are already exported from the engine for the offline\n// harness, and they stay where they are.\n//\n// THE MOVE IS VERBATIM ON PURPOSE. Bodies, comments and identifier names are unchanged from main.ts,\n// including SANCTIONED_TEST_CONTACT and TEST_MODE. Two suites read this source as TEXT and assert on\n// those exact names (detect.test.mjs G1/G2, and two negative controls that delete a guard line and\n// demand G1 goes red). Renaming while moving would have made a behaviour-preserving move look like a\n// behaviour change to the only checks that can see it.\n//\n// IT FAILS CLOSED. TEST_MODE below starts TRUE and SANCTIONED_TEST_CONTACT starts null, so anything\n// importing this file WITHOUT calling configureSend() can send to nobody at all. That matters more\n// here than it did inside main.ts: as a module-level `let` in one file the guard only ever protected\n// that file's isolate. A second val importing this now gets refusal-by-default rather than a silent\n// live sender.\n\ndeclare const Deno: { env: { get(key: string): string | undefined } };\nif (typeof (globalThis as any).Deno === \"undefined\") {\n (globalThis as any).Deno = { env: { get: (k: string) => (globalThis as any).process?.env?.[k] } };\n}\n\nexport const GHL = \"https://services.leadconnectorhq.com\";\nexport const LOC = \"BQHJ19uohldYe3eqA0bl\";\n\n// v1.12 - Kim 15 Aug: every task goes to The Dogs Spot, not a person. NOTES-v1.11.md.\nexport const TASK_OWNER = Deno.env.get(\"TASK_ASSIGNEE\") || \"ZEIunFR1vZvYJEoPTnU1\";\n\n// v1.2 — TOKEN RESOLUTION: GHL_TOKEN env var, else private blob `puppy_config`. Blob fallback\n// exists because val.town has no env-var API. Code is public; token never hardcoded. Full note:\n// NOTES-v1.4.md.\nlet TOKEN: string | undefined = Deno.env.get(\"GHL_TOKEN\");\nexport async function resolveToken(): Promise {\n // Re-read on each request so a rotated environment secret is picked up\n // without exposing token mutation to callers of this module.\n const envToken = Deno.env.get(\"GHL_TOKEN\");\n if (envToken) {\n TOKEN = envToken;\n return envToken;\n }\n if (TOKEN) return TOKEN;\n try {\n const blob = await getBlobModule();\n const cfg = await blob.getJSON(\"puppy_config\").catch(() => null);\n if (cfg?.ghlToken) TOKEN = String(cfg.ghlToken);\n } catch { /* stays undefined; j() will throw a clear auth error */ }\n return TOKEN;\n}\n\nasync function getBlobModule() {\n // Dynamic, not static, so this file's pure logic imports under Node+tsx. Why: NOTES-v1.4.md R39.\n // @ts-expect-error — remote Deno URL specifier; unresolvable (by design) under tsc/Node's module\n // resolution, only ever actually imported at runtime inside a real Deno/val.town environment.\n const mod = await import(\"https://esm.town/v/std/blob\");\n return (mod as any).blob;\n}\n\n// Set by the engine at the top of every cron pass, right after it re-resolves its own TEST_MODE.\n// Default true: an uncalled configureSend means practice mode, not live sending.\nlet TEST_MODE = true;\nexport const ONLY_SENDER_AUTHORITY = \"puppy-engine-v1\" as const;\nlet CONFIGURED_AUTHORITY: string | null = null;\n/** Called once per run by the engine. The optional argument exists for explicit callers; the default\n * preserves the deployed puppy engine's one-argument call. No second path name can arm this layer. */\nexport function configureSend(testMode: boolean, authority: string = ONLY_SENDER_AUTHORITY) {\n if (authority !== ONLY_SENDER_AUTHORITY) {\n throw new Error(`sender authority refused: ${authority || \"(missing)\"}; only ${ONLY_SENDER_AUTHORITY} may send`);\n }\n TEST_MODE = testMode;\n CONFIGURED_AUTHORITY = authority;\n}\n/** For the offline harness and for any caller that needs to see what mode it is actually in. */\nexport function sendModeIsTest(): boolean { return TEST_MODE; }\nexport function configuredSenderAuthority(): string | null { return CONFIGURED_AUTHORITY; }\n\n// The generic JSON helper is needed by main.ts for CRM reads and non-message writes. Without this\n// capability check it was also an unguarded second sender: any module could call j() directly on the\n// message endpoint and bypass assertSendAllowed. The symbol is private to this module.\nconst MESSAGE_IO_CAPABILITY = Symbol(\"message-io-capability\");\nexport function isDirectMessageEndpoint(url: string): boolean {\n try { return new URL(url).pathname.replace(/\\/+$/, \"\") === \"/conversations/messages\"; }\n catch { return false; }\n}\n\nexport async function j(url: string, ver: string, init?: RequestInit, capability?: symbol) {\n if (isDirectMessageEndpoint(url) && capability !== MESSAGE_IO_CAPABILITY) {\n throw new Error(\"direct message endpoint refused: use the guarded sendSms/sendEmail authority\");\n }\n const tok = await resolveToken(); // v1.2 — env var, else private puppy_config blob (see header note)\n const r = await fetch(url, {\n ...init,\n headers: {\n Authorization: `Bearer ${tok}`,\n Version: ver,\n \"Content-Type\": \"application/json\",\n ...(init?.headers ?? {}),\n },\n });\n if (!r.ok) throw new Error(`${r.status} ${url.split(\"?\")[0]} ${(await r.text()).slice(0, 200)}`);\n return r.json();\n}\n\n// v1.7 hardening (6 Aug): in practice mode the SENDERS THEMSELVES refuse anyone except the one\n// sanctioned test record, so safety no longer rests only on enrollment scoping upstream. Fails\n// closed: until resolveTestDummy() has run and set this, practice mode can send to nobody at all.\nlet SANCTIONED_TEST_CONTACT: string | null = null;\nexport function assertSendAllowed(contactId: string, channel: string) {\n if (TEST_MODE && contactId !== SANCTIONED_TEST_CONTACT) {\n throw new Error(`practice mode: refusing ${channel} to ${contactId}; only the sanctioned test record may be messaged`);\n }\n if (CONFIGURED_AUTHORITY !== ONLY_SENDER_AUTHORITY) {\n throw new Error(`sender authority is not configured; refusing ${channel} to ${contactId}`);\n }\n}\n\n// One isolate can receive overlapping invocations even when the blob lock races. Coalesce the exact\n// same in-flight message so those invocations share one HTTP request. This is not a durable receipt —\n// cross-isolate/network-unknown idempotency still belongs in the future dispatcher state — but it\n// closes the local double-POST window without suppressing later legitimate touches.\nconst IN_FLIGHT_MESSAGES = new Map>();\nfunction singleFlight(key: string, run: () => Promise): Promise {\n const existing = IN_FLIGHT_MESSAGES.get(key);\n if (existing) return existing;\n const pending = run().finally(() => IN_FLIGHT_MESSAGES.delete(key));\n IN_FLIGHT_MESSAGES.set(key, pending);\n return pending;\n}\n\nexport async function sendSms(contactId: string, text: string) {\n assertSendAllowed(contactId, \"sms\");\n // Proven shape, copied verbatim from the PupsClub val, which sends real SMS in production today.\n return singleFlight(JSON.stringify([contactId, \"sms\", text]), () => j(`${GHL}/conversations/messages`, \"2021-04-15\", {\n method: \"POST\",\n body: JSON.stringify({ type: \"SMS\", contactId, message: text }),\n }, MESSAGE_IO_CAPABILITY));\n}\n\nexport async function sendEmail(contactId: string, subject: string, html: string) {\n assertSendAllowed(contactId, \"email\");\n // Shape + response (incl. emailMessageId) verified live 27 Jul; full note NOTES-v1.4.md R39.\n return singleFlight(JSON.stringify([contactId, \"email\", subject, html]), () => j(`${GHL}/conversations/messages`, \"2021-04-15\", {\n method: \"POST\",\n body: JSON.stringify({ type: \"Email\", contactId, subject, html }),\n }, MESSAGE_IO_CAPABILITY));\n}\n\nexport async function addTag(contactId: string, tag: string) {\n // Additive, verified live; upsert deliberately not used. Full note: NOTES-v1.4.md R39.\n return j(`${GHL}/contacts/${contactId}/tags`, \"2021-07-28\", {\n method: \"POST\",\n body: JSON.stringify({ tags: [tag] }),\n });\n}\n\nexport async function createTask(contactId: string, title: string, body: string) {\n return j(`${GHL}/contacts/${contactId}/tasks`, \"2021-07-28\", {\n method: \"POST\",\n body: JSON.stringify({ title, body, assignedTo: TASK_OWNER, dueDate: new Date().toISOString(), completed: false }),\n });\n}\n\nexport async function resolveTestDummy(): Promise<{ id: string; firstName: string; companyName: string | null }> {\n if (!TEST_MODE || CONFIGURED_AUTHORITY !== ONLY_SENDER_AUTHORITY) {\n throw new Error(\"test contact upsert refused outside configured practice mode\");\n }\n // TEST_MODE's one sanctioned contact (spec §8). +10000000000 is not a working number in any real\n // numbering plan — chosen specifically so an accidental SMS send during testing cannot reach a real\n // person, while still being a syntactically valid phone value GHL will accept on a contact record.\n const up = await j(`${GHL}/contacts/upsert`, \"2021-07-28\", {\n method: \"POST\",\n body: JSON.stringify({\n locationId: LOC,\n firstName: \"ZZTEST\",\n lastName: \"PuppyPath-Dummy\",\n email: \"aizhigitovamir@gmail.com\",\n phone: \"+10000000000\",\n }),\n });\n const c = up.contact;\n SANCTIONED_TEST_CONTACT = c.id;\n return { id: c.id, firstName: c.firstName, companyName: c.companyName ?? null };\n}\n",[269],"f0fedc1d-2fbf-4aae-bdd3-b2efbbd55c82","run.ts","be37b584-8e76-11f1-b9e0-1607ee4eb77e",1165,["D",1786979138372],"// CHECK NOW — manual trigger for the nurture engine. Built 2 Aug 2026.\n//\n// WHY\n// main.ts is a val.town `interval` file. Its schedule is set in val.town's UI and cannot be read or\n// triggered through the API, which left two real problems: (1) nothing could be verified end-to-end\n// on demand — including the kill switch, which is the one control the client must be able to trust;\n// (2) if the schedule ever stalls there is no way to make the system catch up without a human\n// opening val.town. This file closes both. It imports the same cron() the scheduler calls, so there\n// is exactly one code path — a manual run is not a different run.\n//\n// SAFETY\n// Same admin key as the control panel. Every guard inside cron() still applies in full: the kill\n// switch is checked first, TEST_MODE still defaults on, the run lock still prevents overlap with a\n// scheduled tick, and the send ceilings are unchanged. This adds a trigger, never a bypass.\n//\n// ?k= run once, return the run report as JSON\n// ?k=&dry=1 report what the engine WOULD do without invoking it — resolves nothing, just\n// confirms this endpoint is wired and the key is right\n\nimport cron from \"./main.ts\";\n\n// ---- auth ------------------------------------------------------------------------------------\n// val.town vals are public, so the admin digest must come from the environment. There is no source\n// fallback: absent or malformed configuration denies every key.\n\nasync function sha256Hex(s: string): Promise {\n const b = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(s));\n return [...new Uint8Array(b)].map((x) => x.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nasync function authorised(k: string): Promise {\n const configured = Deno.env.get(\"NURTURE_ADMIN_KEY_SHA256\");\n if (!k || !configured || !/^[0-9a-f]{64}$/i.test(configured)) return false;\n const expected = configured.toLowerCase();\n const got = await sha256Hex(k);\n // Constant-time over equal-length hex digests.\n if (got.length !== expected.length) return false;\n let d = 0;\n for (let i = 0; i < got.length; i++) d |= got.charCodeAt(i) ^ expected.charCodeAt(i);\n return d === 0;\n}\n\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n if (!(await authorised(url.searchParams.get(\"k\") || \"\"))) {\n return new Response(\"Not found\", { status: 401, headers: { \"content-type\": \"text/plain\" } });\n }\n if (url.searchParams.get(\"dry\") === \"1\") {\n return new Response(JSON.stringify({ wired: true, note: \"endpoint live; pass without &dry=1 to actually run\" }, null, 2), {\n headers: { \"content-type\": \"application/json\" },\n });\n }\n const startedAt = new Date().toISOString();\n try {\n const report = await cron();\n return new Response(JSON.stringify({ triggeredAt: startedAt, report }, null, 2), {\n headers: { \"content-type\": \"application/json\", \"cache-control\": \"no-store\" },\n });\n } catch (e) {\n return new Response(JSON.stringify({ triggeredAt: startedAt, error: String(e).slice(0, 900) }, null, 2), {\n status: 500,\n headers: { \"content-type\": \"application/json\" },\n });\n }\n}\n",[276],"c4f73efc-04d4-4901-a710-bae669dbfbec","report.ts","7a35076a-901f-11f1-8a2e-1607ee4eb77e",1164,["D",1786979137205],14,"// FRIDAY REPORT, HTTP endpoint. Renders the week's numbers live from the CRM, saves a Friday\n// snapshot so next week can reference this week honestly. v1.0, 4 Aug 2026.\n//\n// ROUTES ?k= the report page (most recent complete Fri-Fri week)\n// ?k=&save=1 snapshot this week's numbers + draft commentary\n// (auto-save: first ADMIN view on a Friday ET saves the snapshot if missing)\n//\n// DATA every number from the GHL API at render time, computed in report-logic.ts, formulas\n// printed in the appendix. Ad platform numbers appear the day META_TOKEN / GADS creds\n// exist in the val env; until then those cells say \"not tracked yet\" and nothing is\n// estimated. Reconciliation (platform-claimed leads vs contacts that actually landed)\n// switches on the same day.\ndeclare const Deno: { env: { get(k: string): string | undefined } };\nif (typeof (globalThis as any).Deno === \"undefined\") {\n (globalThis as any).Deno = { env: { get: (k: string) => (globalThis as any).process?.env?.[k] } };\n}\nimport {\n reportWindows, inWindow, countContacts, sourceBreakdown, channelBreakdown, attributionCoverage,\n facebookLanded, countEvents, wonOpps,\n weeklyBuckets, pct, deltaWord, money, draftCommentary, FORMULAS, type ContactLite, type EventLite, type OppLite,\n} from \"./report-logic.ts\";\n\nconst LOC = \"BQHJ19uohldYe3eqA0bl\";\nconst GHL = \"https://services.leadconnectorhq.com\";\nconst PUP_TALK_CAL = \"qHuYJ0NEqzibnoqf5Cw3\";\nconst FTD_CALS = [\"K24xHYRExFJDEGpgSNVB\", \"bLn88LGOYYOZ3NySO1EZ\"]; // Free Dog Training Day + Free Training Day\n// v1.0.1 (review fix #3) — computed PER REQUEST, not at module load: val.town keeps modules\n// warm across the DST changeover, and a stale offset shifts every window an hour and can\n// double-save Thursday's snapshot under Friday's key.\nfunction etOffsetMin(atMs: number): number {\n const fmt = new Intl.DateTimeFormat(\"en-US\", { timeZone: \"America/New_York\", timeZoneName: \"shortOffset\" });\n const part = fmt.formatToParts(new Date(atMs)).find((p) => p.type === \"timeZoneName\")?.value ?? \"GMT-4\";\n const m = part.match(/GMT([+-]\\d+)/);\n return m ? Number(m[1]) * 60 : -240;\n}\n\nasync function sha256Hex(s: string): Promise {\n const b = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(s));\n return [...new Uint8Array(b)].map((x) => x.toString(16).padStart(2, \"0\")).join(\"\");\n}\nasync function isAdmin(k: string) {\n const configured = Deno.env.get(\"NURTURE_ADMIN_KEY_SHA256\");\n if (!k || !configured || !/^[0-9a-f]{64}$/i.test(configured)) return false;\n const got = await sha256Hex(k);\n const expected = configured.toLowerCase();\n if (got.length !== expected.length) return false;\n let d = 0;\n for (let i = 0; i < got.length; i++) d |= got.charCodeAt(i) ^ expected.charCodeAt(i);\n return d === 0;\n}\nasync function isViewer(k: string) {\n // v1.0.1 (review fix #4) — derived from the GHL token (a real secret held in env/private\n // blob), NOT from the admin digest that sits in this public source. Rotating the CRM token\n // rotates the view links; documented on Amir's list.\n const tok = await token();\n if (!tok) return false;\n return k === \"tds_view_\" + (await sha256Hex(tok + \":view\")).slice(0, 32);\n}\n\nasync function blobMod() { return (await import(\"https://esm.town/v/std/blob\")).blob; }\nasync function token(): Promise {\n const env = Deno.env.get(\"GHL_TOKEN\");\n if (env) return env;\n try { const blob = await blobMod(); return (await blob.getJSON(\"puppy_config\"))?.ghlToken; } catch { return undefined; }\n}\n\nasync function j(path: string, ver: string) {\n const tok = await token();\n const r = await fetch(`${GHL}${path}`, {\n headers: { Authorization: `Bearer ${tok}`, Version: ver, \"User-Agent\": \"curl/8.5.0\" },\n signal: AbortSignal.timeout(25_000),\n });\n if (!r.ok) throw new Error(`GHL ${path.split(\"?\")[0]} -> HTTP ${r.status}`);\n return r.json();\n}\n\n// Contacts newest-first, paginated until older than `floorMs` (bounded pages so a bad response\n// cannot loop forever). Failure THROWS, the section renders the error loudly, never a zero.\nasync function contactsSince(floorMs: number, errorsOut: string[]): Promise {\n const out: ContactLite[] = [];\n let startAfterId: string | undefined;\n let startAfter: number | undefined;\n let reachedFloor = false;\n for (let page = 0; page < 40; page++) {\n const q = new URLSearchParams({ locationId: LOC, limit: \"100\" });\n if (startAfterId && startAfter) { q.set(\"startAfterId\", startAfterId); q.set(\"startAfter\", String(startAfter)); }\n const d = await j(`/contacts/?${q}`, \"2021-07-28\");\n const cs = d?.contacts ?? [];\n if (!cs.length) break;\n for (const c of cs) {\n // R32: the CRM's own `source` column is null on 78% of contacts and has never once carried\n // \"facebook\". The arrival record is what dashboard.ts has read correctly since 4 Aug.\n const a = (Array.isArray(c.attributions) ? c.attributions : []).find((x: any) => x?.isFirst) ?? c.attributions?.[0] ?? null;\n out.push({\n dateAdded: c.dateAdded, source: c.source ?? null, tags: c.tags ?? [],\n attribution: a ? { medium: a.medium ?? a.utmSessionSource ?? null, campaign: a.utmCampaign ?? null } : null,\n });\n }\n const oldest = Date.parse(cs[cs.length - 1]?.dateAdded ?? \"\");\n const meta = d?.meta ?? {};\n startAfterId = meta.startAfterId; startAfter = meta.startAfter;\n if (Number.isFinite(oldest) && oldest < floorMs) { reachedFloor = true; break; }\n if (!startAfterId) { reachedFloor = true; break; }\n }\n if (!reachedFloor) errorsOut.push(\"Contact history hit the page cap before covering eight weeks; the oldest chart bars may undercount\");\n return out;\n}\n\nasync function eventsFor(calId: string, startMs: number, endMs: number): Promise {\n const d = await j(`/calendars/events?locationId=${LOC}&calendarId=${calId}&startTime=${startMs}&endTime=${endMs}`, \"2021-04-15\");\n return (d?.events ?? []).map((e: any) => ({\n startTime: typeof e.startTime === \"number\" ? e.startTime : Date.parse(e.startTime),\n appointmentStatus: e.appointmentStatus ?? e.appoinmentStatus ?? \"unknown\",\n calendarId: calId,\n }));\n}\n\n// v1.0.1 (review fix #1) — wins are counted by lastStageChangeAt but the search endpoint\n// sorts by createdAt, so a createdAt-floor walk silently drops long-cycle wins (an aged lead\n// created in June, won in August). Wins are a small population: scan them ALL via status=won,\n// no floor break. errorsOut collects a loud note if the page cap is ever hit (fix #8).\n// v1.0.2, PROVEN LIVE 4 Aug 2026: all 5,695 opportunities in this account carry status \"open\".\n// Nobody uses the won/lost flags, so a status=won scan returns zero forever and this report would\n// have printed \"0 closed deals\" every week for the rest of time. The real signal is the pipeline\n// STAGE (Customer / Won-Paid), which the engine's own exit rules already read. Also proven: every\n// such record has monetaryValue 0, so the CRM holds no deal values; the report counts PEOPLE\n// reaching Customer and says plainly that revenue is not recorded.\nconst STAGE_CUSTOMER = \"fd821b4e-bbe6-44de-b754-fa80e4823616\";\nconst STAGE_WON_PAID = \"ae173310-f8b1-4399-acb7-ef1fc03d3697\";\n// FIXED 9 Aug 2026. This used to walk the WHOLE location, page=1..20 at limit=100, and filter\n// down to the two stages afterwards. That reads 2,000 of the roughly 5,800 opportunities this\n// location holds, so it silently missed 1,453 of 1,516 Customer records and 42 of the 53 that\n// carry a dollar value, worth $130,890 of $166,235. It printed \"2 new customers\" for a week that\n// really had 3. The dashboard never had this bug because it queries per stage; this now does the\n// same, which also cuts the request count from 20 pages of everything to ~16 pages of the only\n// two stages that matter.\nasync function wonOppsAll(errorsOut: string[]): Promise {\n const out: OppLite[] = [];\n const pageOf = (stage: string, p: number) =>\n j(`/opportunities/search?location_id=${LOC}&limit=100&page=${p}&pipeline_stage_id=${stage}`, \"2021-07-28\");\n for (const stage of [STAGE_CUSTOMER, STAGE_WON_PAID]) {\n const first = await pageOf(stage, 1);\n const total = Number(first?.meta?.total ?? 0);\n const wanted = Math.ceil(total / 100) || 1;\n const pages = Math.min(wanted, 40); // 4,000 per stage: a backstop, not a working limit\n if (wanted > 40) errorsOut.push(`Customer list hit the page cap on one stage; totals may be partial (${total} records)`);\n const rest = pages > 1\n ? await Promise.all(Array.from({ length: pages - 1 }, (_, i) => pageOf(stage, i + 2)))\n : [];\n for (const d of [first, ...rest]) {\n for (const o of (d?.opportunities ?? [])) {\n out.push({ createdAt: o.createdAt, status: \"won\", monetaryValue: Number(o.monetaryValue) || 0, lastStageChangeAt: o.lastStageChangeAt ?? null });\n }\n }\n }\n return out;\n}\n\n// Ad platforms, honest stubs. The day the tokens exist, these return numbers; until then null.\nasync function metaSpend(w: { startMs: number; endMs: number }, tzMin: number): Promise<{ spend: number; convs: number } | null> {\n const tok = Deno.env.get(\"META_TOKEN\"), act = Deno.env.get(\"META_AD_ACCOUNT\");\n if (!tok || !act) return null;\n // v1.0.1 (fixes #5, #9) — dates shifted into ET before slicing (UTC slice rolled the window\n // one day long); token in the Authorization header, never the URL; errors sanitized so a\n // network failure can never echo credentials into the page.\n const day = (ms: number) => new Date(ms + tzMin * 60_000).toISOString().slice(0, 10);\n const since = day(w.startMs), until = day(w.endMs - 86_400_000);\n let r: Response;\n try {\n r = await fetch(`https://graph.facebook.com/v21.0/${act}/insights?fields=spend,actions&time_range={\"since\":\"${since}\",\"until\":\"${until}\"}`, {\n headers: { Authorization: `Bearer ${tok}` }, signal: AbortSignal.timeout(20_000),\n });\n } catch { throw new Error(\"Meta API unreachable\"); }\n if (!r.ok) throw new Error(`Meta insights -> HTTP ${r.status}`);\n const d = await r.json();\n const row = d?.data?.[0];\n const convs = Number((row?.actions ?? []).find((a: any) => a.action_type === \"onsite_conversion.total_messaging_connection\" || a.action_type === \"lead\")?.value ?? 0);\n return { spend: Number(row?.spend ?? 0), convs };\n}\n\nconst esc = (s: unknown) => String(s ?? \"\").replace(/[&<>\"']/g, (c) => ({ \"&\": \"&\", \"<\": \"<\", \">\": \">\", '\"': \""\", \"'\": \"'\" }[c] as string));\nconst RAMP = [\"#86b6ef\", \"#3987e5\", \"#256abf\", \"#184f95\", \"#0f3a6e\"];\nconst GOOD = \"#0ca30c\", WARN = \"#fab219\", CRIT = \"#d03b3b\";\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n const k = url.searchParams.get(\"k\") || \"\";\n const admin = await isAdmin(k);\n const viewer = !admin && (await isViewer(k));\n if (!admin && !viewer) return new Response(\"Not found\", { status: 401 });\n\n // ?ads=1 (admin only): per-ad Meta spend for a window, straight off the ad platform, as JSON.\n // Exists so cost-per-lead can join platform spend to CRM attribution WITHOUT a number ever\n // being typed. Read only; touches nothing; the formula lives beside the figures downstream.\n if (admin && url.searchParams.get(\"ads\") === \"1\") {\n const tok = Deno.env.get(\"META_TOKEN\"), act = Deno.env.get(\"META_AD_ACCOUNT\");\n if (!tok || !act) return Response.json({ ok: false, why: \"META_TOKEN or META_AD_ACCOUNT not set\" });\n const since = url.searchParams.get(\"since\") || \"\", until = url.searchParams.get(\"until\") || \"\";\n if (!/^\\d{4}-\\d{2}-\\d{2}$/.test(since) || !/^\\d{4}-\\d{2}-\\d{2}$/.test(until)) {\n return Response.json({ ok: false, why: \"since/until must be YYYY-MM-DD\" });\n }\n try {\n const r = await fetch(\n `https://graph.facebook.com/v21.0/${act}/insights?level=ad&fields=ad_id,ad_name,campaign_name,spend,actions&limit=200&time_range={\"since\":\"${since}\",\"until\":\"${until}\"}`,\n { headers: { Authorization: `Bearer ${tok}` }, signal: AbortSignal.timeout(25_000) },\n );\n const body = await r.json();\n if (!r.ok) return Response.json({ ok: false, why: `Facebook returned ${r.status}`, detail: body?.error?.message ?? null });\n const rows = (body?.data ?? []).map((d: any) => ({\n adId: String(d.ad_id ?? \"\"), adName: String(d.ad_name ?? \"\"), campaign: String(d.campaign_name ?? \"\"),\n spend: Number(d.spend ?? 0),\n conv: Number((d.actions ?? []).find((a: any) => a.action_type === \"onsite_conversion.total_messaging_connection\")?.value\n ?? (d.actions ?? []).find((a: any) => a.action_type === \"lead\")?.value ?? 0),\n }));\n return Response.json({ ok: true, since, until, rows, formula: \"cost per lead = spend / CRM contacts whose first-touch utmAdId equals adId, same window\" });\n } catch (e) {\n return Response.json({ ok: false, why: String(e).slice(0, 120) });\n }\n }\n\n const nowMs = Date.now();\n const tzMin = etOffsetMin(nowMs);\n const { current, previous } = reportWindows(nowMs, tzMin);\n const errors: string[] = [];\n const chartWeeks = 8;\n const floor = current.endMs - chartWeeks * 7 * 86_400_000;\n\n let contacts: ContactLite[] = [], ptEvents: EventLite[] = [], ftdEvents: EventLite[] = [], opps: OppLite[] = [];\n let contactsReadable = false, ptReadable = false, ftdReadable = false, oppsReadable = false;\n try { contacts = await contactsSince(floor, errors); contactsReadable = true; } catch (e) { errors.push(`New inquiries could not be read: ${String(e).slice(0, 90)}`); }\n try { ptEvents = await eventsFor(PUP_TALK_CAL, previous.startMs, current.endMs); ptReadable = true; } catch (e) { errors.push(`Pup Talk calendar could not be read: ${String(e).slice(0, 90)}`); }\n try { for (const c of FTD_CALS) ftdEvents.push(...(await eventsFor(c, previous.startMs, current.endMs))); ftdReadable = true; } catch (e) { ftdEvents = []; errors.push(`Free Training Day calendars could not be read: ${String(e).slice(0, 90)}`); }\n try { opps = await wonOppsAll(errors); oppsReadable = true; } catch (e) { errors.push(`Deals could not be read: ${String(e).slice(0, 90)}`); }\n\n let meta: { spend: number; convs: number } | null = null;\n let metaErr: string | null = null;\n try { meta = await metaSpend(current, tzMin); } catch (e) { metaErr = String(e).slice(0, 90); }\n\n const enq = countContacts(contacts, current), enqPrev = countContacts(contacts, previous);\n const pt = countEvents(ptEvents, current), ptPrev = countEvents(ptEvents, previous);\n const ftd = countEvents(ftdEvents, current);\n const won = wonOpps(opps, current), wonPrev = wonOpps(opps, previous);\n const sourcesAll = channelBreakdown(contacts, current); // R32: was sourceBreakdown, which showed 'no source recorded' as her largest channel\n const sources = sourcesAll.slice(0, 6);\n const buckets = weeklyBuckets(contacts, current.endMs, chartWeeks);\n const maxB = Math.max(1, ...buckets);\n\n // The follow-up system's own status, one honest line (stranger-test finding: the report was\n // silent about the thing the retainer is partly for).\n let engineLine = \"\";\n try {\n const blob2 = await blobMod();\n const st = (await blob2.getJSON(\"puppy_state\")) ?? {};\n const run = (await blob2.getJSON(\"puppy_run_state\")) ?? {};\n const rows: any[] = Object.values(st);\n const activeN = rows.filter((s: any) => [\"main\", \"awaiting_appt_outcome\", \"branch_a\", \"branch_b\", \"slow_track\"].includes(s?.status)).length;\n engineLine = run?.testMode === true\n ? `The automated follow-up system is in practice mode and contacting nobody yet. ${activeN === 1 ? \"One test contact is\" : activeN + \" test contacts are\"} running through the sequence to prove it works.`\n : run?.testMode === false\n ? `The automated follow-up system is LIVE with ${activeN} ${activeN === 1 ? \"person\" : \"people\"} in a sequence.`\n : \"\";\n } catch { engineLine = \"\"; }\n\n const unmarked = ptReadable ? Math.max(0, pt.booked - pt.showed - pt.noshow) : 0;\n const commentary = contactsReadable && ptReadable && oppsReadable\n ? draftCommentary({\n enq, enqPrev, ptBooked: pt.booked, ptPrev: ptPrev.booked, ptShowed: pt.showed,\n wonCount: won.count, wonValue: won.value, wonPrevValue: wonPrev.value,\n topSource: sources[0]?.source ?? null, adTracked: !!meta,\n })\n : [\"The written summary is withheld because one or more CRM sources could not be read. Refresh before using this report with the client.\"];\n\n // snapshot: label by the window end date (the Friday). Load last week's for the look-back box.\n const weekKey = new Date(current.endMs).toISOString().slice(0, 10);\n const prevKey = new Date(previous.endMs).toISOString().slice(0, 10);\n const blob = await blobMod().catch(() => null);\n let prevSnap: any = null;\n let savedNote = \"\";\n if (blob) {\n prevSnap = await blob.getJSON(`friday_report_${prevKey}`).catch(() => null);\n const existing = await blob.getJSON(`friday_report_${weekKey}`).catch(() => null);\n const isFridayEt = new Date(nowMs + tzMin * 60_000).getUTCDay() === 5;\n const explicitSave = url.searchParams.get(\"save\") === \"1\";\n // v1.0.1 (fixes #2, #7) — never snapshot a week whose reads FAILED (zeros would be quoted\n // as truth forever); explicit save=1 may overwrite a bad snapshot; success claimed only\n // after the write actually resolved.\n if (admin && errors.length === 0 && (explicitSave || (isFridayEt && !existing))) {\n try {\n await blob.setJSON(`friday_report_${weekKey}`, {\n ts: new Date().toISOString(), weekKey,\n numbers: { enq, enqPrev, pt, ftd, won: won, sources },\n commentary,\n });\n savedNote = \"This week's snapshot was saved just now, next week's report will quote it.\";\n } catch { savedNote = \"Snapshot save FAILED, will retry on next view.\"; }\n } else if (admin && errors.length > 0 && (explicitSave || isFridayEt)) {\n savedNote = \"Snapshot NOT saved: some numbers could not be read (see below).\";\n } else if (existing) savedNote = \"Snapshot for this week already saved.\";\n }\n\n const fmtD = (ms: number) => new Date(ms + tzMin * 60_000).toISOString().slice(5, 10).replace(\"-\", \"/\");\n const tile = (label: string, v: string, note: string, accent?: string) =>\n `

${esc(v)}

${esc(label)}

${esc(note)}

`;\n\n const bars = contactsReadable ? buckets.map((b, i) => {\n const label = i === chartWeeks - 1 ? \"this wk\" : \"\";\n return `

${b}

${label}

`;\n }).join(\"\") : \"\";\n\n const srcRows = contactsReadable\n ? sources.map((s) => `${esc(s.source)}${s.n}`).join(\"\") || `none this week`\n : `Unknown — CRM contacts could not be read`;\n\n const adCells = meta\n ? `${tile(\"Ad spend\", money(meta.spend), \"Meta, this week\")}${tile(\"Cost per inquiry\", contactsReadable ? (enq ? money(meta.spend / enq) : \"n/a\") : \"Unknown\", contactsReadable ? \"spend / inquiries\" : \"CRM inquiries unavailable\", contactsReadable ? undefined : WARN)}`\n : `${tile(\"Ad spend\", \"not tracked yet\", metaErr ? \"connection problem, see appendix\" : \"shows here once Amir links the ad account\", WARN)}`;\n\n // R32: was counting off `source`, which produced \"the CRM recorded 0 Facebook contacts\" in a week\n // its own attribution recorded 116. `unsourced` is deliberately no longer added in: under\n // attribution the unattributed population is about 1 in 142, not 111, so padding it would be\n // inventing a number. It is reported separately as a data-quality note instead.\n const fbLanded = facebookLanded(contacts, current);\n const cover = attributionCoverage(contacts, current);\n const unattributed = cover.total - cover.known;\n const recon = !contactsReadable\n ? `

Did the ad leads actually land?

Unknown. The CRM contact source could not be read, so this report will not compare a platform number with a fabricated zero.

`\n : meta\n ? `

Did the ad leads actually land?

Meta reports ${meta.convs} conversation${meta.convs === 1 ? \"\" : \"s\"} started this week. In the same window ${fbLanded} of the ${cover.total} new contacts in your CRM arrived from Facebook or Instagram, read from the arrival record your CRM keeps on each person. So the comparison is ${meta.convs} claimed against ${fbLanded} landed. The gap, if any, is leads that never became reachable contacts, the number worth watching.${unattributed ? ` ${unattributed} contact${unattributed === 1 ? \"\" : \"s\"} this week arrived with no origin recorded at all and ${unattributed === 1 ? \"is\" : \"are\"} in neither figure.` : \"\"}

`\n : `

Did the ad leads actually land?

Not tracked yet. The day the ad account tokens are connected, this section compares what the platforms claim they delivered against what actually arrived in the CRM.

`;\n\n const errBox = errors.length\n ? `

Some numbers could not be read

${esc(e)}

Missing numbers are shown as errors, never guessed. Refresh in a few minutes; if it persists, tell Amir.

`\n : \"\";\n\n const lastWeekBox = prevSnap\n ? `

What last week's report said

${(prevSnap.commentary ?? []).map((c: string) => esc(c)).join(\" \")}

`\n : `

What last week's report said

No saved report from last week to quote yet. The week-on-week comparisons above are computed fresh from the CRM either way; this box starts quoting the written summary next week.

`;\n\n const html = `\nThe Dogs Spot weekly report, ${esc(fmtD(current.startMs))} to ${esc(fmtD(current.endMs - 86_400_000))}\n

The Dogs Spot, the week in numbers

The week of Friday ${esc(fmtD(current.startMs))} through Thursday ${esc(fmtD(current.endMs - 86_400_000))}. Every figure is read fresh from the CRM when this page opens. ${esc(savedNote)}

\n\n

\n${tile(\"New inquiries\", contactsReadable ? String(enq) : \"Unknown\", contactsReadable ? deltaWord(enq, enqPrev) : \"CRM contacts unavailable\", contactsReadable && enq > enqPrev ? GOOD : contactsReadable ? undefined : WARN)}\n${tile(\"Pup Talks on the calendar\", ptReadable ? String(pt.booked) : \"Unknown\", ptReadable ? deltaWord(pt.booked, ptPrev.booked) : \"calendar unavailable\", ptReadable ? undefined : WARN)}\n${tile(\"New customers\", oppsReadable ? String(won.count) : \"Unknown\", oppsReadable ? `reached the Customer stage (last week ${wonPrev.count})` : \"opportunities unavailable\", oppsReadable && won.count > wonPrev.count ? GOOD : oppsReadable ? undefined : WARN)}\n${adCells}\n

\n\n

What happened, in words DRAFT until Amir reviews

\n${commentary.map((c) => `

${esc(c)}

`).join(\"\")}${unmarked > 0 ? `

${esc(`${unmarked} of the week's Pup Talks ${unmarked === 1 ? \"was\" : \"were\"} never marked showed or no-show in the CRM, so the show rate is fuzzier than it should be. A ten-second tidy after each call fixes that.`)}

` : \"\"}${engineLine ? `

${esc(engineLine)}

` : \"\"}

\n\n

New inquiries, last eight weeks

${contactsReadable\n ? `

${bars}

Each bar is one Friday-to-Thursday week; the rightmost is the week above. As a list: ${buckets.join(\", \")}. Across the eight weeks shown, ${buckets.reduce((a, b) => a + b, 0).toLocaleString(\"en-US\")} new people.

`\n : `

Unknown. CRM contacts could not be read, so an empty chart is not shown as eight zero weeks.

\n\n

Where this week's inquiries came from

\n${srcRows}

Source	People

\n\n

Why there is no revenue figure

${!oppsReadable\n ? \"Revenue is unknown because customer opportunities could not be read. This is not a zero-revenue result.\"\n : (() => {\n const valued = opps.filter((o) => o.monetaryValue > 0);\n const sum = valued.reduce((a, o) => a + o.monetaryValue, 0);\n const money = (n: number) => \"$\" + n.toLocaleString(\"en-US\", { minimumFractionDigits: 2, maximumFractionDigits: 2 });\n // Generated from the same array the tile above counts, so this sentence cannot drift away from\n // the data the way the hand-written one did. It used to read \"every opportunity sits at zero\n // dollars\", which stopped being true and stayed on the page.\n return valued.length === 0\n ? `Not one of your ${opps.length.toLocaleString(\"en-US\")} customer records carries a dollar value, so no honest revenue number can be produced from them.`\n : `${valued.length} of your ${opps.length.toLocaleString(\"en-US\")} customer records carry a dollar value, totaling ${money(sum)}. The other ${(opps.length - valued.length).toLocaleString(\"en-US\")} are empty, which is why this report still cannot tell you what a week earned: the money exists in your payment records, it just never reaches the booking.`;\n})()} ${oppsReadable ? \"Counting people who reach the Customer stage is the closest true measure, and that is the tile above. Put a number on each deal as the deposit is taken and this report can show revenue instead.\" : \"Refresh or repair the CRM connection before sending a revenue statement.\"}

\n\n${recon}\n${lastWeekBox}\n${errBox}\n\n

Appendix, the fine print

This week's raw counts

\n\n\n\n\n\n\n${metaErr ? `` : \"\"}\n

Of the ${ptReadable ? pt.booked : \"unknown\"} Pup Talks: showed / no-show / never marked either way	${ptReadable ? `${pt.showed} / ${pt.noshow} / ${Math.max(0, pt.booked - pt.showed - pt.noshow)}` : \"Unknown\"}
Canceled (not counted above)	${ptReadable ? pt.cancelled : \"Unknown\"}
Show rate	${ptReadable ? `${pt.showed} of ${pt.booked} booked${pt.booked >= 5 ? ` (${pct(pt.showed, pt.booked)})` : \"\"}${Math.max(0, pt.booked - pt.showed - pt.noshow) > 0 && pt.showed + pt.noshow >= 5 ? `; of the ${pt.showed + pt.noshow} actually marked, ${pct(pt.showed, pt.showed + pt.noshow)}` : \"\"}` : \"Unknown\"}
Free Training Day booked / showed	${ftdReadable ? `${ftd.booked} / ${ftd.showed}${ftd.booked === 0 ? \" (none scheduled this week)\" : \"\"}` : \"Unknown\"}
Meta connection error	${esc(metaErr)}

How every number is computed

\n${Object.entries(FORMULAS).map(([k, v]) => `

${esc(k)}: ${esc(v)}

`).join(\"\")}\n

Page built ${esc(new Date(nowMs + tzMin * 60_000).toISOString().slice(0, 16).replace(\"T\", \" at \"))} Georgia time.

`;\n\n return new Response(html, { headers: { \"content-type\": \"text/html; charset=utf-8\", \"cache-control\": \"no-store\" } });\n}\n",[283],"a8c78fee-a002-46e1-b932-4f041b4fdd89","report-logic.ts","79e5d064-901f-11f1-a19e-1607ee4eb77e",679,["D",1786387503379],8,"// FRIDAY REPORT, pure computation module. No network, no Deno APIs: everything here is\n// offline-testable, and every number the report shows is produced by a function in this file\n// with its formula written next to it. v1.0, 4 Aug 2026.\n//\n// ACCURACY RULES (the non-negotiables the report was commissioned under):\n// - numbers come from platform APIs upstream of these functions, never typed in\n// - every derived figure's formula is stored beside it (FORMULAS below, rendered in appendix)\n// - anything unverifiable renders as \"not tracked yet\", never a guess\n\n// `attribution` was PROVEN present on 190/190 contacts in the live account on 4 Aug 2026, while\n// the `source` column was blank on 154 of the same 190. The CRM records where a person came from\n// in a place its own source column never reads from. Optional, because every older caller and\n// every test builds a ContactLite without it.\nexport type Attribution = { medium?: string | null; campaign?: string | null };\nexport type ContactLite = { dateAdded: string; source: string | null; tags: string[]; attribution?: Attribution | null };\nexport type EventLite = { startTime: number; appointmentStatus: string; calendarId: string };\nexport type OppLite = { createdAt: string; status: string; monetaryValue: number; lastStageChangeAt?: string | null };\n\nexport type Window = { startMs: number; endMs: number; label: string };\n\n// Reporting week: Friday 00:00 ET back seven days. The report is read Friday morning, so the\n// most recent COMPLETE window is the seven days ending Thursday midnight.\nexport function reportWindows(nowMs: number, tzOffsetMin: number): { current: Window; previous: Window } {\n // tzOffsetMin: minutes to ADD to UTC to get business-local (ET = -240 in summer).\n const local = new Date(nowMs + tzOffsetMin * 60_000);\n const day = local.getUTCDay(); // 0 Sun .. 5 Fri .. 6 Sat, in local terms\n // most recent Friday 00:00 local, strictly in the past or today\n const sinceFri = (day - 5 + 7) % 7;\n const fri = Date.UTC(local.getUTCFullYear(), local.getUTCMonth(), local.getUTCDate() - sinceFri);\n const friUtcMs = fri - tzOffsetMin * 60_000; // back to real UTC instant of local Friday 00:00\n const week = 7 * 86_400_000;\n return {\n current: { startMs: friUtcMs - week, endMs: friUtcMs, label: \"this week\" },\n previous: { startMs: friUtcMs - 2 * week, endMs: friUtcMs - week, label: \"last week\" },\n };\n}\n\nexport function inWindow(iso: string | number, w: Window): boolean {\n const t = typeof iso === \"number\" ? iso : Date.parse(iso);\n return Number.isFinite(t) && t >= w.startMs && t < w.endMs;\n}\n\n// ---- the formulas, stored as data so the appendix can print them verbatim -----------------------\nexport const FORMULAS: Record = {\n \"New inquiries\": \"how many new people landed in the CRM during the seven days, counted by the date the CRM stamped on them\",\n \"Pup Talks on the calendar\": \"how many Pup Talk appointments had a start time inside the seven days, not counting cancelled ones\",\n \"Showed\": \"how many of those the CRM marked as showed up\",\n \"Show rate\": \"showed divided by booked; the percentage is only quoted when at least five were booked, because a rate built on two appointments misleads\",\n \"Free Training Day\": \"the same counting, done against both Free Training Day calendars\",\n \"New customers\": \"people whose deal reached the Customer stage in the CRM during the week, counted in the week they got there, not the week they first got in touch\",\n \"Up or down on last week\": \"this week against the same count for the seven days before it, shown as level, or up or down by a percentage\",\n \"Cost per inquiry\": \"ad spend divided by new inquiries; appears once the ad account is linked, and is never estimated before then\",\n \"Did the ad leads land\": \"what the ad platform claims it delivered, side by side with what actually arrived in the CRM the same week\",\n};\n\nexport function countContacts(cs: ContactLite[], w: Window): number {\n return cs.filter((c) => inWindow(c.dateAdded, w)).length;\n}\n\nexport function sourceBreakdown(cs: ContactLite[], w: Window): Array<{ source: string; n: number }> {\n const m = new Map();\n for (const c of cs.filter((c) => inWindow(c.dateAdded, w))) {\n const s = (c.source || \"no source recorded\").trim().toLowerCase() || \"no source recorded\";\n m.set(s, (m.get(s) ?? 0) + 1);\n }\n return [...m.entries()].map(([source, n]) => ({ source, n })).sort((a, b) => b.n - a.n);\n}\n\nexport function countEvents(evs: EventLite[], w: Window): { booked: number; showed: number; noshow: number; cancelled: number } {\n const live = evs.filter((e) => inWindow(e.startTime, w));\n const ok = live.filter((e) => e.appointmentStatus !== \"cancelled\" && e.appointmentStatus !== \"invalid\");\n return {\n booked: ok.length,\n showed: ok.filter((e) => e.appointmentStatus === \"showed\").length,\n noshow: ok.filter((e) => e.appointmentStatus === \"noshow\" || e.appointmentStatus === \"no-show\").length,\n cancelled: live.length - ok.length,\n };\n}\n\nexport function wonOpps(os: OppLite[], w: Window): { count: number; value: number } {\n const won = os.filter((o) => o.status === \"won\" && inWindow(o.lastStageChangeAt || o.createdAt, w));\n return { count: won.length, value: won.reduce((a, o) => a + (Number(o.monetaryValue) || 0), 0) };\n}\n\n// weekly buckets for the 8-week chart, oldest first\n// The reader-facing name for each raw medium string. Anything not in this map is passed through\n// as itself rather than bucketed into \"other\", so a new channel appears by name instead of\n// silently vanishing into a catch-all nobody investigates.\nconst MEDIUM_LABEL: Record = {\n facebook: \"Facebook\", instagram: \"Instagram\", form: \"a form on your website\",\n chat_widget: \"the chat box on your website\", conversation: \"a direct message\",\n other: \"somewhere else\", email: \"email\", sms: \"text message\", phone: \"phone call\",\n};\nexport function prettyMedium(m: string | null | undefined): string {\n const k = (m || \"\").trim().toLowerCase();\n if (!k) return \"not recorded\";\n return MEDIUM_LABEL[k] ?? k.replace(/_/g, \" \");\n}\n// Where people actually came from, read from the attribution record rather than the source column.\nexport function channelBreakdown(cs: ContactLite[], w: Window): Array<{ source: string; n: number }> {\n const m = new Map();\n for (const c of cs.filter((c) => inWindow(c.dateAdded, w))) {\n const label = prettyMedium(c.attribution?.medium);\n m.set(label, (m.get(label) ?? 0) + 1);\n }\n return [...m.entries()].map(([source, n]) => ({ source, n }))\n .sort((a, b) => (b.n - a.n) || a.source.localeCompare(b.source));\n}\n// Named campaigns. A campaign name is ad-platform text, so it reaches the page as data and must\n// be escaped there like any other untrusted string.\nexport function campaignBreakdown(cs: ContactLite[], w: Window): Array<{ name: string; n: number }> {\n const m = new Map();\n for (const c of cs.filter((c) => inWindow(c.dateAdded, w))) {\n const name = (c.attribution?.campaign || \"\").trim();\n if (!name) continue;\n m.set(name, (m.get(name) ?? 0) + 1);\n }\n return [...m.entries()].map(([name, n]) => ({ name, n }))\n .sort((a, b) => (b.n - a.n) || a.name.localeCompare(b.name));\n}\n// How many of a window's contacts can be placed at all. This is the honest headline for the\n// section: \"we can account for X of Y\", never a bare count of the unexplained.\nexport function attributionCoverage(cs: ContactLite[], w: Window): { known: number; total: number } {\n const inW = cs.filter((c) => inWindow(c.dateAdded, w));\n return { known: inW.filter((c) => (c.attribution?.medium || \"\").trim()).length, total: inW.length };\n}\n\n// R32 (10 Aug 2026). Paid-social arrivals, read from the ARRIVAL RECORD, never from `source`.\n// Case-insensitive on purpose: channelBreakdown returns display labels from prettyMedium\n// (\"Facebook\", \"Instagram\"), so a case-sensitive regex here reproduces the exact bug this replaces.\nexport const PAID_SOCIAL_RE = /facebook|instagram|meta|messenger/i;\nexport function facebookLanded(cs: ContactLite[], w: Window): number {\n return channelBreakdown(cs, w).filter((s) => PAID_SOCIAL_RE.test(s.source)).reduce((a, s) => a + s.n, 0);\n}\n\nexport function weeklyBuckets(cs: ContactLite[], endMs: number, weeks: number): number[] {\n const wMs = 7 * 86_400_000;\n const out = new Array(weeks).fill(0);\n for (const c of cs) {\n const t = Date.parse(c.dateAdded);\n if (!Number.isFinite(t) || t >= endMs || t < endMs - weeks * wMs) continue;\n const idx = weeks - 1 - Math.floor((endMs - 1 - t) / wMs);\n if (idx >= 0 && idx < weeks) out[idx]++;\n }\n return out;\n}\n\nexport function pct(n: number, d: number): string {\n if (!d) return \"n/a\";\n return Math.round((n / d) * 100) + \"%\";\n}\n\nexport function deltaWord(cur: number, prev: number): string {\n if (cur === prev) return \"level with last week\";\n if (prev === 0) return cur > 0 ? \"up from zero last week\" : \"level with last week\";\n const ch = Math.round(((cur - prev) / prev) * 100);\n return ch > 0 ? `up ${ch}% on last week` : `down ${Math.abs(ch)}% on last week`;\n}\n\nexport function money(n: number): string {\n return \"$\" + n.toLocaleString(\"en-US\", { minimumFractionDigits: 2, maximumFractionDigits: 2 });\n}\n\n// ---- draft commentary: rule-based sentences from the computed numbers. Never speculates. --------\n// Marked DRAFT in the page; the human tops and tails before it goes anywhere.\nexport function draftCommentary(f: {\n enq: number; enqPrev: number;\n ptBooked: number; ptPrev: number; ptShowed: number;\n wonCount: number; wonValue: number; wonPrevValue: number;\n topSource: string | null;\n adTracked: boolean;\n}): string[] {\n const lines: string[] = [];\n lines.push(\n `${f.enq} new ${f.enq === 1 ? \"inquiry\" : \"inquiries\"} came in this week, ${deltaWord(f.enq, f.enqPrev)}.` +\n (f.topSource === \"no source recorded\"\n ? ` Most arrived without a source recorded in the CRM, a tracking gap worth closing.`\n : f.topSource\n ? ` The biggest source was ${f.topSource}.`\n : \"\"),\n );\n lines.push(\n `${f.ptBooked} Pup Talk${f.ptBooked === 1 ? \" was\" : \"s were\"} on the calendar (${deltaWord(f.ptBooked, f.ptPrev)})` +\n (f.ptBooked >= 5 ? `, and ${f.ptShowed} of them showed (${pct(f.ptShowed, f.ptBooked)}).` : f.ptBooked > 0 ? `, ${f.ptShowed} showed.` : \".\"),\n );\n // The CRM holds no deal values (proven live: every opportunity is $0 and none are flagged\n // won), so this counts PEOPLE reaching the Customer stage and never implies a revenue figure.\n if (f.wonCount > 0) {\n lines.push(`${f.wonCount} ${f.wonCount === 1 ? \"person\" : \"people\"} reached the Customer stage this week.`);\n } else {\n lines.push(`Nobody reached the Customer stage in the CRM this week.`);\n }\n if (!f.adTracked) {\n lines.push(`Ad spend and cost per lead are not tracked yet, they appear the week the ad platform tokens are connected.`);\n }\n return lines;\n}\n",[291],"ab06b90a-4bea-4ed5-9cfe-9e9ba9cd3552","render.ts","5f8048e8-902f-11f1-8bd3-1607ee4eb77e",77,["D",1785866856515],"// MESSAGE RENDERING. Extracted from main.ts on 4 Aug 2026.\n//\n// WHY IT LIVES HERE: main.ts sits against a hard 80,000-character ceiling on the platform, and\n// these are the most self-contained functions in the file. Pulling them out also means the escape\n// and merge-field rules can be tested directly rather than only through a full engine run, which\n// matters because two of the fixes below came out of a security review, not a feature request.\n\n// Spec: dog name blank on ~70% of sampled contacts; fallback \"your puppy\" per the writing sheet's own\n// proposed default (§6 Q3). Messy-but-present values (multi-dog, junk like \"Money\") are used as-is —\n// that's an intake-form data-quality problem, not something to silently \"clean\" here.\nexport function resolveDogName(companyName: string | null | undefined): string {\n const v = (companyName ?? \"\").trim();\n return v.length > 0 ? v : \"your puppy\";\n}\n\n// Spec only discusses the blank-dog-name case explicitly. Added this small parallel safety net for a\n// blank first name (defensive, beyond spec's literal text) because \"Hi ,\" landing in a live message\n// would look obviously broken — same principle as the dog-name fallback, applied consistently.\nexport function resolveFirstName(firstName: string | null | undefined): string {\n const v = (firstName ?? \"\").trim();\n return v.length > 0 ? v : \"there\";\n}\n\nexport function applyMergeFields(template: string, firstName: string | null | undefined, companyName: string | null | undefined): string {\n // v1.8.1 — function form so $-patterns in names (\"Bo$$\") cannot corrupt the body.\n return template\n .replaceAll(\"{{FIRST_NAME}}\", () => resolveFirstName(firstName))\n .replaceAll(\"{{DOG_NAME}}\", () => resolveDogName(companyName));\n}\n\n// v1.8.1 — contact-typed fields and Kim's stories land in email HTML; escape BEFORE the\n// **bold** transform so markup we generate survives and markup anyone else typed does not.\nexport function escHtml(s: string): string {\n return s.replace(/[&<>\"']/g, (c) => ({ \"&\": \"&\", \"<\": \"<\", \">\": \">\", '\"': \""\", \"'\": \"'\" }[c] as string));\n}\n\nexport function mdBoldToHtml(text: string): string {\n return text.replace(/\\*\\*(.+?)\\*\\*/g, \"$1\");\n}\n\nexport function bodyToHtml(body: string, previewText?: string): string {\n const paragraphs = escHtml(body)\n .trim()\n .split(/\\n\\s*\\n/)\n .map((p) => `

${mdBoldToHtml(p.trim()).replace(/\\n/g, \"
\")}

`)\n .join(\"\\n\");\n // Hidden preheader technique so the approved \"preview text\" shows in an inbox list without being\n // visible in the opened email — standard, low-risk, one line.\n const preheader = previewText\n ? `\\n`\n : \"\";\n return preheader + paragraphs;\n}\n\n",[299],"e44517da-ff14-4dd9-bac6-8a338f5b2765","registry-diff.ts","a96cde42-908b-11f1-96ea-1607ee4eb77e",1163,["D",1786979135356],"// WHAT CHANGED IN A LIST SOMEBODY ELSE CONTROLS. v1.0, 5 August 2026.\n//\n// The watchdog watches two registries in Kim's CRM that nobody on this project owns: her 165\n// automations, and the eight knowledge bases Chloe answers customers from. Both can be edited by\n// Kim, by Kristian, or by an integration nobody remembers installing, and until v1.6 the knowledge\n// bases were not watched at all. The consolidated one was edited at 02:38 on 5 August and nothing\n// noticed.\n//\n// This is the comparison, on its own, so it can be tested. It lived inline in the watchdog before,\n// where it could only ever be checked by waiting for somebody to change something — which means a\n// check nobody has ever seen go off. Same rule as everywhere else in this project: a check that\n// cannot be shown to fail is not a check.\n//\n// It deliberately knows nothing about workflows or knowledge bases. It takes two maps of\n// id -> description and says what moved.\n\nexport type Registry = Record;\n\nexport type RegistryKeyDiff = {\n missing: string[];\n unexpected: string[];\n duplicates: string[];\n exact: boolean;\n changed: boolean;\n};\n\n/** Compare an approved key set with the keys a registry actually exposes. This is deliberately\n * separate from `registryDiff`: the watchdog compares id->description snapshots over time, while\n * nurture safety asks a stricter question — is this exactly the promised set, with no substitution\n * and no duplicate definition? Order never matters; duplicates always do. */\nexport function registryKeyDiff(expected: readonly string[], actual: readonly string[]): RegistryKeyDiff {\n const clean = (xs: readonly string[]) => xs.map((x) => String(x).trim()).filter(Boolean);\n const a = clean(expected);\n const b = clean(actual);\n const aSet = new Set(a);\n const bSet = new Set(b);\n const duplicates = [...new Set(b.filter((key, i) => b.indexOf(key) !== i))].sort();\n const missing = [...aSet].filter((key) => !bSet.has(key)).sort();\n const unexpected = [...bSet].filter((key) => !aSet.has(key)).sort();\n const exact = missing.length === 0 && unexpected.length === 0 && duplicates.length === 0 &&\n aSet.size === bSet.size;\n return { missing, unexpected, duplicates, exact, changed: !exact };\n}\n\nexport type RegistryChange = {\n added: string[];\n removed: string[];\n edited: string[]; // \"old -> new\", so a reader can see what moved without opening anything\n changed: boolean;\n};\n\nexport function registryDiff(prev: Registry | null | undefined, now: Registry | null | undefined): RegistryChange {\n const a = prev && typeof prev === \"object\" ? prev : {};\n const b = now && typeof now === \"object\" ? now : {};\n const prevIds = Object.keys(a);\n const nowIds = Object.keys(b);\n const added = nowIds.filter((i) => !(i in a)).map((i) => b[i]);\n const removed = prevIds.filter((i) => !(i in b)).map((i) => a[i]);\n const edited = nowIds.filter((i) => i in a && a[i] !== b[i]).map((i) => `${a[i]} -> ${b[i]}`);\n return { added, removed, edited, changed: added.length + removed.length + edited.length > 0 };\n}\n\n/**\n * Is this an empty response we should DISTRUST rather than act on?\n *\n * A malformed-but-200 reply that returns an empty list must never overwrite a good baseline, or\n * the next pass fires \"everything was removed\" and the one after that fires \"everything was\n * added\". The watchdog learned this on the workflow registry; the knowledge-base watch inherits it\n * rather than rediscovering it.\n */\nexport function looksLikeAGlitch(nowCount: number, prevCount: number | null | undefined): boolean {\n return nowCount === 0 && (prevCount ?? 0) > 0;\n}\n\n/** The sentence, generated from the change, never written alongside it. */\nexport function registrySentence(c: RegistryChange, what: string): string {\n if (!c.changed) return `Nothing has moved in ${what} since the last look.`;\n const bits: string[] = [];\n if (c.edited.length) bits.push(`Edited: ${c.edited.slice(0, 3).join(\"; \")}.`);\n if (c.added.length) bits.push(`Added: ${c.added.slice(0, 3).join(\"; \")}.`);\n if (c.removed.length) bits.push(`Removed: ${c.removed.slice(0, 3).join(\"; \")}.`);\n const more = c.added.length + c.removed.length + c.edited.length - Math.min(3, c.edited.length) - Math.min(3, c.added.length) - Math.min(3, c.removed.length);\n if (more > 0) bits.push(`${more} more not listed here.`);\n return bits.join(\" \");\n}\n",[306],"0b6b5e3f-1acf-41da-82cc-c4ece65a4a71","reachability.ts","fe763228-9822-11f1-a772-1607ee4eb77e",1162,["D",1786979134269],"// REACHABILITY, DEAD LETTERS AND DELIVERY. Extracted from main.ts on 14 Aug 2026, for exactly the\n// reason consent.ts and render.ts were extracted before it: main.ts sits against val.town's hard\n// 80,000-character ceiling with ~850 characters spare, and the code that decides whether a real\n// person can be reached at all should be a file you can find, not twenty lines inside a 1,500-line\n// engine. Every function here is pure or takes its IO injected, so all of it is directly testable.\n//\n// THE FOUR DEFECTS THIS FILE EXISTS TO CLOSE. All four were proven by running the compiled engine\n// against the live account, not inferred from reading it.\n//\n// 1. THE SPIN. channelBar guarded `noEmail` for email and had NO PHONE EQUIVALENT. ContactFact had\n// no phone field at all, though getContact fetches `phone` on every pass and threw it away. An\n// SMS step coming due for a phoneless contact went: due -> sendGate (no contactability check) ->\n// channelBar returns null -> send -> sendSms -> `if (!r.ok) throw` -> the catch in cron(), which\n// WROTE NOTHING TO STATE. dueAt never moved, so the next tick re-derived the identical decision.\n// Rule 9's 21-day exit needs lastMainStepSent >= MAIN_SEQUENCE.length, which only advances on the\n// success path, so it never timed out. MAX_SENDS_PER_RUN and MAX_SENDS_PER_DAY both read\n// out.sent, which only increments on success, so FAILURES WERE UNCAPPED. Observed cadence ~60min\n// = ~24 retries per contact per day, forever, plus a CRITICAL watchdog alert every hour.\n// Live census, all 5,748 contacts: 398 qualify as puppy inquiries, 266 of them have NO PHONE.\n// Bulk-tagging today would have been ~648 failed sends and ~2,600 wasted GHL calls per day.\n//\n// 2. NO ATTEMPT COUNTER, NO DEAD LETTER. PuppyState had no failure field and all five terminal\n// statuses were success shapes, so a permanently failing contact rendered as \"In the main\n// sequence\" indefinitely. Fixed by sendFailures + MAX_SEND_FAILURES + done_send_failed.\n//\n// 3. NO REACHABILITY EXIT. A contact with neither email nor phone silently consumed all 8 steps and\n// then fired the soft_exit_21d task telling Kim \"Puppy path finished... now on the slow track\" —\n// a task that is a lie about somebody who received nothing. done_unreachable ends them at the\n// first pass instead, and DELIBERATELY CREATES NO TASK: bulk-tagging 300 contacts would put 265\n// tasks in Kim's CRM in a single run, which is its own incident. It is journalled and counted.\n// Only a contact that TRIED and FAILED (the dead-letter path) earns a task.\n//\n// 4. DELIVERY WAS NEVER RECONCILED. The send response was discarded entirely, including the\n// messageId the engine's own comment documents, so any 2xx from GHL was recorded as \"sent\".\n// Live sampling found 9 `undelivered` out of 124 outbound SMS in this account (7.3%) — every one\n// of them would have counted as a success.\n//\n// SCOPE NOTE — WHAT IS AND IS NOT READABLE ABOUT DELIVERY (verified live, 14 Aug 2026):\n// * SMS status IS readable on GET /conversations/{conversationId}/messages (Version 2021-04-15):\n// each message carries `status` (delivered / undelivered / queued / ...).\n// * EMAIL status is NOT on that endpoint: 137 TYPE_EMAIL messages sampled there carried no\n// `status` key at all.\n// * EMAIL status IS readable on GET /conversations/messages/email/{emailMessageId} (verified 200,\n// returned status:\"opened\"), and sendEmail already returns emailMessageId in its response.\n// Both are handled below. Where either read fails, the status is recorded as the literal string\n// \"unknown\" — VISIBLY UNKNOWN, never filed as fine. That is this codebase's standing rule\n// (facts.ts:1-12): a fact nobody could establish is not a fact that everything is well.\n//\n// RECONCILIATION IS KEYED ON THE MESSAGE ID, never on \"the newest outbound message on the thread\".\n// Chloe, Ava and 165 GHL workflows also send into these same conversations; attributing another\n// system's `undelivered` to this engine would dead-letter a perfectly healthy contact.\n\ndeclare const Deno: { env: { get(key: string): string | undefined } };\nif (typeof (globalThis as any).Deno === \"undefined\") {\n (globalThis as any).Deno = { env: { get: (k: string) => (globalThis as any).process?.env?.[k] } };\n}\n\n// Same idiom as the engine's other knobs: read per call, env-overridable, clamped so a typo cannot\n// disable the ceiling. 3 = two retries after the first failure, which is enough for a transient\n// GHL blip and nowhere near enough to be a spin.\nexport const maxSendFailures = () => Math.max(1, Math.floor(Number(Deno.env.get(\"MAX_SEND_FAILURES\") ?? \"3\")) || 3);\n// How long after a send before its status is worth reading back. GHL stamps status asynchronously;\n// reading seconds after the POST reports \"queued\" for everything and teaches you nothing.\nexport const RECONCILE_MIN_AGE_MS = 5 * 60 * 1000;\n\n// ---- statuses, reasons, state fields --------------------------------------------------------------\n\n// Declared here rather than inline in main.ts purely for that file's character budget; they are\n// spliced into PuppyStatus and TERMINAL_STATUSES there, so they are terminal everywhere for free.\nexport type DeadLetterStatus = \"done_unreachable\" | \"done_send_failed\";\nexport const DEAD_LETTER_STATUSES: DeadLetterStatus[] = [\"done_unreachable\", \"done_send_failed\"];\n\n// Reason strings live in exactly one place so a test, a log line and a dashboard label cannot drift.\n// NOTE the wording: absence is never described as an opt-out the person did not make (consent.ts's\n// rule, and consent-guard.test.mjs CG-4 pins it).\nexport const NO_EMAIL_REASON = \"no email address on the record\";\nexport const NO_PHONE_REASON = \"no phone number on the record\";\nexport const UNREACHABLE_REASON = \"no email address and no phone number on the record\";\nexport const OPTOUT_REASON = \"replied with an opt-out keyword\";\nexport const DND_WRITE_MESSAGE = \"Replied with an opt-out keyword to a puppy-path message\";\n\nexport type FailureFields = {\n // v1.9 — ALL OPTIONAL, on purpose: existing state blobs in production deserialize untouched and\n // every reader defaults them. Same discipline as the v1.7 slow-track fields.\n sendFailures?: number; // consecutive failed attempts; reset to 0 by a success\n lastFailureAt?: string | null; // ISO — feeds the exponential backoff\n lastFailureReason?: string | null;\n lastMessageId?: string | null; // the id GHL returned for our last send, for reconciliation\n lastMessageChannel?: \"sms\" | \"email\" | null;\n lastDeliveryStatus?: string | null; // observed status, or the literal \"unknown\"\n};\n\nexport const FRESH_FAILURE_FIELDS: FailureFields = {\n sendFailures: 0, lastFailureAt: null, lastFailureReason: null,\n lastMessageId: null, lastMessageChannel: null, lastDeliveryStatus: null,\n};\n\n/** Consecutive failures, clamped. Garbage counters (NaN, negative, a string blob) read as 0 rather\n * than falling through to \"dead-letter this contact\" — same clamping the slow track already does. */\nexport const failCount = (s: FailureFields | null | undefined): number =>\n Math.max(0, Math.floor(Number(s?.sendFailures)) || 0);\n\n// ---- channel availability -------------------------------------------------------------------------\n\n/** Is this channel physically usable for this contact? Absence of an address, not consent — the\n * consent question is readChannelConsent's, and the two are deliberately reported differently. */\nexport function missingChannel(c: { noEmail?: boolean; noPhone?: boolean }, ch: \"email\" | \"sms\"): string | null {\n if (ch === \"email\" && c.noEmail) return NO_EMAIL_REASON;\n if (ch === \"sms\" && c.noPhone) return NO_PHONE_REASON;\n return null;\n}\n\n/**\n * Rules 1b and 1c of the state machine, evaluated immediately after the DND rule and BEFORE the\n * disqualified rule.\n *\n * 1b — the contact asked to stop, in words, in a reply. Hard exit. It outranks rule 5 (pause_reply)\n * deliberately: today an \"UNSUBSCRIBE\" reply routes to pause_reply, which pauses, raises a task\n * for a human, records no opt-out at all, and RESUMES SENDING once a human answers.\n * 1c — the contact has neither an email address nor a phone number, so nothing can ever be sent to\n * them by any channel. Ending them here is what stops them consuming all 8 steps in silence and\n * then triggering a \"puppy path finished\" task about somebody who received nothing.\n *\n * Returns a Decision-shaped object; assignable to the engine's Decision union without importing it,\n * which keeps this file free of a circular dependency on main.ts.\n */\nexport function reachabilityExit(f: {\n contact: { noEmail?: boolean; noPhone?: boolean };\n optOutRequested?: boolean;\n}): { kind: \"hard_exit\"; status: \"done_hard_exit\" | \"done_unreachable\"; reason: string } | null {\n if (f.optOutRequested) return { kind: \"hard_exit\", status: \"done_hard_exit\", reason: OPTOUT_REASON };\n if (f.contact.noEmail && f.contact.noPhone) {\n return { kind: \"hard_exit\", status: \"done_unreachable\", reason: UNREACHABLE_REASON };\n }\n return null;\n}\n\nexport type LifecycleFacts = {\n optOutRequested?: boolean;\n blanketDnd?: boolean;\n becameCustomer?: boolean;\n booked?: boolean;\n replied?: boolean;\n sequenceComplete?: boolean;\n noEmail?: boolean;\n noPhone?: boolean;\n};\n\nexport type LifecycleDecision =\n | { kind: \"hard_exit\"; status: \"done_optout\" | \"done_dnd\" | \"done_customer\" | \"done_booked\" | \"done_unreachable\"; reason: string }\n | { kind: \"pause\"; status: \"paused_reply\"; reason: string }\n | { kind: \"complete\"; status: \"done_sequence\"; reason: string }\n | { kind: \"continue\"; status: \"active\"; reason: null };\n\n/** Shared exit precedence for every future isolated path. It is pure and intentionally conservative:\n * legal/safety exits outrank conversion exits, conversion outranks a reply pause, and completion is\n * last. This contract does not change the existing puppy state machine; it prevents each new path\n * from inventing a different ordering. */\nexport function decideLifecycle(f: LifecycleFacts): LifecycleDecision {\n if (f.optOutRequested) return { kind: \"hard_exit\", status: \"done_optout\", reason: OPTOUT_REASON };\n if (f.blanketDnd) return { kind: \"hard_exit\", status: \"done_dnd\", reason: \"blanket Do Not Disturb is on\" };\n if (f.noEmail && f.noPhone) return { kind: \"hard_exit\", status: \"done_unreachable\", reason: UNREACHABLE_REASON };\n if (f.becameCustomer) return { kind: \"hard_exit\", status: \"done_customer\", reason: \"became a customer\" };\n if (f.booked) return { kind: \"hard_exit\", status: \"done_booked\", reason: \"booked the path's conversion event\" };\n if (f.replied) return { kind: \"pause\", status: \"paused_reply\", reason: \"inbound reply needs a human\" };\n if (f.sequenceComplete) return { kind: \"complete\", status: \"done_sequence\", reason: \"final approved step completed\" };\n return { kind: \"continue\", status: \"active\", reason: null };\n}\n\n/** Enrolment-time refusal. A contact with no way of being contacted is not put on the path at all:\n * no puppy-path-v1 tag, one journal row, and a terminal state entry (see reEnrollable). */\nexport function enrolmentBar(c: { email?: unknown; phone?: unknown } | null | undefined): string | null {\n return !c?.email && !c?.phone ? UNREACHABLE_REASON : null;\n}\n\n/**\n * CAN A DEAD LETTER COME BACK? (14 Aug, defect 2.)\n *\n * The candidate filter was `!tags.includes(TAG_ENROLLED) && !state[c.id]`. A done_send_failed or\n * done_unreachable entry sits in state and is never touched again — the per-contact loop `continue`s\n * on any terminal status, so lastCheckedAt never moves and pruneState only drops it after 60 days.\n * Meanwhile the dead-letter task this file writes told Kim to do exactly the thing that did not work:\n * \"remove the puppy-path-v1 tag and re-tag them\". Proven against the live account: she removes the\n * tag, fixes the phone number, re-tags — candidates that survive the filter: 0.\n *\n * So a dead letter is allowed back in, under two conditions that stop it becoming a loop:\n * 1. ONLY the two dead-letter statuses. done_customer, done_hard_exit (which is where an opt-out\n * lands), done_booked, done_soft_21d, done_branch_complete and done_not_enrolled are NOT\n * resurrectable by re-tagging\n * — an opt-out must never be undone by a tag, and a customer must never be re-nurtured by one.\n * 2. THE REASON MUST NO LONGER BE VISIBLY TRUE. A contact who still has neither an email address\n * nor a phone number is not a candidate at all: nothing was fixed, so re-admitting them would\n * re-refuse them every run forever, which is defect 4 with a different name. done_send_failed\n * cannot be verified the same way (a bad number looks exactly like a good one), so it is let\n * back in with a fresh attempt budget — and re-enrolment applies TAG_ENROLLED, which is what\n * stops it repeating: they are excluded by the first clause of the filter from then on.\n */\nexport function reEnrollable(\n s: { status?: string } | null | undefined,\n c: { email?: unknown; phone?: unknown } | null | undefined,\n): boolean {\n if (!s || !DEAD_LETTER_STATUSES.includes(s.status as DeadLetterStatus)) return false;\n return !enrolmentBar(c); // still unreachable: stays dead-lettered, silently, at zero cost\n}\n\n/**\n * Has this exact refusal already been written to the journal for this contact? (14 Aug, defect 4.)\n *\n * A TRANSIENT refusal — \"tagged but already has a live Pup Talk booking\" — must keep being\n * re-evaluated every run, because the booking may be cancelled tomorrow and then they SHOULD enrol.\n * But re-evaluating it wrote an identical journal row every run: 39 of the last 40 rows on Kim's\n * live activity page are the same sentence, hourly, for two days, and at ~24-30 rows a day the\n * 2,000-row cap evicts every real thing the system did within about two months.\n *\n * A terminal refusal gets a state entry instead (that is what enrolmentBar's branch does, and it is\n * why that one never repeated). A transient one cannot have a state entry — any state entry at all\n * removes the contact from the candidate filter — so the repetition is stopped at the journal.\n */\nexport function refusedBefore(\n priorJournal: { contactId?: string | null; event?: string; detail?: string }[] | null | undefined,\n contactId: string,\n detail: string,\n): boolean {\n return (priorJournal ?? []).some(\n (r) => r?.contactId === contactId && r?.event === \"enroll_refused\" && r?.detail === detail,\n );\n}\n\n// ---- backoff --------------------------------------------------------------------------------------\n\n/**\n * Exponential backoff between failed attempts: 2^failures hours. Returned as a sendGate reason\n * string, so a contact in backoff produces `skip` — state untouched, step still due, picked up\n * later — which is exactly how every other deferral in this engine behaves.\n *\n * The `since >= 0` guard mirrors the R27 / v1.7 clock-skew guards: a future-dated stamp (restored\n * blob, clock skew) must never freeze a contact until that future date.\n */\nexport function backoffBar(s: FailureFields | null | undefined, nowMs: number): string | null {\n const n = failCount(s);\n if (!n || !s?.lastFailureAt) return null;\n const since = nowMs - Date.parse(s.lastFailureAt);\n if (!(since >= 0)) return null;\n const waitH = Math.pow(2, Math.min(n, 12));\n if (since >= waitH * 3600000) return null;\n return `send backoff after ${n} failure(s): waiting ${waitH}h, ${(since / 3600000).toFixed(1)}h elapsed`;\n}\n\n// ---- failure accounting ---------------------------------------------------------------------------\n\n/** Injected effects, so every policy decision below stays testable without a network. */\nexport type Effects = {\n state: Record;\n save: (st: Record) => Promise;\n log: (line: string) => void;\n journal: (contactId: string, event: string, detail: string) => void;\n /** null in practice mode — TEST_MODE must never write a task into the client's real CRM. */\n task: ((contactId: string, title: string, body: string) => Promise) | null;\n};\n\n/**\n * THE INVARIANT THIS FUNCTION MUST NOT BREAK. main.ts's comment on the success path reads: \"state\n * persisted IMMEDIATELY after each successful send (a mid-run crash must never re-send)\". So this\n * moves the FAILURE COUNTER AND NOTHING ELSE. lastMainStepSent, lastBranchStepSent, lastSlowStepSent\n * and lastSentAt are all left exactly as they were: nothing went out, so no step is consumed and the\n * pacing clock does not start. The only status change is the terminal one at the ceiling.\n */\nexport function nextFailureState>(\n s: S, nowIso: string, reason: string,\n): { next: S; n: number; dead: boolean } {\n const n = failCount(s) + 1;\n const dead = n >= maxSendFailures();\n const next: any = {\n ...s,\n sendFailures: n,\n lastFailureAt: nowIso,\n lastFailureReason: reason.slice(0, 200),\n lastCheckedAt: nowIso,\n lastMessageId: null, // whatever we were reconciling is moot; this attempt is the news now\n };\n if (dead) {\n next.status = \"done_send_failed\";\n next.exitReason = `${n} consecutive send failures — dead-lettered (${reason.slice(0, 120)})`;\n }\n return { next: next as S, n, dead };\n}\n\nexport const DEAD_LETTER_TITLE = \"Automated follow-up has STOPPED for this contact — messages keep failing\";\n\nexport function deadLetterBody(label: string, n: number, reason: string): string {\n return `Auto-created by puppy-path-engine: ${n} attempts to send ${label} to this contact all failed, so the engine has stopped trying.\\n\\nLast error: ${reason.slice(0, 200)}\\n\\nThis person is NOT receiving the puppy follow-up and will not receive any more of it. Usual causes: the phone number or email address on the record is wrong or missing, the number is a landline, or the carrier is rejecting us.\\n\\nTo put them back on it: fix the contact details first, then remove the puppy-path-v1 tag and add the tag you normally use to start someone on the puppy path. They begin again at message one on the next run. If the record still has no phone number and no email address, nothing happens and they stay stopped — the details have to be fixed first, and this is the only order that works.`;\n}\n\nasync function announceDeadLetter(contactId: string, n: number, label: string, reason: string, fx: Effects) {\n fx.journal(contactId, \"dead_letter\", `${label} failed ${n}x — stopped trying: ${reason.slice(0, 60)}`);\n fx.log(`${contactId}: DEAD LETTER after ${n} failures — status done_send_failed, no further attempts`);\n // A contact that TRIED AND FAILED earns a task; an unreachable contact does not (see defect 3).\n if (fx.task) await fx.task(contactId, DEAD_LETTER_TITLE, deadLetterBody(label, n, reason)).catch(() => {});\n}\n\n/**\n * The catch on the send path. Before this existed the catch wrote NOTHING to state, which is the\n * whole spin: dueAt unchanged, identical decision next tick, forever, uncapped.\n * Returns true when this failure dead-lettered the contact.\n */\nexport async function onSendFailure(\n contactId: string, s: any, err: unknown, label: string, fx: Effects,\n): Promise {\n const reason = String((err as any)?.message ?? err).slice(0, 150);\n const { next, n, dead } = nextFailureState(s, new Date().toISOString(), reason);\n fx.state[contactId] = next;\n // Persisted immediately, exactly like the success path: a mid-run crash must not lose the count\n // either, or the ceiling never arrives.\n await fx.save(fx.state).catch(() => {});\n fx.log(`${contactId}: SEND FAILED ${label} (attempt ${n} of ${maxSendFailures()}): ${reason.slice(0, 100)}`);\n fx.journal(contactId, \"send_failed\", `${label}: ${reason.slice(0, 80)}`);\n if (dead) await announceDeadLetter(contactId, n, label, reason, fx);\n return dead;\n}\n\nexport const DELIVERY_FAILED_STATUSES = new Set([\"undelivered\", \"failed\", \"rejected\", \"bounced\", \"error\"]);\nexport const isDeliveryFailure = (st: unknown): boolean =>\n DELIVERY_FAILED_STATUSES.has(String(st ?? \"\").toLowerCase());\n\n/**\n * A delivery status read back on a LATER pass. GHL returning 2xx to our POST means \"queued\", not\n * \"delivered\" — 7.3% of live outbound SMS in this account are `undelivered` and every one of them\n * was being counted as a success.\n *\n * Returns null when there was nothing to reconcile. `stop` is true only for a real delivery failure,\n * which feeds the same counter as a send failure; the caller skips the rest of the pass so the\n * backoff applies before anything else is attempted.\n *\n * IDEMPOTENT: lastMessageId is cleared either way, so a given message is reconciled at most once and\n * a repeated pass cannot count the same failure twice.\n */\nexport async function onDeliveryStatus(\n contactId: string, s: any, status: string | null | undefined, fx: Effects,\n): Promise<{ s: any; stop: boolean } | null> {\n if (!status) return null;\n const st = String(status).toLowerCase();\n if (!isDeliveryFailure(st)) {\n const next = { ...s, lastDeliveryStatus: st, lastMessageId: null };\n fx.state[contactId] = next;\n // Visibly unknown, not quietly fine. Journalled so the count is on the dashboard rather than\n // being something only a person reading the blob would ever discover.\n if (st === \"unknown\") fx.journal(contactId, \"delivery_unknown\", \"delivery status could not be read for the last message\");\n return { s: next, stop: false };\n }\n const { next, n, dead } = nextFailureState(s, new Date().toISOString(), `delivery reported ${st}`);\n next.lastDeliveryStatus = st;\n fx.state[contactId] = next;\n await fx.save(fx.state).catch(() => {});\n fx.log(`${contactId}: last message came back ${st} (attempt ${n} of ${maxSendFailures()})`);\n fx.journal(contactId, \"delivery_failed\", `${st} (attempt ${n} of ${maxSendFailures()})`);\n if (dead) await announceDeadLetter(contactId, n, `the last message (${st})`, `delivery reported ${st}`, fx);\n return { s: next, stop: true };\n}\n\n/** What a successful send leaves on state: the receipt to reconcile against, and a RESET COUNTER.\n * The reset matters because applyDecision spreads `...s` — a stale count left standing would\n * dead-letter a healthy contact on an unrelated blip weeks later. */\nexport function sendReceipt(resp: any, channel: \"sms\" | \"email\"): FailureFields {\n const id = channel === \"email\"\n ? (resp?.emailMessageId ?? resp?.messageId ?? null)\n : (resp?.messageId ?? resp?.messageIds?.[0] ?? null);\n return {\n sendFailures: 0, lastFailureAt: null, lastFailureReason: null,\n lastMessageId: id != null ? String(id) : null,\n lastMessageChannel: channel,\n lastDeliveryStatus: null,\n };\n}\n\n// ---- opt-out words --------------------------------------------------------------------------------\n\n/**\n * TWO RULES, BOTH DELIBERATELY NARROW: a WHOLE BODY that is nothing but an opt-out word, and a short\n * list of phrases that cannot mean anything else. Everything else is left to a human via pause_reply.\n *\n * [was: /^\\s*(unsubscribe|stop|remove|opt[\\s-]?out)\\b/i — anchored at the start of the RAW body. Email\n * is the channel every footer makes the promise on (\"Reply UNSUBSCRIBE\"), and it is the channel that\n * rule could not read: an email reply arrives as `
UNSUBSCRIBE
`, as `
unsubscribe\n *
`, as `> unsubscribe`, as `\"STOP\"`, or under an `On 14 Aug, Kim wrote:` line — none of which\n * START with the word. It also missed every natural phrasing (\"please unsubscribe me\", \"take me off\n * this list\", \"no more texts please\") while MATCHING five sentences that mean the opposite (\"Remove\n * the 3pm and put us at 4\", \"Stop, I already booked!\", \"Opt out of the Tuesday session only\").\n * A prefix rule is not a narrow rule; it is a rule that reads one word and guesses the rest.]\n *\n * WHY NOT \"cancel\", still. Removed 14 Aug and kept out: for a business whose funnel is booked calls,\n * \"cancel my Pup Talk\" is a booking change from a hot lead. One live inbound in the 669 real bodies\n * checked reads \"My apologies but could you cancel my subscription?\" — which in an account that sells\n * training packages could as easily be the package as the texts. It is not silently dropped: an\n * inbound reply still pauses the sequence and puts a task in front of a person. A wrong opt-out is\n * irreversible in both directions at once — the lead is hard-exited AND a permanent email block is\n * written that silences Kim's own confirmations to them.\n *\n * TESTED AGAINST REAL DATA, not invented data: all 2,889 message bodies in the 99 live conversations\n * (669 of them inbound with a body). Matches exactly the 5 genuine opt-outs the old rule found, and\n * nothing else — including zero matches on the 2,220 outbound bodies, which is the guard that matters\n * for the SMS-reaction shape (`Loved \"…Reply STOP to stop these texts.\"` is an INBOUND message that\n * quotes our own footer back at us). Every phrase below is first-person on purpose: our own footers\n * say \"take YOU off these emails\" and \"Reply STOP\", so no footer can ever match itself.\n */\nconst OPT_OUT_TARGET =\n \"(?:e ?mails?|texts?|texting|messages?|msgs?|sms|mail(?:ing|ings)?|lists?|marketing|communications?|newsletters?|notifications?|spam)\";\n\n/** Body -> comparable core: HTML stripped, quoted-reply and signature chrome dropped, punctuation and\n * emoji reduced to spaces, politeness trimmed off both ends. Exported because it is the half of this\n * rule most likely to be wrong on a shape nobody has seen yet, and a test can only pin what it can see. */\nexport function optOutCore(body: unknown): string {\n let s = String(body ?? \"\");\n if (!s.trim()) return \"\";\n // Entities are decoded BEFORE the tags are stripped as well as after: a double-encoded body\n // (`<p>unsubscribe</p>`, which is what a form-posted reply can arrive as) would\n // otherwise survive tag-stripping as the literal text \"p unsubscribe p\" and match nothing.\n const entities = (x: string) => x.replace(/ /gi, \" \").replace(/"|"/gi, '\"')\n .replace(/'|'/gi, \"'\").replace(/</gi, \"<\").replace(/>/gi, \">\").replace(/&/gi, \"&\");\n s = entities(s);\n s = s.replace(/<(script|style)[\\s\\S]*?<\\/\\1>/gi, \" \");\n s = s.replace(//gi, \"\\n\").replace(/<\\/(p|div|blockquote|tr|li|h[1-6])\\s*>/gi, \"\\n\");\n s = s.replace(/<[^>]*>/g, \" \");\n s = entities(s);\n const kept: string[] = [];\n for (const raw of s.split(/\\r?\\n/)) {\n const line = raw.trim();\n if (/^>+/.test(line)) continue; // quoted line\n if (/^on\\b.{0,120}\\bwrote:?$/i.test(line)) continue; // \"On 14 Aug, Kim wrote:\"\n if (/^(from|sent|to|subject|date|cc|reply-to):/i.test(line)) continue;\n if (/^[-_]{2,}\\s*(original|forwarded)\\b/i.test(line)) continue;\n if (/^sent from my\\b/i.test(line)) continue; // phone signature\n if (/^get outlook for\\b/i.test(line)) continue;\n kept.push(line);\n }\n // A body that is ENTIRELY quoted (\"> unsubscribe\") must not strip to nothing: de-quote instead.\n let text = kept.join(\" \").trim();\n if (!text) text = s.replace(/^[ \\t]*>+[ \\t]?/gm, \" \");\n let core = text.toLowerCase().replace(/[^a-z0-9]+/g, \" \").replace(/\\s+/g, \" \").trim();\n for (let i = 0; i < 2; i++) {\n core = core.replace(/^(?:please|pls|plz|kindly|hi|hello|hey|yes|ok|okay)\\s+/, \"\")\n .replace(/\\s+(?:please|pls|plz|thanks|thank you|thx|asap|now|immediately|ty)$/, \"\");\n }\n return core;\n}\n\n/** The whole body says this and nothing else. \"Stop, I already booked!\" is not in here, and cannot be. */\nexport const WHOLE_BODY_OPT_OUT = new Set([\n \"unsubscribe\", \"unsubscribed\", \"unsub\", \"unsubscribe me\", \"unsubscribe me from this list\",\n \"stop\", \"stop all\", \"stopall\", \"stop it\", \"stop messages\", \"stop texts\", \"stop emails\",\n \"remove\", \"remove me\", \"removed\", \"delete me\", \"take me off\", \"take me off the list\",\n \"opt out\", \"optout\", \"opt me out\", \"opted out\",\n]);\n\n/** Phrases that cannot be a booking change. Each one names the PERSON as the thing being removed and\n * the CHANNEL they are being removed from — \"remove me from this list\", never \"remove the 3pm\". */\nexport const OPT_OUT_PHRASES: RegExp[] = [\n /\\bunsubscribe me\\b/,\n new RegExp(`\\\\bunsubscribe (?:me )?from (?:this|these|your|the|all|future|any)[a-z ]{0,20}?${OPT_OUT_TARGET}\\\\b`),\n new RegExp(`\\\\b(?:remove|delete|take) me (?:from|off) (?:this|these|your|the|all|any|ur)?[a-z ]{0,14}?${OPT_OUT_TARGET}\\\\b`),\n new RegExp(`\\\\bno more ${OPT_OUT_TARGET}\\\\b`),\n /\\bstop (?:texting|emailing|e mailing|messaging|contacting|calling|mailing) me\\b/,\n new RegExp(`\\\\bstop sending me[a-z ]{0,14}?${OPT_OUT_TARGET}\\\\b`),\n /\\b(?:do not|dont|do nt|never) (?:text|email|e mail|message|contact|call) me\\b/,\n new RegExp(`\\\\bopt (?:me )?out of (?:this|these|your|the|all|future|any)[a-z ]{0,14}?${OPT_OUT_TARGET}\\\\b`),\n];\n\nexport function isOptOutBody(body: unknown): boolean {\n const core = optOutCore(body);\n if (!core) return false;\n if (WHOLE_BODY_OPT_OUT.has(core)) return true;\n return OPT_OUT_PHRASES.some((re) => re.test(core));\n}\n\n/**\n * WHICH CHANNEL DID THEY ACTUALLY ASK ABOUT? (v1.13, 16 Aug 2026.)\n *\n * Kim's question, verbatim: \"does a stop word mean text and email only, or does going quiet in a\n * Facebook Messenger conversation also shut someone out permanently\". The first half has a real\n * answer and this is it. \"stop emailing me\" and \"STOP\" are not the same request, and today the\n * engine cannot tell them apart: both hard-exit the contact from every channel and both write a\n * permanent Email block. So somebody who asked only for fewer emails is silently lost as a lead.\n *\n * THIS CLASSIFIES. IT DOES NOT YET NARROW ANYTHING. Nothing downstream acts on the answer except a\n * journal row and a task in front of a person — deliberately, because narrowing an opt-out trades a\n * compliance risk for a marketing gain in KIM'S business, and that is her call and not this file's.\n * What it buys today is the evidence to make that call: how often anyone on this account actually\n * names one channel, measured rather than guessed.\n *\n * IT FAILS TO \"all\", ALWAYS. Every uncertain case — no channel named, both named, a blanket word\n * present, an unrecognised shape — returns \"all\", which is exactly today's behaviour. The only way\n * to get a narrow answer is for the body to name one channel family and NOTHING that could mean\n * everything. Being wrong in the \"all\" direction costs a lead; being wrong the other way keeps\n * messaging somebody who asked us to stop, which is the one this account cannot afford.\n */\nconst EMAIL_WORDS = /\\b(?:e ?mails?|e ?mailing|mail|mailings?|newsletters?|inbox)\\b/;\nconst SMS_WORDS = /\\b(?:texts?|texting|sms|msgs?)\\b/;\n// Anything that could mean \"everything\". `messages` is here on purpose: it is the word a person\n// reaches for when they mean all of it, and it is the word our own SMS footer uses.\nconst BLANKET_WORDS =\n /\\b(?:all|everything|anything|any|messages?|messaging|communications?|marketing|notifications?|spam|lists?|contact|contacting|call|calls|calling)\\b/;\n\nexport type OptOutScope = \"all\" | \"email\" | \"sms\";\n\nexport function optOutScope(body: unknown): OptOutScope {\n const core = optOutCore(body);\n if (!core) return \"all\";\n if (BLANKET_WORDS.test(core)) return \"all\";\n const email = EMAIL_WORDS.test(core);\n const sms = SMS_WORDS.test(core);\n if (email && !sms) return \"email\";\n if (sms && !email) return \"sms\";\n return \"all\";\n}\n\n/** GHL has returned message pages under three shapes across versions; accept all, invent none. */\nfunction pickMessages(r: any): any[] {\n const m = r?.messages?.messages ?? r?.messages ?? r?.message ?? [];\n return Array.isArray(m) ? m : [];\n}\n\nexport type ReplyStatus = {\n hasUnansweredInboundReply: boolean;\n conversationCheckFailed: boolean;\n lastOutboundAt: number | null;\n optOutRequested?: boolean;\n optOutScope?: OptOutScope; // v1.13 — which channel they named, if any. See optOutScope().\n deliveryStatus?: string | null;\n};\n\n/**\n * The one extra read, hung off the conversation getReplyStatus already fetched — the R27 trick, so\n * the collision guard and the opt-out check and the delivery check share one search call rather than\n * three. The message-body read is a second call, but only when there is actually something to read:\n * an inbound message to inspect, or one of our own sends old enough to have a settled status.\n *\n * FAILS TO SILENCE, NEVER TO \"SEND ANYWAY\". A failed read returns optOutRequested:false, so the\n * caller keeps today's behaviour (pause_reply on an inbound), and deliveryStatus:\"unknown\", which is\n * recorded as unknown rather than as success.\n */\nexport async function convoExtras(\n convo: any,\n st: (FailureFields & { lastSentAt?: string | null }) | undefined | null,\n fetchJson: (url: string, ver: string, init?: any) => Promise,\n base: string,\n nowMs: number,\n): Promise<{ optOutRequested: boolean; optOutScope: OptOutScope; deliveryStatus: string | null }> {\n const res = { optOutRequested: false, optOutScope: \"all\" as OptOutScope, deliveryStatus: null as string | null };\n const convoId = convo?.id ?? convo?.conversationId ?? null;\n const dir = convo?.lastMessageDirection ?? convo?.direction ?? null;\n const wantOptOut = dir === \"inbound\" && !!convoId;\n const msgId = st?.lastMessageId ?? null;\n const sentAt = st?.lastSentAt ? Date.parse(st.lastSentAt) : NaN;\n const wantDelivery = !!msgId && (!Number.isFinite(sentAt) || nowMs - sentAt >= RECONCILE_MIN_AGE_MS);\n if (!wantOptOut && !wantDelivery) return res;\n\n // One page, shared. An SMS reconciliation and an opt-out check on the same thread are one call.\n let page: any[] | null = null;\n let pageTried = false;\n const loadPage = async (): Promise => {\n if (pageTried) return page ?? [];\n pageTried = true;\n if (!convoId) return [];\n try { page = pickMessages(await fetchJson(`${base}/conversations/${convoId}/messages?limit=20`, \"2021-04-15\")); }\n catch { page = null; }\n return page ?? [];\n };\n\n if (wantDelivery) {\n if (st?.lastMessageChannel === \"email\") {\n // Email status is not on the conversation endpoint at all; it has its own.\n try {\n const r = await fetchJson(`${base}/conversations/messages/email/${msgId}`, \"2021-04-15\");\n const v = r?.emailMessage?.status ?? r?.status ?? null;\n res.deliveryStatus = v ? String(v).toLowerCase() : \"unknown\";\n } catch { res.deliveryStatus = \"unknown\"; }\n } else {\n const mine = (await loadPage()).find((m) => m?.id === msgId);\n const v = mine?.status ?? null;\n res.deliveryStatus = v ? String(v).toLowerCase() : \"unknown\";\n }\n }\n\n if (wantOptOut) {\n const msgs = await loadPage();\n if (!pageTried || page === null) {\n res.optOutRequested = false; // unreadable — the caller falls back to pause_reply\n } else {\n // AN UNKNOWN DIRECTION IS NOT THE CUSTOMER SPEAKING.\n // [was: String(m?.direction ?? \"inbound\") — an absent direction defaulted to inbound, i.e. to\n // \"the customer said this\", which is the one direction this file's own discipline forbids\n // defaulting to (see the header on convoExtras: FAILS TO SILENCE, NEVER TO \"SEND ANYWAY\").\n // 46 messages in the 99 live conversations sampled on 14 Aug carry direction:null; every one\n // is TYPE_EMAIL and every one is plainly ours (\"Congratulations on Your Dog's Bootcamp\n // Graduation\", \"We look forward to speaking with you tomorrow\"). Our own email footer reads\n // \"Reply UNSUBSCRIBE and we'll take you off these emails\" — so the default was pointing the\n // opt-out scanner at our own copy. Unreadable direction now means the message is not scanned,\n // the caller still sees the inbound reply, and the contact is paused for a human instead.]\n const inbound = msgs.find((m) => String(m?.direction ?? \"\").toLowerCase() === \"inbound\") ?? null;\n const inboundBody = inbound ? (inbound.body ?? inbound.message ?? \"\") : \"\";\n res.optOutRequested = !!inbound && isOptOutBody(inboundBody);\n // Classified from the SAME body that triggered the opt-out, never from a later one.\n if (res.optOutRequested) res.optOutScope = optOutScope(inboundBody);\n }\n }\n return res;\n}\n\n/**\n * Honour an opt-out in the client's live CRM by setting dndSettings.Email.status = \"permanent\" —\n * the exact field consent.ts:29 already reads, so the block is enforced everywhere for free with no\n * change to consent.ts. Nothing in this codebase has ever WRITTEN that field (zero `Email:\n * permanent` across 1,200 live contacts), which is why \"Reply UNSUBSCRIBE\" in every email footer\n * has been a promise the system could not keep.\n *\n * This is a write to a real customer record, so: TEST_MODE never writes, and it is idempotent twice\n * over — it is skipped entirely when Email is already blocking, and the PUT sets a fixed value\n * rather than toggling one. SMS is deliberately not written: GHL/Twilio already honour STOP natively\n * on the SMS channel and set permanent themselves.\n */\nexport async function honourOptOut(\n contactId: string,\n f: { optOutRequested?: boolean; channelBlocked?: { email: boolean; sms: boolean } },\n testMode: boolean,\n fetchJson: (url: string, ver: string, init?: any) => Promise,\n base: string,\n fx?: Effects,\n): Promise {\n const say = (m: string, failed = false) => {\n fx?.log(`${contactId}: ${m}`);\n if (failed) fx?.journal(contactId, \"optout_write_failed\", m);\n return m;\n };\n if (!f.optOutRequested) return null;\n if (testMode) return say(\"opt-out detected — practice mode, no DND written to GHL\");\n if (f.channelBlocked?.email) return say(\"opt-out detected — Email DND already set, nothing written\");\n try {\n await fetchJson(`${base}/contacts/${contactId}`, \"2021-07-28\", {\n method: \"PUT\",\n body: JSON.stringify({ dndSettings: { Email: { status: \"permanent\", message: DND_WRITE_MESSAGE } } }),\n });\n return say(\"opt-out honoured — Email DND set to permanent in GHL\");\n } catch (e) {\n // The hard exit stands either way: this engine stops messaging them regardless of whether GHL\n // took the write. Loud, because everything ELSE that reads that field is now out of step.\n return say(`OPT-OUT DND WRITE FAILED (${String(e).slice(0, 80)}) — hard exit stands, GHL NOT updated`, true);\n }\n}\n\n/**\n * THEY NAMED ONE CHANNEL — record it, and put a person on it. (v1.13, 16 Aug 2026.)\n *\n * The hard exit above is deliberately unchanged and still blanket: somebody who typed anything from\n * the opt-out list comes out of everything. Narrowing that trades a compliance risk for a marketing\n * gain in Kim's business, and that is her decision to make, not this engine's.\n *\n * What this closes is that today the difference is INVISIBLE. \"STOP\" and \"stop emailing me\" produce\n * byte-identical outcomes and byte-identical journal rows, so nobody can even ask how often it\n * happens. After this there is a row per occurrence — which is the evidence that decision needs —\n * and a task, so a lead who only wanted fewer emails is looked at by a human rather than quietly\n * written off. The task is best-effort: a failed task never holds up an exit that has already been\n * decided, and in practice mode no task is created at all.\n *\n * It lives here rather than inline in cron() for main.ts's character budget, which is the same\n * reason the rest of this file exists.\n */\nexport async function noteScopedOptOut(\n contactId: string,\n f: { optOutScope?: OptOutScope; contact?: { firstName?: string | null } },\n testMode: boolean,\n fx: Effects | undefined,\n createTask: ((contactId: string, title: string, body: string) => Promise) | null,\n): Promise<\"all\" | OptOutScope> {\n const scope = f.optOutScope ?? \"all\";\n if (scope === \"all\") return \"all\";\n const named = scope === \"email\" ? \"emails\" : \"texts\";\n fx?.journal(contactId, \"optout_scope\", `asked us to stop ${named} — exited from everything, task raised`);\n if (testMode || !createTask) return scope;\n try {\n await createTask(\n contactId,\n `${f.contact?.firstName || \"A contact\"} asked to stop ${named}, not everything`,\n `They replied asking us to stop ${named}. The follow-up has taken them out of everything, which is ` +\n `the safe reading but may be more than they asked for. Worth a look before this lead is written off.`,\n );\n } catch { /* the exit stands either way; a task is not a gate */ }\n return scope;\n}\n\n// ---- summary counts -------------------------------------------------------------------------------\n\n/** The counts buildSummary never had: send_failed was journalled and then counted by nothing, so a\n * permanently failing contact showed up nowhere at all. */\nexport function failureCounts(\n journal: { event: string; detail: string }[],\n byStatus: Record,\n): { sendFailures: number; deadLettered: number; unreachable: number; deliveryFailed: number; deliveryUnknown: number } {\n let sendFailures = 0, deadLettered = 0, deliveryFailed = 0, deliveryUnknown = 0;\n // STANDING COUNT, from state, not a running total from the journal: a contact refused at\n // enrolment now gets a done_unreachable state entry (that is what stops the refusal repeating),\n // so counting the enroll_refused rows here as well would count every one of them twice.\n const unreachable = byStatus?.done_unreachable ?? 0;\n for (const r of journal ?? []) {\n if (r.event === \"send_failed\") sendFailures++;\n else if (r.event === \"dead_letter\") deadLettered++;\n else if (r.event === \"delivery_failed\") deliveryFailed++;\n else if (r.event === \"delivery_unknown\") deliveryUnknown++;\n }\n return { sendFailures, deadLettered, unreachable, deliveryFailed, deliveryUnknown };\n}\n",[313],"bc56c2ce-7ef9-4dab-9b08-eef1b9270ea8","puppy-messages.ts","cd4b87b0-8c34-11f1-b87e-1607ee4eb77e",1142,["D",1786907763775],6,"// PUPPY PATH — message copy module (split from the engine for val.town's 80k/file limit).\n// Copy is VERBATIM from PHASE1-PUPPY-PATH-WRITING-SHEET.md §3 — do not paraphrase here, ever.\ndeclare const Deno: { env: { get(key: string): string | undefined } };\nif (typeof (globalThis as any).Deno === \"undefined\") {\n (globalThis as any).Deno = { env: { get: (k: string) => (globalThis as any).process?.env?.[k] } };\n}\n\n// ---- v1.3 change, 2 Aug 2026 — booking URL. RETRACTION APPENDED, read the whole block ----------\n// The previous value was:\n// https://api.leadconnectorhq.com/widget/bookings/pbe-discovery-9edbddc3-4b5a-406e-9bc3-7f10cb0d3221\n//\n// WHAT I ORIGINALLY WROTE HERE (and it was wrong): that this id \"does NOT belong to this location\"\n// and was the parent agency's own discovery-call widget.\n//\n// RETRACTED, same day, on better evidence. Re-checking GET /calendars/?locationId=BQHJ19uohldYe3eqA0bl\n// field by field shows `pbe-discovery-9edbddc3-4b5a-406e-9bc3-7f10cb0d3221` is the *widget slug of\n// Kim's own \"Pup Talk Phone Call\" calendar* — the same calendar as qHuYJ0NEqzibnoqf5Cw3. Confirmed\n// independently: https://book.thedogsspotga.com/phone (the page the website's own \"Book your Free\n// Pup Talk\" button leads to) contains BOTH strings. /widget/bookings/ and\n// /widget/booking/ are two URL forms for one object; both return 200 and both land on\n// her calendar. The original link was never broken. I inferred \"not hers\" from the \"pbe\" prefix —\n// which is Pet Biz Experts, the agency that set the account up and therefore named the slug — and\n// stated the inference as a verified finding. That is the error, and it is the kind that matters\n// more than the code change.\n//\n// The current value is kept anyway, for one real reason that survives the retraction: the engine\n// watches PUP_TALK_CALENDAR_ID (qHuYJ0NEqzibnoqf5Cw3) to detect a booking, so using the calendar-id\n// form makes the link a lead clicks and the object the engine watches literally the same string,\n// with no slug indirection to go stale. Secondary: the word \"discovery\" does not appear in it, and\n// Kim asked for \"Pup Talk\" instead.\n//\n// Regression test A1 asserts `!includes(\"pbe-\")`. That assertion is now a style rule, not a\n// correctness rule. Left in place; the comment above is the correction of record.\nexport const REAL_BOOKING_URL =\n \"https://api.leadconnectorhq.com/widget/booking/qHuYJ0NEqzibnoqf5Cw3\";\nexport const SHORT_BOOKING_LINK = Deno.env.get(\"SHORT_BOOKING_LINK\") || REAL_BOOKING_URL;\n\n// Phone number: two live candidates, and the earlier note here (\"zero signals point to 912-823-4382\")\n// is CORRECTED as of 2 Aug 2026. Signals for 912-823-4382 turned out to be strong: it is the meeting\n// location on 73 of 193 Pup Talk appointments, it is the number in the default confirmation text of\n// BOTH booking widgets (\"please call our office at (912) 823-4382\"), and thedogsspotga.com/about-5\n// tells customers to ring it to schedule a training drop-off.\n// Still using 912-348-8726, on a narrower and now-honest basis: it is the number in the website\n// footer on every page and behind the home page \"Call Us\" button, so it is the number a lead who\n// found the site already has. Both are real. Kim must pick one before go-live — flagged on the todo\n// list, not decided quietly.\nexport const PHONE_DISPLAY = Deno.env.get(\"PHONE_DISPLAY\") || \"912-348-8726\";\n\nexport type Channel = \"email\" | \"sms\";\n\nexport type MessageTemplate = {\n id: string;\n channel: Channel;\n offsetHours: number;\n subject?: string; // email only\n previewText?: string; // email only\n bodyTemplate: string;\n // v1.13 (16 Aug) — THE BODY TO USE WHEN THIS CONTACT CANNOT RECEIVE EMAIL. Set it on any SMS\n // whose copy promises or refers to an email; the validator in paths.ts now REQUIRES one there.\n //\n // Why it exists. Email steps skip themselves when a contact has no email address, and a skipped\n // step is consumed rather than deferred, so the sequence walks straight on. That is correct for\n // the engine and wrong for the customer: main-1 (email, +0h) silently skips, and two hours later\n // main-2 (sms) arrives saying \"I'll send a few honest, useful puppy emails over the next few\n // weeks\" — to somebody the engine has ALREADY decided will never get one. The first thing they\n // ever hear from Kim is a promise the system has privately cancelled.\n //\n // It covers the email opt-out case too, not just a blank address field: someone who has said no\n // to email gets no emails either, so the promise is equally untrue to them.\n bodyIfNoEmail?: string;\n};\n\n// ---- message copy (PHASE1-PUPPY-PATH-WRITING-SHEET.md §3, VERBATIM — do not paraphrase) ----------\n// {{FIRST_NAME}} is the ONLY per-contact merge token, resolved at render time by\n// v2.0, 4 Aug 2026. {{DOG_NAME}} was removed from every message in this file and in the taper,\n// on Kim's instruction: \"we haven't always got the name and so if we have a placeholder for the\n// puppies name, it reads weird when there's no puppy in there so I think we should go with having\n// the person's name, but not necessarily the puppies name\". Facebook leads, which are four in\n// five of all inquiries, frequently arrive with no dog name at all. Every sentence that used it\n// was REWRITTEN to read naturally without one, rather than having \"your puppy\" substituted in\n// mechanically, because the mechanical version is exactly what she was objecting to.\n// Also on her instruction, same message: toilet -> potty, garden -> yard, and DAYCARE REMOVED\n// ENTIRELY. They do not offer daycare. That is the same class of error as describing grooming as\n// a service, and it had been sitting in four messages.\n// The old comment, for the record:\n// applyMergeFields(). [phone] / [link] are fixed placeholders per the writing sheet's own §1\n// distinction (Title Case = merge field, lower case = placeholder) — resolved ONCE below via real\n// template-literal interpolation of PHONE_DISPLAY / SHORT_BOOKING_LINK, not per contact.\n// **bold** markdown in messages 3/5/6 is rendered to by bodyToHtml() — that is a formatting\n// transform, not a wording change; the words themselves are untouched.\n//\n// v2.1, 6/7 Aug 2026 — five more of her own corrections (handover/REGISTER-AUG7.md §4), confirmed\n// back to her in writing 7 Aug (handover/MESSAGE-TO-KIM-7-AUG.txt, lines 80-83): main-2 no longer\n// opens \"Got your message\" (opens on the welcome instead); \"pitch\" is gone everywhere a Pup Talk is\n// described, in favour of saying what it IS; branch_a-2 and branch_b-1 lose the \"I won't chase\n// you\"/\"won't keep bugging you\" what-I-won't-do framing while the positive \"reach out\"/\"call or\n// text ... anytime\"/\"door's open\" lines next to them are kept, exactly as she asked; branch_b-2's\n// British \"getting on\" becomes \"going\". Tests: tests/kim-copy.test.mjs, section \"THE 6 AUG\n// FOLLOW-UP\".\n\nexport const MAIN_SEQUENCE: MessageTemplate[] = [\n {\n id: \"main-1\",\n channel: \"email\",\n offsetHours: 0,\n subject: \"Getting your puppy off to a good start\",\n previewText: \"A few things that matter more than people expect in these first weeks.\",\n bodyTemplate: `Hi {{FIRST_NAME}},\n\nThanks for getting in touch.\n\nWhether you're bringing a puppy home soon, or yours is already running circles around the kitchen, the timing of what happens next matters more than people expect.\n\nA puppy's window for learning that new people, new dogs, new places and new sounds are all safe starts closing earlier than most owners realize - a lot of that learning is done by around four to five months old. Whatever they meet calmly now tends to stay easy for life. Whatever gets missed is harder to fix later. Not impossible, just harder, and it usually takes longer than it would have the first time round.\n\nOver the next few weeks I'll send you a handful of short, practical emails - biting, potty training, recall, that sort of thing. Real advice, not fluff.\n\nIf you'd rather just talk it through now, that's what a Pup Talk is for - a real conversation with our team about how things are going. Reply to this email, call or text us on ${PHONE_DISPLAY}, or grab a time here: ${SHORT_BOOKING_LINK}.\n\nKim\nThe Dogs Spot`,\n },\n {\n id: \"main-2\",\n channel: \"sms\",\n offsetHours: 2,\n // v2.1, 6/7 Aug — \"Touch 2 loses 'I got your message' and opens on the welcome.\" Kim's own\n // question about the old line: \"What message am I replying to exactly?\" (REGISTER-AUG7.md §4).\n // This can be the first thing a contact hears from her at all, so \"got your message\" did not\n // always make sense; \"welcome\" carries the same warmth without assuming a reply is owed.\n bodyTemplate: `Hi {{FIRST_NAME}}, it's Kim at The Dogs Spot. Welcome! I'll send a few honest, useful puppy emails over the next few weeks. Reply anytime, a real person reads these.`,\n // v1.13 — for contacts with no email address, or who have opted out of email. They get main-4\n // and main-7 by text and nothing else, so \"a few over the next few weeks\" is still true; only\n // the word \"emails\" was ever the lie. Everything else about the message is deliberately\n // identical, including the welcome Kim rewrote it around on 7 Aug.\n bodyIfNoEmail: `Hi {{FIRST_NAME}}, it's Kim at The Dogs Spot. Welcome! I'll send a few honest, useful puppy tips by text over the next few weeks. Reply anytime, a real person reads these.`,\n },\n {\n id: \"main-3\",\n channel: \"email\",\n offsetHours: 72, // day 3\n subject: \"Puppy biting: normal, not naughty\",\n previewText: \"What's actually going on when a puppy won't stop mouthing, and what helps.\",\n bodyTemplate: `Hi {{FIRST_NAME}},\n\nIf your puppy has started biting at hands, sleeves, ankles, shoelaces - that's not a behavior problem. It's normal. Puppies explore the world with their mouths the way toddlers explore it with their hands, and it usually gets worse before it gets better, especially once teething starts.\n\nA few things that actually help:\n\n**Redirect, don't just say no.** Keep a toy or a chew within arm's reach of wherever you usually sit, so it's already in your hand before the mouthing starts rather than after. The moment teeth touch skin, swap your hand for the toy. Saying \"no\" tells them to stop; it doesn't tell them what to do instead, and a puppy who is told to stop with nothing to switch to just tries again.\n\n**Watch for the overtired witching hour.** A lot of biting spikes happen when a puppy is overstimulated or short on sleep, not when they're being difficult. A nap often does more than any correction.\n\n**Yelp, don't wrestle.** If it hurts, a short \"ow\" and a pause in play teaches bite inhibition better than pulling your hand away, which can turn into a game.\n\nIt gets better. Most of this settles down significantly by six months, and properly once the adult teeth are in. It feels endless at week two. It isn't.\n\nIf any of that doesn't match what you're seeing, reply and tell me - I read these.\n\nKim\nThe Dogs Spot`,\n },\n {\n id: \"main-4\",\n channel: \"sms\",\n offsetHours: 144, // day 6\n bodyTemplate: `Hi {{FIRST_NAME}}, Kim here. Quick one - how's the biting and potty training going? Totally normal stage either way. Reply and let me know, happy to help.`,\n },\n {\n id: \"main-5\",\n channel: \"email\",\n offsetHours: 216, // day 9\n subject: \"A realistic potty-training timeline\",\n previewText: \"What actually helps, and why one accident isn't a setback.\",\n bodyTemplate: `Hi {{FIRST_NAME}},\n\nPotty training questions are the ones I get asked about most, usually some version of \"is this normal?\" Almost always, yes.\n\nA young puppy's bladder is small and their control over it is genuinely limited - not a matter of trying harder. As a rough guide, a lot of trainers use \"roughly one hour of control for every month of age\" early on, which is why an eight- or ten-week-old puppy needs to go out far more often than seems reasonable.\n\nWhat tends to work:\n\n**A schedule, not a hope.** Out first thing, after every meal, after every nap, after play, and last thing at night - before you think they need it, not after.\n\n**Same spot, same word.** Consistency does more work than any product. Pick a spot, use a calm word or phrase every time, and reward the second they finish outside, not back indoors where the reward disconnects from the act.\n\n**Supervise or contain.** Accidents mostly happen when a puppy has quiet, unsupervised access to another room. A crate, a pen, or simply keeping them in sight closes that gap.\n\n**No telling off for accidents.** By the time you've found it, they have moved on. Telling them off teaches confusion, not house manners.\n\nMost puppies are largely reliable by four to six months, and fully reliable somewhat later. If yours is well past that and still having accidents daily, that's worth looking at properly rather than pushing through - reply and tell me what's happening.\n\nKim\nThe Dogs Spot`,\n },\n {\n id: \"main-6\",\n channel: \"email\",\n offsetHours: 312, // day 13\n subject: \"Recall is a habit, not a hope\",\n previewText: `Why \"come\" is worth starting now, even before it matters.`,\n bodyTemplate: `Hi {{FIRST_NAME}},\n\nRecall - getting your puppy to come back reliably - is the one piece of training that keeps a dog safe for the rest of their life. It's also the easiest one to start too late.\n\nThe mistake most people make isn't training it wrong. It's not starting until it's needed - at the park, off lead, with distractions already in the way. By then you're teaching recall and competing for attention at the same time.\n\nStarted early, it's simple:\n\n**Practice where nothing's competing for attention.** Hallway, living room, yard. Say the word once, and make coming back to you the best thing that happens all day - food, praise, a game, whatever they actually want.\n\n**Never call for something unpleasant.** If \"come\" ever means bath time, nail clipping, or the end of a walk, it stops meaning \"good things happen.\" Go get them for that instead.\n\n**Reward every single time, at first.** Not just the good ones. Recall is a habit you're building, not a trick you're testing.\n\nRecall is the one people most often ask me to look at, usually because it worked in the yard and then stopped working everywhere else. If you'd like a hand with it, a Pup Talk is a free twenty-minute call: ${SHORT_BOOKING_LINK}, or call or text ${PHONE_DISPLAY}.\n\nKim\nThe Dogs Spot`,\n },\n {\n id: \"main-7\",\n channel: \"sms\",\n offsetHours: 408, // day 17\n bodyTemplate: `Hi {{FIRST_NAME}}, no pressure at all - if you'd like to talk through training or boarding for your puppy, we're easy to reach. Call or text ${PHONE_DISPLAY}, or book a time here: ${SHORT_BOOKING_LINK}. Kim, The Dogs Spot`,\n },\n {\n id: \"main-8\",\n channel: \"email\",\n offsetHours: 504, // day 21\n subject: \"The last puppy email from me for now\",\n previewText: \"What matters most from the last three weeks, and an open door.\",\n bodyTemplate: `Hi {{FIRST_NAME}},\n\nThis is the last of the every-few-days emails, so a quick summary of everything I've sent: get your puppy meeting the world calmly while that window's open, expect the biting and treat it as normal, keep the potty-training schedule boring and consistent, and start recall before you need it, not after.\n\nNone of that is complicated. Most of it is just easy to talk yourself out of doing consistently when you're tired and there's a puddle on the floor again.\n\nFrom here I'll slow right down - a short note each week for a few weeks, then less and less, only ever the useful kind. If you'd like to talk any of this through properly - what's normal for your puppy specifically, what training or boarding would actually suit your week, what it costs and when it makes sense to start - that's what a Pup Talk is for. It's a conversation. Reply here, call or text ${PHONE_DISPLAY}, or grab a time yourself: ${SHORT_BOOKING_LINK}.\n\nAnd if now just isn't the right time, that's completely fine too. No hard feelings, and the door doesn't close.\n\nKim\nThe Dogs Spot`,\n },\n];\n\nexport const BRANCH_A: MessageTemplate[] = [\n {\n id: \"branch_a-1\",\n channel: \"sms\",\n offsetHours: 2,\n bodyTemplate: `Hi {{FIRST_NAME}}, it's Kim - looks like we missed each other for your Pup Talk. No worries at all, it happens. Want me to find another time? Just reply and I'll schedule it.`,\n },\n {\n id: \"branch_a-2\",\n channel: \"email\",\n offsetHours: 24, // day +1\n subject: \"Let's find another time\",\n previewText: \"Fifteen minutes, whenever actually suits.\",\n bodyTemplate: `Hi {{FIRST_NAME}},\n\nI noticed we had a Pup Talk scheduled, but we missed each other. No worries at all, I know life gets busy.\n\nIt's a quick, no-pressure call where we'll talk about what's been going on, answer any questions you have, and see whether training with us would be a good fit. And if we're not the right fit, I'll tell you that too.\n\nJust reply with a couple of times that work for you, call or text me at ${PHONE_DISPLAY}, or book a time that's convenient here: ${SHORT_BOOKING_LINK}.\n\nIf I don't hear back, I'll assume now just isn't the right time. Whenever you're ready, just reach out, I'd be happy to help.\n\nKim\nThe Dogs Spot`,\n },\n];\n\nexport const BRANCH_B: MessageTemplate[] = [\n {\n id: \"branch_b-1\",\n channel: \"email\",\n offsetHours: 24, // day +1 after the call\n subject: \"Good talking with you\",\n previewText: \"Just a couple of things from our conversation.\",\n bodyTemplate: `Hi {{FIRST_NAME}},\n\nThanks for the call. It's genuinely useful for me to hear how things are going, even outside of anything you decide to book.\n\nIf it's not the right time for training or boarding with us, that's completely fine. A lot of people need more than one conversation before it's the right moment, and that's how it should work - nobody should sign up on a call because it felt awkward not to.\n\nIf anything changes, or a question comes up later that we didn't cover, reply here or call or text ${PHONE_DISPLAY} anytime. I'd just rather you knew the door's open than wonder.\n\nKim\nThe Dogs Spot`,\n },\n {\n id: \"branch_b-2\",\n channel: \"sms\",\n offsetHours: 192, // day +8 after the call\n bodyTemplate: `Hi {{FIRST_NAME}}, Kim again - no news needed, just checking how it's going for you both. If a question's come up since we spoke, reply here anytime. No pressure either way.`,\n },\n];\n\n",[320],"260e62e3-b5df-4a76-ba00-540b7954d5e9","puppy-detect.ts","299fd626-9089-11f1-805a-1607ee4eb77e",1161,["D",1786979132685],"// WHO IS A PUPPY INQUIRY. v1.0, 5 August 2026.\n//\n// WHY THIS FILE EXISTS. The engine enrolls people carrying the tag `nurture - puppy`. Nothing in\n// Kim's account applies that tag: all 5,544 contacts checked, zero carry it. So go-live is three\n// switches, not two, and this is the third.\n//\n// WHY IT IS NOT A ONE-LINE REGEX. The first thing I tried was matching \"puppy\" or an age in weeks\n// or months against the inquiry summary. Over the 800 most recent contacts it returned 29 people,\n// and reading them showed it was wrong about several in ways that matter:\n//\n// * \"Ken Anderson was looking to purchase a puppy. He inquired whether The Dog's Spot GA offered\n// puppies for sale. The agent clarified that they do not sell.\" He would have received\n// forty-one messages about training a puppy he does not own.\n// * \"Charlie, who is 3 years and 4 months old\" matched on \"4 months old\". The dog is three.\n// * \"Evelyn Carter was seeking good homes for her older dogs\" matched on the word \"new puppy\"\n// later in a sentence about rehoming.\n//\n// A false positive here is not a bad row in a spreadsheet. It is a real person getting nineteen\n// months of messages about a puppy they do not have, in Kim's name.\n//\n// SO THIS FILE NEVER APPLIES A TAG. It classifies, it explains itself in one sentence per person,\n// and it hands the list to a human. `confidence` is the whole point: \"clear\" is defensible on its\n// own, \"probable\" wants a glance, \"unclear\" is a question rather than an answer.\n//\n// It also reports its own blind spot, loudly: the inquiry summary is populated on about half of\n// contacts. Anyone with no summary cannot be classified by this at all, and saying so is part of\n// the output rather than a footnote.\n\nexport type Verdict = {\n contactId: string;\n name: string;\n confidence: \"clear\" | \"probable\" | \"unclear\" | \"no\";\n /** One sentence, in plain English, naming the words that decided it. */\n reason: string;\n /** Months, when a dog's age could be read. null when it could not. */\n ageMonths: number | null;\n matched: string[];\n};\n\nexport type DetectSummary = {\n scanned: number;\n withText: number;\n noText: number;\n clear: number;\n probable: number;\n unclear: number;\n no: number;\n};\n\nconst num = (s: string): number | null => {\n const words: Record = {\n one: 1, two: 2, three: 3, four: 4, five: 5, six: 6, seven: 7, eight: 8,\n nine: 9, ten: 10, eleven: 11, twelve: 12, eighteen: 18,\n };\n const t = s.trim().toLowerCase();\n if (/^\\d+(\\.\\d+)?$/.test(t)) return Number(t);\n return words[t] ?? null;\n};\n\n/**\n * The dog's age in months, or null.\n *\n * The \"3 years and 4 months old\" trap is handled by looking for a YEARS reading first and letting\n * it win. A dog described in years is not a puppy however many months are mentioned afterwards.\n */\nexport function ageInMonths(text: string): number | null {\n const t = text.toLowerCase();\n // YEARS FIRST, AND THEY WIN OUTRIGHT.\n // [was: the years pattern required the word \"old\" straight after it, as in \"3-year-old\". So\n // \"Charlie, who is 3 years and 4 months old\" did not match it — the \"old\" belongs to the\n // months — and fell through to the months branch, which read the dog as 4 months. That is\n // the exact false positive this whole file exists to prevent, and the first version of the\n // file still had it. Caught by its own test, not by reading it.]\n const y = t.match(/(\\d+(?:\\.\\d+)?|one|two|three|four|five|six|seven|eight|nine|ten|eleven|twelve)[\\s-]*(?:year|yr)s?\\b/);\n if (y) {\n const n = num(y[1]);\n if (n != null) {\n const m = t.slice(y.index ?? 0).match(/(?:year|yr)s?[\\s,-]*(?:and\\s*)?(\\d+|one|two|three|four|five|six|seven|eight|nine|ten|eleven)[\\s-]*(?:month|mo)s?\\b/);\n return n * 12 + (m ? (num(m[1]) ?? 0) : 0);\n }\n }\n const mo = t.match(/(\\d+(?:\\.\\d+)?|one|two|three|four|five|six|seven|eight|nine|ten|eleven|twelve|eighteen)(?:\\s*-\\s*\\d+)?[\\s-]*(?:month|mo)s?[\\s-]*old/);\n if (mo) { const n = num(mo[1]); if (n != null) return n; }\n const wk = t.match(/(\\d+(?:\\.\\d+)?|one|two|three|four|five|six|seven|eight|nine|ten|eleven|twelve)(?:\\s*-\\s*\\d+)?[\\s-]*(?:week|wk)s?[\\s-]*old/);\n if (wk) { const n = num(wk[1]); if (n != null) return Math.round((n / 4.345) * 10) / 10; }\n return null;\n}\n\n// Reasons someone is NOT a puppy-training inquiry even though the word appears. Each one is here\n// because a real contact in Kim's account tripped it.\nconst DISQUALIFIERS: Array<[RegExp, string]> = [\n [/\\b(purchase|buy|buying|sell|selling|for sale|breeder|adopt(?:ing)? a)\\b[^.]{0,40}\\bpupp/i,\n \"they were asking to buy a puppy, not to train one\"],\n [/\\bpupp\\w*\\b[^.]{0,40}\\b(for sale|to sell|available to buy)\\b/i,\n \"they were asking to buy a puppy, not to train one\"],\n [/\\b(rehome|rehoming|good homes|find(?:ing)? homes|surrender|give away)\\b/i,\n \"they were rehoming dogs rather than asking about training\"],\n [/\\b(do not sell|don't sell|does not sell|doesn't sell)\\b/i,\n \"the reply on file says Kim does not sell dogs, so this was not a training inquiry\"],\n];\n\nconst PUPPY_WORDS = /\\b(pupp(?:y|ies)|new pup\\b|pup\\b)/i;\n// Kim's puppy sequence is written for a young dog. Past about a year it is the wrong sequence.\nconst PUPPY_MAX_MONTHS = 12;\n\n/** Age in the words a person would use. Nobody says a dog is 1.4 months old. */\nexport function sayAge(months: number): string {\n if (months < 2) { const w = Math.round(months * 4.345); return `${w} week${w === 1 ? \"\" : \"s\"} old`; }\n if (months < 24) { const m = Math.round(months); return `${m} month${m === 1 ? \"\" : \"s\"} old`; }\n const y = Math.round(months / 12);\n return `${y} year${y === 1 ? \"\" : \"s\"} old`;\n}\n\nexport function classify(contactId: string, name: string, text: string): Verdict {\n const clean = (text ?? \"\").replace(/\\s+/g, \" \").trim();\n if (!clean) {\n return { contactId, name, confidence: \"unclear\", ageMonths: null, matched: [],\n reason: \"There is nothing written down about what they asked for, so this cannot be decided from the record.\" };\n }\n\n for (const [re, why] of DISQUALIFIERS) {\n const m = clean.match(re);\n if (m) return { contactId, name, confidence: \"no\", ageMonths: ageInMonths(clean), matched: [m[0].slice(0, 60)], reason: `Not a puppy inquiry: ${why}.` };\n }\n\n const age = ageInMonths(clean);\n const saysPuppy = PUPPY_WORDS.test(clean);\n const matched: string[] = [];\n if (saysPuppy) matched.push((clean.match(PUPPY_WORDS) ?? [\"\"])[0]);\n if (age != null) matched.push(`${age} months old`);\n\n if (age != null && age > PUPPY_MAX_MONTHS) {\n return { contactId, name, confidence: \"no\", ageMonths: age, matched,\n reason: `Not a puppy inquiry: the dog is given as ${sayAge(age)}, which is past the sequence.` };\n }\n if (age != null && saysPuppy) {\n return { contactId, name, confidence: \"clear\", ageMonths: age, matched,\n reason: `Called a puppy and given as ${sayAge(age)}, so both signals agree.` };\n }\n // A very young age settles it on its own. No adult dog is four months old, so the word \"puppy\"\n // adds nothing at this end and demanding it would push obvious cases down to \"probable\".\n if (age != null && age <= 6) {\n return { contactId, name, confidence: \"clear\", ageMonths: age, matched,\n reason: `The dog is given as ${sayAge(age)}, which is a puppy whatever words they used.` };\n }\n if (age != null) {\n return { contactId, name, confidence: \"probable\", ageMonths: age, matched,\n reason: `The dog is given as ${sayAge(age)}, which is inside the sequence, but the word puppy is not used.` };\n }\n if (saysPuppy) {\n return { contactId, name, confidence: \"probable\", ageMonths: null, matched,\n reason: \"They call it a puppy, but no age is written down, so how young is a guess.\" };\n }\n return { contactId, name, confidence: \"no\", ageMonths: null, matched: [],\n reason: \"Nothing in what they wrote points at a puppy.\" };\n}\n\nexport function summarise(vs: Verdict[], scanned: number): DetectSummary {\n const by = (c: Verdict[\"confidence\"]) => vs.filter((v) => v.confidence === c).length;\n const noText = vs.filter((v) => v.matched.length === 0 && v.confidence === \"unclear\").length;\n return { scanned, withText: scanned - noText, noText, clear: by(\"clear\"), probable: by(\"probable\"),\n unclear: by(\"unclear\"), no: by(\"no\") };\n}\n\n/**\n * How old is this reading, in words, or null when it is fresh enough not to mention.\n *\n * A dry pass that stopped running would otherwise keep showing its last numbers as though they\n * were this morning's. The engine runs about hourly, so anything past six hours has missed\n * several turns and is worth saying out loud.\n */\nexport function scanAgeNote(atIso: string | null | undefined, nowMs: number): string | null {\n if (!atIso) return null;\n const ms = nowMs - Date.parse(atIso);\n if (!Number.isFinite(ms) || ms < 0) return null;\n const hours = ms / 3_600_000;\n if (hours < 6) return null;\n if (hours < 48) return `This count was last taken about ${Math.round(hours)} hours ago rather than just now, so treat it as a little out of date.`;\n return `This count was last taken about ${Math.round(hours / 24)} days ago, so it has stopped being kept up and the numbers below are old.`;\n}\n\n/** The sentence for the summary, generated from the counts, never written alongside them. */\nexport function detectSentence(s: DetectSummary | null): string {\n if (!s || !s.scanned) return \"No contacts were read, so there is nothing to report here rather than a zero to trust.\";\n const parts = [\n `${s.scanned.toLocaleString(\"en-US\")} contacts were read. ${s.clear} are clearly a puppy inquiry and ${s.probable} probably are.`,\n ];\n if (s.noText) {\n parts.push(`${s.noText} of them have nothing written down about what they asked for, so they cannot be judged from the record at all, either way.`);\n }\n parts.push(\"Nothing has been tagged. This is a list to look at, not an action taken.\");\n return parts.join(\" \");\n}\n\n// ---------------------------------------------------------------------------------------------\n// THE DRY PASS.\n//\n// This file has NO WAY TO APPLY A TAG and that is structural, not a promise: there is no fetch, no\n// POST and no client in it. Everything here takes contacts in and hands verdicts out. The engine\n// calls it on each run, writes the counts down, and applies nothing. When the tagging is finally\n// armed it will be armed somewhere a human had to go and change, not here.\n//\n// The custom-field ids are Kim's account's. `inquiryText` is deliberately forgiving about the\n// shape of a contact, because it is fed straight from the CRM's JSON.\n// ---------------------------------------------------------------------------------------------\nexport const FIELD_INQUIRY_SUMMARY = \"N8Mw4Mmz5ecesIOrQMWm\";\nexport const FIELD_TRAINING_GOAL = \"4EXdybS2XUAaP6tnlncI\";\n\nexport function inquiryText(contact: unknown): string {\n const cfs = (contact as any)?.customFields;\n if (!Array.isArray(cfs)) return \"\";\n const pick = (id: string) => {\n const f = cfs.find((x: any) => x?.id === id);\n const v = f?.value;\n return typeof v === \"string\" || typeof v === \"number\" ? String(v) : \"\";\n };\n return `${pick(FIELD_INQUIRY_SUMMARY)} ${pick(FIELD_TRAINING_GOAL)}`.trim();\n}\n\nexport function classifyContacts(contacts: unknown): Verdict[] {\n if (!Array.isArray(contacts)) return [];\n const grouped = new Map();\n for (const c of contacts) {\n if (!c || typeof c.id !== \"string\" || !c.id) continue;\n grouped.set(c.id, [...(grouped.get(c.id) ?? []), c]);\n }\n return [...grouped.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([id, rows]) => {\n // A paginated retry can return the same contact twice. Combining every distinct text is safer\n // and deterministic; choosing \"the first\" would make the verdict depend on page order.\n const text = [...new Set(rows.map(inquiryText).filter(Boolean))].sort().join(\" \");\n const names = rows.map((c) => String(c.contactName ?? c.firstName ?? \"\")).filter(Boolean).sort();\n return classify(id, names[0] || \"(no name)\", text);\n });\n}\n\nexport type DryScan = {\n at: string;\n summary: DetectSummary;\n /** Ids only, and only the ones worth a human's time. Never names, never message text. */\n clearIds: string[];\n probableIds: string[];\n /** Repeated API rows, ids only. They are classified once and can never inflate enrolment proof. */\n duplicateIds: string[];\n /** Always false in this file. Present so the panel can state it rather than assume it. */\n applied: false;\n};\n\nexport function dryScan(contacts: unknown, at: string): DryScan {\n const vs = classifyContacts(contacts);\n const ids = Array.isArray(contacts)\n ? contacts.filter((c: any) => c && typeof c.id === \"string\").map((c: any) => c.id)\n : [];\n const duplicateIds = [...new Set(ids.filter((id, i) => ids.indexOf(id) !== i))].sort();\n return {\n at,\n summary: summarise(vs, vs.length),\n clearIds: vs.filter((v) => v.confidence === \"clear\").map((v) => v.contactId),\n probableIds: vs.filter((v) => v.confidence === \"probable\").map((v) => v.contactId),\n duplicateIds,\n applied: false,\n };\n}\n",[328],"85533423-5609-458f-8a44-a75db1f3aed1","planner.ts","17430958-9a4d-11f1-912b-1607ee4eb77e",1175,["D",1786982810810],"// MULTI-PATH PLANNER — pure, deterministic and structurally dry-run only.\n//\n// This module cannot send, tag, create tasks or write blob state. It proves who *would* enter a path\n// while enforcing the safety invariants a future dispatcher must preserve: one contact in at most one\n// path, one isolated state/lock key per path, all current/terminal state treated as ownership, channel\n// DND and missing-address guards, and deterministic idempotency keys.\n\nimport {\n ALL_PATH_DEFINITIONS,\n APPROVED_PATHS,\n validateRegistry,\n} from \"./paths.ts\";\nimport type { PathDef, Step } from \"./paths.ts\";\nimport { channelBlockReason } from \"./consent.ts\";\nimport { enrolmentBar, NO_EMAIL_REASON, NO_PHONE_REASON } from \"./reachability.ts\";\n\nexport type PlannerContact = {\n id: string;\n firstName?: string | null;\n lastName?: string | null;\n email?: string | null;\n phone?: string | null;\n dnd?: boolean;\n dndSettings?: unknown;\n tags?: string[];\n};\n\n/** Maps each PathDef.stateKey to that path's contact-state map. State values are intentionally\n * opaque: key membership alone owns the contact, including terminal state. */\nexport type IsolatedPathState = Record | null | undefined>;\n\nexport type PlanRow = {\n contactId: string;\n name: string;\n path: string;\n stateKey: string;\n lockKey: string;\n enrollmentKey: string;\n firstSendKey: string;\n firstStep: { id: string; channel: \"email\" | \"sms\"; offsetHours: number };\n skippedBeforeFirst: { id: string; reason: string }[];\n dryRun: true;\n sendAllowed: false;\n};\n\nexport type ExcludedRow = { contactId: string; name: string; path?: string; why: string };\n\nexport type PlanProof = {\n dryRun: true;\n writes: 0;\n sends: 0;\n planned: number;\n excluded: number;\n duplicatePlannedContactIds: string[];\n stateKeys: string[];\n lockKeys: string[];\n registryValid: boolean;\n registryErrors: string[];\n overlapFree: boolean;\n};\n\nexport type PlanResult = { planned: PlanRow[]; excluded: ExcludedRow[]; proof: PlanProof };\n\nconst nameOf = (c: PlannerContact) =>\n [c.firstName, c.lastName].filter(Boolean).join(\" \") || \"(no name)\";\nconst present = (v: unknown) => typeof v === \"string\" ? v.trim().length > 0 : !!v;\nconst tagsOf = (c: PlannerContact) => Array.isArray(c.tags) ? c.tags.filter((t): t is string => typeof t === \"string\") : [];\nconst byContact = (a: T, b: T) => a.contactId.localeCompare(b.contactId);\n\nfunction duplicateContactIds(contacts: PlannerContact[]): Set {\n const seen = new Set(), dupes = new Set();\n for (const c of contacts) {\n if (!c?.id) continue;\n if (seen.has(c.id)) dupes.add(c.id);\n seen.add(c.id);\n }\n return dupes;\n}\n\nfunction duplicateName(contacts: PlannerContact[], id: string): string {\n return contacts.filter((c) => c?.id === id).map(nameOf).sort()[0] || \"(no name)\";\n}\n\nexport function sourcePathMatches(c: PlannerContact, paths: readonly PathDef[] = ALL_PATH_DEFINITIONS): PathDef[] {\n const tags = tagsOf(c);\n return paths.filter((p) => !!p.sourceTag && tags.includes(p.sourceTag));\n}\n\nexport function enrolledPathMatches(c: PlannerContact, paths: readonly PathDef[] = ALL_PATH_DEFINITIONS): PathDef[] {\n const tags = tagsOf(c);\n return paths.filter((p) => tags.includes(p.enrolledTag));\n}\n\nexport function statePathOwners(\n contactId: string,\n state: IsolatedPathState,\n paths: readonly PathDef[] = ALL_PATH_DEFINITIONS,\n): PathDef[] {\n return paths.filter((p) => {\n const map = state?.[p.stateKey];\n return !!map && typeof map === \"object\" && Object.prototype.hasOwnProperty.call(map, contactId);\n });\n}\n\n/** Earliest deliverable step, sorted by time then source order. A missing or opted-out channel is\n * skipped in the proof rather than making a reachable contact disappear. */\nexport function firstReachableStep(\n c: PlannerContact,\n path: PathDef,\n): { step: Step | null; skipped: { id: string; reason: string }[] } {\n const skipped: { id: string; reason: string }[] = [];\n const ordered = path.steps\n .map((step, index) => ({ step, index }))\n .sort((a, b) => a.step.offsetHours - b.step.offsetHours || a.index - b.index);\n\n for (const { step } of ordered) {\n let reason: string | null = null;\n if (!path.channelsAtLaunch.includes(step.channel)) reason = `${step.channel} is disabled for this path`;\n else if (step.channel === \"email\" && !present(c.email)) reason = NO_EMAIL_REASON;\n else if (step.channel === \"sms\" && !present(c.phone)) reason = NO_PHONE_REASON;\n else reason = channelBlockReason(c, step.channel);\n if (reason) { skipped.push({ id: step.id, reason }); continue; }\n return { step, skipped };\n }\n return { step: null, skipped };\n}\n\nfunction proofFor(planned: PlanRow[], excluded: ExcludedRow[], registryErrors: string[]): PlanProof {\n const ids = planned.map((p) => p.contactId);\n const dupes = [...new Set(ids.filter((id, i) => ids.indexOf(id) !== i))].sort();\n const stateKeys = [...new Set(planned.map((p) => p.stateKey))].sort();\n const lockKeys = [...new Set(planned.map((p) => p.lockKey))].sort();\n return {\n dryRun: true, writes: 0, sends: 0, planned: planned.length, excluded: excluded.length,\n duplicatePlannedContactIds: dupes, stateKeys, lockKeys,\n registryValid: registryErrors.length === 0,\n registryErrors: [...registryErrors],\n overlapFree: dupes.length === 0 && registryErrors.length === 0,\n };\n}\n\nfunction evaluate(\n c: PlannerContact,\n state: IsolatedPathState,\n path: PathDef,\n universe: readonly PathDef[],\n): PlanRow | ExcludedRow {\n const name = nameOf(c);\n const out = (why: string): ExcludedRow => ({ contactId: c.id, name, path: path.key, why });\n if (!c.id) return out(\"contact id is missing\");\n if (!path.steps.length) return out(\"path has no steps registered\");\n if (!path.sourceTag) return out(\"path entry trigger is unresolved; no executable source tag exists\");\n if (!tagsOf(c).includes(path.sourceTag)) return out(`does not carry \"${path.sourceTag}\"`);\n\n const sources = sourcePathMatches(c, universe);\n if (sources.length > 1) return out(`overlap: carries source tags for ${sources.map((p) => p.key).sort().join(\", \")}`);\n\n const stateOwners = statePathOwners(c.id, state, universe);\n if (stateOwners.length > 1) return out(`invalid state overlap: present in ${stateOwners.map((p) => p.stateKey).sort().join(\", \")}`);\n if (stateOwners.length === 1) {\n const owner = stateOwners[0];\n return out(owner.key === path.key\n ? `already has isolated state in ${owner.stateKey}; enrollment is idempotent`\n : `already owned by ${owner.key} state ${owner.stateKey}; planning would double-send`);\n }\n\n const enrolled = enrolledPathMatches(c, universe);\n if (enrolled.length) return out(`already carries enrolled tag(s): ${enrolled.map((p) => p.enrolledTag).sort().join(\", \")}`);\n if (c.dnd === true) return out(\"blanket Do Not Disturb is on\");\n if (enrolmentBar(c)) return out(enrolmentBar(c)!);\n\n const first = firstReachableStep(c, path);\n if (!first.step) {\n const reasons = [...new Set(first.skipped.map((s) => s.reason))];\n return out(`no deliverable step on an allowed channel: ${reasons.join(\"; \") || \"no steps\"}`);\n }\n\n const enrollmentKey = `enrol:${path.key}:v${path.version}:${c.id}`;\n return {\n contactId: c.id,\n name,\n path: path.key,\n stateKey: path.stateKey,\n lockKey: path.lockKey,\n enrollmentKey,\n firstSendKey: `send:${path.key}:v${path.version}:${c.id}:${first.step.id}`,\n firstStep: { id: first.step.id, channel: first.step.channel, offsetHours: first.step.offsetHours },\n skippedBeforeFirst: first.skipped,\n dryRun: true,\n sendAllowed: false,\n };\n}\n\n/** Plan one path. The result order and idempotency keys are independent of input order. A duplicate\n * contact record is excluded rather than choosing whichever copy happened to arrive first. */\nexport function planForPath(\n contacts: PlannerContact[],\n state: IsolatedPathState,\n path: PathDef,\n universe: readonly PathDef[] = ALL_PATH_DEFINITIONS,\n): PlanResult {\n const planned: PlanRow[] = [], excluded: ExcludedRow[] = [];\n const registry = validateRegistry(APPROVED_PATHS, universe);\n const dupes = duplicateContactIds(contacts);\n const seenDuplicate = new Set();\n\n for (const c of [...contacts].sort((a, b) => String(a?.id ?? \"\").localeCompare(String(b?.id ?? \"\")))) {\n if (dupes.has(c.id)) {\n if (!seenDuplicate.has(c.id)) {\n excluded.push({ contactId: c.id, name: duplicateName(contacts, c.id), path: path.key, why: \"duplicate contact id in planner input; refused rather than choosing one record\" });\n seenDuplicate.add(c.id);\n }\n continue;\n }\n if (!registry.ok) {\n excluded.push({ contactId: c.id, name: nameOf(c), path: path.key, why: `path registry invalid: ${registry.errors.join(\"; \")}` });\n continue;\n }\n const row = evaluate(c, state, path, universe);\n if (\"firstStep\" in row) planned.push(row); else excluded.push(row);\n }\n planned.sort(byContact); excluded.sort(byContact);\n return { planned, excluded, proof: proofFor(planned, excluded, registry.errors) };\n}\n\n/** The only paths this module will portfolio-plan by default. They have written candidate copy but\n * remain `source: off`, `senderAuthority: none`; planning them does not approve them or wire them. */\nexport function plannablePaths(): PathDef[] {\n return ALL_PATH_DEFINITIONS.filter((p) => p.stage === \"dry-run-only\" && p.steps.length > 0 && !!p.sourceTag);\n}\n\n/** One decision per contact across every dry-run candidate. A contact matching zero or multiple\n * paths is one exclusion, never several partial plans. */\nexport function planPortfolio(\n contacts: PlannerContact[],\n state: IsolatedPathState,\n paths: readonly PathDef[] = plannablePaths(),\n universe: readonly PathDef[] = ALL_PATH_DEFINITIONS,\n): PlanResult {\n const planned: PlanRow[] = [], excluded: ExcludedRow[] = [];\n const registry = validateRegistry(APPROVED_PATHS, universe);\n const dupes = duplicateContactIds(contacts);\n const seenDuplicate = new Set();\n\n for (const c of [...contacts].sort((a, b) => String(a?.id ?? \"\").localeCompare(String(b?.id ?? \"\")))) {\n if (dupes.has(c.id)) {\n if (!seenDuplicate.has(c.id)) {\n excluded.push({ contactId: c.id, name: duplicateName(contacts, c.id), why: \"duplicate contact id in planner input; refused rather than choosing one record\" });\n seenDuplicate.add(c.id);\n }\n continue;\n }\n if (!registry.ok) {\n excluded.push({ contactId: c.id, name: nameOf(c), why: `path registry invalid: ${registry.errors.join(\"; \")}` });\n continue;\n }\n const allMatches = sourcePathMatches(c, universe);\n if (!allMatches.length) {\n excluded.push({ contactId: c.id, name: nameOf(c), why: \"does not carry exactly one recognised nurture source tag\" });\n continue;\n }\n if (allMatches.length > 1) {\n excluded.push({ contactId: c.id, name: nameOf(c), why: `overlap: carries source tags for ${allMatches.map((p) => p.key).sort().join(\", \")}` });\n continue;\n }\n const path = paths.find((p) => p.key === allMatches[0].key);\n if (!path) {\n excluded.push({ contactId: c.id, name: nameOf(c), why: `${allMatches[0].key} is not a dry-run-only candidate` });\n continue;\n }\n const row = evaluate(c, state, path, universe);\n if (\"firstStep\" in row) planned.push(row); else excluded.push(row);\n }\n\n planned.sort(byContact); excluded.sort(byContact);\n return { planned, excluded, proof: proofFor(planned, excluded, registry.errors) };\n}\n",[335],"07010f2c-1685-4e77-9e01-02926171f76c","payments-source.ts","e209084c-94ec-11f1-9ce5-1607ee4eb77e",1159,["D",1786979130738],"// SQUARE MONEY AS THE CRM RECORDS IT. Read-only, paged, duplicate-safe.\n// The payments endpoint rejects locationId and requires altId + altType=location.\n\nimport type { Payment } from \"./money-match.ts\";\n\nconst LOC = \"BQHJ19uohldYe3eqA0bl\";\nconst GHL = \"https://services.leadconnectorhq.com\";\nconst UA =\n \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\";\n\nexport const PAYMENT_PAGE_SIZE = 100;\nexport const PAYMENT_PAGE_CAP = 60;\nexport const MIN_REAL_PAYMENT = 1;\n\n// Proven live 10 Aug 2026 across all 233 transactions. Unknown types remain in the result and are\n// reported, because a new payment route must not disappear merely because the allow-list is old.\nexport const ACCEPTED_SOURCE_TYPES: readonly string[] = Object.freeze([\n \"calendar\", \"invoice\", \"funnel\", \"payment_link\", \"manual\",\n]);\nconst ACCEPTED = new Set(ACCEPTED_SOURCE_TYPES);\nconst BAD_TEXT = /[\\u0000-\\u001f\\u007f\\u202a-\\u202e\\u2066-\\u2069\\u200e\\u200f\\u061c]/;\n\nexport const isRealMoney = (p: { amount: number }) =>\n Number.isFinite(p?.amount) && p.amount >= MIN_REAL_PAYMENT;\n\nconst nullableText = (v: unknown, label: string, max: number): string | null => {\n if (v == null) return null;\n if (typeof v !== \"string\") throw new Error(`payment row has an invalid ${label}`);\n const text = v.trim();\n if (!text) return null;\n if (text.length > max || BAD_TEXT.test(text)) throw new Error(`payment row has an invalid ${label}`);\n return text;\n};\n\nconst sourceAmount = (v: unknown): number => {\n if (typeof v !== \"number\") throw new Error(\"payment row has an invalid amount\");\n const amount = v;\n if (!Number.isFinite(amount) || amount < 0 || amount > 1_000_000_000) throw new Error(\"payment row has an invalid amount\");\n return amount;\n};\n\n/** Validate and normalize one source record. Invalid money is an error, not a quiet $0 drop. */\nexport function toPayment(t: any): Payment {\n if (!t || typeof t !== \"object\" || Array.isArray(t)) throw new Error(\"payment row is not an object\");\n const id = nullableText(t._id, \"id\", 160);\n if (!id) throw new Error(\"payment row has no stable id\");\n const amount = sourceAmount(t.amount);\n if (typeof t.status !== \"string\") throw new Error(`payment ${id} has an invalid status`);\n const status = t.status.trim().toLowerCase();\n const atRaw = nullableText(t.createdAt, \"createdAt\", 80);\n if (!status || status.length > 80 || BAD_TEXT.test(status)) throw new Error(`payment ${id} has an invalid status`);\n if (atRaw != null && !Number.isFinite(Date.parse(atRaw))) throw new Error(`payment ${id} has an invalid createdAt`);\n return {\n id,\n amount,\n status,\n contactId: nullableText(t.contactId, \"contactId\", 160),\n contactName: nullableText(t.contactName, \"contactName\", 240),\n at: atRaw,\n };\n}\n\nexport type Accepted = {\n payments: Payment[];\n unknownTypes: string[];\n dropped: { zeroOrTest: number; notSucceeded: number; duplicate: number };\n};\n\n/**\n * Keep only completed, real money. Exact duplicate ids collapse; conflicting duplicate ids throw.\n * Every source row lands in payments or exactly one dropped counter.\n */\nexport function acceptPayments(rows: any[]): Accepted {\n if (!Array.isArray(rows)) throw new Error(\"payment rows are not an array\");\n const unknown = new Set();\n const kept: Payment[] = [];\n const seen = new Map();\n let zeroOrTest = 0, notSucceeded = 0, duplicate = 0;\n for (const t of rows) {\n const p = toPayment(t);\n const sourceType = nullableText(t?.entitySourceType, \"entitySourceType\", 80) ?? \"\";\n if (!ACCEPTED.has(sourceType)) unknown.add(sourceType);\n const signature = JSON.stringify({ p, sourceType });\n const prior = seen.get(p.id);\n if (prior !== undefined) {\n if (prior !== signature) throw new Error(`conflicting duplicate payment id: ${p.id}`);\n duplicate++;\n continue;\n }\n seen.set(p.id, signature);\n if (p.status !== \"succeeded\") { notSucceeded++; continue; }\n if (!isRealMoney(p)) { zeroOrTest++; continue; }\n kept.push(p);\n }\n return {\n payments: kept,\n unknownTypes: [...unknown].sort(),\n dropped: { zeroOrTest, notSucceeded, duplicate },\n };\n}\n\nexport type PaymentGetter = (url: string) => Promise;\nexport type PaymentSource = Accepted & {\n source: {\n endpoint: \"GoHighLevel /payments/transactions\";\n fetchedAt: string;\n totalCount: number;\n fetched: number;\n pages: number;\n complete: true;\n };\n};\n\n/** Injected getter keeps paging behavior testable without touching a live account. */\nexport async function fetchPayments(\n get: PaymentGetter,\n opts: { locationId?: string; pageSize?: number; pageCap?: number; now?: number } = {},\n): Promise {\n const locationId = opts.locationId ?? LOC;\n const pageSize = opts.pageSize ?? PAYMENT_PAGE_SIZE;\n const pageCap = opts.pageCap ?? PAYMENT_PAGE_CAP;\n const now = opts.now ?? Date.now();\n if (!locationId || !Number.isInteger(pageSize) || pageSize < 1 || pageSize > PAYMENT_PAGE_SIZE ||\n !Number.isInteger(pageCap) || pageCap < 1 || pageCap > 100 || !Number.isFinite(now)) {\n throw new Error(\"invalid payment source options\");\n }\n\n const rows: any[] = [];\n let totalCount: number | null = null;\n let pages = 0;\n for (let offset = 0; pages < pageCap; offset += pageSize) {\n const q = new URLSearchParams({\n altId: locationId,\n altType: \"location\",\n limit: String(pageSize),\n offset: String(offset),\n });\n const body = await get(`${GHL}/payments/transactions?${q}`) as any;\n if (!body || !Array.isArray(body.data)) throw new Error(`payment page ${pages + 1} has no data array`);\n const reported = Number(body.totalCount);\n if (!Number.isInteger(reported) || reported < 0) throw new Error(`payment page ${pages + 1} has no valid totalCount`);\n if (totalCount === null) totalCount = reported;\n else if (reported !== totalCount) throw new Error(`payment totalCount changed during paging: ${totalCount} to ${reported}`);\n if (body.data.length > pageSize) throw new Error(`payment page ${pages + 1} exceeds its requested limit`);\n rows.push(...body.data);\n pages++;\n if (rows.length >= totalCount) break;\n if (body.data.length < pageSize) throw new Error(`payment source stopped at ${rows.length} of ${totalCount}`);\n }\n\n if (totalCount === null) throw new Error(\"payment source returned no pages\");\n if (rows.length !== totalCount) throw new Error(`payment source read ${rows.length} of ${totalCount} before its page cap`);\n for (const row of rows) {\n const payment = toPayment(row);\n if (payment.at && Date.parse(payment.at) > now + 5 * 60_000) {\n throw new Error(`payment ${payment.id} has a future createdAt`);\n }\n }\n const accepted = acceptPayments(rows);\n if (accepted.dropped.duplicate > 0) {\n throw new Error(`payment pagination repeated ${accepted.dropped.duplicate} transaction(s); completeness cannot be proven`);\n }\n return {\n ...accepted,\n source: {\n endpoint: \"GoHighLevel /payments/transactions\",\n fetchedAt: new Date(now).toISOString(),\n totalCount,\n fetched: rows.length,\n pages,\n complete: true,\n },\n };\n}\n\n/** Production GET transport. It cannot issue a mutating request. */\nexport function ghlPaymentGetter(token: string): PaymentGetter {\n if (!token) throw new Error(\"GHL_TOKEN is required\");\n return async (url: string) => {\n const target = new URL(url, GHL);\n if (target.origin !== GHL || target.pathname !== \"/payments/transactions\") {\n throw new Error(\"refusing a payment URL outside the documented CRM endpoint\");\n }\n const r = await fetch(target.toString(), {\n method: \"GET\",\n headers: { Authorization: `Bearer ${token}`, Version: \"2021-07-28\", \"User-Agent\": UA, Accept: \"application/json\" },\n signal: AbortSignal.timeout(20_000),\n });\n if (!r.ok) throw new Error(`payments source returned ${r.status}`);\n return r.json();\n };\n}\n\nexport const fetchPaymentsFromGhl = (token: string, opts: Parameters[1] = {}) =>\n fetchPayments(ghlPaymentGetter(token), opts);\n",[342],"552be8a9-319a-4622-b363-9541a3deb088","paths.ts","243d2a8e-8e78-11f1-bbbc-1607ee4eb77e",1174,["D",1786982809256],"// NURTURE PATH REGISTRY — contract paths, candidate definitions, and safety validation.\n//\n// There are two different sixes in the project history. The client-approved set was:\n// booked Free Training Day, boarding request, puppy owners, existing-client upsells, gone quiet,\n// and post-purchase. A later writing pass substituted behaviour, no-show, didn't-buy and aged for\n// four of those. That substitution was never conclusively disclosed/approved. The old registry put\n// the substituted six under one authoritative `PATHS` name, which made a definition look like scope.\n//\n// `PATHS` below is now the approved set only. Later ideas remain visible under `CANDIDATE_PATHS`,\n// with no sender authority. No customer copy was changed to make that distinction.\n\ndeclare const Deno: { env: { get(key: string): string | undefined } };\nif (typeof (globalThis as any).Deno === \"undefined\") {\n (globalThis as any).Deno = { env: { get: (k: string) => (globalThis as any).process?.env?.[k] } };\n}\n\nimport { MAIN_SEQUENCE, BRANCH_A, BRANCH_B } from \"./puppy-messages.ts\";\nimport { BOARDING_STEPS } from \"./boarding-messages.ts\";\nimport { NOSHOW_STEPS } from \"./noshow-messages.ts\";\nimport { DIDNTBUY_STEPS } from \"./didntbuy-messages.ts\";\nimport { registryKeyDiff } from \"./registry-diff.ts\";\n\n// ---- auth -----------------------------------------------------------------------------------------\n\nasync function sha256Hex(s: string): Promise {\n const b = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(s));\n return [...new Uint8Array(b)].map((x) => x.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nasync function authorised(k: string): Promise {\n const configured = Deno.env.get(\"NURTURE_ADMIN_KEY_SHA256\");\n if (!k || !configured || !/^[0-9a-f]{64}$/i.test(configured)) return false;\n const expected = configured.toLowerCase();\n const got = await sha256Hex(k);\n if (got.length !== expected.length) return false;\n let d = 0;\n for (let i = 0; i < got.length; i++) d |= got.charCodeAt(i) ^ expected.charCodeAt(i);\n return d === 0;\n}\n\n// ---- types ----------------------------------------------------------------------------------------\n\nconst OWNED_BOOKING_ID = \"qHuYJ0NEqzibnoqf5Cw3\";\nconst OWNED_BOARDING_FORM = \"thedogsspotga.com/boarding-booking-form\";\n\nexport type Step = {\n id: string;\n channel: \"email\" | \"sms\";\n offsetHours: number;\n subject?: string;\n previewText?: string;\n bodyTemplate: string;\n bodyIfNoEmail?: string;\n};\n\nexport type PathApproval = \"approved\" | \"candidate\";\nexport type PathStage = \"sending\" | \"dry-run-only\" | \"disabled\";\nexport type SenderAuthority = \"puppy-engine-v1\" | \"ghl\" | \"none\";\nexport type CopyStatus = \"approved-source\" | \"written-unapproved\" | \"missing\";\nexport type OverlapAudit = \"clear\" | \"published-found\" | \"unverified\";\nexport type EntryRule =\n | { kind: \"tag\"; tag: string; verified: boolean }\n | { kind: \"unresolved\"; description: string };\n\nexport type PathDef = {\n key: string;\n label: string;\n approval: PathApproval;\n stage: PathStage;\n senderAuthority: SenderAuthority;\n source: \"engine\" | \"ghl\" | \"off\";\n sourceTag: string | null;\n enrolledTag: string;\n entryRule: EntryRule;\n stateKey: string;\n lockKey: string;\n version: number;\n channelsAtLaunch: (\"email\" | \"sms\")[];\n copyStatus: CopyStatus;\n steps: Step[];\n notes: string;\n overlapAudit: OverlapAudit;\n ghlOverlap: { name: string; status: \"published\" | \"draft\"; version: number | null }[];\n};\n\nexport const ONLY_SENDER_AUTHORITY: SenderAuthority = \"puppy-engine-v1\";\n\nexport const PROMISED_PATH_KEYS = [\n \"free_training_day\",\n \"boarding\",\n \"puppy\",\n \"existing_client\",\n \"gone_quiet\",\n \"post_purchase\",\n] as const;\n\n// Kept as evidence of the mismatch the old registry encoded. It is not an executable registry.\nexport const LEGACY_SUBSTITUTED_PATH_KEYS = [\n \"puppy\", \"behavior\", \"boarding\", \"noshow\", \"didntbuy\", \"aged\",\n] as const;\n\n// ---- the approved six -----------------------------------------------------------------------------\n\nexport const APPROVED_PATHS: PathDef[] = [\n {\n key: \"free_training_day\",\n label: \"Booked Free Training Day\",\n approval: \"approved\",\n stage: \"disabled\",\n senderAuthority: \"none\",\n source: \"off\",\n sourceTag: null,\n enrolledTag: \"free-training-day-path-v1\",\n entryRule: { kind: \"unresolved\", description: \"Booked Free Training Day trigger has not been reconciled to one verified event or tag.\" },\n stateKey: \"nurture_state_free_training_day_v1\",\n lockKey: \"nurture_lock_free_training_day_v1\",\n version: 1,\n channelsAtLaunch: [\"email\", \"sms\"],\n copyStatus: \"missing\",\n steps: [],\n notes: \"Promised path. Trigger, approved copy, exits and overlap clearance remain unresolved; therefore disabled.\",\n overlapAudit: \"published-found\",\n ghlOverlap: [\n { name: \"Free Training Day small yes booked day\", status: \"published\", version: null },\n { name: \"Free training day no show nurture\", status: \"draft\", version: 9 },\n { name: \"Cxld/Canceled Free Training Day\", status: \"published\", version: 4 },\n { name: \"Free Training Day abandoned booking\", status: \"published\", version: 8 },\n ],\n },\n {\n key: \"boarding\",\n label: \"Boarding request\",\n approval: \"approved\",\n stage: \"dry-run-only\",\n senderAuthority: \"none\",\n source: \"off\",\n sourceTag: \"interest:boarding\",\n enrolledTag: \"boarding-path-v1\",\n entryRule: { kind: \"tag\", tag: \"interest:boarding\", verified: false },\n stateKey: \"nurture_state_boarding_v1\",\n lockKey: \"nurture_lock_boarding_v1\",\n version: 1,\n channelsAtLaunch: [\"email\", \"sms\"],\n copyStatus: \"written-unapproved\",\n steps: BOARDING_STEPS,\n notes: \"Promised path. The lost 31 July draft was recovered and repaired on 17 August. Copy is test-covered but remains unapproved and senderless; the trigger and six published overlaps still require live clearance.\",\n overlapAudit: \"published-found\",\n ghlOverlap: [\n { name: \"Boarding Drop-Off - Confirmation + Reminder\", status: \"published\", version: 19 },\n { name: \"Boarding Pick-Up - Confirmation + Reminder\", status: \"published\", version: 25 },\n { name: \"Abandoned Cart - Partial booking\", status: \"published\", version: 5 },\n { name: \"Cancel Boarding - Drop Off\", status: \"published\", version: 3 },\n { name: \"Online Boarding Update > Kennel\", status: \"published\", version: 4 },\n { name: \"Boarding App Webhook\", status: \"published\", version: 18 },\n ],\n },\n {\n key: \"puppy\",\n label: \"Puppy owners\",\n approval: \"approved\",\n stage: \"sending\",\n senderAuthority: ONLY_SENDER_AUTHORITY,\n source: \"engine\",\n sourceTag: \"nurture - puppy\",\n enrolledTag: \"puppy-path-v1\",\n entryRule: { kind: \"tag\", tag: \"nurture - puppy\", verified: true },\n // These names are the blobs the real sender reads today. Future paths get different keys.\n stateKey: \"puppy_state\",\n lockKey: \"puppy_run_lock\",\n version: 1,\n channelsAtLaunch: [\"email\", \"sms\"],\n copyStatus: \"approved-source\",\n steps: [...MAIN_SEQUENCE, ...BRANCH_A, ...BRANCH_B] as Step[],\n notes: \"The only path the current hourly engine actually sends. Registry presence is not send wiring.\",\n overlapAudit: \"published-found\",\n ghlOverlap: [\n // Live API re-check 17 Aug 2026: cutover completed; this exact legacy workflow is now draft v3.\n { name: \"1. Wait 1 Day: Initial Nurture - Puppy\", status: \"draft\", version: 3 },\n { name: \"1. Wait 1 Day: Initial Nurture\", status: \"published\", version: 2 },\n { name: \"Edited - Main New Nurture (New/Updated)\", status: \"published\", version: 4 },\n { name: \"Secondary Nurture Workflow\", status: \"published\", version: 4 },\n { name: \"A. Removed Tag : Initial Lead Nurtures\", status: \"published\", version: 2 },\n { name: \"Secondary Nurture - PUPPY Workflow\", status: \"draft\", version: 5 },\n { name: \"1. Initial Nurture - Facebook\", status: \"draft\", version: 3 },\n { name: \"1. Initial Nurture - Instagram\", status: \"draft\", version: 3 },\n ],\n },\n {\n key: \"existing_client\",\n label: \"Existing-client upsells\",\n approval: \"approved\",\n stage: \"disabled\",\n senderAuthority: \"none\",\n source: \"off\",\n sourceTag: null,\n enrolledTag: \"existing-client-path-v1\",\n entryRule: { kind: \"unresolved\", description: \"Eligible existing-client segment and exclusions have not been approved as a deterministic trigger.\" },\n stateKey: \"nurture_state_existing_client_v1\",\n lockKey: \"nurture_lock_existing_client_v1\",\n version: 1,\n channelsAtLaunch: [\"email\", \"sms\"],\n copyStatus: \"missing\",\n steps: [],\n notes: \"Promised path. No approved engine copy, trigger or overlap audit; disabled.\",\n overlapAudit: \"unverified\",\n ghlOverlap: [],\n },\n {\n key: \"gone_quiet\",\n label: \"Gone quiet\",\n approval: \"approved\",\n stage: \"disabled\",\n senderAuthority: \"none\",\n source: \"off\",\n sourceTag: null,\n enrolledTag: \"gone-quiet-path-v1\",\n entryRule: { kind: \"unresolved\", description: \"Gone-quiet duration, reply window and source population have not been approved as one trigger.\" },\n stateKey: \"nurture_state_gone_quiet_v1\",\n lockKey: \"nurture_lock_gone_quiet_v1\",\n version: 1,\n channelsAtLaunch: [\"email\", \"sms\"],\n copyStatus: \"missing\",\n steps: [],\n notes: \"Promised path. Silence is not consent; entry and exits must be specified before copy or wiring.\",\n overlapAudit: \"unverified\",\n ghlOverlap: [],\n },\n {\n key: \"post_purchase\",\n label: \"Post-purchase\",\n approval: \"approved\",\n stage: \"disabled\",\n senderAuthority: \"none\",\n source: \"off\",\n sourceTag: null,\n enrolledTag: \"post-purchase-path-v1\",\n entryRule: { kind: \"unresolved\", description: \"Qualifying purchase event and customer exclusions have not been reconciled to one verified trigger.\" },\n stateKey: \"nurture_state_post_purchase_v1\",\n lockKey: \"nurture_lock_post_purchase_v1\",\n version: 1,\n channelsAtLaunch: [\"email\", \"sms\"],\n copyStatus: \"missing\",\n steps: [],\n notes: \"Promised path. No approved engine copy, trigger or overlap audit; disabled.\",\n overlapAudit: \"unverified\",\n ghlOverlap: [],\n },\n];\n\n// `PATHS` is retained as the public name existing tooling imports, but it now means exactly the\n// client-approved set. Written alternatives are not silently promoted into it.\nexport const PATHS = APPROVED_PATHS;\n\n// ---- later candidate substitutions ---------------------------------------------------------------\n\nexport const CANDIDATE_PATHS: PathDef[] = [\n {\n key: \"behavior\", label: \"Behavior problems\", approval: \"candidate\", stage: \"disabled\",\n senderAuthority: \"none\", source: \"off\", sourceTag: \"nurture - behavior\",\n enrolledTag: \"behavior-path-v1\", entryRule: { kind: \"tag\", tag: \"nurture - behavior\", verified: false },\n stateKey: \"nurture_state_behavior_v1\", lockKey: \"nurture_lock_behavior_v1\", version: 1,\n channelsAtLaunch: [\"email\", \"sms\"], copyStatus: \"missing\", steps: [],\n notes: \"Later substitution, not one of the promised six. Highest-risk aggression copy still needs Kim's personal approval.\",\n overlapAudit: \"published-found\",\n ghlOverlap: [\n { name: \"Behavior Quiz Submitted\", status: \"published\", version: 3 },\n { name: \"Dialed In Dog ZJ : Free Training Day Quiz\", status: \"published\", version: 16 },\n { name: \"Quiz -. Pup Talk > Notes\", status: \"published\", version: 4 },\n { name: \"Quiz Score Redirect Logic\", status: \"draft\", version: 6 },\n ],\n },\n {\n key: \"noshow\", label: \"Pup Talk, didn't show\", approval: \"candidate\", stage: \"dry-run-only\",\n senderAuthority: \"none\", source: \"off\", sourceTag: \"nurture - noshow\",\n enrolledTag: \"noshow-path-v1\", entryRule: { kind: \"tag\", tag: \"nurture - noshow\", verified: false },\n stateKey: \"nurture_state_noshow_v1\", lockKey: \"nurture_lock_noshow_v1\", version: 1,\n channelsAtLaunch: [\"email\", \"sms\"], copyStatus: \"written-unapproved\", steps: NOSHOW_STEPS,\n notes: \"Written candidate, not an approved-six path and not connected to a sender. Planner evidence only.\",\n overlapAudit: \"published-found\",\n ghlOverlap: [\n { name: \"Cxld/Canceled Pup Talk\", status: \"published\", version: 7 },\n { name: \"Cxld or No Show - Consult Nurture\", status: \"published\", version: 4 },\n { name: \"Free training day no show nurture\", status: \"draft\", version: 9 },\n { name: \"Cxld/Canceled Free Training Day\", status: \"published\", version: 4 },\n { name: \"Tag Added 'No Show' > No Show\", status: \"published\", version: 2 },\n { name: \"Tag Added 'No Show DND' > No Show TO PREVENT ANOTHER BOOKING\", status: \"published\", version: 2 },\n { name: \"Free Training Day abandoned booking\", status: \"published\", version: 8 },\n ],\n },\n {\n key: \"didntbuy\", label: \"Pup Talk, didn't buy\", approval: \"candidate\", stage: \"dry-run-only\",\n senderAuthority: \"none\", source: \"off\", sourceTag: \"nurture - didntbuy\",\n enrolledTag: \"didntbuy-path-v1\", entryRule: { kind: \"tag\", tag: \"nurture - didntbuy\", verified: false },\n stateKey: \"nurture_state_didntbuy_v1\", lockKey: \"nurture_lock_didntbuy_v1\", version: 1,\n channelsAtLaunch: [\"email\", \"sms\"], copyStatus: \"written-unapproved\", steps: DIDNTBUY_STEPS,\n notes: \"Written candidate, not an approved-six path and not connected to a sender. Planner evidence only.\",\n overlapAudit: \"published-found\",\n ghlOverlap: [\n { name: \"POST CONSULT - NO SALE NURTURE MESSAGES\", status: \"published\", version: 4 },\n { name: \"Tag added 'No Sale' > No Sale Nurture\", status: \"published\", version: 2 },\n ],\n },\n {\n key: \"aged\", label: \"Dormant inquiries\", approval: \"candidate\", stage: \"disabled\",\n senderAuthority: \"none\", source: \"off\", sourceTag: \"nurture - aged\",\n enrolledTag: \"aged-path-v1\", entryRule: { kind: \"tag\", tag: \"nurture - aged\", verified: false },\n stateKey: \"nurture_state_aged_v1\", lockKey: \"nurture_lock_aged_v1\", version: 1,\n channelsAtLaunch: [\"email\"], copyStatus: \"missing\", steps: [],\n notes: \"Later substitution, not one of the promised six. Inventory endpoint remains plan-only and must prove per-contact email consent.\",\n overlapAudit: \"published-found\",\n ghlOverlap: [\n { name: \"Tips Nurture\", status: \"published\", version: 7 },\n { name: \"TIPS FACEBOOK CAMPAIGN - SMS Nurture\", status: \"published\", version: 3 },\n { name: \"Auto Replies > tips campaign\", status: \"published\", version: 10 },\n { name: \"Copy - Tips Ad campaign > Auto Responder\", status: \"published\", version: 11 },\n { name: \"Tips ad campaign > response > phone number\", status: \"published\", version: 10 },\n { name: \"Tips Ad campaign > Auto Responder\", status: \"draft\", version: 19 },\n ],\n },\n];\n\nexport const ALL_PATH_DEFINITIONS: PathDef[] = [...APPROVED_PATHS, ...CANDIDATE_PATHS];\n\nexport function pathByKey(key: string): PathDef | undefined {\n return ALL_PATH_DEFINITIONS.find((p) => p.key === key);\n}\n\n// ---- copy validator -------------------------------------------------------------------------------\n\nconst BANNED = [\n { re: /discovery/i, why: 'Kim banned \"discovery call\", it is \"Pup Talk\"' },\n { re: /grooming/i, why: \"grooming is not a service they offer\" },\n { re: /\\{\\{(?!\\s*(FIRST_NAME|DOG_NAME)\\s*\\}\\})/, why: \"an unrecognised merge token, only {{FIRST_NAME}} and {{DOG_NAME}} are wired up\" },\n { re: /\\[link\\]|\\[phone\\]|INSERT|TODO|LOREM/i, why: \"a placeholder that never got resolved\" },\n];\nconst MENTIONS_EMAIL = /\\be-?mail(s|ed|ing)?\\b|\\binbox\\b/i;\n\nconst trackOf = (id: string) => id.replace(/[-_]?\\d+$/, \"\") || id;\n\nexport function validatePath(p: PathDef) {\n const errors: string[] = [], warnings: string[] = [];\n if (!p.steps.length) {\n return { key: p.key, registered: false, ok: false, errors: [\"no steps registered yet\"], warnings: [] as string[] };\n }\n\n let sawOptOut = false, sawBooking = false;\n const sms = p.steps.filter((s) => s.channel === \"sms\");\n const ids = new Set();\n const previousByTrack = new Map();\n\n for (const s of p.steps) {\n const text = `${s.subject ?? \"\"}\\n${s.previewText ?? \"\"}\\n${s.bodyTemplate}`;\n if (!s.id || ids.has(s.id)) errors.push(`${s.id || \"(missing id)\"}: step id is missing or duplicated inside ${p.key}`);\n ids.add(s.id);\n if (!Number.isFinite(s.offsetHours) || s.offsetHours < 0) errors.push(`${s.id}: offsetHours must be a finite non-negative number`);\n if (!p.channelsAtLaunch.includes(s.channel)) errors.push(`${s.id}: ${s.channel} is not enabled in channelsAtLaunch`);\n for (const b of BANNED) if (b.re.test(text)) errors.push(`${s.id}: ${b.why}`);\n if (p.key !== \"boarding\" && /\\$\\s?\\d/.test(text)) errors.push(`${s.id}: a price in a message; only approved boarding rates may ever be quoted`);\n if (p.key === \"boarding\") {\n const amounts = [...text.matchAll(/\\$\\s?(\\d+(?:\\.\\d+)?)/g)].map((m) => Number(m[1]));\n if (amounts.some((n) => ![30, 35, 40, 45].includes(n))) errors.push(`${s.id}: boarding price is outside Kim's approved rate set`);\n }\n if (/\\bstop\\b/i.test(s.bodyTemplate) || /reply\\s+stop/i.test(s.bodyTemplate)) sawOptOut = true;\n if (s.bodyTemplate.includes(OWNED_BOOKING_ID) || s.bodyTemplate.includes(OWNED_BOARDING_FORM)) sawBooking = true;\n if (/leadconnectorhq\\.com\\/widget\\/bookings?\\//.test(s.bodyTemplate) && !s.bodyTemplate.includes(OWNED_BOOKING_ID)) {\n errors.push(`${s.id}: booking link does not point at a calendar this account owns`);\n }\n if (s.channel === \"sms\" && s.bodyTemplate.length > 320) errors.push(`${s.id}: SMS ${s.bodyTemplate.length} chars, over the 320 ceiling`);\n if (s.channel === \"email\" && !s.subject) errors.push(`${s.id}: email with no subject line`);\n\n if (s.channel === \"sms\" && MENTIONS_EMAIL.test(s.bodyTemplate) && !s.bodyIfNoEmail) {\n errors.push(`${s.id}: an SMS that mentions email needs a bodyIfNoEmail, or it promises a message that will never arrive to anyone without an address`);\n }\n if (s.bodyIfNoEmail) {\n const alt = s.bodyIfNoEmail;\n for (const b of BANNED) if (b.re.test(alt)) errors.push(`${s.id} no-email variant: ${b.why}`);\n if (p.key !== \"boarding\" && /\\$\\s?\\d/.test(alt)) errors.push(`${s.id} no-email variant: a price in a message`);\n if (MENTIONS_EMAIL.test(alt)) errors.push(`${s.id} no-email variant: still mentions email`);\n if (s.channel === \"sms\" && alt.length > 320) errors.push(`${s.id} no-email variant: SMS ${alt.length} chars, over the 320 ceiling`);\n if (alt === s.bodyTemplate) errors.push(`${s.id} no-email variant: identical to the main body, so it changes nothing`);\n }\n\n const track = trackOf(s.id);\n const prev = previousByTrack.get(track);\n if (prev && s.offsetHours <= prev.offsetHours) {\n errors.push(`${s.id}: timing does not move forward inside ${track} (${prev.offsetHours}h then ${s.offsetHours}h)`);\n }\n previousByTrack.set(track, s);\n }\n\n const maxOffset = Math.max(...p.steps.map((s) => s.offsetHours));\n if (maxOffset < 24 * 21) warnings.push(`longest step is ${Math.round(maxOffset / 24)} days, below the contracted 30-day journey`);\n if (!sawOptOut && sms.length) warnings.push(\"no opt-out wording found in source SMS; the approved renderer must append it to every text\");\n if (!sawBooking) warnings.push(\"no approved booking link anywhere in this path\");\n\n return {\n key: p.key, registered: true, ok: errors.length === 0, errors, warnings,\n steps: p.steps.length, sms: sms.length, email: p.steps.length - sms.length,\n };\n}\n\n// ---- registry and readiness validation ------------------------------------------------------------\n\nconst duplicates = (values: string[]) => [...new Set(values.filter((v, i) => values.indexOf(v) !== i))].sort();\n\nexport function validateRegistry(\n approved: readonly PathDef[] = APPROVED_PATHS,\n definitions: readonly PathDef[] = ALL_PATH_DEFINITIONS,\n) {\n const errors: string[] = [], warnings: string[] = [];\n const approvedDiff = registryKeyDiff(PROMISED_PATH_KEYS, approved.map((p) => p.key));\n if (!approvedDiff.exact) errors.push(`approved registry differs from promised set: ${JSON.stringify(approvedDiff)}`);\n\n const keyDupes = duplicates(definitions.map((p) => p.key));\n const stateDupes = duplicates(definitions.map((p) => p.stateKey));\n const lockDupes = duplicates(definitions.map((p) => p.lockKey));\n const enrolledDupes = duplicates(definitions.map((p) => p.enrolledTag));\n const sourceDupes = duplicates(definitions.map((p) => p.sourceTag).filter((x): x is string => !!x));\n if (keyDupes.length) errors.push(`duplicate path keys: ${keyDupes.join(\", \")}`);\n if (stateDupes.length) errors.push(`state is not isolated; duplicate state keys: ${stateDupes.join(\", \")}`);\n if (lockDupes.length) errors.push(`locks are not isolated; duplicate lock keys: ${lockDupes.join(\", \")}`);\n if (enrolledDupes.length) errors.push(`duplicate enrolled tags: ${enrolledDupes.join(\", \")}`);\n if (sourceDupes.length) errors.push(`source tags can overlap by definition: ${sourceDupes.join(\", \")}`);\n\n for (const p of definitions) {\n if (p.entryRule.kind === \"tag\" && p.sourceTag !== p.entryRule.tag) errors.push(`${p.key}: sourceTag and entryRule tag disagree`);\n if (p.entryRule.kind === \"unresolved\" && p.sourceTag) errors.push(`${p.key}: unresolved entry rule must not expose an executable sourceTag`);\n if (p.stage === \"sending\") {\n if (p.approval !== \"approved\") errors.push(`${p.key}: an unapproved candidate is marked sending`);\n if (p.source !== \"engine\" || p.senderAuthority !== ONLY_SENDER_AUTHORITY) errors.push(`${p.key}: sending bypasses the one engine authority`);\n if (p.entryRule.kind !== \"tag\" || !p.entryRule.verified) errors.push(`${p.key}: sending without a verified deterministic entry rule`);\n }\n if (p.stage === \"dry-run-only\" && (p.source !== \"off\" || p.senderAuthority !== \"none\")) {\n errors.push(`${p.key}: dry-run-only definition has sender authority`);\n }\n if (p.approval === \"approved\" && !PROMISED_PATH_KEYS.includes(p.key as any)) errors.push(`${p.key}: marked approved but not promised`);\n }\n for (const p of approved) {\n if (p.approval !== \"approved\") errors.push(`${p.key}: approved registry row is not marked approved`);\n }\n\n const sending = definitions.filter((p) => p.stage === \"sending\");\n const authorities = [...new Set(sending.map((p) => p.senderAuthority))];\n if (authorities.some((a) => a !== ONLY_SENDER_AUTHORITY)) errors.push(`more than one sender authority: ${authorities.join(\", \")}`);\n if (!sending.length) warnings.push(\"no path is represented as actually sending\");\n\n return { ok: errors.length === 0, errors, warnings, approvedDiff, sending: sending.map((p) => p.key) };\n}\n\nexport function pathReadiness(p: PathDef) {\n const blockers: string[] = [];\n const copy = validatePath(p);\n if (p.approval !== \"approved\") blockers.push(\"not one of the approved six paths\");\n if (p.copyStatus !== \"approved-source\") blockers.push(\"copy is not confirmed approved source text\");\n if (!copy.registered || !copy.ok) blockers.push(...copy.errors);\n if (p.entryRule.kind !== \"tag\" || !p.entryRule.verified || !p.sourceTag) blockers.push(\"entry trigger is unresolved or unverified\");\n if (p.source !== \"engine\" || p.senderAuthority !== ONLY_SENDER_AUTHORITY) blockers.push(\"one-sender authority is not assigned\");\n if (p.overlapAudit !== \"clear\") blockers.push(`GHL overlap audit is ${p.overlapAudit}`);\n const published = p.ghlOverlap.filter((w) => w.status === \"published\");\n if (published.length) blockers.push(`${published.length} published GHL overlap(s) remain named`);\n return {\n key: p.key,\n canSend: p.stage === \"sending\" && blockers.length === 0,\n canDryRun: p.steps.length > 0 && !!p.sourceTag && (p.stage === \"dry-run-only\" || p.stage === \"sending\"),\n blockers: [...new Set(blockers)],\n };\n}\n\n// ---- registry endpoint ---------------------------------------------------------------------------\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n if (!(await authorised(url.searchParams.get(\"k\") || \"\"))) {\n return new Response(\"Not found\", { status: 401, headers: { \"content-type\": \"text/plain\" } });\n }\n\n const registry = validateRegistry();\n const legacyMismatch = registryKeyDiff(PROMISED_PATH_KEYS, LEGACY_SUBSTITUTED_PATH_KEYS);\n const rows = ALL_PATH_DEFINITIONS.map((p) => ({\n key: p.key,\n label: p.label,\n approval: p.approval,\n stage: p.stage,\n senderAuthority: p.senderAuthority,\n sourceTag: p.sourceTag,\n enrolledTag: p.enrolledTag,\n stateKey: p.stateKey,\n lockKey: p.lockKey,\n copyStatus: p.copyStatus,\n steps: p.steps.length,\n overlapAudit: p.overlapAudit,\n publishedOverlaps: p.ghlOverlap.filter((w) => w.status === \"published\").map((w) => w.name),\n validation: validatePath(p),\n readiness: pathReadiness(p),\n notes: p.notes,\n }));\n const payload = {\n at: new Date().toISOString(),\n approvedPromisedPaths: [...PROMISED_PATH_KEYS],\n approvedRegistryExact: registry.approvedDiff.exact,\n registryValidation: registry,\n legacySubstitutionMismatch: legacyMismatch,\n actuallySending: rows.filter((p) => p.stage === \"sending\").map((p) => p.key),\n independentlyClearedToSend: rows.filter((p) => p.readiness.canSend).map((p) => p.key),\n dryRunOnlyCandidates: rows.filter((p) => p.stage === \"dry-run-only\").map((p) => p.key),\n candidateSubstitutions: CANDIDATE_PATHS.map((p) => p.key),\n sendingCaveat: \"Only puppy is wired to the existing hourly sender. A registry row or written message module cannot send. Published-overlap clearance still needs independent live evidence.\",\n paths: rows,\n };\n\n if (url.searchParams.get(\"f\") === \"json\" || url.searchParams.get(\"validate\") === \"1\") {\n return new Response(JSON.stringify(payload, null, 2), { headers: { \"content-type\": \"application/json\", \"cache-control\": \"no-store\" } });\n }\n\n const table = rows.map((p) => `${p.label}
${p.key}${p.approval}${p.stage}${p.steps || \"-\"}${p.readiness.canSend ? \"cleared\" : p.readiness.blockers.join(\"; \")}`).join(\"\");\n return new Response(`Nurture path registry\n\n
Nurture path registry
\n
The approved registry is the six promised paths. Later substitutions remain visible as candidates, never as scope or sender wiring. Actually sending: ${payload.actuallySending.join(\", \") || \"none\"}. Independently cleared by this registry: ${payload.independentlyClearedToSend.join(\", \") || \"none\"}.
\n${table}
Path Standing Stage Steps Safety position
`,\n { headers: { \"content-type\": \"text/html; charset=utf-8\", \"cache-control\": \"no-store\" } });\n}\n",[349],"acdf3be6-280a-42df-9ba0-cb28022fa682","noshow-messages.ts","50d0574a-98cf-11f1-9f03-1607ee4eb77e",1133,["D",1786832221558],"// THE \"BOOKED A PUP TALK AND DIDN'T SHOW\" PATH. v1.0, 15 Aug 2026.\n//\n// THE HOLE THIS CLOSES, MEASURED RATHER THAN ASSUMED.\n//\n// Read live from the account on 15 Aug 2026: across the two calendars that matter, most appointments\n// marked no-show or cancelled do NOT carry the tag that is supposed to accompany it — the tag is\n// applied a small single-digit percentage of the time.\n// The staff-booked appointment type loses a substantial share, and every one of those was booked by a\n// member of staff already in a conversation with the customer. The self-booked type loses a much\n// higher share again. Exact figures are held in the client record, not here.\n//\n// Seven published GoHighLevel workflows already have \"no show\" or \"cancelled\" in their names. None\n// of them is what this is. They fire on tags that are applied 2% of the time, and they are one-shot\n// messages rather than a sequence. This path is enrolled by a human applying `nurture - noshow`,\n// which is the same switch every other path uses, and it does not depend on the tag estate at all.\n//\n// THE TONE DECISION, AND IT IS THE WHOLE FILE.\n//\n// Somebody who booked a free call and did not turn up is not a lead who needs chasing. They are\n// usually a person whose week went wrong. The single most likely reason a dog owner misses a free\n// consultation is that the thing they wanted help with got worse, not better, and they are\n// embarrassed. So:\n//\n// * Not one message asks why they missed it. Not once, not gently, not implied.\n// * Not one message says \"we noticed you didn't attend\". They know.\n// * The first message is help with no ask attached, because the ask is what they dodged.\n// * The rebooking link is present every time and never the point of the sentence.\n// * Five touches across thirty days, and the gaps WIDEN: 20 hours, 2 days, 9 days, 16 days,\n// 30 days. Frequency that decays is the difference between a business that is still there and\n// a business that is nagging. The contracted minimum for this system is a 30-day journey, and\n// the validator enforces it — the first draft of this file stopped at day 16 and was caught.\n// Padding it with a fifth chase would have been the wrong fix, so the fifth touch is the same\n// shape as the second: something useful, with no ask attached, and it says out loud that it is\n// the last one. A sequence that stops without saying so leaves the person waiting to be chased.\n//\n// CONSTRAINTS THIS FILE IS WRITTEN AGAINST (engine/paths.ts validator, all enforced by test):\n// * never \"discovery call\" — Kim's word is Pup Talk\n// * never grooming, which they do not offer\n// * NEVER a price, because training prices are not ours to quote and this path has no exception\n// * only {{FIRST_NAME}} and {{DOG_NAME}} are wired up; any other token reaches a customer as\n// literal text\n// * SMS ceiling 320 characters\n// * every booking link must point at the Pup Talk calendar this account owns\n\nimport { PHONE_DISPLAY, SHORT_BOOKING_LINK } from \"./puppy-messages.ts\";\nimport type { Step } from \"./paths.ts\";\n\nexport const NOSHOW_STEPS: Step[] = [\n {\n id: \"main-1\",\n channel: \"sms\",\n offsetHours: 20,\n // TWENTY HOURS, NOT TWO. Two hours after a missed call reads as a system noticing. The next\n // morning reads as a person. It also clears the evening, which is when the reasons for missing\n // an appointment tend to still be happening.\n bodyTemplate:\n `Hi {{FIRST_NAME}}, it's Kim at The Dogs Spot. No problem at all about yesterday - life happens. ` +\n `If you'd still like to talk about {{DOG_NAME}}, grab any time that suits: ${SHORT_BOOKING_LINK}. ` +\n `Or just reply here, a real person reads these. Reply STOP to opt out.`,\n },\n {\n id: \"main-2\",\n channel: \"email\",\n offsetHours: 48,\n subject: \"The thing most people want to ask us first\",\n previewText: \"No booking needed to read this one.\",\n // NO ASK IN THIS EMAIL AT ALL beyond a link at the bottom. It is the only message in the path\n // whose job is to be useful to somebody who never speaks to us again.\n bodyTemplate: `Hi {{FIRST_NAME}},\n\nI'll keep this one short and useful, and there's nothing you need to book to read it.\n\nThe question we get asked more than any other is some version of \"is it too late?\" - the dog is two, or five, or has been doing this for years, and the owner has been told the window closed. It didn't. Older dogs learn more slowly than puppies do in some ways and considerably faster in others, because they can already concentrate. What actually changes with age isn't whether a dog can learn. It's how consistent the humans have to be.\n\nThe second thing worth knowing: almost every problem people call us about - pulling, barking at the door, not coming back when called, going for other dogs - comes down to the dog never having been shown what to do *instead*. Telling a dog to stop doing something leaves them with nothing to do. That's why \"no\" stops working after a while.\n\nIf any of that sounds like {{DOG_NAME}}, a Pup Talk is a real conversation with our team about what's actually going on. No obligation to book anything afterwards, and it costs you nothing.\n\n${SHORT_BOOKING_LINK}\n\nOr call or text us on ${PHONE_DISPLAY} if that's easier.\n\nKim\nThe Dogs Spot`,\n },\n {\n id: \"main-3\",\n channel: \"email\",\n offsetHours: 216, // day 9\n subject: \"What actually happens on a Pup Talk\",\n previewText: \"In case the not knowing is the bit putting you off.\",\n // WHY THIS EMAIL EXISTS. The commonest unspoken reason a free consultation gets missed is not\n // knowing what it is and not wanting to be sold to. So this describes the call plainly,\n // including the part where nobody has to buy anything. It is the highest-intent message in the\n // path and it is deliberately the least salesy.\n bodyTemplate: `Hi {{FIRST_NAME}},\n\nA few people have told me they weren't quite sure what they'd booked, so here's exactly what a Pup Talk is.\n\nIt's a phone call, about twenty minutes. Someone from our team asks what's going on with {{DOG_NAME}}, what you've already tried, and what you'd want to be different. Then they tell you honestly what they think would help.\n\nSometimes that's one of our programs. Often it isn't - it's a change to how something is being handled at home, and it costs nothing to try. We'd rather tell you that than sell you something you didn't need, because the people who send us their friends are the ones we were straight with.\n\nNobody is asked to decide anything on the call.\n\nIf that sounds worth twenty minutes: ${SHORT_BOOKING_LINK}\n\nAnd if the timing just isn't right, that's genuinely fine. We'll be here.\n\nKim\nThe Dogs Spot`,\n },\n {\n id: \"main-4\",\n channel: \"sms\",\n offsetHours: 384, // day 16\n // Deliberately the lightest message in the path. Two weeks after a missed call, the only honest\n // thing to say is that the offer is still open, so that is all it says.\n bodyTemplate:\n `Hi {{FIRST_NAME}}, Kim at The Dogs Spot. Still happy to talk about {{DOG_NAME}} whenever suits - ` +\n `${SHORT_BOOKING_LINK}, or ${PHONE_DISPLAY} if you'd rather just ring. No rush. Reply STOP to opt out.`,\n },\n {\n id: \"main-5\",\n channel: \"email\",\n offsetHours: 720, // day 30\n subject: \"One last thing, and then I'll leave you alone\",\n previewText: \"Useful whether or not you ever call us.\",\n // THE LAST ONE, AND IT SAYS SO IN THE SUBJECT LINE. Saying \"this is the last one\" is the single\n // line most likely to get a reply from somebody who has ignored four, and it is the only honest\n // way to end. Same shape as main-2: useful to a person who never speaks to us again, because\n // most of the people still reading at day 30 are exactly that person.\n bodyTemplate: `Hi {{FIRST_NAME}},\n\nThis is the last email I'll send, so I want it to be worth opening even if we never speak.\n\nThe one thing that changes most dogs fastest, and costs nothing: stop repeating the word. If {{DOG_NAME}} doesn't respond the first time, saying it four more times teaches them the word means nothing until the fourth time. Say it once. If nothing happens, help them do the thing, then reward it like they'd done it on their own. Most people find that alone changes recall inside a fortnight.\n\nThe second thing: whatever you want more of, catch them doing it. Dogs repeat what pays. Almost nobody rewards the dog who is lying quietly in the corner, which is exactly why the quiet doesn't last.\n\nThat's genuinely it. If you ever want a proper conversation about {{DOG_NAME}}, we're here and a Pup Talk is free: ${SHORT_BOOKING_LINK}, or call or text ${PHONE_DISPLAY}.\n\nGood luck with them either way.\n\nKim\nThe Dogs Spot`,\n },\n];\n",[356],"64571cb3-b65e-472e-ab8f-9a1cfb758060","money-match.ts","e97430aa-943a-11f1-b975-1607ee4eb77e",1131,["D",1786832220817],"// THE MONEY MATCHER. v1.0, 9 Aug 2026.\n//\n// WHAT THIS IS FOR. Kim's question, in her words: \"what are we doing with the money information that\n// comes from square back into the CRM?\" The answer today is: it lands as a note on the customer's\n// file, and nothing ever writes the amount onto the booking. The booking is the only place a report\n// can add money up from, so revenue and ROAS read zero while the money plainly exists.\n//\n// HER RULE, agreed in writing on 9 August at 10:26 PM, verbatim:\n// \"One open opportunity -> automatically assign the payment.\n// Multiple open opportunities -> staff chooses the correct one.\"\n// That is exactly what classify() implements. One card, AUTO. More than one, CHOOSE. None, ORPHAN.\n//\n// WHY THIS SHIPS AS A DRY RUN FIRST, and it is not timidity. Kristian's application also writes\n// opportunities into this same CRM; he confirmed it in writing on 7 August. Until he says whether it\n// writes monetaryValue, two systems would own one field and one would win at random. So this module\n// computes every write it WOULD make, proves the arithmetic, and writes nothing. Flipping it live is\n// one flag, after one sentence from him.\n//\n// NOTHING HERE MUTATES. There is no POST, PUT or PATCH in this file, and a test asserts that.\n\nexport type Payment = {\n id: string;\n amount: number;\n status: string;\n contactId: string | null;\n contactName: string | null;\n at: string | null;\n};\nexport type Opp = {\n id: string;\n contactId: string | null;\n name: string | null;\n monetaryValue: number;\n stage: string;\n createdAt: string | null;\n lastStageChangeAt: string | null;\n};\n\nexport type Verdict = \"AUTO\" | \"CHOOSE\" | \"ORPHAN\" | \"ALREADY_VALUED\";\nexport type Match = {\n payment: Payment;\n verdict: Verdict;\n candidates: Opp[];\n wouldWrite: { oppId: string; value: number } | null;\n why: string;\n};\n\n// A payment only counts as money if it actually completed. Pending and failed are shown to Kim\n// separately and never counted as revenue, because a report that counts a failed card as income is\n// worse than no report.\nexport const COMPLETED = \"succeeded\";\n\n// The point of sale bucket. Square sends counter sales with no customer, and this CRM files them all\n// against one nameless record, so a contactId here does NOT mean a real person was identified.\nexport const isNameless = (p: Payment) =>\n !p.contactName || p.contactName.trim().toLowerCase() === \"unknown\";\n\n// THE ONLY TWO STAGES A PAYMENT MAY EVER BE WRITTEN TO. [Added 10 Aug 2026.]\n// A contact appears on up to eight boards in this location and every empty card looks identical\n// from inside classify(). Proven live: unscoped, $4,020 of $4,685 lands on a card that is not a\n// booking, including $500 onto a Survey Requested card belonging to a customer whose real booking\n// already carries $2,395 and would correctly have been left alone. The exception list also goes\n// from 0 to 10, breaking the promise on Kim's page that nobody has to do anything.\n// Filter HERE, not in the caller: a caller that hands over every board is the normal mistake.\nexport const VALUABLE_STAGES: readonly string[] = Object.freeze([\n \"fd821b4e-bbe6-44de-b754-fa80e4823616\", // 1) Initial Lead Pipeline / Customer\n \"ae173310-f8b1-4399-acb7-ef1fc03d3697\", // 1) Initial Lead Pipeline / Won - Paid\n]);\nconst IN_SCOPE = new Set(VALUABLE_STAGES);\n\nexport function classify(payment: Payment, oppsForContact: Opp[]): Match {\n const inScope = oppsForContact.filter((o) => IN_SCOPE.has(o.stage));\n const open = inScope.filter((o) => o.monetaryValue === 0);\n const valued = inScope.filter((o) => o.monetaryValue > 0);\n\n if (isNameless(payment) || !payment.contactId) {\n return { payment, verdict: \"ORPHAN\", candidates: [], wouldWrite: null,\n why: \"no named customer on the payment, so nothing can be matched to it by any system\" };\n }\n if (inScope.length === 0) {\n return { payment, verdict: \"ORPHAN\", candidates: [], wouldWrite: null,\n why: \"the customer is named but has no booking on the Customer or Won and Paid board to put the money on\" };\n }\n if (open.length === 0 && valued.length > 0) {\n return { payment, verdict: \"ALREADY_VALUED\", candidates: valued, wouldWrite: null,\n why: \"every booking for this customer already carries a value; nothing would be overwritten\" };\n }\n if (open.length === 1) {\n return { payment, verdict: \"AUTO\", candidates: open,\n wouldWrite: { oppId: open[0].id, value: payment.amount },\n why: \"one booking open, so the money goes on it, which is the rule Kim gave\" };\n }\n return { payment, verdict: \"CHOOSE\", candidates: open, wouldWrite: null,\n why: `${open.length} bookings open for this customer, so a person picks; guessing here would invent revenue` };\n}\n\nexport type Write = { oppId: string; value: number; paymentIds: string[] };\n\n// ONE WRITE PER BOOKING, CARRYING THE SUM. [Added 10 Aug 2026.]\n// classify() is per payment because Kim's rule is per payment. The grouping belongs here, in the\n// caller's layer. Without it, a customer who pays twice toward one booking produces two writes to\n// one field and the loser's money vanishes silently. Proven live on a repeat boarding customer:\n// two payments in the same period, both resolving to one opportunity, only the last one surviving.\n// The bug self seals: once a wrong value is written the next run sees a non zero field and returns\n// ALREADY_VALUED, so the lost money is unrecoverable without a manual audit.\n// Summing PRESERVES the total, so the figure already on the client's page is the correct one and it\n// is the code that has to catch up with the page.\nexport function planWrites(matches: Match[]): Write[] {\n const byOpp = new Map();\n for (const m of matches) {\n if (m.verdict !== \"AUTO\" || !m.wouldWrite) continue;\n const g = byOpp.get(m.wouldWrite.oppId) ?? { oppId: m.wouldWrite.oppId, amounts: [], paymentIds: [] };\n g.amounts.push(m.wouldWrite.value);\n g.paymentIds.push(m.payment.id);\n byOpp.set(g.oppId, g);\n }\n return [...byOpp.values()].map((g) => ({ oppId: g.oppId, value: sum(g.amounts), paymentIds: g.paymentIds }));\n}\n\nexport type Summary = {\n completed: { count: number; total: number };\n pending: { count: number; total: number };\n failed: { count: number; total: number };\n auto: { count: number; total: number };\n choose: { count: number; total: number };\n orphan: { count: number; total: number };\n alreadyValued: { count: number; total: number };\n coveragePct: number; // of completed money, what this would place on a booking\n valuedNow: { count: number; total: number }; // what the CRM carries today\n valuedAfter: { count: number; total: number }; // what it would carry if the AUTO set were written\n writes: { count: number; total: number }; // ACTUAL write count: one per booking, not per payment\n};\n\nconst sum = (xs: number[]) => Math.round(xs.reduce((a, b) => a + b, 0) * 100) / 100;\n\nexport function summarise(matches: Match[], all: Payment[], valuedToday: Opp[]): Summary {\n const byStatus = (s: string) => all.filter((p) => p.status === s);\n const of = (v: Verdict) => matches.filter((m) => m.verdict === v);\n const amt = (ps: { amount: number }[]) => sum(ps.map((p) => p.amount));\n const pot = (ms: Match[]) => sum(ms.map((m) => m.payment.amount));\n\n const completed = byStatus(COMPLETED);\n const auto = of(\"AUTO\"), choose = of(\"CHOOSE\"), orphan = of(\"ORPHAN\"), av = of(\"ALREADY_VALUED\");\n const writes = planWrites(matches);\n const completedTotal = amt(completed);\n const nowTotal = sum(valuedToday.map((o) => o.monetaryValue));\n\n return {\n completed: { count: completed.length, total: completedTotal },\n pending: { count: byStatus(\"pending\").length, total: amt(byStatus(\"pending\")) },\n failed: { count: byStatus(\"failed\").length, total: amt(byStatus(\"failed\")) },\n auto: { count: auto.length, total: pot(auto) },\n choose: { count: choose.length, total: pot(choose) },\n orphan: { count: orphan.length, total: pot(orphan) },\n alreadyValued: { count: av.length, total: pot(av) },\n // Honesty on the face of it: coverage is what WOULD be placed automatically, out of money that\n // actually completed. Kim is told this number before she ever sees a revenue figure, so a low\n // first month is never a surprise.\n coveragePct: completedTotal > 0 ? Math.round((pot(auto) / completedTotal) * 1000) / 10 : 0,\n valuedNow: { count: valuedToday.length, total: nowTotal },\n // counts BOOKINGS that gain a value, which is the number of writes, not the number of payments\n valuedAfter: { count: valuedToday.length + writes.length, total: sum([nowTotal, pot(auto)]) },\n writes: { count: writes.length, total: sum(writes.map((w) => w.value)) },\n };\n}\n\n// The sentence Kim reads. Generated, never typed, so it cannot drift from the numbers beside it.\nexport function plainEnglish(s: Summary): string {\n const m = (n: number) => \"$\" + n.toLocaleString(\"en-US\", { minimumFractionDigits: 2, maximumFractionDigits: 2 });\n if (s.completed.count === 0) return \"No completed Square payments were found, so there is nothing to place yet.\";\n const parts = [\n `${s.completed.count} Square payments completed, worth ${m(s.completed.total)}.`,\n s.auto.count\n ? `${s.auto.count} of them, worth ${m(s.auto.total)}, belong to a customer with exactly one booking open, so those place themselves.`\n : `None of them belong to a customer with exactly one booking open, so none place themselves yet.`,\n ];\n if (s.choose.count) parts.push(`${s.choose.count}, worth ${m(s.choose.total)}, belong to someone with more than one booking open, so a person picks which one.`);\n if (s.orphan.count) parts.push(`${s.orphan.count}, worth ${m(s.orphan.total)}, arrived with no named customer at all and can never be placed by anything.`);\n if (s.auto.count > s.writes.count) parts.push(`${s.auto.count} payments fill ${s.writes.count} bookings, because some customers paid more than once toward the same booking and those amounts are added together rather than one written over the other.`);\n parts.push(`That would take the money recorded against bookings from ${m(s.valuedNow.total)} to ${m(s.valuedAfter.total)}.`);\n return parts.join(\" \");\n}\n",[363],"30ac6029-d974-454f-9bb4-cc19739cffa7","main.ts","cdd9f676-8c34-11f1-baf4-1607ee4eb77e",1146,["D",1786908222715],41,"// PUPPY PATH ENGINE v1.1 — nurture automation for The Dogs Spot's puppy leads (built 27 Ju\n// (full note moved to NOTES-v1.4.md when this file hit val.town's 80,000-char ceiling)\n\n// ---- Node/tsx compatibility shim, for the local harness only. Full note: NOTES v1.10.\ndeclare const Deno: { env: { get(key: string): string | undefined } };\nif (typeof (globalThis as any).Deno === \"undefined\") {\n (globalThis as any).Deno = { env: { get: (k: string) => (globalThis as any).process?.env?.[k] } };\n}\n\n// Message copy + display constants live in ./puppy-messages.ts (split for val.town's 80k/file cap).\nimport {\n MAIN_SEQUENCE,\n BRANCH_A,\n BRANCH_B,\n PHONE_DISPLAY,\n REAL_BOOKING_URL,\n SHORT_BOOKING_LINK,\n} from \"./puppy-messages.ts\";\nimport type { Channel, MessageTemplate } from \"./puppy-messages.ts\";\n// v1.7 — slow track (taper). Copy+cadence in ./taper-messages.ts; Kim's spec (3 Aug): weekly x4,\n// fortnightly x13, then monthly forever, no asks. Same rails: reply pauses, booking exits, consent.\nimport { nextSlowTouch, monthlyTemplateFor, monthlyTemplateAvoidingRepeat } from \"./taper-messages.ts\";\n// v1.8 — Kim's real stories, one data file, additive slots. Null slots render as nothing.\nimport { readChannelConsent } from \"./consent.ts\";\n// v1.9 — reachability, dead letters, delivery, opt-out words. Extracted for this file's ceiling.\nimport {\n missingChannel, reachabilityExit, enrolmentBar, backoffBar, onSendFailure, onDeliveryStatus,\n sendReceipt, convoExtras, honourOptOut, failureCounts, FRESH_FAILURE_FIELDS, DEAD_LETTER_STATUSES,\n reEnrollable, refusedBefore, noteScopedOptOut,\n} from \"./reachability.ts\";\nimport type { DeadLetterStatus, FailureFields, ReplyStatus, Effects, OptOutScope } from \"./reachability.ts\";\nimport { resolveStories } from \"./kim-stories.ts\";\nimport { appendRunStamp } from \"./cadence.ts\";\nimport { dryScan } from \"./puppy-detect.ts\";\nimport { resolveDogName, resolveFirstName, applyMergeFields, escHtml, bodyToHtml } from \"./render.ts\";\n// v1.13 — the IO layer. Every GHL HTTP call and the practice-mode send guard. It fails closed:\n// configureSend() below is what takes it out of practice mode, and it is called once per run.\nimport {\n GHL, LOC, j, configureSend, sendSms, sendEmail, addTag, createTask, resolveTestDummy,\n} from \"./send.ts\";\n// TASK_OWNER moved with the senders. Re-exported so this file's public surface is unchanged by the\n// move — anything that imported it from the engine still gets it from the engine.\nexport { TASK_OWNER } from \"./send.ts\";\n\n// ---- reference IDs (spec §2, all verified live this session unless noted) ------------------------\n\n// v1.13 (16 Aug) — the IO layer now lives in send.ts. This file was at 79,907 of 80,000 and a\n// one-line fix that morning had to be rewritten twice to fit. send.ts holds every GHL HTTP call and\n// the practice-mode guard; nothing about their behaviour changed. NOTES-v1.11.md.\nconst MAIN_PIPELINE_ID = \"FXt1UpCVBufbF0v3pfyf\"; // \"1) Initial Lead Pipeline\"\n\nconst STAGE = {\n NEW_LEAD: \"ccb18375-9aa1-40aa-a071-1581ca739533\",\n LEAD_NURTURE: \"00d0f792-38e5-444e-8995-a1be96e77d3b\",\n FREE_TRAINING_DAY: \"43ea02b4-529b-4063-b638-447414d603d2\",\n PUP_TALK: \"379d1dd2-fc18-4720-a840-e8f8ed703bb9\",\n CXLD_PUPTALK_TRAINING_DAY: \"4b5599d3-a5ad-4b8c-8388-4d5507c22fd7\",\n NO_SALE_NURTURE: \"e4511876-0adb-417b-a6be-8460a194f913\",\n DISQUALIFIED: \"38826f17-1d0e-4bac-b53e-349b67c2c79d\",\n NO_SHOW: \"f3f41e5e-edaf-4ef1-8cec-c4cccd4ec5c2\",\n ONBOARDING: \"76c72f7f-56bd-4f44-964d-aa4cbbec7d25\",\n CUSTOMER: \"fd821b4e-bbe6-44de-b754-fa80e4823616\",\n WON_PAID: \"ae173310-f8b1-4399-acb7-ef1fc03d3697\",\n} as const;\n\nconst PUP_TALK_CALENDAR_ID = \"qHuYJ0NEqzibnoqf5Cw3\";\n\n\n// v1.1: env-overridable, and now understood as the HUMAN ENROLLMENT SWITCH, not auto-discovery of a\n// pre-existing population — live check 27 Jul: zero contacts carry it (or any spelling variant), so\n// applying it is how a human puts someone on the path. READ ONLY here, never written by this engine.\nconst TAG_SOURCE_SIGNAL = Deno.env.get(\"TAG_SOURCE_SIGNAL\") || \"nurture - puppy\";\nconst TAG_ENROLLED = \"puppy-path-v1\"; // minted by this engine, applied on enrollment\n\n// v1.1 send-window + surge-hold knobs (see header addendum). Read per call, not once at module load —\n// costs nothing at this call volume and lets the offline harness flip them per test section; under\n// val.town the env is static so behavior is identical either way.\nconst sendWindowStartHour = () => Number(Deno.env.get(\"SEND_WINDOW_START_HOUR\") ?? \"9\");\nconst sendWindowEndHour = () => Number(Deno.env.get(\"SEND_WINDOW_END_HOUR\") ?? \"19\");\nconst smsSundayOk = () => (Deno.env.get(\"SMS_SUNDAY_OK\") ?? \"false\") === \"true\";\nconst enrollSurgeThreshold = () => Number(Deno.env.get(\"ENROLL_SURGE_THRESHOLD\") ?? \"25\");\nconst acknowledgeSurge = () => (Deno.env.get(\"ACKNOWLEDGE_SURGE\") ?? \"false\") === \"true\";\nconst BUSINESS_TZ = \"America/New_York\";\n\n// v1.2 hardening knobs (30 Jul). All env-overridable, read per call. Full rationale: NOTES.\nconst minSendGapHours = () => Number(Deno.env.get(\"MIN_SEND_GAP_HOURS\") ?? \"2\");\nconst maxSendsPerRun = () => Number(Deno.env.get(\"MAX_SENDS_PER_RUN\") ?? \"20\");\nconst maxSendsPerDay = () => Number(Deno.env.get(\"MAX_SENDS_PER_DAY\") ?? \"50\");\n// v1.4 — how often a contact gets a full CRM check even when nothing is due. The floor under\n// due-first filtering: cheap must not become blind.\n// v1.4 — how long a reply can sit unanswered before the engine escalates and releases the contact.\nconst pauseTimeoutDays = () => Number(Deno.env.get(\"PAUSE_TIMEOUT_DAYS\") ?? \"14\");\n// v1.5 R27 — how long the engine stands down after ANY other system messages the contact. 24h is one\n// full business cycle: long enough that a customer never gets our email on the same day as a workflow\n// text, short enough that a 21-day sequence still completes near schedule (a deferred step is never\n// dropped, it waits for the next run).\nconst foreignQuietHours = () => Number(Deno.env.get(\"FOREIGN_QUIET_HOURS\") ?? \"24\");\n// Tolerance when deciding \"was that outbound ours?\" — clock skew between our send and GHL stamping\n// the conversation. Anything inside this window of our own lastSentAt is treated as ours.\nconst OURS_TOLERANCE_MS = 5 * 60 * 1000;\nconst safetySweepHours = () => Number(Deno.env.get(\"SAFETY_SWEEP_HOURS\") ?? \"24\");\nconst RUN_LOCK_TTL_MS = 10 * 60 * 1000; // a run that started >10 min ago is presumed dead\n\nconst sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));\n\n// Rule 8's real signal — NOT CONFIRMED LIVE this session, see gap #2 in the header comment. Left as a\n// clearly-named constant so wiring in the real value later is a one-line change, not a re-guess.\nconst PUP_TALK_DECLINED_TAG = \"TDS-Declined\";\n\nconst HOUR_MS = 3600 * 1000;\nconst DAY_MS = 24 * HOUR_MS;\n\n// R38: mode = env var if set, else blob puppy_mode {live:true} (api.ts arm route). Fails safe.\nexport function resolveMode(envVal: string | undefined | null, blobVal: unknown): boolean {\n if (envVal != null) return envVal !== \"false\"; // practice unless the literal string false\n const live = !!(blobVal && typeof blobVal === \"object\" && (blobVal as any).live === true);\n return !live; // no blob, or malformed = practice\n}\nlet TEST_MODE = resolveMode(Deno.env.get(\"TEST_MODE\"), null);\n\n// ---- data model (spec §4, verbatim) ---------------------------------------------------------------\n\ntype PuppyStatus =\n | \"main\" | \"awaiting_appt_outcome\" | \"branch_a\" | \"branch_b\" | \"slow_track\"\n | \"paused_reply\" | \"done_booked\" | \"done_customer\" | \"done_hard_exit\"\n | \"done_soft_21d\" | \"done_branch_complete\" | \"done_not_enrolled\" | DeadLetterStatus;\n\n// v1.7 — done_soft_21d stays terminal for LEGACY pre-taper contacts only (no retroactive\n// enrollment). New 21-day completions flow into slow_track instead.\nconst TERMINAL_STATUSES = new Set([\n \"done_booked\", \"done_customer\", \"done_hard_exit\", \"done_soft_21d\", \"done_branch_complete\",\n \"done_not_enrolled\", // v1.10 — refused AT enrolment; never on the path, so never a win. NOTES v1.10.\n ...DEAD_LETTER_STATUSES, // v1.9 — done_unreachable / done_send_failed. See reachability.ts.\n]);\n\ntype PuppyState = FailureFields & {\n status: PuppyStatus;\n enteredAt: string; // ISO — main sequence start\n lastMainStepSent: number; // 0..8, count of main-sequence messages sent so far\n branchAnchorAt: string | null; // ISO — when branch A/B started\n lastBranchStepSent: number; // 0..2\n pausedForReplyAt: string | null;\n exitReason: string | null; // free text, for humans reading the blob\n lastCheckedAt: string; // ISO, updated every run this contact is touched\n lastSentAt?: string | null; // v1.2 — ISO of the last successful send to this contact (min-gap pacing)\n // v1.4 — R24: monetaryValue was read on every opportunity and thrown away, while the one question\n // the client judges a report by is \"how much revenue did that produce\". Captured at exit.\n exitValue?: number | null; // monetaryValue of the opportunity that ended the sequence\n exitStepsSent?: number | null; // how many messages they had received when they converted\n lastSentStepId?: string | null; // v1.4 — R23: the step ID, so editing copy cannot silently re-point anyone\n // v1.7 — slow track. Optional so pre-v1.7 blobs deserialize untouched; readers default them.\n slowAnchorAt?: string | null; // ISO — when the contact entered the slow track (21-day completion)\n lastSlowStepSent?: number; // count of slow-track messages sent (weekly+fortnightly+monthly)\n};\n\nfunction freshState(enteredAt: string): PuppyState {\n return {\n status: \"main\", enteredAt, lastMainStepSent: 0, branchAnchorAt: null,\n lastBranchStepSent: 0, pausedForReplyAt: null, exitReason: null, lastCheckedAt: enteredAt,\n lastSentAt: null, exitValue: null, exitStepsSent: null, lastSentStepId: null,\n slowAnchorAt: null, lastSlowStepSent: 0, ...FRESH_FAILURE_FIELDS,\n };\n}\n\n// ---- pure helpers: timing, merge fields, rendering ------------------------------------------------\n\nfunction isDue(offsetHours: number, anchorIso: string, nowMs: number): boolean {\n return nowMs >= new Date(anchorIso).getTime() + offsetHours * HOUR_MS;\n}\n\n// v1.1 — business-local wall clock for a UTC instant. Intl with an explicit timeZone is deterministic\n// and DST-correct on both Deno and Node; no date library needed for two fields.\nfunction businessLocalParts(nowMs: number): { hour: number; weekday: string } {\n const parts = new Intl.DateTimeFormat(\"en-US\", {\n timeZone: BUSINESS_TZ,\n hour12: false,\n hour: \"2-digit\",\n weekday: \"short\",\n }).formatToParts(new Date(nowMs));\n const get = (t: string) => parts.find((p) => p.type === t)?.value ?? \"\";\n // Intl gives \"24\" for midnight under hour12:false+2-digit in some engines; normalize to 0.\n const hour = Number(get(\"hour\")) % 24;\n return { hour, weekday: get(\"weekday\") };\n}\n\n// v1.1 — send-window gate (header addendum #3). Pure given (nowMs, channel); env knobs are read once\n// at module load. Emails are allowed any day inside the hour window; SMS additionally respects the\n// closed-on-Sundays business identity unless SMS_SUNDAY_OK.\nfunction inSendWindow(channel: Channel, nowMs: number): { ok: boolean; reason: string } {\n const start = sendWindowStartHour();\n const end = sendWindowEndHour();\n const { hour, weekday } = businessLocalParts(nowMs);\n if (hour < start || hour >= end) {\n return { ok: false, reason: `outside ${start}:00–${end}:00 ${BUSINESS_TZ} (local hour ${hour})` };\n }\n if (channel === \"sms\" && weekday === \"Sun\" && !smsSundayOk()) {\n return { ok: false, reason: \"no SMS on Sundays (business closed)\" };\n }\n return { ok: true, reason: \"\" };\n}\n\ntype RenderedMessage =\n | { channel: \"email\"; subject: string; html: string }\n | { channel: \"sms\"; text: string };\n\n// Appended to every rendered message. Kept as constants so the wording is in exactly one place.\nconst SMS_OPTOUT = \"\\n\\nReply STOP to stop these texts.\";\nconst EMAIL_OPTOUT =\n \"\\n\\n---\\nYou're getting this because you inquired with The Dogs Spot. \" +\n \"Reply UNSUBSCRIBE and we'll take you off these emails.\\n\" +\n \"The Dogs Spot, 643 Pleasant Hill Church Rd, Ellabell, GA 31308\";\n\nfunction renderStep(\n step: MessageTemplate,\n // v1.13 — `noEmail` means \"cannot receive email\", from a blank address OR an email opt-out. It is\n // optional and defaults to false, so a caller that does not know stays on the ordinary copy: the\n // failure direction is \"said emails are coming and they were\", never the reverse.\n contact: { firstName: string | null | undefined; companyName: string | null | undefined; noEmail?: boolean },\n opts: { testMode: boolean },\n): RenderedMessage {\n const prefix = opts.testMode ? \"[TEST] \" : \"\";\n // v1.13 — the no-email variant, where one exists. paths.ts requires one on any SMS that mentions\n // email, so this is what stops main-2 promising emails to a contact main-1 has already skipped.\n const template = contact.noEmail && step.bodyIfNoEmail ? step.bodyIfNoEmail : step.bodyTemplate;\n // v1.8 — story slots resolve before merge fields; a null slot leaves no trace.\n const resolvedBody = applyMergeFields(resolveStories(template), contact.firstName, contact.companyName);\n\n // ---- v1.4 (2 Aug) — OPT-OUT FURNITURE, appended at render time, never written into the c\n // (full note moved to NOTES-v1.4.md when this file hit val.town's 80,000-char ceiling)\n if (step.channel === \"email\") {\n const resolvedPreview = step.previewText\n ? applyMergeFields(step.previewText, contact.firstName, contact.companyName)\n : undefined;\n return {\n channel: \"email\",\n subject: prefix + applyMergeFields(step.subject ?? \"\", contact.firstName, contact.companyName),\n html: bodyToHtml(resolvedBody + EMAIL_OPTOUT, resolvedPreview),\n };\n }\n return { channel: \"sms\", text: prefix + resolvedBody + SMS_OPTOUT };\n}\n\n// ---- facts / decision types -------------------------------------------------------------------\n\ntype ApptFact = {\n id: string;\n startTime: number; // epoch ms\n endTime: number; // epoch ms\n appointmentStatus: string;\n deleted: boolean;\n};\n\ntype OppFact = {\n id: string;\n pipelineId: string;\n pipelineStageId: string;\n monetaryValue: number;\n status: string;\n};\n\ntype ContactFact = {\n id: string;\n firstName: string;\n companyName: string | null;\n dnd: boolean;\n noEmail?: boolean; // R37: contact has no email address at all; email steps skip DELIBERATELY\n noPhone?: boolean; // R39: same, for SMS. Its absence was the spin. See reachability.ts.\n};\n\ntype Facts = {\n now: number;\n contact: ContactFact;\n opportunities: OppFact[];\n pupTalkAppt: ApptFact | null;\n declinedSignal: boolean;\n hasUnansweredInboundReply: boolean;\n conversationCheckFailed: boolean;\n // v1.5 R27 — epoch ms of the newest outbound message on this contact's thread that this engine did\n // NOT send, or null when there is none / it cannot be told apart from ours. See sendGate.\n foreignOutboundAt: number | null;\n // v1.6 R28 — per-channel consent, read from GHL's dndSettings. true = this channel is opted out.\n channelBlocked: { email: boolean; sms: boolean };\n optOutRequested?: boolean; // R39 — an inbound body matched an opt-out keyword. reachability.ts.\n optOutScope?: OptOutScope; // v1.13 — which channel they named, if any. Classified, not yet acted on.\n};\n\ntype Decision =\n | { kind: \"hard_exit\"; status: \"done_hard_exit\" | \"done_customer\" | \"done_booked\" | DeadLetterStatus; reason: string }\n | { kind: \"pause_reply\"; isNewPause: boolean }\n | { kind: \"advance_status\"; status: \"awaiting_appt_outcome\" | \"branch_a\" | \"branch_b\" | \"slow_track\"; branchAnchorAt?: string }\n | { kind: \"soft_exit_21d\" }\n | { kind: \"branch_complete\" }\n | { kind: \"send\"; sequence: \"main\" | \"branch_a\" | \"branch_b\" | \"slow\"; stepIndex: number }\n | { kind: \"skip_step\"; sequence: \"main\" | \"branch_a\" | \"branch_b\" | \"slow\"; stepIndex: number; reason: string }\n | { kind: \"skip\"; reason: string };\n\n// v1.7 — slow template for a progression index AT a moment. Weekly/fortnightly fixed by index;\n// monthly picked by the send's calendar month (July=heat, Dec=holidays — as promised to Kim).\n// Shared by decideAction AND the executor so decided and sent templates cannot drift.\nfunction slowTemplateAt(sentCount: number, nowMs: number, lastSentId?: string | null): { tpl: MessageTemplate; offsetHours: number; phase: string } {\n // v1.7.1 — clamp garbage counters (NaN/negative/string blobs) instead of letting an out-of-range\n // index fall through to \"send monthly now\"; monthly fallback only ever fires in the monthly phase.\n const clean = Math.max(0, Math.floor(Number(sentCount)) || 0);\n const n = nextSlowTouch(clean);\n const tpl = n.phase === \"monthly\" ? monthlyTemplateAvoidingRepeat(new Date(nowMs), lastSentId) : n.template!;\n return { tpl, offsetHours: n.offsetHours, phase: n.phase };\n}\n\nfunction pickPrimaryOpportunity(opps: OppFact[]): OppFact | null {\n return opps.find((o) => o.pipelineId === MAIN_PIPELINE_ID) ?? opps[0] ?? null;\n}\n\n// \"Live\" = not cancelled, not invalid, not soft-deleted. Anything else (new / confirmed / showed /\n// noshow) counts as \"they booked\" for rule 6's purposes — the outcome gets sorted out by rules 7/8.\nfunction apptIsLiveBooked(appt: ApptFact | null): boolean {\n if (!appt || appt.deleted) return false;\n return appt.appointmentStatus !== \"cancelled\" && appt.appointmentStatus !== \"invalid\";\n}\n\n// v1.11 - the gate's question is not rule 6's: a FINISHED appointment is a reason to follow up, not\n// to stay quiet. Receipt + reasoning: NOTES-v1.11.md. Pinned: tests/enrolment-gate.test.mjs.\nfunction apptIsUpcomingBooking(appt: ApptFact | null, nowMs: number): boolean {\n if (!apptIsLiveBooked(appt)) return false;\n if (/showed|noshow|no[-_\\s]?show|completed/i.test(appt!.appointmentStatus)) return false; // over\n return appt!.startTime > nowMs;\n}\n\n// ---- the core state machine (spec §5). Pure, first-match-wins, same order every pass. NOTES v1.10.\nfunction channelBar(f: Facts, ch: \"email\" | \"sms\"): string | null {\n const gone = missingChannel(f.contact, ch); // R37/R39: no address at all, either channel\n if (gone) return gone;\n if (f.channelBlocked[ch]) return `opted out of ${ch}`;\n return null;\n}\n\nfunction decideAction(f: Facts, s: PuppyState): Decision {\n // Rule 1 + 2 — DND / unsubscribed. Top-level `dnd` = full opt-out, hard exit here. Since v1.6\n // (R28) per-channel opt-outs in `dndSettings` are ALSO read — not here, but as f.channelBlocked,\n // which skip-consumes steps on a blocked channel while the other channel carries on. Both layers\n // are live; this rule is the total-stop one.\n if (f.contact.dnd) {\n return { kind: \"hard_exit\", status: \"done_hard_exit\", reason: \"dnd\" };\n }\n\n // Rules 1b/1c (v1.9) — said stop in words / no way to reach them at all. BELOW rule 1 and ABOVE\n // rule 3, deliberately; both orderings are pinned by tests. Full reasoning in reachability.ts.\n { const rx = reachabilityExit(f); if (rx) return rx; }\n\n const primaryOpp = pickPrimaryOpportunity(f.opportunities);\n\n // Rule 3 — Disqualified stage (human override, outranks everything below it).\n if (primaryOpp?.pipelineStageId === STAGE.DISQUALIFIED) {\n return { kind: \"hard_exit\", status: \"done_hard_exit\", reason: \"disqualified\" };\n }\n\n // Rule 4 — became a paying customer. v1.2: scans ALL opportunities, not just primary (fuzz\n // round finding; full note in NOTES-v1.4.md).\n const becameCustomer = f.opportunities.some(\n (o) => o.pipelineStageId === STAGE.CUSTOMER || o.pipelineStageId === STAGE.WON_PAID || o.monetaryValue > 0,\n );\n if (becameCustomer) {\n return { kind: \"hard_exit\", status: \"done_customer\", reason: \"became a customer\" };\n }\n\n // Rule 4b — booked something else entirely (Free Training Day). NOT an explicit numbered r\n // (full note moved to NOTES-v1.4.md when this file hit val.town's 80,000-char ceiling)\n if (primaryOpp?.pipelineStageId === STAGE.FREE_TRAINING_DAY) {\n return { kind: \"hard_exit\", status: \"done_booked\", reason: \"booked Free Training Day — sequence ends per writing sheet §4\" };\n }\n\n // Rule 5 — inbound reply pending, or: couldn't check at all (fail closed — see header gap #1).\n // conversationCheckFailed must be checked BEFORE hasUnansweredInboundReply: an unreadable signal is\n // never treated as \"confirmed no reply,\" because that would let sends continue for someone who may\n // well have replied — exactly the failure this rule exists to prevent.\n if (f.conversationCheckFailed) {\n return { kind: \"skip\", reason: \"conversation check failed (live API scope gap) — not sending until resolved\" };\n }\n if (f.hasUnansweredInboundReply) {\n // Keeps matching every run; the SIDE EFFECT fires once, via isNewPause. NOTES-v1.11.md.\n return { kind: \"pause_reply\", isNewPause: s.status !== \"paused_reply\" };\n }\n\n // Rule 6 — a live Pup Talk booking -> awaiting_appt_outcome. Scoped to the Pup Talk calendar\n // (branch copy is Pup-Talk-specific; FTD handled by 4b; full note in NOTES-v1.4.md).\n // v1.7.1 — the slow arm requires the appointment to POSTDATE slow entry (mirrors 6b): a stale\n // historical appointment must not yank a taper contact into branch copy.\n if (s.status === \"main\" && apptIsLiveBooked(f.pupTalkAppt)) {\n return { kind: \"advance_status\", status: \"awaiting_appt_outcome\" };\n }\n if (\n s.status === \"slow_track\" && f.pupTalkAppt && apptIsLiveBooked(f.pupTalkAppt) &&\n f.pupTalkAppt.startTime > new Date(s.slowAnchorAt ?? s.enteredAt).getTime()\n ) {\n return { kind: \"advance_status\", status: \"awaiting_appt_outcome\" };\n }\n\n // Rule 6b (v1.2) — REBOOKED while in a branch. Found independently by the adversarial revi\n // (full note moved to NOTES-v1.4.md when this file hit val.town's 80,000-char ceiling)\n if (\n (s.status === \"branch_a\" || s.status === \"branch_b\") &&\n f.pupTalkAppt &&\n apptIsLiveBooked(f.pupTalkAppt) &&\n s.branchAnchorAt &&\n f.pupTalkAppt.startTime > new Date(s.branchAnchorAt).getTime()\n ) {\n return { kind: \"advance_status\", status: \"awaiting_appt_outcome\" };\n }\n\n // Rule 7 — awaiting -> branch_a (missed): time passed, no show, no cancel. NOTES has the full table.\n if (\n s.status === \"awaiting_appt_outcome\" && s.slowAnchorAt && f.pupTalkAppt &&\n f.pupTalkAppt.appointmentStatus === \"cancelled\"\n ) {\n return { kind: \"advance_status\", status: \"slow_track\" };\n }\n\n if (\n s.status === \"awaiting_appt_outcome\" &&\n f.pupTalkAppt &&\n f.now >= f.pupTalkAppt.endTime &&\n f.pupTalkAppt.appointmentStatus !== \"showed\" &&\n f.pupTalkAppt.appointmentStatus !== \"cancelled\"\n ) {\n return {\n kind: \"advance_status\",\n status: \"branch_a\",\n branchAnchorAt: new Date(f.pupTalkAppt.endTime).toISOString(),\n };\n }\n\n // Rule 8 — awaiting -> branch_b (showed, then declined). declinedSignal NOT CONFIRMED LIVE\n // (header gap #2); branchAnchorAt uses \"now\" per spec's fallback.\n if (\n s.status === \"awaiting_appt_outcome\" &&\n f.pupTalkAppt &&\n f.pupTalkAppt.appointmentStatus === \"showed\" &&\n f.declinedSignal\n ) {\n return { kind: \"advance_status\", status: \"branch_b\", branchAnchorAt: new Date(f.now).toISOString() };\n }\n\n // Rule 9 — 21-day completion. Gated on message 8 having actually SENT, not elapsed time alone\n // (else this outranks rule 10 on the very run msg 8 becomes due and it never sends —\n // NOTES-v1.4.md). Stage never auto-moved; that is Kim's call.\n if (\n s.status === \"main\" &&\n s.lastMainStepSent >= MAIN_SEQUENCE.length &&\n f.now >= new Date(s.enteredAt).getTime() + 21 * DAY_MS\n ) {\n return { kind: \"soft_exit_21d\" };\n }\n\n // Rule 9b — branch exhausted -> done_branch_complete (the type's own terminal; a contact must\n // not sit re-evaluated forever with nothing left to send). NOTES-v1.4.md.\n if (s.status === \"branch_a\" && s.lastBranchStepSent >= BRANCH_A.length) {\n return { kind: \"branch_complete\" };\n }\n if (s.status === \"branch_b\" && s.lastBranchStepSent >= BRANCH_B.length) {\n return { kind: \"branch_complete\" };\n }\n\n // Rule 10 — otherwise, send whatever's next due. v1.1: a due step additionally waits for the send\n // window (inSendWindow). v1.2: and for the per-contact min-gap floor — after an outage, several\n // overdue steps space out ~2h apart instead of one per cron tick. Every deferral leaves state\n // untouched, so a later run simply picks it up.\n const sendGate = (channel: Channel): { ok: boolean; reason: string } => {\n const w = inSendWindow(channel, f.now);\n if (!w.ok) return w;\n if (s.lastSentAt) {\n const gapMs = minSendGapHours() * HOUR_MS;\n const sinceLast = f.now - new Date(s.lastSentAt).getTime();\n // v1.7 — sinceLast >= 0 guard (mirrors R27): a future-dated lastSentAt (clock skew, restored\n // blob) must not freeze the contact until that future date; negative elapsed = ignore the gap.\n if (sinceLast >= 0 && sinceLast < gapMs) {\n return { ok: false, reason: `min send gap (${minSendGapHours()}h) not elapsed — last send ${(sinceLast / HOUR_MS).toFixed(1)}h ago` };\n }\n }\n // v1.9 — exponential backoff after a failed send: 2^failures hours. See reachability.ts.\n { const bo = backoffBar(s, f.now); if (bo) return { ok: false, reason: bo }; }\n // R27 (v1.5) — FOREIGN-SENDER QUIET PERIOD: an outbound newer than ours means another system\n // owns this contact right now; stand down. Fails OPEN. Full rationale: NOTES-v1.4.md.\n if (f.foreignOutboundAt != null) {\n const quietMs = foreignQuietHours() * HOUR_MS;\n const since = f.now - f.foreignOutboundAt;\n if (since >= 0 && since < quietMs) {\n return {\n ok: false,\n reason: `another system messaged this contact ${(since / HOUR_MS).toFixed(1)}h ago — quiet period ${foreignQuietHours()}h`,\n };\n }\n }\n return { ok: true, reason: \"\" };\n };\n if (s.status === \"main\" && s.lastMainStepSent < MAIN_SEQUENCE.length) {\n const step = MAIN_SEQUENCE[s.lastMainStepSent];\n if (isDue(step.offsetHours, s.enteredAt, f.now)) {\n const g = sendGate(step.channel);\n if (!g.ok) return { kind: \"skip\", reason: `main #${s.lastMainStepSent + 1} due but deferred: ${g.reason}` };\n const br = channelBar(f, step.channel);\n if (br) {\n return { kind: \"skip_step\", sequence: \"main\", stepIndex: s.lastMainStepSent, reason: `${br} — step consumed, not sent` };\n }\n return { kind: \"send\", sequence: \"main\", stepIndex: s.lastMainStepSent };\n }\n return { kind: \"skip\", reason: `next main step (#${s.lastMainStepSent + 1}) not due yet` };\n }\n if (s.status === \"branch_a\" && s.lastBranchStepSent < BRANCH_A.length && s.branchAnchorAt) {\n const step = BRANCH_A[s.lastBranchStepSent];\n if (isDue(step.offsetHours, s.branchAnchorAt, f.now)) {\n const g = sendGate(step.channel);\n if (!g.ok) return { kind: \"skip\", reason: `branch A step due but deferred: ${g.reason}` };\n { const br = channelBar(f, step.channel);\n if (br) return { kind: \"skip_step\", sequence: \"branch_a\", stepIndex: s.lastBranchStepSent, reason: `${br} — step consumed, not sent` }; }\n return { kind: \"send\", sequence: \"branch_a\", stepIndex: s.lastBranchStepSent };\n }\n return { kind: \"skip\", reason: \"next branch A step not due yet\" };\n }\n if (s.status === \"branch_b\" && s.lastBranchStepSent < BRANCH_B.length && s.branchAnchorAt) {\n const step = BRANCH_B[s.lastBranchStepSent];\n if (isDue(step.offsetHours, s.branchAnchorAt, f.now)) {\n const g = sendGate(step.channel);\n if (!g.ok) return { kind: \"skip\", reason: `branch B step due but deferred: ${g.reason}` };\n { const br = channelBar(f, step.channel);\n if (br) return { kind: \"skip_step\", sequence: \"branch_b\", stepIndex: s.lastBranchStepSent, reason: `${br} — step consumed, not sent` }; }\n return { kind: \"send\", sequence: \"branch_b\", stepIndex: s.lastBranchStepSent };\n }\n return { kind: \"skip\", reason: \"next branch B step not due yet\" };\n }\n\n // v1.7 — Rule 10s: slow track. Indefinite by design, so no exhaustion exit — the exits are the\n // rules above (reply, booking, customer, DND). Anchor falls back to enteredAt if a legacy blob\n // lands here without slowAnchorAt.\n if (s.status === \"slow_track\") {\n const sentCount = Math.max(0, Math.floor(Number(s.lastSlowStepSent)) || 0);\n const anchor = s.slowAnchorAt ?? s.enteredAt;\n const { tpl, offsetHours, phase } = slowTemplateAt(sentCount, f.now, s.lastSentStepId);\n if (isDue(offsetHours, anchor, f.now)) {\n const g = sendGate(tpl.channel);\n if (!g.ok) return { kind: \"skip\", reason: `slow #${sentCount + 1} (${phase}) due but deferred: ${g.reason}` };\n const sbr = channelBar(f, tpl.channel);\n if (sbr) {\n return { kind: \"skip_step\", sequence: \"slow\", stepIndex: sentCount, reason: `${sbr} — slow step consumed, not sent` };\n }\n return { kind: \"send\", sequence: \"slow\", stepIndex: sentCount };\n }\n return { kind: \"skip\", reason: `next slow touch (#${sentCount + 1}, ${phase}) not due yet` };\n }\n\n return { kind: \"skip\", reason: `status ${s.status} has nothing to evaluate` };\n}\n\n// Pure, no IO. The ONE place PuppyState transitions are written, by cron AND the harness, so tested\n// and shipped behaviour cannot drift. Full note: NOTES-v1.4.md R39.\nfunction applyDecision(decision: Decision, s: PuppyState, nowIso: string): PuppyState {\n const next: PuppyState = { ...s, lastCheckedAt: nowIso };\n switch (decision.kind) {\n case \"hard_exit\":\n next.status = decision.status;\n next.exitReason = decision.reason;\n return next;\n case \"pause_reply\":\n next.status = \"paused_reply\";\n if (decision.isNewPause) {\n next.pausedForReplyAt = nowIso;\n next.exitReason = \"human reply pending\";\n }\n return next;\n case \"advance_status\":\n next.status = decision.status;\n if (decision.branchAnchorAt) next.branchAnchorAt = decision.branchAnchorAt;\n // v1.2 — a branch always restarts at its first message. Why: NOTES-v1.4.md R39.\n if (decision.status === \"branch_a\" || decision.status === \"branch_b\") next.lastBranchStepSent = 0;\n // v1.7.1 — returning to slow_track (cancelled booking) keeps slowAnchorAt and\n // lastSlowStepSent untouched: the taper resumes where it left off.\n return next;\n case \"soft_exit_21d\":\n // v1.7 — 21-day completion now hands the contact to the slow track (Kim's taper);\n // done_soft_21d remains in the type for legacy blobs only.\n next.status = \"slow_track\";\n next.slowAnchorAt = nowIso;\n next.lastSlowStepSent = 0;\n next.exitReason = \"21-day sequence complete — moved to slow track\";\n return next;\n case \"branch_complete\":\n next.status = \"done_branch_complete\";\n next.exitReason = \"branch sequence complete, no reply\";\n return next;\n case \"send\":\n if (decision.sequence === \"main\") next.lastMainStepSent = s.lastMainStepSent + 1;\n else if (decision.sequence === \"slow\") next.lastSlowStepSent = (s.lastSlowStepSent ?? 0) + 1;\n else next.lastBranchStepSent = s.lastBranchStepSent + 1;\n next.lastSentAt = nowIso; // v1.2 — feeds the min-gap pacing floor\n return next;\n case \"skip_step\":\n // v1.6 R28 — the step is consumed, not deferred. Deferring a step whose channel the contact\n // has opted out of would stall that contact forever on a message that can never legally send.\n // lastSentAt is deliberately NOT set: nothing went out, so nothing should start the pacing clock.\n if (decision.sequence === \"main\") next.lastMainStepSent = s.lastMainStepSent + 1;\n else if (decision.sequence === \"slow\") next.lastSlowStepSent = (s.lastSlowStepSent ?? 0) + 1;\n else next.lastBranchStepSent = s.lastBranchStepSent + 1;\n return next;\n case \"skip\":\n return next;\n }\n}\n\n// ---- blob state (dynamic import, see Node/tsx shim note above) ------------------------------------\n\nasync function getBlobModule() {\n // Dynamic, not static, so this file's pure logic imports under Node+tsx. Why: NOTES-v1.4.md R39.\n // @ts-expect-error — remote Deno URL specifier; unresolvable (by design) under tsc/Node's module\n // resolution, only ever actually imported at runtime inside a real Deno/val.town environment.\n const mod = await import(\"https://esm.town/v/std/blob\");\n return (mod as any).blob;\n}\n\nasync function loadAllState(): Promise> {\n const blob = await getBlobModule();\n return (await blob.getJSON(\"puppy_state\").catch(() => null)) ?? {};\n}\nasync function saveAllState(state: Record) {\n const blob = await getBlobModule();\n await blob.setJSON(\"puppy_state\", state);\n}\n// v1.8.2. Each run records its own timestamp so the dashboard can report the cadence it OBSERVES\n// rather than one a human typed. See cadence.ts for why, and for the shared shape.\nasync function saveReport(report: any) {\n const blob = await getBlobModule();\n let history: string[] = [];\n try {\n history = appendRunStamp(await blob.getJSON(\"puppy_run_state\").catch(() => null),\n typeof report?.ts === \"string\" ? report.ts : new Date().toISOString());\n } catch { /* bookkeeping is a nicety; never fail a run over it */ }\n await blob.setJSON(\"puppy_run_state\", { ...(report as object), history });\n}\nasync function saveLastError(err: unknown) {\n const blob = await getBlobModule();\n await blob.setJSON(\"puppy_last_error\", err);\n}\n\n// ---- v1.1: journal + summary ----------------------------------------------------------------------\n\ntype JournalRow = { ts: string; contactId: string | null; event: string; detail: string; test?: boolean };\n\n// Appends this run's rows and returns the full merged journal (capped at the newest 2000 rows) so the\n// caller can build the summary from complete history without a second blob read.\nasync function appendJournal(rows: JournalRow[]): Promise {\n const blob = await getBlobModule();\n const existing: JournalRow[] = (await blob.getJSON(\"puppy_journal\").catch(() => null)) ?? [];\n const merged = [...existing, ...rows].slice(-2000);\n if (rows.length) await blob.setJSON(\"puppy_journal\", merged);\n return merged;\n}\n\n// Pure — aggregate the numbers Kim's eventual 30-day report needs. Journal-derived counts\n// (bookedDuringPath, customersDuringPath, sendsByStep) survive state pruning; state-derived counts\n// reflect the current population.\nfunction buildSummary(\n state: Record,\n journal: JournalRow[],\n lastRun: { at: string; testMode: boolean; sent: number; failed: number; enrolled: number },\n) {\n const byStatus: Record = {};\n for (const s of Object.values(state)) byStatus[s.status] = (byStatus[s.status] ?? 0) + 1;\n const sendsByStep: Record = {};\n let bookedDuringPath = 0;\n let customersDuringPath = 0;\n let pausedForHuman = 0;\n let surgeHolds = 0;\n for (const r of journal) {\n if (r.event === \"sent\") sendsByStep[r.detail] = (sendsByStep[r.detail] ?? 0) + 1;\n else if (r.event === \"advance_status\" && r.detail === \"awaiting_appt_outcome\") bookedDuringPath++;\n else if (r.event === \"hard_exit\" && r.detail === \"became a customer\") customersDuringPath++;\n else if (r.event === \"pause_reply\") pausedForHuman++;\n else if (r.event === \"enrollment_surge_hold\") surgeHolds++;\n }\n return {\n at: lastRun.at,\n v: \"1.2\",\n lastRun,\n activeByStatus: byStatus,\n totalTracked: Object.keys(state).length,\n sendsByStep,\n bookedDuringPath,\n customersDuringPath,\n pausedForHuman,\n surgeHolds,\n ...failureCounts(journal, byStatus), // v1.9 — send_failed was journalled and counted by nothing\n };\n}\n\nasync function saveSummary(summary: unknown) {\n const blob = await getBlobModule();\n await blob.setJSON(\"puppy_summary\", summary);\n}\n\n// Pure — v1.1 state hygiene: drop terminal entries untouched for 60+ days. History stays in the\n// journal; the puppy-path-v1 tag still prevents re-enrollment of a pruned contact.\nfunction pruneState(state: Record, nowMs: number): { kept: Record; prunedIds: string[] } {\n const kept: Record = {};\n const prunedIds: string[] = [];\n for (const [id, s] of Object.entries(state)) {\n const stale = TERMINAL_STATUSES.has(s.status) && nowMs - new Date(s.lastCheckedAt).getTime() > 60 * DAY_MS;\n if (stale) prunedIds.push(id);\n else kept[id] = s;\n }\n return { kept, prunedIds };\n}\n\n// Pure — v1.1 enrollment gate (header addendum #1/#2). Given this run's un-enrolled tag matches,\n// decide who enrolls. Over-threshold = bulk-tag accident suspected: enroll nobody, hold until a human\n// clears it (ACKNOWLEDGE_SURGE=true) or the candidate count drops back under the threshold.\nfunction selectEnrollable(\n candidates: T[],\n surgeThreshold: number,\n surgeAcknowledged: boolean,\n): { enroll: T[]; surgeHeld: boolean } {\n if (candidates.length > surgeThreshold && !surgeAcknowledged) {\n return { enroll: [], surgeHeld: true };\n }\n return { enroll: candidates, surgeHeld: false };\n}\n\n// ---- IO layer: GHL reads --------------------------------------------------------------------------\n\nasync function getContact(contactId: string): Promise {\n const r = await j(`${GHL}/contacts/${contactId}`, \"2021-07-28\");\n return r.contact;\n}\n\nasync function getOpenOpportunities(contactId: string): Promise {\n const r = await j(`${GHL}/opportunities/search?location_id=${LOC}&contact_id=${contactId}&limit=10`, \"2021-07-28\");\n return (r.opportunities ?? []).map((o: any) => ({\n id: o.id,\n pipelineId: o.pipelineId,\n pipelineStageId: o.pipelineStageId,\n monetaryValue: o.monetaryValue ?? 0,\n status: o.status,\n }));\n}\n\n// ---- v1.3 (2 Aug 2026) — R19: THE ENROLMENT-SCAN QUOTA FIX -----------------------------\n// (full note moved to NOTES-v1.4.md when this file hit val.town's 80,000-char ceiling)\nconst EXIT_STAGES = [\n \"fd821b4e-bbe6-44de-b754-fa80e4823616\", // Customer\n \"ae173310-f8b1-4399-acb7-ef1fc03d3697\", // Won - Paid\n \"38826f17-1d0e-4bac-b53e-349b67c2c79d\", // Disqualified\n \"43ea02b4-529b-4063-b638-447414d603d2\", // Free Training Day\n];\n\nasync function fetchExitOppIndex(): Promise | null> {\n const index = new Map();\n try {\n for (const stage of EXIT_STAGES) {\n let after: any = null, afterId: any = null, pages = 0;\n while (pages < 12) { // hard ceiling: a runaway page-walk must never be the thing that breaks a run\n let u = `${GHL}/opportunities/search?location_id=${LOC}&pipeline_id=${MAIN_PIPELINE_ID}` +\n `&pipeline_stage_id=${stage}&limit=100`;\n if (after != null) u += `&startAfter=${after}&startAfterId=${afterId}`;\n const r = await j(u, \"2021-07-28\");\n const ops = r.opportunities ?? [];\n if (!ops.length) break;\n for (const o of ops) {\n if (!o.contactId) continue;\n const fact: OppFact = {\n id: o.id,\n pipelineId: o.pipelineId,\n pipelineStageId: o.pipelineStageId,\n monetaryValue: o.monetaryValue ?? 0,\n status: o.status,\n };\n const prev = index.get(o.contactId);\n if (prev) prev.push(fact); else index.set(o.contactId, [fact]);\n }\n pages++;\n after = r.meta?.startAfter; afterId = r.meta?.startAfterId;\n if (!after) break;\n }\n }\n return index;\n } catch {\n // Fail to null, never to an empty map. An empty map would read as \"nobody is a customer\" and\n // could enrol someone who has already bought — the exact mistake this check exists to prevent.\n // Null makes the caller fall back to the per-contact read it used before.\n return null;\n }\n}\n\n// v1.1 (header addendum #5): the Pup Talk calendar's ±90d window holds ~143 events (measured live\n// 27 Jul); fetching it per contact re-downloaded all of them for every active contact every run.\n// Now: one fetch per run, indexed by contactId, latest non-deleted event per contact.\nasync function fetchPupTalkApptIndex(): Promise> {\n const now = Date.now();\n const windowStart = now - 90 * DAY_MS; // look back far enough to still catch a recently-missed appt\n const windowEnd = now + 90 * DAY_MS;\n const r = await j(\n `${GHL}/calendars/events?locationId=${LOC}&calendarId=${PUP_TALK_CALENDAR_ID}&startTime=${windowStart}&endTime=${windowEnd}`,\n \"2021-04-15\",\n );\n const index = new Map();\n for (const e of r.events ?? []) {\n if (!e.contactId || e.deleted) continue;\n const fact: ApptFact = {\n id: e.id,\n startTime: new Date(e.startTime).getTime(),\n endTime: new Date(e.endTime).getTime(),\n appointmentStatus: e.appointmentStatus,\n deleted: !!e.deleted,\n };\n const prev = index.get(e.contactId);\n if (!prev || fact.startTime > prev.startTime) index.set(e.contactId, fact);\n }\n return index;\n}\n\n// See header gap #1. Fails closed: any error, or a response shape this code doesn't recognize, is\n// reported as conversationCheckFailed=true — never silently treated as \"no reply.\"\nasync function getReplyStatus(\n contactId: string,\n enteredAtIso: string,\n st?: PuppyState,\n): Promise {\n // v1.5 R27: lastOutboundAt rides along on the SAME request that rule 5 already makes — the collision\n // guard costs zero extra API calls. It is the conversation's own lastMessageDate, returned only when\n // that last message was outbound; the caller decides whether it was ours.\n let lastOutboundAt: number | null = null;\n try {\n const r = await j(`${GHL}/conversations/search?locationId=${LOC}&contactId=${contactId}&limit=1`, \"2021-07-28\");\n const convo = (r.conversations ?? [])[0];\n if (!convo) return { hasUnansweredInboundReply: false, conversationCheckFailed: false, lastOutboundAt };\n // v1.9 — opt-out words + delivery status, hung off the conversation this call already fetched.\n const rx = await convoExtras(convo, st, j, GHL, Date.now());\n {\n const d = convo.lastMessageDirection ?? convo.direction ?? null;\n const ts = convo.lastMessageDate ?? convo.lastMessageDateTime ?? null;\n if (d === \"outbound\" && ts != null) {\n const n = new Date(ts).getTime();\n if (!Number.isNaN(n)) lastOutboundAt = n;\n }\n }\n // Field name NOT independently proven this session (the 401 blocked confirming it) — tryin\n // (full note moved to NOTES-v1.4.md when this file hit val.town's 80,000-char ceiling)\n const direction = convo.lastMessageDirection ?? convo.direction ?? null;\n if (direction !== \"inbound\" && direction !== \"outbound\") {\n return { hasUnansweredInboundReply: false, conversationCheckFailed: true, lastOutboundAt, ...rx };\n }\n // v1.4 R21 — unreadCount is the second signal; outbound does not clear it. NOTES-v1.4.md R21.\n const unread = Number(convo.unreadCount ?? 0);\n if (direction === \"outbound\") {\n if (unread > 0) {\n return { hasUnansweredInboundReply: true, conversationCheckFailed: false, lastOutboundAt, ...rx };\n }\n return { hasUnansweredInboundReply: false, conversationCheckFailed: false, lastOutboundAt, ...rx };\n }\n const lastTsRaw = convo.lastMessageDate ?? convo.lastMessageDateTime ?? convo.dateUpdated ?? null;\n const lastTs = lastTsRaw != null ? new Date(lastTsRaw).getTime() : NaN;\n if (!Number.isNaN(lastTs) && lastTs < new Date(enteredAtIso).getTime()) {\n // Pre-enrollment history — EXCEPT if it is still unread, in which case somebody wrote in and\n // nobody has answered them, which outranks how old it is.\n if (Number(convo.unreadCount ?? 0) > 0) return { hasUnansweredInboundReply: true, conversationCheckFailed: false, lastOutboundAt, ...rx };\n return { hasUnansweredInboundReply: false, conversationCheckFailed: false, lastOutboundAt, ...rx };\n }\n return { hasUnansweredInboundReply: true, conversationCheckFailed: false, lastOutboundAt, ...rx };\n } catch {\n return { hasUnansweredInboundReply: false, conversationCheckFailed: true, lastOutboundAt };\n }\n}\n\n// ---- orchestration: cron() (default export — the val.town entry point) ----------------------------\n\nexport default async function cron() {\n // R38: re-resolved first so every later read this pass agrees. See NOTES R38.\n TEST_MODE = resolveMode(Deno.env.get(\"TEST_MODE\"), await (await getBlobModule()).getJSON(\"puppy_mode\").catch(() => null));\n // v1.13 — send.ts starts in practice mode and stays there until this line runs. It is deliberately\n // the FIRST thing after the mode is known: a send attempted before it throws rather than delivers.\n configureSend(TEST_MODE);\n const out: any = {\n ok: true,\n v: \"1.13.0\", // IO layer -> send.ts; 3.4k of headroom back. Bump this WITH the change, never after.\n\n ts: new Date().toISOString(), // v1.2 — lets the watchdog's staleness check actually work\n testMode: TEST_MODE,\n enrolled: 0,\n sent: 0,\n failed: 0,\n skipped: 0,\n log: [] as string[],\n };\n const journal: JournalRow[] = [];\n const jrow = (contactId: string | null, event: string, detail: string) =>\n journal.push({ ts: new Date().toISOString(), contactId, event, detail, ...(TEST_MODE ? { test: true } : {}) });\n // v1.2 - best-effort run lock, no compare-and-swap on blob storage. NOTES-v1.11.md.\n const blob = await getBlobModule();\n\n // ---- KILL SWITCH (v1.3). Checked first; fails OPEN. Full note in NOTES-v1.4.md.\n try {\n const kill = await blob.getJSON(\"nurture_kill\").catch(() => null);\n if (kill?.stopped) {\n out.ok = true;\n out.killed = true;\n out.log.push(`STOPPED by kill switch (set ${kill.at ?? \"unknown\"}) — no contact examined this tick`);\n await blob.setJSON(\"puppy_run_state\", out).catch(() => {});\n console.log(\"PUPPYPATH\", JSON.stringify(out));\n return out;\n }\n } catch { /* fail open — see note above */ }\n\n const lock = await blob.getJSON(\"puppy_run_lock\").catch(() => null);\n if (lock?.startedAt && Date.now() - new Date(lock.startedAt).getTime() < RUN_LOCK_TTL_MS) {\n out.log.push(`another run appears active (lock from ${lock.startedAt}) — skipping this tick`);\n console.log(\"PUPPYPATH\", JSON.stringify(out));\n return out;\n }\n await blob.setJSON(\"puppy_run_lock\", { startedAt: new Date().toISOString() }).catch(() => {});\n\n try {\n const state = await loadAllState();\n // v1.2 — existing journal loaded up front: the daily send cap counts today's already-journaled\n // live sends, so the ceiling holds across runs, not just within one.\n const priorJournal: JournalRow[] = (await blob.getJSON(\"puppy_journal\").catch(() => null)) ?? [];\n const todayPrefix = new Date().toISOString().slice(0, 10);\n let sentToday = priorJournal.filter(\n (r) => (r.event === \"sent\" || r.event === \"send_failed\") && r.ts.slice(0, 10) === todayPrefix && !r.test,\n ).length; // v1.9 — ATTEMPTS, not successes: failures were uncapped and cost the same GHL calls\n // v1.1 (addendum #5): one calendar fetch per run, shared by enrollment guard + per-contact facts.\n // R33: wrapped; one 401 used to abort the whole run before any contact was seen.\n let apptIndex: Map;\n try {\n apptIndex = await fetchPupTalkApptIndex();\n } catch (e) {\n apptIndex = new Map();\n out.log.push(`appt index unavailable, continuing without it: ${String((e as Error)?.message ?? e).slice(0, 120)}`);\n }\n let contactIds: string[];\n // v1.2 — opportunities fetched during enrollment eligibility are reused when the same contact is\n // processed later in this run, instead of a redundant second API call.\n const oppsCache = new Map();\n let skippedNotDue = 0; // v1.4 — how many contacts cost zero API calls this run\n // v1.9 — the effects the reachability helpers write through. task is null in practice mode.\n const fctx: Effects = { state, save: saveAllState, log: (l) => out.log.push(l), journal: jrow, task: TEST_MODE ? null : createTask };\n\n // v1.9 — THE DRY TAGGING PASS. Runs in BOTH modes on purpose; applies nothing, ever.\n // Full note, including why it was dead for three deploys: NOTES-v1.4.md, \"the dry tagging pass\".\n try {\n const recent = await j(`${GHL}/contacts/?locationId=${LOC}&limit=100`, \"2021-07-28\");\n await blob.setJSON(\"tag_candidates\", dryScan(recent?.contacts ?? [], new Date().toISOString()));\n } catch { /* a dry scan is never worth failing a run over */ }\n\n if (TEST_MODE) {\n // Spec §8: skip real discovery entirely, operate ONLY on the one sanctioned dummy.\n const dummy = await resolveTestDummy();\n contactIds = [dummy.id];\n if (!state[dummy.id]) {\n state[dummy.id] = freshState(new Date().toISOString());\n await addTag(dummy.id, TAG_ENROLLED).catch((e) =>\n out.log.push(`tag failed on dummy: ${String(e).slice(0, 120)}`)\n );\n out.enrolled++;\n out.log.push(`TEST_MODE: enrolled dummy ${dummy.id}`);\n jrow(dummy.id, \"enrolled\", \"test dummy\");\n }\n } else {\n // v1.1 enrollment: the source tag is the HUMAN enrollment switch. Blocks only what makes\n // enrollment WRONG (existing customer, live booking). DND enforced by rule 1 first pass.\n // Surge hold guards bulk tagging — selectEnrollable. Full note: NOTES-v1.4.md.\n const found = await j(`${GHL}/contacts/search`, \"2021-07-28\", {\n method: \"POST\",\n body: JSON.stringify({\n locationId: LOC,\n pageLimit: 100,\n filters: [{ field: \"tags\", operator: \"contains_set\", value: [TAG_SOURCE_SIGNAL] }],\n }),\n });\n // v1.2 — surface pagination truncation instead of silently ignoring candidates beyond page 1\n // (only reachable when a human pushes a >100 bulk batch through with ACKNOWLEDGE_SURGE).\n const totalTagged = found.total ?? (found.contacts ?? []).length;\n if (totalTagged > (found.contacts ?? []).length) {\n out.log.push(\n `WARNING: ${totalTagged} contacts carry '${TAG_SOURCE_SIGNAL}' but only ${(found.contacts ?? []).length} ` +\n `fit one page — the rest enroll on later runs as earlier ones get the puppy-path-v1 tag`,\n );\n }\n // v1.10 — a dead letter Kim has fixed and re-tagged comes back. reEnrollable, reachability.ts.\n const rawCandidates: any[] = (found.contacts ?? []).filter(\n (c: any) => !(c.tags ?? []).includes(TAG_ENROLLED) && (!state[c.id] || reEnrollable(state[c.id], c)),\n );\n const surgeThreshold = enrollSurgeThreshold();\n const { enroll, surgeHeld } = selectEnrollable(rawCandidates, surgeThreshold, acknowledgeSurge());\n if (surgeHeld) {\n out.log.push(\n `ENROLLMENT SURGE HELD: ${rawCandidates.length} un-enrolled '${TAG_SOURCE_SIGNAL}' contacts found in one run ` +\n `(threshold ${surgeThreshold}) — bulk tagging suspected, enrolling NOBODY until a human clears it ` +\n `(remove the bulk tags, or set ACKNOWLEDGE_SURGE=true). Already-enrolled contacts continue normally.`,\n );\n jrow(null, \"enrollment_surge_hold\", `${rawCandidates.length} candidates vs threshold ${surgeThreshold}`);\n }\n // v1.3 / R19 — one indexed read for the whole candidate set instead of one call each.\n const exitOppIndex = enroll.length ? await fetchExitOppIndex() : null;\n if (enroll.length) {\n out.log.push(\n exitOppIndex\n ? `exit-opp index built (${exitOppIndex.size} contacts across ${EXIT_STAGES.length} stages) — ${enroll.length} candidate(s) screened without per-contact calls`\n : `exit-opp index unavailable — falling back to per-contact reads for ${enroll.length} candidate(s)`,\n );\n }\n for (const c of enroll) {\n let opps: OppFact[];\n if (exitOppIndex) {\n opps = exitOppIndex.get(c.id) ?? [];\n } else {\n await sleep(120); // v1.2 — pacing: GHL fails 401/403 (not 429) over 100 req/10s\n opps = await getOpenOpportunities(c.id);\n }\n oppsCache.set(c.id, opps);\n // Across ALL opportunities, not just primary — spec's \"no opportunity showing Customer/Won-Paid\"\n // reading, and the account's own one-opportunity-per-contact rule makes this a cheap superset.\n const alreadyCustomer = opps.some(\n (o) => o.pipelineStageId === STAGE.CUSTOMER || o.pipelineStageId === STAGE.WON_PAID || o.monetaryValue > 0,\n );\n if (alreadyCustomer) { // v1.10 — TERMINAL, like the unreachable branch below: rule 4 would\n // hard-exit them on the first pass anyway, and without a state entry this refusal repeated\n // every run forever. NOT done_customer: api.ts counts that as WON. NOTES v1.10.\n state[c.id] = { ...freshState(new Date().toISOString()), status: \"done_not_enrolled\", exitReason: \"already a customer when tagged\" };\n out.log.push(`${c.id}: tagged but already a customer — not enrolled`);\n jrow(c.id, \"enroll_refused\", \"already a customer\");\n continue;\n }\n const appt = apptIndex.get(c.id) ?? null;\n // v1.11 — UPCOMING, not merely \"booked at some point\". See apptIsUpcomingBooking.\n if (appt && apptIsUpcomingBooking(appt, Date.now())) { const R = \"live booking already exists\";\n // v1.10 — TRANSIENT: the booking may be cancelled, so this must stay re-evaluated and can\n // get no state entry. The repetition is stopped at the journal instead. NOTES v1.10.\n out.log.push(`${c.id}: tagged but ${R} — not enrolled`);\n if (!refusedBefore(priorJournal, c.id, R)) jrow(c.id, \"enroll_refused\", R);\n continue;\n }\n { const eb = enrolmentBar(c); if (eb) { // v1.9 — unreachable. The terminal entry, NOT the\n // tag (they were never on the path), is what stops this refusal repeating every run.\n state[c.id] = { ...freshState(new Date().toISOString()), status: \"done_unreachable\", exitReason: eb };\n out.log.push(`${c.id}: tagged but ${eb} — not enrolled`); jrow(c.id, \"enroll_refused\", eb); continue; } }\n state[c.id] = freshState(new Date().toISOString());\n await addTag(c.id, TAG_ENROLLED).catch((e) => out.log.push(`tag failed on ${c.id}: ${String(e).slice(0, 120)}`));\n out.enrolled++;\n out.log.push(`enrolled ${c.id}`);\n jrow(c.id, \"enrolled\", `via tag '${TAG_SOURCE_SIGNAL}'`);\n }\n contactIds = Object.keys(state);\n }\n\n for (const contactId of contactIds) {\n let s = state[contactId];\n if (!s || TERMINAL_STATUSES.has(s.status)) continue;\n\n // v1.2 — paused_reply contacts get a LIGHTWEIGHT safety pass instead of v1.1's full skip.\n // (full note moved to NOTES-v1.4.md when this file hit val.town's 80,000-char ceiling)\n if (s.status === \"paused_reply\") {\n // v1.4 R22 — the pause timeout, and why it does not resume: NOTES-v1.4.md R22.\n const pausedSince = s.pausedForReplyAt ? new Date(s.pausedForReplyAt).getTime() : null;\n if (pausedSince && Date.now() - pausedSince > pauseTimeoutDays() * DAY_MS) {\n const days = Math.floor((Date.now() - pausedSince) / DAY_MS);\n try {\n if (!TEST_MODE) {\n await createTask(\n contactId,\n `Still waiting on us — replied ${days} days ago, nobody has answered`,\n `This person replied to a follow-up message ${days} days ago. The sequence stopped for them at the time and raised a task, and that task has not been actioned.\\n\\nOpen Conversations, read what they said, and answer it. They are being taken off the automated follow-up either way — they asked a person a question and they deserve a person's answer.`,\n );\n }\n } catch (e) {\n out.log.push(`${contactId}: pause-timeout task failed: ${String(e).slice(0, 100)}`);\n }\n state[contactId] = {\n ...s,\n status: \"done_hard_exit\",\n exitReason: `paused for ${days} days with no human response — escalated and released`,\n lastCheckedAt: new Date().toISOString(),\n };\n out.log.push(`${contactId}: paused ${days}d with no action — escalated, exited`);\n jrow(contactId, \"pause_timeout\", `${days} days unanswered`);\n continue;\n }\n try {\n await sleep(120);\n const contact = await getContact(contactId);\n if (!contact) continue;\n const opportunities = oppsCache.get(contactId) ?? (await getOpenOpportunities(contactId));\n // v1.10 — the paused STOP. No state arg: nothing to reconcile here. NOTES v1.10.\n const pr = await getReplyStatus(contactId, s.enteredAt);\n const facts: Facts = {\n now: Date.now(),\n contact: { id: contactId, firstName: contact.firstName ?? \"\", companyName: contact.companyName ?? null, dnd: !!contact.dnd, noEmail: !contact.email, noPhone: !contact.phone },\n opportunities,\n pupTalkAppt: apptIndex.get(contactId) ?? null,\n declinedSignal: (contact.tags ?? []).includes(PUP_TALK_DECLINED_TAG),\n hasUnansweredInboundReply: false,\n optOutRequested: pr.optOutRequested, // rule 1b outranks rule 5, so this is still reachable\n conversationCheckFailed: true, // pinned: no send can ever pass rule 5 on this pass\n channelBlocked: readChannelConsent(contact),\n foreignOutboundAt: null, // no conversation was fetched on this path; rule 5 blocks sends anyway\n };\n const d = decideAction(facts, s);\n const nowIso = new Date().toISOString();\n if (d.kind === \"hard_exit\") {\n const v = pickPrimaryOpportunity(opportunities)?.monetaryValue ?? 0;\n state[contactId] = { ...applyDecision(d, s, nowIso), exitValue: v, exitStepsSent: s.lastMainStepSent + s.lastBranchStepSent + (s.lastSlowStepSent ?? 0) };\n out.log.push(`${contactId}: paused contact hard-exited -> ${d.status} (${d.reason})`);\n jrow(contactId, \"hard_exit\", `${d.reason}${v ? ` | value ${v}` : \"\"}`);\n await honourOptOut(contactId, facts, TEST_MODE, j, GHL, fctx);\n } else {\n state[contactId] = { ...s, lastCheckedAt: nowIso };\n }\n } catch (err) {\n out.log.push(`${contactId}: paused-pass FAILED: ${String(err).slice(0, 120)}`);\n }\n continue;\n }\n\n // v1.4 R19b DUE-FIRST FILTERING: nothing due = ask the CRM nothing. Two valves stop cheap\n // becoming blind: SAFETY_SWEEP_HOURS, and any unmodelled status. Full note: NOTES-v1.4.md.\n\n const dueCheck = (() => {\n try {\n if (s.status === \"main\") {\n if (s.lastMainStepSent >= MAIN_SEQUENCE.length) return { due: true, why: \"sequence complete, needs exit evaluation\" };\n const next = MAIN_SEQUENCE[s.lastMainStepSent];\n if (isDue(next.offsetHours, s.enteredAt, Date.now())) return { due: true, why: `main step ${s.lastMainStepSent + 1} due` };\n return { due: false, why: `main step ${s.lastMainStepSent + 1} not due yet` };\n }\n if ((s.status === \"branch_a\" || s.status === \"branch_b\") && s.branchAnchorAt) {\n const seq = s.status === \"branch_a\" ? BRANCH_A : BRANCH_B;\n if (s.lastBranchStepSent >= seq.length) return { due: true, why: \"branch complete, needs exit evaluation\" };\n const next = seq[s.lastBranchStepSent];\n if (isDue(next.offsetHours, s.branchAnchorAt, Date.now())) return { due: true, why: \"branch step due\" };\n return { due: false, why: \"branch step not due yet\" };\n }\n // v1.7.1 — slow_track modelled too: the taper population only grows (non-terminal by\n // design), and without this every taper contact cost a full 3-call CRM check every 15\n // minutes for months of \"not due yet\". The daily safety sweep still catches exits.\n if (s.status === \"slow_track\") {\n const c = Math.max(0, Math.floor(Number(s.lastSlowStepSent)) || 0);\n if (isDue(nextSlowTouch(c).offsetHours, s.slowAnchorAt ?? s.enteredAt, Date.now())) return { due: true, why: `slow touch ${c + 1} due` };\n return { due: false, why: `slow touch ${c + 1} not due yet` };\n }\n return { due: true, why: \"status not modelled by the shortcut — full check\" };\n } catch {\n return { due: true, why: \"due-check threw — full check\" };\n }\n })();\n\n const lastChecked = s.lastCheckedAt ? new Date(s.lastCheckedAt).getTime() : 0;\n const sweepOverdue = Date.now() - lastChecked > safetySweepHours() * HOUR_MS;\n\n if (!dueCheck.due && !sweepOverdue) {\n state[contactId] = { ...s, lastCheckedAt: s.lastCheckedAt };\n out.skipped++;\n skippedNotDue++;\n continue; // zero API calls for this contact this run\n }\n\n try {\n await sleep(120); // v1.2 — pacing between contacts (GHL: 100 req/10s, breach = 401/403 not 429)\n const contact = await getContact(contactId);\n if (!contact) {\n out.log.push(`${contactId}: contact not found, skipping`);\n continue;\n }\n const opportunities = oppsCache.get(contactId) ?? (await getOpenOpportunities(contactId));\n const pupTalkAppt = apptIndex.get(contactId) ?? null;\n const declinedSignal = (contact.tags ?? []).includes(PUP_TALK_DECLINED_TAG);\n const reply = await getReplyStatus(contactId, s.enteredAt, s);\n // v1.9 — settle the PREVIOUS send first: a 2xx from GHL meant \"queued\", never \"delivered\".\n { const dl = await onDeliveryStatus(contactId, s, reply.deliveryStatus, fctx);\n if (dl) { s = dl.s; if (dl.stop) { out.failed++; continue; } } }\n\n const facts: Facts = {\n now: Date.now(),\n contact: {\n id: contactId,\n firstName: contact.firstName ?? \"\",\n companyName: contact.companyName ?? null,\n dnd: !!contact.dnd,\n noEmail: !contact.email,\n noPhone: !contact.phone, // R39 — getContact already fetched it and threw it away\n },\n opportunities,\n pupTalkAppt,\n declinedSignal,\n hasUnansweredInboundReply: reply.hasUnansweredInboundReply,\n conversationCheckFailed: reply.conversationCheckFailed,\n // v1.5 R27 — was that last outbound ours or somebody else's? Ours iff it lands within\n // OURS_TOLERANCE_MS of our own recorded send. No lastSentAt yet (nothing sent to this\n // contact) means any outbound on the thread is definitionally foreign.\n channelBlocked: readChannelConsent(contact),\n optOutRequested: reply.optOutRequested,\n optOutScope: reply.optOutScope,\n foreignOutboundAt: (() => {\n const lo = reply.lastOutboundAt;\n if (lo == null) return null;\n if (!s.lastSentAt) return lo;\n const ours = new Date(s.lastSentAt).getTime();\n if (Number.isNaN(ours)) return lo;\n return Math.abs(lo - ours) <= OURS_TOLERANCE_MS ? null : lo;\n })(),\n };\n\n const decision = decideAction(facts, s);\n const nowIso = new Date().toISOString();\n\n switch (decision.kind) {\n case \"hard_exit\": {\n // v1.4 — R24: capture what this exit was worth, at the only moment the number is knowable.\n const exitVal = pickPrimaryOpportunity(opportunities)?.monetaryValue ?? 0;\n const stepsSent = s.lastMainStepSent + s.lastBranchStepSent + (s.lastSlowStepSent ?? 0);\n state[contactId] = {\n ...applyDecision(decision, s, nowIso),\n exitValue: exitVal,\n exitStepsSent: stepsSent,\n };\n out.log.push(`${contactId}: hard exit -> ${decision.status} (${decision.reason})${exitVal ? ` | value ${exitVal}` : \"\"}`);\n jrow(contactId, \"hard_exit\", `${decision.reason}${exitVal ? ` | value ${exitVal} after ${stepsSent} message(s)` : \"\"}`);\n await honourOptOut(contactId, facts, TEST_MODE, j, GHL, fctx);\n await noteScopedOptOut(contactId, facts, TEST_MODE, fctx, createTask); // v1.13, reachability.ts\n break;\n }\n\n case \"pause_reply\":\n state[contactId] = applyDecision(decision, s, nowIso);\n if (decision.isNewPause) {\n jrow(contactId, \"pause_reply\", \"inbound reply detected — handed to a human\");\n const title = `Reply from ${facts.contact.firstName || \"contact\"} re: puppy path — read and respond personally`;\n try {\n await createTask(\n contactId,\n title,\n \"Auto-created by puppy-path-engine: an inbound reply was detected; the sequence is paused for this contact until a human responds.\",\n );\n out.log.push(`${contactId}: paused (new reply), task created`);\n } catch (e) {\n out.log.push(`${contactId}: paused (new reply), TASK CREATE FAILED: ${String(e).slice(0, 120)}`);\n }\n } else {\n out.log.push(`${contactId}: still paused (reply already flagged, no duplicate task)`);\n }\n break;\n\n case \"advance_status\":\n state[contactId] = applyDecision(decision, s, nowIso);\n out.log.push(`${contactId}: advanced -> ${decision.status}`);\n // \"awaiting_appt_outcome\" here means: they booked a Pup Talk while in the sequence —\n // the attributable event the summary counts as bookedDuringPath.\n jrow(contactId, \"advance_status\", decision.status);\n break;\n\n case \"soft_exit_21d\":\n state[contactId] = applyDecision(decision, s, nowIso);\n try {\n await createTask(\n contactId,\n `Puppy path finished for ${facts.contact.firstName || \"contact\"} — now on the slow track`,\n `Puppy path finished for ${facts.contact.firstName || \"contact\"}, no reply/booking. They are now on the slow track (occasional helpful messages: weekly for a month, then fortnightly, then monthly — no sales asks). Nothing needed unless you want them moved in the pipeline too; the stage was NOT auto-moved — that's Kim's call.`,\n );\n } catch (e) {\n out.log.push(`${contactId}: soft-exit task FAILED: ${String(e).slice(0, 120)}`);\n }\n out.log.push(`${contactId}: 21d complete — moved to slow track (stage NOT moved)`);\n jrow(contactId, \"soft_exit_21d\", \"21-day sequence complete — moved to slow track\");\n break;\n\n case \"branch_complete\":\n state[contactId] = applyDecision(decision, s, nowIso);\n out.log.push(`${contactId}: branch complete`);\n jrow(contactId, \"branch_complete\", s.status);\n break;\n\n case \"send\": {\n // v1.2 — blast ceilings (mirrors the PupsClub val's precedent). A capped send is a pure\n // deferral: state untouched, the step stays due, later runs drain the backlog gradually.\n if (out.sent + out.failed >= maxSendsPerRun()) {\n out.skipped++;\n out.log.push(`${contactId}: send due but MAX_SENDS_PER_RUN (${maxSendsPerRun()}) reached — deferred`);\n break;\n }\n if (!TEST_MODE && sentToday >= maxSendsPerDay()) {\n out.skipped++;\n out.log.push(`${contactId}: send due but MAX_SENDS_PER_DAY (${maxSendsPerDay()}) reached — deferred to tomorrow`);\n break;\n }\n const step = decision.sequence === \"slow\"\n ? slowTemplateAt(decision.stepIndex, Date.now(), s.lastSentStepId).tpl\n : (decision.sequence === \"main\" ? MAIN_SEQUENCE : decision.sequence === \"branch_a\" ? BRANCH_A : BRANCH_B)[decision.stepIndex];\n // v1.7.1 — consent re-checked against the template actually being sent: a monthly\n // re-resolution at the UTC month boundary can flip template (and channel) between\n // decision and execution; an opted-out channel must win that race.\n { const rbr = decision.sequence === \"slow\" ? channelBar(facts, step.channel) : null;\n if (rbr) {\n out.skipped++;\n out.log.push(`${contactId}: slow step resolved to barred ${step.channel} at send time (${rbr}) — skipped, not consumed`);\n break;\n } }\n const rendered = renderStep(\n step,\n {\n firstName: facts.contact.firstName,\n companyName: facts.contact.companyName,\n // Both arms, because both end in the same place: no email ever arrives.\n noEmail: !!facts.contact.noEmail || !!facts.channelBlocked?.email,\n },\n { testMode: TEST_MODE },\n );\n try {\n const resp = rendered.channel === \"sms\"\n ? await sendSms(contactId, rendered.text)\n : await sendEmail(contactId, rendered.subject, rendered.html);\n // v1.2 — state persisted IMMEDIATELY after each successful send (a mid-run crash\n // must never re-send). Non-send transitions recompute idempotently. NOTES-v1.4.md.\n state[contactId] = { ...applyDecision(decision, s, nowIso), ...sendReceipt(resp, rendered.channel) };\n await saveAllState(state).catch((e) =>\n out.log.push(`${contactId}: sent OK but state persist failed (will retry at end): ${String(e).slice(0, 100)}`),\n );\n // v1.4 — R23: position is an array index, so inserting a message re-points everyone\n // mid-sequence with no signal. Recording the step ID makes that drift DETECTABLE.\n\n // v1.7 — slow records template id; R23 drift check stays main-only (slow's monthly\n // index-to-id mapping varies by design).\n const seqNow = decision.sequence === \"main\" ? MAIN_SEQUENCE : decision.sequence === \"branch_a\" ? BRANCH_A : decision.sequence === \"branch_b\" ? BRANCH_B : null;\n const sentStepId = decision.sequence === \"slow\" ? step.id : (seqNow?.[decision.stepIndex]?.id ?? null);\n if (s.lastSentStepId && sentStepId && seqNow) {\n const prevIdx = seqNow.findIndex((x) => x.id === s.lastSentStepId);\n if (prevIdx >= 0 && prevIdx !== decision.stepIndex - 1 && decision.sequence === \"main\") {\n out.log.push(`${contactId}: SEQUENCE DRIFT — last sent ${s.lastSentStepId} now sits at index ${prevIdx}, expected ${decision.stepIndex - 1}. The copy has been edited underneath in-flight contacts.`);\n jrow(contactId, \"sequence_drift\", `${s.lastSentStepId} -> index ${prevIdx}`);\n }\n }\n state[contactId] = { ...state[contactId], lastSentStepId: sentStepId };\n out.sent++;\n if (!TEST_MODE) sentToday++;\n out.log.push(`${contactId}: sent ${decision.sequence} step ${decision.stepIndex + 1} (${rendered.channel})`);\n jrow(contactId, \"sent\", `${decision.sequence}#${decision.stepIndex + 1} (${rendered.channel === \"sms\" ? \"text\" : \"email\"})`);\n } catch (e) {\n out.failed++;\n if (!TEST_MODE) sentToday++; // a failed attempt spent the same GHL call as a send\n await onSendFailure(contactId, s, e, `${decision.sequence}#${decision.stepIndex + 1}`, fctx);\n }\n break;\n }\n\n case \"skip_step\":\n // v1.6 R28 / v1.9 — this step's channel is opted out OR has no address at all. Consumed,\n // not deferred, so the sequence carries on; journalled, because a message that silently\n // never went out is what nobody notices until a customer asks why they never heard back.\n state[contactId] = applyDecision(decision, s, nowIso);\n out.skipped++;\n out.log.push(`${contactId}: ${decision.reason}`);\n // v1.13 — no address is NOT an opt-out. Kim's page showed Lisa Price as opted out.\n jrow(contactId, /opted out of/.test(decision.reason ?? \"\") ? \"skip_step_channel_optout\" : \"skip_step_no_address\", decision.reason);\n break;\n\n case \"skip\":\n // Still runs through applyDecision (a no-op on every field except lastCheckedAt) so \"last\n // time this contact was actually looked at\" stays accurate per spec §4's schema comment.\n state[contactId] = applyDecision(decision, s, nowIso);\n out.skipped++;\n // R37: deferral reasons logged; \"not due\" stays silent (skippedNotDue counts it).\n if (!/not due/.test(decision.reason)) {\n out.log.push(`${contactId}: ${decision.reason}`);\n jrow(contactId, \"deferred\", decision.reason.slice(0, 120));\n }\n break;\n }\n } catch (err) {\n out.failed++;\n out.log.push(`${contactId}: FAILED: ${String(err).slice(0, 150)}`);\n // v1.4 — this catch used to write to out.log only, and out.log is not persisted to the\n // journal. So a contact failing here was invisible to the dashboard, which reads the journal.\n // Every failure now leaves a row.\n jrow(contactId, \"contact_failed\", String(err).slice(0, 100));\n }\n }\n\n // v1.1: prune stale terminal entries (their history lives on in the journal), persist everything,\n // then rebuild the aggregate summary from full journal + surviving state.\n out.skippedNotDue = skippedNotDue;\n if (skippedNotDue) out.log.push(`${skippedNotDue} contact(s) not due — zero API calls spent on them`);\n const { kept, prunedIds } = pruneState(state, Date.now());\n for (const id of prunedIds) jrow(id, \"pruned\", \"terminal 60+ days, removed from state (journal retains history)\");\n if (prunedIds.length) out.log.push(`pruned ${prunedIds.length} stale terminal entries`);\n await saveAllState(kept);\n const fullJournal = await appendJournal(journal);\n await saveSummary(\n buildSummary(kept, fullJournal, {\n at: new Date().toISOString(),\n testMode: TEST_MODE,\n sent: out.sent,\n failed: out.failed,\n enrolled: out.enrolled,\n }),\n ).catch((e) => out.log.push(`summary save failed: ${String(e).slice(0, 100)}`));\n await saveReport(out);\n await blob.setJSON(\"puppy_run_lock\", { startedAt: null }).catch(() => {}); // release lock\n // Holiday deposits: once an hour, LAST, fully caught, read-only. Why it hangs off this\n // schedule rather than its own file is in NOTES-v1.4.md under \"deposit refresh\".\n try {\n const dep = await import(\"./deposits.ts\");\n await dep.refreshIfDue(() => blob.getJSON(dep.ATTEMPT_KEY) as any, () => dep.runCollection(false, \"engine\"), Date.now());\n } catch (e) { console.log(\"deposits refresh skipped\", String(e).slice(0, 120)); }\n console.log(\"PUPPYPATH\", JSON.stringify(out));\n return out;\n } catch (err) {\n out.ok = false;\n out.error = String(err);\n await saveLastError({ at: new Date().toISOString(), error: String(err) }).catch(() => {});\n // v1.2 — even on a crashed run, persist whatever state mutations happened before the crash\n // (sends already persisted individually; this catches transitions) and the journal rows.\n await saveReport(out).catch(() => {});\n await appendJournal(journal).catch(() => {});\n await blob.setJSON(\"puppy_run_lock\", { startedAt: null }).catch(() => {});\n console.log(\"PUPPYPATH\", JSON.stringify(out));\n return out;\n }\n}\n\n// ---- booking-link shortener (spec §7) --------------------------------------------------\n// (full note moved to NOTES-v1.4.md when this file hit val.town's 80,000-char ceiling)\nexport async function bookingRedirect(_req: Request): Promise {\n return Response.redirect(REAL_BOOKING_URL, 302);\n}\n\n// ---- exports for the local test harness (puppy-path-engine.test.ts) -------------------------------\n\nexport {\n decideAction,\n applyDecision,\n renderStep,\n resolveDogName,\n resolveFirstName,\n applyMergeFields,\n isDue,\n freshState,\n pickPrimaryOpportunity,\n apptIsLiveBooked,\n apptIsUpcomingBooking,\n bodyToHtml,\n // v1.1 pure additions\n businessLocalParts,\n inSendWindow,\n selectEnrollable,\n buildSummary,\n pruneState,\n MAIN_SEQUENCE,\n BRANCH_A,\n BRANCH_B,\n STAGE,\n MAIN_PIPELINE_ID,\n TAG_ENROLLED,\n TAG_SOURCE_SIGNAL,\n PUP_TALK_DECLINED_TAG,\n PHONE_DISPLAY,\n REAL_BOOKING_URL,\n SHORT_BOOKING_LINK,\n TERMINAL_STATUSES,\n DAY_MS,\n HOUR_MS,\n TEST_MODE,\n // v1.7 — slow track\n slowTemplateAt,\n nextSlowTouch,\n monthlyTemplateFor,\n};\n// v1.8 — story machinery + taper banks re-exported for the offline harness\nexport { readChannelConsent } from \"./consent.ts\";\nexport * from \"./reachability.ts\";\nexport { STORY_SLOTS, resolveStories, storyFor } from \"./kim-stories.ts\";\nexport { SLOW_WEEKLY, SLOW_FORTNIGHTLY, SLOW_MONTHLY_BANK } from \"./taper-messages.ts\";\nexport type { PuppyState, PuppyStatus, Facts, Decision, ContactFact, OppFact, ApptFact, MessageTemplate, RenderedMessage };\n",[370],"245ad811-33e0-43df-8360-236ebfb6905e","kim-stories.ts","789b1fbc-901e-11f1-980a-1607ee4eb77e",129,["D",1785901696927],"// KIM'S STORIES — the one file that makes the taper personal. v1.8, 4 Aug 2026.\n//\n// THE RULE THIS FILE EXISTS TO ENFORCE: no invented stories, ever. No fictional dogs, no\n// composite customers, no \"a client once told me\". Every `story` below starts as null and stays\n// null until KIM'S OWN WORDS go in. The copy is written to read complete without them — an\n// empty slot renders as nothing, not as a hole.\n//\n// HOW TO FILL ONE IN (the whole procedure, ~5 minutes):\n// 1. Kim answers a question from the Story Capture Sheet (handover/Story-Capture-Sheet.pdf).\n// 2. Paste her answer, lightly tidied but in her words, as the `story` string below.\n// Keep it to 2-4 sentences. First person. No customer surnames without her okay.\n// 3. PUT this one file to the val (same deploy command as always). Nothing else changes.\n// 4. The next send that hits that slot carries her story. Practice mode renders it too,\n// so it can be checked on the panel/journal before anyone real sees it.\n//\n// Slots are ADDITIVE paragraphs: the template holds {{STORY:id}} on its own line; the renderer\n// swaps in the story, or removes the line entirely when null. Both paths are tested.\n\nexport type StorySlot = {\n id: string;\n // The question that gets a usable answer from Kim in 30 seconds — printed on the capture sheet.\n prompt: string;\n // Where it lands, so a human editing this file knows the context without opening the copy file.\n lands: string;\n // Kim's words, or null. Null = the message sends without it and reads complete.\n story: string | null;\n};\n\nexport const STORY_SLOTS: StorySlot[] = [\n {\n id: \"teenage\",\n prompt: \"Name one dog who turned into a teenage terror around 8 months and came good. What did the owner stick with?\",\n lands: \"Slow track week 1 — the adolescence email\",\n story: null,\n },\n {\n id: \"alone_time\",\n prompt: \"Tell me about one dog who couldn't be left alone at first. What actually fixed it?\",\n lands: \"Slow track day 63 — the alone-time email\",\n story: null,\n },\n {\n id: \"vet_visits\",\n prompt: \"Which dog do you know who walks into the vet happy? What did their owner do differently?\",\n lands: \"Slow track day 70 — the vet visits email\",\n story: null,\n },\n {\n id: \"settle\",\n prompt: \"One dog you can picture lying calmly somewhere busy (a patio, a game, a store). How did they get there?\",\n lands: \"Slow track day 119 — the off-switch email\",\n story: null,\n },\n {\n id: \"dog_parks\",\n prompt: \"One thing you've seen go wrong at a dog park that the owner never noticed. What should they have seen?\",\n lands: \"Slow track day 147 — the dog parks email\",\n story: null,\n },\n {\n id: \"nose_work\",\n prompt: \"Name a dog who was 'bad' until they got a job to do. What was the job?\",\n lands: \"Slow track day 175 — the boredom email\",\n story: null,\n },\n {\n id: \"leash_meetings\",\n prompt: \"Which pair of dogs hated each other on leash but got along fine off it, or walking side by side?\",\n lands: \"Slow track day 203 — the leash meetings email\",\n story: null,\n },\n {\n id: \"holidays\",\n prompt: \"What's one thing that happens at the kennel every Thanksgiving or Christmas that owners would never guess?\",\n lands: \"Monthly November — the holiday guests email\",\n story: null,\n },\n];\n\nconst byId = new Map(STORY_SLOTS.map((s) => [s.id, s]));\n\n// Anything SHAPED like a slot token but not a slot we know: an empty id `{{STORY:}}`, a spaced id\n// `{{STORY: a b }}`, the residue a nested token leaves behind after its inner half resolves. None of\n// these is a slot, so none of them is content. They get removed, never shipped.\n// [was: a single pass matching only /\\{\\{STORY:[a-z_]+\\}\\}/, which left `{{STORY:}}` standing\n// after resolving the inner token of `{{STORY:{{STORY:x}}}}`. Caught by tests/stories.test.mjs S5.]\nconst TOKEN_SHAPE = /\\{\\{STORY:[^{}]*\\}\\}/g;\n// Last line of defence: even a half-token fragment must not reach a customer.\nconst TOKEN_FRAGMENT = /\\{\\{STORY:[^}]*\\}{0,2}/g;\n\n// story text, or null. Trims whitespace so a pasted answer can't break the layout.\nexport function storyFor(id: string): string | null {\n const s = byId.get(id)?.story;\n if (!s) return null;\n // A pasted answer can't smuggle a slot token back in (single-pass resolve would ship it raw).\n const t = s.replace(TOKEN_FRAGMENT, \"\").trim();\n return t.length ? t : null;\n}\n\n// Resolve every {{STORY:id}} token in a rendered body. Unknown ids resolve to nothing rather\n// than leaking a token to a customer — and the tests assert every id used in copy exists here.\n//\n// Resolution LOOPS rather than running once. One pass is not enough: a malformed nest only reveals\n// its outer token after the inner one is gone, and a filled story sitting next to a token can shift\n// what the next match sees. The loop is bounded (a pass that changes nothing stops it), so a\n// pathological input costs a few passes rather than hanging.\nexport function resolveStories(text: string): string {\n let out = String(text ?? \"\");\n for (let pass = 0; pass < 8 && out.includes(\"{{STORY:\"); pass++) {\n const before = out;\n out = out.replace(/\\{\\{STORY:([a-z_]+)\\}\\}/g, (_, id) => storyFor(id) ?? \"\");\n out = out.replace(TOKEN_SHAPE, \"\");\n if (out === before) break;\n }\n // Whatever survived the loop is not a slot and is not content.\n out = out.replace(TOKEN_FRAGMENT, \"\");\n return out.replace(/\\n{3,}/g, \"\\n\\n\").trim();\n}\n",[378],"b915f4d9-b531-4a8a-80fc-7aee0e4c0d03","holiday-deposits.ts","2f043ab0-91ad-11f1-9dc1-1607ee4eb77e",1132,["D",1786832221229],21,"// HOLIDAY DEPOSIT TRACKER. v1.0, 6 Aug 2026.\n//\n// WHAT KIM ASKED FOR: she charges a $50 nonrefundable deposit on boarding stays over holidays,\n// and today somebody goes through the bookings by hand to work out who has paid.\n//\n// WHAT THIS CAN AND CANNOT DO, because the difference is the whole honesty of the feature.\n// Square money DOES reach the CRM. It arrives as a note on the contact, like\n// \"[Square] +$355.00 payment tWYOxuFcG9ZqzF7GTnUPfElf2ZEZY (balance $0.00)\"\n// (verified live on 6 Aug against a real contact). So we can see payments that went through\n// Square. We CANNOT see a deposit handed over in cash or taken over the phone. That means this\n// produces a SHORTLIST TO CHECK, never a list of people who have not paid. The word \"unpaid\"\n// is banned from anything this module renders, and a test enforces that.\n//\n// TWO TRAPS FOUND IN HER REAL DATA, both of which would have made Kim chase the wrong people:\n// 1. The same Square payment is written into the notes FIVE times, and the \"(balance ...)\"\n// figures inside those duplicates contradict each other ($355.00 then $0.00 four times).\n// So: dedupe on the payment id, and never read the balance figure.\n// 2. A recurring weekly slot (\"Daycare Enzo\") lands inside every holiday window. Without a\n// recurring filter Kim would be told a regular customer owes her a holiday deposit eight\n// times over. Recurring bookings are excluded.\n//\n// THIS MODULE WRITES NOTHING. No tag, no custom field, no pipeline stage, no message. That is\n// deliberate and it is tested: addTag() elsewhere in this engine is not TEST_MODE-guarded, and\n// this account contains a workflow (\"Add tag 'red flag' = DND\") which proves a single tag here\n// can silence a real customer on six channels. A read-only report cannot do that.\n\nexport type CalEvent = {\n contactId?: string | null;\n title?: string | null;\n startTime?: string | number | null; // carries its own offset, e.g. \"2026-11-25T09:00:00-05:00\"\n // The pick-up. A stay that starts before a holiday window and runs into it is a holiday stay,\n // and without this the module could only see the drop-off day.\n endTime?: string | number | null;\n dateAdded?: string | null;\n appointmentStatus?: string | null;\n // Her CRM really does return BOTH spellings on the same object: 4 of the 13 events on the\n // Boarding Drop Off calendar carry `appoinmentStatus` alongside the correct one (checked live,\n // 6 Aug 2026). They agree today. Reading only one of them is passing a test by luck.\n appoinmentStatus?: string | null;\n isRecurring?: boolean | null;\n deleted?: boolean | null;\n};\n\n// \"direct\" = \"[Square] +$35.00 payment (balance $x)\" — money arriving\n// \"matched\" = \"[Square] Till payment $35.00 on . Matched from Square payment ...\"\n// — a RECONCILIATION record written by the backfill, carrying its own separate id.\n// Both are real and both are live in her account on the same contact, with the same amount and\n// two different ids. See collapseSameMoney() for why that distinction has to survive parsing.\nexport type Payment = { amount: number; id: string; at: string | null; kind: \"direct\" | \"matched\" };\n\nexport type Stay = {\n contactId: string;\n day: string; // local date of the drop-off, \"YYYY-MM-DD\"\n until: string; // local date of the pick-up; equals `day` when the CRM does not say\n dogs: string[]; // one stay can be several dogs (names, best effort)\n dogCount: number; // how many drop-off rows this stay is, whether or not the names parsed\n bookedAt: string | null;\n window: string; // which holiday it falls in, in Kim's words\n};\n\nexport type StayStatus = {\n stay: Stay;\n state: \"seen\" | \"partial\" | \"none_seen\" | \"could_not_check\";\n amountSeen: number;\n note: string; // the plain-English reason, always populated\n};\n\n/** The fourth Thursday of November. Computed, never typed, so it cannot drift year to year.\n * Kim was told Thanksgiving is handled by working it out fresh each year. This is that. */\nexport function thanksgiving(year: number): string {\n // day 1 of November, then walk to the first Thursday, then add three weeks.\n const first = new Date(Date.UTC(year, 10, 1));\n const dow = first.getUTCDay(); // 0 Sun .. 4 Thu\n const firstThu = 1 + ((4 - dow) + 7) % 7;\n const day = firstThu + 21;\n return `${year}-11-${String(day).padStart(2, \"0\")}`;\n}\n\n/** The windows a deposit applies to, as dates, derived rather than hardcoded.\n * Thanksgiving: the Monday before through the Sunday after.\n * Christmas and New Year: 20 Dec through 2 Jan.\n * If Kim wants different edges these are the only two lines to change. */\nexport function holidayWindows(year: number): { name: string; from: string; to: string }[] {\n const t = thanksgiving(year);\n // [was: String(Number(t.slice(8)) + 3) — decimal arithmetic on the day number. Whenever\n // Thanksgiving falls on the 28th (2030, 2041, ...) that produced \"2030-11-31\", a date that does\n // not exist. Two consequences, both live: a stay dropping off Sunday 1 December sorts ABOVE\n // \"2030-11-31\" in a string compare and vanishes from the window, and the card printed the\n // words \"Thanksgiving (Nov 25 to Nov 31)\" to Kim. Real calendar arithmetic now.]\n return [\n { name: \"Thanksgiving\", from: shiftDays(t, -3), to: shiftDays(t, 3) },\n { name: \"Christmas and New Year\", from: `${year}-12-20`, to: `${year + 1}-01-02` },\n ];\n}\n\n/** The local calendar day of an appointment. startTime carries its own offset, so the first ten\n * characters ARE the local day. Parsing it into a Date and reformatting would shift bookings\n * across midnight into or out of a window, which is how a customer gets chased by mistake.\n *\n * A NUMBER is handled separately and deliberately. Two sibling modules that read this same CRM\n * endpoint already defend against an epoch-millisecond startTime, so the shape is real. Returning\n * null for it would have dropped EVERY stay silently and stored \"no holiday stays are booked\" as\n * a fact, in November, with the kennels full. An epoch has no offset, so it is converted in the\n * business's own timezone rather than in whatever timezone the server happens to be in. */\nexport const BUSINESS_TZ = \"America/New_York\";\nexport function localDay(startTime: string | number | null | undefined): string | null {\n if (typeof startTime === \"number\" && Number.isFinite(startTime)) {\n try {\n const p = new Intl.DateTimeFormat(\"en-CA\", { timeZone: BUSINESS_TZ, year: \"numeric\", month: \"2-digit\", day: \"2-digit\" })\n .format(new Date(startTime));\n return /^\\d{4}-\\d{2}-\\d{2}$/.test(p) ? p : null;\n } catch { return null; }\n }\n if (!startTime || typeof startTime !== \"string\" || startTime.length < 10) return null;\n // A STRING ENDING IN Z IS UTC, AND ITS FIRST TEN CHARACTERS ARE NOT THE LOCAL DAY.\n //\n // The slice below is right for \"2026-11-25T21:00:00-05:00\", which carries New York's own offset.\n // It is wrong by a whole day for \"2026-11-26T02:00:00Z\", which is the same instant: every evening\n // drop-off from about 7pm Eastern reads as the NEXT calendar day. A stay on 2 January — the last\n // day of the Christmas and New Year window — moves to the 3rd, falls outside `to`, and the\n // customer silently never appears on Kim's shortlist at all. No error, no \"could not check\".\n //\n // Said plainly: this shape has NOT been seen on this endpoint. Every startTime read live on 6 and\n // 7 August carried an explicit offset. But two sibling modules already defend against an epoch\n // number from this same CRM, a Z suffix is unambiguous when it does appear, and converting it in\n // the business's own timezone costs one branch. Handling it is cheap; slicing it is wrong.\n if (/\\dZ$/.test(startTime)) {\n const t = Date.parse(startTime);\n return Number.isFinite(t) ? localDay(t) : null; // through the epoch branch, in BUSINESS_TZ\n }\n const d = startTime.slice(0, 10);\n return /^\\d{4}-\\d{2}-\\d{2}$/.test(d) ? d : null;\n}\n\n/** WHICH SEASON ARE WE IN. Passed the local date as \"YYYY-MM-DD\", never reading the clock itself,\n * so this is testable and cannot behave differently on the val than it does here.\n * On 1 January the season that matters is still LAST year's — the New Year window runs to the 2nd,\n * and a page that flips to next Thanksgiving on New Year's Day drops the stays happening that day. */\nexport function businessDay(nowIso: string): string {\n // Her business is in New York. Rolling the season over on the UTC date empties the card at 8pm\n // on 2 January, five hours before the season actually ends, while dogs are still in the kennels\n // — and the empty result then gets stored over the real one.\n try {\n const d = new Date(nowIso);\n if (isNaN(d.getTime())) return String(nowIso).slice(0, 10);\n const p = new Intl.DateTimeFormat(\"en-CA\", { timeZone: BUSINESS_TZ, year: \"numeric\", month: \"2-digit\", day: \"2-digit\" }).format(d);\n return /^\\d{4}-\\d{2}-\\d{2}$/.test(p) ? p : String(nowIso).slice(0, 10);\n } catch { return String(nowIso).slice(0, 10); }\n}\n\nexport function seasonYear(today: string): number {\n const y = Number(today.slice(0, 4));\n const md = today.slice(5, 10);\n return md <= \"01-02\" ? y - 1 : y;\n}\n\nexport function windowFor(day: string | null, windows: { name: string; from: string; to: string }[]): string | null {\n if (!day) return null;\n for (const w of windows) if (day >= w.from && day <= w.to) return w.name;\n return null;\n}\n\n/** A STAY, not a moment. Somebody who drops off on 19 December and collects on 27 December has\n * boarded over Christmas and owes the holiday deposit, but their drop-off day is outside the\n * window. Deciding membership on the drop-off day alone dropped exactly the customers a holiday\n * boarding business has most of: the ones who leave the day before they travel. */\nexport function windowForRange(from: string | null, to: string | null, windows: { name: string; from: string; to: string }[]): string | null {\n if (!from) return null;\n const end = to && to >= from ? to : from;\n for (const w of windows) if (from <= w.to && end >= w.from) return w.name;\n return null;\n}\n\n/** Which bookings count. Cancelled, deleted and recurring are all excluded, and the recurring\n * exclusion is the one that matters most: a standing weekly slot is not a holiday stay. */\nexport const DEAD_STATUSES = [\"cancelled\", \"canceled\", \"noshow\", \"no-show\", \"no show\", \"invalid\"];\nexport function eligible(e: CalEvent): boolean {\n if (!e || truthy(e.deleted)) return false;\n // [was: `e.isRecurring === true`. Her CRM has already been caught shipping the misspelled\n // `appoinmentStatus`, so trusting it to always send a real boolean here is a bet, not a fact.\n // A recurring series returned with isRecurring:\"true\" would have put a weekly daycare regular\n // on the list telling him he owes a boarding deposit.]\n if (truthy(e.isRecurring)) return false;\n // BOTH spellings are read, and either one saying cancelled is enough to drop the booking.\n // The asymmetry is deliberate: dropping a live booking means Kim is not prompted about it and\n // she notices; keeping a cancelled one means she chases a customer who already cancelled, and\n // that one she cannot take back.\n // TRIMMED, because this account demonstrably ships padded strings: \"Daycare Enzo \" and\n // \" Boarding Dropoff with Help Test\" are both real titles out of it. One trailing space on a\n // status was enough to make a cancelled booking eligible.\n const states = [e.appointmentStatus, e.appoinmentStatus].map((s) => String(s ?? \"\").trim().toLowerCase());\n // EXPORTED so a test can assert the whole list rather than the one spelling somebody thought\n // of. GHL really does emit `noshow` and `invalid`, and the American spelling is one keystroke\n // away. Letting any of them through puts a customer who cancelled on Kim's chase list, which\n // the comment above calls the mistake she cannot take back.\n const dead = DEAD_STATUSES;\n if (states.some((s) => dead.includes(s))) return false;\n if (!e.contactId) return false;\n // A DAYCARE slot is not a boarding stay and carries no boarding deposit. Until now the ONLY\n // thing keeping the weekly \"Daycare Enzo\" booking off Kim's list was its recurrence flag; a\n // one-off daycare booking in Christmas week would have been billed a $50 boarding deposit.\n // Narrowed: a title that says BOTH is a boarding booking with a note on it, and excluding\n // \"Boarding + daycare drop off with Dan Bonner\" would lose a real holiday stay.\n const title = String(e.title ?? \"\");\n if (/\\bday\\s?care\\b/i.test(title) && !/\\bboarding\\b/i.test(title)) return false;\n return true;\n}\n\n/** Her CRM's booleans are not reliably booleans. Treats \"true\"/\"TRUE\"/1 the same as true, and\n * anything else, including undefined, as false. */\nfunction truthy(v: unknown): boolean {\n if (v === true || v === 1) return true;\n return typeof v === \"string\" && v.trim().toLowerCase() === \"true\";\n}\n\n/** A dog's name out of \"Achilles — Boarding Drop Off\" style titles, best effort and never fatal. */\nexport function dogFromTitle(title: string | null | undefined): string {\n const t = (title || \"\").trim();\n if (!t) return \"\";\n // [was: split on /[—–-]/, which cut \"Jean-Luc — Boarding Drop Off\" down to \"Jean\". A hyphen\n // inside a name is not a separator; a SPACED hyphen is. Kim reads these names before phoning\n // somebody, so the wrong name here is a wrong conversation.]\n const cut = t.split(/\\s[—–-]\\s|[—–]|\\bBoarding\\b|\\bDrop\\s?off\\b/i)[0];\n return cut.trim().replace(/\\s+with\\s+.*$/i, \"\").trim();\n}\n\n/** WHERE THE END OF A STAY ACTUALLY LIVES. A drop-off appointment in her CRM is a TEN MINUTE\n * slot: \"2026-11-25T12:50 to 2026-11-25T13:00\". Its endTime is the end of the handover, not the\n * end of the boarding. The real length of the stay is on a separate Boarding Pick Up calendar —\n * Ghost and Chewy drop off on 25 November and are collected on the 28th, and only the pick-up\n * calendar says so. Without this, \"did this dog board over Christmas\" could only ever be answered\n * by the drop-off date, and everybody who leaves the day before the holiday starts was invisible.\n * The LATEST eligible pick-up on or after the drop-off wins, bounded by the customer's own next\n * booking and by MAX_STAY_DAYS. */\nexport const MAX_STAY_DAYS = 21;\nexport function attachPickups(stays: Stay[], pickups: CalEvent[]): Stay[] {\n const byContact = new Map();\n for (const p of pickups) {\n if (!eligible(p)) continue;\n const d = localDay(p.startTime);\n if (!d || !p.contactId) continue;\n const list = byContact.get(p.contactId) ?? [];\n list.push(d);\n byContact.set(p.contactId, list);\n }\n for (const list of byContact.values()) list.sort();\n // The customer's OWN next drop-off is the hard upper bound. Without it a stay reaches forward\n // and takes a pick-up belonging to a later booking: a 3-night Thanksgiving stay was rendered\n // \"Nov 25 to Dec 27\", and an ordinary 6 November boarding was dragged into a holiday window and\n // billed a deposit. [was: the EARLIEST pick-up on or after the drop-off, which was wrong the\n // other way — one dog of three going home early cut the stay short and deleted it from the\n // window entirely. Her pick-up calendar really does carry one row per dog.]\n // A stay cannot run forever. Without an upper bound an ORPHAN pick-up — and her account has\n // about twenty contacts with pick-ups and no matching drop-off — drags an out-of-season boarding\n // into a holiday window: a 6 November stay with a stray 1 February pick-up record rendered as\n // \"Nov 6 to Feb 1\" on Kim's shortlist.\n const dropDays = new Map();\n for (const s of stays) {\n const list = dropDays.get(s.contactId) ?? [];\n list.push(s.day);\n dropDays.set(s.contactId, list);\n }\n for (const list of dropDays.values()) list.sort();\n return stays.map((s) => {\n const nextDrop = (dropDays.get(s.contactId) ?? []).find((d) => d > s.day);\n // `<=` on the next drop-off, not `<`: a pick-up on the same day as the customer's next\n // booking is the END of this stay, not part of the next one. With a strict `<`, a customer\n // collecting on 27 December and re-boarding the same day lost their Christmas stay entirely.\n const cands = (byContact.get(s.contactId) ?? []).filter((d) =>\n d >= s.day && d <= shiftDays(s.day, MAX_STAY_DAYS) && (!nextDrop || d <= nextDrop));\n const cand = cands.length ? cands[cands.length - 1] : null;\n return cand && cand > s.until ? { ...s, until: cand } : s;\n });\n}\n\n/** One customer dropping three dogs on the same day is ONE stay and ONE deposit question. */\nexport function groupIntoStays(\n events: CalEvent[],\n windows: { name: string; from: string; to: string }[],\n pickups: CalEvent[] = [],\n): Stay[] {\n const by = new Map();\n for (const e of events) {\n if (!eligible(e)) continue;\n const day = localDay(e.startTime);\n const until = localDay(e.endTime) ?? day;\n if (!day) continue;\n const key = `${e.contactId}|${day}`;\n const dog = dogFromTitle(e.title);\n const existing = by.get(key);\n if (existing) {\n if (dog && !existing.dogs.includes(dog)) existing.dogs.push(dog);\n // COUNTED FROM THE ROWS, not from the names. A title that does not parse still means a dog,\n // and the deposit is charged per dog, so counting parsed names would under-charge.\n existing.dogCount++;\n // the LATEST pick-up across the dogs on this stay\n if (until && until > existing.until) existing.until = until;\n // keep the EARLIEST booking time: that is when the deposit became due\n if (e.dateAdded && (!existing.bookedAt || e.dateAdded < existing.bookedAt)) existing.bookedAt = e.dateAdded;\n } else {\n by.set(key, { contactId: e.contactId!, day, until: until ?? day, dogs: dog ? [dog] : [], dogCount: 1, bookedAt: e.dateAdded ?? null, window: \"\" });\n }\n }\n // Pick-ups are attached BEFORE the window filter, because the whole point is that a stay whose\n // drop-off falls outside a window can still run through it.\n const withEnds = attachPickups([...by.values()], pickups);\n const out: Stay[] = [];\n for (const s of withEnds) {\n const win = windowForRange(s.day, s.until, windows);\n if (win) out.push({ ...s, window: win });\n }\n return out.sort((a, b) => (a.day < b.day ? -1 : a.day > b.day ? 1 : 0));\n}\n\n/** Square payments out of contact notes, DEDUPED BY PAYMENT ID.\n * The same payment appears five times in her real data with contradictory balance figures, so\n * the balance is deliberately not read: only the amount and the payment's own id. */\nexport function parseSquarePayments(notes: { body?: string | null; dateAdded?: string | null }[] | null | undefined): Payment[] {\n const out = new Map();\n // EVERY match in EVERY note, not the first match in each.\n // [was: .exec() on each body, i.e. one payment per note. A note holding two Square lines lost\n // the second one. Every parser gap in this function fails in the same direction — less money\n // seen than was paid — and that direction is the one that puts a paying customer on the list.]\n // The amount tolerates whole dollars (\"+$50 payment\") as well as cents, and the id stops at\n // punctuation so a trailing comma cannot become part of the dedupe key.\n const DIRECT = /\\[Square\\]\\s*\\+?\\$([\\d,]+(?:\\.\\d{2})?)\\s+payment\\s+([A-Za-z0-9_-]+)/gi;\n // Format 2: the reconciliation backfill. It carries the REAL payment date in its own text,\n // which is four days earlier than the note's dateAdded on the live example, so the stated\n // date is used and the note's write time is only the fallback. The trailing punctuation after\n // the id is OPTIONAL: on a note that ENDS at the id the whole payment used to vanish.\n const MATCHED = /\\[Square\\][^[]*?Till payment\\s*\\$([\\d,]+(?:\\.\\d{2})?)\\s*on\\s*(\\d{4}-\\d{2}-\\d{2})[\\s\\S]*?Matched from Square payment\\s+([A-Za-z0-9_-]+)/gi;\n const add = (amount: number, id: string, at: string | null, kind: \"direct\" | \"matched\") => {\n if (!Number.isFinite(amount) || !id) return;\n const prev = out.get(id);\n // keep the earliest sighting of a given payment\n if (!prev || (at && prev.at && at < prev.at)) out.set(id, { amount, id, at, kind });\n else if (!prev.at) out.set(id, { amount, id, at, kind });\n };\n for (const n of notes ?? []) {\n const body = n?.body ?? \"\";\n if (!body) continue;\n for (const m of body.matchAll(MATCHED)) add(Number(m[1].replace(/,/g, \"\")), m[3], m[2], \"matched\");\n for (const m of body.matchAll(DIRECT)) add(Number(m[1].replace(/,/g, \"\")), m[2], n?.dateAdded ?? null, \"direct\");\n }\n return [...out.values()].sort((a, b) => String(a.at).localeCompare(String(b.at)));\n}\n\n/** THE SAME $35, TWICE, UNDER TWO IDS.\n * Seen live on a customer contact: a direct \"+payment\" note and a \"Till payment ... Matched from\n * on 2026-07-17. Matched from Square payment 3zu7...\". Same money or two payments? Nothing in\n * the data settles it, and the two readings disagree about whether a $50 deposit is covered.\n * So the conservative reading wins: a \"Matched from\" record of the same amount as a direct\n * payment is treated as describing that same money. Getting this wrong the other way removes a\n * person from the shortlist, and a person who is not on the shortlist is never looked at. */\n/** A CONTACT THAT LOOKS LIKE SOMEBODY TESTING THE BOOKING FORM. Kim's account holds at least two:\n * a contact literally named \"help test\" with three future boarding bookings, and a tagged\n * \"ZZTEST PuppyPath-Dummy\". This does NOT remove the row — a filter that quietly drops a real\n * customer called Mr Test is worse than a label — it flags it, so Kim knows before she picks up\n * the phone to a stranger about $50. */\nexport function looksLikeTestRecord(name: string | null | undefined): boolean {\n // \"tester\" is deliberately absent: Tester is a real surname, and this label appears on Kim's\n // screen right next to a person's name, immediately before she decides whether to phone them.\n return /\\b(test|testing|dummy|zztest|do not use|ignore)\\b/i.test(String(name ?? \"\"));\n}\n\n// 21 DAYS, and the number is not a guess. The one real pair on her account is a payment noted on\n// 31 July reconciling a till payment the backfill states was taken on 17 July: 14.6 days, because\n// the parser deliberately uses the backfill's OWN stated payment date rather than the day the note\n// was written. A fortnight would have been too tight for the only case anybody has ever seen, so\n// the bound carries about 40% headroom over it and still refuses to fold across months.\nexport const COLLAPSE_WINDOW_DAYS = 21;\nexport function collapseSameMoney(payments: Payment[]): { kept: Payment[]; collapsed: number } {\n // IDEMPOTENT, and now DATE-BOUNDED. Both properties are load-bearing.\n //\n // Idempotent [round 6]: every backfill record sharing an amount with a payment folds, so a\n // second pass finds nothing. The layers above assume that.\n //\n // Date-bounded [round 9]: a \"Matched from Square payment\" note is a reconciliation of a payment\n // near it in TIME. The one real pair on her account is four days apart; the code was folding on\n // amount alone, across the customer's whole history. $50 is precisely the amount a repeat\n // customer pays more than once in a year, so a November payment and a December till record were\n // being read as one $50 — deleting a real deposit, demoting a settled stay, and then printing\n // \"nothing unspent on file matches that amount\" and \"nothing else is unaccounted for\" about a\n // customer who had paid twice. 2.3% of generated customers. Same false sentence as round 8's\n // bug, a different door.\n //\n // The bias is unchanged and deliberate: folding keeps somebody ON the shortlist, which costs Kim\n // a glance. NOT folding a genuine duplicate would clear somebody who owes, which costs her $50\n // and she never finds out. The bound only stops folding across months, where \"same money\" stops\n // being a plausible reading at all.\n const directs = payments.filter((p) => p.kind === \"direct\");\n const kept: Payment[] = [];\n let collapsed = 0;\n for (const p of payments) {\n if (p.kind === \"matched\" && directs.some((d) => d.amount === p.amount && withinDays(d.at, p.at, COLLAPSE_WINDOW_DAYS))) {\n collapsed++;\n continue;\n }\n kept.push(p);\n }\n return { kept, collapsed };\n}\n\n/** Are two payment dates close enough to be the same money? A missing date on either side counts\n * as close: an undated record is not evidence that they are far apart. */\nexport function withinDays(a: string | null, b: string | null, days: number): boolean {\n const x = Date.parse(String(a ?? \"\")), y = Date.parse(String(b ?? \"\"));\n if (!Number.isFinite(x) || !Number.isFinite(y)) return true;\n return Math.abs(x - y) <= days * 86_400_000;\n}\n\nexport const DEPOSIT = 50;\n\n/** WHAT THIS STAY OWES. Kim's own money page, taken from her live website: \"Holiday boarding —\n * $50 PER DOG, non-refundable. Deducted from the total boarding cost at drop-off.\"\n * [was: a flat $50 per stay, with a line on the card asking Kim to tell us if it was per dog.\n * It is per dog, and it says so in her own handover pack. Jeffrey Musselwhite's three dogs on\n * 25 November owe $150, and a single $50 payment was clearing that whole stay — the silent\n * direction, where somebody who owes $100 more drops off the list and is never looked at.] */\nexport function depositDue(stay: Stay): number {\n return DEPOSIT * dogsOn(stay);\n}\nexport function dogsOn(stay: Stay): number {\n return Math.max(1, stay.dogCount || stay.dogs.length || 1);\n}\n\n/** THE ONE PLACE THAT DECIDES WHICH PAYMENTS SETTLE A STAY. Returns them, or nothing.\n *\n * This exists because the money bug has now come back FOUR times, and every time through the\n * same crack: the rule for \"is this stay settled\" and the rule for \"what did that cost\" lived in\n * two places and drifted apart. The last version cleared a stay on either one payment for the\n * full amount OR one $50 per dog, and then debited a single $50 — so a two-dog stay settled by a\n * $100 payment debited NOTHING, and the same $100 settled the customer's next stay too. Kim owed\n * $200, $100 arrived, neither row reached her shortlist. 29% of generated multi-stay customers\n * hit it.\n *\n * So there is one function. statusFor asks it what settles the stay; the allocator asks it what\n * to spend. They cannot disagree, because it is the same answer. */\nexport function qualifyingPayments(stay: Stay, payments: Payment[]): Payment[] {\n // OLDEST MONEY FIRST, and never in whatever order the array happened to arrive.\n //\n // [was: `near.find(...)` and `perDog.slice(0, dogs)` straight off the caller's array. Two things\n // came out of that, found by a property test over 841,000 shuffles on 7 August:\n // 1. The same customer, the same payments, a different array order, a different answer. There\n // is no meaningful order on this list — it is whatever the notes endpoint returned — so a\n // row could move between \"Payment on file\" and \"Worth a look\" from one hourly run to the\n // next with nothing whatsoever having changed on her account.\n // 2. Worse, it could starve a later stay. Two real $50 payments, both inside the FIRST stay's\n // window, only the later one inside the SECOND stay's window: settle the first stay with the\n // later payment and the second stay has nothing left it can reach, and reads as unpaid.\n // Settle it with the earlier one and both are correctly settled. Oldest-first is the reading\n // that matches how the money was actually spent, and it is stable.\n // Sorted by id as well as date, so two payments stamped the same second cannot swap either.]\n // A payment with no readable date sorts LAST, not first: \"oldest first\" is a claim, and an\n // undated record is not evidence that it is the oldest. DEFENSIVE ONLY, and there is no negative\n // control for it on purpose: paymentsNearStay compares (p.at || \"\").slice(0, 10) against the\n // window, \"\" is below every real date, so an undated payment is filtered out before this line\n // ever sees it. A control that cannot be made to fail is worse than no control. H86 pins the\n // reachable half of that — an undated record never qualifies for a stay at all.\n const when = (p: Payment) => {\n const t = p.at ? Date.parse(p.at) : NaN;\n return Number.isFinite(t) ? t : Number.POSITIVE_INFINITY;\n };\n const near = [...collapseSameMoney(paymentsNearStay(stay, payments)).kept]\n .sort((a, b) => when(a) - when(b) || String(a.id).localeCompare(String(b.id)));\n const due = depositDue(stay);\n const dogs = dogsOn(stay);\n const whole = near.find((p) => p.amount === due);\n if (whole) return [whole];\n const perDog = near.filter((p) => p.amount === DEPOSIT);\n return perDog.length >= dogs ? perDog.slice(0, dogs) : [];\n}\n\n// HOW A PAYMENT IS MATCHED TO A DEPOSIT, and why the answer is \"it mostly is not\".\n//\n// Nothing in her CRM says what a card payment was FOR. Two attempts at guessing have now both\n// been wrong in a way that costs her money:\n// v1 summed every payment between the booking and the drop-off. A $355 training package cleared\n// a $50 deposit, and being cleared means nobody ever looks at that customer again.\n// v2 narrowed it to ten days around the booking and still summed. That missed a real $50 paid\n// eight days later — the page said \"we cannot find a $50 payment\" one line after printing\n// one — and STILL cleared anybody who happened to settle a $240 invoice that same week.\n//\n// So this version stops guessing. It clears a stay on ONE piece of evidence only: a card payment\n// for EXACTLY the deposit amount, in a wide window around the stay. Anything else is shown to Kim\n// with its date and amount and left for her to judge, which takes her about two seconds per row\n// and is the thing she was doing by hand anyway. A wrong \"worth a look\" costs her a glance. A\n// wrong \"settled\" costs her $50 and she never finds out.\n// HOW SHE ACTUALLY GETS PAID, off her own money page: \"Card — at the counter, or through the\n// website's payments page. This is the normal route and THE ONLY ONE THAT MATCHES ITSELF TO A\n// CUSTOMER RECORD AUTOMATICALLY. Venmo — there is a Venmo page on the website. Zelle — sent to an\n// address inside the Zelle app. Cheque — made payable by post.\"\n// [was: \"may still have been paid in cash or over the phone\", which named neither of the two\n// routes she actually offers. Every one of Venmo, Zelle and cheque is invisible here, so naming\n// them is the difference between Kim knowing where to look and Kim assuming non-payment.]\n// CASH IS NOT ONE OF HER ROUTES. [was: \"Venmo, Zelle, cheque or cash\". Her money page lists\n// exactly four ways to pay — Card, Venmo, Zelle and Cheque — and cash appears nowhere on her site\n// or anywhere in the handover pack. The comment directly above this line names the three invisible\n// routes correctly and the string underneath it invented a fourth. True of cash in general,\n// invented as a thing Kim accepts, and the whole point of this sentence is telling her where else\n// to actually look.]\nexport const OTHER_ROUTES = \"A deposit paid by Venmo, Zelle or a cheque does not reach the card system, so it will not show here.\";\n// HER OTHER DEPOSIT. The same money page publishes a $250 non-refundable TRAINING deposit — which\n// is exactly what five dogs owe at $50 each. The per-dog rule widened the set of amounts that can\n// clear a stay from {$50} to {$50, $100, $150, ...}, and $250 is now in it. Nothing in the data\n// says which a $250 payment was for, so the row says so rather than quietly picking one.\nexport const TRAINING_DEPOSIT = 250;\n/** A SINGLE PAYMENT FOR A MULTI-DOG DEPOSIT IS WEAKER EVIDENCE THAN ONE $50 PER DOG, and the\n * per-dog rule quietly widened the amounts that can clear a stay from {$50} to {$50, $100, $150,\n * $200, $250, ...}. Her published boarding rates are $30-$65 a day, so five nights at $30 is $150\n * — a three-dog deposit — and the total is settled at drop-off, inside the search window. $250\n * is her training deposit exactly. Flagging only $250 patched the rarest collision and left the\n * likelier ones silent. Any lump sum above one dog's deposit now says what else it could be. */\nexport function lumpCaveat(due: number): string {\n // The count comes from the amount due, so a four-dog stay is told four and not \"two or three\" —\n // which was $100-$150 of advice printed on a $200 row, contradicting the rule the same row was\n // applying.\n if (due === TRAINING_DEPOSIT) return ` Worth an eye: $${TRAINING_DEPOSIT} is also what a training deposit costs, so this one payment could be either.`;\n if (due > DEPOSIT) return ` Worth an eye: one payment of this size could also be the boarding total rather than the deposit. ${due / DEPOSIT} separate $${DEPOSIT} payments would be clearer.`;\n return \"\";\n}\nexport const NEAR_WINDOW_BEFORE = 30; // a deposit can be taken before the booking is typed in\n\n/** Every card payment close enough to this stay to be worth putting in front of Kim. */\nexport function paymentsNearStay(stay: Stay, payments: Payment[]): Payment[] {\n if (!stay.bookedAt) return [];\n const lo = shiftDays(stay.bookedAt.slice(0, 10), -NEAR_WINDOW_BEFORE);\n const hi = shiftDays(stay.until || stay.day, 1);\n return payments.filter((p) => {\n const d = (p.at || \"\").slice(0, 10);\n return d >= lo && d <= hi;\n });\n}\n\nconst MONTHS = [\"Jan\", \"Feb\", \"Mar\", \"Apr\", \"May\", \"Jun\", \"Jul\", \"Aug\", \"Sep\", \"Oct\", \"Nov\", \"Dec\"];\n/** \"2026-07-21\" -> \"Jul 21\", the same way round as the stay dates on the card. Kim is American and\n * a row that says \"Nov 25 to Nov 28\" beside \"$50.00 on 21 Jul\" makes her read the date twice. */\nexport function prettyDay(iso: string | null | undefined): string {\n const m = /^(\\d{4})-(\\d{2})-(\\d{2})/.exec(String(iso ?? \"\"));\n return m ? `${MONTHS[Number(m[2]) - 1] ?? m[2]} ${Number(m[3])}` : \"\";\n}\n/** \"Oct 5\", \"Oct 5 and Oct 6\", \"Oct 5, Oct 6 and Oct 7\" — never \"a and b and c\". */\n/** \"on Nov 20\" when three dogs were paid for in one visit, rather than \"on Nov 20, Nov 20 and\n * Nov 20\" — which is how a family of three actually pays, at the counter, in one go. */\nexport function sameDayList(days: string[]): string {\n const uniq = [...new Set(days)];\n return uniq.length === 1 ? `on ${uniq[0]}` : `on ${humanList(uniq)}`;\n}\nexport function humanList(items: string[]): string {\n if (items.length <= 1) return items[0] ?? \"\";\n return `${items.slice(0, -1).join(\", \")} and ${items[items.length - 1]}`;\n}\n/** \"$50.00 on Dec 20\" for three taps on the same day, not the same line three times — which is\n * what a four-dog family paying at the counter produced, and reads as a rendering fault. */\nconst listPayments = (ps: Payment[]) => {\n const byAmountAndDay = new Map();\n for (const p of ps) {\n const day = prettyDay(p.at);\n const k = `${p.amount}|${day}`;\n const prev = byAmountAndDay.get(k);\n if (prev) prev.n++;\n else byAmountAndDay.set(k, { amount: p.amount, day, n: 1 });\n }\n return [...byAmountAndDay.values()]\n .map((g) => `${g.n > 1 ? `${g.n} payments of ` : \"\"}$${g.amount.toFixed(2)} on ${g.day}`)\n .join(\", \");\n};\n\nexport function shiftDays(day: string, delta: number): string {\n const d = new Date(`${day}T00:00:00Z`);\n if (isNaN(d.getTime())) return day;\n d.setUTCDate(d.getUTCDate() + delta);\n return d.toISOString().slice(0, 10);\n}\n\n/** could_not_check NEVER collapses into none_seen. A failed read must not read as \"she owes\". */\nexport function statusFor(\n stay: Stay,\n payments: Payment[] | null,\n // WHAT THE ROW SHOWS vs WHAT THE ROW IS SETTLED BY. `payments` is the money still unspent, which\n // is what may settle this stay. `opts.all` is everything on the account, which is what Kim can\n // see in Square. [was: one list for both, so a stay whose money had already been counted against\n // an earlier stay was told \"no card payment is on file around it AT ALL\" — with the payment\n // sitting right there in her window. 7.9% of generated rows. One step from an accusation, and\n // false: she phones, the customer says \"I paid on the 20th\", and they did.]\n opts: { all?: Payment[]; alreadyCounted?: Set } = {},\n): StayStatus {\n if (payments === null) {\n return { stay, state: \"could_not_check\", amountSeen: 0,\n note: \"We could not read this person's payments just now, so this one is unknown. It is not a finding either way.\" };\n }\n // No booking date means no window to search, so there is no honest answer here.\n // [was: the range fell back to the beginning of time, and a payment from 2019 cleared the stay.]\n if (!stay.bookedAt) {\n return { stay, state: \"could_not_check\", amountSeen: 0,\n note: \"This booking has no record of when it was made, so there is no period to check a deposit against. It is not a finding either way.\" };\n }\n const near = collapseSameMoney(paymentsNearStay(stay, opts.all ?? payments)).kept;\n // THE ONLY THING THAT CLEARS A STAY: a card payment for exactly the deposit. Everything else\n // gets shown to Kim with its date and left to her, because nothing in the data says what a\n // payment was for and two goes at guessing have both cost her money.\n const due = depositDue(stay);\n const dogs = dogsOn(stay);\n // TWO SHAPES OF EXACT EVIDENCE, and nothing else clears a stay: one payment for the whole\n // amount due, or one $50 payment per dog. Both are exact-amount matches. Summing whatever else\n // is on the account is what cleared a customer on a training package two versions ago.\n const exact = qualifyingPayments(stay, payments);\n const ids = new Set(exact.map((p) => p.id));\n const rest = near.filter((p) => !ids.has(p.id));\n // Money that IS in this stay's window but has already paid for one of this customer's earlier\n // stays. Naming it is the difference between an honest row and a false one.\n const counted = rest.filter((p) => opts.alreadyCounted?.has(p.id));\n const countedNote = counted.length\n ? ` ${counted.length === 1 ? `A card payment of $${counted[0].amount.toFixed(2)} on ${prettyDay(counted[0].at)} is` : `${counted.length} card payments totaling $${counted.reduce((n, p) => n + p.amount, 0).toFixed(2)} are`} around this stay too, but ${counted.length === 1 ? \"it has\" : \"they have\"} already been counted against ${counted.length === 1 ? \"an earlier stay\" : \"earlier stays\"} of theirs.`\n : \"\";\n const others = rest.filter((p) => !opts.alreadyCounted?.has(p.id));\n const restNote = (others.length\n ? ` ${others.length === 1 ? \"There is also 1 other card payment\" : `There are also ${others.length} other card payments`} on this account around this stay: ${listPayments(others)}.`\n : \"\") + countedNote;\n if (exact.length) {\n // TWO DIFFERENT PAYMENTS CAN SHARE AN AMOUNT AND A DAY, and then the settled one and the\n // left-over one render identically — which makes a correct allocation look exactly like the\n // money bug this module has fought five times. Say how many landed.\n const twinDay = exact.length === 1\n ? near.filter((p) => p.amount === exact[0].amount && prettyDay(p.at) === prettyDay(exact[0].at)).length\n : 1;\n const ofN = twinDay > 1 ? ` (one of ${twinDay} payments of that amount that day)` : \"\";\n return { stay, state: \"seen\", amountSeen: due,\n note: exact.length === 1\n ? `A card payment for exactly $${due.toFixed(2)} is on file on ${prettyDay(exact[0].at)}${ofN}, which is the deposit for ${dogs === 1 ? \"1 dog\" : `${dogs} dogs`}.${lumpCaveat(due)}${restNote}`\n : `${exact.length} card payments of $${DEPOSIT}.00 are on file, one per dog, ${sameDayList(exact.map((p) => prettyDay(p.at)))}. That is the $${due.toFixed(2)} due for ${dogs} dogs.${restNote}` };\n }\n if (near.length) {\n // SPLIT, deliberately. `others` is money Kim could still match to this stay; `counted` is money\n // that is around it but has already paid for one of the same customer's earlier stays. Lumping\n // them together is how a row ends up implying she has been paid twice, or not at all.\n // A PAYMENT CAN BE SHOWN AND NOT COUNTED. `near` is what Kim can see in this stay's window;\n // `exact` is what may settle it. A record whose fold-twin survives OUTSIDE the window is in the\n // first and not the second, and the row then denied a $50 match one clause before printing\n // \"$50.00 on Oct 15\". 1.3% of rows. The module's own header names that exact sentence shape as\n // the v2 bug it fixed, so it cannot be allowed back in a different branch.\n const blocked = others.filter((p) => p.amount === due || p.amount === DEPOSIT);\n const why = blocked.length\n ? `Square records the same money again outside this stay, so ${blocked.length === 1 ? \"it has\" : \"they have\"} not been counted here`\n : \"nothing unspent on file matches that amount\";\n const shown = others.length\n ? `${others.length === 1 ? \"1 card payment is\" : `${others.length} card payments are`} on file around it: ${listPayments(others)}. Worth a look to see whether the deposit is ${others.length === 1 ? \"that one\" : \"among them\"}.`\n : \"Nothing else on this account is unaccounted for around it.\";\n return { stay, state: \"partial\", amountSeen: others.reduce((n, p) => n + p.amount, 0),\n note: `The deposit on this stay is $${due.toFixed(2)} (${dogs === 1 ? \"1 dog\" : `${dogs} dogs`} at $${DEPOSIT}), and ${why}. ${shown}${countedNote}` };\n }\n return { stay, state: \"none_seen\", amountSeen: 0,\n note: `The deposit on this stay is $${due.toFixed(2)} (${dogs === 1 ? \"1 dog\" : `${dogs} dogs`} at $${DEPOSIT}) and no card payment is on file around it at all. ${OTHER_ROUTES}` };\n}\n\n/** ONE PAYMENT, ONE STAY.\n *\n * statusFor answers about a single stay and is handed the customer's whole payment list, so a\n * regular who books Thanksgiving AND Christmas in the same phone call and pays one $50 deposit\n * had BOTH stays marked settled. Kim was owed $100, $50 arrived, and neither row reached the\n * shortlist. That is the exact failure the module says it exists to prevent, and it is the\n * ordinary case rather than an edge — the two windows are six weeks apart and the search window\n * around each booking overlaps almost completely.\n *\n * So the payments are ALLOCATED. Each exact-deposit payment settles at most one stay, earliest\n * drop-off first, and a payment already spent on one stay is invisible to the next. */\nexport function statusesForCustomer(stays: Stay[], payments: Payment[] | null): StayStatus[] {\n // TIE-BROKEN, not just sorted. [was: `a.day.localeCompare(b.day)` alone. JavaScript's sort is\n // stable, so two stays on the SAME DAY stayed in whatever order the caller passed them, and the\n // one that happened to be first took the money. Same customer, same payments, same day, two\n // bookings: which one reads \"Payment on file\" was decided by array order. Found by shuffling\n // the input 464,000 times. The tie-break is the booking date first — the stay she booked\n // earlier is the one an earlier payment belongs to — then fields that identify the stay, so\n // the answer is the same on every run.]\n const key = (s: Stay) => `${s.day}|${s.bookedAt ?? \"\"}|${s.until ?? \"\"}|${dogsOn(s)}|${(s.dogs ?? []).join(\",\")}`;\n const ordered = [...stays].sort((a, b) => a.day.localeCompare(b.day) || key(a).localeCompare(key(b)));\n if (payments === null) return ordered.map((s) => statusFor(s, null));\n // COLLAPSED ONCE, HERE, BEFORE ANYTHING IS ALLOCATED.\n // [was: statusFor collapsed internally and the allocator marked only the SURVIVING id as spent,\n // so the folded twin was still visible to the next stay. The same two records were read as one\n // payment when judging a stay and as two when allocating across them, and one $50 deposit that\n // Square had written twice — the exact direct+matched pair live on her account — cleared TWO\n // holiday stays, quoting two different dates so it read as two deposits.]\n const money = collapseSameMoney(payments).kept;\n const spent = new Set();\n return ordered.map((s) => {\n const available = money.filter((p) => !spent.has(p.id));\n // `all` IS THE RAW LIST, not the globally collapsed one. [was: `all: money`, and the docstring\n // for `all` says \"everything on the account, which is what Kim can see in Square\" — which the\n // collapsed list is not. A till record folded against a payment OUTSIDE this stay's window\n // vanished from the display, and the row printed the banned sentence: a customer who paid BOTH\n // deposits, fourteen days apart, had her Thanksgiving row read \"no card payment is on file\n // around it at all\". Adding a later payment turned a settled stay into \"nothing at all\".\n // statusFor collapses `all` itself, scoped to this stay's own window, which is the only scope\n // where \"same money\" is a reading rather than a guess.]\n const st = statusFor(s, available, { all: payments, alreadyCounted: new Set(spent) });\n if (st.state === \"seen\") {\n // EARLIEST DROP-OFF FIRST, and the earliest qualifying payment settles it. Both halves are\n // deliberate and both are pinned by H48: without an order, which stay gets the money is\n // whichever way the array happened to arrive.\n // COMPUTED EXACTLY AS statusFor COMPUTES THE ONE IT QUOTES, so the record Kim reads on the\n // row is the record that gets debited. Since collapseSameMoney is idempotent this second\n // pass is a no-op on already-collapsed money, and there is deliberately no control for it:\n // a control that cannot fail is worse than none. H57 is what guards the idempotency this\n // relies on. [was: paymentsNearStay without the collapse, which diverged from the quote.]\n // EVERY payment that settled it, not one of them. [was: `.find(p => p.amount === DEPOSIT)`,\n // which debited nothing at all when a multi-dog stay was settled by one lump sum, and one of\n // N when it was settled per dog. Same money, two stays, both green.]\n for (const p of qualifyingPayments(s, available)) spent.add(p.id);\n }\n return st;\n });\n}\n\n/** The kill switch. If the payment feed itself looks dead, say so instead of telling Kim that\n * every single customer owes her money.\n *\n * MIN_SAMPLE exists because of what happened on the first live run, 6 Aug 15:41Z. Two holiday\n * stays were booked, neither customer had a Square note, and the switch fired: Kim would have\n * been shown \"the payment feed has stopped\" on the strength of two people. Two customers with no\n * Square payment is an ordinary Tuesday, not evidence of an outage. Below the floor the list is\n * shown with its usual caveats, which is the honest reading of a small sample.\n *\n * IT COUNTS CUSTOMERS, NOT BOOKINGS. [was: one entry per stay, so a single regular with five\n * holiday drop-offs and a habit of paying cash cleared the floor on their own and suppressed the\n * whole card. Her real data has one contact with 24 drop-offs. The docstring said \"customers\"\n * and the code counted rows.] */\nexport const MIN_SAMPLE_FOR_DEAD_FEED = 5;\nexport function feedLooksDead(perCustomer: Map | Payment[][], minSample = MIN_SAMPLE_FOR_DEAD_FEED): boolean {\n const lists = perCustomer instanceof Map ? [...perCustomer.values()] : perCustomer;\n return lists.length >= minSample && lists.every((p) => p.length === 0);\n}\n\n/** The sentence Kim reads. Generated from the counts, so the words cannot disagree with them. */\n// Takes anything carrying a `state`, not a full StayStatus: the dashboard regenerates this line\n// from the rows it is about to render, so the two cannot disagree, and a DepositRow is not a Stay.\nexport function depositSentence(statuses: readonly { state: StayStatus[\"state\"] }[], feedDead: boolean): string {\n if (statuses.length === 0) {\n return \"No holiday boarding stays are booked in the deposit windows yet, so there is nothing to check.\";\n }\n const none = statuses.filter((s) => s.state === \"none_seen\").length;\n const partial = statuses.filter((s) => s.state === \"partial\").length;\n const seen = statuses.filter((s) => s.state === \"seen\").length;\n const unknown = statuses.filter((s) => s.state === \"could_not_check\").length;\n if (feedDead) {\n // The old wording claimed \"no Square payment has been recorded against ANYBODY\", which was a\n // claim about people the run had never managed to read. It now says how many it actually read.\n const checked = statuses.length - unknown;\n if (checked <= 0) {\n return `There ${statuses.length === 1 ? \"is 1 holiday stay\" : `are ${statuses.length} holiday stays`} booked, and ${statuses.length === 1 ? \"it could not be checked\" : \"none of them could be checked\"} just now, so there is nothing to report either way yet.`;\n }\n return `There ${statuses.length === 1 ? \"is 1 holiday stay\" : `are ${statuses.length} holiday stays`} booked, and no card payment shows against ${checked === statuses.length ? (statuses.length === 1 ? \"it\" : \"any of them\") : (checked === 1 ? \"the one we could check\" : `any of the ${checked} we could check`)}. That pattern usually means the payment feed has stopped rather than that nobody has paid, so the list is being held back until that is checked.`;\n }\n const bits: string[] = [];\n bits.push(`${statuses.length} holiday ${statuses.length === 1 ? \"stay is\" : \"stays are\"} booked.`);\n if (seen) bits.push(`${seen} ${seen === 1 ? \"has a card payment\" : \"have a card payment\"} on file.`);\n if (none || partial) {\n const n = none + partial;\n // NO FIXED FIGURE HERE. The deposit is $50 per dog, so the amount due differs per row: the\n // headline said \"we cannot find a $50 payment\" above a three-dog stay that owes $150. Each\n // row states its own amount; the headline states none.\n // \"the deposit for it\", not \"what is owed on it\". [was: \"owed\", which is the vocabulary of a\n // debt list. The card's own closing sentence exists to say this is not one, and every other\n // string on it was already careful about this. Plainer, and it names the actual figure's name.]\n bits.push(`${n} ${n === 1 ? \"is worth checking\" : \"are worth checking\"}: we cannot find a card payment matching the deposit for ${n === 1 ? \"it\" : \"them\"}.`);\n }\n if (unknown) bits.push(`${unknown} could not be checked just now.`);\n bits.push(`${OTHER_ROUTES} This is a shortlist to look at rather than a list of people who owe you.`);\n return bits.join(\" \");\n}\n",[385],"bf46008c-90cb-4bf9-9984-3de649c4f759","google-ads-ingest.ts","14bbe268-9a4d-11f1-9cbb-1607ee4eb77e",1170,["D",1786980229015],"// PII-FREE GOOGLE ADS SNAPSHOT INGEST.\n//\n// A Google Ads Script posts aggregate campaign metrics here. The endpoint stores campaign names,\n// status, budgets and totals only. Tracking surfaces consume the same validated snapshot and always\n// expose its source timestamp. Older replays cannot replace newer truth.\n\nexport const GOOGLE_ADS_BLOB = \"google_ads_snapshot_v1\";\nexport const GOOGLE_ADS_HISTORY_BLOB = \"google_ads_history_v1\";\nexport const SNAPSHOT_FRESH_MS = 2 * 3_600_000;\nexport const SNAPSHOT_MAX_INGEST_AGE_MS = 30 * 60_000;\nexport const SNAPSHOT_FUTURE_TOLERANCE_MS = 5 * 60_000;\nconst MAX_BODY_BYTES = 200_000;\n\nexport type CampaignMetric = {\n id: string;\n name: string;\n status: \"ENABLED\" | \"PAUSED\" | \"REMOVED\" | \"UNKNOWN\";\n type: string;\n dailyBudget: number;\n today: { impressions: number; clicks: number; cost: number; conversions: number };\n last7Days: { impressions: number; clicks: number; cost: number; conversions: number };\n};\n\nexport type GoogleAdsSnapshot = {\n schema: 1;\n generatedAt: string;\n accountTimeZone: string;\n currency: string;\n campaigns: CampaignMetric[];\n};\n\nexport type SnapshotFreshness = {\n state: \"fresh\" | \"stale\" | \"future\" | \"missing\" | \"invalid\";\n snapshot: GoogleAdsSnapshot | null;\n ageMs: number | null;\n reason: string;\n};\n\nconst METRIC_KEYS = [\"impressions\", \"clicks\", \"cost\", \"conversions\"] as const;\nconst COUNT_KEYS = new Set([\"impressions\", \"clicks\"]);\nconst MAX_COUNT = 1_000_000_000;\nconst MAX_MONEY = 1_000_000_000;\nconst BAD_TEXT = /[\\u0000-\\u001f\\u007f\\u202a-\\u202e\\u2066-\\u2069\\u200e\\u200f\\u061c]/i;\n\nconst assertKeys = (value: Record, allowed: readonly string[], label: string): void => {\n const allow = new Set(allowed);\n const unexpected = Object.keys(value).find((key) => !allow.has(key));\n if (unexpected) throw new Error(`${label} contains an unexpected field: ${unexpected}`);\n};\n\n/** Reject any payload shape that could accidentally turn this aggregate store into a lead dump. */\nexport function assertNoPii(value: unknown): void {\n const walk = (v: unknown, key = \"\") => {\n if (/email|phone|contact|gclid|gbraid|wbraid|address|first.?name|last.?name|url|query|customer/i.test(key)) {\n throw new Error(`PII-like key is not allowed: ${key}`);\n }\n if (typeof v === \"string\") {\n if (/@/.test(v) || /(?:\\+\\d[\\d\\s().-]{8,}\\d|\$\\d{3}\$\\s*\\d{3}|\\d{3}[-.\\s]\\d{3}[-.\\s]\\d{4})/.test(v) ||\n /https?:\\/\\//i.test(v) || /(?:gclid|gbraid|wbraid)=/i.test(v)) {\n throw new Error(\"PII-like value is not allowed\");\n }\n return;\n }\n if (Array.isArray(v)) return v.forEach((x) => walk(x, key));\n if (v && typeof v === \"object\") {\n for (const [k, x] of Object.entries(v as Record)) walk(x, k);\n }\n };\n walk(value);\n}\n\nconst finiteNumber = (v: unknown, max: number): number => {\n if (typeof v !== \"number\") throw new Error(\"metric must be a JSON number\");\n const n = v;\n if (!Number.isFinite(n) || n < 0 || n > max) throw new Error(\"metric is outside the accepted range\");\n return n;\n};\n\nconst cleanText = (v: unknown, label: string, max: number): string => {\n if (typeof v !== \"string\") throw new Error(`invalid ${label}`);\n const s = v.trim();\n if (!s || s.length > max || BAD_TEXT.test(s)) throw new Error(`invalid ${label}`);\n return s;\n};\n\nconst validTimeZone = (v: unknown): string => {\n const s = cleanText(v, \"accountTimeZone\", 80);\n try { new Intl.DateTimeFormat(\"en-US\", { timeZone: s }).format(new Date(0)); }\n catch { throw new Error(\"invalid accountTimeZone\"); }\n return s;\n};\n\nexport function validateSnapshot(raw: unknown): GoogleAdsSnapshot {\n assertNoPii(raw);\n const v = raw as any;\n if (!v || typeof v !== \"object\" || Array.isArray(v)) throw new Error(\"snapshot must be an object\");\n assertKeys(v, [\"schema\", \"generatedAt\", \"accountTimeZone\", \"currency\", \"campaigns\"], \"snapshot\");\n if (v?.schema !== 1) throw new Error(\"unsupported schema\");\n if (typeof v.generatedAt !== \"string\" || !/^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d{1,3})?Z$/.test(v.generatedAt)) {\n throw new Error(\"invalid generatedAt\");\n }\n const generated = Date.parse(v.generatedAt);\n if (!Number.isFinite(generated) || new Date(generated).toISOString() !== v.generatedAt) throw new Error(\"invalid generatedAt\");\n const accountTimeZone = validTimeZone(v.accountTimeZone);\n const currency = typeof v.currency === \"string\" ? v.currency : \"\";\n if (!/^[A-Z]{3}$/.test(currency)) throw new Error(\"invalid currency\");\n if (!Array.isArray(v.campaigns) || v.campaigns.length < 1 || v.campaigns.length > 100) {\n throw new Error(\"campaigns must contain 1 to 100 rows\");\n }\n\n const campaigns = v.campaigns.map((c: any): CampaignMetric => {\n if (!c || typeof c !== \"object\" || Array.isArray(c)) throw new Error(\"invalid campaign row\");\n assertKeys(c, [\"id\", \"name\", \"status\", \"type\", \"dailyBudget\", \"today\", \"last7Days\"], \"campaign\");\n const id = typeof c.id === \"string\" ? c.id : \"\";\n const name = cleanText(c?.name, \"campaign name\", 160);\n const status = typeof c.status === \"string\" ? c.status.toUpperCase() : \"\";\n const type = cleanText(c?.type, \"campaign type\", 80);\n if (!/^\\d{1,30}$/.test(id)) throw new Error(\"invalid campaign id\");\n if (![\"ENABLED\", \"PAUSED\", \"REMOVED\", \"UNKNOWN\"].includes(status)) throw new Error(\"invalid campaign status\");\n const dailyBudget = finiteNumber(c?.dailyBudget, MAX_MONEY);\n const period = (key: \"today\" | \"last7Days\") => {\n if (!c?.[key] || typeof c[key] !== \"object\" || Array.isArray(c[key])) throw new Error(`invalid ${key} metrics`);\n assertKeys(c[key], METRIC_KEYS, key);\n const out: Record = {};\n for (const metric of METRIC_KEYS) {\n const n = finiteNumber(c[key][metric], COUNT_KEYS.has(metric) ? MAX_COUNT : MAX_MONEY);\n if (COUNT_KEYS.has(metric) && !Number.isInteger(n)) throw new Error(`${key}.${metric} must be an integer`);\n out[metric] = +n.toFixed(2);\n }\n return out as CampaignMetric[typeof key];\n };\n return {\n id, name, status: status as CampaignMetric[\"status\"], type,\n dailyBudget: +dailyBudget.toFixed(2), today: period(\"today\"), last7Days: period(\"last7Days\"),\n };\n });\n\n const ids = new Set();\n for (const c of campaigns) {\n if (ids.has(c.id)) throw new Error(\"duplicate campaign id\");\n ids.add(c.id);\n }\n return {\n schema: 1,\n generatedAt: new Date(generated).toISOString(),\n accountTimeZone,\n currency,\n campaigns,\n };\n}\n\n/** Structural validation plus the clock state used by every reader. */\nexport function snapshotFreshness(\n raw: unknown,\n nowMs: number = Date.now(),\n maxAgeMs: number = SNAPSHOT_FRESH_MS,\n): SnapshotFreshness {\n if (raw == null) return { state: \"missing\", snapshot: null, ageMs: null, reason: \"No Google Ads snapshot has been stored.\" };\n let snapshot: GoogleAdsSnapshot;\n try { snapshot = validateSnapshot(raw); }\n catch (e) { return { state: \"invalid\", snapshot: null, ageMs: null, reason: String(e).replace(/^Error:\\s*/, \"\").slice(0, 180) }; }\n const generated = Date.parse(snapshot.generatedAt);\n if (!Number.isFinite(nowMs) || nowMs < 0 || !Number.isFinite(maxAgeMs) || maxAgeMs < 0) {\n return { state: \"invalid\", snapshot: null, ageMs: null, reason: \"The freshness clock is invalid.\" };\n }\n if (generated > nowMs + SNAPSHOT_FUTURE_TOLERANCE_MS) {\n return { state: \"future\", snapshot, ageMs: generated - nowMs, reason: \"The source timestamp is materially in the future.\" };\n }\n const ageMs = Math.max(0, nowMs - generated);\n return ageMs <= maxAgeMs\n ? { state: \"fresh\", snapshot, ageMs, reason: \"The Google Ads Script snapshot is current.\" }\n : { state: \"stale\", snapshot, ageMs, reason: \"The Google Ads Script snapshot has stopped updating.\" };\n}\n\n/** New ingests must be near-real-time. Exact retries are handled before this check. */\nexport function assertSnapshotCurrent(snapshot: GoogleAdsSnapshot, nowMs: number = Date.now()): void {\n const generated = Date.parse(snapshot.generatedAt);\n if (generated > nowMs + SNAPSHOT_FUTURE_TOLERANCE_MS) throw new Error(\"generatedAt is too far in the future\");\n if (nowMs - generated > SNAPSHOT_MAX_INGEST_AGE_MS) throw new Error(\"generatedAt is too old to become current truth\");\n}\n\nasync function sha256Hex(s: string): Promise {\n const b = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(s));\n return [...new Uint8Array(b)].map((x) => x.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nasync function authorised(key: string): Promise {\n const expected = (Deno.env.get(\"GADS_INGEST_SHA256\") ?? \"\").trim().toLowerCase();\n if (!key || !/^[0-9a-f]{64}$/.test(expected)) return false;\n const got = await sha256Hex(key);\n let diff = got.length ^ expected.length;\n for (let i = 0; i < Math.min(got.length, expected.length); i++) diff |= got.charCodeAt(i) ^ expected.charCodeAt(i);\n return diff === 0;\n}\n\nclass BodyTooLarge extends Error {}\n\nasync function readBody(req: Request): Promise {\n const declaredRaw = req.headers.get(\"content-length\");\n if (declaredRaw != null) {\n const declared = Number(declaredRaw);\n if (!Number.isInteger(declared) || declared < 0) throw new Error(\"invalid content-length\");\n if (declared > MAX_BODY_BYTES) throw new BodyTooLarge(\"payload too large\");\n }\n if (!req.body) throw new Error(\"empty body\");\n const reader = req.body.getReader();\n const chunks: Uint8Array[] = [];\n let total = 0;\n while (true) {\n const { value, done } = await reader.read();\n if (done) break;\n total += value.byteLength;\n if (total > MAX_BODY_BYTES) {\n await reader.cancel().catch(() => undefined);\n throw new BodyTooLarge(\"payload too large\");\n }\n chunks.push(value);\n }\n if (!total) throw new Error(\"empty body\");\n const bytes = new Uint8Array(total);\n let offset = 0;\n for (const chunk of chunks) { bytes.set(chunk, offset); offset += chunk.byteLength; }\n return new TextDecoder(\"utf-8\", { fatal: true }).decode(bytes);\n}\n\nconst noStore = { \"Cache-Control\": \"no-store\", \"X-Content-Type-Options\": \"nosniff\" };\nconst empty204 = (result: string, at: string) => new Response(null, {\n status: 204,\n headers: { ...noStore, \"X-Ingest-Result\": result, \"X-Snapshot-At\": at },\n});\n\n// Blob reads and writes have no compare-and-swap primitive. Serialize requests handled by this\n// isolate so two different source timestamps cannot race and leave the older one as current.\nlet ingestTail: Promise = Promise.resolve();\nfunction serialiseIngest(work: () => Promise): Promise {\n const run = ingestTail.then(work, work);\n ingestTail = run.then(() => undefined, () => undefined);\n return run;\n}\n\nexport default async function (req: Request): Promise {\n if (req.method !== \"POST\") return new Response(\"Not found\", { status: 404, headers: noStore });\n const u = new URL(req.url);\n const key = u.pathname.split(\"/\").filter(Boolean)[0] ?? \"\";\n if (!(await authorised(key))) return new Response(\"Not found\", { status: 404, headers: noStore });\n if (!/^application\\/json(?:\\s*;|$)/i.test(req.headers.get(\"content-type\") ?? \"\")) {\n return new Response(\"Content-Type must be application/json\", { status: 415, headers: noStore });\n }\n\n let raw: unknown;\n try { raw = JSON.parse(await readBody(req)); }\n catch (e) {\n const status = e instanceof BodyTooLarge ? 413 : 400;\n return Response.json({ ok: false, error: String(e).replace(/^Error:\\s*/, \"\").slice(0, 180) }, { status, headers: noStore });\n }\n\n let snapshot: GoogleAdsSnapshot;\n try { snapshot = validateSnapshot(raw); }\n catch (e) { return Response.json({ ok: false, error: String(e).slice(0, 180) }, { status: 400, headers: noStore }); }\n\n return serialiseIngest(async () => { try {\n const { blob } = await import(\"https://esm.town/v/std/blob\");\n const existingRaw = await blob.getJSON(GOOGLE_ADS_BLOB).catch(() => null);\n let existing: GoogleAdsSnapshot | null = null;\n if (existingRaw != null) {\n try { existing = validateSnapshot(existingRaw); }\n catch { existing = null; } // a valid new source reading repairs an invalid current blob\n }\n if (existing) {\n const incomingAt = Date.parse(snapshot.generatedAt), existingAt = Date.parse(existing.generatedAt);\n if (incomingAt === existingAt) {\n if (JSON.stringify(snapshot) === JSON.stringify(existing)) return empty204(\"duplicate\", snapshot.generatedAt);\n return Response.json({ ok: false, error: \"conflicting snapshot at the same generatedAt\" }, { status: 409, headers: noStore });\n }\n if (incomingAt < existingAt) {\n return Response.json({ ok: false, error: \"older snapshot cannot replace newer truth\" }, { status: 409, headers: noStore });\n }\n }\n assertSnapshotCurrent(snapshot);\n\n // Val's blob API returns `null` for a key that has never existed; the offline harness used to\n // model that as a rejected promise. Both shapes mean \"first snapshot\", while a non-null,\n // non-array value is still corruption and must fail closed.\n const historyRaw = await blob.getJSON(GOOGLE_ADS_HISTORY_BLOB).catch(() => null);\n if (historyRaw != null && !Array.isArray(historyRaw)) {\n throw new Error(`Google Ads history blob is not an array (${Object.prototype.toString.call(historyRaw)})`);\n }\n const history: GoogleAdsSnapshot[] = (historyRaw ?? []).map((x) => validateSnapshot(x));\n const day = snapshot.generatedAt.slice(0, 10);\n const nextHistory = [snapshot, ...history.filter((x) => x.generatedAt.slice(0, 10) !== day)]\n .sort((a, b) => Date.parse(b.generatedAt) - Date.parse(a.generatedAt))\n .slice(0, 90);\n\n // History first: if it cannot persist, current truth remains untouched and the source retries.\n await blob.setJSON(GOOGLE_ADS_HISTORY_BLOB, nextHistory);\n await blob.setJSON(GOOGLE_ADS_BLOB, snapshot);\n return empty204(\"stored\", snapshot.generatedAt);\n } catch (e) {\n return Response.json({ ok: false, error: `storage unavailable: ${String(e).replace(/^Error:\\s*/, \"\").slice(0, 140)}` },\n { status: 503, headers: noStore });\n } });\n}\n",[393],"a70f9d58-28d9-49cc-8b8d-3edcc6edad71","gads.ts","8d5f7910-989e-11f1-a489-1607ee4eb77e",1156,["D",1786979126454],"// HUMAN GOOGLE ADS OFFLINE-CONVERSION PREVIEW.\n//\n// This endpoint is intentionally a thin authenticated view over gads-rows.ts. The scheduled feed\n// and the file a human inspects must share one extractor, one source walk, one de-duplication key,\n// and one CSV serializer; otherwise the preview can approve bytes the recurring job never sends.\n\nimport {\n buildRows,\n ghlGetter,\n toCsv,\n LEAD_NAME,\n SHOW_NAME,\n MAX_DAYS,\n PAGE_CAP,\n} from \"./gads-rows.ts\";\n\nexport { parseGhlTime } from \"./gads-rows.ts\";\n\ndeclare const Deno: { env: { get(name: string): string | undefined } };\n\nasync function sha256Hex(value: string): Promise {\n const digest = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(value));\n return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nasync function authorised(candidate: string): Promise {\n const expected = (Deno.env.get(\"NURTURE_ADMIN_KEY_SHA256\") ?? \"\").trim().toLowerCase();\n if (!candidate || !/^[0-9a-f]{64}$/.test(expected)) return false;\n const actual = await sha256Hex(candidate);\n let difference = actual.length ^ expected.length;\n for (let i = 0; i < Math.min(actual.length, expected.length); i++) {\n difference |= actual.charCodeAt(i) ^ expected.charCodeAt(i);\n }\n return difference === 0;\n}\n\nfunction queryNumber(u: URL, name: string, fallback: number): number {\n const raw = u.searchParams.get(name);\n if (raw === null) return fallback;\n if (!raw.trim()) throw new Error(`${name} must be a number`);\n const value = Number(raw);\n if (!Number.isFinite(value)) throw new Error(`${name} must be a finite number`);\n return value;\n}\n\nconst errorResponse = (message: string, status: number) =>\n Response.json({ ok: false, error: message }, {\n status,\n headers: { \"Cache-Control\": \"no-store\", \"X-Content-Type-Options\": \"nosniff\" },\n });\n\nexport default async function (req: Request): Promise {\n const u = new URL(req.url);\n if (!(await authorised(u.searchParams.get(\"k\") ?? \"\"))) return new Response(\"Not found\", { status: 404 });\n if (req.method !== \"GET\" && req.method !== \"HEAD\") return new Response(\"Not found\", { status: 404 });\n\n const token = (Deno.env.get(\"GHL_TOKEN\") ?? \"\").trim();\n if (!token) return errorResponse(\"GHL_TOKEN is not configured\", 503);\n\n let days: number, leadValue: number, showValue: number;\n try {\n days = queryNumber(u, \"days\", MAX_DAYS);\n leadValue = queryNumber(u, \"leadValue\", 5);\n showValue = queryNumber(u, \"showValue\", 150);\n } catch (error) {\n return errorResponse(String(error).replace(/^Error:\\s*/, \"\"), 400);\n }\n\n const generatedAt = new Date().toISOString();\n let built: Awaited>;\n try {\n built = await buildRows(ghlGetter(token), { days, leadValue, showValue });\n } catch (error) {\n return errorResponse(`Google conversion source read failed: ${String(error).replace(/^Error:\\s*/, \"\").slice(0, 240)}`, 503);\n }\n\n const incomplete: string[] = [];\n if (built.truncated) incomplete.push(`contact walk hit its ${PAGE_CAP}-page cap before the cutoff`);\n if (built.appointmentFailures) incomplete.push(`${built.appointmentFailures} appointment read(s) failed`);\n if (built.invalidOutcomeTimes) incomplete.push(`${built.invalidOutcomeTimes} paid outcome timestamp(s) were invalid`);\n if (incomplete.length) {\n return errorResponse(`Refusing a partial Google conversion result: ${incomplete.join(\"; \")}`, 503);\n }\n\n const sourceReceipt = {\n source: \"GoHighLevel contacts and appointments\",\n readAt: generatedAt,\n lookbackDays: built.days,\n since: built.since,\n contactsScanned: built.scanned,\n pagesRead: built.pages,\n reachedCutoff: built.reachedCutoff,\n };\n\n if (u.searchParams.get(\"csv\") === \"1\") {\n if (!built.rows.length) return errorResponse(\"No complete conversion rows are available\", 503);\n let csv: string;\n try { csv = toCsv(built.rows); }\n catch (error) { return errorResponse(`Conversion file validation failed: ${String(error).slice(0, 200)}`, 503); }\n return new Response(req.method === \"HEAD\" ? null : csv, {\n headers: {\n \"Content-Type\": \"text/csv; charset=utf-8\",\n \"Content-Disposition\": `attachment; filename=\"dogsspot-google-offline-${generatedAt.slice(0, 10)}.csv\"`,\n \"Cache-Control\": \"no-store\",\n \"X-Content-Type-Options\": \"nosniff\",\n \"X-Feed-Source\": \"GoHighLevel\",\n \"X-Feed-As-At\": generatedAt,\n \"X-Feed-Rows\": String(built.rows.length),\n },\n });\n }\n\n return Response.json({\n ok: true,\n source: sourceReceipt,\n conversionActions: [LEAD_NAME, SHOW_NAME],\n googleClickedContacts: built.clicked,\n uploadRows: built.rows.length,\n duplicateRowsDropped: built.duplicateRowsDropped,\n withheld: {\n braidOnly: built.braidOnly,\n undatableLead: built.undatableLead,\n unsafeShowTiming: built.unsafeShowTiming,\n futureLeadRows: built.futureLeadRows,\n consultOnly: built.consultOnly,\n unclassified: built.unclassified,\n },\n rows: built.rows,\n uploadHow:\n `Google Ads → Goals → Conversions → Uploads → + → Upload a file. The conversion actions must ` +\n `already exist as imports from clicks and match ${LEAD_NAME} and ${SHOW_NAME} exactly.`,\n }, { headers: { \"Cache-Control\": \"no-store\", \"X-Content-Type-Options\": \"nosniff\" } });\n}\n",[400],"5d5b3398-70d0-4cba-9998-d60d6f2cc6ea","gads-rows.ts","381d7986-98b0-11f1-b0c6-1607ee4eb77e",1155,["D",1786979125176],"// GOOGLE ADS OFFLINE CONVERSIONS — THE ROW BUILDER, EXTRACTED SO A SECOND ENDPOINT CAN SHARE IT.\n// v1.0, 15 Aug 2026.\n//\n// WHY THIS FILE EXISTS. engine/gads.ts is the hand-driven endpoint: a human hits it with the admin\n// key, gets JSON to read or a CSV to download, and uploads that file by hand. It works and it is\n// verified live, so it is not touched. What it cannot do is be POLLED: it wants the admin key in a\n// query string, it has no cache, and a bad minute at the CRM turns into an HTTP 500 that a machine\n// on a schedule would simply record as a failed run.\n//\n// engine/gads-feed.ts is the machine-facing twin. Both need the same three things — find the\n// Google-clicked contacts, join them to real outcomes, emit Google's exact column set — so those\n// three things live here rather than being typed twice and drifting.\n//\n// THE COLUMN CONTRACT IS PINNED BY A TEST. tests/gads-feed.test.mjs asserts that the header line\n// and the Parameters line in this file appear VERBATIM in engine/gads.ts. If either file's idea of\n// Google's template changes, that test goes red instead of one endpoint quietly emitting a file\n// Google will reject with \"The selected file is missing data columns\".\n//\n// EVERYTHING HERE IS READ-ONLY AGAINST THE CRM. There is no write path in this module at all.\n\n/** The two conversion actions created in Google Ads on 15 Aug 2026. The names must match EXACTLY. */\nexport const LEAD_NAME = \"CRM Lead (Google)\";\nexport const SHOW_NAME = \"CRM Booking Showed (Google)\";\n\n// Google's own live template, fetched 15 Aug 2026 from\n// https://www.gstatic.com/conversiontracking/conversion-import-template.csv\n// SEVEN columns, not the five in most third-party write-ups. The two consent columns are new and\n// omitting them fails Preview with the unhelpful \"The selected file is missing data columns\".\nexport const CSV_HEADER =\n \"Google Click ID,Conversion Name,Conversion Time,Conversion Value,Conversion Currency,Ad User Data,Ad Personalization\";\n// THE PREAMBLE, COPIED FROM GOOGLE'S OWN TEMPLATE, AND WHY IT IS NOT DECORATION.\n// [was: PARAMS_LINE alone, `Parameters:TimeZone=+0000,,,,,,` — six commas, on the theory that the\n// Parameters row must match the header's column count. Google's template uses FOUR, and carries\n// three comment rows and a `### TEMPLATE ###` marker above it. On 16 Aug 2026 a file with the\n// six-comma row and no preamble was refused four times with \"The selected file is missing data\n// columns\"; the byte-for-byte template shape was accepted immediately and parsed all 15 rows.\n// Which half mattered was never isolated, so both are reproduced exactly rather than guessed at\n// a fifth time.]\nexport const PREAMBLE = [\n \"### INSTRUCTIONS ###,,,,\",\n '\"# IMPORTANT: Remember to set the TimeZone value in the \"\"parameters\"\" row and/or in your Conversion Time column\",,,,',\n \"# For instructions on how to set your timezones visit http://goo.gl/T1C5Ov,,,,\",\n \",,,,\",\n \"### TEMPLATE ###,,,,\",\n \"Parameters:TimeZone=+0000,,,,\",\n];\n/** Kept for callers that only want the Parameters row. Four commas, per the template. */\nexport const PARAMS_LINE = \"Parameters:TimeZone=+0000,,,,\";\n// CONSENT: BLANK, and this is a correction, not a preference.\n// [was: \"UNSPECIFIED\", with a comment asserting \"Google processes US traffic normally on\n// UNSPECIFIED.\" Google does not accept it at all. On 16 Aug 2026 every row of a 15-row file was\n// rejected with \"The value 'UNSPECIFIED' in column 'Ad User Data' is invalid.\" Blank is how the\n// column says not-specified, it makes no claim about consent collection either, and the same file\n// with blanks was accepted 14/15 minutes later. If this ever reads UNSPECIFIED again, the whole\n// scheduled feed silently rejects 100% of its rows.]\nexport const CONSENT = \"\";\n\n/** Hard cap on the lookback. Google drops any conversion uploaded more than 90 days after the\n * click; the click precedes contact creation, so the window on contact age must stay short of it. */\nexport const MAX_DAYS = 85;\n/** What the scheduled feed uses. Ten days of margin under Google's 90, because the gap between the\n * click and the contact record being created is real but unmeasured — see NOTES in gads-feed.ts. */\nexport const FEED_DAYS = 80;\n\nconst LOC = \"BQHJ19uohldYe3eqA0bl\";\nconst GHL = \"https://services.leadconnectorhq.com\";\n// Cloudflare in front of the CRM refuses non-browser clients inconsistently. Every read in this\n// project sends a Chrome UA for that reason; python urllib gets a 1010 and curl with this does not.\nconst UA =\n \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\";\n// THE RUNAWAY GUARD, AND WHY 18 WAS ALREADY TOO SMALL.\n//\n// The walk stops when it passes the cutoff; this cap only stops it running forever if that never\n// happens. So it must sit ABOVE the number of contacts the widest legal window can hold, with room\n// to grow, or it silently becomes the thing that ends the walk — and a walk ended early drops the\n// OLDEST Google-clicked contacts, the ones nearest their 90-day expiry, first.\n//\n// Counted 15 Aug 2026 against the live CRM: 1,737 contacts in the last 85 days, 25.2/day over the\n// last 30. Eighty-five days needed EIGHTEEN pages of a cap of eighteen — the live endpoint returned\n// `pages: 18` that morning, with 63 contacts of headroom, about two and a half days of it. The old\n// comment's own premise (\"~25 new contacts/day\") works out to 2,125 contacts over 85 days, which is\n// 22 pages: the cap contradicted the assumption written beside it.\n// 40 pages = 4,000 contacts = ~158 days at today's rate. Pages past the cutoff are never fetched,\n// so raising this costs nothing on any normal run.\nexport const PAGE_CAP = 40;\n\nexport type Row = {\n clickId: string;\n name: string;\n time: string;\n value: number;\n who: string;\n why: string;\n};\n\nexport type Built = {\n rows: Row[];\n scanned: number;\n pages: number;\n clicked: number;\n reachedCutoff: boolean;\n /** True when PAGE_CAP, not the cutoff, ended the walk: the file is short at the OLD end. */\n truncated: boolean;\n /** Google click ids the CSV deliberately does not carry — see the walk for why. */\n braidOnly: { name: string; dateAdded: string; kind: string; id: string }[];\n /** Clicked, but the click was NOT their first touch, so the lead row could not be dated after it.\n * No showed row ships either: without the later click timestamp, an older paid appointment can\n * also predate that click. See clickPrecedesCreation for why this is a drop and not a guess. */\n undatableLead: { name: string; dateAdded: string; id: string }[];\n /** Returning contacts whose showed outcome was withheld because the later click time is unknown. */\n unsafeShowTiming: { name: string; dateAdded: string; id: string }[];\n /** Appointment reads that failed. A scheduled build must never silently publish through these. */\n appointmentFailures: number;\n /** Duplicate Google identity keys removed locally before CSV generation. */\n duplicateRowsDropped: number;\n /** Lead rows held until their +5 minute conversion timestamp is no longer in the future. */\n futureLeadRows: number;\n /** Paid outcomes whose timestamp is invalid, before contact creation, or in the future. */\n invalidOutcomeTimes: number;\n /** Came from an ad, turned up to something free, has not bought. Deliberately NOT a showed row. */\n consultOnly: { name: string; what: string[] }[];\n /** Attended, not free, and on a calendar nobody has classified. NOT counted as a sale — see the\n * ranking note. This list is the queue of calendars somebody needs to price. */\n unclassified: { name: string; what: string; calendarId: string }[];\n /** dateAdded of the NEWEST Google-clicked contact found, or null if the walk found none.\n * gads-feed.ts turns this into daysSinceNewestGclidContact, which is half its alarm. */\n newestClickAt: string | null;\n days: number;\n since: string;\n};\n\n/** How the CRM is read. Injected so the tests can drive the whole builder without a network. */\nexport type Getter = (url: string, version: string) => Promise;\n\n// ─────────────────────────────────────────────────────────────────────────────────────────────────\n// WHICH ATTENDED APPOINTMENTS ARE ACTUALLY A SALE\n//\n// THE BUG THIS EXISTS TO KILL, stated with its receipt. Until 15 Aug 2026 this module took the\n// EARLIEST attended appointment and posted it to Google as \"CRM Booking Showed\" at $150. Read\n// against the live CRM that same evening, of the four contacts that produced a showed row:\n//\n// contact A — free phone consult picked at $150. They DID buy later (a boarding stay), so the\n// value was right by luck and the DATE was five days early, pinned to a free\n// 20-minute call instead of the sale.\n// contact B — free phone consult picked at $150. Their only other appointment is also free.\n// They never bought anything. The file invented $150 of revenue and would have\n// taught Google to go find more people like them.\n// contact C — paid boarding drop-off picked at $150. Correct.\n// contact D — paid program drop-off picked at $150. Correct.\n//\n// So 1 of 4 rows was fabricated and a 2nd was misdated: a 25% invented-revenue rate in a file that\n// was one click from being uploaded into Kim's live account. Optimising bids toward free-consult\n// takers is worse than not measuring at all, because it looks like measurement.\n//\n// HOW THE CLASSIFICATION IS DONE, AND WHY NOT BY TITLE ALONE. Calendar id is the primary key: it is\n// exact, stable across renames, and read from the live calendar list (29 calendars, 15 Aug 2026).\n// Title is a fallback for a calendar created after this list was taken.\n//\n// The title fallback deliberately does NOT match a bare /free/. Two REVENUE calendars are called\n// \"Leash Free Drop Off\" and \"Leash Free Pick-up\" — Leash Free is a paid training program — and a\n// naive /free/ classifies both as giveaways and silently deletes real sales from the file. \"free\"\n// only counts when followed by training or consult.\n// ─────────────────────────────────────────────────────────────────────────────────────────────────\n\n/** Calendars whose appointments cost the customer nothing. Ids read live 15 Aug 2026. */\nexport const FREE_CALENDARS: Record = {\n qHuYJ0NEqzibnoqf5Cw3: \"Pup Talk Phone Call\",\n bLn88LGOYYOZ3NySO1EZ: \"Free Training Day\",\n K24xHYRExFJDEGpgSNVB: \"Free Dog Training Day\",\n \"3kigJYgi2o0BapQfaqEz\": \"Free Training Consultation (Phone)\",\n DBILn7p80AzaqnsCb4XU: \"Free Training Consultation (Zoom)\",\n x9Wbc1UnBAD5JR3s0laV: \"Free Training Consultation (Facility)\",\n // Free by Kim's own written Meet & Greet policy, 12 Aug 2026.\n Uwq6x1shML23UzMSkHz8: \"Meet & Greet\",\n};\n\n/** Fallback for calendars created after the list above. See the note on \"Leash Free\". */\nexport const FREE_TITLE_RE =\n /(pup\\s*talk|meet\\s*(?:&|and)\\s*greet|free\\s+(?:dog\\s+)?training|free\\s+\\w*\\s*consult)/i;\n\n/** GHL ships BOTH `appointmentStatus` and the misspelt `appoinmentStatus` on every event. Read both,\n * because which one is populated is not ours to depend on. */\nexport function apptStatus(e: any): string {\n return String(e?.appointmentStatus ?? e?.appoinmentStatus ?? \"\");\n}\n\n/** True when the customer turned up. */\nexport function attended(e: any): boolean {\n return /showed|completed/i.test(apptStatus(e)) && !!e?.startTime;\n}\n\n/** True when attending this cost the customer nothing, so it is a LEAD signal and not a sale. */\nexport function isFreeAppointment(e: any): boolean {\n if (e?.calendarId && Object.prototype.hasOwnProperty.call(FREE_CALENDARS, e.calendarId)) return true;\n return FREE_TITLE_RE.test(String(e?.title ?? \"\"));\n}\n\n// ─────────────────────────────────────────────────────────────────────────────────────────────────\n// THE RANKING, AND THE ONE THING IT DOES NOT DECIDE\n//\n// WHAT IT CONTROLS. Exactly one showed row is emitted per contact, so the ranking chooses WHICH\n// appointment that row is stamped against — its DATE, and the sentence in `why` that justifies it.\n// It does NOT choose the money. Every showed row carries the same flat $150 floor, because Kim's\n// price list has never been supplied and this project does not invent numbers. So \"most valuable\"\n// here cannot mean \"the biggest dollar figure\" — there are no per-service dollar figures to rank.\n// It means: OF THE THINGS THIS PERSON ATTENDED, WHICH ONE BEST EVIDENCES THAT MONEY CHANGED HANDS.\n// Per-service values are [NEEDS DATA]; when they land, this ranking is where they attach.\n//\n// THE TIERS, and why they sit in this order. Read from the live calendar list — all 29 calendars on\n// location BQHJ19uohldYe3eqA0bl, fetched 15 Aug 2026, not guessed from memory:\n//\n// 4 PROGRAM Basic, Bundle, Bootcamp, Leash Free, Service Dog, Community. Each is a named\n// multi-day board-and-train program with its own Drop Off and Pick-up calendars — the\n// dog stays. A program enrolment is a larger commitment than a night of kennelling.\n// 3 BOARDING Boarding Drop Off / Pick Up, and their two Online twins. A real purchase, smaller.\n// 2 LESSON Private Lesson, DIY Private Lesson, Accelarator Weekly Lesson. Single sessions.\n// 1 UNSURE A calendar nobody has classified, and a title with nothing recognisable in it.\n// Emits NO sale — see below. Counted and named in `unclassified` so it gets fixed.\n// 0 FREE Never a sale. FREE_CALENDARS above, plus the title fallback.\n//\n// WHY \"UNSURE\" DOES NOT PRODUCE A SALE, which is a behaviour change worth stating plainly. The old\n// rule was \"not free, therefore revenue\", so any calendar created after this list was written fell\n// straight into the $150 bucket. That is the SAME shape as the bug this file exists to kill: a\n// thing nobody had checked was assumed to be money. Five live calendars sit in exactly that state\n// today — Pack Walks, Community Group Lesson, P.U.P.S Club Community lesson, and the two remaining\n// class bookings — and nobody here knows whether attending one costs the customer a penny. Not one\n// of the 13 Google-clicked contacts has ever attended any of them, so this costs nothing today.\n// The two ways to be wrong are not symmetric: calling a free thing revenue INVENTS money in Kim's\n// live account, calling a revenue thing unsure merely understates and says so out loud.\n//\n// TIE-BREAK 1, WITHIN A TIER: THE DROP-OFF, NOT THE PICK-UP. A drop-off and its pick-up are ONE\n// purchase logged twice (Stephen: 30 Jul drop, 3 Aug pick. Lauren: 18 Jul drop, 8 Aug pick). The\n// drop-off is when the customer actually converted, and it sits further from Google's\n// 90-days-after-the-click rejection cliff. Louie has only a pick-up on record, so a pick-up still\n// counts when it is the only evidence there is.\n// TIE-BREAK 2: EARLIEST. Same reason — distance from the cliff, and first purchase is the conversion.\n//\n// WHAT THIS CHANGED IN THE OUTPUT, MEASURED RATHER THAN CLAIMED: nothing. Against all 13 live\n// Google-clicked contacts on 15 Aug 2026, the tiered rule and the previous earliest-revenue rule\n// select the identical three appointments, because no contact has ever attended two DIFFERENT\n// revenue tiers. This is a change of GUARANTEE, not of output, and saying otherwise would be the\n// \"built is not proven\" mistake in miniature.\n// ─────────────────────────────────────────────────────────────────────────────────────────────────\n\nexport const RANK = { FREE: 0, UNSURE: 1, LESSON: 2, BOARDING: 3, PROGRAM: 4 } as const;\n\n/** Calendar id -> tier. Ids read live from the location's 29 calendars, 15 Aug 2026. */\nexport const CALENDAR_RANK: Record = {\n // 4 — named multi-day board-and-train programs, each a Drop Off / Pick-up pair.\n \"34JtodEqRp3K2wLp0a0y\": RANK.PROGRAM, // Basic Drop Off\n U53Ci7ndlS0NlkAa6vya: RANK.PROGRAM, // Basic Pick-up\n Zqzo53ckFZafZcaUKyOM: RANK.PROGRAM, // Bundle Drop Off\n \"2sAT9Q61WM2WNTqLqcGj\": RANK.PROGRAM, // Bundle Pick-up\n Qpaf5pzYxNg17K5IRwAl: RANK.PROGRAM, // Bootcamp Pick Up\n drCumXztAXB1MlgbNyqX: RANK.PROGRAM, // Bootcamp Pick-up\n MXqoZqw2t3ewo1Oxja2m: RANK.PROGRAM, // Leash Free Drop Off — \"Free\" in the name, paid program\n QBN6Y6U6lgDufXHz6B2l: RANK.PROGRAM, // Leash Free Pick-up — likewise\n U0sp9FfaU9qJOiWp1Upb: RANK.PROGRAM, // Service Dog Drop Off\n \"8rQdqxN39H6Db3Duf5ZX\": RANK.PROGRAM, // Service Dog Pick-up\n WMnuQPTsY8tz3JaxqPPf: RANK.PROGRAM, // Community Drop Off\n DN6b9L0gVEwBI80v7Ctk: RANK.PROGRAM, // Community Pick-up\n // 3 — the boarding (kennel) stay.\n wS5N8WN4BbzznaLjEg1N: RANK.BOARDING, // Boarding Drop Off\n ZmmjQJszkRMUltfEbumB: RANK.BOARDING, // Boarding Drop Off - Online\n \"1FnbK7pQp1ViZWIzX9SR\": RANK.BOARDING, // Boarding Pick Up\n bN6wWGJa0qKq0QGRg4CC: RANK.BOARDING, // Boarding Pick Up - Online\n // 2 — single paid sessions.\n dZwsM5n1Mu56898lAUrU: RANK.LESSON, // Private Lesson\n \"3XRkHVefDdcol153WXn7\": RANK.LESSON, // DIY - Private Lesson\n zR7eIQ6mToz4YOZIGIl0: RANK.LESSON, // Accelarator Weekly Lesson\n // DELIBERATELY ABSENT, so they land in UNSURE and get reported rather than assumed:\n // F9NJIG5VJO4GkHpJYg9q Pack Walks\n // cCmCBJGScp2R0JvfYlCj Community Group Lesson\n // PF1pYhk5QIrhBD33wUk0 P.U.P.S Club Community lesson\n // Nobody has told us whether these cost the customer anything. When somebody does, add them here.\n};\n\n/** Title fallback for a calendar created after the list above. Ordered: first match wins. */\nexport const TITLE_RANK: [RegExp, number][] = [\n [/(bootcamp|board\\s*(?:&|and)\\s*train|basic|bundle|leash\\s*free|service\\s*dog|accelerat)/i, RANK.PROGRAM],\n [/(boarding|day\\s*ca?re)/i, RANK.BOARDING],\n [/(private\\s*lesson|group\\s*lesson|pack\\s*walk|weekly\\s*lesson)/i, RANK.LESSON],\n];\n\n/** Which tier an appointment sits in. Calendar id first (exact, survives renames), title second. */\nexport function saleRank(e: any): number {\n if (isFreeAppointment(e)) return RANK.FREE;\n // A present-but-unknown id is a new source record, not permission to infer money from prose.\n // Title fallback is only for legacy events that genuinely carry no calendar id.\n if (e?.calendarId) return CALENDAR_RANK[e.calendarId] ?? RANK.UNSURE;\n const title = String(e?.title ?? \"\");\n for (const [re, rank] of TITLE_RANK) if (re.test(title)) return rank;\n return RANK.UNSURE;\n}\n\n/** The six live \"collect the dog at the end\" calendars. Ids read 15 Aug 2026, same list as above. */\nexport const PICKUP_CALENDARS = new Set([\n \"U53Ci7ndlS0NlkAa6vya\", // Basic Pick-up\n \"2sAT9Q61WM2WNTqLqcGj\", // Bundle Pick-up\n \"Qpaf5pzYxNg17K5IRwAl\", // Bootcamp Pick Up\n \"drCumXztAXB1MlgbNyqX\", // Bootcamp Pick-up\n \"QBN6Y6U6lgDufXHz6B2l\", // Leash Free Pick-up\n \"8rQdqxN39H6Db3Duf5ZX\", // Service Dog Pick-up\n \"DN6b9L0gVEwBI80v7Ctk\", // Community Pick-up\n \"1FnbK7pQp1ViZWIzX9SR\", // Boarding Pick Up\n \"bN6wWGJa0qKq0QGRg4CC\", // Boarding Pick Up - Online\n]);\n\n/** True when this is the START of the service rather than the collection at the end of it.\n * Calendar id is exact; the title fallback covers \"Pickup\", \"Pick Up\" and \"Pick-Up\" alike, all\n * three of which appear verbatim in the live records. Anything that is neither — a lesson, a\n * single session — is its own start, which is why the default is true. */\nexport function isServiceStart(e: any): boolean {\n if (e?.calendarId && PICKUP_CALENDARS.has(e.calendarId)) return false;\n return !/pick\\s*[-_ ]?\\s*up/i.test(String(e?.title ?? \"\"));\n}\n\n/**\n * The one appointment that represents the sale, or null if the contact has not bought.\n * Highest tier wins; within a tier the drop-off beats the pick-up; then earliest. See the ranking\n * note above for why each of those three is the way round it is.\n */\nexport function pickSaleAppointment(events: any[]): any | null {\n const revenue = (events ?? []).filter((e) => attended(e) && saleRank(e) > RANK.UNSURE);\n if (!revenue.length) return null;\n revenue.sort((a, b) =>\n saleRank(b) - saleRank(a) ||\n Number(isServiceStart(b)) - Number(isServiceStart(a)) ||\n parseGhlTime(a.startTime).getTime() - parseGhlTime(b.startTime).getTime()\n );\n return revenue[0];\n}\n\n/** The real one. Same headers as every other read in this project. */\nexport function ghlGetter(token: string): Getter {\n if (!token) throw new Error(\"GHL_TOKEN is required\");\n return async (url: string, version: string) => {\n const target = new URL(url, GHL);\n if (target.origin !== GHL || !target.pathname.startsWith(\"/contacts/\")) {\n throw new Error(\"refusing a CRM pagination URL outside the contacts API\");\n }\n const r = await fetch(target.toString(), {\n headers: {\n Authorization: `Bearer ${token}`,\n Version: version,\n \"User-Agent\": UA,\n Accept: \"application/json\",\n },\n });\n if (!r.ok) throw new Error(`${r.status} ${url.slice(0, 120)}`);\n return r.json();\n };\n}\n\n/**\n * Google click ids, wherever GoHighLevel actually keeps them.\n *\n * THE CENSUS THIS IS BUILT ON. Measured 15 Aug 2026 against ALL 5,770 contacts in the CRM — every\n * page of GET /contacts/, not a sample — because the previous matcher was written from the docs and\n * the docs are wrong about the field name:\n *\n * attributions[].utmGclid 81 entries across 50 contacts. The structured field, and the\n * NAME is utmGclid, not gclid — so the old matcher's\n * `\"gclid\":\"…\"` alternative matched ZERO of the 5,770 records\n * in the payload this walk actually reads. Every hit it ever\n * scored came from the other branch. (It does match the DETAIL\n * endpoint's attributionSource.gclid, on 12 of 1,884 checked —\n * but nothing here reads that endpoint.)\n * attributions[].gbraid 31 entries across 20 contacts. Always beside a gclid today.\n * attributions[].pageUrl \"?gclid=\" 81 entries. The ONLY reason extraction worked at all.\n * attributionSource.gclid, the shape GET /contacts/{id} returns. That endpoint returns\n * lastAttributionSource.gclid no attributions[], and the list endpoint returns no\n * attributionSource: the two shapes never co-occur, so a\n * matcher that knows only one of them is one refactor away\n * from finding nothing at all.\n * wbraid 0 in the whole database — but iOS/in-app traffic emits it.\n *\n * WHY THAT WAS FRAGILE RATHER THAN MERELY UGLY. Extraction rested entirely on the click id being\n * DUPLICATED into a URL. It is duplicated in 81 of 81 entries today — and pageUrl is absent from\n * most attribution entries the list endpoint returns at all (6 of 190 on a sampled page carried\n * one). A sparse entry holding utmGclid and no pageUrl was worth nothing, silently: no error, the\n * contact simply is not in the file. On a SCHEDULED feed nobody is watching when that happens.\n *\n * So: match the KEY under any prefix (utmGclid, utm_gclid, lastGclid, gclid) OR the query parameter\n * in any of its three encodings, and return EVERY id found rather than the first — the caller must\n * tell a gclid from a braid, because Google's columns do.\n *\n * Value charset [A-Za-z0-9_-] is verified, not assumed: all 50 live gclids (55–92 chars) and all 31\n * gbraids (34 chars) fall inside it. The bound is 20–200 rather than 20–140 so a longer id is\n * rejected outright instead of being truncated into a plausible, wrong one.\n */\nexport function extractClickIds(raw: string): { gclid?: string; gbraid?: string; wbraid?: string } {\n const found: { gclid?: string; gbraid?: string; wbraid?: string } = {};\n for (const kind of [\"gclid\", \"wbraid\", \"gbraid\"] as const) {\n const m =\n raw.match(new RegExp(`\"[A-Za-z_]*${kind}\"\\\\s*:\\\\s*\"([A-Za-z0-9_-]{20,200})\"`, \"i\")) ||\n // No word-boundary guard on this branch, deliberately. A boundary looks tidier and it broke\n // the doubly-encoded case the moment it was tested: in \"...%253Fgclid%253DCj0…\" the character\n // before \"gclid\" is the F of %253F, which is alphanumeric, so a boundary rejects a real click\n // id. Nothing needs the guard either — \"fbclid\" does not contain \"gclid\", and any token that\n // ends in \"gclid=\" IS a gclid. Proven both ways against the live 5,770 and against synthetic\n // placements before this line was written.\n raw.match(new RegExp(`${kind}(?:=|%3D|%253D)([A-Za-z0-9_-]{20,200})`, \"i\"));\n if (m) found[kind] = m[1];\n }\n return found;\n}\n\n/** Kept as a thin wrapper so any caller written against the old single-id shape still compiles. */\nexport function extractClickId(raw: string): { kind: string; id: string } | null {\n const f = extractClickIds(raw);\n if (f.gclid) return { kind: \"gclid\", id: f.gclid };\n if (f.gbraid) return { kind: \"gbraid\", id: f.gbraid };\n if (f.wbraid) return { kind: \"wbraid\", id: f.wbraid };\n return null;\n}\n\n// TIMEZONE. GHL is inconsistent and it cost us a wrong file on 15 Aug 2026. Contact `dateAdded` is UTC\n// with a Z. Appointment `startTime` is a NAIVE LOCAL string with no offset, in America/New_York. val.town\n// runs TZ=UTC, so `new Date(naive)` read Eastern wall-clock as UTC and stamped every booking FOUR HOURS\n// EARLY. Detected by checking each appointment against the UTC creation time of the contact who booked it:\n// read as UTC, every booking preceded the person who made it. Never patch this with a flat +4h — it breaks\n// when EST returns in November. This module is imported by gads-feed.ts, which serves an endpoint Google\n// polls on a schedule, so a silent 4h error here would repeat forever unattended.\nconst BIZ_TZ = \"America/New_York\";\n\n/** Offset of `tz` from UTC in ms at a given instant. Positive = ahead of UTC. */\nfunction tzOffsetMs(tz: string, atUtcMs: number): number {\n const dtf = new Intl.DateTimeFormat(\"en-US\", {\n timeZone: tz, hour12: false,\n year: \"numeric\", month: \"2-digit\", day: \"2-digit\",\n hour: \"2-digit\", minute: \"2-digit\", second: \"2-digit\",\n });\n const p: Record = {};\n for (const part of dtf.formatToParts(new Date(atUtcMs))) p[part.type] = part.value;\n return Date.UTC(+p.year, +p.month - 1, +p.day, +p.hour % 24, +p.minute, +p.second) - atUtcMs;\n}\n\n/** True when the string carries its own zone — trailing Z, or a +hh:mm / -hh:mm offset. */\nfunction hasExplicitZone(s: string): boolean {\n return /(?:Z|[+-]\\d{2}:?\\d{2})\\s*$/.test(s.trim());\n}\n\n/** Parse a GHL timestamp to a real instant, reading naive strings as business-local, DST-aware. */\nexport function parseGhlTime(s: string): Date {\n const t = String(s).trim();\n if (hasExplicitZone(t)) return new Date(t);\n const m = t.match(/^(\\d{4})-(\\d{2})-(\\d{2})[T ](\\d{2}):(\\d{2})(?::(\\d{2}))?/);\n if (!m) return new Date(t);\n const [, Y, Mo, D, H, Mi, Se] = m;\n const wall = Date.UTC(+Y, +Mo - 1, +D, +H, +Mi, +(Se ?? 0));\n let guess = wall;\n for (let i = 0; i < 2; i++) guess = wall - tzOffsetMs(BIZ_TZ, guess);\n return new Date(guess);\n}\n\n/** Google's documented CSV time shape. No per-row zone: the Parameters line pins UTC for the file. */\n/**\n * DID THE GOOGLE CLICK HAPPEN BEFORE THIS CONTACT EXISTED? (16 Aug 2026.)\n *\n * The lead row's timestamp is `dateAdded + 5 minutes`, and the comment above buildRows justifies it\n * with \"the click precedes contact creation\". That is true of a FIRST touch and false of a returning\n * visitor: a contact created in June who clicks an ad in July still carries that July gclid, and\n * stamping their lead conversion in June puts it before its own click.\n *\n * Google rejects exactly that, in those words — \"The conversion can't occur before the click\" — and\n * it did, on 16 Aug 2026, on one row of a 15-row file.\n *\n * GoHighLevel marks the first attribution `isFirst: true` and OMITS the key on every later one. That\n * is measured, not assumed: across 4,500 live contacts there are 81 attributions carrying a gclid,\n * 43 with `isFirst: true`, 38 with the key absent, and ZERO with `isFirst: false`. The rejected row's\n * contact is in the second group and has two attributions — a first touch with no click id, and a\n * later paid-search chat session carrying the gclid.\n *\n * So this returns true ONLY on an explicit `isFirst === true` beside the click id. Absent, false, or\n * an unreadable shape all mean \"cannot establish\", and the caller drops the lead row rather than\n * date it wrongly. Failing towards \"no row\" costs a signal; failing the other way puts a row Google\n * will reject into a file somebody assumes was accepted.\n */\nexport function clickPrecedesCreation(contact: unknown): boolean {\n const atts = (contact as any)?.attributions;\n if (!Array.isArray(atts)) return false;\n for (const a of atts) {\n if (a?.isFirst !== true) continue;\n if (extractClickIds(JSON.stringify(a ?? {})).gclid) return true;\n }\n return false;\n}\n\nexport function gTime(iso: string, plusMinutes = 0): string {\n const d = new Date(parseGhlTime(iso).getTime() + plusMinutes * 60_000);\n const p = (n: number) => String(n).padStart(2, \"0\");\n return `${d.getUTCFullYear()}-${p(d.getUTCMonth() + 1)}-${p(d.getUTCDate())} ` +\n `${p(d.getUTCHours())}:${p(d.getUTCMinutes())}:${p(d.getUTCSeconds())}`;\n}\n\n/** Byte-for-byte the file engine/gads.ts serves: same quoting, same column order, same consent. */\nexport function toCsv(rows: Row[]): string {\n if (!Array.isArray(rows)) throw new Error(\"conversion rows are not an array\");\n const identities = new Set();\n for (const [i, row] of rows.entries()) {\n if (!/^[A-Za-z0-9_-]{20,200}$/.test(String(row?.clickId ?? \"\"))) throw new Error(`row ${i + 1} has an invalid click id`);\n if (row?.name !== LEAD_NAME && row?.name !== SHOW_NAME) throw new Error(`row ${i + 1} has an unknown conversion name`);\n if (!/^\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2}$/.test(String(row?.time ?? \"\")) ||\n !Number.isFinite(Date.parse(`${row.time.replace(\" \", \"T\")}Z`))) throw new Error(`row ${i + 1} has an invalid conversion time`);\n if (!Number.isFinite(row?.value) || row.value < 0 || row.value > 1_000_000_000) throw new Error(`row ${i + 1} has an invalid conversion value`);\n const identity = `${row.clickId}\\u0000${row.name}\\u0000${row.time}`;\n if (identities.has(identity)) throw new Error(`row ${i + 1} duplicates a Google conversion identity`);\n identities.add(identity);\n }\n const esc = (s: string) => `\"${String(s).replace(/\"/g, '\"\"')}\"`;\n const lines = [\n ...PREAMBLE,\n CSV_HEADER,\n ...rows.map((r) =>\n [esc(r.clickId), esc(r.name), esc(r.time), r.value, \"USD\", CONSENT, CONSENT].join(\",\")\n ),\n ];\n return lines.join(\"\\n\") + \"\\n\";\n}\n\n/**\n * Walk contacts newest-first to the cutoff, keep the ones carrying a Google click id, and join each\n * to its real outcomes.\n *\n * TRAPS ENCODED HERE so nobody relearns them:\n * * Conversion Time must be AFTER the click. The click precedes contact creation, so a lead row\n * is dateAdded + 5 minutes and a showed row is the appointment start, later still.\n * * GET /opportunities/search with date_added_start/end returns HTTP 200 and ZERO rows silently\n * (proved 15 Aug 2026). Nothing here uses those filters: contacts are paginated by\n * meta.nextPageUrl and cut off locally against dateAdded.\n * * One \"showed\" row per contact — the earliest attended appointment that the customer PAID for.\n * Free consults never produce one; see pickSaleAppointment and the receipt above it. Google\n * de-dupes on (click id, conversion name, time), so a later second stay must not become a\n * second sale in the same row; it restates the first.\n * * $150 on a showed row is a deliberately conservative FLOOR, not a price. A boarding stay and a\n * Basic training program are not worth the same and Kim's price list has never been supplied.\n * Understating is the safe direction — Google under-bids on a low value and over-bids on an\n * invented one — but this stays wrong-and-known until real values land. Do not report it to Kim\n * as revenue.\n * * One unreadable contact must not sink the whole file. Appointment reads are individually\n * caught, and the count of failures is returned rather than thrown.\n */\nexport async function buildRows(\n get: Getter,\n opts: { days?: number; leadValue?: number; showValue?: number; now?: number } = {},\n): Promise {\n const rawDays = opts.days ?? FEED_DAYS;\n if (!Number.isFinite(Number(rawDays)) || Number(rawDays) <= 0) throw new Error(\"days must be a positive number\");\n const days = Math.min(Math.max(Math.floor(Number(rawDays)), 1), MAX_DAYS);\n const value = (raw: unknown, fallback: number, label: string) => {\n const n = raw == null ? fallback : Number(raw);\n if (!Number.isFinite(n) || n < 0 || n > 1_000_000_000) throw new Error(`${label} is invalid`);\n return n;\n };\n const leadValue = value(opts.leadValue, 5, \"leadValue\");\n const showValue = value(opts.showValue, 150, \"showValue\");\n const now = opts.now ?? Date.now();\n if (!Number.isFinite(now)) throw new Error(\"now is invalid\");\n const cutoff = now - days * 86_400_000;\n\n const hits: { id: string; name: string; dateAdded: string; addedMs: number; firstTouch: boolean; click: { kind: string; id: string } }[] = [];\n // Clicked contacts whose lead row cannot be dated safely. Counted, never silently dropped.\n const undatableLead: { name: string; dateAdded: string; id: string }[] = [];\n // Contacts whose ONLY Google identifier is a gbraid or wbraid. Google's \"Google Click ID\" column\n // is a GCLID column; a braid posted into it is rejected. Zero contacts in the CRM are in this\n // state today (31 gbraids, every one beside a gclid) — but the old code would have written one\n // into the file as if it were a click id, and a rejected row inside an otherwise accepted file\n // is exactly the failure nobody goes looking for. Counted and returned instead.\n const braidOnly: { name: string; dateAdded: string; kind: string; id: string }[] = [];\n const consultOnly: { name: string; what: string[] }[] = [];\n const unclassified: { name: string; what: string; calendarId: string }[] = [];\n const unsafeShowTiming: { name: string; dateAdded: string; id: string }[] = [];\n let appointmentFailures = 0, futureLeadRows = 0, invalidOutcomeTimes = 0;\n let url: string | null = `${GHL}/contacts/?locationId=${LOC}&limit=100`;\n let pages = 0, scanned = 0, reachedCutoff = false;\n const pageUrls = new Set();\n const contactIds = new Set();\n let previousAdded = Number.POSITIVE_INFINITY;\n while (url && pages < PAGE_CAP && !reachedCutoff) {\n if (pageUrls.has(url)) throw new Error(\"contacts pagination repeated a URL\");\n pageUrls.add(url);\n const page = await get(url, \"2021-07-28\");\n if (!page || !Array.isArray(page.contacts)) throw new Error(`contacts page ${pages + 1} has no contacts array`);\n const contacts = page.contacts;\n for (const c of contacts) {\n scanned++;\n const dateAdded = String(c?.dateAdded ?? \"\");\n const added = Date.parse(dateAdded);\n if (!Number.isFinite(added)) throw new Error(`contact ${String(c?.id ?? \"(missing)\")} has an invalid dateAdded`);\n if (added > now + 5 * 60_000) throw new Error(`contact ${String(c?.id ?? \"(missing)\")} has a future dateAdded`);\n if (added > previousAdded) throw new Error(\"contacts source is not newest-first; refusing an incomplete cutoff walk\");\n previousAdded = added;\n // Finish validating this page even after the first old row. That is how we can prove a later\n // in-window row was not hidden behind an out-of-order cutoff boundary.\n if (added < cutoff) { reachedCutoff = true; continue; }\n const contactId = String(c?.id ?? \"\").trim();\n if (!contactId) throw new Error(\"a contact in the conversion window has no stable id\");\n if (contactIds.has(contactId)) throw new Error(`contacts source repeated id ${contactId}`);\n contactIds.add(contactId);\n const ids = extractClickIds(JSON.stringify(c));\n const who = [c?.firstName, c?.lastName].filter(Boolean).join(\" \") || \"(no name)\";\n if (ids.gclid) {\n hits.push({ id: contactId, name: who, dateAdded, addedMs: added, firstTouch: clickPrecedesCreation(c), click: { kind: \"gclid\", id: ids.gclid } });\n } else if (ids.gbraid || ids.wbraid) {\n braidOnly.push({\n name: who,\n dateAdded,\n kind: ids.gbraid ? \"gbraid\" : \"wbraid\",\n id: (ids.gbraid ?? ids.wbraid) as string,\n });\n }\n }\n const next = page?.meta?.nextPageUrl ?? null;\n if (next !== null && typeof next !== \"string\") throw new Error(`contacts page ${pages + 1} has an invalid nextPageUrl`);\n if (next) {\n const target = new URL(next, GHL);\n if (target.origin !== GHL || !target.pathname.startsWith(\"/contacts/\")) {\n throw new Error(\"contacts pagination pointed outside the CRM contacts API\");\n }\n url = target.toString();\n } else url = null;\n pages++;\n }\n\n const rows: Row[] = [];\n for (const h of hits) {\n // A later click on an existing contact has no timestamp in the list payload. That makes BOTH\n // rows unsafe: dateAdded can predate the click, and the selected paid appointment can also be\n // older than it. Keep the contact visible in diagnostics and emit nothing until the click time\n // is available. This is the exact edge case behind Google's \"conversion before click\" reject.\n if (!h.firstTouch) {\n undatableLead.push({ name: h.name, dateAdded: h.dateAdded, id: h.click.id });\n unsafeShowTiming.push({ name: h.name, dateAdded: h.dateAdded, id: h.click.id });\n continue;\n }\n const leadAt = h.addedMs + 5 * 60_000;\n if (leadAt > now) {\n futureLeadRows++;\n continue;\n }\n rows.push({\n clickId: h.click.id,\n name: LEAD_NAME,\n time: gTime(h.dateAdded, 5),\n value: leadValue,\n who: h.name,\n why: `contact created ${h.dateAdded} carrying a ${h.click.kind}, and that click was their first touch`,\n });\n try {\n const appts = await get(`${GHL}/contacts/${h.id}/appointments`, \"2021-04-15\");\n if (!appts || !Array.isArray(appts.events)) throw new Error(\"appointments response has no events array\");\n const events = appts.events;\n // Validate every known paid event, not just whichever one the ranker selects. Otherwise a\n // valid event can sort ahead of a malformed sibling and make an incomplete source look safe.\n const invalidPaid = new Set();\n for (const event of events) {\n if (!attended(event) || saleRank(event) <= RANK.UNSURE) continue;\n const eventAt = parseGhlTime(String(event?.startTime ?? \"\")).getTime();\n if (!Number.isFinite(eventAt) || eventAt <= h.addedMs || eventAt > now) {\n invalidOutcomeTimes++;\n invalidPaid.add(event);\n }\n }\n const sale = pickSaleAppointment(events.filter((event: any) => !invalidPaid.has(event)));\n if (sale) {\n const saleAt = parseGhlTime(String(sale.startTime ?? \"\")).getTime();\n if (!Number.isFinite(saleAt) || saleAt <= h.addedMs || saleAt > now) {\n invalidOutcomeTimes++;\n } else {\n rows.push({\n clickId: h.click.id,\n name: SHOW_NAME,\n time: gTime(sale.startTime),\n value: showValue,\n who: h.name,\n why: `attended paid service \"${String(sale.title ?? \"appointment\").trim()}\" ` +\n `at ${sale.startTime} (calendar ${sale.calendarId})`,\n });\n }\n } else {\n // NOT a silent drop. A contact who attended only free things is the funnel working — they\n // came from an ad, they turned up, they have not bought YET. It is a real state and the\n // reason this contact is absent from the showed rows, so it is reported rather than lost.\n const freeAttended = events.filter((e: any) => attended(e) && isFreeAppointment(e));\n if (freeAttended.length) {\n consultOnly.push({\n name: h.name,\n what: freeAttended.map((e: any) =>\n `${FREE_CALENDARS[e.calendarId] ?? e.title ?? \"free appointment\"} ${e.startTime}`\n ),\n });\n }\n }\n // Reported whether or not a sale was found: an unclassified calendar is a question, and a\n // contact can easily have both a known sale and an unpriced appointment beside it.\n for (const e of events) {\n if (attended(e) && saleRank(e) === RANK.UNSURE) {\n unclassified.push({\n name: h.name,\n what: `${String(e.title ?? \"appointment\").trim()} ${e.startTime}`,\n calendarId: String(e.calendarId ?? \"\"),\n });\n }\n }\n } catch {\n // Count it. gads-feed.ts treats any non-zero count as an incomplete build and serves the last\n // complete cache instead, so a partial CRM outage cannot silently become Google's new truth.\n appointmentFailures++;\n }\n }\n\n // Google also de-duplicates this identity, but the unattended feed must know its own output is\n // unique before relying on a downstream safety net. Preserve the first occurrence deterministically.\n const seen = new Set();\n const uniqueRows: Row[] = [];\n let duplicateRowsDropped = 0;\n for (const row of rows) {\n const key = `${row.clickId}\\u0000${row.name}\\u0000${row.time}`;\n if (seen.has(key)) { duplicateRowsDropped++; continue; }\n seen.add(key);\n uniqueRows.push(row);\n }\n\n return {\n rows: uniqueRows,\n scanned,\n pages,\n clicked: hits.length,\n reachedCutoff,\n // The walk ran out of pages before it reached the cutoff, so the file is SHORT — and short at\n // the old end, where the contacts closest to their 90-day expiry live. On a scheduled feed this\n // is the difference between \"no conversions this week\" and \"we stopped looking\".\n truncated: !reachedCutoff && !!url && pages >= PAGE_CAP,\n braidOnly,\n undatableLead,\n unsafeShowTiming,\n appointmentFailures,\n duplicateRowsDropped,\n futureLeadRows,\n invalidOutcomeTimes,\n consultOnly,\n unclassified,\n // The walk runs newest-first, so the FIRST hit is the newest — but it is computed by comparing\n // dates rather than trusting that order, because \"the contacts feed is sorted descending\" is an\n // observation about one day's data and this value feeds an alarm that has to hold on every day.\n newestClickAt: hits.reduce(\n (best, h) => (!best || Date.parse(h.dateAdded) > Date.parse(best) ? h.dateAdded : best),\n null,\n ),\n days,\n since: new Date(cutoff).toISOString(),\n };\n}\n",[407],"b943320c-de56-4a89-b830-4f4fe4d07de0","gads-feed.ts","38abdbe0-98b0-11f1-af03-1607ee4eb77e",1154,["D",1786979123741],5,"// THE SCHEDULED CONVERSION FEED. v1.0, 15 Aug 2026.\n//\n// THE CHORE THIS DELETES. Until tonight, somebody had to remember, every week, to open the val\n// endpoint, download a CSV, open Google Ads, find Goals → Conversions → Uploads, and attach the\n// file. The account has already proved what happens to weekly chores here: the last human change\n// to it was 22 Jul 19:21:36 ET, and the 24 days after that returned \"You don't have any changes\n// that match your dates or filters.\" A step that depends on memory is a step that stops.\n//\n// WHAT REPLACES IT. Google Ads' Uploads screen has a Schedules tab that will FETCH a file itself,\n// on a schedule, from one of three sources: Google Sheets, HTTPS, SFTP. Our file already exists at\n// an HTTPS URL. So the whole loop closes by pointing Google at a URL, once, by hand — and then\n// never again. This file is that URL: a stable, cached, unguessable, always-parseable CSV route.\n//\n// WHY IT IS NOT JUST gads.ts WITH A LONGER LEASH. Three differences, each of which is the\n// difference between a thing that runs unattended and a thing that looks like it does:\n//\n// 1. THE SECRET IS IN THE PATH, AND IT IS ITS OWN SECRET.\n// The URL ends in \".csv\" because Google's documented HTTPS setups go out of their way to make\n// it so — Matomo's instructions tell you to append \"&requestType=https&conversion-export.csv\"\n// to a URL that is otherwise all query string, which only makes sense as a file-type sniff on\n// the URL's tail. A path secret gives us a .csv ending for free and needs no query string at\n// all, so nothing depends on Google preserving one.\n// And it is a DIFFERENT secret from the admin key. The URL is pasted into a Google Ads screen\n// where it lives forever, visible to anyone with access to the account. The admin key opens\n// the whole admin surface; this key opens one read-only CSV and nothing else.\n//\n// 2. IT CANNOT SERVE A FILE GOOGLE WILL REJECT.\n// Google fails a scheduled run on a file with headers and no data rows: \"The data type or\n// schema of the data source could not be determined... there is at least one line with valid\n// data.\" A CRM hiccup at the moment Google happens to fetch would do exactly that. So the\n// last good file is cached, and a build that fails OR returns zero rows serves the cache\n// instead of a header-only file. Re-serving last week's rows is free: Google states \"the same\n// conversion won't be imported more than once\" for the same click id + name + time.\n//\n// 3. IT IS BOUNDED IN TIME.\n// The live scan takes ~7s. A scheduled fetcher that waits forever is a scheduled fetcher that\n// one day times out mid-run. The rebuild gets a budget; over it, the cache is served.\n//\n// THE WINDOW, AND WHY 80 DAYS AND NOT 85.\n// Google: \"Offline conversions that were uploaded more than 90 days after the associated last\n// click won't be imported.\" The clock runs from the CLICK, and we do not have the click's\n// timestamp — only the contact's dateAdded, which is at or after it. On this CRM the two are\n// minutes apart (the click lands on a page, the chat or the form makes the contact), but that is\n// an observation, not a guarantee. 80 days of contact age leaves ten days of margin, and because\n// the window moves with the calendar, a row simply stops being emitted before it can start being\n// rejected. Nothing accumulates; nothing needs cleaning up.\n//\n// WHAT THIS STILL CANNOT DO, said plainly rather than left to be discovered:\n// * It cannot create the schedule. Google Ads has no way to do that except a human in the UI,\n// and the Google Ads API route needs a developer token this account does not have.\n// * Nothing here pages anybody. If the schedule is deleted or the fetch starts failing, the\n// evidence is in ?status — it does not come and find you. Every fetch is recorded there with\n// its user-agent and time precisely so that \"is this still running?\" is a question with an\n// answer rather than a shrug.\n// * The two conversion actions it feeds are not account-default goals, so what it uploads is\n// reporting, not bidding, until somebody promotes them.\n\nimport { buildRows, ghlGetter, toCsv, FEED_DAYS, LEAD_NAME, SHOW_NAME, CSV_HEADER } from \"./gads-rows.ts\";\n\nconst BLOB_KEY = \"gads_feed_cache\";\n/** Serve the cache without rebuilding if it is younger than this. Google fetches weekly, so in\n * practice every scheduled fetch rebuilds; this only spares a human clicking twice in a row. */\nconst MAX_AGE_MS = 6 * 3_600_000;\n/** The rebuild's budget. Past it, the cache is served and the status view says the build was slow. */\nconst BUILD_BUDGET_MS = 25_000;\n/** How many fetches to remember. Enough to see a weekly schedule's last three months. */\nconst FETCH_LOG = 14;\nconst FILENAME = \"dogsspot-google-conversions.csv\";\n\ntype FetchNote = {\n at: string;\n ua: string;\n served: string;\n rows: number;\n ms: number;\n /** A Google-owned fetcher, or everything else. Status reads are not logged as file fetches. */\n source?: \"google-schedule\" | \"other\";\n};\n/** One build, recorded whether or not it produced anything. See BUILD_LOG for why. */\ntype BuildNote = {\n at: string;\n ok: boolean;\n rows: number;\n scanned: number;\n clicked: number;\n ms: number;\n error: string;\n pages?: number;\n reachedCutoff?: boolean;\n truncated?: boolean;\n appointmentFailures?: number;\n duplicateRowsDropped?: number;\n unsafeShowTiming?: number;\n futureLeadRows?: number;\n invalidOutcomeTimes?: number;\n};\nexport type Cache = {\n csv: string;\n rows: number;\n builtAt: string;\n days: number;\n scanned: number;\n clicked: number;\n lastBuild: BuildNote;\n fetches: FetchNote[];\n /** Every recent build, empty ones included. */\n builds?: BuildNote[];\n /** High-water marks, so a collapse has something to be a collapse FROM. */\n bestScanned?: number;\n bestClicked?: number;\n /** When a build last produced at least one row. The stored file is FROM this moment, so it is\n * also the age of what Google keeps being handed. */\n lastNonZeroBuildAt?: string | null;\n /** When this feed STARTED falling back to the stored file, or null when it is serving fresh\n * builds. Set once on the first fallback and left alone until a real build serves again, so it\n * measures the length of the outage rather than the time of the last symptom. */\n servingStaleSince?: string | null;\n /** dateAdded of the newest Google-clicked contact the last good build saw. NOT cleared by a build\n * that finds none — that is the whole point: it must go on ageing so the silence becomes loud. */\n newestClickAt?: string | null;\n};\n\nexport type CacheIntegrity = {\n state: \"valid\" | \"missing\" | \"invalid\" | \"unreadable\";\n cache: Cache | null;\n fileUsable: boolean;\n reason: string;\n};\n\n/** Validate stored bytes before they can bypass the CRM rebuild. */\nexport function cacheIntegrity(raw: unknown, nowMs: number = Date.now(), readable = true): CacheIntegrity {\n if (!readable) return { state: \"unreadable\", cache: null, fileUsable: false, reason: \"The feed cache could not be read.\" };\n if (raw == null) return { state: \"missing\", cache: null, fileUsable: false, reason: \"No feed cache exists yet.\" };\n try {\n if (!raw || typeof raw !== \"object\" || Array.isArray(raw)) throw new Error(\"cache is not an object\");\n const c = raw as Cache;\n if (!Number.isInteger(c.rows) || c.rows < 0 || typeof c.csv !== \"string\" || typeof c.builtAt !== \"string\" ||\n !Array.isArray(c.fetches) || !c.lastBuild || typeof c.lastBuild !== \"object\") throw new Error(\"cache fields are malformed\");\n for (const iso of [c.builtAt || null, c.servingStaleSince ?? null, c.lastNonZeroBuildAt ?? null, c.newestClickAt ?? null]) {\n if (iso != null && !Number.isFinite(Date.parse(iso))) throw new Error(\"cache contains an invalid timestamp\");\n }\n if (c.builtAt && Date.parse(c.builtAt) > nowMs + 5 * 60_000) throw new Error(\"cache build timestamp is in the future\");\n if (c.rows === 0) {\n if (c.csv !== \"\" || c.builtAt !== \"\") throw new Error(\"an empty cache claims to hold a file\");\n return { state: \"valid\", cache: c, fileUsable: false, reason: \"Telemetry exists but no valid file has been built.\" };\n }\n if (c.days !== FEED_DAYS) throw new Error(\"cached file was built with a non-production lookback\");\n const lines = c.csv.trimEnd().split(\"\\n\");\n const header = lines.indexOf(CSV_HEADER);\n if (header < 0) throw new Error(\"cached CSV has no Google header\");\n const data = lines.slice(header + 1);\n if (data.length !== c.rows || data.length === 0) throw new Error(\"cached CSV row count does not match metadata\");\n const identities = new Set();\n for (const line of data) {\n const parts = line.split(\",\");\n const unquote = (value: string) => value.startsWith('\"') && value.endsWith('\"') ? value.slice(1, -1) : \"\";\n const clickId = unquote(parts[0] ?? \"\"), conversion = unquote(parts[1] ?? \"\"), time = unquote(parts[2] ?? \"\");\n const amount = Number(parts[3]);\n const rowAt = Date.parse(`${time.replace(\" \", \"T\")}Z`);\n const canonicalTime = Number.isFinite(rowAt) ? new Date(rowAt).toISOString().replace(\"T\", \" \").slice(0, 19) : \"\";\n if (parts.length !== 7 || !/^[A-Za-z0-9_-]{20,200}$/.test(clickId) ||\n (conversion !== LEAD_NAME && conversion !== SHOW_NAME) ||\n !/^\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2}$/.test(time) ||\n canonicalTime !== time || rowAt > Date.parse(c.builtAt) + 5 * 60_000 ||\n parts[3] === \"\" || !Number.isFinite(amount) || amount < 0 ||\n parts[4] !== \"USD\" || parts[5] !== \"\" || parts[6] !== \"\") {\n throw new Error(\"cached CSV contains an invalid data row\");\n }\n const identity = `${clickId}\\u0000${conversion}\\u0000${time}`;\n if (identities.has(identity)) throw new Error(\"cached CSV contains a duplicate Google conversion identity\");\n identities.add(identity);\n }\n return { state: \"valid\", cache: c, fileUsable: true, reason: \"Cached bytes match their row metadata.\" };\n } catch (e) {\n return { state: \"invalid\", cache: null, fileUsable: false, reason: String(e).replace(/^Error:\\s*/, \"\").slice(0, 180) };\n }\n}\n\n// ─────────────────────────────────────────────────────────────────────────────────────────────────\n// TELLING A QUIET WEEK FROM A BROKEN PIPE\n//\n// THE DEFECT THIS CLOSES. Until 15 Aug 2026, a build that found nothing and a build whose supply had\n// collapsed were the same event here: both returned rows = 0, both served the cache, and — the part\n// that made it invisible — scanned and clicked were only ever written to the blob on a build that\n// produced rows (`if (build.ok && build.rows > 0)`). So if gclid capture broke, ?status went on\n// reporting the healthy scanned/clicked numbers from the last good week, indefinitely, while Google\n// re-imported a stale file it had already de-duped. The feed would look alive for as long as anyone\n// cared to check.\n//\n// Three failures wear the same \"0 rows\" costume and they need completely different responses:\n// * the build is erroring or timing out → the val or the CRM is down; fix the endpoint\n// * the walk reads far fewer contacts than ever → the contacts endpoint or the token changed\n// * contacts read fine, NONE carry a gclid → attribution capture broke; nothing here can fix\n// it, and every day it runs costs recoverable\n// conversions that expire 90 days after the click\n// * everything healthy, just no new bookings → nothing is wrong. This is a quiet week.\n//\n// Only the last one is acceptable, and it is the one the old code reported for all four.\n// ─────────────────────────────────────────────────────────────────────────────────────────────────\nconst BUILD_LOG = 20;\n/** A scan this far below the high-water mark is a collapse, not a slow week. Contact volume moves a\n * few percent week to week (25.2/day over the 30 days to 15 Aug); it does not halve by itself. */\nconst SCAN_COLLAPSE_RATIO = 0.5;\n\n/** What is actually wrong, or null when nothing is. Pure function of the build history. */\nexport function diagnoseSupply(c: Cache | null): { state: string; healthy: boolean; detail: string } {\n const raw = c?.builds?.[0] ?? (c?.lastBuild?.at ? c.lastBuild : null);\n if (!raw) return { state: \"no-builds-yet\", healthy: false, detail: \"This feed has never completed a build.\" };\n // A BUILD RECORDED BEFORE 15 Aug 2026 HAS NO scanned/clicked, because those fields were added the\n // day the supply diagnosis was. Reading them straight put the literal word \"undefined\" into a\n // sentence on a client-facing page — caught live within minutes of the tracking page shipping.\n // A missing figure is not a zero either: zero clicked means \"supply collapsed\", which would be an\n // alarm invented out of an old blob. So they are normalised to null and the wording adapts.\n const known = Number.isFinite(raw.scanned as number) && Number.isFinite(raw.clicked as number);\n const last = { ...raw, scanned: known ? raw.scanned : 0, clicked: known ? raw.clicked : 0 };\n if (!known && raw.ok) {\n return raw.rows > 0\n ? { state: \"ok\", healthy: true, detail: `${raw.rows} outcomes are ready to send. This build predates the supply check, so how many contacts were read is not recorded.` }\n : { state: \"quiet\", healthy: true, detail: \"The last build produced no new rows. It predates the supply check, so nothing more can be said about why.\" };\n }\n if (!last.ok) {\n return { state: \"build-failing\", healthy: false, detail: `The last build did not complete: ${last.error || \"unknown error\"}. Google is being served a cached file.` };\n }\n const best = c?.bestScanned ?? 0;\n if (best > 0 && last.scanned < best * SCAN_COLLAPSE_RATIO) {\n return { state: \"crm-read-shrunk\", healthy: false, detail: `The walk read ${last.scanned} contacts; it has read as many as ${best}. The contacts endpoint, the token or the page cap changed — this is not an advertising problem.` };\n }\n if (last.clicked === 0 && (c?.bestClicked ?? 0) > 0) {\n return { state: \"gclid-supply-collapsed\", healthy: false, detail: `${last.scanned} contacts read and NOT ONE carries a Google click id, against a best of ${c!.bestClicked}. Attribution capture has broken. Conversions expire 90 days after the click, so every day this runs loses recoverable ones.` };\n }\n // Consecutive empty builds. One is a quiet week; a run of them on a live account is not.\n const empties = (c?.builds ?? []).findIndex((b) => b.ok && b.rows > 0);\n const streak = empties === -1 ? (c?.builds ?? []).length : empties;\n if (last.rows === 0 && streak >= 4) {\n return { state: \"empty-streak\", healthy: false, detail: `${streak} consecutive builds have produced no rows while the CRM read fine. Worth a human look even though nothing here is technically broken.` };\n }\n if (last.rows === 0) {\n return { state: \"quiet\", healthy: true, detail: `The CRM read fine (${last.scanned} contacts, ${last.clicked} carrying a click id) and produced no new rows. Nothing is broken; the last good file is being served.` };\n }\n return { state: \"ok\", healthy: true, detail: `${last.rows} rows from ${last.clicked} Google-clicked contacts out of ${last.scanned} read.` };\n}\n\n// ─────────────────────────────────────────────────────────────────────────────────────────────────\n// THE ALARM: \"NOTHING HAPPENED\" AND \"EVERYTHING BROKE\" ARE THE SAME HTTP 200\n//\n// THE DEFECT. When a build returns zero rows this feed serves the last good file, and it is right\n// to: Google fails a scheduled run on a header-only file, and re-serving rows it has already\n// de-duped costs nothing. But the fallback has no clock on it. A total collapse of the gclid supply\n// therefore returns HTTP 200 and a valid CSV forever — byte-identical to a quiet week — while\n// Google cheerfully re-ingests conversions it already has and the real ones expire 90 days after\n// their click. Nothing in the response, the status code or the file distinguishes the two.\n//\n// THE FIX IS NOT TO STOP SERVING THE STALE FILE. A stale file still beats an empty one, on every\n// week where the truth really is \"no new bookings\". Serving behaviour is untouched. What changes is\n// that the CONDITION is now visible and dated, so \"is this still working?\" has an answer.\n//\n// THE TWO THRESHOLDS, and why they are the numbers they are:\n//\n// STALE_ALARM_DAYS = 3 The empty-build fallback persisting beyond three days. Google's schedule\n// here is WEEKLY, so one fallback fetch is ordinary and three days of\n// continuous fallback means two consecutive attempts found nothing.\n//\n// GCLID_SILENCE_ALARM_DAYS = 14 No NEW Google-clicked contact in a fortnight.\n// MEASURED, AND MARGINAL — say so rather than let somebody discover it.\n// The 13 Google-clicked contacts in the CRM on 15 Aug 2026 arrived on\n// 9 May, 3/9/9/10/17/18/23 Jun, 6/13/21/25 Jul, 11 Aug. The gaps between\n// consecutive arrivals run 0,1,1,4,5,6,7,7,8,13,17,25 days. TWO of those\n// twelve gaps are 14 or more, so this threshold WOULD have fired twice in\n// 98 days on traffic that was working perfectly. It is implemented at 14\n// because 14 is what was specified; on the measured arrival rate the\n// honest number is 21 (above the 17-day maximum, below the 25-day outlier\n// that spans the period before our campaigns went live on 22 Jul).\n// One constant, one line, no other change needed.\n//\n// COMPARISONS ARE ASYMMETRIC ON PURPOSE. \"Persisting BEYOND 3 days\" is strictly greater than 3.\n// \"No new contact IN 14 days\" is satisfied AT 14 days — at exactly 14 you have had none for a\n// fortnight, which is the condition, so that one is >=. Both boundaries are pinned by tests.\n// ─────────────────────────────────────────────────────────────────────────────────────────────────\nexport const STALE_ALARM_DAYS = 3;\nexport const GCLID_SILENCE_ALARM_DAYS = 14;\n/** Weekly Google fetch plus two days of slack before the schedule is treated as stalled. */\nexport const SCHEDULE_STALL_DAYS = 9;\n/** One fallback is useful; an indefinitely successful stale upload hides the outage from Google. */\nexport const MAX_STALE_SERVE_DAYS = STALE_ALARM_DAYS;\n/** A weekly file may survive one failed fetch, but not a second week near the 90-day click limit. */\nexport const MAX_CACHED_FILE_AGE_DAYS = 10;\n\nexport type FeedState = {\n state: \"ok\" | \"quiet\" | \"ALARM\";\n why: string;\n reasons: string[];\n lastNonZeroBuildAt: string | null;\n daysSinceNewestGclidContact: number | null;\n newestGclidContactAt: string | null;\n servingStaleSince: string | null;\n daysServingStale: number | null;\n thresholds: { staleDays: number; gclidSilenceDays: number };\n};\n\nconst daysBetween = (fromIso: string | null | undefined, nowMs: number): number | null => {\n if (!fromIso) return null;\n const t = Date.parse(fromIso);\n return Number.isFinite(t) && t <= nowMs + 5 * 60_000 ? Math.max(0, nowMs - t) / 86_400_000 : null;\n};\n\n/**\n * The plain-language verdict. Pure function of the stored state and the clock, so a test can drive\n * every boundary without a network, a blob or a val.\n *\n * ok — a recent build produced rows and they are what Google is being served.\n * quiet — nothing is being produced, and nothing is wrong: no new bookings this week. The stored\n * file is being served and that is the designed behaviour.\n * ALARM — the silence has gone on long enough that it can no longer be read as quiet.\n */\nexport function feedState(c: Cache | null, nowMs: number = Date.now()): FeedState {\n const supply = diagnoseSupply(c);\n const servingStaleSince = c?.servingStaleSince ?? null;\n const daysServingStale = daysBetween(servingStaleSince, nowMs);\n const newestGclidContactAt = c?.newestClickAt ?? null;\n const daysSinceNewestGclidContact = daysBetween(newestGclidContactAt, nowMs);\n const round = (n: number | null) => (n === null ? null : +n.toFixed(2));\n\n const reasons: string[] = [];\n if (daysServingStale !== null && daysServingStale > STALE_ALARM_DAYS) {\n reasons.push(\n `The last good file has been served instead of a fresh build since ${servingStaleSince} — ` +\n `${daysServingStale.toFixed(1)} days, past the ${STALE_ALARM_DAYS}-day limit. Google is re-importing ` +\n `conversions it already has and getting no new ones.`,\n );\n }\n if (daysSinceNewestGclidContact !== null && daysSinceNewestGclidContact >= GCLID_SILENCE_ALARM_DAYS) {\n reasons.push(\n `No new Google-clicked contact since ${newestGclidContactAt} — ${daysSinceNewestGclidContact.toFixed(1)} days, ` +\n `at or past the ${GCLID_SILENCE_ALARM_DAYS}-day limit. Either the ads stopped bringing people in or the CRM ` +\n `stopped recording the click id. Both need a human; only one is an advertising problem.`,\n );\n }\n // A build that is failing, a CRM read that has shrunk, a supply that has gone to zero, or a run\n // of empty builds are already diagnosed above, and each is an alarm in its own right whatever the\n // two clocks say. diagnoseSupply owns \"what is wrong\"; this function owns \"for how long\".\n if (!supply.healthy) reasons.push(supply.detail);\n\n const state: FeedState[\"state\"] = reasons.length ? \"ALARM\" : supply.state === \"ok\" ? \"ok\" : \"quiet\";\n const why = reasons.length\n ? reasons.join(\" \")\n : state === \"ok\"\n ? `Working. ${supply.detail}`\n : `Quiet, not broken. ${supply.detail} Nothing has been produced recently, but not for long ` +\n `enough to mean anything is wrong: the limits are ${STALE_ALARM_DAYS} days of serving the stored ` +\n `file and ${GCLID_SILENCE_ALARM_DAYS} days with no new Google-clicked contact.`;\n\n return {\n state,\n why,\n reasons,\n lastNonZeroBuildAt: c?.lastNonZeroBuildAt ?? null,\n daysSinceNewestGclidContact: round(daysSinceNewestGclidContact),\n newestGclidContactAt,\n servingStaleSince,\n daysServingStale: round(daysServingStale),\n thresholds: { staleDays: STALE_ALARM_DAYS, gclidSilenceDays: GCLID_SILENCE_ALARM_DAYS },\n };\n}\n\nasync function sha256Hex(s: string): Promise {\n const b = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(s));\n return [...new Uint8Array(b)].map((x) => x.toString(16).padStart(2, \"0\")).join(\"\");\n}\n/** Constant-time compare against the dedicated feed digest. There is deliberately no source-code\n * fallback and no admin-key bypass: the URL is stored by a third party and must have one narrow,\n * independently rotatable credential. */\nasync function authorised(k: string): Promise {\n if (!k) return false;\n const expected = (Deno.env.get(\"NURTURE_GADS_FEED_SHA256\") ?? \"\").trim().toLowerCase();\n if (!/^[0-9a-f]{64}$/.test(expected)) return false;\n const got = await sha256Hex(k);\n if (got.length !== expected.length) return false;\n let d = 0;\n for (let i = 0; i < got.length; i++) d |= got.charCodeAt(i) ^ expected.charCodeAt(i);\n return d === 0;\n}\n\nasync function ghlToken(): Promise {\n return (Deno.env.get(\"GHL_TOKEN\") ?? \"\").trim();\n}\n\nasync function readCache(): Promise<{ ok: boolean; value: unknown }> {\n try {\n const { blob } = await import(\"https://esm.town/v/std/blob\");\n return { ok: true, value: await blob.getJSON(BLOB_KEY) };\n } catch { return { ok: false, value: null }; }\n}\nasync function writeCache(c: Cache): Promise {\n try {\n const { blob } = await import(\"https://esm.town/v/std/blob\");\n await blob.setJSON(BLOB_KEY, c);\n return true;\n } catch { return false; }\n}\n\n/**\n * Rebuild, under a wall-clock budget.\n *\n * The losing promise is not cancelled — there is nothing to cancel a half-finished set of CRM\n * reads with — it is simply not waited for. That is deliberate: a slow build that finishes after\n * we have already answered costs nothing, and the alternative (waiting) is the failure mode.\n */\nasync function rebuild(days: number): Promise<{\n ok: boolean; rows: number; csv: string; ms: number; error: string; scanned: number;\n clicked: number; newestClickAt: string | null; pages: number; reachedCutoff: boolean;\n truncated: boolean; appointmentFailures: number; duplicateRowsDropped: number;\n unsafeShowTiming: number; futureLeadRows: number; invalidOutcomeTimes: number;\n}> {\n const t0 = Date.now();\n const blank = {\n ok: false, rows: 0, csv: \"\", ms: 0, error: \"\", scanned: 0, clicked: 0,\n newestClickAt: null as string | null, pages: 0, reachedCutoff: false, truncated: false,\n appointmentFailures: 0, duplicateRowsDropped: 0, unsafeShowTiming: 0,\n futureLeadRows: 0, invalidOutcomeTimes: 0,\n };\n try {\n const token = await ghlToken();\n if (!token) return { ...blank, ms: Date.now() - t0, error: \"GHL_TOKEN is not configured\" };\n\n const work = buildRows(ghlGetter(token), { days }).then((b) => {\n const telemetry = {\n rows: b.rows.length, csv: toCsv(b.rows), ms: 0, scanned: b.scanned,\n clicked: b.clicked, newestClickAt: b.newestClickAt, pages: b.pages,\n reachedCutoff: b.reachedCutoff, truncated: b.truncated,\n appointmentFailures: b.appointmentFailures,\n duplicateRowsDropped: b.duplicateRowsDropped,\n unsafeShowTiming: b.unsafeShowTiming.length,\n futureLeadRows: b.futureLeadRows,\n invalidOutcomeTimes: b.invalidOutcomeTimes,\n };\n if (b.truncated) return { ...telemetry, ok: false, error: `CRM walk hit its ${b.pages}-page cap before the cutoff` };\n if (b.appointmentFailures > 0) return { ...telemetry, ok: false, error: `${b.appointmentFailures} appointment read(s) failed; refusing a partial build` };\n if (b.invalidOutcomeTimes > 0) return { ...telemetry, ok: false, error: `${b.invalidOutcomeTimes} paid outcome timestamp(s) were not source-safe` };\n return { ...telemetry, ok: true, error: \"\" };\n });\n const timer = new Promise((res) =>\n setTimeout(() => res({ ...blank, error: `build exceeded ${BUILD_BUDGET_MS}ms` }), BUILD_BUDGET_MS)\n );\n const r = await Promise.race([work, timer]);\n return { ...r, ms: Date.now() - t0 };\n } catch (e) {\n return { ...blank, ms: Date.now() - t0, error: String(e).slice(0, 300) };\n }\n}\n\nconst HOW = {\n once: [\n \"Google Ads → Goals → Conversions → Uploads → the Schedules tab → the blue + button\",\n \"Source: HTTPS. File URL: this URL, ending .csv. Leave username/password blank.\",\n \"Frequency: Weekly. Then Save & preview.\",\n ].join(\" \"),\n needs: `Both conversion actions must already exist, named EXACTLY \"${LEAD_NAME}\" and \"${SHOW_NAME}\", created as Import → CRM/file → conversions from clicks.`,\n watch: \"Add ?status=1 (or /status after the key) to this URL to see when it was last fetched and by what.\",\n};\n\nexport default async function (req: Request): Promise {\n const u = new URL(req.url);\n // The key is the FIRST path segment, with a .csv suffix stripped, or ?k= for a human at a\n // terminal. Anything after it is decoration Google is welcome to keep: /KEY/whatever.csv works,\n // which is what lets the URL end in .csv while carrying no query string at all.\n const segs = u.pathname.split(\"/\").filter(Boolean);\n const fromPath = (segs[0] ?? \"\").replace(/\\.csv$/i, \"\");\n const key = fromPath || (u.searchParams.get(\"k\") ?? \"\");\n if (!(await authorised(key))) {\n // 404 rather than 401: a scanner learns nothing, and Google only ever fetches the right URL.\n return new Response(\"Not found\", { status: 404 });\n }\n if (req.method !== \"GET\" && req.method !== \"HEAD\") return new Response(\"Not found\", { status: 404 });\n\n const wantStatus = /^status/i.test(segs[1] ?? \"\") || u.searchParams.get(\"status\") === \"1\";\n // This is one recurring production feed, not a queryable report. A mutable lookback can replace\n // its cache with a narrow, internally valid file, so the machine route always uses FEED_DAYS.\n const days = FEED_DAYS;\n const ua = (req.headers.get(\"user-agent\") ?? \"\").slice(0, 160);\n const fetchSource: FetchNote[\"source\"] = /google|adsbot/i.test(ua) ? \"google-schedule\" : \"other\";\n const t0 = Date.now();\n\n const read = await readCache();\n const integrity = cacheIntegrity(read.value, t0, read.ok);\n const cache = integrity.cache;\n const cachedRows = cache?.rows ?? 0;\n const ageMs = integrity.fileUsable && cache?.builtAt ? t0 - Date.parse(cache.builtAt) : Infinity;\n const usable = integrity.fileUsable && cachedRows > 0 && Number.isFinite(ageMs) && ageMs >= 0;\n\n // A status read never rebuilds. It is a question about the machine, not a request for the file,\n // and a status page that costs seven seconds of CRM reads is a status page nobody opens.\n if (wantStatus) {\n const last = cache?.fetches?.[0];\n const lastScheduledFetch = cache?.fetches?.find((f) => f.source === \"google-schedule\") ?? null;\n const daysSinceLastScheduledFetch = lastScheduledFetch ? daysBetween(lastScheduledFetch.at, t0) : null;\n const supply = diagnoseSupply(cache);\n const scheduleState = !lastScheduledFetch ? \"not-scheduled\"\n : daysSinceLastScheduledFetch === null ? \"unknown\"\n : daysSinceLastScheduledFetch > SCHEDULE_STALL_DAYS ? \"stalled\" : \"healthy\";\n const state = feedState(cache, t0);\n return Response.json({\n ok: integrity.state === \"valid\" && supply.healthy && state.state !== \"ALARM\" && scheduleState === \"healthy\",\n what: \"Google Ads scheduled offline-conversion feed for The Dogs Spot\",\n // READ THIS FIELD FIRST. \"0 rows\" alone cannot tell a quiet week from a broken pipe; this can.\n supply,\n file: {\n rows: cachedRows,\n builtAt: cache?.builtAt || null,\n ageHours: usable ? +(ageMs / 3_600_000).toFixed(1) : null,\n days: cache?.days ?? null,\n integrity: integrity.state,\n integrityDetail: integrity.reason,\n },\n lastBuild: cache?.lastBuild ?? null,\n recentBuilds: cache?.builds ?? [],\n highWater: { scanned: cache?.bestScanned ?? null, clicked: cache?.bestClicked ?? null },\n lastFetch: last ?? null,\n daysSinceLastFetch: last ? daysBetween(last.at, t0) : null,\n lastScheduledFetch,\n daysSinceLastScheduledFetch: daysSinceLastScheduledFetch === null ? null : +daysSinceLastScheduledFetch.toFixed(2),\n scheduleState,\n scheduleLooksStalled: scheduleState === \"stalled\" ? true : scheduleState === \"healthy\" ? false : null,\n feedState: state,\n fetches: cache?.fetches ?? [],\n how: HOW,\n });\n }\n\n let csv = \"\", served = \"\", rows = cachedRows;\n let build: Awaited> | null = null;\n\n if (usable && ageMs < MAX_AGE_MS) {\n csv = cache!.csv;\n served = \"cache-fresh\";\n } else {\n build = await rebuild(days);\n if (build.ok && build.rows > 0) {\n csv = build.csv;\n rows = build.rows;\n served = \"rebuilt\";\n } else if (usable) {\n // Build failed, or succeeded with nothing in it. Either way the last good file is the right\n // answer: Google de-dupes what it has already seen, and a header-only file is a failed run.\n csv = cache!.csv;\n served = build.ok ? \"cache-empty-build\" : \"cache-build-failed\";\n\n const staleDays = cache?.servingStaleSince ? daysBetween(cache.servingStaleSince, t0) : null;\n const fileAgeDays = ageMs / 86_400_000;\n if ((staleDays !== null && staleDays > MAX_STALE_SERVE_DAYS) || fileAgeDays > MAX_CACHED_FILE_AGE_DAYS) {\n const recorded = await note(cache, {\n at: new Date(t0).toISOString(), ua, served: \"503-stale-cutoff\", rows: 0,\n ms: Date.now() - t0, source: fetchSource,\n }, build, days);\n const suffix = recorded ? \"\" : \"; its failure receipt could not be stored\";\n return new Response(`stored conversion file is too old to serve safely${suffix}\\n`, {\n status: 503,\n headers: { \"Content-Type\": \"text/plain; charset=utf-8\", \"Cache-Control\": \"no-store\", \"X-Content-Type-Options\": \"nosniff\" },\n });\n }\n } else {\n // Nothing good to serve and nothing cached. Fail loudly: a failed run in the Uploads tab is\n // information. A file with no rows is a schema error Google reports as something else.\n const why = build.ok ? \"the scan found no Google-clicked contacts in the window\" : build.error;\n await note(cache, { at: new Date(t0).toISOString(), ua, served: \"503\", rows: 0, ms: Date.now() - t0, source: fetchSource }, build, days);\n return new Response(`no rows to serve: ${why}\\n`, { status: 503, headers: {\n \"Content-Type\": \"text/plain; charset=utf-8\", \"Cache-Control\": \"no-store\", \"X-Content-Type-Options\": \"nosniff\",\n } });\n }\n }\n\n const recorded = await note(cache, {\n at: new Date(t0).toISOString(), ua, served, rows, ms: Date.now() - t0, source: fetchSource,\n }, build, days, csv, rows);\n if (!recorded) {\n return new Response(\"conversion file receipt could not be stored\\n\", { status: 503, headers: {\n \"Content-Type\": \"text/plain; charset=utf-8\", \"Cache-Control\": \"no-store\", \"X-Content-Type-Options\": \"nosniff\",\n } });\n }\n\n return new Response(req.method === \"HEAD\" ? null : csv, {\n headers: {\n \"Content-Type\": \"text/csv; charset=utf-8\",\n \"Content-Disposition\": `attachment; filename=\"${FILENAME}\"`,\n \"Cache-Control\": \"no-store\",\n \"X-Feed-Served\": served,\n \"X-Feed-Rows\": String(rows),\n \"X-Feed-Built-At\": build?.ok && build.rows > 0 ? new Date(t0).toISOString() : (cache?.builtAt ?? \"\"),\n \"X-Feed-Source\": \"GoHighLevel\",\n \"X-Content-Type-Options\": \"nosniff\",\n },\n });\n}\n\n/**\n * Record the fetch, and the build if there was one, in the same blob as the file.\n *\n * WHY THE TELEMETRY IS NOT OPTIONAL. The whole point of this file is that nobody will be watching\n * it. An automation nobody watches and that cannot say when it last ran is indistinguishable from\n * one that stopped in September. Every fetch leaves its user-agent and its timestamp here, so the\n * question \"did Google actually collect this?\" has an answer that is not a guess.\n */\nasync function note(\n prev: Cache | null,\n f: FetchNote,\n build: {\n ok: boolean; rows: number; ms: number; error: string; scanned: number; clicked: number;\n csv: string; newestClickAt?: string | null; pages: number; reachedCutoff: boolean;\n truncated: boolean; appointmentFailures: number; duplicateRowsDropped: number;\n unsafeShowTiming: number; futureLeadRows: number; invalidOutcomeTimes: number;\n } | null,\n days: number,\n csv?: string,\n rows?: number,\n): Promise {\n const base: Cache = prev ?? {\n csv: \"\", rows: 0, builtAt: \"\", days, scanned: 0, clicked: 0,\n lastBuild: { at: \"\", ok: false, rows: 0, scanned: 0, clicked: 0, ms: 0, error: \"\" },\n fetches: [], builds: [], bestScanned: 0, bestClicked: 0,\n lastNonZeroBuildAt: null, servingStaleSince: null, newestClickAt: null,\n };\n const next: Cache = { ...base, fetches: [f, ...(base.fetches ?? [])].slice(0, FETCH_LOG) };\n\n // THE STALE CLOCK. Set on the FIRST fallback and left alone until a real build serves again, so\n // it measures the length of the outage rather than the time of the most recent symptom. Cleared\n // only by \"rebuilt\" — the one served value that means a fresh build actually produced the bytes.\n // \"cache-fresh\" (the under-6h shortcut) deliberately neither sets nor clears it: it is not a\n // fallback, and it cannot occur during one anyway, because builtAt only advances on a build that\n // produced rows. \"503\" does not set it either — nothing stale is being served, the request failed.\n if (f.served === \"rebuilt\") {\n next.servingStaleSince = null;\n } else if (f.served === \"cache-empty-build\" || f.served === \"cache-build-failed\") {\n next.servingStaleSince = base.servingStaleSince ?? f.at;\n }\n if (build) {\n const note: BuildNote = {\n at: f.at, ok: build.ok, rows: build.rows,\n scanned: build.scanned, clicked: build.clicked, ms: build.ms, error: build.error,\n pages: build.pages, reachedCutoff: build.reachedCutoff, truncated: build.truncated,\n appointmentFailures: build.appointmentFailures,\n duplicateRowsDropped: build.duplicateRowsDropped,\n unsafeShowTiming: build.unsafeShowTiming,\n futureLeadRows: build.futureLeadRows,\n invalidOutcomeTimes: build.invalidOutcomeTimes,\n };\n next.lastBuild = note;\n // EVERY build is recorded, empty ones included. This is the whole fix: the old code only wrote\n // scanned/clicked when rows > 0, so a collapse in supply left the last healthy numbers standing\n // and ?status kept reporting them. An empty build is exactly the build worth remembering.\n next.builds = [note, ...(base.builds ?? [])].slice(0, BUILD_LOG);\n // High-water marks only move up, and only on a build that actually completed. A timeout returns\n // zeroes and must not be allowed to reset the baseline a collapse is measured against.\n if (build.ok) {\n next.bestScanned = Math.max(base.bestScanned ?? 0, build.scanned);\n next.bestClicked = Math.max(base.bestClicked ?? 0, build.clicked);\n // THE SILENCE CLOCK, AND WHY IT ONLY EVER MOVES FORWARD.\n //\n // A build that reads the CRM fine and finds NO Google-clicked contact returns null here. If\n // that null were stored, daysSinceNewestGclidContact would go null too and the alarm would\n // disarm itself at the exact moment it was needed — the failure reporting itself as \"no data\".\n // So the stored date is only ever replaced by a NEWER one. On a collapse it stands still and\n // ages, which is what makes fourteen days of silence audible.\n const seen = build.newestClickAt ?? null;\n if (seen && (!base.newestClickAt || Date.parse(seen) > Date.parse(base.newestClickAt))) {\n next.newestClickAt = seen;\n }\n }\n // Only a build that produced rows replaces the stored file. A successful scan that found\n // nothing leaves the last good file exactly where it is.\n if (build.ok && build.rows > 0 && csv) {\n next.csv = csv;\n next.rows = rows ?? build.rows;\n next.builtAt = f.at;\n next.lastNonZeroBuildAt = f.at;\n next.days = days;\n next.scanned = build.scanned;\n next.clicked = build.clicked;\n }\n }\n return writeCache(next);\n}\n",[414],"4cd1221f-1a1e-4c20-8057-f68c806622f4","facts.ts","ac8030d4-904a-11f1-a8a4-1607ee4eb77e",1134,["D",1786832221998],9,"// ONE SOURCE OF TRUTH PER FACT. v1.0, 4 Aug 2026.\n//\n// THE ROOT CAUSE THIS FILE EXISTS TO KILL:\n// Prose and data were produced separately. Somebody wrote a sentence, something else computed a\n// number, and nothing forced them to agree. Every wrong claim in this project came from that gap:\n// - \"runs every 15 minutes\" beside a timestamp reading 26 minutes ago\n// - \"1,513 records\" that had drifted to 1,514 before a reader saw it\n// - \"35 counter sales totaling $23,463.99\" when the journal holds 40 totalling $28,035.99\n// - \"11 live questions\" in a handover doc while the page rendered 13\n// None of those were typos. Each was a sentence that had no mechanical link to its own subject.\n//\n// THE RULE: a fact is computed once, here, together with the sentence that describes it. Anything\n// that displays it reads from here. If two files can produce the same number independently, one of\n// them is wrong and nobody knows which.\n//\n// EVERY FACT CARRIES ITS PROVENANCE: where it was read and when. `Fact.source` answers \"where did\n// this number come from\" in one hop, which is the test for whether it ships.\n\nexport type Fact = {\n value: T | null; // null means NOT KNOWN, never zero-by-accident\n source: string; // the endpoint or blob it came from, in one hop\n readAt: string; // ISO timestamp of the read that produced it\n note?: string; // anything the reader must know to use it honestly\n};\n\n// Written as function DECLARATIONS rather than generic arrows on purpose.\n// [was: `export const fact = (value: T | null, ...)`. Inside the val that compiles fine, and\n// the dashboard has always rendered correct numbers from it. But esm.town, which is how any\n// OTHER val would import this file, parses a .ts file as .tsx: it read `` as an opening JSX\n// tag and served `export const fact = _jsxs(T, { children: [\"(value: T | null, source...\"] })`\n// — the type signature turned into React children. Anything importing it got garbage that would\n// have thrown at call time, not at import time. The watchdog needs to import this file so that\n// the Square backlog is computed in exactly one place; `function fact(` is unambiguous to\n// both parsers, so it can.]\nexport function fact(value: T | null, source: string, note?: string): Fact {\n return { value, source, readAt: new Date().toISOString(), note };\n}\n\n/** A fact that could not be read. Distinct from a fact whose value is genuinely zero. */\nexport function unknownFact(source: string, note?: string): Fact {\n return { value: null, source, readAt: new Date().toISOString(), note };\n}\n\n// ---------------------------------------------------------------------------------------------\n// THE SQUARE BACKLOG. Previously four numbers typed into a sentence: \"35 counter sales totaling\n// $23,463.99. 14 of the 35 carry enough of a trail; the other 21 arrived with no name.\"\n// An independent re-derivation found 40 / $28,035.99 / 10 / 30. The typed version understated the\n// unlinked money by $4,572 and understated the unresolvable count by 9. It is computed now.\n//\n// The subtlety that makes this worth a function rather than a one-liner: the bridge RE-LOGS the\n// same payment on every retry, so 87 journal rows collapse to 40 distinct payments. Summing rows\n// instead of payments gives $56,369.97, which is double-counting, not a bigger truth.\n// ---------------------------------------------------------------------------------------------\n\nexport type SquareBacklog = {\n payments: number; // distinct payment ids that never matched a contact\n total: number; // their summed value, counting each payment once\n withTrail: number; // carry an email, phone or Square customer id: recoverable with effort\n withTrailTotal: number;\n noTrail: number; // arrived with nothing at all: no permission will ever resolve these\n noTrailTotal: number;\n};\n\n// FIXED 9 Aug 2026. The loop below used to start `if (r.kind !== \"NO-MATCH\") continue`, which\n// meant the comment about reading \"ANY row for this payment\" was a lie: only NO-MATCH rows were\n// ever seen. A payment that failed to match on the first attempt and matched on a later one was\n// still counted as unmatched forever. That overstated the backlog Kim was shown by $10,884.00\n// across 9 payments: the reported payment count and value were both materially too high. The client has the wrong\n// figure in writing, so this is a correction owed, not just a cleanup.\n// A payment is only unmatched if NO row anywhere in the journal ties it to a contact.\n//\n// FIXED AGAIN 12 Aug 2026, and this one is the reason paymentId() exists as its own function.\n// The guard above is correct and it never fired, because it was guarding the wrong GROUP. The\n// bridge writes two note shapes for one payment:\n// \"payment \" the NO-MATCH row\n// \"backfilled from square payment ; client opp untouched\" the row that RESOLVED it\n// `\\S+` is greedy about punctuation, so the second one keyed on \";\" and the first on \"\".\n// One payment became two, the failing half looked permanently unmatched, and the resolving half\n// sat under a key nothing read. Measured live: a large batch of payments reported as never having\n// reached a customer when the journal names the contact each was backfilled to, on the same row, at\n// the same second. The reported count and value were both roughly an order of magnitude too high.\n// The client has the wrong figure in writing for the THIRD time on this one number — correction owed.\n// THE RULE THIS ENCODES: a guard is only as good as the key that groups the rows it guards.\n// Also read the `id` FIELD: PAY-DUP rows carry the payment id there and have no note at all.\nconst MATCHED_KINDS = new Set([\"REVENUE-ON-CLIENT-OPP\", \"PAYMENT\", \"CAPI-PURCHASE\", \"INVOICE-LINKED\"]);\nexport function paymentIds(row: unknown): string[] {\n const r = row as any;\n const clean = (s: unknown) => String(s ?? \"\").replace(/[;,.]+$/, \"\");\n const out = new Set();\n if (typeof r?.id === \"string\" && r.id) out.add(clean(r.id));\n const m = /payment\\s+(\\S+)/.exec(String(r?.note ?? \"\"));\n if (m) out.add(clean(m[1]));\n out.delete(\"\");\n return [...out];\n}\nexport function squareBacklog(journal: unknown): SquareBacklog | null {\n if (!Array.isArray(journal)) return null;\n const rowsFor = new Map();\n for (const r of journal as any[]) {\n for (const id of paymentIds(r)) {\n (rowsFor.get(id) ?? rowsFor.set(id, []).get(id)!).push(r);\n }\n }\n const byPayment = new Map();\n for (const [id, rs] of rowsFor) {\n if (!rs.some((r) => r?.kind === \"NO-MATCH\")) continue; // never failed: not a backlog item\n if (rs.some((r) => MATCHED_KINDS.has(r?.kind) || (typeof r?.contactId === \"string\" && r.contactId.length > 4))) continue; // matched later\n const amt = rs.map((r) => Number(r?.amount) || 0).find((a) => a > 0) ?? 0;\n const trail = rs.some((r) => r?.hadEmail === true || r?.hadPhone === true || r?.hadCustomerId === true);\n byPayment.set(id, { amt, trail });\n }\n const rows = [...byPayment.values()];\n const sum = (f: (x: { amt: number; trail: boolean }) => boolean) =>\n rows.filter(f).reduce((a, x) => a + x.amt, 0);\n return {\n payments: rows.length,\n total: rows.reduce((a, x) => a + x.amt, 0),\n withTrail: rows.filter((x) => x.trail).length,\n withTrailTotal: sum((x) => x.trail),\n noTrail: rows.filter((x) => !x.trail).length,\n noTrailTotal: sum((x) => !x.trail),\n };\n}\n\n// ---------------------------------------------------------------------------------------------\n// THE PAYMENT LEDGER. Added 15 Aug 2026 so the match-ratio check can run on a schedule.\n//\n// WHY IT LIVES HERE AND NOT IN THE MONITOR. engine/watch.ts's matchRatioFindings answers the\n// second thing Kim asked to be warned about on 12 Aug, \"payments no longer being matched\". It\n// needs one row per Square payment carrying WHEN it arrived and WHETHER it ever reached a\n// customer record. That is the same rule squareBacklog() applies directly above, so it is\n// computed here, from the same paymentIds() and the same MATCHED_KINDS, rather than hand-copied\n// into the monitor. This project has already paid three times for a second reading of this exact\n// rule drifting from the first: three different totals on three different days, and the count figure\n// Kim now has in writing twice. A fourth copy is the one thing that must not happen.\n//\n// TWO EXCLUSIONS, BOTH OF WHICH CHANGE THE RATIO RATHER THAN THE BACKLOG. squareBacklog() does\n// not need them, because a refund never carries a NO-MATCH row and the bridge's own self test is\n// always linked, so neither can enter the backlog. Both WOULD enter a ratio, because a ratio\n// counts the population and not just the failures:\n// * REFUND ids live in their own namespace. Counted as payments they inflate the denominator\n// and a busy refund day reads as a matching collapse.\n// * The bridge posts itself a $1.00 payment to prove the pipe works. It is not a sale.\n// These mirror scripts/exception-report-lib.mjs REFUND_KINDS and SELF_TEST_PAYMENT_ID, and\n// tests/payment-ledger.test.mjs holds the two side by side and fails if they ever disagree.\n// ---------------------------------------------------------------------------------------------\n\nexport const REFUND_KINDS = new Set([\n \"REFUND\", \"REFUND-NO-MATCH\", \"REFUND-PENDING\", \"REFUND-DUP\", \"REFUND-PENDING-APPLIED\", \"BAD-REFUND\",\n]);\nexport const SELF_TEST_PAYMENT_ID = /^(TESTPAY|captest)[-_]/i;\n\n/** One Square payment: when the bridge first wrote it down, and whether it ever reached a contact. */\nexport type LedgerRow = { id: string; atMs: number | null; matched: boolean };\n\n/**\n * Every distinct Square payment the bridge has logged, in the shape ratioBuckets() takes.\n *\n * `matched` is the SAME test squareBacklog() uses to decide a payment is not backlog: any row,\n * on any attempt, that ties the payment to a contact counts, no matter how many times it failed\n * first. `atMs` is the EARLIEST timestamp on any of the payment's rows, because a payment belongs\n * to the window it arrived in and not to the window somebody finally fixed it in. Dating it by the\n * fix would move failures forward into the present and flatter every past window.\n */\nexport function paymentLedger(journal: unknown): LedgerRow[] {\n if (!Array.isArray(journal)) return [];\n const rowsFor = new Map();\n for (const r of journal as any[]) {\n if (REFUND_KINDS.has((r as any)?.kind)) continue;\n for (const id of paymentIds(r)) {\n if (SELF_TEST_PAYMENT_ID.test(id)) continue;\n (rowsFor.get(id) ?? rowsFor.set(id, []).get(id)!).push(r);\n }\n }\n const out: LedgerRow[] = [];\n for (const [id, rs] of rowsFor) {\n const matched = rs.some((r) =>\n MATCHED_KINDS.has(r?.kind) || (typeof r?.contactId === \"string\" && r.contactId.length > 4));\n const stamps = rs\n .map((r) => Date.parse(String(r?.ts ?? \"\")))\n .filter((n) => Number.isFinite(n))\n .sort((a, b) => a - b);\n out.push({ id, atMs: stamps.length ? stamps[0] : null, matched });\n }\n return out.sort((a, b) => (a.atMs ?? 0) - (b.atMs ?? 0));\n}\n\n// ---------------------------------------------------------------------------------------------\n// SENTENCES ARE GENERATED FROM VALUES, NEVER COMPOSED ALONGSIDE THEM.\n// Each of these takes the fact and returns the words. There is no path by which the words can\n// describe a different number from the one passed in, because there is only one number.\n// ---------------------------------------------------------------------------------------------\n\nconst money = (n: number) => `$${n.toLocaleString(\"en-US\", { minimumFractionDigits: 2, maximumFractionDigits: 2 })}`;\n\nexport function squareSentence(b: SquareBacklog | null): string {\n if (!b || b.payments === 0) {\n return \"We could not read the payment records just now, so there is nothing to report here rather than a zero to trust.\";\n }\n // WHY THIS NO LONGER SPLITS THE COUNT INTO TRACEABLE AND HOPELESS, 12 Aug 2026.\n // It used to end \"arrived with no name, email or phone attached at all, and nothing will ever\n // resolve those\". That sentence was false. hadEmail/hadPhone/hadCustomerId describe the WEBHOOK\n // PAYLOAD the bridge received, not what Square holds. Checked live against Square: the payment\n // this sentence called hopeless is Caroline Riner, and Square has her name and her phone number.\n // The flags got it exactly backwards for two of the four. A page may not tell an owner a sale is\n // unrecoverable on the strength of a field that was never asking that question.\n // THE RULE: never let a sentence make a claim stronger than the field behind it can carry.\n const parts = [\n `${b.payments} counter sales totaling ${money(b.total)} are recorded but not linked to a name.`,\n \"The exception list names each one with whatever the card reader captured, so they can be placed by hand.\",\n \"This is old filing rather than missing money. Every dollar was collected.\",\n ];\n return parts.join(\" \");\n}\n\n// ---------------------------------------------------------------------------------------------\n// THE PHONE-CALL OMISSION. Two facts sat on the page and were never joined: a channel bucket\n// labelled \"somewhere else\" holding 20 people, and a separate line saying the old source column\n// logged 22 phone calls. An independent cross-tab showed the \"other\" bucket is 20 of 20 phone\n// calls, 100%. The page had the answer twice and printed it as a shrug. Computed now.\n// ---------------------------------------------------------------------------------------------\n\nexport type ContactLike = {\n source?: string | null;\n attribution?: { medium?: string | null } | null;\n dateAdded?: string;\n};\nexport type Win = { startMs: number; endMs: number };\n\n/**\n * What share of the un-named \"other\" medium bucket is explained by phone calls?\n *\n * THE WINDOW IS MANDATORY, and this is not defensive typing. The first version of this function\n * took no window, so it counted every contact ever fetched (nine weeks) and rendered \"all 192 of\n * them are logged as phone calls\" directly beneath a bar that read 20. Same disease, in the code\n * written to cure it: a sentence describing a different population from the chart above it.\n * A caller that cannot supply the window gets null rather than a number from the wrong period.\n */\nexport function otherBucketExplanation(contacts: ContactLike[] | null, w: Win | null): { other: number; phoneInOther: number } | null {\n if (!Array.isArray(contacts) || !contacts.length || !w) return null;\n const inWin = (c: ContactLike) => {\n const t = Date.parse(c.dateAdded ?? \"\");\n return Number.isFinite(t) && t >= w.startMs && t < w.endMs;\n };\n const scoped = contacts.filter(inWin);\n if (!scoped.length) return null;\n const isOther = (c: ContactLike) => /^other$/i.test(String(c.attribution?.medium ?? \"\").trim());\n const isPhone = (c: ContactLike) => /phone/i.test(String(c.source ?? \"\"));\n return {\n other: scoped.filter(isOther).length,\n phoneInOther: scoped.filter((c) => isOther(c) && isPhone(c)).length,\n };\n}\n\nexport function otherBucketSentence(x: { other: number; phoneInOther: number } | null): string {\n if (!x || x.other === 0) return \"\";\n if (x.phoneInOther === 0) {\n return `The ${x.other} filed as \"somewhere else\" carry an arrival record that just says \"other\", and none of them match a logged phone call, so we genuinely cannot place them.`;\n }\n const all = x.phoneInOther === x.other;\n return all\n ? `Worth knowing what \"somewhere else\" actually is: all ${x.other} of them are logged in your CRM as phone calls. Your arrival record has no category for a call, so people who rang you land in that bucket. They are not unknown, they are your callers.`\n : `${x.phoneInOther} of the ${x.other} filed as \"somewhere else\" are logged in your CRM as phone calls. Your arrival record has no category for a call, so callers land in that bucket rather than one of their own.`;\n}\n\n// ---------------------------------------------------------------------------------------------\n// CROSS-ARTIFACT REGISTRY. Any fact that appears in more than one place (page, PDF, ledger, a\n// message to the client) is registered here by name. The consistency test walks this list and\n// fails the build when two artefacts state the same named fact differently. Drift becomes\n// impossible rather than merely unlikely.\n// ---------------------------------------------------------------------------------------------\n\nexport type SharedFact = {\n name: string; // stable id\n pattern: RegExp; // how it appears in prose, capturing the value\n describe: string; // what it is, for the failure message\n};\n\nexport const SHARED_FACTS: SharedFact[] = [\n { name: \"decision_count\", pattern: /(\\d+)\\s+(?:live\\s+)?questions?\\s+(?:on this page\\s+)?(?:are|is)?\\s*wait/i, describe: \"how many questions are waiting on Kim\" },\n { name: \"bootcamp_bookings\", pattern: /(\\d+)\\s+Bootcamp bookings/i, describe: \"Bootcamp bookings on record\" },\n { name: \"bootcamp_ceiling\", pattern: /\\$([\\d,]+)\\s*(?:,|\\.|and|$)/i, describe: \"the Bootcamp exposure ceiling\" },\n { name: \"slow_track_len\", pattern: /(\\d+)\\s+more spread over about\\s+(\\d+)\\s+months/i, describe: \"the slow track length\" },\n { name: \"automations\", pattern: /(?:all\\s+)?(\\d+)\\s+automations/i, describe: \"automations in the account\" },\n];\n\n// ---------------------------------------------------------------------------------------------\n// THE TAG THAT DECIDES WHETHER GO-LIVE REACHES ANYBODY.\n// The engine enrolls on the tag `nurture - puppy`. If nothing applies it, switching the sequence\n// on reaches nobody, and it looks healthy while doing so: the engine reports successful runs with\n// zero enrollments, which is exactly what a working system with no work also looks like.\n//\n// [was: the page said \"1,200 of your most recent contacts were checked and not one carries the\n// tag\". True when it was typed, and a scan size rather than an answer: it left open whether the\n// other four thousand were different. GoHighLevel will filter contacts by tag server-side and\n// return a total, so the real number is one call away. Cross-checked 5 Aug against a full walk of\n// all 5,544 contacts, page by page: \"no sale\" 133, \"tips-nurture\" 155, \"customer\" 1,512, and\n// `nurture - puppy` zero. The filter and the census agree on every one.]\n// ---------------------------------------------------------------------------------------------\nexport type TagCoverage = { tag: string; tagged: number; total: number };\n\nexport function tagCoverageSentence(t: TagCoverage | null): string {\n if (!t || t.total <= 0) {\n return \"We could not read your contact records just now, so this says nothing rather than a zero worth trusting.\";\n }\n if (t.tagged === 0) {\n return `Every one of your ${t.total.toLocaleString(\"en-US\")} contact records was checked just now, and not a single one is marked as a puppy inquiry. Nothing in your account applies that mark, which is why the tagging has to be switched on at the same moment as everything else.`;\n }\n const pct = Math.round((t.tagged / t.total) * 100);\n // [was: \"1 ... are marked ... Those are the people\" — a real reader hit the n=1 case on 9 Aug\n // and the plural read as a glitch on a page that trades on precision. Number agreement is now\n // computed from the count, never assumed.]\n const one = t.tagged === 1;\n return `${t.tagged.toLocaleString(\"en-US\")} of your ${t.total.toLocaleString(\"en-US\")} contact records ${one ? \"is\" : \"are\"} marked as a puppy inquiry, checked just now, which is ${pct < 1 ? \"under 1\" : pct}% of them. ${one ? \"That is the one person\" : \"Those are the people\"} the new messages would pick up.`;\n}\n",[422],"eb90323f-8d68-4475-9df3-83a104f20880","didntbuy-messages.ts","f729f928-98db-11f1-a772-1607ee4eb77e",1125,["D",1786820593709],"// THE \"HAD THE PUP TALK, DIDN'T BUY\" PATH. v1.0, 15 Aug 2026.\n//\n// WHO THIS IS FOR, AND WHY IT IS THE HARDEST OF THE SIX TO WRITE.\n//\n// They turned up. They talked to your team for twenty minutes about their dog. They heard what the\n// programmes cost. And they said no, or said nothing, which is the same thing.\n//\n// That makes them the opposite of every other path. The puppy path talks to someone who has not\n// spoken to anybody yet. The no-show path talks to someone who never made it through the door. This\n// one talks to somebody who has already had the conversation and already declined — so every\n// argument for the service has already been made to them once, by a person, and it did not land.\n//\n// Repeating it louder is the obvious move and it is the wrong one. The account already does that:\n// `POST CONSULT - NO SALE NURTURE MESSAGES` and `Tag added 'No Sale' > No Sale Nurture` are both\n// published, and 142 contacts carry the `no sale` tag. 126 of those also carry `tips-nurture`, so a\n// meaningful number of these people are getting two sequences at once already.\n//\n// THE RULE THIS FILE IS WRITTEN ON: never re-pitch the thing they said no to.\n//\n// * Not one message asks them to reconsider, or mentions a programme, or a price.\n// * Not one message references the money, the cost, or \"when you're ready to invest\".\n// * Every message is worth reading if they never buy anything. That is not generosity, it is the\n// only thing that still works on somebody who has already declined a sales conversation.\n// * The reason most people say no is not price, it is that they do not yet believe the problem is\n// solvable. So the messages show the problem being solved, in small pieces they can try today.\n// * It is longer and slower than the others: five touches over ninety days, widening gaps of 11,\n// 16, 30 and 30 days. Somebody who said no in August may have a very different week in November.\n// * The only ask, and it appears once, at the end, is a conversation — not a purchase.\n//\n// KIM'S PRICE RULE IS ABSOLUTE HERE and the validator enforces it: no training price appears in any\n// message on any path. On this path it matters more than anywhere else, because a price is exactly\n// the thing they already heard and declined. Her $500 discount decision lives near this path and is\n// deliberately NOT in it — that needs its own wording and its own switch before it goes anywhere\n// near a customer.\n//\n// CONSTRAINTS (engine/paths.ts validator, all enforced by test):\n// never \"discovery call\" — it is Pup Talk · never grooming · NEVER a price · only {{FIRST_NAME}}\n// and {{DOG_NAME}} · SMS 320 chars · booking links point at the Pup Talk calendar we own.\n\nimport { PHONE_DISPLAY, SHORT_BOOKING_LINK } from \"./puppy-messages.ts\";\nimport type { Step } from \"./paths.ts\";\n\nexport const DIDNTBUY_STEPS: Step[] = [\n {\n id: \"main-1\",\n channel: \"email\",\n offsetHours: 72,\n subject: \"One thing you can try this week\",\n previewText: \"Nothing to book. Just the thing I would start with.\",\n // THREE DAYS, AND NO ASK AT ALL. The conversation is still fresh enough to be remembered and far\n // enough back that a message does not read as a follow-up call. There is deliberately no link in\n // the body of this one beyond the sign-off, because the ask is what they already declined.\n bodyTemplate: `Hi {{FIRST_NAME}},\n\nThanks for taking the time to talk to us about {{DOG_NAME}}. Whatever you decide to do next, here is\nthe one thing I would start with, and it costs nothing.\n\nPick the single behaviour that annoys you most, and for one week stop correcting it. Instead, decide\nwhat you would rather {{DOG_NAME}} did in that exact moment — sitting instead of jumping, going to a\nmat instead of barking at the door, looking at you instead of at the other dog — and reward that\nevery single time you see it, even by accident.\n\nMost people have never tried it that way round, because telling a dog \"no\" feels like doing something\nand waiting to catch them being good feels like doing nothing. But a dog cannot stop doing a thing\nwithout being given something else to do, and the something else is what you are building.\n\nGive it a week before you judge it. It usually looks worse for two days and then noticeably better.\n\nKim\nThe Dogs Spot`,\n },\n {\n id: \"main-2\",\n channel: \"email\",\n offsetHours: 336, // day 14\n subject: \"Why it gets worse before it gets better\",\n previewText: \"If you tried it and week one was rough, this is why.\",\n // FOLLOWS DIRECTLY FROM MESSAGE ONE. If they tried it, this explains what they saw and keeps\n // them going. If they did not, it still reads as useful. Either way it earns the next email.\n bodyTemplate: `Hi {{FIRST_NAME}},\n\nIf you tried what I sent a fortnight ago and the first few days were worse rather than better, that\nis not you doing it wrong. It has a name and it is worth knowing about, because it is the exact point\nwhere most people give up.\n\nWhen something has always worked for a dog — barking until you open the door, pulling until you\nfollow — and it suddenly stops working, they do not immediately try something else. They do the same\nthing harder first. Louder, longer, more insistent. It is the same reason people press a lift button\nrepeatedly.\n\nThat burst is the signal it is working. It is also the moment almost everybody caves, and caving\nteaches the dog that the louder version is the one that pays. That single moment undoes more training\nthan anything else I see.\n\nSo: expect two or three days of worse. Decide in advance what you will do when it happens. And if you\nare going to give in, give in immediately rather than after twenty minutes, because the twenty\nminutes is what teaches them persistence works.\n\nKim\nThe Dogs Spot`,\n },\n {\n id: \"main-3\",\n channel: \"sms\",\n offsetHours: 720, // day 30\n // The only SMS before the end. Short, no link, and it asks a question rather than making an\n // offer, because a question from a real person is the only thing that reopens a closed door.\n bodyTemplate:\n `Hi {{FIRST_NAME}}, it's Kim at The Dogs Spot. No pitch - just curious how {{DOG_NAME}} is getting on ` +\n `since we spoke. Reply and tell me, a real person reads these. Reply STOP to opt out.`,\n },\n {\n id: \"main-4\",\n channel: \"email\",\n offsetHours: 1440, // day 60\n subject: \"The three things that actually change a dog\",\n previewText: \"None of them cost anything.\",\n // THE MOST USEFUL MESSAGE IN THE PATH, and by design it makes the service less necessary rather\n // than more. Somebody who declined a sales conversation two months ago will not be moved by\n // urgency; they might be moved by a business that keeps being useful without asking.\n bodyTemplate: `Hi {{FIRST_NAME}},\n\nTwo months on, here is the honest version of what changes a dog, in the order it matters. None of it\ncosts anything and none of it needs us.\n\n**One. What gets rewarded gets repeated, including the things you did not mean to reward.** Almost\nevery problem I see is something the dog is being paid for by accident. Attention counts as payment,\nand so does shouting.\n\n**Two. Consistency beats intensity.** Five minutes a day, every day, beats an hour at the weekend by\na distance most people would not believe. Dogs learn on repetition, not on effort.\n\n**Three. Manage the situation while you train the behaviour.** If {{DOG_NAME}} rehearses the wrong\nthing forty times a week while you work on it, you are training against yourself. Close the curtain,\nchange the route, use the lead. It is not cheating, it is how the training gets a chance to work.\n\nIf you have got what you needed on your own, that is genuinely a good outcome and I am glad. If you\nare stuck on one specific thing, reply and tell me what it is — I will tell you what I would try,\nwhether or not you ever come to us.\n\nKim\nThe Dogs Spot`,\n },\n {\n id: \"main-5\",\n channel: \"email\",\n offsetHours: 2160, // day 90\n subject: \"Last one from me\",\n previewText: \"And an open door, whenever it suits.\",\n // THE ONLY ASK IN THE WHOLE PATH, ninety days after they declined, and it is a conversation\n // rather than a purchase. It also says the sequence is ending, which is the line most likely to\n // get a reply from somebody who has read four and answered none.\n bodyTemplate: `Hi {{FIRST_NAME}},\n\nThis is the last email I will send about {{DOG_NAME}}, so I will keep it short.\n\nThree months ago we talked and you decided it was not the right time. That was a perfectly reasonable\ndecision, and nothing I have sent since has tried to talk you out of it, which I hope you noticed.\n\nTwo things before I stop.\n\nIf any of what I have sent was useful, that is the whole point of it and you owe us nothing for it.\n\nAnd if something has changed — a new problem, an old one that got worse, or just a different few\nmonths — the door is open. A Pup Talk is still free and still just a conversation, with no\nobligation to do anything afterwards, same as last time.\n\n${SHORT_BOOKING_LINK}\n\nOr call or text ${PHONE_DISPLAY} and ask for me.\n\nGood luck with them either way.\n\nKim\nThe Dogs Spot`,\n },\n];\n",[430],"4aefaaf2-4ab8-465c-a9d5-c175535ac49f","deposits.ts","2e97d0d2-91ad-11f1-a57d-1607ee4eb77e",1153,["D",1786979121965],15,"// HOLIDAY DEPOSIT COLLECTOR. The only part of this feature that touches her CRM. v1.0, 6 Aug 2026.\n//\n// WHY IT IS A SEPARATE FILE. holiday-deposits.ts holds all the judgement and a test asserts that\n// it contains no fetch() and no write verb at all. That assertion is only worth something if the\n// network code lives somewhere else, so it lives here. This file fetches and stores; it decides\n// nothing. Every decision is made by a function imported from the module that cannot reach the\n// network.\n//\n// WHAT IT DOES, IN ORDER\n// 1. asks both Boarding Drop Off calendars for the events inside this season's deposit windows\n// 2. groups them into stays (one customer, one day, however many dogs)\n// 3. reads each of those customers' notes, which is where Square money lands\n// 4. writes the answer into the `holiday_deposits` blob\n// The dashboard renders that blob and never repeats any of this, so Kim's page stays fast and\n// cannot be broken by a slow CRM.\n//\n// GET ONLY. Every request in here is a GET. There is no code path that tags, messages, moves or\n// updates anybody, and there is no argument that makes one appear.\n//\n// A FAILED READ IS NOT A ZERO. If a customer's notes cannot be read, that customer is recorded as\n// unknown, with the reason, and stays unknown all the way to Kim's screen. The one thing this\n// feature must never do is turn a network hiccup into \"this person has not paid\".\n//\n// ?k= the stored answer, as JSON\n// ?k=&run=1 re-collect from the live CRM, then store and return it\ndeclare const Deno: { env: { get(k: string): string | undefined } };\nif (typeof (globalThis as any).Deno === \"undefined\") {\n (globalThis as any).Deno = { env: { get: (k: string) => (globalThis as any).process?.env?.[k] } };\n}\nimport {\n holidayWindows, seasonYear, groupIntoStays, parseSquarePayments, statusFor, feedLooksDead,\n depositSentence, paymentsNearStay, statusesForCustomer, shiftDays, businessDay, type CalEvent, type Payment, type StayStatus,\n} from \"./holiday-deposits.ts\";\n\nconst GHL = \"https://services.leadconnectorhq.com\";\nconst LOC = \"BQHJ19uohldYe3eqA0bl\";\n// Both drop-off calendars. One customer appears on BOTH of these in her live data, which is why\n// the union is taken rather than whichever one someone remembers first.\nexport const BOARDING_CALENDARS = [\"wS5N8WN4BbzznaLjEg1N\", \"ZmmjQJszkRMUltfEbumB\"];\n// The matching PICK UP calendars. A drop-off appointment is a ten minute handover slot, so the\n// only place the length of a stay is written down is here. Read on 6 Aug: Ghost and Chewy drop\n// off on 25 Nov and are collected on the 28th, and nothing on the drop-off calendar says that.\nexport const PICKUP_CALENDARS = [\"1FnbK7pQp1ViZWIzX9SR\", \"bN6wWGJa0qKq0QGRg4CC\"];\n// How far past the last window to look for the pick-up that ends a stay running over New Year.\nexport const LOOKAHEAD_DAYS = 30;\nexport const BLOB_KEY = \"holiday_deposits\";\n// How far before the first holiday window to look for bookings. A stay that starts earlier and\n// runs into the window is still a holiday stay; the query filters on drop-off time, so it has to\n// be fetched before it can be judged.\nexport const LOOKBACK_DAYS = 21;\n// The notes endpoint takes NO paging parameters (it 422s on limit and on offset), so the only\n// defence against a silently truncated list is to treat a response at the cap as unreadable.\n// 100 is the usual GHL page size; the largest real list across 60 sampled contacts was 3.\nexport const NOTES_UNPAGEABLE_CAP = 100;\n// How often the list is refreshed off the engine's schedule.\nexport const REFRESH_EVERY_MS = 3_600_000;\n// The ATTEMPT stamp, written on every try. Gating on the stored list instead means a run that\n// legitimately declines to store — no credential, no calendar, everybody unreadable, an empty\n// season held back — leaves the gate open, and the engine then retries every 15 minutes forever\n// against a CRM that is already unwell.\nexport const ATTEMPT_KEY = \"holiday_deposits_attempt\";\n\n/** Is it time to look again? Pure, so the rule can be tested instead of inspected as text.\n * An unreadable or missing stamp opens the gate: never having looked, and not being able to tell\n * when we last looked, both mean look now. A NaN must not close it forever. */\n/** THE WHOLE \"should I collect now\" STEP, in one place, so both schedules run the same code and a\n * test can watch it decide. [was: hand-rolled in main.ts and again in deposits-cron.ts, checked\n * by greps for the word `needsRefresh`. A mutation that called needsRefresh and threw the answer\n * away — collecting from her CRM on every tick — passed all three of those greps.] */\nexport async function refreshIfDue(\n readStamp: () => Promise<{ at?: string } | null>,\n run: () => Promise<{ ok: boolean; error?: string }>,\n nowMs: number,\n): Promise<{ ran: boolean; why: string }> {\n const last = await readStamp().catch(() => null);\n if (!needsRefresh(last?.at, nowMs)) return { ran: false, why: \"not due yet\" };\n const r = await run();\n return { ran: true, why: r.ok ? \"collected\" : `not stored: ${r.error ?? \"unknown\"}` };\n}\n\nexport function needsRefresh(lastAttemptAt: string | null | undefined, nowMs: number, everyMs = REFRESH_EVERY_MS): boolean {\n if (!lastAttemptAt) return true;\n const t = Date.parse(String(lastAttemptAt));\n if (!Number.isFinite(t)) return true;\n return nowMs - t > everyMs;\n}\n\n/** Whether a finished collection may replace what is stored. Pure, so all four refusals are\n * testable; they used to be reachable only through the live blob and were checked as regexes. */\nexport function decideStore(out: DepositBlob, prev: DepositBlob | null, force = false): { store: boolean; error?: string } {\n // A collection that could not read a single calendar is NOT stored: overwriting a good answer\n // with an empty one would show Kim \"no holiday stays booked\" the first time her CRM blinked.\n if (out.calendarsRead === 0) return { store: false, error: \"no calendar answered, so the stored list was left alone\" };\n // NOR a collection in which every single row is unknown. The calendars answered, so the guard\n // above lets it through, and the blob would be replaced with a page of \"could not check\" AND a\n // fresh timestamp — the content gets worse while the page claims to have just been updated.\n if (out.rows.length > 0 && out.rows.every((r) => r.state === \"could_not_check\")) {\n return { store: false, error: \"nobody's payments could be read, so the stored list was left alone\" };\n }\n // NOR a run that has gone from a real list to nothing. A renamed calendar answers 200 with an\n // EMPTY events array, which is well formed and passes both guards above; in December that\n // silently replaces her shortlist with \"nothing to check\". A season really can empty out, so\n // this is not permanent: it holds the old list, says why, and the card starts ageing visibly.\n if (!force && out.rows.length === 0 && (prev?.rows?.length ?? 0) > 0) {\n return { store: false, error: `the boarding calendars answered but returned no holiday bookings at all, where the stored list has ${prev!.rows.length}. That is usually a renamed calendar rather than an empty season, so the stored list was left alone. Re-run with force=1 to accept it.` };\n }\n // NOR A RUN THAT SEES LESS THAN THE STORED ONE DID.\n //\n // This is the hole the three guards above left open, and it is the worst of the four because it\n // is silent. There are two boarding calendars precisely because one customer can appear on\n // either; the row list is their union. If ONE calendar fails — a transient 5xx, a revoked scope,\n // a rename — `calendarsRead` comes back 1 of 2, every guard above passes, and the partial union\n // is written straight over the complete one. The customers who only ever appear on the calendar\n // that failed do not become \"could not check\" rows. Their bookings were never fetched, so they\n // get NO ROW AT ALL: they vanish off Kim's shortlist entirely, under a banner that says one\n // calendar did not answer but cannot say who is missing. There is no retry anywhere in this\n // file, so one blip is enough. Found on 7 August; nothing guarded it.\n //\n // Compared by how many did NOT answer, not by the raw count, so genuinely deleting a calendar\n // (2 asked and read, then 1 asked and read) still stores.\n const missedNow = (out.calendarsAsked - out.calendarsRead) + (out.pickupsAsked - out.pickupsRead);\n const missedBefore = prev ? (prev.calendarsAsked - prev.calendarsRead) + (prev.pickupsAsked - prev.pickupsRead) : 0;\n if (!force && prev && missedNow > missedBefore) {\n return { store: false, error: `this run could not read ${missedNow} calendar(s) where the stored list was missing ${missedBefore}, so it sees fewer bookings than what is already saved. A shorter list with a newer timestamp is worse than the saved one going visibly stale, so the stored list was left alone.` };\n }\n return { store: true };\n}\nasync function sha256Hex(s: string): Promise {\n const b = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(s));\n return [...new Uint8Array(b)].map((x) => x.toString(16).padStart(2, \"0\")).join(\"\");\n}\nasync function authorised(k: string): Promise {\n const configured = Deno.env.get(\"NURTURE_ADMIN_KEY_SHA256\");\n if (!k || !configured || !/^[0-9a-f]{64}$/i.test(configured)) return false;\n const expected = configured.toLowerCase();\n const got = await sha256Hex(k);\n if (got.length !== expected.length) return false;\n let d = 0;\n for (let i = 0; i < got.length; i++) d |= got.charCodeAt(i) ^ expected.charCodeAt(i);\n return d === 0;\n}\nasync function blobMod() { return (await import(\"https://esm.town/v/std/blob\")).blob; }\nasync function token(): Promise {\n const env = Deno.env.get(\"GHL_TOKEN\");\n if (env) return env;\n const cfg = await (await blobMod()).getJSON(\"puppy_config\").catch(() => null);\n return (cfg as any)?.ghlToken;\n}\n\n// The single door to the network, and it only knows one verb. Named so that a reader checking\n// \"can this thing write to her account\" gets their answer from the signature.\nasync function getJson(path: string, version: string, tok: string): Promise {\n const r = await fetch(`${GHL}${path}`, {\n method: \"GET\",\n // curl's UA is not decoration: her CRM rejects requests without it.\n headers: { Authorization: `Bearer ${tok}`, Version: version, \"User-Agent\": \"curl/8.5.0\" },\n signal: AbortSignal.timeout(20_000),\n });\n if (!r.ok) throw new Error(`HTTP ${r.status}`);\n return r.json();\n}\n\nexport type DepositRow = {\n contactId: string;\n name: string;\n day: string;\n until: string;\n dogs: string[];\n dogCount: number;\n window: string;\n state: StayStatus[\"state\"];\n amountSeen: number;\n note: string;\n};\nexport type DepositBlob = {\n at: string;\n season: number;\n windows: { name: string; from: string; to: string }[];\n rows: DepositRow[];\n sentence: string;\n feedDead: boolean;\n readFailures: number;\n calendarsRead: number;\n calendarsAsked: number;\n pickupsRead: number;\n pickupsAsked: number;\n};\n\nconst dayMs = (d: string) => Date.parse(`${d}T00:00:00Z`);\n\n/** Every page of a contact's notes, or null if we could not be sure we had them all.\n * Returning a SHORT list would be indistinguishable from a customer with no payments, so a read\n * that cannot be completed returns null and the customer is reported as unknown. */\nasync function allNotes(io: { get: (p: string, v: string) => Promise }, contactId: string): Promise {\n // NO QUERY STRING. [was: `?limit=100&offset=N`, written to fix a truncation worry. This endpoint\n // rejects both: it answers 422 \"property limit should not exist\" to any parameter at all, so\n // every customer became a failed read. It shipped, and both live customers came back \"could not\n // check\" ninety seconds later. It was caught by running it against her account, not by the 250\n // assertions that stayed green — the fixtures answered a URL the real CRM refuses.]\n const d = await io.get(`/contacts/${contactId}/notes`, \"2021-07-28\");\n // A 200 with no notes ARRAY is a response we do not understand, not a customer with no notes.\n if (!Array.isArray(d?.notes)) return null;\n // The endpoint takes no paging parameters, so it returns the lot or it does not. If a response\n // ever comes back at exactly the cap, we cannot tell a full list from a truncated one, and an\n // unknown is the only honest answer. Across 60 sampled contacts on 6 Aug the largest was 3.\n if (d.notes.length >= NOTES_UNPAGEABLE_CAP) return null;\n return d.notes;\n}\n\n/** COLLECT. `io` is injected so the whole thing can be run against fixtures in a test without a\n * network, and so there is exactly one place in this file that can talk to her CRM. */\nexport async function collect(\n io: { get: (path: string, version: string) => Promise },\n todayIso: string,\n): Promise {\n const season = seasonYear(businessDay(todayIso));\n const windows = holidayWindows(season);\n const from = windows[0].from, to = windows[windows.length - 1].to;\n\n // ---- the bookings ----\n const events: CalEvent[] = [];\n let calendarsRead = 0;\n for (const cal of BOARDING_CALENDARS) {\n try {\n // LOOK BACK BEFORE THE WINDOW. A dog dropped off on 19 December and collected on the 27th\n // has boarded over Christmas, but the query filters on the drop-off time, so without this\n // reach-back those bookings are never even fetched. windowForRange decides membership.\n // The SAME range as the pick-ups on purpose. [was: drop-offs stopped at the end of the\n // window while pick-ups reached 30 days past it, so for every stay at the tail of the season\n // the customer's own next booking was never fetched. `nextDrop` came back undefined, the\n // \"hard upper bound\" was structurally blind exactly where it mattered, and a 30 Dec stay\n // swallowed the 15 Jan pick-up of a 10 Jan booking — rendering \"Dec 30 to Jan 15\" and\n // letting a January payment settle the holiday deposit. Out-of-window bookings fetched this\n // way are filtered out by the overlap rule; they are here to be next-drop-off markers.]\n const q = `locationId=${LOC}&calendarId=${cal}&startTime=${dayMs(shiftDays(from, -LOOKBACK_DAYS))}&endTime=${dayMs(shiftDays(to, LOOKAHEAD_DAYS))}`;\n const d = await io.get(`/calendars/events?${q}`, \"2021-04-15\");\n // A 200 that does not carry an events ARRAY is not an empty calendar, it is a response we do\n // not understand. [was: `d?.events ?? []`, which counted a renamed key, a partial payload or\n // a stale calendarId as \"read, and she has no bookings\" — and stored that over a good list.]\n if (!Array.isArray(d?.events)) throw new Error(\"no events array in the response\");\n for (const e of d.events) events.push(e as CalEvent);\n calendarsRead++;\n } catch { /* one calendar down is reported below, never silently treated as \"no bookings\" */ }\n }\n // The pick-ups. A calendar that does not answer here is NOT fatal: without it a stay is judged\n // on its drop-off day alone, which is exactly what the module did before, so the list gets\n // smaller rather than wrong. It is reported all the same.\n const pickups: CalEvent[] = [];\n let pickupsRead = 0;\n for (const cal of PICKUP_CALENDARS) {\n try {\n const q = `locationId=${LOC}&calendarId=${cal}&startTime=${dayMs(shiftDays(from, -LOOKBACK_DAYS))}&endTime=${dayMs(shiftDays(to, LOOKAHEAD_DAYS))}`;\n const d = await io.get(`/calendars/events?${q}`, \"2021-04-15\");\n if (!Array.isArray(d?.events)) throw new Error(\"no events array in the response\");\n for (const e of d.events) pickups.push(e as CalEvent);\n pickupsRead++;\n } catch { /* reported on the card: a stay is then judged on its drop-off day alone */ }\n }\n\n const stays = groupIntoStays(events, windows, pickups);\n\n // ---- the money ----\n const rows: DepositRow[] = [];\n // KEYED BY CUSTOMER. The kill switch's floor is written in customers (\"five people with no card\n // payment\"), so a customer with five holiday drop-offs must count once, not five times.\n const perCustomer = new Map();\n let readFailures = 0;\n\n // BY CUSTOMER, not by stay, so one $50 deposit cannot settle two of the same person's bookings.\n const byCustomer = new Map();\n for (const s of stays) {\n const list = byCustomer.get(s.contactId) ?? [];\n list.push(s);\n byCustomer.set(s.contactId, list);\n }\n\n for (const [contactId, own] of byCustomer) {\n let pays: Payment[] | null = null;\n try {\n const notes = await allNotes(io, contactId);\n // A 200 with no notes ARRAY is a response we do not understand, not a customer with no\n // notes. [was: `d?.notes ?? []`, so a rate-limit soft-fail or a changed response shape\n // rendered as \"No Square payment is on file\" — a confident finding built on nothing.]\n pays = notes === null ? null : parseSquarePayments(notes);\n } catch { pays = null; }\n if (pays === null) readFailures++;\n\n let nm = \"\";\n try {\n const c = await io.get(`/contacts/${contactId}`, \"2021-07-28\");\n const ct = c?.contact ?? c;\n nm = [ct?.firstName, ct?.lastName].filter(Boolean).join(\" \").trim() || ct?.contactName || \"\";\n } catch { nm = \"\"; }\n // A name we could not read is shown as that, not as a blank that reads like a bug.\n const name = nm || \"name not readable\";\n\n // WHAT THE KILL SWITCH IS ALLOWED TO SEE: money in the period this run is judging, for\n // customers we actually searched. A stay with no booking date has NO searchable window, so\n // paymentsNearStay returns a structural empty for it; counting that as \"we looked and saw no\n // money\" let one missing field push the sample over the floor and black out the whole card.\n if (pays !== null && own.some((s) => s.bookedAt)) {\n const near = own.filter((s) => s.bookedAt).flatMap((s) => paymentsNearStay(s, pays!));\n perCustomer.set(contactId, near);\n }\n\n for (const st of statusesForCustomer(own, pays)) {\n rows.push({\n contactId, name, day: st.stay.day, until: st.stay.until, dogs: st.stay.dogs,\n dogCount: st.stay.dogCount, window: st.stay.window, state: st.state, amountSeen: st.amountSeen, note: st.note,\n });\n }\n }\n rows.sort((a, b) => a.day.localeCompare(b.day));\n\n const feedDead = feedLooksDead(perCustomer);\n const statuses: StayStatus[] = rows.map((r) => ({\n stay: { contactId: r.contactId, day: r.day, until: r.until, dogs: r.dogs, dogCount: r.dogCount, bookedAt: null, window: r.window },\n state: r.state, amountSeen: r.amountSeen, note: r.note,\n }));\n\n return {\n at: todayIso, season, windows, rows,\n sentence: depositSentence(statuses, feedDead),\n feedDead, readFailures,\n calendarsRead, calendarsAsked: BOARDING_CALENDARS.length,\n pickupsRead, pickupsAsked: PICKUP_CALENDARS.length,\n };\n}\n\n/** ONE PLACE where a collection is run and stored, so the scheduled run and the manual run cannot\n * drift apart. deposits-cron.ts calls this; so does the endpoint below. */\nexport async function runCollection(force = false, source = \"unknown\"): Promise<{ ok: boolean; error?: string; out?: DepositBlob }> {\n const b = await blobMod();\n // Stamped BEFORE the work, so a collection that fails, times out or declines to store still\n // closes the gate for an hour rather than being retried on every tick.\n // WITH WHO STARTED IT. Two schedules can reach this — the engine's interval and deposits-cron.ts\n // — plus a person hitting the endpoint. On 6 Aug the list refreshed at 20:49 with nobody\n // triggering it, which was the first autonomous refresh ever observed, and there was no way to\n // tell WHICH schedule did it. \"It works\" and \"which one works\" are different facts.\n await b.setJSON(ATTEMPT_KEY, { at: new Date().toISOString(), source }).catch(() => {});\n const tok = await token();\n if (!tok) return { ok: false, error: \"no CRM credential resolved, so nothing was collected\" };\n const out = await collect({ get: (p, v) => getJson(p, v, tok) }, new Date().toISOString());\n const prev = (await b.getJSON(BLOB_KEY).catch(() => null)) as DepositBlob | null;\n const d = decideStore(out, prev, force);\n if (!d.store) return { ok: false, error: d.error, out };\n await b.setJSON(BLOB_KEY, out);\n return { ok: true, out };\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n if (!(await authorised(url.searchParams.get(\"k\") || \"\"))) {\n return new Response(\"Not found\", { status: 401, headers: { \"content-type\": \"text/plain\" } });\n }\n const json = (o: unknown, status = 200) =>\n new Response(JSON.stringify(o, null, 2), { status, headers: { \"content-type\": \"application/json\", \"cache-control\": \"no-store\" } });\n\n try {\n if (url.searchParams.get(\"run\") !== \"1\") {\n const b = await blobMod();\n const stored = await b.getJSON(BLOB_KEY).catch(() => null);\n // THE ATTEMPT STAMP COMES BACK TOO, and reading it does not write it. Without this, \"the\n // list has not moved\" is ambiguous between \"the schedule never tried\" and \"it tried and\n // declined to store\" — and those need completely different fixes. Every observation of the\n // refresh so far has been unable to tell them apart.\n const attempt: any = await b.getJSON(ATTEMPT_KEY).catch(() => null);\n return json({ ...(stored ?? { at: null, rows: [], sentence: \"This has not been collected yet.\" }),\n lastAttemptAt: attempt?.at ?? null,\n lastAttemptBy: attempt?.source ?? null,\n refreshDueAt: attempt?.at && Number.isFinite(Date.parse(attempt.at))\n ? new Date(Date.parse(attempt.at) + REFRESH_EVERY_MS).toISOString() : null });\n }\n const r = await runCollection(url.searchParams.get(\"force\") === \"1\", \"endpoint\");\n return r.ok ? json(r.out) : json({ error: r.error, ...(r.out ?? {}) }, 503);\n } catch (e) {\n return json({ error: String(e).slice(0, 500) }, 500);\n }\n}\n",[437],"b71c0829-6146-4c4f-82e8-64c1a725c66d","deposits-cron.ts","b4eead18-91ad-11f1-b6f8-1607ee4eb77e",325,["D",1786053100090],"// THE HOLIDAY DEPOSIT REFRESH, ON A SCHEDULE. v1.0, 6 Aug 2026.\n//\n// WHY IT IS ITS OWN FILE AND NOT A LINE IN main.ts. main.ts is hard-capped at 80,000 characters\n// and has 679 left. Squeezing this in would mean deleting something that is already load-bearing\n// to make room for something new, on the entry point that runs Kim's follow-up system. A second\n// scheduled file costs nothing and cannot take the engine down with it.\n//\n// IT ONLY READS. Everything it does is inside runCollection(), which reads two calendars and some\n// contact notes and writes one blob. There is no path from here to a message, a tag or a customer.\n//\n// IT NEVER SHOUTS. If the CRM is unreachable this logs and returns. The dashboard already knows\n// how to say \"last checked N hours ago\", so a missed run degrades into a visibly older timestamp\n// rather than into an alarm or, worse, an empty list presented as fact.\nimport { runCollection, refreshIfDue, ATTEMPT_KEY, BLOB_KEY, type DepositBlob, type DepositRow } from \"./deposits.ts\";\n\nexport default async function (): Promise {\n try {\n // THE SAME GATE main.ts USES, through the same function, so the two cannot drift.\n const blob = (await import(\"https://esm.town/v/std/blob\")).blob;\n const g = await refreshIfDue(() => blob.getJSON(ATTEMPT_KEY) as any, () => runCollection(false, \"deposits-cron\"), Date.now());\n if (!g.ran) { console.log(`[deposits] ${g.why}`); return; }\n const o = (await blob.getJSON(BLOB_KEY)) as DepositBlob | null;\n if (!o) { console.log(`[deposits] ${g.why}, and nothing is stored`); return; }\n const worth = (o.rows ?? []).filter((x: DepositRow) => x.state === \"none_seen\" || x.state === \"partial\").length;\n console.log(`[deposits] ${o.rows.length} stay(s), ${worth} worth checking, ${o.readFailures} unreadable, drop-off calendars ${o.calendarsRead}/${o.calendarsAsked}, pick-up calendars ${o.pickupsRead}/${o.pickupsAsked}`);\n } catch (e) {\n // A scheduled job that throws on val.town shows up as a failed run and pages nobody usefully.\n // The honest outcome of a failed refresh is an older timestamp on the page, which is visible.\n console.log(`[deposits] refresh failed: ${String(e).slice(0, 200)}`);\n }\n}\n",[445],"85f34901-ba8f-4ce4-a52d-b609bbf3381c","decisions.ts","13df017c-902f-11f1-8dc5-1607ee4eb77e",885,["D",1786741146324],26,"// WHAT IS WAITING ON KIM. v1.2, 4 Aug 2026.\n//\n// WHY THIS FILE EXISTS: two independent readers were handed the dashboard cold. Both said the\n// same thing without prompting. Kim: \"there is no list of what I'm being asked, no button, no\n// 'Kim: 3 things waiting on you'.\" Candace: \"exactly one requires anything from us, buried\n// fifth-from-top, styled identically to eight items needing nothing, with no owner.\" A page that\n// reports state but never asks for a decision quietly turns the reader into a spectator.\n//\n// THE RULE: an item goes here only when it is genuinely blocked on Kim, it is written in her\n// words, and it says what happens if she says yes AND what happens if she says nothing. No item\n// nags. No item implies she is late. \"Nothing\" is always an acceptable answer, and where that is\n// true the item says so.\n//\n// EVERY ITEM MIRRORS A NUMBERED ROW IN THE COMMITMENTS LEDGER, so the page and the ledger cannot\n// drift apart. The `ref` is that row. If you add one here, add it there in the same commit.\n//\n// v1.2, after the second stranger test. Three findings, all fair:\n// 1. Every item carries `evidence` now. The work log below it sets a standard of proof (\"How we\n// know\" on every line) and this card was exempting itself from that standard while sitting\n// ABOVE it. The reader noticed within one read.\n// 2. No item may hardcode a live number. The old K11 text said \"two of this week's went\n// unmarked\" while the tiles, reading the same account, showed none unmarked in their window.\n// A number typed into prose goes stale the day after it is typed. Live figures arrive through\n// `Ctx` and are rendered by a function, or they are not stated.\n// 3. The $250 Bootcamp cohort is a decision about her customers' money and was sitting twelve\n// rows down in the work log rather than here. \"Wrong things promoted\", exactly.\n\nexport type Ctx = {\n unmarkedPupTalks?: number | null; // appointments with no showed/no-show mark yet, this window\n inquiriesPerWeek?: number | null; // live count, so the volume a YES commits her to is never typed\n // computed by facts.ts from the bridge journal. The typed version of this sentence was wrong in\n // all four of its numbers and understated the money by $4,572.\n squareSentence?: string | null;\n // Live, from a server-side tag filter over the WHOLE contact base. Never a scan size.\n puppyTagSentence?: string | null;\n // What the tagging step WOULD pick up, measured on the engine's last run. Null until it has run\n // one, so the page never implies a dry pass happened when none did.\n tagScanSentence?: string | null;\n};\n\nexport type Decision = {\n ref: string; // ledger row, e.g. \"K8\"\n ask: string; // the question, in Kim's vocabulary, ending in a question mark\n why: string | ((c: Ctx) => string); // what it unblocks or prevents\n // A function when the evidence contains a figure. A number in evidence is still a number,\n // and it drifts exactly like a number in prose does.\n evidence: string | ((c: Ctx) => string);\n ifYes?: string | ((c: Ctx) => string); // what saying yes costs. May depend on live figures.\n ifNothing: string; // what happens if she never answers. Honest, including \"nothing bad\".\n weight: \"blocking\" | \"worth doing\" | \"whenever\";\n liveNow?: boolean; // already affecting real customers today, as opposed to pending\n // v1.5. Three separate readers, independently, came to this page worrying about money and found\n // the only question about money filed last and folded away. Weight measures urgency; this\n // measures whether the reader will go looking for it. Money always shows.\n surface?: boolean;\n /** An extra paragraph computed at render time. Never a place to put a typed figure. */\n extra?: (c: Ctx) => string;\n};\n\n// v1.6, 14 Aug 2026, AFTER GO-LIVE. The follow-up system was switched from practice to live on the\n// evening of 11 August. This file did not notice for three days, and three of its cards went on\n// telling Kim the opposite while two real people were being messaged:\n// 1. K8, \"When do we do the switch-on together?\", was an answered question, and its `ifNothing`\n// (\"The new messages stay in practice mode and nobody is messaged by them\") was the single\n// most misleading sentence on her page. DELETED rather than reworded: a card whose question\n// has been answered by an event is not a card, it is a record, and records live in\n// worklog.ts. The go-live is written up there, dated, with evidence she can check herself.\n// 2. K1's `ifYes` said the wording \"still does not send until the switch-on above is scheduled\n// too\". It sends. Corrected. K1 is also no longer `blocking`: it carries a stated default\n// (\"Wednesday's corrections stand as given\"), which by finding 2 of v1.3 below makes it an\n// answered question, and nothing about a wording re-read holds up the email half.\n// 3. K12's `ifNothing` said \"Texting can still go live on its own\". Texting IS live on its own.\n// And WEIGHT_LABEL: `blocking` no longer means \"holds up go-live\", because nothing does. It\n// means the EMAIL half cannot start, which is true of exactly one item, K12. The enum name is\n// left alone on purpose; renaming a type to fix a label is how a rename becomes a refactor.\n//\n// v1.3, after the third stranger test, which read this file as well as the page. Four findings:\n// 1. The type stated the rule as \"what happens if she says yes AND if she says nothing\" and then\n// implemented only half of it. `ifYes` now exists and is filled wherever a yes has a cost.\n// 2. `weight: \"blocking\"` was applied to two items that do not block. An item carrying a stated\n// default is an answered question; a December deposit does not gate a puppy sequence. The\n// headline counts blockers, so mislabelling one puts a wrong number at the top of the page.\n// 3. The genuine email go-live blocker was in the ledger and NOT here, so a reader answering\n// every card would believe the runway was clear when the email half cannot deliver.\n// 4. The page detected \"already reaching customers\" by regex-matching this file's prose, so a\n// reword would have silently disabled the warning. It is a field now.\n\nexport const DECISIONS: Decision[] = [\n // [K8, \"When do we do the switch-on together?\", was removed on 14 Aug 2026. The switch-on\n // happened on the evening of 11 August, so the question had nothing left to ask, and the card\n // was telling Kim the messages \"stay in practice mode and nobody is messaged by them\" while\n // two real people were partway through them. It is not reworded and it is not silently\n // dropped: the event it was asking about is written up as a dated entry in worklog.ts, and the\n // fact that this page carried the wrong answer for three days is written up there too, under\n // \"my mistake\", where her page keeps my errors on purpose.]\n {\n ref: \"K1\",\n ask: \"The wording changes you asked for are in. Want a fresh read, or is Wednesday's answer the answer?\",\n why: \"On Wednesday you gave the wording its verdict and its corrections in one go: open message two on the welcome, say what a Pup Talk is rather than what it is not, drop the lines about what we will not do, and say \\\"going\\\" not \\\"getting on\\\", plus the hot-day water note and back-to-school for August. Every one of those went into the copy on 9 August and each is now pinned by its own automated check so it cannot drift back. The write-ups you hold were regenerated from the changed copy the same day.\",\n evidence: \"Both write-ups were generated from the live system rather than from a draft, so what you read is exactly what would send. Your Wednesday message is the answer of record; the 9 August regeneration carries your changes.\",\n // v1.4. This read \"roughly 190 new people a week\" while the page counted 186 four inches\n // above it. The volume a YES commits her to is the whole weight of the question, so it is\n // counted at render time or it is not stated as a number at all.\n // [was: \"It still does not send until the switch-on above is scheduled too.\" It sends. The\n // system went live on the evening of 11 August and these are the words real people have been\n // receiving since. Corrected 14 Aug 2026.]\n ifYes: \"Nothing else about the wording comes back to you. These are the words going out to real people now, so a change from you would land on every message that has not been sent yet, including the rest of the messages for anyone already partway through.\",\n ifNothing: \"Your Wednesday corrections stand as given and the copy stays exactly as regenerated.\",\n // [was: \"blocking\", when blocking meant \"holds up go-live\". Go-live has happened, and a card\n // whose ifNothing is a stated default was never a blocker by this file's own rule anyway.]\n weight: \"worth doing\",\n },\n {\n ref: \"K2\",\n ask: \"Which number should customers see, 912-348-8726 or 912-823-4382?\",\n why: \"It goes at the bottom of every message that leaves the system, so it needs to be the one you actually want ringing.\",\n evidence: \"Both numbers are live on your account and both are cleared for texting. On 4 August, only one of them was on your website footer: 912-348-8726.\",\n ifNothing: \"We use 912-348-8726, the one already on your website. This one has a default, so it does not hold anything up; it is here because it is your name on the message.\",\n weight: \"worth doing\",\n },\n {\n ref: \"KB1\",\n ask: \"Bootcamp deposits: you answered this on Wednesday. Anything to add, or is it closed?\",\n why: \"Your Wednesday answer is the answer of record: most people pay the deposit over the phone, the one or two who paid the wrong amount were corrected at drop off, everyone ultimately paid the right price, and the website payment was set up to go to PayPal rather than Square. So the earlier worry on this card, that money might have gone missing while the form said $250, is answered by you: nothing was underpaid. The form itself was fixed to $500 on 2 August and stays fixed.\",\n evidence: \"The wrong figure was found inside the booking form's own settings, corrected and published, and the live site was then searched end to end for '$250' with no hits left. Your Wednesday message about PayPal, the phone payments and nothing being underpaid is the answer of record; the payment matching this card used to ask for is no longer needed unless you want it.\",\n ifYes: \"If you ever want the belt-and-braces version, we match the 17 bookings against the payment records and hand you the list. Deciding to look is not deciding to chase.\",\n ifNothing: \"Closed on your say-so. The form is fixed and your answer stands.\",\n extra: (c) => c.squareSentence ? `Separately, on the same subject of money the records cannot place: ${c.squareSentence}` : \"\",\n weight: \"worth doing\",\n surface: true,\n },\n {\n ref: \"K6\",\n ask: \"Should people who have already booked keep getting the safety tips?\",\n why: \"Right now the follow-ups stop the moment somebody books. Some owners like the tips continuing; some find it odd to still be sold at after they said yes.\",\n evidence: \"Read from the sequence itself: booking is a stop condition on every path, including the slow track.\",\n ifNothing: \"They stop at booking, which is the safer of the two.\",\n weight: \"worth doing\",\n },\n {\n ref: \"K11\",\n ask: \"Can we ask the front desk to mark every Pup Talk showed or no-show?\",\n why: (c) =>\n c.unmarkedPupTalks\n ? `${c.unmarkedPupTalks} of the Pup Talks in the last 7 days ${c.unmarkedPupTalks === 1 ? \"has\" : \"have\"} no mark against ${c.unmarkedPupTalks === 1 ? \"it\" : \"them\"} yet, so the show-up figure on this page is better than the truth by up to that many. It is a ten second job at the desk.`\n : \"When one goes unmarked the show-up figure on this page comes out better than the truth, because an unmarked appointment is not counted as a miss. None are unmarked right now, and keeping it that way is a ten second job at the desk.\",\n evidence: \"Counted live from your calendar each time this page loads, not typed in here.\",\n ifYes: \"Nothing to build. It is a habit at the desk, and the number on this page stops flattering itself.\",\n ifNothing: \"The show-up figure drifts optimistic whenever one is missed, and this page keeps saying so. Nothing else is affected.\",\n weight: \"worth doing\",\n },\n {\n ref: \"K7\",\n ask: \"You have two review-request automations both switched on. Which one do you want to keep?\",\n why: \"You have two review-request workflows switched on at once, with near-identical names. We cannot read a workflow's steps through the interface we have, so we cannot promise you both actually fire, but two published copies is the usual shape of a customer being asked twice, and it is worth ten seconds of your time.\",\n evidence: \"Read from all 165 automations on 4 August: \\\"New Review Request WF\\\" and \\\"Update- New Review Request WF\\\" are both published. What we could NOT do is open either one and read its steps, because that call is not available to us. So this is two live copies, not a confirmed double send.\",\n ifNothing: \"Both stay switched on. If they do both fire, the double ask continues; it is not damaging, it just looks careless.\",\n weight: \"worth doing\",\n liveNow: true,\n },\n {\n ref: \"K12\",\n ask: \"The four domain lines: you said yes on Wednesday and asked for instructions. Ready for them on Upwork today?\",\n why: \"This is the real blocker on the email half, and on Wednesday you answered it: happy to add the four lines, just need to know how and where. Checked on 4 August, your domain tells the internet that Google and Wix are allowed to send email in your name, and nobody else. Until the four lines go in, every follow-up email would come from a server your domain does not stand behind, and a lot of them would land in spam. Texting is unaffected: that is verified separately and already works.\",\n evidence: \"Read from your domain's own public records. They list Google and Wix and nothing else. The settings needed are generated by your CRM and are four short lines of text. Your Wednesday yes is the answer of record; the step-by-step instructions for the Wix screen are written and come to you on Upwork.\",\n ifYes: \"You paste the four lines where the instructions show, it takes about ten minutes, and the emails can start going out alongside the texts that are already going out.\",\n // [was: \"Texting can still go live on its own.\" It did, on the evening of 11 August, and it is\n // running. The sentence was written before that and read afterwards as though nothing had\n // been switched on at all. Corrected 14 Aug 2026.]\n ifNothing: \"Texting carries on by itself, exactly as it is doing now. The emails cannot start, and this stays the one thing standing in their way.\",\n weight: \"blocking\",\n },\n {\n ref: \"K10\",\n ask: \"Costs against what it brings in: you said go ahead on Wednesday. The spend half now reads live. Want the walkthrough this week?\",\n why: \"You answered on Wednesday: \\\"I absolutely wanna know what all this costs against what it brings in, go ahead.\\\" Since 9 August the spend half is no longer waiting on anybody: Facebook granted the read permission, so the advertising card on this page now shows real dollars from the ad platform every time it loads. What the page still cannot show is the money coming back, because your CRM does not record a value on a sale. Closing that half is Amir's job and it is on his list, not yours.\",\n evidence: \"The spend connection was watched working on 9 August: the page read $671.72 and 159 started conversations for the last 7 full days straight from Facebook. The earning side is nearly blank in your CRM: 53 of your customer records carry a dollar value, $166,235.00 between them, and every one of those was last touched on 30 June, so nothing in the last six weeks has had a value put on it.\",\n ifYes: \"Half an hour together, real spend against real bookings, and the cost-per-lead for each campaign on paper in front of you.\",\n ifNothing: \"The spend keeps showing on this page either way. The what-it-brings-in half waits until the CRM records a value on a sale.\",\n weight: \"worth doing\",\n surface: true,\n },\n {\n ref: \"K13\",\n ask: \"Can we retire the access key you pasted into the Upwork thread on 31 July?\",\n why: \"It is a working key to your CRM sitting in a chat log. Nothing has gone wrong that we know of, and we have no way to tell whether anybody else has used it, which is exactly why it should not be sitting there. It is simply not where a key should live.\",\n evidence: \"The message was still in the thread on 4 August. On Wednesday evening you went to delete the key yourself and said you were not entirely sure it worked. That attempt is on record; what has not happened yet is anyone confirming the old key is actually dead, and until that check runs the honest state is: probably retired, not yet proven.\",\n ifYes: \"Two minutes, and one loose end closed.\",\n ifNothing: \"A working key to your customer list stays in a chat log that other people can be added to. Nothing has gone wrong so far, and nobody can promise it will not.\",\n weight: \"worth doing\",\n liveNow: true,\n },\n {\n ref: \"K14\",\n ask: \"Can we take the holiday boarding deposit automatically instead of by hand?\",\n why: \"You already have a product in your CRM called \\\"Holiday boarding deposit\\\" set at $50, fully configured, and it does not appear on a single order in the payment history we can see. Your boarding bookings go through the form on your website instead, so the CRM never gets the chance to take the money or record that it arrived. That is why somebody is checking by hand.\",\n evidence: \"Read from your own product list: \\\"Holiday boarding deposit\\\" and \\\"New Client Boarding Deposit\\\" both exist at $50, and not one order in your recent payment history references either.\",\n ifYes: \"Two sizes of job, and Amir will lay out both before anything is built: record the deposit against the customer automatically so you get a list rather than a memory, or take it as part of the booking so nobody can complete one without paying.\",\n ifNothing: \"It stays a manual check every holiday season.\",\n weight: \"worth doing\",\n },\n {\n ref: \"K15\",\n ask: \"You have five no-sale and tips follow-up sequences running, plus two auto-responders. Do you want me to go through them for overlap?\",\n why: \"They are all published and live. The one that looked accidental, \\\"Copy - Tips Ad campaign > Auto Responder\\\", you answered on 5 August: the copy is Milton's on purpose, and it answers on Facebook comments as well as in Messenger, so it stays exactly as it is. What is left of this question is smaller: whether Amir reads the five sequences so nobody can end up getting two sets of messages from you on the same afternoon.\",\n evidence: \"Read from all 165 automations on 4 August: seven published and one draft. Five are follow-up sequences; two are auto-responders and call routing, so the real number to review is nearer five. Your 5 August message is the answer of record on the copy workflow.\",\n ifYes: \"Amir reads all of them and tells you which are earning their place, before anything new is built.\",\n ifNothing: \"They keep running as they are, which is now the known-good state you described.\",\n weight: \"worth doing\",\n },\n {\n ref: \"K9\",\n ask: \"Would you tell us a story or two from the kennel?\",\n why: \"There are eight places in the follow-up messages where a real thing that happened to a real dog would land far better than general advice. They are written to read perfectly well empty, and they are empty today, because made up stories are not something we will put in your name.\",\n evidence: \"The eight places are marked in the sequence you have already read. Each one has a fallback line that reads normally with no story in it, which is what is running now.\",\n ifNothing: \"The messages read exactly as you have already seen them, which costs you nothing.\",\n weight: \"whenever\",\n },\n {\n ref: \"K16\",\n ask: \"Do you want the one untranscribed call from 4 August looked at, or is the answer enough?\",\n why: \"Mostly answered on 6 August. No transcript exists on any call older than about three months, and since then almost every call with speech has one. What is not settled is why the old ones have none: either transcription was switched on around 11 May, or transcripts are deleted once they reach about ninety days. Both look the same from here, and the second one would mean you are quietly losing call history every month. One query a week from now tells us which, and it costs nothing.\",\n // [was, twice over: first \"Every call in your account was checked\" (it was 62 of them), then\n // \"the writing-down step has simply never been switched on\". That second claim was inferred\n // from the API showing no transcript on any of the 62 call records, and the inference was\n // wrong: the API simply does not carry transcripts on those records. On 5 August a call from\n // that same morning was opened in the CRM and its transcript was watched rendering, word by\n // word. Transcription is on. The claim below is what has actually been observed.]\n evidence:\n \"Sixty-two of your calls were checked from your most recently active conversations: 54 carry a full audio recording, about two and a quarter hours of it, and the recordings play. The 8 without one were calls nobody answered. Then a call from the morning of 5 August was opened directly in the CRM and its written transcript was watched rendering, and a second call from 4:54 that same afternoon shows its transcript in the CRM as well, so transcription is on and working at least sometimes. What has not been found yet is a call that is missing its transcript, which is why your report matters: one example from you of a call where the transcript used to be there, or should be, pins down the pattern in minutes.\",\n ifYes:\n \"Point at one call where the transcript is missing, or tell us roughly when they disappeared for you, and the comparison between that call and the transcribed one from that morning does the rest: same number or different, human or Chloe, long or short, before or after a settings change.\",\n ifNothing:\n \"Nothing breaks. Recording keeps working and at least some calls keep getting transcripts, but the ones that are missing stay a puzzle solved by trial and error instead of by one example from you.\",\n weight: \"worth doing\",\n },\n];\n\nexport const WEIGHT_ORDER: Record = { blocking: 0, \"worth doing\": 1, whenever: 2 };\n// [was: blocking: \"Holds up go-live\". Nothing holds up go-live any more, because it happened on\n// the evening of 11 August. What the label now marks is the one half of the system that still\n// cannot start: email. Corrected 14 Aug 2026.]\nexport const WEIGHT_LABEL: Record = {\n blocking: \"Holds up the email half\",\n \"worth doing\": \"Worth doing\",\n whenever: \"Whenever you like\",\n};\nexport function sortedDecisions(ds: Decision[] = DECISIONS): Decision[] {\n return [...ds].sort((a, b) => WEIGHT_ORDER[a.weight] - WEIGHT_ORDER[b.weight]);\n}\nexport const blockingCount = (ds: Decision[] = DECISIONS) => ds.filter((d) => d.weight === \"blocking\").length;\n/** Resolve a `why` that may depend on live figures. */\nexport const whyText = (d: Decision, c: Ctx): string => (typeof d.why === \"function\" ? d.why(c) : d.why);\n/** Same treatment for ifYes: a volume figure must be counted, never typed. */\nexport const ifYesText = (d: Decision, c: Ctx): string | undefined =>\n d.ifYes == null ? undefined : (typeof d.ifYes === \"function\" ? d.ifYes(c) : d.ifYes);\nexport const extraText = (d: Decision, c: Ctx): string => (d.extra ? d.extra(c) : \"\");\n/** Evidence gets the same treatment as why/ifYes: a figure in it is computed, never typed. */\nexport const evidenceText = (d: Decision, c: Ctx): string =>\n typeof d.evidence === \"function\" ? d.evidence(c) : d.evidence;\n",[452],"4041e479-7d4b-4ebd-8726-e6251b3da7e3","dashboard.ts","fb119304-9028-11f1-8278-1607ee4eb77e",1152,["D",1786979118671],42,"// THE DOGS SPOT, LIVE DASHBOARD. One page Kim can open any time, from anything. v1.0, 4 Aug 2026.\n//\n// THE PROMISE THIS FILE MAKES: it always renders something true. Every data source is fetched\n// independently, every failure is caught, and the last good answer for each section is cached in\n// a blob. If the CRM is down, the page says \"the CRM did not answer just now, here is what it\n// said 20 minutes ago\" instead of showing a zero or a blank. A dashboard that shows a wrong zero\n// is worse than no dashboard, because it is quietly reassuring.\n//\n// ROUTES ?k= the dashboard\n// ?k=&f=json the same numbers as data\n//\n// AUDIENCE: Kim. Non-technical, on a phone, thirty seconds. No jargon, no acronyms unexplained,\n// no metric that does not connect to her money. Detail lives below the fold for whoever wants it.\ndeclare const Deno: { env: { get(k: string): string | undefined } };\nif (typeof (globalThis as any).Deno === \"undefined\") {\n (globalThis as any).Deno = { env: { get: (k: string) => (globalThis as any).process?.env?.[k] } };\n}\nimport {\n countContacts, sourceBreakdown, channelBreakdown, campaignBreakdown, attributionCoverage,\n countEvents, wonOpps, weeklyBuckets,\n deltaWord, money, type ContactLite, type EventLite, type OppLite,\n} from \"./report-logic.ts\";\nimport { sortedDecisions, blockingCount, whyText, ifYesText, extraText, evidenceText, WEIGHT_LABEL, type Decision, type Ctx } from \"./decisions.ts\";\nimport { SEEDED, mergeLog, KIND_LABEL, type WorkEntry } from \"./worklog.ts\";\nimport { squareBacklog, squareSentence, otherBucketExplanation, otherBucketSentence, tagCoverageSentence, type TagCoverage } from \"./facts.ts\";\nimport { observedCadenceMin, lateness, lateSentence, isHealthy, neverRanItselfSentence } from \"./cadence.ts\";\nimport { detectSentence, scanAgeNote, type DetectSummary } from \"./puppy-detect.ts\";\nimport type { DepositBlob, DepositRow } from \"./deposits.ts\";\nimport { looksLikeTestRecord, depositSentence, OTHER_ROUTES } from \"./holiday-deposits.ts\";\nimport { GOOGLE_ADS_BLOB, snapshotFreshness, type GoogleAdsSnapshot } from \"./google-ads-ingest.ts\";\n\nconst LOC = \"BQHJ19uohldYe3eqA0bl\";\n// READ FROM THE SAME PLACE THE ENGINE READS IT. If someone changes the enrollment tag in the val's\n// settings, the page must start counting the new tag, not keep reporting confidently on the old\n// one. Two constants would be two facts, and one of them would be wrong without telling anybody.\nconst ENROLL_TAG = Deno.env.get(\"TAG_SOURCE_SIGNAL\") || \"nurture - puppy\";\nconst GHL = \"https://services.leadconnectorhq.com\";\nconst PUP_TALK_CAL = \"qHuYJ0NEqzibnoqf5Cw3\";\nconst CACHE_KEY = \"dash_cache\";\nconst BRIDGE = \"https://amir5--41ace24c7e2111f18c9d1607ee4eb77e.web.val.run\";\n// The bridge journal is read-only, but its credential still grants access to client data.\n// Keep it in the environment only: this source is publicly readable on the hosting platform.\nconst BRIDGE_ADMIN = Deno.env.get(\"BRIDGE_ADMIN\") || \"\";\n\n// ---- palette: validated with the dataviz validator, both modes, on these exact surfaces ------\n// Categorical slots 1-3 (blue/orange/aqua): ALL CHECKS PASS light and dark. Status steps are the\n// reserved four and always ship with a word beside them, never color alone.\nconst CAT = [\"#2a78d6\", \"#eb6834\", \"#1baf7a\"];\nconst CAT_DARK = [\"#3987e5\", \"#d95926\", \"#199e70\"];\nconst GOOD = \"#0ca30c\", WARN = \"#fab219\", CRIT = \"#d03b3b\";\n\nasync function sha256Hex(s: string): Promise {\n const b = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(s));\n return [...new Uint8Array(b)].map((x) => x.toString(16).padStart(2, \"0\")).join(\"\");\n}\nasync function blobMod() { return (await import(\"https://esm.town/v/std/blob\")).blob; }\n// v1.1 (review #2): a failed READ and a genuinely EMPTY value are different facts. Collapsing\n// them made the page say \"0 people waiting on you\" when the truth was \"we could not check\".\ntype Read = { ok: true; v: T | null } | { ok: false; v: null };\nasync function readBlob(k: string): Promise> {\n try { return { ok: true, v: ((await (await blobMod()).getJSON(k)) ?? null) as T | null }; }\n catch { return { ok: false, v: null }; }\n}\nasync function getBlob(k: string): Promise { return (await readBlob(k)).v; }\nasync function token(): Promise {\n return (Deno.env.get(\"GHL_TOKEN\") ?? \"\").trim() || undefined;\n}\nconst constantTimeEqual = (a: string, b: string): boolean => {\n let difference = a.length ^ b.length;\n for (let i = 0; i < Math.min(a.length, b.length); i++) difference |= a.charCodeAt(i) ^ b.charCodeAt(i);\n return difference === 0;\n};\nasync function isAdmin(k: string) {\n const expected = (Deno.env.get(\"NURTURE_ADMIN_KEY_SHA256\") ?? \"\").trim().toLowerCase();\n return !!k && /^[0-9a-f]{64}$/.test(expected) && constantTimeEqual(await sha256Hex(k), expected);\n}\nasync function isViewer(k: string) {\n const tok = await token();\n return !!tok && !!k && constantTimeEqual(k, \"tds_view_\" + (await sha256Hex(tok + \":view\")).slice(0, 32));\n}\n\nasync function j(path: string, ver: string) {\n const tok = await token();\n const r = await fetch(`${GHL}${path}`, {\n headers: { Authorization: `Bearer ${tok}`, Version: ver, \"User-Agent\": \"curl/8.5.0\" },\n signal: AbortSignal.timeout(20_000),\n });\n if (!r.ok) throw new Error(`HTTP ${r.status}`);\n return r.json();\n}\n\nconst ET = () => {\n const p = new Intl.DateTimeFormat(\"en-US\", { timeZone: \"America/New_York\", timeZoneName: \"shortOffset\" })\n .formatToParts(new Date()).find((x) => x.type === \"timeZoneName\")?.value ?? \"GMT-4\";\n const m = p.match(/GMT([+-]\\d+)/);\n return m ? Number(m[1]) * 60 : -240;\n};\n\nasync function contactsSince(floorMs: number, truncated: string[]): Promise {\n const out: ContactLite[] = [];\n let sa: string | undefined, sav: number | undefined;\n let reachedFloor = false;\n for (let page = 0; page < 30; page++) {\n const q = new URLSearchParams({ locationId: LOC, limit: \"100\" });\n if (sa && sav) { q.set(\"startAfterId\", sa); q.set(\"startAfter\", String(sav)); }\n const d = await j(`/contacts/?${q}`, \"2021-07-28\");\n const cs = d?.contacts ?? [];\n if (!cs.length) break;\n for (const c of cs) {\n // The FIRST attribution entry is the one flagged isFirst by the CRM, i.e. how this person\n // arrived, not how they last touched us. Later entries describe return visits.\n const a = (Array.isArray(c.attributions) ? c.attributions : []).find((x: any) => x?.isFirst) ?? c.attributions?.[0] ?? null;\n out.push({\n dateAdded: c.dateAdded, source: c.source ?? null, tags: c.tags ?? [],\n attribution: a ? { medium: a.medium ?? a.utmSessionSource ?? null, campaign: a.utmCampaign ?? null } : null,\n });\n }\n const oldest = Date.parse(cs[cs.length - 1]?.dateAdded ?? \"\");\n sa = d?.meta?.startAfterId; sav = d?.meta?.startAfter;\n if (Number.isFinite(oldest) && oldest < floorMs) { reachedFloor = true; break; }\n if (!sa) { reachedFloor = true; break; }\n }\n if (!reachedFloor) truncated.push(\"the older weeks of the chart\");\n return out;\n}\n\n// Ad platforms. Both are env-gated and honest: no token means \"not connected yet\", never a guess.\nasync function metaWeek(startMs: number, endMs: number, tz: number) {\n const tok = Deno.env.get(\"META_TOKEN\"), act = Deno.env.get(\"META_AD_ACCOUNT\");\n if (!tok || !act) return null;\n const day = (ms: number) => new Date(ms + tz * 60_000).toISOString().slice(0, 10);\n const r = await fetch(\n `https://graph.facebook.com/v21.0/${act}/insights?fields=spend,actions&time_range={\"since\":\"${day(startMs)}\",\"until\":\"${day(endMs - 86_400_000)}\"}`,\n { headers: { Authorization: `Bearer ${tok}` }, signal: AbortSignal.timeout(20_000) },\n ).catch(() => { throw new Error(\"Facebook did not answer\"); });\n if (!r.ok) {\n // A token that exists but has not been granted ad-reading rights is a SETUP state, not a\n // fault, and it must not reach Kim as \"Facebook returned 400\". Meta answers this exact case\n // with code 200 and a message naming ads_management/ads_read. Verified live on 4 Aug against\n // the real token: the system user was created without an app role, so it came out holding\n // only page permissions. Anything else genuinely is an error and says so.\n const body = await r.json().catch(() => null);\n const msg = String(body?.error?.message ?? \"\");\n if (body?.error?.code === 200 || /ads_read|ads_management/.test(msg)) throw new Error(\"PERMISSION\");\n throw new Error(`Facebook returned ${r.status}`);\n }\n const row = (await r.json())?.data?.[0];\n const acts = row?.actions ?? [];\n const conv = Number(acts.find((a: any) => a.action_type === \"onsite_conversion.total_messaging_connection\")?.value\n ?? acts.find((a: any) => a.action_type === \"lead\")?.value ?? 0);\n return { spend: Number(row?.spend ?? 0), conv };\n}\n// PROVEN LIVE 4 Aug 2026: this account has 5,695 opportunities and every single one carries\n// status \"open\", and nobody uses the won/lost flags. Counting `status=won` returns zero forever,\n// which would have rendered \"0 closed deals\" every week regardless of reality. The real signal\n// is the pipeline STAGE (Customer / Won-Paid), which the engine already uses for its exit rules.\n// Separately proven: every one of those records has monetaryValue 0, so the CRM holds no deal\n// values at all. The page therefore reports customer COUNT and says plainly that revenue is not\n// recorded, rather than printing a $0.00 that reads as \"we earned nothing\".\nconst STAGE_CUSTOMER = \"fd821b4e-bbe6-44de-b754-fa80e4823616\";\nconst STAGE_WON_PAID = \"ae173310-f8b1-4399-acb7-ef1fc03d3697\";\n\nexport type GoogleSnapshotView = {\n state: \"fresh\" | \"stale\" | \"future\" | \"missing\" | \"invalid\";\n source: \"Google Ads Script\";\n asAt: string | null;\n currency: string | null;\n enabledCampaigns: number;\n configuredDailyBudget: number | null;\n spendToday: number | null;\n spendLast7Days: number | null;\n conversionsLast7Days: number | null;\n detail: string;\n};\n\n/** Source-backed Google figures. Observed spend includes campaigns paused after spending today. */\nexport function googleSnapshotView(raw: unknown, nowMs: number = Date.now()): GoogleSnapshotView {\n const checked = snapshotFreshness(raw, nowMs);\n const snapshot = checked.snapshot;\n if (!snapshot) {\n return {\n state: checked.state, source: \"Google Ads Script\", asAt: null, currency: null,\n enabledCampaigns: 0, configuredDailyBudget: null, spendToday: null,\n spendLast7Days: null, conversionsLast7Days: null, detail: checked.reason,\n };\n }\n const enabled = snapshot.campaigns.filter((campaign) => campaign.status === \"ENABLED\");\n const sum = (pick: (campaign: GoogleAdsSnapshot[\"campaigns\"][number]) => number) =>\n +snapshot.campaigns.reduce((total, campaign) => total + pick(campaign), 0).toFixed(2);\n return {\n state: checked.state,\n source: \"Google Ads Script\",\n asAt: snapshot.generatedAt,\n currency: snapshot.currency,\n enabledCampaigns: enabled.length,\n configuredDailyBudget: +enabled.reduce((total, campaign) => total + campaign.dailyBudget, 0).toFixed(2),\n spendToday: sum((campaign) => campaign.today.cost),\n spendLast7Days: sum((campaign) => campaign.last7Days.cost),\n conversionsLast7Days: sum((campaign) => campaign.last7Days.conversions),\n detail: checked.reason,\n };\n}\n\n// ESCAPING, AND THE THREE THINGS IT DOES NOT COVER — bidi controls, length, and values that\n// are not text. The cap is a SEPARATE function from esc() on purpose. Full note: NOTES-dashboard.md.\nconst text = (s: unknown) => (typeof s === \"string\" ? s : typeof s === \"number\" && Number.isFinite(s) ? String(s) : \"\");\nconst esc = (s: unknown) => text(s).replace(/[\\u202A-\\u202E\\u2066-\\u2069\\u200E\\u200F\\u061C]/g, \"\")\n .replace(/[&<>\"']/g, (c) => ({ \"&\": \"&\", \"<\": \"<\", \">\": \">\", '\"': \""\", \"'\": \"'\" }[c] as string));\n/** For a field typed by a stranger into her public booking form: capped, then escaped. */\nconst MAX_CELL = 120;\nconst escCell = (s: unknown) => {\n const raw = text(s);\n return esc(raw.length > MAX_CELL ? `${raw.slice(0, MAX_CELL)}...` : raw);\n};\n// The Friday report compares complete Friday-to-Thursday weeks; this page rolls the last 7 days.\n// Saying \"on last week\" here would mean something different from the same phrase there.\nconst vs = (a: number, b: number) => {\n if (a === b) return \"level with the 7 days before\";\n if (b === 0) return \"up from none the 7 days before\";\n const ch = Math.round(((a - b) / b) * 100);\n return `${ch > 0 ? \"up\" : \"down\"} ${Math.abs(ch)}% on the 7 days before`;\n};\nconst MONTHS = [\"Jan\", \"Feb\", \"Mar\", \"Apr\", \"May\", \"Jun\", \"Jul\", \"Aug\", \"Sep\", \"Oct\", \"Nov\", \"Dec\"];\nconst prettyDate = (iso: string) => {\n const m = /^(\\d{4})-(\\d{2})-(\\d{2})/.exec(iso || \"\");\n return m ? `${MONTHS[Number(m[2]) - 1] ?? m[2]} ${Number(m[3])}` : iso;\n};\nconst ago = (iso?: string | null) => {\n if (!iso) return \"never\";\n const m = Math.floor((Date.now() - Date.parse(iso)) / 60000);\n if (!Number.isFinite(m)) return \"unknown\";\n if (m < 1) return \"just now\";\n if (m < 60) return `${m} minute${m === 1 ? \"\" : \"s\"} ago`;\n const h = Math.floor(m / 60);\n if (h < 24) return `${h} hour${h === 1 ? \"\" : \"s\"} ago`;\n const d = Math.floor(h / 24);\n return `${d} day${d === 1 ? \"\" : \"s\"} ago`;\n};\n\n// ---- the holiday deposit card ----------------------------------------------------------------\n// EVERY WORD HERE IS ABOUT SOMEBODY ELSE'S MONEY, so the rules are tighter than anywhere else on\n// this page: it is a list to LOOK AT, never a list of people who owe. Cash and phone deposits do\n// not reach Square, so an absence of a payment is an absence of evidence and is worded that way.\n// A read that failed stays visibly unknown and is never quietly filed under \"nothing found\".\nexport const DEP_STATE: Record = {\n seen: { label: \"Payment on file\", color: GOOD },\n partial: { label: \"Worth a look\", color: WARN },\n none_seen: { label: \"Worth a look\", color: WARN },\n could_not_check: { label: \"Could not check\", color: \"#6b7280\" },\n};\n/** The Dogs column has to agree with the money. Her titles do not all carry a dog name — one real\n * one is \" Boarding Dropoff with Help Test\" — so a stay can be charged for three dogs while only\n * two names parsed. Showing the two names alone reads as an overcharge; this says both numbers. */\n// The windows line, built so it cannot render as a dangling \"Windows checked: .\" and cannot throw\n// on a blob whose `windows` is not an array of objects. That line sits outside the rows check, so\n// before this it ran — and crashed the page — even when there was nothing at all to show.\nfunction windowLine(windows: unknown): string {\n const ws = (Array.isArray(windows) ? windows : []).filter((w): w is { name: string; from: string; to: string } => !!w && typeof w === \"object\");\n if (!ws.length) return \"The holiday windows are not recorded on this list, so it cannot say which dates it covered.\";\n return `Windows checked: ${ws.map((w) => `${esc(w.name)} (${esc(prettyDate(w.from))} to ${esc(prettyDate(w.to))})`).join(\", \")}.`;\n}\n\nexport function dogsCell(r: DepositRow): string {\n // Array.isArray, not `?? []`. A `dogs` field that is a bare string — or a number, or an object —\n // reaches `.filter` and throws, and this function is called inside the page's one big template\n // literal with no try/catch anywhere above it, so the whole dashboard 500s on one bad row.\n // Same for a dogCount that is a numeric string (\"1 dogs\") or negative (\"-1 dogs\").\n const names = (Array.isArray(r.dogs) ? r.dogs : []).filter((d) => typeof d === \"string\" && d.trim());\n const asked = Number(r.dogCount);\n const n = Math.max(0, Number.isFinite(asked) ? Math.floor(asked) : 0) || names.length || 0;\n if (!n) return \"not recorded\";\n if (!names.length) return `${n} ${n === 1 ? \"dog\" : \"dogs\"}, names not recorded`;\n if (names.length < n) return `${names.join(\", \")} and ${n - names.length} more (${n} in total)`;\n return names.join(\", \");\n}\n\nexport function depositCard(dep: DepositBlob | null, readOk: boolean, agoFn: (s?: string | null) => string): string {\n if (!readOk) {\n return `
Holiday deposits
We could not read the deposit list just now. That is a problem reading it, not a finding about anybody. Refreshing in a few minutes normally fixes it.
`;\n }\n if (!dep || !dep.at) {\n return `
Holiday deposits
The deposit check has not run yet, so there is nothing to show here. It fills in the first time it runs.
`;\n }\n // A STORED LIST THAT IS NOT A LIST IS A READING PROBLEM, not an empty season. Filtering a\n // malformed `rows` down to [] and carrying on would print \"No holiday boarding stays are booked\",\n // which is the one thing this card must never say on the strength of something it could not read.\n if (dep.rows !== undefined && dep.rows !== null && !Array.isArray(dep.rows)) {\n return `
Holiday deposits
The stored deposit list is not readable, so nothing is shown here rather than a list that might be wrong. That is a problem reading it, not a finding about anybody.
`;\n }\n // NOTHING BELOW TRUSTS THE SHAPE OF THE STORED BLOB.\n //\n // Every one of these guards is a crash reproduced on 7 August against the real function. The card\n // is interpolated into the page's single template literal, and there is no try/catch between here\n // and the HTTP response, so any throw takes down Kim's whole dashboard rather than one card:\n // rows: {} -> \"(dep.rows ?? []) is not iterable\" (spread of a non-iterable)\n // rows: \"x\" -> renders a blank phantom customer the headline then counts\n // two same-state rows, day null -> \"Cannot read properties of null (reading 'localeCompare')\"\n // invisible with one row, because .sort() never calls the\n // comparator on a single element\n // dogs: \"Fido\" -> \".filter is not a function\" (fixed in dogsCell)\n // windows: \"Thanksgiving\" -> \".map is not a function\", and that line runs even with no rows\n const order: Record = { none_seen: 0, partial: 1, could_not_check: 2, seen: 3 };\n const day = (r: DepositRow) => (typeof r.day === \"string\" ? r.day : \"\");\n const rows = (Array.isArray(dep.rows) ? dep.rows : []).filter((r): r is DepositRow => !!r && typeof r === \"object\")\n .slice()\n .sort((a, b) => ((order[a.state] ?? 9) - (order[b.state] ?? 9)) || day(a).localeCompare(day(b)));\n const stayDates = (r: DepositRow) => r.until && day(r) && r.until > r.day\n ? `${prettyDate(r.day)} to ${prettyDate(r.until)}` : day(r) ? prettyDate(r.day) : \"date not recorded\";\n // A row with no readable name is NOT rendered anonymously. deposits.ts already substitutes\n // \"name not readable\" upstream; a blank green \"Payment on file\" row with no name at all is\n // unverifiable — Kim cannot act on it and cannot check it — so this is the second line of that\n // defence rather than a duplicate of it.\n const who = (r: DepositRow) => (typeof r.name === \"string\" && r.name.trim() ? r.name : \"name not readable\");\n // AN UNKNOWN STATE FALLS BACK TO \"could not check\", as one pair.\n // [was: two independent `??` fallbacks, a grey dot and the label \"Worth a look\", which between\n // them produced a combination that exists nowhere in DEP_STATE: grey is reserved for\n // \"Could not check\" and \"Worth a look\" is reserved for the two orange states. A state this code\n // does not recognise is a state it cannot make a claim about, so it says so.]\n const shown = (r: DepositRow) => DEP_STATE[r.state] ?? DEP_STATE.could_not_check;\n const body = rows.map((r) => `${escCell(who(r))}${esc(stayDates(r))}${escCell(dogsCell(r))}\n● ${esc(shown(r).label)}\n${esc(r.note)}${looksLikeTestRecord(who(r)) ? \" This one looks like somebody testing the booking form rather than a customer, so check who it is before you call.\" : \"\"}`).join(\"\");\n const missed = dep.calendarsAsked && dep.calendarsRead < dep.calendarsAsked\n ? `
Not the whole picture: ${dep.calendarsAsked - dep.calendarsRead} of your ${dep.calendarsAsked} boarding calendars did not answer when this ran, so bookings on ${dep.calendarsAsked - dep.calendarsRead === 1 ? \"it are\" : \"them are\"} missing from the list below.
` : \"\";\n // A pick-up calendar that did not answer is the quiet one: the stays that go missing are exactly\n // the ones that start before a holiday and run into it, and the short list still looks complete.\n const noPickups = (dep.pickupsAsked ?? 0) && (dep.pickupsRead ?? 0) < (dep.pickupsAsked ?? 0)\n ? `
Not the whole picture: ${(dep.pickupsAsked ?? 0) - (dep.pickupsRead ?? 0)} of your ${dep.pickupsAsked} boarding pick-up calendars did not answer, so anyone who dropped off before a holiday and stayed through it may be missing from this list.
` : \"\";\n // COUNTS THE ROWS ON THE TABLE, not the customers behind them. [was: dep.readFailures, which\n // counts customers, so one customer with three holiday stays produced \"1 customer's payments\n // could not be read\" above a table showing three unknown rows and a headline saying 3.]\n const unknownRows = rows.filter((r) => r.state === \"could_not_check\").length;\n const unknowns = unknownRows\n ? `
${unknownRows === 1 ? \"1 stay\" : `${unknownRows} stays`} could not be checked when this ran, so ${unknownRows === 1 ? \"it is\" : \"they are\"} marked unknown rather than guessed at.
` : \"\";\n // EVERY ROW BELOW IS WRITTEN IN THE PRESENT TENSE. If the list is old, saying so at the bottom\n // in small print is not enough: somebody could have paid yesterday and the page would still read\n // \"no Square payment is on file\". Past a day and a half this goes at the TOP, where the reader\n // is before they start acting on names.\n const ageH = (Date.now() - Date.parse(dep.at)) / 3_600_000;\n // AN AGE THAT CANNOT BE READ IS NOT AN AGE OF ZERO. [was: `Number.isFinite(ageH) && ageH > 36`\n // alone, so an unparseable `at` made ageH NaN, skipped this banner silently, and a list of\n // completely unknown age looked identical at the top of the card to one checked a minute ago —\n // in the one place this card exists to be honest about.]\n const stale = !Number.isFinite(ageH)\n ? `
There is no readable date on this list, so there is no way to tell how old it is. Treat every row below as possibly out of date and check before you act on a name.
`\n : ageH > 36\n ? `
This list was last checked ${esc(agoFn(dep.at))}. Anyone who has paid since then will still show here as not found, so check the date before you act on a name.
` : \"\";\n // THE HEADLINE IS REGENERATED FROM THE ROWS ON THIS PAGE, never read from the blob.\n //\n // [was: `esc(dep.sentence)`, printed verbatim. The sentence and the rows are written by the same\n // run, so they agree — by convention, enforced nowhere. A stale, hand-edited or half-written\n // blob put \"No holiday boarding stays are booked in the deposit windows yet, so there is nothing\n // to check.\" directly above a table of three named people worth checking. Generating it here\n // from the rows being rendered makes that disagreement impossible rather than unlikely.]\n const sentence = depositSentence(rows.map((r) => ({ state: shown(r) === DEP_STATE.could_not_check ? \"could_not_check\" : r.state })), !!dep.feedDead);\n return `
Holiday deposits
\n
${esc(sentence)}
\n${stale}${missed}${noPickups}${unknowns}\n${dep.feedDead ? \"\" : rows.length ? `${body}
Who Stay Dogs Deposit
` : \"\"}\n
${windowLine(dep.windows)} $50 per dog, so a three-dog stay is $150. ${esc(OTHER_ROUTES)} Only overnight boarding stays are counted here; cancellations and everything else on the calendar are left out. Last checked ${esc(agoFn(dep.at))}.
\n
`;\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n const k = url.searchParams.get(\"k\") || \"\";\n const admin = await isAdmin(k);\n if (!admin && !(await isViewer(k))) return new Response(\"Not found\", { status: 401 });\n\n const now = Date.now(), tz = ET();\n const wk = 7 * 86_400_000;\n const cur = { startMs: now - wk, endMs: now, label: \"last 7 days\" };\n const prev = { startMs: now - 2 * wk, endMs: now - wk, label: \"the 7 before\" };\n\n const cacheRead = await readBlob(CACHE_KEY);\n const cache = cacheRead.v ?? {};\n const stale: string[] = []; // sections served from cache, named for the reader\n const truncated: string[] = [];\n\n // v1.1 (review #1): every source runs CONCURRENTLY with its own budget. Sequentially, a merely\n // slow CRM could exceed the platform's request limit and the page would die entirely, which is\n // the one outcome this dashboard exists to prevent. Now the whole fetch phase costs one budget,\n // not the sum of them, and any single source can fail without touching the others.\n const BUDGET = 9_000;\n const budgeted = (p: Promise): Promise =>\n Promise.race([p, new Promise((_, rej) => setTimeout(() => rej(new Error(\"too slow\")), BUDGET))]);\n\n const [cRes, ptRes, oppRes, metaRes, tagRes, sqRes] = await Promise.allSettled([\n budgeted(contactsSince(now - 9 * wk, truncated)),\n budgeted((async () => {\n const d = await j(`/calendars/events?locationId=${LOC}&calendarId=${PUP_TALK_CAL}&startTime=${prev.startMs}&endTime=${now}`, \"2021-04-15\");\n return ((d?.events ?? []) as any[]).map((e: any) => ({\n startTime: typeof e.startTime === \"number\" ? e.startTime : Date.parse(e.startTime),\n appointmentStatus: e.appointmentStatus ?? \"unknown\", calendarId: PUP_TALK_CAL,\n })) as EventLite[];\n })()),\n budgeted((async () => {\n // PROVEN LIVE 4 Aug 2026. Replaces a capped scan that was quietly wrong — it found 2 new\n // customers in a week when the true figure was 5. Full note: NOTES-dashboard.md.\n const STAGES = [STAGE_CUSTOMER, STAGE_WON_PAID];\n const page = (stage: string, p: number) =>\n j(`/opportunities/search?location_id=${LOC}&limit=100&page=${p}&pipeline_stage_id=${stage}`, \"2021-07-28\");\n const acc: OppLite[] = [];\n let complete = true;\n for (const stage of STAGES) {\n const first = await page(stage, 1);\n const total = Number(first?.meta?.total ?? 0);\n const pages = Math.min(Math.ceil(total / 100) || 1, 40); // 40 pages = 4,000 records, a sane backstop\n if (Math.ceil(total / 100) > 40) complete = false;\n const rest = await Promise.all(\n Array.from({ length: Math.max(0, pages - 1) }, (_, i) => page(stage, i + 2).catch(() => null)),\n );\n for (const d of [first, ...rest]) {\n if (!d) { complete = false; continue; }\n for (const o of d?.opportunities ?? []) {\n // `status` is carried through as the CRM reports it. It used to be overwritten with \"won\" on\n // the way in, which meant the page could not see the field it went on to make claims about.\n acc.push({ createdAt: o.createdAt, status: String(o.status ?? \"open\"), monetaryValue: Number(o.monetaryValue) || 0, lastStageChangeAt: o.lastStageChangeAt ?? null });\n }\n }\n }\n if (!complete) truncated.push(\"customers\");\n return acc;\n })()),\n budgeted(metaWeek(cur.startMs, cur.endMs, tz)),\n // The Square backlog used to be four numbers typed into a sentence, and all four were wrong:\n // it said 35 payments worth $23,463.99 when the journal holds 40 worth $28,035.99, and it\n // never split the money between the recoverable and the unrecoverable. Read live now.\n // THE TAG THAT DECIDES WHETHER GO-LIVE REACHES ANYBODY, counted server side over the whole\n // contact base rather than sampled. Two calls, both filtered, both returning a total.\n // [was: the number 1,200 typed into a decision's evidence — a scan size presented as an\n // answer. Cross-checked 5 Aug: this filter and a full page-by-page walk of all 5,544\n // contacts agree exactly on \"no sale\" (133), \"tips-nurture\" (155) and \"customer\" (1,512).]\n budgeted((async () => {\n const count = async (tag: string | null): Promise => {\n const body: Record = { locationId: LOC, pageLimit: 1 };\n if (tag) body.filters = [{ field: \"tags\", operator: \"contains\", value: tag }];\n const r = await fetch(`${GHL}/contacts/search`, {\n method: \"POST\",\n headers: { Authorization: `Bearer ${await token()}`, Version: \"2021-07-28\", \"User-Agent\": \"curl/8.5.0\", \"Content-Type\": \"application/json\" },\n body: JSON.stringify(body),\n signal: AbortSignal.timeout(8_000),\n });\n if (!r.ok) throw new Error(`contacts/search ${r.status}`);\n return Number((await r.json())?.total ?? 0);\n };\n const [tagged, total] = await Promise.all([count(ENROLL_TAG), count(null)]);\n return { tag: ENROLL_TAG, tagged, total } as TagCoverage;\n })()),\n budgeted((async () => {\n if (!BRIDGE_ADMIN) throw new Error(\"bridge credential unavailable\");\n const r = await fetch(`${BRIDGE}?dump=1&admin=${encodeURIComponent(BRIDGE_ADMIN)}`,\n { signal: AbortSignal.timeout(15_000) });\n if (!r.ok) throw new Error(`bridge ${r.status}`);\n return squareBacklog(await r.json());\n })()),\n ]);\n\n const contacts: ContactLite[] | null = cRes.status === \"fulfilled\" ? cRes.value : null;\n const tagCov: TagCoverage | null = tagRes.status === \"fulfilled\" ? tagRes.value : null;\n const ptEvents: EventLite[] | null = ptRes.status === \"fulfilled\" ? ptRes.value : null;\n const opps: OppLite[] | null = oppRes.status === \"fulfilled\" ? oppRes.value : null;\n const meta = metaRes.status === \"fulfilled\" ? metaRes.value : null;\n const square = sqRes.status === \"fulfilled\" ? sqRes.value : null;\n const metaRaw = metaRes.status === \"rejected\" ? String(metaRes.reason).replace(/^Error:\\s*/, \"\") : null;\n const metaPending = metaRaw === \"PERMISSION\"; // linked, but Facebook has not granted reading yet\n const metaErr = metaPending ? null : (metaRaw ? metaRaw.slice(0, 80) : null);\n\n // computed, or pulled from cache with an honest label\n const C = cache.numbers ?? {};\n const A = cache.ages ?? {}; // per-section ISO stamps: a three-day-old number must not read \"a few minutes ago\"\n const inq = contacts ? countContacts(contacts, cur) : (C.inq ?? null);\n const inqPrev = contacts ? countContacts(contacts, prev) : (C.inqPrev ?? null);\n const srcAll = contacts ? sourceBreakdown(contacts, cur) : (C.srcAll ?? null);\n // PROVEN LIVE 4 Aug 2026: the source column was blank for 154 of 190, while the attribution\n // record placed 190 of 190. The page used to print \"no source recorded: 154\" and then guess in\n // prose that most were Messenger. It now reads the field that actually holds the answer.\n const chan = contacts ? channelBreakdown(contacts, cur) : (C.chan ?? null);\n const camps = contacts ? campaignBreakdown(contacts, cur) : (C.camps ?? null);\n const cover = contacts ? attributionCoverage(contacts, cur) : (C.cover ?? null);\n const buckets = contacts ? weeklyBuckets(contacts, now, 8) : (C.buckets ?? null);\n const pt = ptEvents ? countEvents(ptEvents, cur) : (C.pt ?? null);\n const ptPrev = ptEvents ? countEvents(ptEvents, prev) : (C.ptPrev ?? null);\n // Everything in `opps` is already stage-filtered to Customer/Won-Paid, so the STAGE is the\n // signal; the CRM's own status field is left untouched so the page can report on it honestly.\n const stageWon = (list: OppLite[] | null, w: { startMs: number; endMs: number }) => list\n ? { count: list.filter((o) => { const t = Date.parse(o.lastStageChangeAt || o.createdAt); return Number.isFinite(t) && t >= w.startMs && t < w.endMs; }).length, value: 0 }\n : null;\n const won = opps ? stageWon(opps, cur) : (C.won ?? null);\n // How often a price actually gets written on a deal. The page used to state flatly that every\n // opportunity sat at zero, which a reader disproved from the page's own Bootcamp figures. It is\n // 53 of 1,513, none of them in the last month. Counted here rather than claimed.\n const won2Total = opps ? opps.length : (C.won2Total ?? null);\n const valued = opps ? opps.filter((o) => Number(o.monetaryValue) > 0).length : (C.valued ?? null);\n const valuedTotal = opps ? opps.reduce((a, o) => a + (Number(o.monetaryValue) || 0), 0) : (C.valuedTotal ?? null);\n // \"none at all in the last month\" was typed into the template and would have read true forever,\n // including on the day somebody wrote one. Measured now, from the same records.\n const valuedRecentMs = opps\n ? (opps.filter((o) => Number(o.monetaryValue) > 0)\n .map((o) => Date.parse(o.lastStageChangeAt || o.createdAt)).filter((t) => Number.isFinite(t))\n .reduce((a, b) => Math.max(a, b), 0) || null)\n : (C.valuedRecentMs ?? null);\n const lostCount = opps ? opps.filter((o) => String(o.status).toLowerCase() === \"lost\").length : (C.lostCount ?? null);\n const wonPrev = opps ? stageWon(opps, prev) : (C.wonPrev ?? null);\n const missing: string[] = []; // failed AND no cached value to fall back on\n if (!contacts) (C.inq != null ? stale : missing).push(\"new inquiries\");\n if (!ptEvents) (C.pt ? stale : missing).push(\"Pup Talks\");\n if (!opps) (C.won ? stale : missing).push(\"new customers\");\n\n const googleR = await readBlob(GOOGLE_ADS_BLOB);\n const google = googleSnapshotView(googleR.v, now);\n const googleDetail = !googleR.ok\n ? \"The stored Google Ads Script snapshot could not be read.\"\n : google.state === \"fresh\"\n ? `${google.source}, as at ${google.asAt}.`\n : `${google.source} is ${google.state}${google.asAt ? `, as at ${google.asAt}` : \"\"}. ${google.detail}`;\n\n const runR = await readBlob(\"puppy_run_state\"); const run = runR.v;\n const wd = await getBlob(\"wd_public\");\n const killR = await readBlob(\"nurture_kill\"); const kill = killR.v;\n const stateR = await readBlob(\"puppy_state\"); const state = stateR.v ?? {};\n const stateKnown = stateR.ok, runKnown = runR.ok && killR.ok;\n const liveLog = await getBlob(\"tds_worklog\");\n // What the tagging WOULD do, written down by the engine on every run. It applies nothing.\n const tagScan = await getBlob<{ at?: string; summary?: DetectSummary; applied?: boolean }>(\"tag_candidates\");\n // THE HOLIDAY DEPOSIT LIST. Read from the blob the collector writes, never recomputed here: the\n // collection is dozens of CRM calls and Kim's page must not wait for them. A read that FAILS and\n // a list that is genuinely EMPTY are kept apart, because \"no holiday stays booked\" and \"we could\n // not check\" look identical on a screen and only one of them is safe to show in November.\n const depR = await readBlob(\"holiday_deposits\");\n const dep = depR.v;\n const log = mergeLog(SEEDED, liveLog);\n\n const crmSources = [[\"contacts\", !!contacts], [\"appointments\", !!ptEvents], [\"deals\", !!opps]] as const;\n const crmDown = crmSources.filter(([, ok]) => !ok).map(([n]) => n);\n const crmOk = crmDown.length === 0;\n const crmPartial = crmDown.length > 0 && crmDown.length < 3;\n const engineAgeMin = run?.ts ? Math.floor((now - Date.parse(run.ts)) / 60000) : null;\n const engineCadence = observedCadenceMin(run?.history);\n const engineLate = lateness(engineAgeMin, engineCadence);\n const engineOk = isHealthy(engineLate.state) && !kill?.stopped;\n // THREE-VALUED ON PURPOSE, because two values have nowhere to put \"we could not tell\". An\n // unknown mode renders as unknown, never as practice. Full note: NOTES-dashboard.md.\n const modeKnown = runKnown && typeof run?.testMode === \"boolean\";\n const practice = modeKnown && run.testMode === true;\n const wdAgeMin = wd?.ts ? Math.floor((now - Date.parse(wd.ts)) / 60000) : null;\n // SCHEDULED runs only. A rhythm measured over hand-triggered runs is a measurement of the hand.\n // [was: observedCadenceMin(wd?.history), where history mixes both. It produced \"left to itself\n // it runs about every 95 minutes\" out of stamps that were almost entirely me pressing the\n // check-now button, and put that sentence in front of Kim as the watchdog's schedule. The\n // watchdog now records autoHistory separately; older payloads have no such field, and the\n // honest answer for those is \"we cannot tell yet\" rather than the old number.]\n const wdAuto: string[] | null = Array.isArray(wd?.autoHistory) ? wd.autoHistory : null;\n const wdTracksTrigger = wdAuto != null;\n const wdNeverRanItself = wdTracksTrigger && wdAuto.length === 0;\n const wdCadence = wdTracksTrigger ? observedCadenceMin(wdAuto) : null;\n const wdAutoAgeMin = wd?.lastAutoTs ? Math.floor((now - Date.parse(wd.lastAutoTs)) / 60000) : null;\n // Graded on when it last ran ITSELF, not on when it was last poked.\n const wdLate = wdNeverRanItself\n ? { state: \"late\" as const, dueAt: null, lateAt: null }\n : lateness(wdTracksTrigger ? wdAutoAgeMin : wdAgeMin, wdCadence);\n // When did we start being able to tell the difference? The first stamp after the change.\n const wdTrackingSince: string | null = wdTracksTrigger && Array.isArray(wd?.history) && wd.history.length\n ? wd.history[wd.history.length - 1] : null;\n const wdManualSince = wdTracksTrigger && Array.isArray(wd?.history)\n ? wd.history.filter((t: string) => !wdTrackingSince || Date.parse(t) >= Date.parse(wdTrackingSince)).length\n : 0;\n // A watchdog that has not looked recently is not a passing watchdog, whatever its last report\n // said. Grading it purely on the contents of a stale report is how a page ends up putting a\n // green tick beside a system that stopped running an hour ago.\n const wdOk = !!wd && (wd.worst === \"OK\" || wd.worst === \"INFO\") && isHealthy(wdLate.state);\n\n // v1.1 (reviews #3, #8): each section carries its OWN timestamp so staleness is reported per\n // number, and the whole write is skipped when the cache could not be read, so a transient blob\n // hiccup can never erase good history for a section that happens to be failing today.\n if (cacheRead.ok && (contacts || ptEvents || opps)) {\n const nowIso = new Date().toISOString();\n try {\n await (await blobMod()).setJSON(CACHE_KEY, {\n at: nowIso,\n numbers: {\n inq: contacts ? inq : C.inq, inqPrev: contacts ? inqPrev : C.inqPrev,\n srcAll: contacts ? srcAll : C.srcAll, buckets: contacts ? buckets : C.buckets,\n chan: contacts ? chan : C.chan, camps: contacts ? camps : C.camps,\n cover: contacts ? cover : C.cover,\n pt: ptEvents ? pt : C.pt, ptPrev: ptEvents ? ptPrev : C.ptPrev,\n won: opps ? won : C.won, wonPrev: opps ? wonPrev : C.wonPrev,\n won2Total: opps ? won2Total : C.won2Total, valued: opps ? valued : C.valued,\n valuedTotal: opps ? valuedTotal : C.valuedTotal,\n valuedRecentMs: opps ? valuedRecentMs : C.valuedRecentMs, lostCount: opps ? lostCount : C.lostCount,\n },\n ages: {\n inq: contacts ? nowIso : A.inq, pt: ptEvents ? nowIso : A.pt, won: opps ? nowIso : A.won,\n },\n });\n } catch { /* the cache is a nicety; never fail the page over it */ }\n }\n\n if (admin && url.searchParams.get(\"f\") === \"json\") {\n return new Response(JSON.stringify({ inq, inqPrev, pt, won, meta, google, stale, crmOk, engineOk, practice, wd }, null, 2),\n { headers: { \"content-type\": \"application/json\", \"cache-control\": \"no-store\" } });\n }\n\n // each stale section reports ITS OWN age, not the cache blob's last-write time\n const sectionAge = (label: string) =>\n label === \"new inquiries\" ? (A.inq ?? cache.at) : label === \"Pup Talks\" ? (A.pt ?? cache.at) : (A.won ?? cache.at);\n\n // An appointment nobody has marked is silently counted as \"not a no-show\", which flatters the\n // show-up figure. The page says so, using a number it counts live rather than one typed here.\n const unmarked = pt ? Math.max(0, pt.booked - pt.showed - pt.noshow) : null;\n const otherBucket = contacts ? otherBucketExplanation(contacts as any, cur) : null;\n const ctx: Ctx = {\n unmarkedPupTalks: unmarked,\n inquiriesPerWeek: inq ?? null,\n squareSentence: square ? squareSentence(square) : null,\n // null when the read failed, so the decision says \"unconfirmed\" rather than \"zero\".\n puppyTagSentence: tagCov ? tagCoverageSentence(tagCov) : null,\n // The dry tagging pass. Present only when the engine has actually run one.\n tagScanSentence: tagScan?.summary && tagScan.applied === false\n ? [detectSentence(tagScan.summary), scanAgeNote(tagScan.at, now)].filter(Boolean).join(\" \")\n : null,\n };\n // Both of these used to be typed into the sentence: \"four in five\" (it was 84%) and a claim that\n // the rest \"picked up the phone\" (the arrival record has no phone category at all, so the chart\n // could never show one). Derived now, or not stated.\n const socialShare = chan && inq\n ? Math.round(100 * (chan as any[]).filter((c) => /Facebook|Instagram/i.test(c.source)).reduce((a, c) => a + c.n, 0) / inq)\n : null;\n // No null-coalescing to zero anywhere in this region, deliberately: an unread source list must\n // stay null rather than become a confident zero. A missing phone row and a list we could not read\n // are different facts, and only one of them is safe to print. (The literal pattern is kept out of\n // this comment too, because the test that enforces the rule scans the region as text.)\n const phoneRow = srcAll ? (srcAll as any[]).find((s0) => /phone/i.test(s0.source)) : null;\n const phoneLogged: number | null = srcAll ? (phoneRow ? phoneRow.n : 0) : null;\n const decisions = sortedDecisions();\n const blocking = blockingCount();\n\n // ---- headline verdict ------------------------------------------------------------------\n const problems: string[] = [];\n if (!crmOk) problems.push(\"the CRM is not answering\");\n if (!runKnown) problems.push(\"we could not check whether the follow-up system is running\");\n else if (kill?.stopped) problems.push(\"the follow-up system is stopped\");\n else if (!engineOk) problems.push(\"the follow-up system is running late\");\n // The headline has to agree with the mode row further down the page. Without this, a run record\n // that reads back fine but carries no readable practice-or-live flag left the row saying \"could\n // not check\" under a headline saying everything is normal, which is the shape of contradiction\n // the stranger test rejected. Kept as its own line rather than folded into the chain above,\n // because a stopped system and an unreadable mode are different things to tell somebody.\n else if (!modeKnown) problems.push(\"we could not tell whether the follow-up system is in practice or running for real\");\n if (wd && wd.worst === \"CRITICAL\") problems.push(\"the watchdog found a problem\");\n else if (wd && wdNeverRanItself) problems.push(\"we cannot yet show the watchdog keeping its own time\");\n else if (wd && wdLate.state === \"late\") problems.push(\"the watchdog has not looked recently\");\n const allWell = problems.length === 0;\n // problems[] is built from fixed strings above, but it is still assembled text that reaches the\n // page: escaped at the point of use (the hero line calls esc(verdict)), and kept a plain join\n // here so the escape has exactly one place to live.\n // A row below can wear a warning triangle for being merely overdue, which is not a problem worth\n // alarming Kim about. But the headline may not then say \"everything is running\" as though nothing\n // on the page were marked: the reader can see the triangle, and a headline that ignores it is the\n // same contradiction the stranger test rejected, moved up one level. So the headline names it.\n const liveIssues = decisions.filter((d) => d.liveNow).length;\n const running = [engineLate.state, wd ? wdLate.state : \"ok\"].filter((x) => x === \"due\").length;\n // [was: \"...already affecting customers rather than waiting on go-live.\" The contrast stopped\n // meaning anything on 11 August, when go-live happened: everything on this page is now\n // \"rather than waiting on go-live\", so the clause was quietly telling her the opposite. The\n // label was also typed in capitals, which she asked us to stop doing on 14 August.]\n const liveNote = liveIssues ? ` Separately, ${liveIssues === 1 ? \"one question below is marked\" : `${liveIssues} questions below are marked`} Happening now: ${liveIssues === 1 ? \"that one is\" : \"those are\"} already affecting customers.` : \"\";\n const behindNote = running ? ` ${running === 1 ? \"One part of it is\" : `${running} parts of it are`} running a little behind schedule, which happens and sorts itself out.` : \"\";\n const verdict = allWell\n // [was: the practice branch went on to count `blocking` as the number of things \"holding up\n // switching it on\". Since 14 Aug `blocking` means the email half cannot start, not that\n // go-live is held up, so that clause would have put a wrong number in the biggest sentence\n // on the page the moment this branch rendered again. Removed rather than restated: the\n // email half has its own line under Waiting on you, and one fact belongs in one place.]\n ? (runKnown && practice\n ? `Everything we run is healthy. The follow-up system's own record says practice mode, so it is not messaging anyone.${liveNote}${behindNote}`\n : `Everything is running normally.${liveNote}${behindNote}`)\n : \"Needs a look: \" + problems.join(\", \") + \".\";\n\n const tile = (label: string, v: string, note: string, accent?: string) =>\n `
${esc(v)}
${esc(label)}
${esc(note)}
`;\n const na = (v: number | null | undefined) => (v == null ? \"n/a\" : String(v));\n\n const checkRow = (ok: boolean, name: string, detail: string) =>\n `
${ok ? \"✓\" : \"⚠\"}
${esc(name)}
${esc(detail)}
`;\n\n // channel chart: top 3 named sources + Other, labeled directly (secondary encoding, per the\n // dataviz rule that a sub-3:1 slot needs visible labels)\n // v1.2 (stranger test): the old build assigned color index 2 to BOTH the third named source\n // and the catch-all roll-up beside it, so two adjacent segments and their two legend swatches\n // were pixel-identical and could not be told apart by looking. A roll-up bucket is not a peer\n // of the named categories anyway; it now takes the recessive gray the dataviz rules reserve for\n // it, which frees all three categorical slots for real, distinguishable channels.\n const chanRows = (chan ?? []).slice(0, 3);\n const chanOther = (chan ?? []).slice(3).reduce((a: number, s: any) => a + s.n, 0);\n const chanTotal = (chan ?? []).reduce((a: number, s: any) => a + s.n, 0) || 1;\n const segs = [\n ...chanRows.map((s: any, i: number) => ({ ...s, fill: `var(--c${i})` })),\n ...(chanOther ? [{ source: \"smaller channels added up\", n: chanOther, fill: \"var(--barq)\" }] : []),\n ];\n const share = (n: number) => `${Math.round((n / chanTotal) * 100)}%`;\n const chanBar = segs.map((s: any) =>\n ``).join(\"\");\n // Every row carries its share as well as its count. A bare 154 is a number; 81% is a decision.\n const chanLegend = segs.map((s: any) =>\n `
${esc(s.source)}${s.n} (${share(s.n)})
`).join(\"\");\n const campTop = (camps ?? []).slice(0, 5);\n const campShown = campTop.reduce((a: number, c: any) => a + c.n, 0);\n const campTotal = (camps ?? []).reduce((a: number, c: any) => a + c.n, 0);\n const campRows = campTop.map((c: any) =>\n `
${esc(c.name)}${c.n}
`).join(\"\");\n\n const maxB = Math.max(1, ...((buckets ?? [1]) as number[]));\n const bars = ((buckets ?? []) as number[]).map((b, i, arr) =>\n `
${b}
`).join(\"\");\n\n const adCard = (name: string, connected: boolean, spend: string, result: string, note: string) =>\n `
${esc(name)}
${connected\n ? `
${esc(spend)}
spent, last 7 days
${esc(result)}
conversations started
`\n : `
${esc(note)}
`}
`;\n const googleReady = googleR.ok && google.state === \"fresh\";\n const googleCard = googleReady\n ? `
Google
${esc(`${google.currency} ${google.spendLast7Days!.toFixed(2)}`)}
spent, last 7 days
${esc(String(google.conversionsLast7Days))}
conversions reported by Google
${esc(`${google.enabledCampaigns} enabled campaign${google.enabledCampaigns === 1 ? \"\" : \"s\"}; ${google.currency} ${google.configuredDailyBudget!.toFixed(2)}/day in enabled budgets; ${google.currency} ${google.spendToday!.toFixed(2)} spent today. Source: ${google.source}, as at ${google.asAt}.`)}
`\n : \"\";\n\n // Kim's reading order, from her own test: banner, first blocker, the four numbers, gone. The\n // history is the part she cannot act on, so it is the part that folds; the asks stay open.\n //\n // THE TWO HTML COMMENTS AROUND THIS CARD ARE A CONTRACT, NOT DECORATION (added 14 Aug 2026).\n // The watchdog checks that a LIVE system's page never uses the words \"practice mode\" in the\n // present tense, because for three days it did and nobody noticed. Every line in this card is\n // dated and past tense, and several of them correctly say practice mode was on in July and\n // early August, so the check skips what sits between `` and\n // ``. If either marker is removed the watchdog does NOT quietly stop\n // checking: it scans the whole page instead and starts complaining about this card, which is\n // the direction a broken check should fail in. Do not move a present-tense sentence in here.\n const LOG_SHOWN = 6;\n const logRow = (e: WorkEntry) => {\n const col = e.kind === \"broke\" ? CRIT : e.kind === \"mine\" ? WARN : e.kind === \"found\" ? WARN : GOOD;\n return `
${esc(KIND_LABEL[e.kind] ?? e.kind)}
${esc(e.what)}
${e.evidence ? `
How we know: ${esc(e.evidence)}
` : \"\"}
${esc(prettyDate(e.at))}
`;\n };\n const logRows = log.slice(0, LOG_SHOWN).map(logRow).join(\"\");\n const logRest = Math.max(0, log.length - LOG_SHOWN);\n const logRestRows = log.slice(LOG_SHOWN).map(logRow).join(\"\");\n\n // Eight-week direction. The tiles compare one week to the week before, which is noise at this\n // volume: the account's own week-on-week swings run to plus and minus thirty. The trend across\n // the whole chart is the sentence the reader actually wants, and it was the one thing on the\n // page nobody was saying out loud.\n const trendLine = (() => {\n const b = (buckets ?? []) as number[];\n if (b.length < 4) return \"\";\n const firstHalf = b.slice(0, Math.floor(b.length / 2)), lastHalf = b.slice(-Math.floor(b.length / 2));\n const a = firstHalf.reduce((x, y) => x + y, 0) / firstHalf.length;\n const z = lastHalf.reduce((x, y) => x + y, 0) / lastHalf.length;\n if (!a) return \"\";\n const ch = Math.round(((z - a) / a) * 100);\n if (Math.abs(ch) < 10) return `Averaged out, inquiries are running about level across these eight weeks, near ${Math.round(z)} a week.`;\n return `Averaged out, inquiries are ${ch > 0 ? \"up\" : \"down\"} ${Math.abs(ch)}% across these eight weeks: about ${Math.round(a)} a week over the first month, about ${Math.round(z)} a week over the last month.`;\n })();\n\n // The first reader's whole test was ninety seconds in a car park. Answering the second and third\n // readers added items until this card had twelve, which would have pushed every number below the\n // fold and failed her test to satisfy theirs. So the ones that actually hold up go-live are set\n // out in full, and the rest are listed as plain questions behind a fold she opens if she wants.\n // Nothing is hidden: the full text of every one is in the page, one tap away, and the count is\n // stated. It is an ordering decision, not an omission.\n // Numbered, because the page asks thirteen questions and gives her no way to answer them except\n // a message. \"Yes to 1 and 4\" is a reply she can type one-handed at 6am. An unnumbered list is\n // not.\n const numberOf = new Map(decisions.map((d, i) => [d.ref, i + 1]));\n const full = (d: Decision) =>\n `
${d.liveNow ? \"Happening now\" : esc(WEIGHT_LABEL[d.weight])}
` +\n `
${numberOf.get(d.ref)}. ${esc(d.ask)}
${esc(whyText(d, ctx))}
` +\n `
How we know: ${esc(evidenceText(d, ctx))}
` +\n (ifYesText(d, ctx) ? `
If you say yes: ${esc(ifYesText(d, ctx))}
` : \"\") +\n (extraText(d, ctx) ? `
${esc(extraText(d, ctx))}
` : \"\") +\n `
If you say nothing: ${esc(d.ifNothing)}
`;\n // Shown in full: anything that blocks go-live, AND anything already affecting real customers.\n // The first draft of this fold put a live double-messaging issue behind a summary reading \"none\n // of which hold anything up\", one line under a banner announcing it. Blocking and live-now are\n // different reasons to be at the top, and both earn it.\n const upFront = (d: Decision) => d.weight === \"blocking\" || !!d.liveNow || !!d.surface;\n const blockers = decisions.filter(upFront);\n const rest = decisions.filter((d) => !upFront(d));\n const decRows = blockers.map(full).join(\"\")\n + (rest.length\n ? `
${rest.length} more, none of which hold anything up${rest.some((d) => d.liveNow) ? `, though ${rest.filter((d) => d.liveNow).length === 1 ? \"one is\" : `${rest.filter((d) => d.liveNow).length} are`} already running against customers` : \" or affect anybody today\"}
${rest.map(full).join(\"\")}
`\n : \"\");\n\n // THE FUNNEL. Every piece of this was already on the page and the page never put it together.\n // A reader called it \"the whole ballgame\": assembled, it says what share of inquiries becomes a\n // customer. Rendered only when every step read successfully, because a funnel with a hole in it\n // invites exactly the wrong conclusion.\n const funnelReady = inq != null && pt != null && won != null && !truncated.includes(\"customers\");\n const rate = (a: number, b: number) => (b > 0 ? `${(100 * a / b).toFixed(a / b < 0.1 ? 1 : 0)}%` : \"n/a\");\n const funnelRows = funnelReady\n ? [\n { label: \"New inquiries\", n: inq as number, of: null as string | null },\n { label: \"Pup Talks on the calendar\", n: pt!.booked, of: `${rate(pt!.booked, inq as number)} of inquiries` },\n { label: \"Showed up\", n: pt!.showed, of: `${rate(pt!.showed, pt!.booked)} of the ${pt!.booked} that were held${pt!.cancelled ? `, ${rate(pt!.showed, pt!.booked + pt!.cancelled)} of all ${pt!.booked + pt!.cancelled} booked` : \"\"}` },\n { label: \"Became customers\", n: won!.count, of: \"in the same 7 days, but mostly from earlier inquiries\" },\n ]\n : [];\n const funnelMax = Math.max(1, ...funnelRows.map((r) => r.n));\n const funnelHtml = funnelRows.map((r, i) =>\n `
${esc(r.label)}
` +\n `
${i === 3\n ? \"\"\n : ``}
` +\n `
${r.n}${r.of ? ` ${esc(r.of)}` : \"\"}
`).join(\"\");\n\n // The page said \"1 in a sequence: people currently walking through the follow-up messages\".\n // That one record is the sanctioned test dummy (contact mxf92ajJDtsZMHqJxAKv, every one of its\n // sends flagged test:true). Calling a synthetic record a person is the single most misleading\n // thing this page has ever said, so the count of REAL people is derived separately and the copy\n // branches on it rather than on the raw total.\n const isTestRecord = (k: string, v: any) =>\n v?.test === true || v?.isTest === true || /dummy|zztest/i.test(String(v?.name ?? v?.contactName ?? \"\")) || k === TEST_DUMMY_ID;\n const SOURCE_TAG = \"nurture - puppy\";\n const TEST_DUMMY_ID = \"mxf92ajJDtsZMHqJxAKv\";\n const ENROLLED = [\"main\", \"awaiting_appt_outcome\", \"branch_a\", \"branch_b\", \"slow_track\"];\n const realPeople = Object.entries(state).filter(([k, v]: any) =>\n ENROLLED.includes(v?.status) && !isTestRecord(k, v)).length;\n const activeN = Object.values(state).filter((s: any) =>\n [\"main\", \"awaiting_appt_outcome\", \"branch_a\", \"branch_b\", \"slow_track\"].includes(s?.status)).length;\n const pausedN = Object.values(state).filter((s: any) => s?.status === \"paused_reply\").length;\n\n const html = `\n\nThe Dogs Spot dashboard\n
\n\n
The Dogs Spot
\n
This page reads your systems the moment you open it. Refresh any time.
\n\n
${allWell ? \"✓\" : \"⚠\"} ${esc(verdict)}
\n${decisions.length ? `
${decisions.length} question${decisions.length === 1 ? \"\" : \"s\"} on this page ${decisions.length === 1 ? \"is\" : \"are\"} waiting on a word from you. None of them hold up the follow-up system: that went live on 11 August and is running. ${blocking === 0 ? \"None of them hold up the email half either.\" : `${blocking} of ${blocking === 1 ? \"them holds\" : \"them hold\"} up the email half, which cannot start until ${blocking === 1 ? \"it is\" : \"they are\"} answered.`} They are the first card below, most pressing first.
` : \"\"}
\n\n
Waiting on you
\n
The ones written out in full are the ones worth your time first: anything holding up the email half, anything already affecting customers, and anything about money. The rest can wait as long as you like. Each one says how we know it is real and what happens if you never answer, because for most of them the answer is nothing bad. They are numbered, so a reply saying \"yes to 1 and 3\" is a complete answer. The numbers stay attached to the same questions week to week, so the list below runs out of order once the quieter ones are tucked away. Send it to Amir on Upwork, or say it on the next call.
\n${decRows}\n
\n\n${stale.length || missing.length || truncated.length ? `
Heads up: ${\n stale.length ? `${esc(stale.map((s) => `${s} (last read ${ago(sectionAge(s))})`).join(\", \"))} could not be read at this moment, so ${stale.length === 1 ? \"that number is the last one\" : \"those numbers are the last ones\"} we read successfully. ` : \"\"\n}${missing.length ? `${esc(missing.join(\" and \"))} could not be read and there is no earlier reading to show, so ${missing.length === 1 ? \"it shows\" : \"they show\"} as n/a. ` : \"\"\n}${truncated.length ? `you have enough records that we stopped reading partway through rather than keep you waiting, so ${truncated.length === 1 ? \"the count of\" : \"the counts of\"} ${esc(truncated.join(\" and \"))} ${truncated.length === 1 ? \"is a floor\" : \"are floors\"}, not ${truncated.length === 1 ? \"a total\" : \"totals\"}. The real number is that one or higher, never lower. ` : \"\"\n}Every other number on this page was read fresh just now. Refreshing in a few minutes normally gets the rest.
` : \"\"}\n\n
\n${tile(\"New inquiries\", na(inq), inq != null && inqPrev != null ? `last 7 days, ${vs(inq, inqPrev)}` : \"last 7 days\", undefined)}\n${tile(\"Pup Talks on the calendar\", pt ? String(pt.booked) : \"n/a\", pt && ptPrev ? `held in the last 7 days, ${vs(pt.booked, ptPrev.booked)}` : \"held in the last 7 days\")}\n${tile(\"Showed up\", pt ? String(pt.showed) : \"n/a\", pt ? (() => {\n const un = Math.max(0, pt.booked - pt.showed - pt.noshow);\n const bits = [`of the ${pt.booked} held`];\n if (pt.noshow) bits.push(`${pt.noshow} did not show`);\n // every appointment in the denominator has to be accounted for, or the reader is left doing\n // subtraction on the front tile and finding a number missing\n if (un) bits.push(`${un} ${un === 1 ? \"has\" : \"have\"} not been marked yet, so this figure is flattering by up to ${un}`);\n const tail = pt.cancelled ? ` A further ${pt.cancelled} cancelled ahead of time and ${pt.cancelled === 1 ? \"is\" : \"are\"} not counted in the ${pt.booked}.` : \"\";\n return bits.join(\", \") + \".\" + tail;\n })() : \"last 7 days\")}\n${tile(\"New customers\", won ? String(won.count) : \"n/a\", truncated.includes(\"customers\") ? \"reached the Customer stage. At least this many: see the note above\" : won && wonPrev ? `reached the Customer stage, ${vs(won.count, wonPrev.count)}` : \"reached the Customer stage, last 7 days\", undefined)}\n
\n\n${depositCard(dep, depR.ok, ago)}\n\n${funnelReady ? `
From first contact to paying customer
\n
Four counts over the same 7 days. An inquiry is any new person who reached you and landed in your CRM: a Facebook or Instagram message, a form, the chat box, or a phone call somebody logged.
\n${funnelHtml}\n
Before reading that first gap as bad news: ${socialShare != null ? `${socialShare}% of these inquiries` : \"most of these inquiries\"} arrived as a message on Facebook or Instagram, and a message costs the sender nothing, so plenty were never close to booking. Worth knowing what this cannot tell you: your CRM's arrival record has no category for a phone call at all, so callers are not separated out here. The old source column logged ${esc(String(phoneLogged ?? \"some\"))} phone calls this week, but that column is blank for most people, so neither of us can put a firm number on how many of these actually rang you. The first three rows follow the same people through. The last one does not, and it would be dishonest to draw an arrow to it: somebody who became a customer this week usually first got in touch weeks or months ago, so they are not part of the ${esc(String(inq))} above. Read it as four true counts over the same seven days rather than one conversion rate. The gap between inquiries and Pup Talks is the widest of them, and it is the one worth a conversation.
\n
` : \"\"}\n\n
Is everything working?
\n${checkRow(crmOk, \"Your CRM\", crmOk ? \"Answering normally. This page just read it.\" : crmPartial ? `Answered for some things but not for ${esc(crmDown.join(\" and \"))} just now. If this is still showing in an hour, tell Amir.` : \"Did not answer just now. If this is still showing in an hour, tell Amir.\")}\n${checkRow(engineOk, \"The follow-up system\", kill?.stopped\n ? \"Stopped by the big red button. Nothing is being sent.\"\n : engineAgeMin == null ? \"No check-in recorded yet.\"\n : `Last checked itself ${ago(run?.ts)}. ${lateSentence(engineLate, engineCadence)}`)}\n${checkRow(wdOk, \"The watchdog\", wd\n ? wdNeverRanItself\n ? `${wd.headline} Last look ${ago(wd.ts)}, started by hand. ${neverRanItselfSentence(wdTrackingSince, wdManualSince)}`\n : `${wd.headline} Last look ${ago(wd.ts)}. ${lateSentence(wdLate, wdCadence)}${wdLate.state === \"late\" ? \" Treat that last report as out of date until it looks again.\" : \"\"}`\n : \"No report from the watchdog yet.\")}\n${meta ? checkRow(true, \"Facebook ad spend\", \"Connected and reporting. Your spend is in the advertising section below.\")\n : metaPending ? `
•
Facebook ad spend
Half connected. Your ad account is named here, and Facebook has not yet given us permission to read what you spend on it, so the connection does not work yet. That is one setting on Amir's side, not a fault. It is the only reason this page can show you what came in but not what it cost.
`\n : metaErr ? checkRow(false, \"Facebook ad spend\", `Not reading right now: ${metaErr}`)\n : `
•
Facebook ad spend
Not linked yet, so this page cannot show what you spent. Where your inquiries came from is shown below regardless, because that comes from your own records rather than from Facebook.
`}\n${checkRow(googleReady, \"Google ad spend\", googleReady\n ? `Connected and reporting. ${googleDetail} Spend is in the advertising section below.`\n : googleDetail)}\n
\n\n
Where the last 7 days of inquiries came from
\n${chan ? `
${chanBar}
${chanLegend}
` : `
Could not read this just now.
`}\n${cover ? `
${cover.known === cover.total ? `Every one of these ${cover.total}` : `${cover.known} of these ${cover.total}`} carries a record of how they arrived, though for some that record just says \"other\", so treat the named channels as the solid part. Worth knowing: the CRM's own \"source\" column is blank for ${esc(String(((srcAll ?? []) as any[]).find((s: any) => s.source === \"no source recorded\")?.n ?? 0))} of these, so any list built off that column will look like you have no idea where your customers come from. You do. It is recorded one field over.
` : \"\"}\n${otherBucket && otherBucketSentence(otherBucket) ? `
${esc(otherBucketSentence(otherBucket))}
` : \"\"}\n${campRows ? `
Which ads they answered
${campRows}
${\n campShown < campTotal\n ? `The ${Math.min(5, (camps ?? []).length)} biggest, covering ${campShown} of the ${campTotal} people who answered a named ad. The remaining ${campTotal - campShown} are spread across ${Math.max(0, (camps ?? []).length - 5)} smaller ones. `\n : `All ${campTotal} people who answered a named ad. `\n}${inq != null && campTotal < inq ? `The other ${inq - campTotal} of your ${inq} inquiries came in without a campaign attached, which is normal for people who message you directly rather than clicking an ad. ` : \"\"}These are the campaign names exactly as they appear in your ad account. Counted from your own records rather than from Facebook, so it stays true whether or not the ad account is linked.
` : \"\"}\n
\n\n
New inquiries, week by week
\n${buckets ? `
${bars}
Eight weeks, oldest on the left. The last bar is the last 7 days.${trendLine ? ` ${esc(trendLine)}` : \"\"}
` : `
Could not read this just now.
`}\n
\n\n${meta || metaErr || googleReady ? `
What the advertising cost
\n${meta || metaErr ? adCard(\"Facebook and Instagram\", !!meta, meta ? money(meta.spend) : \"\", meta ? String(meta.conv) : \"\", metaErr ? `Not reading right now: ${metaErr}` : \"\") : \"\"}\n${meta ? `
Spend covers the seven full days up to yesterday, which is the last day the ad platform reports as final. Set against the ${esc(String(inq ?? \"n/a\"))} inquiries above, that is ${meta && inq ? esc(money(meta.spend / inq)) : \"n/a\"} each.
` : \"\"}\n${googleCard}\n
` : \"\"}\n\n
What we have been doing
\n
Newest first. Each line names how it was checked, so you can pick any one and hold it up against the thing itself. Anything marked \"my mistake\" is one of mine, kept here on purpose rather than quietly fixed.
\n${logRows || `
Nothing recorded yet.
`}\n${logRest ? `
${logRest} older ${logRest === 1 ? \"entry\" : \"entries\"}
${logRestRows}
` : \"\"}\n
\n\n
One thing worth fixing in the CRM
\n
${valued != null && valuedTotal != null && won2Total\n ? `A price gets written on about one deal in ${Math.max(2, Math.round(won2Total / Math.max(1, valued)))}: ${valued} of your ${won2Total} customer records carry one, ${money(valuedTotal)} between them. The most recent was ${valuedRecentMs ? esc(prettyDate(new Date(valuedRecentMs).toISOString()) + \" \" + new Date(valuedRecentMs).getUTCFullYear()) : \"further back than these records reach\"}. So the habit exists and it lapsed.`\n : \"Most of your deals do not carry a value.\"}${lostCount != null ? ` Across all ${won2Total} of those records, ${lostCount === 0 ? \"not one is marked won or lost\" : `${lostCount} ${lostCount === 1 ? \"is\" : \"are\"} marked lost and none at all are marked won`}.` : \"\"} So to be plain about it: this card carries no money in it, in or out, only counts of people. That is why it counts people reaching the Customer stage rather than showing you revenue: a figure built on that few would be worse than no figure at all. Writing the price on each deal as it closes is the single change that would let this page show you what a week was worth.
\n\n
The follow-up system, in detail
\n${modeKnown\n ? `
${practice ? \"⚠\" : \"✓\"}
${practice ? \"Practice mode\" : \"Live\"}
${practice ? \"It is doing everything except actually sending. Nobody real is being messaged. It goes live only when you say the word.\" : \"Real messages are going to real people.\"}
`\n : `
⚠
Practice or live: could not check
The system's own record did not answer just now, so this page will not guess. Refresh in a minute.
`}\n${stateKnown\n ? `
0 ? WARN : GOOD}\">${pausedN > 0 ? \"⚠\" : \"✓\"}
${pausedN > 0 ? `${pausedN} person${pausedN === 1 ? \"\" : \"s\"} replied and ${pausedN === 1 ? \"is\" : \"are\"} waiting on you` : \"Nobody is waiting on a reply from you\"}
${pausedN > 0 ? \"The system stepped back the moment they wrote to you. Answer them in your inbox; that is the only job this system ever hands you.\" : \"When somebody replies, the system stops messaging them and they appear here. That is the only job it ever hands you.\"}
\n
${realPeople ? \"✓\" : \"⚠\"}
${realPeople === 0 ? (practice ? \"Nobody real is in the sequence yet\" : \"Nobody is in the sequence right now\") : `${realPeople} in a sequence`}
${realPeople > 0\n ? \"People currently walking through the follow-up messages.\"\n // THE EMPTY CASE, AND WHICH EMPTY IT IS. Empty-and-practice, empty-and-live and\n // empty-and-we-cannot-tell are three different facts and read differently; the unknown branch\n // must not contain the phrase the watchdog scans this page for. Full note: NOTES-dashboard.md.\n : practice\n ? `In practice mode the system runs against ${activeN === 0 ? \"no records at all\" : `${activeN} test record${activeN === 1 ? \"\" : \"s\"} of ours`} and has never sent to or processed one of your actual inquiries. That is deliberate: it is how we prove the machinery works without touching anybody. People join by carrying the tag \"${esc(SOURCE_TAG)}\". A person can put that tag on today, and anyone marked simply waits, untouched, until the switch is thrown. No automation applies the tag yet, so that tagging gets switched on in the same move as go-live.`\n : !modeKnown\n ? `There is nobody in the sequence at this moment. Whether the system is set to run in practice or for real could not be read when this page opened, so this page will not tell you which, and the row a little above says the same thing. That is a failed read of one small record, not a fault in the follow-up itself. Nothing on this line is a claim about who has or has not been messaged, and nothing here is waiting on you. Refresh in a minute and it should be able to answer.`\n : `The system is live and there is nobody in it at this moment. That is what an empty week looks like rather than a fault: everyone who joined has either booked, become a customer, or reached the end of their three weeks. Nothing needs doing and nothing is waiting on you. The next person joins on their own, as soon as the mark \"${esc(SOURCE_TAG)}\" is on their record. Worth knowing which way to read a long empty run: if this line still says nobody a week from now while the new inquiries count at the top of this page keeps climbing, that is people arriving and not being marked, and it is worth telling Amir.`}
`\n : `
⚠
Who is in the system: could not check
This page will not show you a zero it cannot stand behind. Refresh in a minute.
`}\n
\n\n
Read live ${esc(prettyDate(new Date(now + tz * 60_000).toISOString()) + \" at \" + new Date(now + tz * 60_000).toISOString().slice(11, 16))} Georgia time. The four counts at the top, the funnel, both breakdowns and the week-by-week chart ${stale.length || missing.length || truncated.length ? \"were read from your own systems just now, apart from the ones named at the top\" : \"were read from your own systems just now\"}. The questions and the list of work are written by hand, and each one carries the check that backs it.
\n
`;\n\n return new Response(html, { headers: { \"content-type\": \"text/html; charset=utf-8\", \"cache-control\": \"no-store\" } });\n}\n",[460],"b45f58b5-564d-491b-a9ac-642ffdfcff88","cpl.ts","e52967e0-941c-11f1-8def-1607ee4eb77e",473,["D",1786298724982],"// COST PER LEAD, v1.0, 9 Aug 2026. GHL leads grouped by attributionSource.adId, joined to Meta\n// spend into per-campaign cost per lead. The val orchestrator wires these together and fetches\n// Meta itself; nothing here runs unattended, writes anything, or is a route.\n// WHY attributionSource, not attributions[] (report.ts/dashboard.ts's field): proven live 9 Aug —\n// GET /contacts/ (contactsSince, report.ts:70-92) has attributions[]/utmAdId, no attributionSource;\n// POST /contacts/search has attributionSource.adId directly; both agree on the total, 175 contacts\n// for 31 Jul-6 Aug. Window filter is report-logic.ts's inWindow (report-logic.ts:38-41): same rule\n// as \"New inquiries\".\ndeclare const Deno: { env: { get(k: string): string | undefined } };\nif (typeof (globalThis as any).Deno === \"undefined\") {\n (globalThis as any).Deno = { env: { get: (k: string) => (globalThis as any).process?.env?.[k] } };\n}\nimport { inWindow, money, type Window } from \"./report-logic.ts\";\nexport type { Window };\n\nexport const LOC = \"BQHJ19uohldYe3eqA0bl\";\nconst GHL = \"https://services.leadconnectorhq.com\";\n\n// ---- 1. GHL PULL, GROUPED BY AD ----\n\nexport type AdCount = { adId: string | null; n: number };\n// Network as an argument, shape of deposits.ts's io.get (deposits.ts:212): tests use a fixture.\nexport type GhlIo = { post: (path: string, version: string, body: unknown) => Promise };\n\nexport async function pullAdCounts(io: GhlIo, w: Window, errorsOut: string[]): Promise {\n const counts = new Map();\n let searchAfter: any;\n let reachedFloor = false;\n for (let page = 0; page < 40; page++) {\n const body: Record = { locationId: LOC, pageLimit: 100 };\n if (searchAfter) body.searchAfter = searchAfter;\n const d = await io.post(\"/contacts/search\", \"2021-07-28\", body);\n const cs = d?.contacts ?? [];\n if (!cs.length) break;\n for (const c of cs) {\n if (!inWindow(c.dateAdded, w)) continue;\n const adId = c?.attributionSource?.adId || null;\n const k = adId ?? \"\";\n counts.set(k, (counts.get(k) ?? 0) + 1);\n }\n const oldest = Date.parse(cs[cs.length - 1]?.dateAdded ?? \"\");\n searchAfter = cs[cs.length - 1]?.searchAfter;\n if (Number.isFinite(oldest) && oldest < w.startMs) { reachedFloor = true; break; }\n if (!searchAfter) { reachedFloor = true; break; }\n }\n // contactsSince's reachedFloor warning (report.ts:90): never silently read as \"no leads\".\n if (!reachedFloor) errorsOut.push(\"Contact pull hit the page cap before covering the window; ad counts may undercount\");\n return [...counts.entries()]\n .map(([k, n]) => ({ adId: k === \"\" ? null : k, n }))\n .sort((a, b) => b.n - a.n || String(a.adId).localeCompare(String(b.adId)));\n}\n\n// A ready io for real use (token resolution stays with the caller).\nexport function liveGhlIo(token: string): GhlIo {\n return {\n post: async (path, version, body) => {\n const r = await fetch(`${GHL}${path}`, {\n method: \"POST\",\n headers: { Authorization: `Bearer ${token}`, Version: version, \"User-Agent\": \"curl/8.5.0\", \"Content-Type\": \"application/json\" },\n body: JSON.stringify(body),\n signal: AbortSignal.timeout(25_000),\n });\n if (!r.ok) throw new Error(`GHL ${path} -> HTTP ${r.status}`);\n return r.json();\n },\n };\n}\n\n// ---- 2. JOIN TO PER-CAMPAIGN COST PER LEAD, pure, no network ----\n\nexport type AdSpend = { campaign: string; spend: number };\nexport type CampaignCPL = {\n campaign: string; leads: number; spend: number; spendStr: string;\n cpl: number | null; cplStr: string;\n formula: string; // spend / leads with real numbers in it (report-logic.ts:52's formula)\n};\n// noAdId: leads with no ad attribution at all. noSpendData: leads on a real adId Meta had no spend row for.\nexport type CPLResult = { campaigns: CampaignCPL[]; noAdId: number; noSpendData: number };\n\nexport function joinCostPerLead(counts: AdCount[], adSpend: Record): CPLResult {\n const byCampaign = new Map();\n const row = (name: string) => byCampaign.get(name) ?? { spend: 0, leads: 0 };\n for (const s of Object.values(adSpend)) {\n const r = row(s.campaign); r.spend += Number(s.spend) || 0; byCampaign.set(s.campaign, r);\n }\n let noAdId = 0, noSpendData = 0;\n for (const { adId, n } of counts) {\n if (!adId) { noAdId += n; continue; }\n const s = adSpend[adId];\n if (!s) { noSpendData += n; continue; }\n const r = row(s.campaign); r.leads += n; byCampaign.set(s.campaign, r);\n }\n const campaigns = [...byCampaign.entries()].map(([campaign, { spend, leads }]) => {\n const cpl = leads > 0 ? spend / leads : null;\n const spendStr = money(spend), cplStr = cpl === null ? \"n/a\" : money(cpl);\n const formula = `${spendStr} / ${leads} lead${leads === 1 ? \"\" : \"s\"} = ${cplStr}`;\n return { campaign, leads, spend, spendStr, cpl, cplStr, formula };\n }).sort((a, b) => b.spend - a.spend || a.campaign.localeCompare(b.campaign));\n return { campaigns, noAdId, noSpendData };\n}\n\n// ---- 3. META AD SPEND, defensive: every failure is a value, never a throw ----\n// A hiccup reads as \"spend not available now\", never crashes the unattended run. Same ET-day\n// slicing + unencoded time_range as report.ts's metaSpend (report.ts:135-141) — matched, not\n// \"improved\": the one Meta call run live so far.\n\nexport type MetaAdRow = { adId: string; adName: string; campaign: string; spend: number };\nexport type MetaResult = { ok: true; rows: MetaAdRow[]; truncated?: string } | { ok: false; why: string };\n\n// Mirrors report.ts:29-34, copied not imported: report.ts is an HTTP entry point, no exports.\nexport function etOffsetMin(atMs: number): number {\n const fmt = new Intl.DateTimeFormat(\"en-US\", { timeZone: \"America/New_York\", timeZoneName: \"shortOffset\" });\n const part = fmt.formatToParts(new Date(atMs)).find((p) => p.type === \"timeZoneName\")?.value ?? \"GMT-4\";\n const m = part.match(/GMT([+-]\\d+)/);\n return m ? Number(m[1]) * 60 : -240;\n}\n\nexport async function fetchMetaAdSpend(w: { startMs: number; endMs: number }, tzOffsetMin: number): Promise {\n const tok = Deno.env.get(\"META_TOKEN\"), act = Deno.env.get(\"META_AD_ACCOUNT\");\n if (!tok) return { ok: false, why: \"META_TOKEN is not set\" };\n if (!act) return { ok: false, why: \"META_AD_ACCOUNT is not set\" };\n const day = (ms: number) => new Date(ms + tzOffsetMin * 60_000).toISOString().slice(0, 10);\n const since = day(w.startMs), until = day(w.endMs - 86_400_000);\n // level=ad, one row per ad; limit=500 covers this account (17 ads seen in one live week).\n const url = `https://graph.facebook.com/v21.0/${act}/insights?level=ad&fields=ad_id,ad_name,campaign_name,spend&time_range={\"since\":\"${since}\",\"until\":\"${until}\"}&limit=500`;\n let r: Response;\n try { r = await fetch(url, { headers: { Authorization: `Bearer ${tok}` }, signal: AbortSignal.timeout(20_000) }); }\n catch (e) { return { ok: false, why: `Meta API unreachable: ${String(e).slice(0, 150)}` }; }\n let body: any;\n try { body = await r.json(); } catch { return { ok: false, why: `Meta insights returned unparseable JSON (HTTP ${r.status})` }; }\n if (!r.ok) return { ok: false, why: `Meta insights error: ${String(body?.error?.message ?? `HTTP ${r.status}`).slice(0, 200)}` };\n const rows: MetaAdRow[] = (body?.data ?? []).map((d: any) => ({\n adId: String(d.ad_id ?? \"\"), adName: String(d.ad_name ?? \"\"), campaign: String(d.campaign_name ?? \"\"), spend: Number(d.spend) || 0,\n }));\n const truncated = typeof body?.paging?.next === \"string\" ? \"more ads exist past this page; spend is partial\" : undefined;\n return { ok: true, rows, truncated };\n}\n\nexport function toAdSpendMap(rows: MetaAdRow[]): Record {\n const m: Record = {};\n for (const r of rows) if (r.adId) m[r.adId] = { campaign: r.campaign, spend: (m[r.adId]?.spend ?? 0) + r.spend };\n return m;\n}\n",[468],"f12e4f05-b4c9-4d64-8f25-b055e28125c0","consent.ts","38af309a-94ed-11f1-b1d6-1607ee4eb77e",1151,["D",1786979116789],"// PER-CHANNEL CONSENT. Extracted from main.ts on 10 Aug 2026, for two reasons: that file is at its\n// 80,000 character ceiling, and the function that decides whether a real human gets messaged should\n// be a file you can find, not twenty lines buried in the middle of the engine.\n//\n// Full evidence in NOTES-v1.4.md R28 and R31. The short version, and it is the important one:\n// GoHighLevel names dndSettings after the DO NOT DISTURB switch, not after the person.\n//\n// active the DND is ON -> BLOCK. 55 live contacts carry SMS active with\n// TWILIO_ERROR_CODE 30006, dnd:false, so nothing else\n// would have caught them.\n// permanent the recipient sent STOP -> BLOCK. 25 live contacts.\n// inactive the DND is OFF -> SEND. Kristina Gant, the only contact tagged for this\n// sequence, is inactive on every channel.\n// absent/\"\" no per-channel record -> SEND.\n//\n// Until 10 Aug this read `status !== \"active\"` as blocked, which is exactly backwards, and it\n// survived 394 assertions because the only test that touched it grepped the source text for the\n// word \"active\" instead of calling the function.\n//\n// The predicate ALLOW-LISTS the two states that mean go, so a state GoHighLevel invents tomorrow\n// fails CLOSED. `status` is consent; `message` is a delivery diagnostic and is never read as consent.\n\nexport type NurtureChannel = \"email\" | \"sms\";\n\n/** Find every spelling of a channel key. GHL normally returns `SMS`, `RCS` and `Email`, but a\n * lower-cased fixture or proxy response must not turn a block into permission. If duplicate keys\n * disagree, `some(blocked)` below chooses the safe result. */\nfunction channelEntries(ds: unknown, key: string): unknown[] {\n if (!ds || typeof ds !== \"object\" || Array.isArray(ds)) return [];\n return Object.entries(ds as Record)\n .filter(([k]) => k.toLowerCase() === key.toLowerCase())\n .map(([, value]) => value);\n}\n\nfunction entryBlocked(entry: unknown): boolean {\n if (!entry || typeof entry !== \"object\" || Array.isArray(entry)) return true;\n const status = String((entry as any).status ?? \"\").trim().toLowerCase();\n return status !== \"\" && status !== \"inactive\";\n}\n\nexport function readChannelConsent(contact: any): { email: boolean; sms: boolean } {\n const ds = contact?.dndSettings;\n const malformed = ds != null && (typeof ds !== \"object\" || Array.isArray(ds));\n const blocked = (key: string): boolean => malformed || channelEntries(ds, key).some(entryBlocked);\n return {\n // SMS and RCS are both text to the recipient, so either one off means we do not text them.\n sms: blocked(\"SMS\") || blocked(\"RCS\"),\n email: blocked(\"Email\"),\n };\n}\n\n/** One reason string for the planner and release tools. The top-level switch is absolute; a\n * per-channel switch only blocks that channel. Unknown per-channel statuses fail closed inside\n * `readChannelConsent`, while a genuinely absent setting keeps GHL's observed \"not blocked\"\n * meaning. */\nexport function channelBlockReason(contact: any, channel: NurtureChannel): string | null {\n if (!contact || typeof contact !== \"object\" || !Object.prototype.hasOwnProperty.call(contact, \"dnd\")) {\n return \"blanket Do Not Disturb status is unavailable\";\n }\n if (contact?.dnd === true) return \"blanket Do Not Disturb is on\";\n if (contact.dnd !== false) return \"blanket Do Not Disturb status is unreadable\";\n if (!Object.prototype.hasOwnProperty.call(contact, \"dndSettings\") ||\n !contact.dndSettings || typeof contact.dndSettings !== \"object\" || Array.isArray(contact.dndSettings)) {\n return \"per-channel consent snapshot is unavailable\";\n }\n return readChannelConsent(contact)[channel] ? `opted out of ${channel}` : null;\n}\n\n/** Was this object actually hydrated with the two consent surfaces? Opportunity-embedded contacts\n * often carry an address while omitting `dndSettings`; an aged-list release must not treat that\n * partial projection as consent evidence. */\nexport function hasConsentSnapshot(contact: any): boolean {\n return !!contact && typeof contact === \"object\" &&\n Object.prototype.hasOwnProperty.call(contact, \"dnd\") &&\n typeof contact.dnd === \"boolean\" &&\n Object.prototype.hasOwnProperty.call(contact, \"dndSettings\") &&\n !!contact.dndSettings && typeof contact.dndSettings === \"object\" && !Array.isArray(contact.dndSettings);\n}\n",[475],"83ca8078-cab9-4f96-b5f5-89120b8838d2","cadence.ts","14aa659c-902f-11f1-8dc5-1607ee4eb77e",178,["D",1785930139649],"// HOW OFTEN DOES IT ACTUALLY RUN. v1.0, 4 Aug 2026.\n//\n// WHY THIS FILE EXISTS: the dashboard told Kim \"the follow-up system runs every 15 minutes\"\n// because a human typed that sentence, not because anything had measured it. A stranger reading\n// the page cold caught it in one pass: the same health row said \"last checked itself 26 minutes\n// ago\" and \"it runs every 15 minutes\", with a green tick beside both. The claim and the evidence\n// were contradicting each other on screen and the claim was winning.\n//\n// The scheduler's interval is not readable through any API (four candidate routes probed on\n// 4 Aug, all 404), so the only honest source of truth is the footprints each system leaves. The\n// engine now records the timestamp of every run; these functions read the gaps between them.\n// Nobody gets to type the cadence any more, which means nobody can get it wrong.\n\n/** Median minutes between consecutive runs, or null when the evidence is too thin to claim one. */\nexport function observedCadenceMin(history: unknown): number | null {\n const ts = (Array.isArray(history) ? history : [])\n .map((x) => Date.parse(String(x))).filter((n) => Number.isFinite(n)).sort((a, b) => a - b);\n if (ts.length < 3) return null;\n const gaps: number[] = [];\n for (let i = 1; i < ts.length; i++) {\n const g = (ts[i] - ts[i - 1]) / 60000;\n // A same-minute duplicate is a double write, not an interval. A multi-day hole is a deploy or\n // an outage, not an interval. Reading either as \"the rhythm\" would let one bad night convince\n // the page that a 15-minute system normally runs daily, and then nothing would ever look late.\n if (g >= 1 && g <= 24 * 60) gaps.push(g);\n }\n if (gaps.length < 2) return null;\n gaps.sort((a, b) => a - b);\n const mid = Math.floor(gaps.length / 2);\n return Math.round(gaps.length % 2 ? gaps[mid] : (gaps[mid - 1] + gaps[mid]) / 2);\n}\n\n/**\n * Late relative to the rhythm the system actually keeps, not to a number somebody hoped for.\n *\n * THREE states, not two, and the middle one is the point. A single missed turn on a system that\n * batches daily messages is not a business problem, so raising an alarm for it would train the\n * reader to ignore alarms, and the day one matters nobody looks. But printing a plain green tick\n * beside a visibly overdue timestamp is what the stranger test caught and refused to accept: the\n * reader could see the gap, and the page was pretending not to. So an overdue-but-not-alarming\n * system gets its own word. The reader is told it is behind, and told that being behind here is\n * ordinary. Nothing is hidden and nothing is dramatised.\n *\n * ok within half a cycle of schedule\n * due past due, one missed turn or so. Says so out loud. Not a fault, not a green tick either.\n * late two and a half cycles behind, floor 30 minutes. This one reaches the headline verdict.\n *\n * With no measured rhythm the thresholds are a flat 60 and 90 minutes, so \"we have not measured\n * it yet\" cannot quietly become infinite patience for a system that has genuinely stopped.\n */\nexport function lateness(ageMin: number | null, cadenceMin: number | null): {\n state: \"ok\" | \"due\" | \"late\" | \"unknown\"; dueAt: number | null; lateAt: number | null;\n} {\n if (ageMin == null) return { state: \"unknown\", dueAt: null, lateAt: null };\n const dueAt = cadenceMin ? cadenceMin * 1.5 : 60;\n const lateAt = cadenceMin ? Math.max(cadenceMin * 2.5, 30) : 90;\n const state = ageMin > lateAt ? \"late\" : ageMin > dueAt ? \"due\" : \"ok\";\n return { state, dueAt, lateAt };\n}\n/** Does this state deserve a tick? Only a system on schedule does. */\nexport const isHealthy = (s: ReturnType[\"state\"]) => s === \"ok\";\n\n/**\n * Append this run's stamp to the trail a system leaves behind, given whatever the previous blob\n * held. Lives here rather than in the engine because main.ts sits against a hard 80,000-character\n * ceiling on the platform, and because the writer and the reader of this trail should agree on its\n * shape by sharing one definition instead of two that drift.\n *\n * Seeds from a pre-history state's own `ts` so the very next run already yields one real gap\n * rather than starting the evidence from nothing. Never appends a duplicate of the last stamp.\n */\nexport const RUN_HISTORY_MAX = 40;\nexport function appendRunStamp(prev: any, ts: string): string[] {\n let h: string[] = Array.isArray(prev?.history) ? prev.history.filter((x: unknown) => typeof x === \"string\") : [];\n if (!h.length && typeof prev?.ts === \"string\") h = [prev.ts];\n if (h[h.length - 1] !== ts) h.push(ts);\n return h.slice(-RUN_HISTORY_MAX);\n}\n\n/**\n * One sentence for the reader, combining the verdict and the yardstick it was measured against.\n *\n * The previous version printed those two separately and produced a flat contradiction that a\n * reader caught at once: \"Its next look is a little overdue\" immediately followed by \"There is not\n * enough history yet to say how often it normally runs.\" You cannot call a thing late and in the\n * same breath say you do not know when it was due. Both sentences were individually true, because\n * an unmeasured system still falls back to a flat one-hour expectation, but nothing on the page\n * said so. Now the yardstick is never separated from the judgement that used it.\n */\nexport function lateSentence(l: ReturnType, cadenceMin: number | null): string {\n const rhythm = cadenceMin == null\n ? \"We have not watched it long enough to know its usual rhythm, so for now we expect it at least once an hour\"\n : `Left to itself it runs about every ${cadenceMin} minute${cadenceMin === 1 ? \"\" : \"s\"}`;\n if (l.state === \"unknown\") return `${rhythm}, and there is no check-in on record to compare against.`;\n if (l.state === \"late\") return `${rhythm}, and it is well past that. If it is still behind in an hour, tell Amir.`;\n if (l.state === \"due\") return `${rhythm}, and it is a little past that now. One late turn is ordinary; several in a row is not.`;\n return `${rhythm}, and it is on time.`;\n}\n/**\n * The sentence for a system that is supposed to run on a schedule and, as far as anything can\n * tell, is not. Kept separate from lateSentence because \"it is a bit late\" and \"it has never\n * started on its own\" are different facts and must not share a phrasing.\n *\n * WHY THIS EXISTS. The watchdog reported a rhythm of \"about every 95 minutes\". That number was\n * computed from its run stamps, honestly, and it was still wrong: nearly every stamp was a human\n * pressing the check-now button. The page was describing my own button presses back to Kim as the\n * watchdog's schedule.\n *\n * IT MUST NOT GUESS WHY.\n * [was: \"Nothing has started it on its own, which means its timer is not firing.\" First half an\n * observation, second half a conclusion, and the conclusion was wrong. I opened the schedule on\n * 5 August and found it set to once every 24 hours, deliberately, a week earlier. The timer was\n * firing perfectly. It was just slower than the window I had been watching, and everything else\n * in the history was a person. I had already written \"the timer has never fired\" into a message\n * and onto Kim's page before I looked. An empty record of scheduled runs means exactly that:\n * report the gap, and let somebody open the settings.]\n *\n * `sinceIso` is when the system started telling scheduled runs apart from manual ones. Saying so\n * matters: an empty record since this morning is not the same claim as \"it has never run\".\n */\nexport function neverRanItselfSentence(sinceIso: string | null, manualCount: number): string {\n const since = sinceIso\n ? `Since ${new Date(sinceIso).toLocaleDateString(\"en-US\", { month: \"long\", day: \"numeric\" })} this system has recorded which of its checks were scheduled and which were started by hand.`\n : \"This system now records which of its checks were scheduled and which were started by hand.\";\n const manual = manualCount > 1\n ? ` ${manualCount} checks have run since then, every one started by hand.`\n : manualCount === 1\n ? \" One check has run since then, and it was started by hand.\"\n : \" Nothing has run since then either way.\";\n return `${since}${manual} Nothing on a schedule has been recorded in that time. Everything it checks is still being checked, because Amir has been running it by hand, but we cannot yet show you it keeping its own time. Nothing else on this page is affected either way.`;\n}\n\n/** Kept for callers that only want the yardstick. */\nexport function cadenceSentence(cadenceMin: number | null): string {\n return cadenceMin == null\n ? \"There is not enough history yet to say how often it normally runs.\"\n : `Left to itself it runs about every ${cadenceMin} minute${cadenceMin === 1 ? \"\" : \"s\"}.`;\n}\n",[482],"e046a436-72c8-404e-a3ba-72876134aa0f","boarding-messages.ts","a64140c2-9a55-11f1-9bdb-1607ee4eb77e",1173,["D",1786982807727],"// BOARDING INQUIRY, NOT YET BOOKED — recovered and repaired 17 Aug 2026.\n//\n// Source: the 31 Jul draft recovered from Amir's Downloads folder. This module deliberately stays\n// dry-run only. Prices are limited to the approved boarding-rate set enforced by paths.ts; the copy\n// does not claim availability, invent urgency, diagnose a dog, or turn a complimentary bath into a\n// grooming service. Every direct route points to The Dogs Spot's own boarding form.\n\nimport { PHONE_DISPLAY } from \"./puppy-messages.ts\";\nimport type { Step } from \"./paths.ts\";\n\nconst BOARDING_FORM = \"https://thedogsspotga.com/boarding-booking-form\";\n\nexport const BOARDING_STEPS: Step[] = [\n {\n id: \"main-1\", channel: \"sms\", offsetHours: 0,\n bodyTemplate:\n \"Hi {{FIRST_NAME}}, The Dogs Spot here. We got your boarding question. Tell us your dates and anything {{DOG_NAME}} needs us to know, and a real person will check availability. Reply STOP to opt out.\",\n },\n {\n id: \"main-2\", channel: \"email\", offsetHours: 24,\n subject: \"What a boarding day looks like here\",\n previewText: \"Routine, rest and what our team watches for.\",\n bodyTemplate: `Hi {{FIRST_NAME}},\n\nBefore rates and dates, the useful question is what a stay actually looks like for {{DOG_NAME}}.\n\nBoarding days have a routine: time outside, rest in the dog's own space and supervised time with our team. We watch eating, energy and how each dog is settling in, especially at the start of a first stay. If something does not look right, we contact you rather than guessing.\n\nIf {{DOG_NAME}} has never boarded before, has medication, needs a quieter setup or has a difficult history around other dogs, reply and tell us. That information helps us decide whether we are the right fit and plan responsibly.\n\nThe Dogs Spot`,\n },\n {\n id: \"main-3\", channel: \"sms\", offsetHours: 72,\n bodyTemplate:\n \"A first stay can feel like a big step. Routine helps most dogs settle, and the details matter. Reply with {{DOG_NAME}}'s dates, medication or special needs and we will tell you honestly what is possible. Reply STOP to opt out.\",\n },\n {\n id: \"main-4\", channel: \"email\", offsetHours: 120,\n subject: \"Boarding rates and the next step\",\n previewText: \"The current day rates in one place.\",\n bodyTemplate: `Hi {{FIRST_NAME}},\n\nHere are the current boarding day rates:\n\n- Regular boarding: $35/day\n- Special-needs boarding: $45/day\n- Training refresher for eligible graduates: $35/day\n\nSome eligible training graduates have a $30/day regular rate or $40/day special-needs rate. We confirm eligibility and the exact stay total before anything is booked.\n\nDrop-off and pick-up are by appointment. To request dates for {{DOG_NAME}}, use ${BOARDING_FORM} or reply here and our team will help.\n\nThe Dogs Spot`,\n },\n {\n id: \"main-5\", channel: \"sms\", offsetHours: 168,\n bodyTemplate:\n `Drop-off and pick-up are by appointment so our team is ready for {{DOG_NAME}}. Request your dates here: ${BOARDING_FORM}, or reply and we will help. Availability is confirmed by our team. Reply STOP to opt out.`,\n },\n {\n id: \"main-6\", channel: \"sms\", offsetHours: 240,\n bodyTemplate:\n \"One useful detail: boarding guests normally get a complimentary bath before pick-up, so they come home clean. If you want us to check dates for {{DOG_NAME}}, reply here. Reply STOP to opt out.\",\n },\n {\n id: \"main-7\", channel: \"email\", offsetHours: 312,\n subject: \"What to prepare for a first stay\",\n previewText: \"Food, records and the details that help a dog settle.\",\n bodyTemplate: `Hi {{FIRST_NAME}},\n\nFor a first stay, bring {{DOG_NAME}}'s own food in a labelled container and make sure current vaccination records are available before drop-off. Tell us about medication, feeding instructions, handling needs and anything that tends to make your dog worried.\n\nBecause drop-off and pick-up are by appointment, our team knows when to expect you and can plan the handoff instead of rushing it.\n\nIf you are unsure whether something matters, reply and tell us. We would rather know than guess.\n\nThe Dogs Spot`,\n },\n {\n id: \"main-8\", channel: \"sms\", offsetHours: 384,\n bodyTemplate:\n `If you have a trip coming up, send the dates before the last minute so we can check real availability. Request here: ${BOARDING_FORM}, or reply with the dates. Nothing is confirmed until our team says it is. Reply STOP to opt out.`,\n },\n {\n id: \"main-9\", channel: \"email\", offsetHours: 456,\n subject: \"If your dog is older, anxious or needs extra care\",\n previewText: \"The details we want before we confirm a stay.\",\n bodyTemplate: `Hi {{FIRST_NAME}},\n\nBeing older, anxious or new to boarding does not automatically rule {{DOG_NAME}} out. It does mean we need the full picture before confirming a stay.\n\nReply with medication, mobility limits, bite history, separation concerns, feeding needs and how your dog responds around unfamiliar people or dogs. We will tell you plainly whether our setup is suitable and what would be required.\n\nThis is not a promise that every dog can be accommodated. It is a promise that the decision will be based on the dog in front of us, not a generic checklist.\n\nThe Dogs Spot`,\n },\n {\n id: \"main-10\", channel: \"sms\", offsetHours: 552,\n bodyTemplate:\n `Still considering boarding for {{DOG_NAME}}? Reply with your dates and the one thing you are most concerned about. A real person will read it and give you a straight answer. Reply STOP to opt out.`,\n },\n {\n id: \"main-11\", channel: \"email\", offsetHours: 648,\n subject: \"Boarding rates and request link, one more time\",\n previewText: \"Everything needed to request a stay.\",\n bodyTemplate: `Hi {{FIRST_NAME}},\n\nOne last recap in case the earlier note was buried:\n\n- Regular boarding: $35/day\n- Special-needs boarding: $45/day\n- Training refresher for eligible graduates: $35/day\n- Eligible graduate rates, when confirmed: $30/day regular or $40/day special needs\n\nDrop-off and pick-up are by appointment, and availability must be confirmed by our team. Request dates for {{DOG_NAME}} here: ${BOARDING_FORM}.\n\nYou can also call or text ${PHONE_DISPLAY} if that is easier.\n\nThe Dogs Spot`,\n },\n {\n id: \"main-12\", channel: \"sms\", offsetHours: 720,\n bodyTemplate:\n `Last boarding note from us for now. If you still need dates for {{DOG_NAME}}, request them at ${BOARDING_FORM} or reply here. If plans changed, no problem. Reply STOP to opt out.`,\n },\n];\n",[489],"45af6bdb-c344-4f38-86d0-2ea214d6c3c5","api.ts",1150,["D",1786979115362],17,"// NURTURE CONTROL PANEL, HTTP face of the puppy-path engine. Built 2 Aug 2026.\n//\n// WHY THIS FILE EXISTS\n// The engine (main.ts) keeps everything it knows in val.town blobs. Blobs are reachable only with a\n// blob-scoped API token, which means the only people who could see whether the nurture system was\n// working were people holding a production credential. That is the wrong shape for this client: Kim\n// cancelled her previous supplier for going quiet, and a system whose status is invisible to her is\n// the same failure wearing different clothes.\n//\n// So the engine gets a front door. One URL, one key, no login, no install. It answers three\n// questions in plain language, who is in the system, what happened today, is anything broken, and\n// carries the one control she must always have: STOP.\n//\n// WHAT IT IS NOT\n// Read-mostly by design. The only state it writes is the kill switch. It cannot enrol anyone, send\n// anything, or edit copy. A leaked link is an information disclosure, not a way to message her\n// customers.\n//\n// AUTH\n// ?k=. Constant-time-ish compare, no key echoed back, no data before the check,\n// and the 401 body is byte-identical whether the key is absent or wrong.\n//\n// ROUTES (all GET, all query-param, so a phone bookmark works)\n// ?k=… the dashboard\n// ?k=…&f=json the same numbers as JSON\n// ?k=…&stop=1 kill switch ON , engine halts before it looks at a single contact\n// ?k=…&go=1 kill switch OFF\n//\n// COLOUR\n// Stage colours are a validated 4-step single-hue ordinal ramp (#86b6ef → #3987e5 → #256abf →\n// #184f95); status colours are the reserved good/warning/critical steps and always ship with a word\n// beside them, never colour alone. Both ramps were run through the palette validator in light and\n// dark before this file was written: ordinal ramp ALL CHECKS PASS in both modes.\n\n// The same shim engine/dashboard.ts carries, and for the same reason: this file has to be\n// importable outside val.town so a test can render the page and read it. Without it, the first\n// `Deno.env.get` at module scope throws on import and the page's words stay untested — which is\n// how four false sentences reached a live client and sat there.\ndeclare const Deno: { env: { get(k: string): string | undefined } };\nif (typeof (globalThis as any).Deno === \"undefined\") {\n (globalThis as any).Deno = { env: { get: (k: string) => (globalThis as any).process?.env?.[k] } };\n}\n\n// ---- auth ------------------------------------------------------------------------------------\n// v2 (2 Aug, after the adversarial pass): the key is NOT in this file. val.town vals are PUBLIC -\n// proved by fetching this very source with no token, so a literal key here was readable by anyone\n// who found the val, which meant anyone could read Kim's data, stop her system, or trigger a run.\n// The digest also lives in the environment. Keeping even a reusable verifier in public source makes\n// rotation harder and permits offline guessing when a human chose a weak key.\n\nasync function sha256Hex(s: string): Promise {\n const b = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(s));\n return [...new Uint8Array(b)].map((x) => x.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nasync function authorised(k: string): Promise {\n const expected = Deno.env.get(\"NURTURE_ADMIN_KEY_SHA256\") || \"\";\n const got = await sha256Hex(k);\n // Constant-time over equal-length hex digests.\n if (expected.length !== 64 || got.length !== expected.length) return false;\n let d = 0;\n for (let i = 0; i < got.length; i++) d |= got.charCodeAt(i) ^ expected.charCodeAt(i);\n return d === 0;\n}\n\n// v1.7.1, VIEW-ONLY access. The admin link is also the stop-button link, so anyone Kim forwards\n// it to could halt her follow-up. The view key is DERIVED from the admin digest (deterministic, no\n// second secret to store): it renders the same page minus the stop controls and the JSON/selftest\n// modes. Give Kim and staff the view link; the admin link stays with whoever may press stop.\nasync function viewKey(): Promise {\n // v1.7.2 (review fix), derived from the GHL token (a real secret in env/private blob), not\n // from the admin DIGEST that anyone can read in this public source. Rotating the CRM token\n // rotates the view links, which is the right coupling anyway.\n const tok = Deno.env.get(\"GHL_TOKEN\") || ((await get(\"puppy_config\", null))?.ghlToken ?? \"\");\n if (!tok) return \"tds_view_disabled_no_token_available_x\";\n return \"tds_view_\" + (await sha256Hex(tok + \":view\")).slice(0, 32);\n}\nasync function viewAuthorised(k: string): Promise {\n const expected = await viewKey();\n if (k.length !== expected.length) return false;\n let d = 0;\n for (let i = 0; i < k.length; i++) d |= k.charCodeAt(i) ^ expected.charCodeAt(i);\n return d === 0;\n}\nconst KILL_BLOB = \"nurture_kill\";\nconst BUSINESS_TZ = \"America/New_York\";\n// THE TWO TAGS THIS PAGE NAMES TO KIM, read the way the engine reads them. The page tells her to\n// take one tag off a record and check the other is on it, so if either name drifts the page is\n// sending her to do something to a tag that no longer decides anything.\n// TAG_SOURCE_SIGNAL is env-overridable in the engine and is read from the same env var here.\n// TAG_ENROLLED is minted by the engine and has no env override, so this is a SECOND COPY of\n// engine/puppy_path_v1.1.ts's constant. It cannot be imported: that module is the whole engine\n// and importing it here would pull the sender into the page. If it is ever renamed there, rename\n// it here in the same change. (tests/dashboard.test.mjs pins the two together.)\nconst TAG_SOURCE_SIGNAL = Deno.env.get(\"TAG_SOURCE_SIGNAL\") || \"nurture - puppy\";\nconst TAG_ENROLLED = \"puppy-path-v1\";\n/** How many journal entries the page reads. It SHOWS at most RECENT_ROWS rows: see `collapse`. */\nconst RECENT_RAW = 400;\n/** How many rows the table draws. Runs of identical entries take one row each, not one per entry. */\nconst RECENT_ROWS = 40;\n\nasync function blobMod() {\n return (await import(\"https://esm.town/v/std/blob\")).blob;\n}\nasync function get(key: string, fallback: any = null) {\n try {\n const blob = await blobMod();\n const v = await blob.getJSON(key);\n return v ?? fallback;\n } catch {\n return fallback;\n }\n}\n\n// A FAILED READ AND AN EMPTY VALUE ARE NOT THE SAME FACT, and `get()` above cannot tell them\n// apart: it catches the failure and hands back the fallback, so a record that could not be read\n// comes back looking exactly like a record that has never been written.\n//\n// On most blobs that costs nothing. On the run record it costs a sentence: one failed read and\n// this page told Kim \"This has never recorded a run. Tell Amir.\" about a system that has been\n// running hourly all week, and put \"no run has reported yet\" under a banner she checks daily.\n// Both are claims about her system made out of a failure to read one small record.\n// So the run record is read through this instead, and the page has a third thing it can say.\ntype Read = { ok: boolean; v: T | null };\nasync function read(key: string): Promise> {\n try {\n const blob = await blobMod();\n return { ok: true, v: ((await blob.getJSON(key)) ?? null) as T | null };\n } catch {\n return { ok: false, v: null };\n }\n}\n\n\n// Plain-English names for the engine's internal statuses. Kim never sees a snake_case token.\nconst STATUS_LABEL: Record = {\n main: \"In the main sequence\",\n awaiting_appt_outcome: \"Booked, waiting on the Pup Talk\",\n branch_a: \"Missed the Pup Talk, being rebooked\",\n branch_b: \"Had the Pup Talk, hasn't bought yet\",\n slow_track: \"On the slow track, an occasional helpful message\",\n paused_reply: \"Paused, they replied, a human has it\",\n done_booked: \"Booked a Pup Talk\",\n done_customer: \"Became a customer\",\n done_hard_exit: \"Stopped, opted out or disqualified\",\n done_soft_21d: \"Finished the sequence\",\n done_branch_complete: \"Finished the follow-up\",\n // v1.7.2, 14 Aug 2026. Two end states added to the engine by reachability.ts. Without a name\n // here the lookup below used to fall through to the raw value, so the words \"done_send_failed\"\n // would have appeared on a page written for somebody who does not want to know what a status is.\n done_unreachable: \"No way to contact them\",\n done_send_failed: \"Messages keep failing — needs a look\",\n // v1.10, 14 Aug 2026. Written when somebody carrying the joining tag turns out to have been a\n // customer already, so the follow-up never starts for them. Deliberately NOT done_customer, and\n // that distinction is the whole reason it exists: WON below sums done_booked and done_customer\n // off the saved state and puts the total on the \"Booked or became a customer\" tile, which is the\n // one number Kim judges this system by. These people bought before it ever touched them and\n // received nothing from it, so counting them there would credit it with her own sales. It is in\n // neither ACTIVE nor WON, it needs nothing from her, and it never reaches the tile that asks her\n // to fix something.\n done_not_enrolled: \"Already a customer, so never put on the follow-up\",\n};\nconst ACTIVE = [\"main\", \"awaiting_appt_outcome\", \"branch_a\", \"branch_b\", \"slow_track\"];\nconst WON = [\"done_booked\", \"done_customer\"];\n// `done_unreachable` and `done_send_failed` are the two end states where the system has stopped\n// trying. They are neither ACTIVE nor WON, and they are counted STANDING (from the saved state,\n// which persists) rather than per day: see `unreachable` / `deadLettered` in collect().\n\n/** Kim never reads an enum. An unnamed status is our bug and is reported to us, in `collect()`,\n * as `unlabelledStatuses`; what she gets is a true sentence that does not pretend to know more\n * than we do. [was: `STATUS_LABEL[r.status] || r.status`, which put the raw token on her page.] */\nfunction statusLabel(s: unknown): string {\n const k = String(s ?? \"\");\n return STATUS_LABEL[k] || \"In the system, at a stage this page has not been taught to name yet\";\n}\n\n// The same discipline for journal events. Kept beside STATUS_LABEL rather than inside the\n// renderer so `collect()` can report the gaps to us in the admin JSON.\nconst EVENT_LABEL: Record = {\n sent: \"message sent\", enrolled: \"joined the sequence\", pause_reply: \"paused, they replied\",\n soft_exit_21d: \"finished the 21 days, moved to slow track\", advance_status: \"moved forward\",\n // [was: \"message FAILED\" and \"check FAILED\", in capitals mid-sentence. Same 14 August note from\n // Kim as the headings: capitals are shouting, not emphasis. These two rows are already coloured\n // and already sit under a heading that says something went wrong.]\n send_failed: \"message failed\", skip_step_channel_optout: \"step skipped, opted out of that channel\",\n branch_complete: \"follow-up finished\", pruned: \"archived\", pause_timeout: \"waited too long, needs a person\",\n enroll_refused: \"not enrolled\", sequence_drift: \"copy changed underneath, check\", contact_failed: \"check failed\",\n // v1.7.2, 14 Aug 2026. Everything below was already being written into the journal by the engine\n // and had no name here, so it reached Kim as the raw word. `hard_exit` was the live one: her\n // panel has been printing \"hard_exit\" beside a real person who became a customer. The first two\n // are the new ones from reachability.ts.\n deferred: \"held back this run\",\n dead_letter: \"stopped trying — needs a look\", delivery_failed: \"message did not arrive\",\n delivery_unknown: \"could not tell whether it arrived\",\n optout_write_failed: \"opt-out not written to the CRM, needs a look\",\n hard_exit: \"left the sequence for good\", skip_step: \"step skipped\",\n enrollment_surge_hold: \"enrollment paused, too many at once\",\n};\n/** Same rule as statusLabel: an unnamed event is our bug, reported to us as `unlabelledEvents`. */\nconst eventLabel = (e: unknown) =>\n EVENT_LABEL[String(e ?? \"\")] || \"something this page has not been taught to name yet\";\n\nfunction esc(s: unknown) {\n return String(s ?? \"\").replace(/[&<>\"']/g, (c) =>\n ({ \"&\": \"&\", \"<\": \"<\", \">\": \">\", '\"': \""\", \"'\": \"'\" }[c] as string)\n );\n}\n\nfunction todayInBusinessTz(): string {\n // en-CA gives YYYY-MM-DD, which is what the journal timestamps slice to.\n return new Intl.DateTimeFormat(\"en-CA\", { timeZone: BUSINESS_TZ }).format(new Date());\n}\n\n/** A stamp Kim can hold against her own clock. Every timestamp in the blobs is UTC, and Georgia is\n * four hours behind it in August, so printing one raw put a time on her page that had not happened\n * yet. [was: `String(d.killedAt).slice(0,16).replace(\"T\",\" at \")` — 20:59 UTC rendered as \"20:59\"\n * beside a sentence she read at 4:59 in the afternoon.] */\nfunction inBusinessTz(iso: unknown): string | null {\n const t = Date.parse(String(iso ?? \"\"));\n if (!Number.isFinite(t)) return null;\n try {\n return new Intl.DateTimeFormat(\"en-US\", {\n timeZone: BUSINESS_TZ, month: \"short\", day: \"numeric\", hour: \"numeric\", minute: \"2-digit\",\n }).format(new Date(t));\n } catch { return null; }\n}\n\nasync function collect() {\n const [state, summary, runR, journal, lastError, kill] = await Promise.all([\n get(\"puppy_state\", {}),\n get(\"puppy_summary\", null),\n read(\"puppy_run_state\"),\n get(\"puppy_journal\", []),\n get(\"puppy_last_error\", null),\n get(KILL_BLOB, null),\n ]);\n const run = runR.v;\n const wd = await get(\"wd_public\", null); // v1.5, independent watchdog headline\n\n const rows: any[] = Object.entries(state || {}).map(([id, s]: any) => ({ id, ...(s || {}) }));\n const byStatus: Record = {};\n for (const r of rows) byStatus[r.status || \"unknown\"] = (byStatus[r.status || \"unknown\"] || 0) + 1;\n\n const j: any[] = Array.isArray(journal) ? journal : [];\n const today = todayInBusinessTz();\n const todays = j.filter((r) => String(r.ts || \"\").slice(0, 10) === today);\n\n const sentToday = todays.filter((r) => r.event === \"sent\" && !r.test).length;\n const testSentToday = todays.filter((r) => r.event === \"sent\" && r.test).length;\n // v2 fix (adversarial pass): this matched \"failed\"/\"error\" exactly, but the engine journals\n // \"send_failed\", so the error tile could never leave zero and \"RUNNING, with errors today\" was\n // an unreachable state. A dashboard whose alarm cannot fire is worse than no dashboard, because it\n // is actively reassuring. Match any failure-shaped event instead.\n const failedToday = todays.filter((r) => /fail|error/i.test(String(r.event ?? \"\"))).length;\n\n const active = ACTIVE.reduce((n, k) => n + (byStatus[k] || 0), 0);\n const won = WON.reduce((n, k) => n + (byStatus[k] || 0), 0);\n const paused = byStatus[\"paused_reply\"] || 0;\n // STANDING, from the saved state, not from today's journal rows. `failedToday` below resets at\n // midnight Georgia time, so a contact the engine gave up on last Tuesday is invisible in it by\n // Wednesday morning; these two do not move until somebody fixes the contact's details.\n // (engine/reachability.ts also has a `failureCounts()`, which counts failure EVENTS inside the\n // journal window. Different unit, different question, deliberately not reused here: this is a\n // count of people currently stopped, that is a count of things that happened.)\n const unreachable = byStatus[\"done_unreachable\"] || 0;\n const deadLettered = byStatus[\"done_send_failed\"] || 0;\n // Our bug list, not hers. Any status the engine writes that this file has no plain-English name\n // for shows up here, in the admin JSON, where we will see it.\n const unlabelledStatuses = Object.keys(byStatus).filter((s) => !STATUS_LABEL[s]).sort();\n const unlabelledEvents = [...new Set(j.map((r) => String(r?.event ?? \"\")))].filter((e) => e && !EVENT_LABEL[e]).sort();\n\n // Staleness is the alarm that matters most: a scheduler that stops firing is exactly the silent\n // failure this client cancels contracts over. But an alarm that cries wolf gets ignored, which\n // costs the same thing more slowly.\n // [was: `ageMin > 60`, with the comment \"60 min = four missed 15-minute ticks\". The engine has\n // not run every 15 minutes for a long time; it runs about once an hour. Measured 14 Aug over\n // the 39 most recent gaps in `run.history`: shortest 11 min, longest 64.2, and 36 of the 39\n // sat between 60.0 and 61.0. Four of them ran past 61 minutes, which is where `> 60` starts\n // firing, so this page has been showing Kim a red NOT RUNNING and telling her to call Amir\n // for a minute or two at a time, roughly five minutes across those 39 hours, with the engine\n // working perfectly. The threshold has to be a multiple of the cadence it is watching, not a\n // number left over from an older one: 130 min is two missed hourly checks plus the observed\n // jitter, and still less than a lost morning.]\n const STALE_MIN = 130;\n const lastRunTs = run?.ts || null;\n const ageMin = lastRunTs ? Math.floor((Date.now() - new Date(lastRunTs).getTime()) / 60000) : null;\n const stale = ageMin === null || ageMin > STALE_MIN;\n\n return {\n generatedAt: new Date().toISOString(),\n run: run ?? null,\n contacts: rows.map((r) => ({\n id: r.id,\n status: r.status,\n label: statusLabel(r.status),\n enteredAt: r.enteredAt ?? null,\n lastMainStepSent: r.lastMainStepSent ?? null,\n lastSentAt: r.lastSentAt ?? null,\n })),\n killed: !!kill?.stopped,\n killedAt: kill?.at ?? null,\n testMode: run?.testMode ?? null,\n // Did the run record answer at all? Every sentence on the page that names practice-or-live, the\n // version, or whether the system is running is gated on this, so a failed read renders as a\n // failed read rather than as a confident claim in whichever direction the default happened to\n // point. `testMode` above stays as it is: null there means \"no readable value\", and the page\n // now has the second fact it needs to say WHY.\n runReadOk: runR.ok,\n // MODE IS THREE-VALUED. A page that can only say practice or live has to pick one when it does\n // not know, and picking one is how this project put \"in practice mode ... nobody real is being\n // messaged\" in front of Kim for three days while two real people were being messaged.\n modeKnown: runR.ok && typeof run?.testMode === \"boolean\",\n engineVersion: run?.v ?? null,\n lastRunTs,\n lastRunAgeMin: ageMin,\n stale,\n counts: { total: rows.length, active, won, paused, sentToday, testSentToday, failedToday, unreachable, deadLettered },\n byStatus,\n unlabelledStatuses,\n unlabelledEvents,\n lastError: lastError ?? null,\n // A WIDER WINDOW THAN THE PAGE SHOWS, ON PURPOSE.\n //\n // [was: `j.slice(-40)`, rendered one row per entry. On 14 August 2026 Kim's page said \"The last\n // 40 things it did\" above 39 copies of one sentence: `not enrolled / live booking already\n // exists`, once an hour for two days, because one contact who already has a booking is\n // re-refused on every single run and every refusal is journalled. Everything else the system\n // had ever done had been pushed off the end of her page by one repeating condition. The\n // renderer now folds runs of identical entries into one row with a count, and the window is\n // widened to match: forty ROWS of history rather than forty entries, so a repeat costs one row\n // instead of forty. The engine writing the repeat in the first place is a separate fix.]\n recent: j.slice(-RECENT_RAW).reverse(),\n recentRaw: Math.min(j.length, RECENT_RAW),\n journalTotal: j.length,\n summary: summary ?? null,\n watchdog: wd ?? null,\n };\n}\n\n// ---- rendering ------------------------------------------------------------------------------------\n\nconst RAMP = [\"#86b6ef\", \"#3987e5\", \"#256abf\", \"#184f95\", \"#0f3a6e\"]; // validated ordinal, light+dark\nconst GOOD = \"#0ca30c\", WARN = \"#fab219\", CRIT = \"#d03b3b\";\n\nfunction tile(label: string, value: string | number, note: string, accent?: string) {\n return `
\n
${esc(value)}
\n
${esc(label)}
\n
${esc(note)}
\n
`;\n}\n\nfunction stageBar(byStatus: Record, total: number) {\n const order = [\"main\", \"awaiting_appt_outcome\", \"branch_a\", \"branch_b\", \"slow_track\"];\n const segs = order\n .map((k, i) => ({ k, n: byStatus[k] || 0, c: RAMP[i] }))\n .filter((s) => s.n > 0);\n const sum = segs.reduce((a, s) => a + s.n, 0);\n if (!sum) {\n return `
Nobody is in a sequence right now. That is expected until the first contact is tagged.
`;\n }\n const bar = segs\n .map((s) => ``)\n .join(\"\");\n const legend = segs\n .map((s) => `
${esc(STATUS_LABEL[s.k])}${s.n}
`)\n .join(\"\");\n return `
${bar}
${legend}
\n \n \n ${segs.map((s) => ``).join(\"\")}\n
The same numbers as a table
Stage People
${esc(STATUS_LABEL[s.k])} ${s.n}
Total in a sequence ${sum}
`;\n}\n\n/** EXPORTED so it can be rendered and read in a test. Nothing tested this page's words until\n * 14 Aug 2026: every check on this file was about auth and credentials, and meanwhile the page\n * itself carried four false sentences to a live client for days. val.town runs the default export\n * and ignores named ones, so this costs the deployed val nothing. */\nexport function page(d: any, k: string, opts: { readonly?: boolean } = {}) {\n const c = d.counts;\n // HEADINGS AND LABELS ARE IN SENTENCE CASE. Kim asked for this on 14 August 2026, about this\n // page: the banner shouted RUNNING NORMALLY, every card heading was forced to capitals by one\n // line of stylesheet, and two journal words were spelled FAILED mid-sentence. Capitals are not\n // emphasis to her, they are shouting, and a page that shouts is a page she reads less carefully.\n const health = !d.runReadOk\n // A FAILED READ IS NOT A VERDICT. [was: nothing — this state did not exist, so a blob read that\n // threw fell straight through to `d.stale` (age null counts as stale) and printed \"Not\n // running ... This has never recorded a run. Tell Amir.\" about a system running perfectly.]\n ? { c: WARN, icon: \"⚠\", t: \"Could not check\", m: \"This page could not read the follow-up system's own record just now, so it will not tell you whether it is running. That is one small record failing to load, not a fault in the follow-up itself. Refresh in a minute; if this is still showing in an hour, tell Amir.\" }\n : d.killed\n ? { c: CRIT, icon: \"■\", t: \"Stopped\", m: `You stopped the system${inBusinessTz(d.killedAt) ? \" on \" + esc(inBusinessTz(d.killedAt)) + \" Georgia time\" : \"\"}. Nothing is being sent.` }\n : d.stale\n // [was: \"It should run every 15.\" The line four rows below this one, the one Kim actually sees\n // most days, says it checks about once an hour, and about once an hour is what it does. Two\n // sentences on one page disagreeing about the same clock is how a page stops being believed.\n // Corrected 14 Aug 2026 to match both the other sentence and the measured cadence.]\n ? { c: CRIT, icon: \"⚠\", t: \"Not running\", m: d.lastRunTs ? `The last check was ${d.lastRunAgeMin} minutes ago. It should check about once an hour, so it has now missed at least two. Tell Amir.` : \"This has never recorded a run. Tell Amir.\" }\n : c.failedToday > 0\n ? { c: WARN, icon: \"⚠\", t: \"Running, with problems today\", m: `${c.failedToday === 1 ? \"One message\" : c.failedToday + \" messages\"} failed today. Details are at the bottom of this page.` }\n : { c: GOOD, icon: \"✓\", t: \"Running normally\", m: `Last check: ${d.lastRunAgeMin === 1 ? \"1 minute\" : d.lastRunAgeMin + \" minutes\"} ago. It checks about once an hour around the clock, and messages only ever go out between 9am and 7pm Georgia time.` };\n\n // THREE STATES, NOT TWO. The unknown one used to say \"no run has reported yet\", which is one\n // possible reason out of two and was printed for both: a run record that could not be read looked\n // identical to a system that had never started. It now says which of the two it is, and in\n // neither case does it name a mode it could not read.\n const mode = d.testMode === true\n ? `
Practice mode: the system is doing everything except actually sending to your customers. Practice messages go to a dead-end test contact that cannot receive anything, so if you test it yourself you'll get silence, that's the point of practice mode. Keep handling new calls and messages the way you do today; it takes over only when you say the word and this banner says Live.
`\n : d.testMode === false\n // THE STOP SWITCH OUTRANKS THE MODE. [was: \"Live: real messages are going to real people.\"\n // unconditionally. Press Stop and the banner four inches above turns red and says \"Nothing is\n // being sent\", and this line went on saying real messages are going to real people. Both\n // sentences on one screen, one of them false, and the false one is the reassuring one.]\n ? d.killed\n ? `
Live, but stopped: this system is set up to send real messages to real people, and you have it stopped, so nothing is going out to anybody until you press Start.
`\n : d.stale\n ? `
Live, but not checking in: this system is set up to send real messages to real people, and it has missed its last checks, so nothing is going out while that lasts. The red banner above says the same thing.
`\n : `
Live: real messages are going to real people.
`\n : !d.runReadOk\n ? `
Practice or live: could not check. The system's own record did not answer when this page opened, so this page will not guess which one it is. Refresh in a minute.
`\n : `
Practice or live: not recorded. The system has not written down which one it is set to, so this page will not guess. If the banner above says it has never recorded a run, that is the reason.
`;\n\n // v1.7, Kim's own question (\"how does she know what needs doing today?\") answered on the page\n // itself, permanently. One plain sentence, computed from the same numbers as the tiles.\n //\n // AND IT HAS TO SURVIVE THE LINE PRINTED DIRECTLY UNDER IT. [was: the \"Nothing\" branch ended\n // \"If the banner above is green and Paused says 0, you can close this page.\" — a rule that tells\n // her to close the page while the very next line on it read \"The watchdog flagged 1 thing(s) for\n // Amir to look at.\" Two sentences an inch apart, one saying nothing is outstanding and one\n // naming something outstanding, and the reader is left to work out which to believe. The\n // watchdog's findings are Amir's work, not hers, so the answer is to say that out loud rather\n // than to hide either line.]\n const wdWorst = String(d.watchdog?.worst ?? \"\");\n const today = `
What needs doing today
${\n d.killed\n ? \"The system is stopped. Nothing will happen until someone presses Start below.\"\n : c.failedToday > 0\n ? `Look at the problems listed at the bottom of this page, ${c.failedToday === 1 ? \"one message\" : c.failedToday + \" messages\"} failed today.`\n : c.paused > 0\n ? `${c.paused === 1 ? \"One person\" : c.paused + \" people\"} replied and ${c.paused === 1 ? \"is\" : \"are\"} waiting on a human. Open Conversations and answer ${c.paused === 1 ? \"them\" : \"each one\"}, that is today's work.`\n : !d.runReadOk\n ? \"This page could not read the follow-up system's own record just now, so it cannot tell you whether anything needs doing. Refresh in a minute.\"\n // THE SAME CONTRADICTION AS THE WATCHDOG LINE, ONE CARD HIGHER AND OLDER. The banner directly\n // above this box turns red and says \"Not running ... Tell Amir\" when the system has missed two\n // checks, and this box went on saying \"Nothing. ... you can close this page.\" There was no\n // stale branch here at all, so the one state where she must act was the one state where the\n // page told her she could leave.\n : d.stale\n ? `Tell Amir that the follow-up system ${d.lastRunTs ? \"has stopped checking in\" : \"has never checked in at all\"}. That is the red banner at the top of this page, and it is the one thing on here worth interrupting him for.`\n : wdWorst === \"CRITICAL\"\n ? \"Nothing for you to do yourself. The watchdog has found a problem and has already told Amir; the red line just below says so. If it is still red in an hour, call him.\"\n : wdWorst === \"WARNING\"\n ? \"Nothing for you. The line directly below this box is the watchdog's, and what it has flagged is on Amir's list rather than yours.\"\n // The closing rule names only things that are actually on the page. [was: \"...and Paused\n // says 0, you can close this page.\" — a rule that told her to close a page whose very next\n // line said something had been flagged. It now names the watchdog line as one of the things\n // to look at, and when there is no watchdog line to look at it does not send her to it.]\n : d.watchdog\n ? \"Nothing. If the banner above is green, Paused says 0, and the watchdog line below says nothing is wrong, you can close this page.\"\n : \"Nothing. If the banner above is green and Paused says 0, you can close this page.\"\n }
`;\n\n // Journal rows carry engine-internal names (sent main#3); translate to the words the PDFs use.\n const pretty = (s: string) =>\n s.replace(/\\bmain#(\\d+)/g, \"Touch $1 of the first 21 days\")\n .replace(/\\bslow#(\\d+)/g, \"Slow track message $1\")\n .replace(/\\bbranch_a#(\\d+)/g, \"rebooking note $1\")\n .replace(/\\bbranch_b#(\\d+)/g, \"after-the-call note $1\");\n // FOLD RUNS OF IDENTICAL ENTRIES, AND SAY ON THE PAGE THAT THAT IS WHAT HAPPENED.\n //\n // Only CONSECUTIVE identical entries fold. Two of the same thing with something else in between\n // stay two rows, because the gap between them is part of the story. \"Identical\" means the same\n // event about the same person with the same detail and the same practice flag; the only thing\n // that differs inside a fold is the time, and both ends of that are printed.\n //\n // Folding is not hiding. Every folded entry is counted on the row that replaced it, the count and\n // the two times are shown, and the note under the table states the arithmetic so it adds up.\n const sameAs = (a: any, b: any) =>\n String(a?.event ?? \"\") === String(b?.event ?? \"\") &&\n String(a?.contactId ?? \"\") === String(b?.contactId ?? \"\") &&\n String(a?.detail ?? \"\") === String(b?.detail ?? \"\") &&\n !!a?.test === !!b?.test;\n const groups: { r: any; n: number; oldest: string; newest: string }[] = [];\n for (const r of (d.recent || [])) {\n const g = groups[groups.length - 1];\n // d.recent is newest first, so each further entry in a run is OLDER than the one before it.\n if (g && sameAs(g.r, r)) { g.n++; g.oldest = String(r?.ts ?? \"\"); }\n else groups.push({ r, n: 1, oldest: String(r?.ts ?? \"\"), newest: String(r?.ts ?? \"\") });\n }\n const shown = groups.slice(0, RECENT_ROWS);\n const entriesShown = shown.reduce((a, g) => a + g.n, 0);\n const folded = entriesShown - shown.length;\n // Georgia time, said once in the note under the table rather than on all forty rows. [was: the\n // raw stamp sliced to 16 characters, which is UTC — every time in this table read four hours\n // later than the clock on her wall, so a message sent at 4:59 in the afternoon showed as 20:59.]\n const when = (ts: unknown) => esc(inBusinessTz(ts) ?? \"time not recorded\");\n const rows = shown\n .map((g) => `${when(g.newest)}${esc(eventLabel(g.r.event))}${g.r.test ? ' practice' : \"\"}${esc(pretty(String(g.r.detail || \"\")))}${\n g.n > 1\n ? `
The same thing ${g.n} times over, one after another with nothing in between: ${when(g.oldest)} to ${when(g.newest)}. Shown once here, with the count, so one thing repeating cannot push the rest off this table.
`\n : \"\"\n }`)\n .join(\"\") || `Nothing recorded yet.`;\n // The arithmetic, spelled out, because she checks it.\n const rowsNote = groups.length === 0\n ? \"The system has not written anything down yet.\"\n : `Times are Georgia time, newest first. ${folded === 0\n ? `Nothing repeated back to back, so every entry has its own row: ${shown.length} ${shown.length === 1 ? \"row\" : \"rows\"} for ${entriesShown} ${entriesShown === 1 ? \"entry\" : \"entries\"}.`\n : `Where the same thing happened over and over with nothing in between, it is shown once with a count instead of once per time. So this table is ${shown.length} ${shown.length === 1 ? \"row\" : \"rows\"} plus ${folded} folded into ${folded === 1 ? \"one of them\" : \"them\"}, which is ${shown.length} + ${folded} = ${entriesShown} ${entriesShown === 1 ? \"entry\" : \"entries\"}. Nothing is dropped: every repeat is counted on the row that stands for it.`\n }${d.journalTotal > entriesShown ? ` The system has ${d.journalTotal} written down in total, so there is more history further back than this table reaches.` : \"\"}`;\n\n return `\n\nThe Dogs Spot, Nurture Control Panel\n
\n
The Dogs Spot, Nurture Control Panel
\n
Everything the follow-up system is doing, on one page. The numbers are read fresh every time this page opens, refresh for the latest.
\n\n
\n
${health.icon}
\n
${health.t}
${health.m}
\n
${mode}
\n\n${today}\n\n${d.watchdog ? `
${esc(d.watchdog.headline)} ●
` : \"\"}\n\n
Right now
\n
\n${tile(\"People being followed up\", c.active, d.testMode === true ? \"right now that is the test dummy, not a real customer\" : \"in a sequence right now\")}\n${tile(\"Booked or became a customer\", c.won, \"the whole point of the system\", c.won > 0 ? GOOD : undefined)}\n${tile(\"Paused: someone replied\", c.paused, \"answer them in the Conversations inbox; the system stays out of it\", c.paused > 0 ? WARN : undefined)}\n${tile(\"Messages sent today\", c.sentToday, c.testSentToday ? `plus ${c.testSentToday} practice` : \"to real people\")}\n${tile(\"Problems today\", c.failedToday, c.failedToday ? \"see the bottom of this page\" : \"none\", c.failedToday ? CRIT : GOOD)}\n${(() => {\n // THE TILE THAT DOES NOT RESET AT MIDNIGHT. \"Problems today\" above is a count of things that\n // happened since midnight, so somebody the system gave up on last week shows as zero in it\n // every morning and is never mentioned again. This one counts PEOPLE currently stopped. The two\n // numbers are stated separately as well as added up, because she checks the arithmetic and a\n // bare total hides which of the two problems she actually has.\n //\n // TWO SENTENCES HERE WERE UNTRUE UNTIL 14 AUGUST 2026 AND ARE CORRECTED:\n // 1. [was: \"unlike the tile beside it this one does not reset overnight\". It does reset — not\n // overnight, at 60 days, when pruneState drops a terminal entry whose last check is more\n // than 60 days old. \"Does not reset\" was the shape of the truth with the actual rule filed\n // off. It now says which clock it runs on.]\n // 2. [was: \"They stay on this number until somebody fixes the contact details in your CRM.\"\n // Fixing the details changed nothing: any state entry at all removed the contact from the\n // enrolment filter, so the instruction named an action with no effect. The engine now lets\n // a dead letter back in (reEnrollable, engine/reachability.ts), and the two halves of this\n // tile take DIFFERENT actions, so they are told apart rather than lumped together:\n // - unreachable never got the puppy-path-v1 tag (they never started the path), so adding\n // a phone number or an email address is the whole job;\n // - dead-lettered did get it, and the tag is the first clause of the filter, so it has to\n // come off as well. The CRM task the engine writes says the same thing.]\n const un = c.unreachable || 0, dl = c.deadLettered || 0;\n const stuck = un + dl;\n // ONE INSTRUCTION FOR BOTH HALVES, AND THE ORDER IS THE LOAD-BEARING PART.\n //\n // [An earlier draft of this on 14 Aug 2026 split the instruction by status: \"no way to contact\n // them\" was told to just fix the details, because that group is refused at enrolment and never\n // gets the puppy-path-v1 tag. That is only one of the two roads into that status. The other is\n // rule 1c (reachabilityExit, engine/reachability.ts): somebody who WAS enrolled — so does carry\n // the tag — and later had their number and address taken off the record. For those, \"just fix\n // the details\" is an instruction that does nothing, because the tag keeps them out of the\n // enrolment search whatever else is true. Caught by the engine's author before it shipped. The\n // steps below are true for every person this tile can be counting.]\n //\n // Why the order matters rather than being tidiness: re-admission requires the record to have an\n // address or a number at the moment the system looks. Take the tag off first, with the record\n // still empty, and nothing happens at all — by design, so the contact is not re-refused on every\n // run forever — and it looks exactly like the fix not working.\n const fix = `To put somebody back on the follow-up, do it in this order. First put a phone number or an email address on their record: without one the system will not take them back at all, and every later step will look like it did nothing. Then, if the record still carries the tag \"${esc(TAG_ENROLLED)}\", take that tag off. Then check they still carry \"${esc(TAG_SOURCE_SIGNAL)}\", the tag that starts somebody on the puppy path, and put it back if it has gone. They begin again at the first message on the next check.${\n dl ? ` For anyone whose messages kept failing, a wrong number and a right one look identical to the system, so if the number is still wrong it will send a few and stop again.` : \"\"\n } There is a task waiting in your CRM for each of these people that says the same thing.`;\n // The split is only worth printing when there IS a split. [was: the sum unconditionally, so one\n // person with no phone number read \"1 with no phone number and no email address on the record,\n // plus 0 whose messages kept failing ...: 1 + 0 = 1\" — arithmetic offered as proof, about a\n // number she can see is one.]\n const split = un && dl\n ? `${un} with no phone number and no email address on the record, plus ${dl} whose messages kept failing until the system stopped trying: ${un} + ${dl} = ${stuck}.`\n : un\n ? `${un === 1 ? \"One person has\" : `${un} people have`} no phone number and no email address on the record.`\n : `${dl === 1 ? \"One person's messages\" : `${dl} people's messages`} kept failing until the system stopped trying.`;\n const note = stuck === 0\n ? \"none. Unlike Problems today beside it, this one does not go back to zero at midnight: somebody stays counted here until the system clears their record out, which it does 60 days after it stopped trying.\"\n : `${split} ${fix} Left alone they stay on this number until the system clears their record out, 60 days after it stopped trying.`;\n return tile(\"People it could not reach\", stuck, note, stuck ? WARN : GOOD);\n})()}\n
\n\n
Where those people are
${stageBar(d.byStatus || {}, c.total)}${!(d.byStatus || {})[\"slow_track\"] ? `
The slow track (the occasional messages that follow the first 21 days) will appear here once the first person finishes their three weeks. Their first slow-track message goes out a week after that, on day 28.
` : \"\"}
\n\n${opts.readonly ? `
This page is view-only. The stop switch is on the owner's link.
` : `
Stop everything
\n
This halts the follow-up system before it looks at a single person. It takes effect on the next check, which is about an hour away at most, and needs no one's help. Nothing is deleted, everyone keeps their place and picks up where they left off when you start it again. (When it is stopped, a green Start button appears right here.)
\n\n
To take one single person off every track instead: open their contact in GoHighLevel and switch on the main Do Not Disturb for the whole contact. The system reads that the next time it looks at that person, which is whenever their next message falls due, or within a day at the latest. You are not waiting unprotected in between: the only moment it would message them is the same moment it reads the switch. Once it reads it, they are off every track for good. One thing to watch, because it is easy to hit by accident: GoHighLevel also has separate Do Not Disturb switches for texts on their own and for emails on their own, lower down the same screen. Those stop the one they name and nothing else, so turning off texts leaves the emails running. The main one at the top is the only one that stops everything.
\n${d.killed\n ? ``\n : ``}\n
`}\n\n
${d.journalTotal <= entriesShown && groups.length <= RECENT_ROWS ? \"Everything it has done so far\" : \"What it has been doing\"}
\n${rows}
When What Detail
\n
${rowsNote}
\n\n${d.lastError && d.lastError.at && Date.now() - new Date(d.lastError.at).getTime() < 24 * 3600 * 1000 ? `
Something went wrong in the last 24 hours
Technical details for whoever fixes it, if this box is showing, tell Amir and include what is below.
${esc(JSON.stringify(d.lastError).slice(0, 1200))}
` : \"\"}\n\n\n
${d.engineVersion\n ? `The follow-up system reported itself as version ${esc(d.engineVersion)} on its last check${d.lastRunAgeMin == null ? \"\" : d.lastRunAgeMin === 1 ? \", 1 minute ago\" : `, ${d.lastRunAgeMin} minutes ago`}. That is read from its own record, not typed on this page, so it is the version that actually ran.`\n : d.runReadOk\n ? \"The follow-up system has not recorded a version yet, so this page cannot tell you which one is running.\"\n : \"This page could not read the follow-up system's record just now, so it cannot tell you which version is running.\"} The numbers above were read fresh when this page opened.
\n
`;\n}\n\n// ---- live self-test ------------------------------------------------------------------------------\n// Resolves the CRM credential exactly the way the engine does (env var first, then the puppy_config\n// blob) and pings the four endpoints the engine depends on. Reports status codes only, the token is\n// never returned, logged, or echoed. This exists because a stale credential is the failure mode that\n// looks identical to \"quiet\": the scheduler keeps ticking, every read fails, and nothing tells anyone.\nconst GHL = \"https://services.leadconnectorhq.com\";\nconst LOC = \"BQHJ19uohldYe3eqA0bl\";\n\nasync function resolveEngineToken(): Promise<{ token?: string; from: string }> {\n const env = Deno.env.get(\"GHL_TOKEN\");\n if (env) return { token: env, from: \"env GHL_TOKEN\" };\n const cfg = await get(\"puppy_config\", null);\n if (cfg?.ghlToken) return { token: cfg.ghlToken, from: \"puppy_config blob\" };\n return { from: \"NOT FOUND\" };\n}\n\nasync function selfTest() {\n const { token, from } = await resolveEngineToken();\n const checks: any[] = [];\n const probe = async (name: string, url: string, ver: string, why: string) => {\n if (!token) return checks.push({ name, status: null, ok: false, why, note: \"no credential resolved\" });\n try {\n const r = await fetch(url, { headers: { Authorization: `Bearer ${token}`, Version: ver, Accept: \"application/json\" } });\n checks.push({ name, status: r.status, ok: r.status === 200, why });\n } catch (e) {\n checks.push({ name, status: null, ok: false, why, note: String(e).slice(0, 120) });\n }\n };\n await probe(\"read calendar bookings\", `${GHL}/calendars/events?locationId=${LOC}&calendarId=qHuYJ0NEqzibnoqf5Cw3&startTime=${Date.now() - 864e5}&endTime=${Date.now()}`, \"2021-04-15\", \"how it notices someone booked a Pup Talk\");\n await probe(\"read replies\", `${GHL}/conversations/search?locationId=${LOC}&limit=1`, \"2021-04-15\", \"how it pauses when someone writes back\");\n await probe(\"read contacts\", `${GHL}/contacts/?locationId=${LOC}&limit=1`, \"2021-07-28\", \"how it reads names and dog names\");\n await probe(\"read deals\", `${GHL}/opportunities/pipelines?locationId=${LOC}`, \"2021-07-28\", \"how it notices someone became a customer\");\n return { credentialFrom: from, allOk: checks.every((c) => c.ok), checks };\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n const k = url.searchParams.get(\"k\") || \"\";\n const isAdmin = await authorised(k);\n const isViewer = !isAdmin && (await viewAuthorised(k));\n if (!isAdmin && !isViewer) {\n return new Response(\"Not found\", { status: 401, headers: { \"content-type\": \"text/plain\" } });\n }\n if (isViewer) {\n // view key renders the dashboard only, no stop/go, no JSON, no selftest.\n const d = await collect();\n return new Response(page(d, k, { readonly: true }), {\n headers: { \"content-type\": \"text/html; charset=utf-8\", \"cache-control\": \"no-store\" },\n });\n }\n\n if (url.searchParams.get(\"selftest\") === \"1\") {\n return new Response(JSON.stringify(await selfTest(), null, 2), {\n headers: { \"content-type\": \"application/json\", \"cache-control\": \"no-store\" },\n });\n }\n\n // R37 (11 Aug 2026, go-live prep): remove one contact from engine state. Exists for exactly one\n // job: taking the ZZTEST dummy out before TEST_MODE flips, so live mode never sends its queued\n // steps (an unprefixed email to Amir, then an SMS to +10000000000 that fails on Kim's dashboard).\n // Admin-gated like stop/go. Returns counts so the caller has a receipt, not a hope.\n if (url.searchParams.get(\"prune\")) {\n const id = String(url.searchParams.get(\"prune\"));\n const blob = await blobMod();\n const st = ((await blob.getJSON(\"puppy_state\").catch(() => null)) ?? {}) as Record;\n const existed = Object.prototype.hasOwnProperty.call(st, id);\n delete st[id];\n await blob.setJSON(\"puppy_state\", st);\n return new Response(JSON.stringify({ pruned: id, existed, remaining: Object.keys(st).length }), {\n headers: { \"content-type\": \"application/json\", \"cache-control\": \"no-store\" },\n });\n }\n\n // R38: arm live / arm practice. Writes blob puppy_mode, which cron() reads at the top of every\n // pass. Exists because env vars are settable only in val.town's UI and that session is not always\n // available. Admin-gated. Practice is the fail-safe: only {live:true} arms.\n if (url.searchParams.get(\"arm\")) {\n const want = String(url.searchParams.get(\"arm\"));\n if (want !== \"live\" && want !== \"practice\") {\n return new Response(JSON.stringify({ error: \"arm must be live or practice\" }), { status: 400 });\n }\n const blob = await blobMod();\n await blob.setJSON(\"puppy_mode\", { live: want === \"live\", at: new Date().toISOString(), by: \"api-arm\" });\n const back = await blob.getJSON(\"puppy_mode\").catch(() => null);\n return new Response(JSON.stringify({ armed: want, blob: back }), {\n headers: { \"content-type\": \"application/json\", \"cache-control\": \"no-store\" },\n });\n }\n\n if (url.searchParams.get(\"stop\") === \"1\") {\n const blob = await blobMod();\n await blob.setJSON(KILL_BLOB, { stopped: true, at: new Date().toISOString(), by: \"control-panel\" });\n return Response.redirect(`${url.origin}${url.pathname}?k=${encodeURIComponent(k)}`, 303);\n }\n if (url.searchParams.get(\"go\") === \"1\") {\n const blob = await blobMod();\n await blob.setJSON(KILL_BLOB, { stopped: false, at: new Date().toISOString(), by: \"control-panel\" });\n return Response.redirect(`${url.origin}${url.pathname}?k=${encodeURIComponent(k)}`, 303);\n }\n\n const d = await collect();\n if (url.searchParams.get(\"f\") === \"json\") {\n return new Response(JSON.stringify(d, null, 2), {\n headers: { \"content-type\": \"application/json\", \"cache-control\": \"no-store\" },\n });\n }\n return new Response(page(d, k), {\n headers: { \"content-type\": \"text/html; charset=utf-8\", \"cache-control\": \"no-store\" },\n });\n}\n",[496],"c8e60570-62ed-4ca5-a907-54f2af5800f5","aged.ts","58225aaa-8e77-11f1-90c9-1607ee4eb77e",1149,["D",1786979114237],"// AGED-LIST SEGMENTER AND RELEASE PLANNER — built 2 Aug 2026.\n//\n// WHY THIS EXISTS\n// The plan of record was \"release the 3,206 dormant New Lead contacts by email, a few hundred a\n// week.\" Before building the machine, the audience was measured. It does not exist in the shape the\n// plan assumed:\n//\n// 3,426 opportunities sit in New Lead (not 3,206 — it grows ~12/day)\n// 177 (5.2%) have an email address\n// 766 (22.4%) have a phone number\n// 2,655 (77.5%) have NEITHER — they are Messenger-only contacts and cannot be emailed or texted\n//\n// Verified twice: once from the opportunity payload's embedded contact, then again by re-fetching\n// 25 of the \"no email\" contacts individually with GET /contacts/{id} — 0 of 25 had a hidden email.\n// So the email-only launch reaches 177 people, not three thousand.\n//\n// Age was also assumed wrong. Nothing in the backlog is older than 292 days; the oldest month is\n// October 2025 and only 328 rows are from 2025 at all. Median age is 109 days.\n//\n// This endpoint keeps that truth live rather than frozen in a document: it re-measures on demand,\n// segments the backlog by what can actually be done with each person, and produces the batch plan.\n//\n// WHAT IT WILL NOT DO\n// It never sends. It plans. Releasing anyone is a separate, deliberate act by a human, and the\n// copy for this path has not been approved by the client. `?k=…&plan=1` returns the batch list;\n// there is no endpoint here that hands that list to a sender.\n//\n// QUOTA (this is the R19 fix in miniature)\n// A full walk is 35 paginated calls. That is far too much to do on every 15-minute engine tick, so\n// the result is cached in the `aged_segments` blob with a timestamp and only recomputed when asked\n// or when older than CACHE_TTL. The engine never calls this; it is an operator tool.\n//\n// ?k= segment summary (cached)\n// ?k=&fresh=1 force a re-measure from the live CRM\n// ?k=&plan=1 the batch release plan\n// ?k=&f=json raw JSON of whichever of the above applies\n\nimport { hasConsentSnapshot, readChannelConsent } from \"./consent.ts\";\n\n// ---- auth ------------------------------------------------------------------------------------\n// val.town vals are public, so the admin digest must come from the environment. There is no source\n// fallback: absent or malformed configuration denies every key.\n\nasync function sha256Hex(s: string): Promise {\n const b = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(s));\n return [...new Uint8Array(b)].map((x) => x.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nasync function authorised(k: string): Promise {\n const configured = Deno.env.get(\"NURTURE_ADMIN_KEY_SHA256\");\n if (!k || !configured || !/^[0-9a-f]{64}$/i.test(configured)) return false;\n const expected = configured.toLowerCase();\n const got = await sha256Hex(k);\n // Constant-time over equal-length hex digests.\n if (got.length !== expected.length) return false;\n let d = 0;\n for (let i = 0; i < got.length; i++) d |= got.charCodeAt(i) ^ expected.charCodeAt(i);\n return d === 0;\n}\nconst GHL = \"https://services.leadconnectorhq.com\";\nconst LOC = \"BQHJ19uohldYe3eqA0bl\";\nconst PIPE = \"FXt1UpCVBufbF0v3pfyf\";\nconst NEW_LEAD = \"ccb18375-9aa1-40aa-a071-1581ca739533\";\nconst CACHE_KEY = \"aged_segments\";\nconst CACHE_TTL_MS = 12 * 3600 * 1000;\n\n// Batch policy. Email first, small, watching between batches — a burst to a stale list is how a\n// sending reputation dies, and this list is stale by construction.\nconst BATCH_SIZE = 60;\nconst BATCHES_PER_WEEK = 1;\n\nasync function blobMod() { return (await import(\"https://esm.town/v/std/blob\")).blob; }\n\n\nasync function token(): Promise {\n const env = Deno.env.get(\"GHL_TOKEN\");\n if (env) return env;\n const blob = await blobMod();\n const cfg = await blob.getJSON(\"puppy_config\").catch(() => null);\n return cfg?.ghlToken;\n}\n\nasync function walkNewLead() {\n const t = await token();\n if (!t) throw new Error(\"no CRM credential resolved\");\n const rows: any[] = [];\n let after: any = null, afterId: any = null, pages = 0;\n while (pages < 45) {\n let u = `${GHL}/opportunities/search?location_id=${LOC}&pipeline_id=${PIPE}&pipeline_stage_id=${NEW_LEAD}&limit=100`;\n if (after != null) u += `&startAfter=${after}&startAfterId=${afterId}`;\n const r = await fetch(u, { headers: { Authorization: `Bearer ${t}`, Version: \"2021-07-28\", Accept: \"application/json\" } });\n if (!r.ok) throw new Error(`opportunities/search ${r.status}`);\n const d = await r.json();\n const ops = d.opportunities ?? [];\n if (!ops.length) break;\n rows.push(...ops);\n pages++;\n after = d.meta?.startAfter; afterId = d.meta?.startAfterId;\n if (!after) break;\n }\n return { rows, pages };\n}\n\n// A lead nobody can reach is not a lead. A lead who only ever spoke on Messenger cannot be emailed or\n// texted at all — Meta's 24-hour messaging window closes that door, and pretending otherwise is how a\n// nurture plan produces a number that never arrives.\nexport function segmentAgedRows(rows: any[], now = Date.now()) {\n const seg: Record = {\n emailable: [], releaseReady: [], consentUnknown: [], emailBlocked: [],\n phoneOnly: [], unreachable: [], excluded: [],\n };\n const ageBuckets: Record = { \"0-30d\": 0, \"31-90d\": 0, \"91-180d\": 0, \"181-365d\": 0, \"365d+\": 0 };\n const years: Record = {};\n let dupes = 0;\n\n // Opportunity pagination can repeat a contact, and one copy can be a partial projection while\n // another carries DND. Hold every row whose contact id, email or phone occurs more than once;\n // choosing a \"first\" row would make consent depend on page order. The planner is deliberately\n // conservative here because this is release eligibility, not a marketing audience estimate.\n const identityCounts = new Map();\n const identityKeys = (o: any): string[] => {\n const c = o?.contact ?? {};\n const contactId = String(o?.contactId ?? c.id ?? \"\").trim();\n const email = String(c.email ?? \"\").trim().toLowerCase();\n const phone = String(c.phone ?? \"\").replace(/\\D/g, \"\");\n return [contactId && `id:${contactId}`, email && `email:${email}`, phone && `phone:${phone}`].filter(Boolean) as string[];\n };\n for (const o of rows) {\n for (const key of new Set(identityKeys(o))) identityCounts.set(key, (identityCounts.get(key) ?? 0) + 1);\n }\n\n for (const o of rows) {\n const c = o.contact ?? {};\n const email = String(c.email ?? \"\").trim().toLowerCase();\n const phone = String(c.phone ?? \"\").trim();\n const tags: string[] = (c.tags ?? []).map((x: string) => String(x).toLowerCase());\n const created = o.createdAt ? new Date(o.createdAt).getTime() : null;\n const ageDays = created ? Math.floor((now - created) / 86400000) : null;\n\n if (created) {\n const y = new Date(created).getUTCFullYear();\n years[y] = (years[y] ?? 0) + 1;\n const a = ageDays!;\n ageBuckets[a <= 30 ? \"0-30d\" : a <= 90 ? \"31-90d\" : a <= 180 ? \"91-180d\" : a <= 365 ? \"181-365d\" : \"365d+\"]++;\n }\n\n const contactId = String(o.contactId ?? c.id ?? \"\").trim();\n const rec = { contactId: contactId || null, name: c.name ?? null, email: email || null, phone: phone || null, ageDays, tags };\n\n // Exclusions come first and are absolute.\n const isSpam = tags.some((t) => t.includes(\"spam\"));\n const isCustomer = tags.includes(\"customer\") || tags.includes(\"subscription_active\");\n const alreadyOnAPath = tags.some((t) => t.startsWith(\"puppy-path\") || t.startsWith(\"path-\") || t.includes(\"nurture\"));\n if (isSpam || isCustomer || alreadyOnAPath) { seg.excluded.push({ ...rec, why: isSpam ? \"flagged spam\" : isCustomer ? \"already a customer\" : \"already on a nurture path\" }); continue; }\n\n const repeated = identityKeys(o).filter((key) => (identityCounts.get(key) ?? 0) > 1);\n if (repeated.length) {\n dupes++;\n seg.excluded.push({ ...rec, why: \"duplicate identity held; consent cannot depend on which API row arrived first\" });\n continue;\n }\n\n if (email) {\n // The opportunity projection can contain an email while omitting per-channel DND entirely.\n // Inventory may count that address; a release plan may not treat missing consent evidence as\n // permission. Only a hydrated snapshot that is clear on both surfaces reaches releaseReady.\n if (c.dnd === true || readChannelConsent(c).email) {\n const held = { ...rec, consentStatus: \"blocked\", why: c.dnd === true ? \"blanket Do Not Disturb is on\" : \"opted out of email\" };\n seg.emailable.push(held);\n seg.emailBlocked.push(held);\n } else if (!hasConsentSnapshot(c)) {\n const held = { ...rec, consentStatus: \"unknown\", why: \"per-channel consent was not present in this data projection\" };\n seg.emailable.push(held);\n seg.consentUnknown.push(held);\n } else {\n const clear = { ...rec, consentStatus: \"clear\" };\n seg.emailable.push(clear);\n seg.releaseReady.push(clear);\n }\n }\n else if (phone) seg.phoneOnly.push(rec);\n else seg.unreachable.push(rec);\n }\n\n // Oldest first: they have waited longest and are the least likely to remember enquiring, so they\n // are also the batch most worth watching the opt-out rate on.\n const oldestThenId = (a: any, b: any) =>\n (b.ageDays ?? 0) - (a.ageDays ?? 0) ||\n String(a.contactId ?? \"\").localeCompare(String(b.contactId ?? \"\")) ||\n String(a.email ?? \"\").localeCompare(String(b.email ?? \"\")) ||\n String(a.phone ?? \"\").localeCompare(String(b.phone ?? \"\")) ||\n String(a.why ?? \"\").localeCompare(String(b.why ?? \"\"));\n seg.emailable.sort(oldestThenId);\n seg.releaseReady.sort(oldestThenId);\n seg.consentUnknown.sort(oldestThenId);\n seg.emailBlocked.sort(oldestThenId);\n seg.phoneOnly.sort(oldestThenId);\n seg.unreachable.sort(oldestThenId);\n seg.excluded.sort(oldestThenId);\n\n return { seg, ageBuckets, years, dupes };\n}\n\nexport function planAgedBatches(emailable: any[]) {\n // Defence in depth: even a caller that hands this function the broad address inventory cannot\n // obtain a batch for an unknown/blocked row. Old cached records lack this marker and therefore hold.\n const candidates = (emailable ?? []).filter((r) => r?.consentStatus === \"clear\" && String(r?.contactId ?? \"\").trim());\n const counts = new Map();\n for (const r of candidates) {\n const id = String(r.contactId).trim();\n counts.set(id, (counts.get(id) ?? 0) + 1);\n }\n const eligible = candidates\n .filter((r) => counts.get(String(r.contactId).trim()) === 1)\n .sort((a, b) => (b.ageDays ?? 0) - (a.ageDays ?? 0) || String(a.contactId).localeCompare(String(b.contactId)));\n const batches: any[] = [];\n for (let i = 0; i < eligible.length; i += BATCH_SIZE) {\n batches.push({\n batch: batches.length + 1,\n weekOffset: batches.length * (1 / BATCHES_PER_WEEK),\n size: eligible.slice(i, i + BATCH_SIZE).length,\n oldestAgeDays: eligible[i]?.ageDays ?? null,\n contactIds: eligible.slice(i, i + BATCH_SIZE).map((r) => r.contactId),\n idempotencyKeys: eligible.slice(i, i + BATCH_SIZE).map((r) => `aged-plan:v1:${r.contactId}`),\n dryRun: true,\n sendAllowed: false,\n });\n }\n return batches;\n}\n\nasync function measure(fresh: boolean) {\n const blob = await blobMod();\n if (!fresh) {\n const cached = await blob.getJSON(CACHE_KEY).catch(() => null);\n if (cached?.at && Date.now() - new Date(cached.at).getTime() < CACHE_TTL_MS) return { ...cached, fromCache: true };\n }\n const { rows, pages } = await walkNewLead();\n const { seg, ageBuckets, years, dupes } = segmentAgedRows(rows);\n const out = {\n at: new Date().toISOString(),\n fromCache: false,\n apiCallsUsed: pages,\n total: rows.length,\n counts: {\n emailable: seg.emailable.length,\n releaseReady: seg.releaseReady.length,\n consentUnknown: seg.consentUnknown.length,\n emailBlocked: seg.emailBlocked.length,\n phoneOnly: seg.phoneOnly.length,\n unreachable: seg.unreachable.length,\n excluded: seg.excluded.length,\n duplicatesRemoved: dupes,\n },\n ageBuckets, years,\n batchPolicy: { size: BATCH_SIZE, perWeek: BATCHES_PER_WEEK, channel: \"email only\" },\n weeksToClear: Math.ceil(seg.releaseReady.length / (BATCH_SIZE * BATCHES_PER_WEEK)),\n emailable: seg.emailable,\n releaseReady: seg.releaseReady,\n consentUnknown: seg.consentUnknown.slice(0, 200),\n emailBlocked: seg.emailBlocked.slice(0, 200),\n phoneOnly: seg.phoneOnly.slice(0, 200),\n excludedSample: seg.excluded.slice(0, 50),\n };\n await blob.setJSON(CACHE_KEY, out).catch(() => {});\n return out;\n}\n\nfunction pct(n: number, d: number) { return d ? `${((n / d) * 100).toFixed(1)}%` : \"0%\"; }\n\nfunction html(d: any) {\n const c = d.counts;\n const rows = (d.batches ?? []).slice(0, 12).map((b: any) =>\n `${b.batch}week +${b.weekOffset}${b.size}${b.oldestAgeDays ?? \"—\"} days`).join(\"\");\n return `Aged list — what is actually there\n\n
The dormant list — what is actually in it
\n
Measured from the live CRM ${d.fromCache ? \"(cached \" + String(d.at).slice(0, 16).replace(\"T\", \" \") + \" UTC)\" : \"just now\"} · ${d.apiCallsUsed ?? \"—\"} API calls
\n
The plan assumed roughly 3,200 people who could be emailed. They cannot.\nOf ${d.total} contacts sitting in New Lead, ${c.emailable} have an email address —\n${pct(c.emailable, d.total)}. ${c.unreachable} (${pct(c.unreachable, d.total)}) have neither an email\nnor a phone number: they only ever spoke through Messenger, and Meta's 24-hour rule closes that door.
\n
Who can actually be contacted
\n\n\n\n\n\n\n\n
Segment Count Share What can be done
Has an email ${c.emailable} ${pct(c.emailable, d.total)} Address inventory only; not permission to release.
Email + consent snapshot clear ${c.releaseReady ?? 0} ${pct(c.releaseReady ?? 0, d.total)} The only rows allowed into the dry-run batch plan.
Email, consent unknown ${c.consentUnknown ?? c.emailable} ${pct(c.consentUnknown ?? c.emailable, d.total)} Held until each full contact DND snapshot is read.
Email blocked / DND ${c.emailBlocked ?? 0} ${pct(c.emailBlocked ?? 0, d.total)} Excluded from the release.
Phone only ${c.phoneOnly} ${pct(c.phoneOnly, d.total)} SMS — held until numbers are validated. Stale numbers get a business flagged by carriers.
Neither ${c.unreachable} ${pct(c.unreachable, d.total)} Nothing by email or text. Reachable only inside Messenger, within Meta's window.
Excluded ${c.excluded} ${pct(c.excluded, d.total)} Already customers, already on a path, flagged spam, or duplicates.
\n
How old it really is
\n${Object.entries(d.ageBuckets || {}).map(([k, v]) => ``).join(\"\")}
Age Count
${k} ${v}
\n
By year created: ${Object.entries(d.years || {}).map(([k, v]) => `${k} ${v}`).join(\" · \")}. Nothing in this list is more than a year old.
\n${rows ? `
The release plan
${rows}
Batch When People Oldest in batch
\n
${d.batchPolicy.size} per batch, ${d.batchPolicy.perWeek} batch per week, email only, oldest first — ${d.weeksToClear} week(s) across consent-cleared rows. Every row is dry-run only and carries sendAllowed:false.
` : \"\"}\n
Nothing here sends anything. This page measures and plans. Releasing a batch is a separate deliberate action, and the copy for this path has not been approved yet.
`;\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n if (!(await authorised(url.searchParams.get(\"k\") || \"\"))) {\n return new Response(\"Not found\", { status: 401, headers: { \"content-type\": \"text/plain\" } });\n }\n try {\n const d: any = await measure(url.searchParams.get(\"fresh\") === \"1\");\n if (url.searchParams.get(\"plan\") === \"1\") d.batches = planAgedBatches(d.releaseReady ?? []);\n if (url.searchParams.get(\"f\") === \"json\") {\n return new Response(JSON.stringify(d, null, 2), { headers: { \"content-type\": \"application/json\", \"cache-control\": \"no-store\" } });\n }\n if (!d.batches) d.batches = planAgedBatches(d.releaseReady ?? []);\n return new Response(html(d), { headers: { \"content-type\": \"text/html; charset=utf-8\", \"cache-control\": \"no-store\" } });\n } catch (e) {\n return new Response(JSON.stringify({ error: String(e).slice(0, 500) }, null, 2), { status: 500, headers: { \"content-type\": \"application/json\" } });\n }\n}\n",[503],"4efd351c-3c9f-4573-a836-b17d633dbf63","_deno-shim.d.ts","d1481a50-95ca-11f1-b3cf-1607ee4eb77e",772,["D",1786483375216],"declare const Deno: { env: { get(k: string): string | undefined } };\nexport {};\n",[510],"59b7d2e2-8cbc-4ac6-83e6-09e5fc5294d5","SOURCE-BUNDLE.part9.txt","5cc7c38a-91cc-11f1-86f1-1607ee4eb77e",1095,["D",1786801898418],"THE DOGS SPOT — SOURCE BUNDLE (part 9 of 40)\n\nEVERY source file in this project, engine/ included. Restoring these parts and nothing else gives\nyou a tree that builds, typechecks and runs its own test suite with no network and no val.\n\nengine/ is here as of 14 Aug 2026. It used to be left out because val 1bfa6e81-74e1-4c6c-ab32-118304a4ffff\nholds it, which was true of every engine file except engine/watch.ts: a module the val does not run,\nso it was never deployed, so it lived in one container and nothing else. A reclaim destroyed it.\nscripts/deploy.mjs --check still compares engine/ against the val file by file; that is a second\ncheck on the same files now, not the only copy of them.\n\nRESTORE (needs only node, from an empty folder). Save each part, then run this ON EACH ONE:\n\n node -e 'const fs=require(\"fs\"),p=require(\"path\");const b=fs.readFileSync(process.argv[1],\"utf8\");\n for(const s of b.split(\"\\n=====FILE \").slice(1)){const i=s.indexOf(\" =====\\n\");\n const f=s.slice(0,i),c=s.slice(i+7);fs.mkdirSync(p.dirname(f),{recursive:true});\n fs.writeFileSync(f,c.replace(/\\n$/,\"\"))}' PART.txt\n\nA record named #1, #2, ... is one FILE cut into pieces: concatenate them in order, then\nstrip one trailing newline from the last. scripts/restore.mjs does this for you.\n\nEach part is complete in itself: whole files only, no reassembly, any order.\n\nThen: node scripts/build.mjs (engine/ came out of these parts; nothing to fetch first)\n node scripts/typecheck.mjs\n node tests/run-all.mjs\n node scripts/deploy.mjs --check (pulls nothing, proves the val matches what you restored)\n node tests/negative-controls.mjs (proves the suite above can actually fail)\n\nIN THIS PART (5 of 116 files)\n\n engine/reachability.ts 35089 bytes 62236c301631\n engine/registry-diff.ts 3125 bytes ad145165cddc\n engine/render.ts 2810 bytes f3a95d4ce610\n engine/report-logic.ts 10987 bytes 57376bd947f3\n\n================================================================================================\n=====FILE engine/puppy_path_v1.1.ts#2 =====\ntion was fetched on this path; rule 5 blocks sends anyway\n };\n const d = decideAction(facts, s);\n const nowIso = new Date().toISOString();\n if (d.kind === \"hard_exit\") {\n const v = pickPrimaryOpportunity(opportunities)?.monetaryValue ?? 0;\n state[contactId] = { ...applyDecision(d, s, nowIso), exitValue: v, exitStepsSent: s.lastMainStepSent + s.lastBranchStepSent + (s.lastSlowStepSent ?? 0) };\n out.log.push(`${contactId}: paused contact hard-exited -> ${d.status} (${d.reason})`);\n jrow(contactId, \"hard_exit\", `${d.reason}${v ? ` | value ${v}` : \"\"}`);\n await honourOptOut(contactId, facts, TEST_MODE, j, GHL, fctx);\n } else {\n state[contactId] = { ...s, lastCheckedAt: nowIso };\n }\n } catch (err) {\n out.log.push(`${contactId}: paused-pass FAILED: ${String(err).slice(0, 120)}`);\n }\n continue;\n }\n\n // v1.4 R19b DUE-FIRST FILTERING: nothing due = ask the CRM nothing. Two valves stop cheap\n // becoming blind: SAFETY_SWEEP_HOURS, and any unmodelled status. Full note: NOTES-v1.4.md.\n\n const dueCheck = (() => {\n try {\n if (s.status === \"main\") {\n if (s.lastMainStepSent >= MAIN_SEQUENCE.length) return { due: true, why: \"sequence complete, needs exit evaluation\" };\n const next = MAIN_SEQUENCE[s.lastMainStepSent];\n if (isDue(next.offsetHours, s.enteredAt, Date.now())) return { due: true, why: `main step ${s.lastMainStepSent + 1} due` };\n return { due: false, why: `main step ${s.lastMainStepSent + 1} not due yet` };\n }\n if ((s.status === \"branch_a\" || s.status === \"branch_b\") && s.branchAnchorAt) {\n const seq = s.status === \"branch_a\" ? BRANCH_A : BRANCH_B;\n if (s.lastBranchStepSent >= seq.length) return { due: true, why: \"branch complete, needs exit evaluation\" };\n const next = seq[s.lastBranchStepSent];\n if (isDue(next.offsetHours, s.branchAnchorAt, Date.now())) return { due: true, why: \"branch step due\" };\n return { due: false, why: \"branch step not due yet\" };\n }\n // v1.7.1 — slow_track modelled too: the taper population only grows (non-terminal by\n // design), and without this every taper contact cost a full 3-call CRM check every 15\n // minutes for months of \"not due yet\". The daily safety sweep still catches exits.\n if (s.status === \"slow_track\") {\n const c = Math.max(0, Math.floor(Number(s.lastSlowStepSent)) || 0);\n if (isDue(nextSlowTouch(c).offsetHours, s.slowAnchorAt ?? s.enteredAt, Date.now())) return { due: true, why: `slow touch ${c + 1} due` };\n return { due: false, why: `slow touch ${c + 1} not due yet` };\n }\n return { due: true, why: \"status not modelled by the shortcut — full check\" };\n } catch {\n return { due: true, why: \"due-check threw — full check\" };\n }\n })();\n\n const lastChecked = s.lastCheckedAt ? new Date(s.lastCheckedAt).getTime() : 0;\n const sweepOverdue = Date.now() - lastChecked > safetySweepHours() * HOUR_MS;\n\n if (!dueCheck.due && !sweepOverdue) {\n state[contactId] = { ...s, lastCheckedAt: s.lastCheckedAt };\n out.skipped++;\n skippedNotDue++;\n continue; // zero API calls for this contact this run\n }\n\n try {\n await sleep(120); // v1.2 — pacing between contacts (GHL: 100 req/10s, breach = 401/403 not 429)\n const contact = await getContact(contactId);\n if (!contact) {\n out.log.push(`${contactId}: contact not found, skipping`);\n continue;\n }\n const opportunities = oppsCache.get(contactId) ?? (await getOpenOpportunities(contactId));\n const pupTalkAppt = apptIndex.get(contactId) ?? null;\n const declinedSignal = (contact.tags ?? []).includes(PUP_TALK_DECLINED_TAG);\n const reply = await getReplyStatus(contactId, s.enteredAt, s);\n // v1.9 — settle the PREVIOUS send first: a 2xx from GHL meant \"queued\", never \"delivered\".\n { const dl = await onDeliveryStatus(contactId, s, reply.deliveryStatus, fctx);\n if (dl) { s = dl.s; if (dl.stop) { out.failed++; continue; } } }\n\n const facts: Facts = {\n now: Date.now(),\n contact: {\n id: contactId,\n firstName: contact.firstName ?? \"\",\n companyName: contact.companyName ?? null,\n dnd: !!contact.dnd,\n noEmail: !contact.email,\n noPhone: !contact.phone, // R39 — getContact already fetched it and threw it away\n },\n opportunities,\n pupTalkAppt,\n declinedSignal,\n hasUnansweredInboundReply: reply.hasUnansweredInboundReply,\n conversationCheckFailed: reply.conversationCheckFailed,\n // v1.5 R27 — was that last outbound ours or somebody else's? Ours iff it lands within\n // OURS_TOLERANCE_MS of our own recorded send. No lastSentAt yet (nothing sent to this\n // contact) means any outbound on the thread is definitionally foreign.\n channelBlocked: readChannelConsent(contact),\n optOutRequested: reply.optOutRequested,\n foreignOutboundAt: (() => {\n const lo = reply.lastOutboundAt;\n if (lo == null) return null;\n if (!s.lastSentAt) return lo;\n const ours = new Date(s.lastSentAt).getTime();\n if (Number.isNaN(ours)) return lo;\n return Math.abs(lo - ours) <= OURS_TOLERANCE_MS ? null : lo;\n })(),\n };\n\n const decision = decideAction(facts, s);\n const nowIso = new Date().toISOString();\n\n switch (decision.kind) {\n case \"hard_exit\": {\n // v1.4 — R24: capture what this exit was worth, at the only moment the number is knowable.\n const exitVal = pickPrimaryOpportunity(opportunities)?.monetaryValue ?? 0;\n const stepsSent = s.lastMainStepSent + s.lastBranchStepSent + (s.lastSlowStepSent ?? 0);\n state[contactId] = {\n ...applyDecision(decision, s, nowIso),\n exitValue: exitVal,\n exitStepsSent: stepsSent,\n };\n out.log.push(`${contactId}: hard exit -> ${decision.status} (${decision.reason})${exitVal ? ` | value ${exitVal}` : \"\"}`);\n jrow(contactId, \"hard_exit\", `${decision.reason}${exitVal ? ` | value ${exitVal} after ${stepsSent} message(s)` : \"\"}`);\n await honourOptOut(contactId, facts, TEST_MODE, j, GHL, fctx);\n break;\n }\n\n case \"pause_reply\":\n state[contactId] = applyDecision(decision, s, nowIso);\n if (decision.isNewPause) {\n jrow(contactId, \"pause_reply\", \"inbound reply detected — handed to a human\");\n const title = `Reply from ${facts.contact.firstName || \"contact\"} re: puppy path — read and respond personally`;\n try {\n await createTask(\n contactId,\n title,\n \"Auto-created by puppy-path-engine: an inbound reply was detected; the sequence is paused for this contact until a human responds.\",\n );\n out.log.push(`${contactId}: paused (new reply), task created`);\n } catch (e) {\n out.log.push(`${contactId}: paused (new reply), TASK CREATE FAILED: ${String(e).slice(0, 120)}`);\n }\n } else {\n out.log.push(`${contactId}: still paused (reply already flagged, no duplicate task)`);\n }\n break;\n\n case \"advance_status\":\n state[contactId] = applyDecision(decision, s, nowIso);\n out.log.push(`${contactId}: advanced -> ${decision.status}`);\n // \"awaiting_appt_outcome\" here means: they booked a Pup Talk while in the sequence —\n // the attributable event the summary counts as bookedDuringPath.\n jrow(contactId, \"advance_status\", decision.status);\n break;\n\n case \"soft_exit_21d\":\n state[contactId] = applyDecision(decision, s, nowIso);\n try {\n await createTask(\n contactId,\n `Puppy path finished for ${facts.contact.firstName || \"contact\"} — now on the slow track`,\n `Puppy path finished for ${facts.contact.firstName || \"contact\"}, no reply/booking. They are now on the slow track (occasional helpful messages: weekly for a month, then fortnightly, then monthly — no sales asks). Nothing needed unless you want them moved in the pipeline too; the stage was NOT auto-moved — that's Kim's call.`,\n );\n } catch (e) {\n out.log.push(`${contactId}: soft-exit task FAILED: ${String(e).slice(0, 120)}`);\n }\n out.log.push(`${contactId}: 21d complete — moved to slow track (stage NOT moved)`);\n jrow(contactId, \"soft_exit_21d\", \"21-day sequence complete — moved to slow track\");\n break;\n\n case \"branch_complete\":\n state[contactId] = applyDecision(decision, s, nowIso);\n out.log.push(`${contactId}: branch complete`);\n jrow(contactId, \"branch_complete\", s.status);\n break;\n\n case \"send\": {\n // v1.2 — blast ceilings (mirrors the PupsClub val's precedent). A capped send is a pure\n // deferral: state untouched, the step stays due, later runs drain the backlog gradually.\n if (out.sent + out.failed >= maxSendsPerRun()) {\n out.skipped++;\n out.log.push(`${contactId}: send due but MAX_SENDS_PER_RUN (${maxSendsPerRun()}) reached — deferred`);\n break;\n }\n if (!TEST_MODE && sentToday >= maxSendsPerDay()) {\n out.skipped++;\n out.log.push(`${contactId}: send due but MAX_SENDS_PER_DAY (${maxSendsPerDay()}) reached — deferred to tomorrow`);\n break;\n }\n const step = decision.sequence === \"slow\"\n ? slowTemplateAt(decision.stepIndex, Date.now(), s.lastSentStepId).tpl\n : (decision.sequence === \"main\" ? MAIN_SEQUENCE : decision.sequence === \"branch_a\" ? BRANCH_A : BRANCH_B)[decision.stepIndex];\n // v1.7.1 — consent re-checked against the template actually being sent: a monthly\n // re-resolution at the UTC month boundary can flip template (and channel) between\n // decision and execution; an opted-out channel must win that race.\n { const rbr = decision.sequence === \"slow\" ? channelBar(facts, step.channel) : null;\n if (rbr) {\n out.skipped++;\n out.log.push(`${contactId}: slow step resolved to barred ${step.channel} at send time (${rbr}) — skipped, not consumed`);\n break;\n } }\n const rendered = renderStep(\n step,\n { firstName: facts.contact.firstName, companyName: facts.contact.companyName },\n { testMode: TEST_MODE },\n );\n try {\n const resp = rendered.channel === \"sms\"\n ? await sendSms(contactId, rendered.text)\n : await sendEmail(contactId, rendered.subject, rendered.html);\n // v1.2 — state persisted IMMEDIATELY after each successful send (a mid-run crash\n // must never re-send). Non-send transitions recompute idempotently. NOTES-v1.4.md.\n state[contactId] = { ...applyDecision(decision, s, nowIso), ...sendReceipt(resp, rendered.channel) };\n await saveAllState(state).catch((e) =>\n out.log.push(`${contactId}: sent OK but state persist failed (will retry at end): ${String(e).slice(0, 100)}`),\n );\n // v1.4 — R23: position is an array index, so inserting a message re-points everyone\n // mid-sequence with no signal. Recording the step ID makes that drift DETECTABLE.\n\n // v1.7 — slow records template id; R23 drift check stays main-only (slow's monthly\n // index-to-id mapping varies by design).\n const seqNow = decision.sequence === \"main\" ? MAIN_SEQUENCE : decision.sequence === \"branch_a\" ? BRANCH_A : decision.sequence === \"branch_b\" ? BRANCH_B : null;\n const sentStepId = decision.sequence === \"slow\" ? step.id : (seqNow?.[decision.stepIndex]?.id ?? null);\n if (s.lastSentStepId && sentStepId && seqNow) {\n const prevIdx = seqNow.findIndex((x) => x.id === s.lastSentStepId);\n if (prevIdx >= 0 && prevIdx !== decision.stepIndex - 1 && decision.sequence === \"main\") {\n out.log.push(`${contactId}: SEQUENCE DRIFT — last sent ${s.lastSentStepId} now sits at index ${prevIdx}, expected ${decision.stepIndex - 1}. The copy has been edited underneath in-flight contacts.`);\n jrow(contactId, \"sequence_drift\", `${s.lastSentStepId} -> index ${prevIdx}`);\n }\n }\n state[contactId] = { ...state[contactId], lastSentStepId: sentStepId };\n out.sent++;\n if (!TEST_MODE) sentToday++;\n out.log.push(`${contactId}: sent ${decision.sequence} step ${decision.stepIndex + 1} (${rendered.channel})`);\n jrow(contactId, \"sent\", `${decision.sequence}#${decision.stepIndex + 1} (${rendered.channel === \"sms\" ? \"text\" : \"email\"})`);\n } catch (e) {\n out.failed++;\n if (!TEST_MODE) sentToday++; // a failed attempt spent the same GHL call as a send\n await onSendFailure(contactId, s, e, `${decision.sequence}#${decision.stepIndex + 1}`, fctx);\n }\n break;\n }\n\n case \"skip_step\":\n // v1.6 R28 / v1.9 — this step's channel is opted out OR has no address at all. Consumed,\n // not deferred, so the sequence carries on; journalled, because a message that silently\n // never went out is what nobody notices until a customer asks why they never heard back.\n state[contactId] = applyDecision(decision, s, nowIso);\n out.skipped++;\n out.log.push(`${contactId}: ${decision.reason}`);\n jrow(contactId, \"skip_step_channel_optout\", decision.reason);\n break;\n\n case \"skip\":\n // Still runs through applyDecision (a no-op on every field except lastCheckedAt) so \"last\n // time this contact was actually looked at\" stays accurate per spec §4's schema comment.\n state[contactId] = applyDecision(decision, s, nowIso);\n out.skipped++;\n // R37: deferral reasons logged; \"not due\" stays silent (skippedNotDue counts it).\n if (!/not due/.test(decision.reason)) {\n out.log.push(`${contactId}: ${decision.reason}`);\n jrow(contactId, \"deferred\", decision.reason.slice(0, 120));\n }\n break;\n }\n } catch (err) {\n out.failed++;\n out.log.push(`${contactId}: FAILED: ${String(err).slice(0, 150)}`);\n // v1.4 — this catch used to write to out.log only, and out.log is not persisted to the\n // journal. So a contact failing here was invisible to the dashboard, which reads the journal.\n // Every failure now leaves a row.\n jrow(contactId, \"contact_failed\", String(err).slice(0, 100));\n }\n }\n\n // v1.1: prune stale terminal entries (their history lives on in the journal), persist everything,\n // then rebuild the aggregate summary from full journal + surviving state.\n out.skippedNotDue = skippedNotDue;\n if (skippedNotDue) out.log.push(`${skippedNotDue} contact(s) not due — zero API calls spent on them`);\n const { kept, prunedIds } = pruneState(state, Date.now());\n for (const id of prunedIds) jrow(id, \"pruned\", \"terminal 60+ days, removed from state (journal retains history)\");\n if (prunedIds.length) out.log.push(`pruned ${prunedIds.length} stale terminal entries`);\n await saveAllState(kept);\n const fullJournal = await appendJournal(journal);\n await saveSummary(\n buildSummary(kept, fullJournal, {\n at: new Date().toISOString(),\n testMode: TEST_MODE,\n sent: out.sent,\n failed: out.failed,\n enrolled: out.enrolled,\n }),\n ).catch((e) => out.log.push(`summary save failed: ${String(e).slice(0, 100)}`));\n await saveReport(out);\n await blob.setJSON(\"puppy_run_lock\", { startedAt: null }).catch(() => {}); // release lock\n // Holiday deposits: once an hour, LAST, fully caught, read-only. Why it hangs off this\n // schedule rather than its own file is in NOTES-v1.4.md under \"deposit refresh\".\n try {\n const dep = await import(\"./deposits.ts\");\n await dep.refreshIfDue(() => blob.getJSON(dep.ATTEMPT_KEY) as any, () => dep.runCollection(false, \"engine\"), Date.now());\n } catch (e) { console.log(\"deposits refresh skipped\", String(e).slice(0, 120)); }\n console.log(\"PUPPYPATH\", JSON.stringify(out));\n return out;\n } catch (err) {\n out.ok = false;\n out.error = String(err);\n await saveLastError({ at: new Date().toISOString(), error: String(err) }).catch(() => {});\n // v1.2 — even on a crashed run, persist whatever state mutations happened before the crash\n // (sends already persisted individually; this catches transitions) and the journal rows.\n await saveReport(out).catch(() => {});\n await appendJournal(journal).catch(() => {});\n await blob.setJSON(\"puppy_run_lock\", { startedAt: null }).catch(() => {});\n console.log(\"PUPPYPATH\", JSON.stringify(out));\n return out;\n }\n}\n\n// ---- booking-link shortener (spec §7) --------------------------------------------------\n// (full note moved to NOTES-v1.4.md when this file hit val.town's 80,000-char ceiling)\nexport async function bookingRedirect(_req: Request): Promise {\n return Response.redirect(REAL_BOOKING_URL, 302);\n}\n\n// ---- exports for the local test harness (puppy-path-engine.test.ts) -------------------------------\n\nexport {\n decideAction,\n applyDecision,\n renderStep,\n resolveDogName,\n resolveFirstName,\n applyMergeFields,\n isDue,\n freshState,\n pickPrimaryOpportunity,\n apptIsLiveBooked,\n bodyToHtml,\n // v1.1 pure additions\n businessLocalParts,\n inSendWindow,\n selectEnrollable,\n buildSummary,\n pruneState,\n MAIN_SEQUENCE,\n BRANCH_A,\n BRANCH_B,\n STAGE,\n MAIN_PIPELINE_ID,\n TAG_ENROLLED,\n TAG_SOURCE_SIGNAL,\n PUP_TALK_DECLINED_TAG,\n PHONE_DISPLAY,\n REAL_BOOKING_URL,\n SHORT_BOOKING_LINK,\n TERMINAL_STATUSES,\n DAY_MS,\n HOUR_MS,\n TEST_MODE,\n // v1.7 — slow track\n slowTemplateAt,\n nextSlowTouch,\n monthlyTemplateFor,\n};\n// v1.8 — story machinery + taper banks re-exported for the offline harness\nexport { readChannelConsent } from \"./consent.ts\";\nexport * from \"./reachability.ts\";\nexport { STORY_SLOTS, resolveStories, storyFor } from \"./kim-stories.ts\";\nexport { SLOW_WEEKLY, SLOW_FORTNIGHTLY, SLOW_MONTHLY_BANK } from \"./taper-messages.ts\";\nexport type { PuppyState, PuppyStatus, Facts, Decision, ContactFact, OppFact, ApptFact, MessageTemplate, RenderedMessage };\n\n\n=====FILE engine/reachability.ts =====\n// REACHABILITY, DEAD LETTERS AND DELIVERY. Extracted from main.ts on 14 Aug 2026, for exactly the\n// reason consent.ts and render.ts were extracted before it: main.ts sits against val.town's hard\n// 80,000-character ceiling with ~850 characters spare, and the code that decides whether a real\n// person can be reached at all should be a file you can find, not twenty lines inside a 1,500-line\n// engine. Every function here is pure or takes its IO injected, so all of it is directly testable.\n//\n// THE FOUR DEFECTS THIS FILE EXISTS TO CLOSE. All four were proven by running the compiled engine\n// against the live account, not inferred from reading it.\n//\n// 1. THE SPIN. channelBar guarded `noEmail` for email and had NO PHONE EQUIVALENT. ContactFact had\n// no phone field at all, though getContact fetches `phone` on every pass and threw it away. An\n// SMS step coming due for a phoneless contact went: due -> sendGate (no contactability check) ->\n// channelBar returns null -> send -> sendSms -> `if (!r.ok) throw` -> the catch in cron(), which\n// WROTE NOTHING TO STATE. dueAt never moved, so the next tick re-derived the identical decision.\n// Rule 9's 21-day exit needs lastMainStepSent >= MAIN_SEQUENCE.length, which only advances on the\n// success path, so it never timed out. MAX_SENDS_PER_RUN and MAX_SENDS_PER_DAY both read\n// out.sent, which only increments on success, so FAILURES WERE UNCAPPED. Observed cadence ~60min\n// = ~24 retries per contact per day, forever, plus a CRITICAL watchdog alert every hour.\n// Live census, all 5,748 contacts: 398 qualify as puppy inquiries, 266 of them have NO PHONE.\n// Bulk-tagging today would have been ~648 failed sends and ~2,600 wasted GHL calls per day.\n//\n// 2. NO ATTEMPT COUNTER, NO DEAD LETTER. PuppyState had no failure field and all five terminal\n// statuses were success shapes, so a permanently failing contact rendered as \"In the main\n// sequence\" indefinitely. Fixed by sendFailures + MAX_SEND_FAILURES + done_send_failed.\n//\n// 3. NO REACHABILITY EXIT. A contact with neither email nor phone silently consumed all 8 steps and\n// then fired the soft_exit_21d task telling Kim \"Puppy path finished... now on the slow track\" —\n// a task that is a lie about somebody who received nothing. done_unreachable ends them at the\n// first pass instead, and DELIBERATELY CREATES NO TASK: bulk-tagging 300 contacts would put 265\n// tasks in Kim's CRM in a single run, which is its own incident. It is journalled and counted.\n// Only a contact that TRIED and FAILED (the dead-letter path) earns a task.\n//\n// 4. DELIVERY WAS NEVER RECONCILED. The send response was discarded entirely, including the\n// messageId the engine's own comment documents, so any 2xx from GHL was recorded as \"sent\".\n// Live sampling found 9 `undelivered` out of 124 outbound SMS in this account (7.3%) — every one\n// of them would have counted as a success.\n//\n// SCOPE NOTE — WHAT IS AND IS NOT READABLE ABOUT DELIVERY (verified live, 14 Aug 2026):\n// * SMS status IS readable on GET /conversations/{conversationId}/messages (Version 2021-04-15):\n// each message carries `status` (delivered / undelivered / queued / ...).\n// * EMAIL status is NOT on that endpoint: 137 TYPE_EMAIL messages sampled there carried no\n// `status` key at all.\n// * EMAIL status IS readable on GET /conversations/messages/email/{emailMessageId} (verified 200,\n// returned status:\"opened\"), and sendEmail already returns emailMessageId in its response.\n// Both are handled below. Where either read fails, the status is recorded as the literal string\n// \"unknown\" — VISIBLY UNKNOWN, never filed as fine. That is this codebase's standing rule\n// (facts.ts:1-12): a fact nobody could establish is not a fact that everything is well.\n//\n// RECONCILIATION IS KEYED ON THE MESSAGE ID, never on \"the newest outbound message on the thread\".\n// Chloe, Ava and 165 GHL workflows also send into these same conversations; attributing another\n// system's `undelivered` to this engine would dead-letter a perfectly healthy contact.\n\ndeclare const Deno: { env: { get(key: string): string | undefined } };\nif (typeof (globalThis as any).Deno === \"undefined\") {\n (globalThis as any).Deno = { env: { get: (k: string) => (globalThis as any).process?.env?.[k] } };\n}\n\n// Same idiom as the engine's other knobs: read per call, env-overridable, clamped so a typo cannot\n// disable the ceiling. 3 = two retries after the first failure, which is enough for a transient\n// GHL blip and nowhere near enough to be a spin.\nexport const maxSendFailures = () => Math.max(1, Math.floor(Number(Deno.env.get(\"MAX_SEND_FAILURES\") ?? \"3\")) || 3);\n// How long after a send before its status is worth reading back. GHL stamps status asynchronously;\n// reading seconds after the POST reports \"queued\" for everything and teaches you nothing.\nexport const RECONCILE_MIN_AGE_MS = 5 * 60 * 1000;\n\n// ---- statuses, reasons, state fields --------------------------------------------------------------\n\n// Declared here rather than inline in main.ts purely for that file's character budget; they are\n// spliced into PuppyStatus and TERMINAL_STATUSES there, so they are terminal everywhere for free.\nexport type DeadLetterStatus = \"done_unreachable\" | \"done_send_failed\";\nexport const DEAD_LETTER_STATUSES: DeadLetterStatus[] = [\"done_unreachable\", \"done_send_failed\"];\n\n// Reason strings live in exactly one place so a test, a log line and a dashboard label cannot drift.\n// NOTE the wording: absence is never described as an opt-out the person did not make (consent.ts's\n// rule, and consent-guard.test.mjs CG-4 pins it).\nexport const NO_EMAIL_REASON = \"no email address on the record\";\nexport const NO_PHONE_REASON = \"no phone number on the record\";\nexport const UNREACHABLE_REASON = \"no email address and no phone number on the record\";\nexport const OPTOUT_REASON = \"replied with an opt-out keyword\";\nexport const DND_WRITE_MESSAGE = \"Replied with an opt-out keyword to a puppy-path message\";\n\nexport type FailureFields = {\n // v1.9 — ALL OPTIONAL, on purpose: existing state blobs in production deserialize untouched and\n // every reader defaults them. Same discipline as the v1.7 slow-track fields.\n sendFailures?: number; // consecutive failed attempts; reset to 0 by a success\n lastFailureAt?: string | null; // ISO — feeds the exponential backoff\n lastFailureReason?: string | null;\n lastMessageId?: string | null; // the id GHL returned for our last send, for reconciliation\n lastMessageChannel?: \"sms\" | \"email\" | null;\n lastDeliveryStatus?: string | null; // observed status, or the literal \"unknown\"\n};\n\nexport const FRESH_FAILURE_FIELDS: FailureFields = {\n sendFailures: 0, lastFailureAt: null, lastFailureReason: null,\n lastMessageId: null, lastMessageChannel: null, lastDeliveryStatus: null,\n};\n\n/** Consecutive failures, clamped. Garbage counters (NaN, negative, a string blob) read as 0 rather\n * than falling through to \"dead-letter this contact\" — same clamping the slow track already does. */\nexport const failCount = (s: FailureFields | null | undefined): number =>\n Math.max(0, Math.floor(Number(s?.sendFailures)) || 0);\n\n// ---- channel availability -------------------------------------------------------------------------\n\n/** Is this channel physically usable for this contact? Absence of an address, not consent — the\n * consent question is readChannelConsent's, and the two are deliberately reported differently. */\nexport function missingChannel(c: { noEmail?: boolean; noPhone?: boolean }, ch: \"email\" | \"sms\"): string | null {\n if (ch === \"email\" && c.noEmail) return NO_EMAIL_REASON;\n if (ch === \"sms\" && c.noPhone) return NO_PHONE_REASON;\n return null;\n}\n\n/**\n * Rules 1b and 1c of the state machine, evaluated immediately after the DND rule and BEFORE the\n * disqualified rule.\n *\n * 1b — the contact asked to stop, in words, in a reply. Hard exit. It outranks rule 5 (pause_reply)\n * deliberately: today an \"UNSUBSCRIBE\" reply routes to pause_reply, which pauses, raises a task\n * for a human, records no opt-out at all, and RESUMES SENDING once a human answers.\n * 1c — the contact has neither an email address nor a phone number, so nothing can ever be sent to\n * them by any channel. Ending them here is what stops them consuming all 8 steps in silence and\n * then triggering a \"puppy path finished\" task about somebody who received nothing.\n *\n * Returns a Decision-shaped object; assignable to the engine's Decision union without importing it,\n * which keeps this file free of a circular dependency on main.ts.\n */\nexport function reachabilityExit(f: {\n contact: { noEmail?: boolean; noPhone?: boolean };\n optOutRequested?: boolean;\n}): { kind: \"hard_exit\"; status: \"done_hard_exit\" | \"done_unreachable\"; reason: string } | null {\n if (f.optOutRequested) return { kind: \"hard_exit\", status: \"done_hard_exit\", reason: OPTOUT_REASON };\n if (f.contact.noEmail && f.contact.noPhone) {\n return { kind: \"hard_exit\", status: \"done_unreachable\", reason: UNREACHABLE_REASON };\n }\n return null;\n}\n\n/** Enrolment-time refusal. A contact with no way of being contacted is not put on the path at all:\n * no puppy-path-v1 tag, one journal row, and a terminal state entry (see reEnrollable). */\nexport function enrolmentBar(c: { email?: unknown; phone?: unknown } | null | undefined): string | null {\n return !c?.email && !c?.phone ? UNREACHABLE_REASON : null;\n}\n\n/**\n * CAN A DEAD LETTER COME BACK? (14 Aug, defect 2.)\n *\n * The candidate filter was `!tags.includes(TAG_ENROLLED) && !state[c.id]`. A done_send_failed or\n * done_unreachable entry sits in state and is never touched again — the per-contact loop `continue`s\n * on any terminal status, so lastCheckedAt never moves and pruneState only drops it after 60 days.\n * Meanwhile the dead-letter task this file writes told Kim to do exactly the thing that did not work:\n * \"remove the puppy-path-v1 tag and re-tag them\". Proven against the live account: she removes the\n * tag, fixes the phone number, re-tags — candidates that survive the filter: 0.\n *\n * So a dead letter is allowed back in, under two conditions that stop it becoming a loop:\n * 1. ONLY the two dead-letter statuses. done_customer, done_hard_exit (which is where an opt-out\n * lands), done_booked, done_soft_21d, done_branch_complete and done_not_enrolled are NOT\n * resurrectable by re-tagging\n * — an opt-out must never be undone by a tag, and a customer must never be re-nurtured by one.\n * 2. THE REASON MUST NO LONGER BE VISIBLY TRUE. A contact who still has neither an email address\n * nor a phone number is not a candidate at all: nothing was fixed, so re-admitting them would\n * re-refuse them every run forever, which is defect 4 with a different name. done_send_failed\n * cannot be verified the same way (a bad number looks exactly like a good one), so it is let\n * back in with a fresh attempt budget — and re-enrolment applies TAG_ENROLLED, which is what\n * stops it repeating: they are excluded by the first clause of the filter from then on.\n */\nexport function reEnrollable(\n s: { status?: string } | null | undefined,\n c: { email?: unknown; phone?: unknown } | null | undefined,\n): boolean {\n if (!s || !DEAD_LETTER_STATUSES.includes(s.status as DeadLetterStatus)) return false;\n return !enrolmentBar(c); // still unreachable: stays dead-lettered, silently, at zero cost\n}\n\n/**\n * Has this exact refusal already been written to the journal for this contact? (14 Aug, defect 4.)\n *\n * A TRANSIENT refusal — \"tagged but already has a live Pup Talk booking\" — must keep being\n * re-evaluated every run, because the booking may be cancelled tomorrow and then they SHOULD enrol.\n * But re-evaluating it wrote an identical journal row every run: 39 of the last 40 rows on Kim's\n * live activity page are the same sentence, hourly, for two days, and at ~24-30 rows a day the\n * 2,000-row cap evicts every real thing the system did within about two months.\n *\n * A terminal refusal gets a state entry instead (that is what enrolmentBar's branch does, and it is\n * why that one never repeated). A transient one cannot have a state entry — any state entry at all\n * removes the contact from the candidate filter — so the repetition is stopped at the journal.\n */\nexport function refusedBefore(\n priorJournal: { contactId?: string | null; event?: string; detail?: string }[] | null | undefined,\n contactId: string,\n detail: string,\n): boolean {\n return (priorJournal ?? []).some(\n (r) => r?.contactId === contactId && r?.event === \"enroll_refused\" && r?.detail === detail,\n );\n}\n\n// ---- backoff --------------------------------------------------------------------------------------\n\n/**\n * Exponential backoff between failed attempts: 2^failures hours. Returned as a sendGate reason\n * string, so a contact in backoff produces `skip` — state untouched, step still due, picked up\n * later — which is exactly how every other deferral in this engine behaves.\n *\n * The `since >= 0` guard mirrors the R27 / v1.7 clock-skew guards: a future-dated stamp (restored\n * blob, clock skew) must never freeze a contact until that future date.\n */\nexport function backoffBar(s: FailureFields | null | undefined, nowMs: number): string | null {\n const n = failCount(s);\n if (!n || !s?.lastFailureAt) return null;\n const since = nowMs - Date.parse(s.lastFailureAt);\n if (!(since >= 0)) return null;\n const waitH = Math.pow(2, Math.min(n, 12));\n if (since >= waitH * 3600000) return null;\n return `send backoff after ${n} failure(s): waiting ${waitH}h, ${(since / 3600000).toFixed(1)}h elapsed`;\n}\n\n// ---- failure accounting ---------------------------------------------------------------------------\n\n/** Injected effects, so every policy decision below stays testable without a network. */\nexport type Effects = {\n state: Record;\n save: (st: Record) => Promise;\n log: (line: string) => void;\n journal: (contactId: string, event: string, detail: string) => void;\n /** null in practice mode — TEST_MODE must never write a task into the client's real CRM. */\n task: ((contactId: string, title: string, body: string) => Promise) | null;\n};\n\n/**\n * THE INVARIANT THIS FUNCTION MUST NOT BREAK. main.ts's comment on the success path reads: \"state\n * persisted IMMEDIATELY after each successful send (a mid-run crash must never re-send)\". So this\n * moves the FAILURE COUNTER AND NOTHING ELSE. lastMainStepSent, lastBranchStepSent, lastSlowStepSent\n * and lastSentAt are all left exactly as they were: nothing went out, so no step is consumed and the\n * pacing clock does not start. The only status change is the terminal one at the ceiling.\n */\nexport function nextFailureState>(\n s: S, nowIso: string, reason: string,\n): { next: S; n: number; dead: boolean } {\n const n = failCount(s) + 1;\n const dead = n >= maxSendFailures();\n const next: any = {\n ...s,\n sendFailures: n,\n lastFailureAt: nowIso,\n lastFailureReason: reason.slice(0, 200),\n lastCheckedAt: nowIso,\n lastMessageId: null, // whatever we were reconciling is moot; this attempt is the news now\n };\n if (dead) {\n next.status = \"done_send_failed\";\n next.exitReason = `${n} consecutive send failures — dead-lettered (${reason.slice(0, 120)})`;\n }\n return { next: next as S, n, dead };\n}\n\nexport const DEAD_LETTER_TITLE = \"Automated follow-up has STOPPED for this contact — messages keep failing\";\n\nexport function deadLetterBody(label: string, n: number, reason: string): string {\n return `Auto-created by puppy-path-engine: ${n} attempts to send ${label} to this contact all failed, so the engine has stopped trying.\\n\\nLast error: ${reason.slice(0, 200)}\\n\\nThis person is NOT receiving the puppy follow-up and will not receive any more of it. Usual causes: the phone number or email address on the record is wrong or missing, the number is a landline, or the carrier is rejecting us.\\n\\nTo put them back on it: fix the contact details first, then remove the puppy-path-v1 tag and add the tag you normally use to start someone on the puppy path. They begin again at message one on the next run. If the record still has no phone number and no email address, nothing happens and they stay stopped — the details have to be fixed first, and this is the only order that works.`;\n}\n\nasync function announceDeadLetter(contactId: string, n: number, label: string, reason: string, fx: Effects) {\n fx.journal(contactId, \"dead_letter\", `${label} failed ${n}x — stopped trying: ${reason.slice(0, 60)}`);\n fx.log(`${contactId}: DEAD LETTER after ${n} failures — status done_send_failed, no further attempts`);\n // A contact that TRIED AND FAILED earns a task; an unreachable contact does not (see defect 3).\n if (fx.task) await fx.task(contactId, DEAD_LETTER_TITLE, deadLetterBody(label, n, reason)).catch(() => {});\n}\n\n/**\n * The catch on the send path. Before this existed the catch wrote NOTHING to state, which is the\n * whole spin: dueAt unchanged, identical decision next tick, forever, uncapped.\n * Returns true when this failure dead-lettered the contact.\n */\nexport async function onSendFailure(\n contactId: string, s: any, err: unknown, label: string, fx: Effects,\n): Promise {\n const reason = String((err as any)?.message ?? err).slice(0, 150);\n const { next, n, dead } = nextFailureState(s, new Date().toISOString(), reason);\n fx.state[contactId] = next;\n // Persisted immediately, exactly like the success path: a mid-run crash must not lose the count\n // either, or the ceiling never arrives.\n await fx.save(fx.state).catch(() => {});\n fx.log(`${contactId}: SEND FAILED ${label} (attempt ${n} of ${maxSendFailures()}): ${reason.slice(0, 100)}`);\n fx.journal(contactId, \"send_failed\", `${label}: ${reason.slice(0, 80)}`);\n if (dead) await announceDeadLetter(contactId, n, label, reason, fx);\n return dead;\n}\n\nexport const DELIVERY_FAILED_STATUSES = new Set([\"undelivered\", \"failed\", \"rejected\", \"bounced\", \"error\"]);\nexport const isDeliveryFailure = (st: unknown): boolean =>\n DELIVERY_FAILED_STATUSES.has(String(st ?? \"\").toLowerCase());\n\n/**\n * A delivery status read back on a LATER pass. GHL returning 2xx to our POST means \"queued\", not\n * \"delivered\" — 7.3% of live outbound SMS in this account are `undelivered` and every one of them\n * was being counted as a success.\n *\n * Returns null when there was nothing to reconcile. `stop` is true only for a real delivery failure,\n * which feeds the same counter as a send failure; the caller skips the rest of the pass so the\n * backoff applies before anything else is attempted.\n *\n * IDEMPOTENT: lastMessageId is cleared either way, so a given message is reconciled at most once and\n * a repeated pass cannot count the same failure twice.\n */\nexport async function onDeliveryStatus(\n contactId: string, s: any, status: string | null | undefined, fx: Effects,\n): Promise<{ s: any; stop: boolean } | null> {\n if (!status) return null;\n const st = String(status).toLowerCase();\n if (!isDeliveryFailure(st)) {\n const next = { ...s, lastDeliveryStatus: st, lastMessageId: null };\n fx.state[contactId] = next;\n // Visibly unknown, not quietly fine. Journalled so the count is on the dashboard rather than\n // being something only a person reading the blob would ever discover.\n if (st === \"unknown\") fx.journal(contactId, \"delivery_unknown\", \"delivery status could not be read for the last message\");\n return { s: next, stop: false };\n }\n const { next, n, dead } = nextFailureState(s, new Date().toISOString(), `delivery reported ${st}`);\n next.lastDeliveryStatus = st;\n fx.state[contactId] = next;\n await fx.save(fx.state).catch(() => {});\n fx.log(`${contactId}: last message came back ${st} (attempt ${n} of ${maxSendFailures()})`);\n fx.journal(contactId, \"delivery_failed\", `${st} (attempt ${n} of ${maxSendFailures()})`);\n if (dead) await announceDeadLetter(contactId, n, `the last message (${st})`, `delivery reported ${st}`, fx);\n return { s: next, stop: true };\n}\n\n/** What a successful send leaves on state: the receipt to reconcile against, and a RESET COUNTER.\n * The reset matters because applyDecision spreads `...s` — a stale count left standing would\n * dead-letter a healthy contact on an unrelated blip weeks later. */\nexport function sendReceipt(resp: any, channel: \"sms\" | \"email\"): FailureFields {\n const id = channel === \"email\"\n ? (resp?.emailMessageId ?? resp?.messageId ?? null)\n : (resp?.messageId ?? resp?.messageIds?.[0] ?? null);\n return {\n sendFailures: 0, lastFailureAt: null, lastFailureReason: null,\n lastMessageId: id != null ? String(id) : null,\n lastMessageChannel: channel,\n lastDeliveryStatus: null,\n };\n}\n\n// ---- opt-out words --------------------------------------------------------------------------------\n\n/**\n * TWO RULES, BOTH DELIBERATELY NARROW: a WHOLE BODY that is nothing but an opt-out word, and a short\n * list of phrases that cannot mean anything else. Everything else is left to a human via pause_reply.\n *\n * [was: /^\\s*(unsubscribe|stop|remove|opt[\\s-]?out)\\b/i — anchored at the start of the RAW body. Email\n * is the channel every footer makes the promise on (\"Reply UNSUBSCRIBE\"), and it is the channel that\n * rule could not read: an email reply arrives as `
UNSUBSCRIBE
`, as `
unsubscribe\n *
`, as `> unsubscribe`, as `\"STOP\"`, or under an `On 14 Aug, Kim wrote:` line — none of which\n * START with the word. It also missed every natural phrasing (\"please unsubscribe me\", \"take me off\n * this list\", \"no more texts please\") while MATCHING five sentences that mean the opposite (\"Remove\n * the 3pm and put us at 4\", \"Stop, I already booked!\", \"Opt out of the Tuesday session only\").\n * A prefix rule is not a narrow rule; it is a rule that reads one word and guesses the rest.]\n *\n * WHY NOT \"cancel\", still. Removed 14 Aug and kept out: for a business whose funnel is booked calls,\n * \"cancel my Pup Talk\" is a booking change from a hot lead. One live inbound in the 669 real bodies\n * checked reads \"My apologies but could you cancel my subscription?\" — which in an account that sells\n * training packages could as easily be the package as the texts. It is not silently dropped: an\n * inbound reply still pauses the sequence and puts a task in front of a person. A wrong opt-out is\n * irreversible in both directions at once — the lead is hard-exited AND a permanent email block is\n * written that silences Kim's own confirmations to them.\n *\n * TESTED AGAINST REAL DATA, not invented data: all 2,889 message bodies in the 99 live conversations\n * (669 of them inbound with a body). Matches exactly the 5 genuine opt-outs the old rule found, and\n * nothing else — including zero matches on the 2,220 outbound bodies, which is the guard that matters\n * for the SMS-reaction shape (`Loved \"…Reply STOP to stop these texts.\"` is an INBOUND message that\n * quotes our own footer back at us). Every phrase below is first-person on purpose: our own footers\n * say \"take YOU off these emails\" and \"Reply STOP\", so no footer can ever match itself.\n */\nconst OPT_OUT_TARGET =\n \"(?:e ?mails?|texts?|texting|messages?|msgs?|sms|mail(?:ing|ings)?|lists?|marketing|communications?|newsletters?|notifications?|spam)\";\n\n/** Body -> comparable core: HTML stripped, quoted-reply and signature chrome dropped, punctuation and\n * emoji reduced to spaces, politeness trimmed off both ends. Exported because it is the half of this\n * rule most likely to be wrong on a shape nobody has seen yet, and a test can only pin what it can see. */\nexport function optOutCore(body: unknown): string {\n let s = String(body ?? \"\");\n if (!s.trim()) return \"\";\n // Entities are decoded BEFORE the tags are stripped as well as after: a double-encoded body\n // (`<p>unsubscribe</p>`, which is what a form-posted reply can arrive as) would\n // otherwise survive tag-stripping as the literal text \"p unsubscribe p\" and match nothing.\n const entities = (x: string) => x.replace(/ /gi, \" \").replace(/"|"/gi, '\"')\n .replace(/'|'/gi, \"'\").replace(/</gi, \"<\").replace(/>/gi, \">\").replace(/&/gi, \"&\");\n s = entities(s);\n s = s.replace(/<(script|style)[\\s\\S]*?<\\/\\1>/gi, \" \");\n s = s.replace(//gi, \"\\n\").replace(/<\\/(p|div|blockquote|tr|li|h[1-6])\\s*>/gi, \"\\n\");\n s = s.replace(/<[^>]*>/g, \" \");\n s = entities(s);\n const kept: string[] = [];\n for (const raw of s.split(/\\r?\\n/)) {\n const line = raw.trim();\n if (/^>+/.test(line)) continue; // quoted line\n if (/^on\\b.{0,120}\\bwrote:?$/i.test(line)) continue; // \"On 14 Aug, Kim wrote:\"\n if (/^(from|sent|to|subject|date|cc|reply-to):/i.test(line)) continue;\n if (/^[-_]{2,}\\s*(original|forwarded)\\b/i.test(line)) continue;\n if (/^sent from my\\b/i.test(line)) continue; // phone signature\n if (/^get outlook for\\b/i.test(line)) continue;\n kept.push(line);\n }\n // A body that is ENTIRELY quoted (\"> unsubscribe\") must not strip to nothing: de-quote instead.\n let text = kept.join(\" \").trim();\n if (!text) text = s.replace(/^[ \\t]*>+[ \\t]?/gm, \" \");\n let core = text.toLowerCase().replace(/[^a-z0-9]+/g, \" \").replace(/\\s+/g, \" \").trim();\n for (let i = 0; i < 2; i++) {\n core = core.replace(/^(?:please|pls|plz|kindly|hi|hello|hey|yes|ok|okay)\\s+/, \"\")\n .replace(/\\s+(?:please|pls|plz|thanks|thank you|thx|asap|now|immediately|ty)$/, \"\");\n }\n return core;\n}\n\n/** The whole body says this and nothing else. \"Stop, I already booked!\" is not in here, and cannot be. */\nexport const WHOLE_BODY_OPT_OUT = new Set([\n \"unsubscribe\", \"unsubscribed\", \"unsub\", \"unsubscribe me\", \"unsubscribe me from this list\",\n \"stop\", \"stop all\", \"stopall\", \"stop it\", \"stop messages\", \"stop texts\", \"stop emails\",\n \"remove\", \"remove me\", \"removed\", \"delete me\", \"take me off\", \"take me off the list\",\n \"opt out\", \"optout\", \"opt me out\", \"opted out\",\n]);\n\n/** Phrases that cannot be a booking change. Each one names the PERSON as the thing being removed and\n * the CHANNEL they are being removed from — \"remove me from this list\", never \"remove the 3pm\". */\nexport const OPT_OUT_PHRASES: RegExp[] = [\n /\\bunsubscribe me\\b/,\n new RegExp(`\\\\bunsubscribe (?:me )?from (?:this|these|your|the|all|future|any)[a-z ]{0,20}?${OPT_OUT_TARGET}\\\\b`),\n new RegExp(`\\\\b(?:remove|delete|take) me (?:from|off) (?:this|these|your|the|all|any|ur)?[a-z ]{0,14}?${OPT_OUT_TARGET}\\\\b`),\n new RegExp(`\\\\bno more ${OPT_OUT_TARGET}\\\\b`),\n /\\bstop (?:texting|emailing|e mailing|messaging|contacting|calling|mailing) me\\b/,\n new RegExp(`\\\\bstop sending me[a-z ]{0,14}?${OPT_OUT_TARGET}\\\\b`),\n /\\b(?:do not|dont|do nt|never) (?:text|email|e mail|message|contact|call) me\\b/,\n new RegExp(`\\\\bopt (?:me )?out of (?:this|these|your|the|all|future|any)[a-z ]{0,14}?${OPT_OUT_TARGET}\\\\b`),\n];\n\nexport function isOptOutBody(body: unknown): boolean {\n const core = optOutCore(body);\n if (!core) return false;\n if (WHOLE_BODY_OPT_OUT.has(core)) return true;\n return OPT_OUT_PHRASES.some((re) => re.test(core));\n}\n\n/** GHL has returned message pages under three shapes across versions; accept all, invent none. */\nfunction pickMessages(r: any): any[] {\n const m = r?.messages?.messages ?? r?.messages ?? r?.message ?? [];\n return Array.isArray(m) ? m : [];\n}\n\nexport type ReplyStatus = {\n hasUnansweredInboundReply: boolean;\n conversationCheckFailed: boolean;\n lastOutboundAt: number | null;\n optOutRequested?: boolean;\n deliveryStatus?: string | null;\n};\n\n/**\n * The one extra read, hung off the conversation getReplyStatus already fetched — the R27 trick, so\n * the collision guard and the opt-out check and the delivery check share one search call rather than\n * three. The message-body read is a second call, but only when there is actually something to read:\n * an inbound message to inspect, or one of our own sends old enough to have a settled status.\n *\n * FAILS TO SILENCE, NEVER TO \"SEND ANYWAY\". A failed read returns optOutRequested:false, so the\n * caller keeps today's behaviour (pause_reply on an inbound), and deliveryStatus:\"unknown\", which is\n * recorded as unknown rather than as success.\n */\nexport async function convoExtras(\n convo: any,\n st: (FailureFields & { lastSentAt?: string | null }) | undefined | null,\n fetchJson: (url: string, ver: string, init?: any) => Promise,\n base: string,\n nowMs: number,\n): Promise<{ optOutRequested: boolean; deliveryStatus: string | null }> {\n const res = { optOutRequested: false, deliveryStatus: null as string | null };\n const convoId = convo?.id ?? convo?.conversationId ?? null;\n const dir = convo?.lastMessageDirection ?? convo?.direction ?? null;\n const wantOptOut = dir === \"inbound\" && !!convoId;\n const msgId = st?.lastMessageId ?? null;\n const sentAt = st?.lastSentAt ? Date.parse(st.lastSentAt) : NaN;\n const wantDelivery = !!msgId && (!Number.isFinite(sentAt) || nowMs - sentAt >= RECONCILE_MIN_AGE_MS);\n if (!wantOptOut && !wantDelivery) return res;\n\n // One page, shared. An SMS reconciliation and an opt-out check on the same thread are one call.\n let page: any[] | null = null;\n let pageTried = false;\n const loadPage = async (): Promise => {\n if (pageTried) return page ?? [];\n pageTried = true;\n if (!convoId) return [];\n try { page = pickMessages(await fetchJson(`${base}/conversations/${convoId}/messages?limit=20`, \"2021-04-15\")); }\n catch { page = null; }\n return page ?? [];\n };\n\n if (wantDelivery) {\n if (st?.lastMessageChannel === \"email\") {\n // Email status is not on the conversation endpoint at all; it has its own.\n try {\n const r = await fetchJson(`${base}/conversations/messages/email/${msgId}`, \"2021-04-15\");\n const v = r?.emailMessage?.status ?? r?.status ?? null;\n res.deliveryStatus = v ? String(v).toLowerCase() : \"unknown\";\n } catch { res.deliveryStatus = \"unknown\"; }\n } else {\n const mine = (await loadPage()).find((m) => m?.id === msgId);\n const v = mine?.status ?? null;\n res.deliveryStatus = v ? String(v).toLowerCase() : \"unknown\";\n }\n }\n\n if (wantOptOut) {\n const msgs = await loadPage();\n if (!pageTried || page === null) {\n res.optOutRequested = false; // unreadable — the caller falls back to pause_reply\n } else {\n // AN UNKNOWN DIRECTION IS NOT THE CUSTOMER SPEAKING.\n // [was: String(m?.direction ?? \"inbound\") — an absent direction defaulted to inbound, i.e. to\n // \"the customer said this\", which is the one direction this file's own discipline forbids\n // defaulting to (see the header on convoExtras: FAILS TO SILENCE, NEVER TO \"SEND ANYWAY\").\n // 46 messages in the 99 live conversations sampled on 14 Aug carry direction:null; every one\n // is TYPE_EMAIL and every one is plainly ours (\"Congratulations on Your Dog's Bootcamp\n // Graduation\", \"We look forward to speaking with you tomorrow\"). Our own email footer reads\n // \"Reply UNSUBSCRIBE and we'll take you off these emails\" — so the default was pointing the\n // opt-out scanner at our own copy. Unreadable direction now means the message is not scanned,\n // the caller still sees the inbound reply, and the contact is paused for a human instead.]\n const inbound = msgs.find((m) => String(m?.direction ?? \"\").toLowerCase() === \"inbound\") ?? null;\n res.optOutRequested = !!inbound && isOptOutBody(inbound.body ?? inbound.message ?? \"\");\n }\n }\n return res;\n}\n\n/**\n * Honour an opt-out in the client's live CRM by setting dndSettings.Email.status = \"permanent\" —\n * the exact field consent.ts:29 already reads, so the block is enforced everywhere for free with no\n * change to consent.ts. Nothing in this codebase has ever WRITTEN that field (zero `Email:\n * permanent` across 1,200 live contacts), which is why \"Reply UNSUBSCRIBE\" in every email footer\n * has been a promise the system could not keep.\n *\n * This is a write to a real customer record, so: TEST_MODE never writes, and it is idempotent twice\n * over — it is skipped entirely when Email is already blocking, and the PUT sets a fixed value\n * rather than toggling one. SMS is deliberately not written: GHL/Twilio already honour STOP natively\n * on the SMS channel and set permanent themselves.\n */\nexport async function honourOptOut(\n contactId: string,\n f: { optOutRequested?: boolean; channelBlocked?: { email: boolean; sms: boolean } },\n testMode: boolean,\n fetchJson: (url: string, ver: string, init?: any) => Promise,\n base: string,\n fx?: Effects,\n): Promise {\n const say = (m: string, failed = false) => {\n fx?.log(`${contactId}: ${m}`);\n if (failed) fx?.journal(contactId, \"optout_write_failed\", m);\n return m;\n };\n if (!f.optOutRequested) return null;\n if (testMode) return say(\"opt-out detected — practice mode, no DND written to GHL\");\n if (f.channelBlocked?.email) return say(\"opt-out detected — Email DND already set, nothing written\");\n try {\n await fetchJson(`${base}/contacts/${contactId}`, \"2021-07-28\", {\n method: \"PUT\",\n body: JSON.stringify({ dndSettings: { Email: { status: \"permanent\", message: DND_WRITE_MESSAGE } } }),\n });\n return say(\"opt-out honoured — Email DND set to permanent in GHL\");\n } catch (e) {\n // The hard exit stands either way: this engine stops messaging them regardless of whether GHL\n // took the write. Loud, because everything ELSE that reads that field is now out of step.\n return say(`OPT-OUT DND WRITE FAILED (${String(e).slice(0, 80)}) — hard exit stands, GHL NOT updated`, true);\n }\n}\n\n// ---- summary counts -------------------------------------------------------------------------------\n\n/** The counts buildSummary never had: send_failed was journalled and then counted by nothing, so a\n * permanently failing contact showed up nowhere at all. */\nexport function failureCounts(\n journal: { event: string; detail: string }[],\n byStatus: Record,\n): { sendFailures: number; deadLettered: number; unreachable: number; deliveryFailed: number; deliveryUnknown: number } {\n let sendFailures = 0, deadLettered = 0, deliveryFailed = 0, deliveryUnknown = 0;\n // STANDING COUNT, from state, not a running total from the journal: a contact refused at\n // enrolment now gets a done_unreachable state entry (that is what stops the refusal repeating),\n // so counting the enroll_refused rows here as well would count every one of them twice.\n const unreachable = byStatus?.done_unreachable ?? 0;\n for (const r of journal ?? []) {\n if (r.event === \"send_failed\") sendFailures++;\n else if (r.event === \"dead_letter\") deadLettered++;\n else if (r.event === \"delivery_failed\") deliveryFailed++;\n else if (r.event === \"delivery_unknown\") deliveryUnknown++;\n }\n return { sendFailures, deadLettered, unreachable, deliveryFailed, deliveryUnknown };\n}\n\n\n=====FILE engine/registry-diff.ts =====\n// WHAT CHANGED IN A LIST SOMEBODY ELSE CONTROLS. v1.0, 5 August 2026.\n//\n// The watchdog watches two registries in Kim's CRM that nobody on this project owns: her 165\n// automations, and the eight knowledge bases Chloe answers customers from. Both can be edited by\n// Kim, by Kristian, or by an integration nobody remembers installing, and until v1.6 the knowledge\n// bases were not watched at all. The consolidated one was edited at 02:38 on 5 August and nothing\n// noticed.\n//\n// This is the comparison, on its own, so it can be tested. It lived inline in the watchdog before,\n// where it could only ever be checked by waiting for somebody to change something — which means a\n// check nobody has ever seen go off. Same rule as everywhere else in this project: a check that\n// cannot be shown to fail is not a check.\n//\n// It deliberately knows nothing about workflows or knowledge bases. It takes two maps of\n// id -> description and says what moved.\n\nexport type Registry = Record;\n\nexport type RegistryChange = {\n added: string[];\n removed: string[];\n edited: string[]; // \"old -> new\", so a reader can see what moved without opening anything\n changed: boolean;\n};\n\nexport function registryDiff(prev: Registry | null | undefined, now: Registry | null | undefined): RegistryChange {\n const a = prev && typeof prev === \"object\" ? prev : {};\n const b = now && typeof now === \"object\" ? now : {};\n const prevIds = Object.keys(a);\n const nowIds = Object.keys(b);\n const added = nowIds.filter((i) => !(i in a)).map((i) => b[i]);\n const removed = prevIds.filter((i) => !(i in b)).map((i) => a[i]);\n const edited = nowIds.filter((i) => i in a && a[i] !== b[i]).map((i) => `${a[i]} -> ${b[i]}`);\n return { added, removed, edited, changed: added.length + removed.length + edited.length > 0 };\n}\n\n/**\n * Is this an empty response we should DISTRUST rather than act on?\n *\n * A malformed-but-200 reply that returns an empty list must never overwrite a good baseline, or\n * the next pass fires \"everything was removed\" and the one after that fires \"everything was\n * added\". The watchdog learned this on the workflow registry; the knowledge-base watch inherits it\n * rather than rediscovering it.\n */\nexport function looksLikeAGlitch(nowCount: number, prevCount: number | null | undefined): boolean {\n return nowCount === 0 && (prevCount ?? 0) > 0;\n}\n\n/** The sentence, generated from the change, never written alongside it. */\nexport function registrySentence(c: RegistryChange, what: string): string {\n if (!c.changed) return `Nothing has moved in ${what} since the last look.`;\n const bits: string[] = [];\n if (c.edited.length) bits.push(`Edited: ${c.edited.slice(0, 3).join(\"; \")}.`);\n if (c.added.length) bits.push(`Added: ${c.added.slice(0, 3).join(\"; \")}.`);\n if (c.removed.length) bits.push(`Removed: ${c.removed.slice(0, 3).join(\"; \")}.`);\n const more = c.added.length + c.removed.length + c.edited.length - Math.min(3, c.edited.length) - Math.min(3, c.added.length) - Math.min(3, c.removed.length);\n if (more > 0) bits.push(`${more} more not listed here.`);\n return bits.join(\" \");\n}\n\n\n=====FILE engine/render.ts =====\n// MESSAGE RENDERING. Extracted from main.ts on 4 Aug 2026.\n//\n// WHY IT LIVES HERE: main.ts sits against a hard 80,000-character ceiling on the platform, and\n// these are the most self-contained functions in the file. Pulling them out also means the escape\n// and merge-field rules can be tested directly rather than only through a full engine run, which\n// matters because two of the fixes below came out of a security review, not a feature request.\n\n// Spec: dog name blank on ~70% of sampled contacts; fallback \"your puppy\" per the writing sheet's own\n// proposed default (§6 Q3). Messy-but-present values (multi-dog, junk like \"Money\") are used as-is —\n// that's an intake-form data-quality problem, not something to silently \"clean\" here.\nexport function resolveDogName(companyName: string | null | undefined): string {\n const v = (companyName ?? \"\").trim();\n return v.length > 0 ? v : \"your puppy\";\n}\n\n// Spec only discusses the blank-dog-name case explicitly. Added this small parallel safety net for a\n// blank first name (defensive, beyond spec's literal text) because \"Hi ,\" landing in a live message\n// would look obviously broken — same principle as the dog-name fallback, applied consistently.\nexport function resolveFirstName(firstName: string | null | undefined): string {\n const v = (firstName ?? \"\").trim();\n return v.length > 0 ? v : \"there\";\n}\n\nexport function applyMergeFields(template: string, firstName: string | null | undefined, companyName: string | null | undefined): string {\n // v1.8.1 — function form so $-patterns in names (\"Bo$$\") cannot corrupt the body.\n return template\n .replaceAll(\"{{FIRST_NAME}}\", () => resolveFirstName(firstName))\n .replaceAll(\"{{DOG_NAME}}\", () => resolveDogName(companyName));\n}\n\n// v1.8.1 — contact-typed fields and Kim's stories land in email HTML; escape BEFORE the\n// **bold** transform so markup we generate survives and markup anyone else typed does not.\nexport function escHtml(s: string): string {\n return s.replace(/[&<>\"']/g, (c) => ({ \"&\": \"&\", \"<\": \"<\", \">\": \">\", '\"': \""\", \"'\": \"'\" }[c] as string));\n}\n\nexport function mdBoldToHtml(text: string): string {\n return text.replace(/\\*\\*(.+?)\\*\\*/g, \"$1\");\n}\n\nexport function bodyToHtml(body: string, previewText?: string): string {\n const paragraphs = escHtml(body)\n .trim()\n .split(/\\n\\s*\\n/)\n .map((p) => `
${mdBoldToHtml(p.trim()).replace(/\\n/g, \"
\")}
`)\n .join(\"\\n\");\n // Hidden preheader technique so the approved \"preview text\" shows in an inbox list without being\n // visible in the opened email — standard, low-risk, one line.\n const preheader = previewText\n ? `
${escHtml(previewText)}
\\n`\n : \"\";\n return preheader + paragraphs;\n}\n\n\n\n=====FILE engine/report-logic.ts =====\n// FRIDAY REPORT, pure computation module. No network, no Deno APIs: everything here is\n// offline-testable, and every number the report shows is produced by a function in this file\n// with its formula written next to it. v1.0, 4 Aug 2026.\n//\n// ACCURACY RULES (the non-negotiables the report was commissioned under):\n// - numbers come from platform APIs upstream of these functions, never typed in\n// - every derived figure's formula is stored beside it (FORMULAS below, rendered in appendix)\n// - anything unverifiable renders as \"not tracked yet\", never a guess\n\n// `attribution` was PROVEN present on 190/190 contacts in the live account on 4 Aug 2026, while\n// the `source` column was blank on 154 of the same 190. The CRM records where a person came from\n// in a place its own source column never reads from. Optional, because every older caller and\n// every test builds a ContactLite without it.\nexport type Attribution = { medium?: string | null; campaign?: string | null };\nexport type ContactLite = { dateAdded: string; source: string | null; tags: string[]; attribution?: Attribution | null };\nexport type EventLite = { startTime: number; appointmentStatus: string; calendarId: string };\nexport type OppLite = { createdAt: string; status: string; monetaryValue: number; lastStageChangeAt?: string | null };\n\nexport type Window = { startMs: number; endMs: number; label: string };\n\n// Reporting week: Friday 00:00 ET back seven days. The report is read Friday morning, so the\n// most recent COMPLETE window is the seven days ending Thursday midnight.\nexport function reportWindows(nowMs: number, tzOffsetMin: number): { current: Window; previous: Window } {\n // tzOffsetMin: minutes to ADD to UTC to get business-local (ET = -240 in summer).\n const local = new Date(nowMs + tzOffsetMin * 60_000);\n const day = local.getUTCDay(); // 0 Sun .. 5 Fri .. 6 Sat, in local terms\n // most recent Friday 00:00 local, strictly in the past or today\n const sinceFri = (day - 5 + 7) % 7;\n const fri = Date.UTC(local.getUTCFullYear(), local.getUTCMonth(), local.getUTCDate() - sinceFri);\n const friUtcMs = fri - tzOffsetMin * 60_000; // back to real UTC instant of local Friday 00:00\n const week = 7 * 86_400_000;\n return {\n current: { startMs: friUtcMs - week, endMs: friUtcMs, label: \"this week\" },\n previous: { startMs: friUtcMs - 2 * week, endMs: friUtcMs - week, label: \"last week\" },\n };\n}\n\nexport function inWindow(iso: string | number, w: Window): boolean {\n const t = typeof iso === \"number\" ? iso : Date.parse(iso);\n return Number.isFinite(t) && t >= w.startMs && t < w.endMs;\n}\n\n// ---- the formulas, stored as data so the appendix can print them verbatim -----------------------\nexport const FORMULAS: Record = {\n \"New inquiries\": \"how many new people landed in the CRM during the seven days, counted by the date the CRM stamped on them\",\n \"Pup Talks on the calendar\": \"how many Pup Talk appointments had a start time inside the seven days, not counting cancelled ones\",\n \"Showed\": \"how many of those the CRM marked as showed up\",\n \"Show rate\": \"showed divided by booked; the percentage is only quoted when at least five were booked, because a rate built on two appointments misleads\",\n \"Free Training Day\": \"the same counting, done against both Free Training Day calendars\",\n \"New customers\": \"people whose deal reached the Customer stage in the CRM during the week, counted in the week they got there, not the week they first got in touch\",\n \"Up or down on last week\": \"this week against the same count for the seven days before it, shown as level, or up or down by a percentage\",\n \"Cost per inquiry\": \"ad spend divided by new inquiries; appears once the ad account is linked, and is never estimated before then\",\n \"Did the ad leads land\": \"what the ad platform claims it delivered, side by side with what actually arrived in the CRM the same week\",\n};\n\nexport function countContacts(cs: ContactLite[], w: Window): number {\n return cs.filter((c) => inWindow(c.dateAdded, w)).length;\n}\n\nexport function sourceBreakdown(cs: ContactLite[], w: Window): Array<{ source: string; n: number }> {\n const m = new Map();\n for (const c of cs.filter((c) => inWindow(c.dateAdded, w))) {\n const s = (c.source || \"no source recorded\").trim().toLowerCase() || \"no source recorded\";\n m.set(s, (m.get(s) ?? 0) + 1);\n }\n return [...m.entries()].map(([source, n]) => ({ source, n })).sort((a, b) => b.n - a.n);\n}\n\nexport function countEvents(evs: EventLite[], w: Window): { booked: number; showed: number; noshow: number; cancelled: number } {\n const live = evs.filter((e) => inWindow(e.startTime, w));\n const ok = live.filter((e) => e.appointmentStatus !== \"cancelled\" && e.appointmentStatus !== \"invalid\");\n return {\n booked: ok.length,\n showed: ok.filter((e) => e.appointmentStatus === \"showed\").length,\n noshow: ok.filter((e) => e.appointmentStatus === \"noshow\" || e.appointmentStatus === \"no-show\").length,\n cancelled: live.length - ok.length,\n };\n}\n\nexport function wonOpps(os: OppLite[], w: Window): { count: number; value: number } {\n const won = os.filter((o) => o.status === \"won\" && inWindow(o.lastStageChangeAt || o.createdAt, w));\n return { count: won.length, value: won.reduce((a, o) => a + (Number(o.monetaryValue) || 0), 0) };\n}\n\n// weekly buckets for the 8-week chart, oldest first\n// The reader-facing name for each raw medium string. Anything not in this map is passed through\n// as itself rather than bucketed into \"other\", so a new channel appears by name instead of\n// silently vanishing into a catch-all nobody investigates.\nconst MEDIUM_LABEL: Record = {\n facebook: \"Facebook\", instagram: \"Instagram\", form: \"a form on your website\",\n chat_widget: \"the chat box on your website\", conversation: \"a direct message\",\n other: \"somewhere else\", email: \"email\", sms: \"text message\", phone: \"phone call\",\n};\nexport function prettyMedium(m: string | null | undefined): string {\n const k = (m || \"\").trim().toLowerCase();\n if (!k) return \"not recorded\";\n return MEDIUM_LABEL[k] ?? k.replace(/_/g, \" \");\n}\n// Where people actually came from, read from the attribution record rather than the source column.\nexport function channelBreakdown(cs: ContactLite[], w: Window): Array<{ source: string; n: number }> {\n const m = new Map();\n for (const c of cs.filter((c) => inWindow(c.dateAdded, w))) {\n const label = prettyMedium(c.attribution?.medium);\n m.set(label, (m.get(label) ?? 0) + 1);\n }\n return [...m.entries()].map(([source, n]) => ({ source, n }))\n .sort((a, b) => (b.n - a.n) || a.source.localeCompare(b.source));\n}\n// Named campaigns. A campaign name is ad-platform text, so it reaches the page as data and must\n// be escaped there like any other untrusted string.\nexport function campaignBreakdown(cs: ContactLite[], w: Window): Array<{ name: string; n: number }> {\n const m = new Map();\n for (const c of cs.filter((c) => inWindow(c.dateAdded, w))) {\n const name = (c.attribution?.campaign || \"\").trim();\n if (!name) continue;\n m.set(name, (m.get(name) ?? 0) + 1);\n }\n return [...m.entries()].map(([name, n]) => ({ name, n }))\n .sort((a, b) => (b.n - a.n) || a.name.localeCompare(b.name));\n}\n// How many of a window's contacts can be placed at all. This is the honest headline for the\n// section: \"we can account for X of Y\", never a bare count of the unexplained.\nexport function attributionCoverage(cs: ContactLite[], w: Window): { known: number; total: number } {\n const inW = cs.filter((c) => inWindow(c.dateAdded, w));\n return { known: inW.filter((c) => (c.attribution?.medium || \"\").trim()).length, total: inW.length };\n}\n\n// R32 (10 Aug 2026). Paid-social arrivals, read from the ARRIVAL RECORD, never from `source`.\n// Case-insensitive on purpose: channelBreakdown returns display labels from prettyMedium\n// (\"Facebook\", \"Instagram\"), so a case-sensitive regex here reproduces the exact bug this replaces.\nexport const PAID_SOCIAL_RE = /facebook|instagram|meta|messenger/i;\nexport function facebookLanded(cs: ContactLite[], w: Window): number {\n return channelBreakdown(cs, w).filter((s) => PAID_SOCIAL_RE.test(s.source)).reduce((a, s) => a + s.n, 0);\n}\n\nexport function weeklyBuckets(cs: ContactLite[], endMs: number, weeks: number): number[] {\n const wMs = 7 * 86_400_000;\n const out = new Array(weeks).fill(0);\n for (const c of cs) {\n const t = Date.parse(c.dateAdded);\n if (!Number.isFinite(t) || t >= endMs || t < endMs - weeks * wMs) continue;\n const idx = weeks - 1 - Math.floor((endMs - 1 - t) / wMs);\n if (idx >= 0 && idx < weeks) out[idx]++;\n }\n return out;\n}\n\nexport function pct(n: number, d: number): string {\n if (!d) return \"n/a\";\n return Math.round((n / d) * 100) + \"%\";\n}\n\nexport function deltaWord(cur: number, prev: number): string {\n if (cur === prev) return \"level with last week\";\n if (prev === 0) return cur > 0 ? \"up from zero last week\" : \"level with last week\";\n const ch = Math.round(((cur - prev) / prev) * 100);\n return ch > 0 ? `up ${ch}% on last week` : `down ${Math.abs(ch)}% on last week`;\n}\n\nexport function money(n: number): string {\n return \"$\" + n.toLocaleString(\"en-US\", { minimumFractionDigits: 2, maximumFractionDigits: 2 });\n}\n\n// ---- draft commentary: rule-based sentences from the computed numbers. Never speculates. --------\n// Marked DRAFT in the page; the human tops and tails before it goes anywhere.\nexport function draftCommentary(f: {\n enq: number; enqPrev: number;\n ptBooked: number; ptPrev: number; ptShowed: number;\n wonCount: number; wonValue: number; wonPrevValue: number;\n topSource: string | null;\n adTracked: boolean;\n}): string[] {\n const lines: string[] = [];\n lines.push(\n `${f.enq} new ${f.enq === 1 ? \"inquiry\" : \"inquiries\"} came in this week, ${deltaWord(f.enq, f.enqPrev)}.` +\n (f.topSource === \"no source recorded\"\n ? ` Most arrived without a source recorded in the CRM, a tracking gap worth closing.`\n : f.topSource\n ? ` The biggest source was ${f.topSource}.`\n : \"\"),\n );\n lines.push(\n `${f.ptBooked} Pup Talk${f.ptBooked === 1 ? \" was\" : \"s were\"} on the calendar (${deltaWord(f.ptBooked, f.ptPrev)})` +\n (f.ptBooked >= 5 ? `, and ${f.ptShowed} of them showed (${pct(f.ptShowed, f.ptBooked)}).` : f.ptBooked > 0 ? `, ${f.ptShowed} showed.` : \".\"),\n );\n // The CRM holds no deal values (proven live: every opportunity is $0 and none are flagged\n // won), so this counts PEOPLE reaching the Customer stage and never implies a revenue figure.\n if (f.wonCount > 0) {\n lines.push(`${f.wonCount} ${f.wonCount === 1 ? \"person\" : \"people\"} reached the Customer stage this week.`);\n } else {\n lines.push(`Nobody reached the Customer stage in the CRM this week.`);\n }\n if (!f.adTracked) {\n lines.push(`Ad spend and cost per lead are not tracked yet, they appear the week the ad platform tokens are connected.`);\n }\n return lines;\n}\n\n",[517],"df0f7193-df89-4cb2-8164-d3b18c4392c7","SOURCE-BUNDLE.part8.txt","7c8dcd00-91bc-11f1-8e89-1607ee4eb77e",1094,["D",1786801897743],"THE DOGS SPOT — SOURCE BUNDLE (part 8 of 40)\n\nEVERY source file in this project, engine/ included. Restoring these parts and nothing else gives\nyou a tree that builds, typechecks and runs its own test suite with no network and no val.\n\nengine/ is here as of 14 Aug 2026. It used to be left out because val 1bfa6e81-74e1-4c6c-ab32-118304a4ffff\nholds it, which was true of every engine file except engine/watch.ts: a module the val does not run,\nso it was never deployed, so it lived in one container and nothing else. A reclaim destroyed it.\nscripts/deploy.mjs --check still compares engine/ against the val file by file; that is a second\ncheck on the same files now, not the only copy of them.\n\nRESTORE (needs only node, from an empty folder). Save each part, then run this ON EACH ONE:\n\n node -e 'const fs=require(\"fs\"),p=require(\"path\");const b=fs.readFileSync(process.argv[1],\"utf8\");\n for(const s of b.split(\"\\n=====FILE \").slice(1)){const i=s.indexOf(\" =====\\n\");\n const f=s.slice(0,i),c=s.slice(i+7);fs.mkdirSync(p.dirname(f),{recursive:true});\n fs.writeFileSync(f,c.replace(/\\n$/,\"\"))}' PART.txt\n\nA record named #1, #2, ... is one FILE cut into pieces: concatenate them in order, then\nstrip one trailing newline from the last. scripts/restore.mjs does this for you.\n\nEach part is complete in itself: whole files only, no reassembly, any order.\n\nThen: node scripts/build.mjs (engine/ came out of these parts; nothing to fetch first)\n node scripts/typecheck.mjs\n node tests/run-all.mjs\n node scripts/deploy.mjs --check (pulls nothing, proves the val matches what you restored)\n node tests/negative-controls.mjs (proves the suite above can actually fail)\n\nIN THIS PART (1 of 116 files)\n\n\n================================================================================================\n=====FILE engine/puppy_path_v1.1.ts#1 =====\n// PUPPY PATH ENGINE v1.1 — nurture automation for The Dogs Spot's puppy leads (built 27 Ju\n// (full note moved to NOTES-v1.4.md when this file hit val.town's 80,000-char ceiling)\n\n// ---- Node/tsx compatibility shim, for the local harness only. Full note: NOTES v1.10.\ndeclare const Deno: { env: { get(key: string): string | undefined } };\nif (typeof (globalThis as any).Deno === \"undefined\") {\n (globalThis as any).Deno = { env: { get: (k: string) => (globalThis as any).process?.env?.[k] } };\n}\n\n// Message copy + display constants live in ./puppy-messages.ts (split for val.town's 80k/file cap).\nimport {\n MAIN_SEQUENCE,\n BRANCH_A,\n BRANCH_B,\n PHONE_DISPLAY,\n REAL_BOOKING_URL,\n SHORT_BOOKING_LINK,\n} from \"./puppy-messages.ts\";\nimport type { Channel, MessageTemplate } from \"./puppy-messages.ts\";\n// v1.7 — slow track (taper). Copy+cadence in ./taper-messages.ts; Kim's spec (3 Aug): weekly x4,\n// fortnightly x13, then monthly forever, no asks. Same rails: reply pauses, booking exits, consent.\nimport { nextSlowTouch, monthlyTemplateFor, monthlyTemplateAvoidingRepeat } from \"./taper-messages.ts\";\n// v1.8 — Kim's real stories, one data file, additive slots. Null slots render as nothing.\nimport { readChannelConsent } from \"./consent.ts\";\n// v1.9 — reachability, dead letters, delivery, opt-out words. Extracted for this file's ceiling.\nimport {\n missingChannel, reachabilityExit, enrolmentBar, backoffBar, onSendFailure, onDeliveryStatus,\n sendReceipt, convoExtras, honourOptOut, failureCounts, FRESH_FAILURE_FIELDS, DEAD_LETTER_STATUSES,\n reEnrollable, refusedBefore,\n} from \"./reachability.ts\";\nimport type { DeadLetterStatus, FailureFields, ReplyStatus, Effects } from \"./reachability.ts\";\nimport { resolveStories } from \"./kim-stories.ts\";\nimport { appendRunStamp } from \"./cadence.ts\";\nimport { dryScan } from \"./puppy-detect.ts\";\nimport { resolveDogName, resolveFirstName, applyMergeFields, escHtml, bodyToHtml } from \"./render.ts\";\n\n// ---- reference IDs (spec §2, all verified live this session unless noted) ------------------------\n\nconst GHL = \"https://services.leadconnectorhq.com\";\n// v1.2 — TOKEN RESOLUTION: GHL_TOKEN env var, else private blob `puppy_config`. Blob fallback\n// exists because val.town has no env-var API. Code is public; token never hardcoded. Full note:\n// NOTES-v1.4.md.\nlet TOKEN: string | undefined = Deno.env.get(\"GHL_TOKEN\");\nasync function resolveToken(): Promise {\n if (TOKEN) return TOKEN;\n try {\n const blob = await getBlobModule();\n const cfg = await blob.getJSON(\"puppy_config\").catch(() => null);\n if (cfg?.ghlToken) TOKEN = String(cfg.ghlToken);\n } catch { /* stays undefined; j() will throw a clear auth error */ }\n return TOKEN;\n}\nconst LOC = \"BQHJ19uohldYe3eqA0bl\";\nconst MAIN_PIPELINE_ID = \"FXt1UpCVBufbF0v3pfyf\"; // \"1) Initial Lead Pipeline\"\n\nconst STAGE = {\n NEW_LEAD: \"ccb18375-9aa1-40aa-a071-1581ca739533\",\n LEAD_NURTURE: \"00d0f792-38e5-444e-8995-a1be96e77d3b\",\n FREE_TRAINING_DAY: \"43ea02b4-529b-4063-b638-447414d603d2\",\n PUP_TALK: \"379d1dd2-fc18-4720-a840-e8f8ed703bb9\",\n CXLD_PUPTALK_TRAINING_DAY: \"4b5599d3-a5ad-4b8c-8388-4d5507c22fd7\",\n NO_SALE_NURTURE: \"e4511876-0adb-417b-a6be-8460a194f913\",\n DISQUALIFIED: \"38826f17-1d0e-4bac-b53e-349b67c2c79d\",\n NO_SHOW: \"f3f41e5e-edaf-4ef1-8cec-c4cccd4ec5c2\",\n ONBOARDING: \"76c72f7f-56bd-4f44-964d-aa4cbbec7d25\",\n CUSTOMER: \"fd821b4e-bbe6-44de-b754-fa80e4823616\",\n WON_PAID: \"ae173310-f8b1-4399-acb7-ef1fc03d3697\",\n} as const;\n\nconst PUP_TALK_CALENDAR_ID = \"qHuYJ0NEqzibnoqf5Cw3\";\n\n\n// v1.1: env-overridable, and now understood as the HUMAN ENROLLMENT SWITCH, not auto-discovery of a\n// pre-existing population — live check 27 Jul: zero contacts carry it (or any spelling variant), so\n// applying it is how a human puts someone on the path. READ ONLY here, never written by this engine.\nconst TAG_SOURCE_SIGNAL = Deno.env.get(\"TAG_SOURCE_SIGNAL\") || \"nurture - puppy\";\nconst TAG_ENROLLED = \"puppy-path-v1\"; // minted by this engine, applied on enrollment\n\n// v1.1 send-window + surge-hold knobs (see header addendum). Read per call, not once at module load —\n// costs nothing at this call volume and lets the offline harness flip them per test section; under\n// val.town the env is static so behavior is identical either way.\nconst sendWindowStartHour = () => Number(Deno.env.get(\"SEND_WINDOW_START_HOUR\") ?? \"9\");\nconst sendWindowEndHour = () => Number(Deno.env.get(\"SEND_WINDOW_END_HOUR\") ?? \"19\");\nconst smsSundayOk = () => (Deno.env.get(\"SMS_SUNDAY_OK\") ?? \"false\") === \"true\";\nconst enrollSurgeThreshold = () => Number(Deno.env.get(\"ENROLL_SURGE_THRESHOLD\") ?? \"25\");\nconst acknowledgeSurge = () => (Deno.env.get(\"ACKNOWLEDGE_SURGE\") ?? \"false\") === \"true\";\nconst BUSINESS_TZ = \"America/New_York\";\n\n// v1.2 hardening knobs (30 Jul). All env-overridable, read per call. Full rationale: NOTES.\nconst minSendGapHours = () => Number(Deno.env.get(\"MIN_SEND_GAP_HOURS\") ?? \"2\");\nconst maxSendsPerRun = () => Number(Deno.env.get(\"MAX_SENDS_PER_RUN\") ?? \"20\");\nconst maxSendsPerDay = () => Number(Deno.env.get(\"MAX_SENDS_PER_DAY\") ?? \"50\");\n// v1.4 — how often a contact gets a full CRM check even when nothing is due. The floor under\n// due-first filtering: cheap must not become blind.\n// v1.4 — how long a reply can sit unanswered before the engine escalates and releases the contact.\nconst pauseTimeoutDays = () => Number(Deno.env.get(\"PAUSE_TIMEOUT_DAYS\") ?? \"14\");\n// v1.5 R27 — how long the engine stands down after ANY other system messages the contact. 24h is one\n// full business cycle: long enough that a customer never gets our email on the same day as a workflow\n// text, short enough that a 21-day sequence still completes near schedule (a deferred step is never\n// dropped, it waits for the next run).\nconst foreignQuietHours = () => Number(Deno.env.get(\"FOREIGN_QUIET_HOURS\") ?? \"24\");\n// Tolerance when deciding \"was that outbound ours?\" — clock skew between our send and GHL stamping\n// the conversation. Anything inside this window of our own lastSentAt is treated as ours.\nconst OURS_TOLERANCE_MS = 5 * 60 * 1000;\nconst safetySweepHours = () => Number(Deno.env.get(\"SAFETY_SWEEP_HOURS\") ?? \"24\");\nconst RUN_LOCK_TTL_MS = 10 * 60 * 1000; // a run that started >10 min ago is presumed dead\n\nconst sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));\n\n// Rule 8's real signal — NOT CONFIRMED LIVE this session, see gap #2 in the header comment. Left as a\n// clearly-named constant so wiring in the real value later is a one-line change, not a re-guess.\nconst PUP_TALK_DECLINED_TAG = \"TDS-Declined\";\n\nconst HOUR_MS = 3600 * 1000;\nconst DAY_MS = 24 * HOUR_MS;\n\n// R38: mode = env var if set, else blob puppy_mode {live:true} (api.ts arm route). Fails safe.\nexport function resolveMode(envVal: string | undefined | null, blobVal: unknown): boolean {\n if (envVal != null) return envVal !== \"false\"; // practice unless the literal string false\n const live = !!(blobVal && typeof blobVal === \"object\" && (blobVal as any).live === true);\n return !live; // no blob, or malformed = practice\n}\nlet TEST_MODE = resolveMode(Deno.env.get(\"TEST_MODE\"), null);\n\n// ---- data model (spec §4, verbatim) ---------------------------------------------------------------\n\ntype PuppyStatus =\n | \"main\" | \"awaiting_appt_outcome\" | \"branch_a\" | \"branch_b\" | \"slow_track\"\n | \"paused_reply\" | \"done_booked\" | \"done_customer\" | \"done_hard_exit\"\n | \"done_soft_21d\" | \"done_branch_complete\" | \"done_not_enrolled\" | DeadLetterStatus;\n\n// v1.7 — done_soft_21d stays terminal for LEGACY pre-taper contacts only (no retroactive\n// enrollment). New 21-day completions flow into slow_track instead.\nconst TERMINAL_STATUSES = new Set([\n \"done_booked\", \"done_customer\", \"done_hard_exit\", \"done_soft_21d\", \"done_branch_complete\",\n \"done_not_enrolled\", // v1.10 — refused AT enrolment; never on the path, so never a win. NOTES v1.10.\n ...DEAD_LETTER_STATUSES, // v1.9 — done_unreachable / done_send_failed. See reachability.ts.\n]);\n\ntype PuppyState = FailureFields & {\n status: PuppyStatus;\n enteredAt: string; // ISO — main sequence start\n lastMainStepSent: number; // 0..8, count of main-sequence messages sent so far\n branchAnchorAt: string | null; // ISO — when branch A/B started\n lastBranchStepSent: number; // 0..2\n pausedForReplyAt: string | null;\n exitReason: string | null; // free text, for humans reading the blob\n lastCheckedAt: string; // ISO, updated every run this contact is touched\n lastSentAt?: string | null; // v1.2 — ISO of the last successful send to this contact (min-gap pacing)\n // v1.4 — R24: monetaryValue was read on every opportunity and thrown away, while the one question\n // the client judges a report by is \"how much revenue did that produce\". Captured at exit.\n exitValue?: number | null; // monetaryValue of the opportunity that ended the sequence\n exitStepsSent?: number | null; // how many messages they had received when they converted\n lastSentStepId?: string | null; // v1.4 — R23: the step ID, so editing copy cannot silently re-point anyone\n // v1.7 — slow track. Optional so pre-v1.7 blobs deserialize untouched; readers default them.\n slowAnchorAt?: string | null; // ISO — when the contact entered the slow track (21-day completion)\n lastSlowStepSent?: number; // count of slow-track messages sent (weekly+fortnightly+monthly)\n};\n\nfunction freshState(enteredAt: string): PuppyState {\n return {\n status: \"main\", enteredAt, lastMainStepSent: 0, branchAnchorAt: null,\n lastBranchStepSent: 0, pausedForReplyAt: null, exitReason: null, lastCheckedAt: enteredAt,\n lastSentAt: null, exitValue: null, exitStepsSent: null, lastSentStepId: null,\n slowAnchorAt: null, lastSlowStepSent: 0, ...FRESH_FAILURE_FIELDS,\n };\n}\n\n// ---- pure helpers: timing, merge fields, rendering ------------------------------------------------\n\nfunction isDue(offsetHours: number, anchorIso: string, nowMs: number): boolean {\n return nowMs >= new Date(anchorIso).getTime() + offsetHours * HOUR_MS;\n}\n\n// v1.1 — business-local wall clock for a UTC instant. Intl with an explicit timeZone is deterministic\n// and DST-correct on both Deno and Node; no date library needed for two fields.\nfunction businessLocalParts(nowMs: number): { hour: number; weekday: string } {\n const parts = new Intl.DateTimeFormat(\"en-US\", {\n timeZone: BUSINESS_TZ,\n hour12: false,\n hour: \"2-digit\",\n weekday: \"short\",\n }).formatToParts(new Date(nowMs));\n const get = (t: string) => parts.find((p) => p.type === t)?.value ?? \"\";\n // Intl gives \"24\" for midnight under hour12:false+2-digit in some engines; normalize to 0.\n const hour = Number(get(\"hour\")) % 24;\n return { hour, weekday: get(\"weekday\") };\n}\n\n// v1.1 — send-window gate (header addendum #3). Pure given (nowMs, channel); env knobs are read once\n// at module load. Emails are allowed any day inside the hour window; SMS additionally respects the\n// closed-on-Sundays business identity unless SMS_SUNDAY_OK.\nfunction inSendWindow(channel: Channel, nowMs: number): { ok: boolean; reason: string } {\n const start = sendWindowStartHour();\n const end = sendWindowEndHour();\n const { hour, weekday } = businessLocalParts(nowMs);\n if (hour < start || hour >= end) {\n return { ok: false, reason: `outside ${start}:00–${end}:00 ${BUSINESS_TZ} (local hour ${hour})` };\n }\n if (channel === \"sms\" && weekday === \"Sun\" && !smsSundayOk()) {\n return { ok: false, reason: \"no SMS on Sundays (business closed)\" };\n }\n return { ok: true, reason: \"\" };\n}\n\ntype RenderedMessage =\n | { channel: \"email\"; subject: string; html: string }\n | { channel: \"sms\"; text: string };\n\n// Appended to every rendered message. Kept as constants so the wording is in exactly one place.\nconst SMS_OPTOUT = \"\\n\\nReply STOP to stop these texts.\";\nconst EMAIL_OPTOUT =\n \"\\n\\n---\\nYou're getting this because you inquired with The Dogs Spot. \" +\n \"Reply UNSUBSCRIBE and we'll take you off these emails.\\n\" +\n \"The Dogs Spot, 643 Pleasant Hill Church Rd, Ellabell, GA 31308\";\n\nfunction renderStep(\n step: MessageTemplate,\n contact: { firstName: string | null | undefined; companyName: string | null | undefined },\n opts: { testMode: boolean },\n): RenderedMessage {\n const prefix = opts.testMode ? \"[TEST] \" : \"\";\n // v1.8 — story slots resolve before merge fields; a null slot leaves no trace.\n const resolvedBody = applyMergeFields(resolveStories(step.bodyTemplate), contact.firstName, contact.companyName);\n\n // ---- v1.4 (2 Aug) — OPT-OUT FURNITURE, appended at render time, never written into the c\n // (full note moved to NOTES-v1.4.md when this file hit val.town's 80,000-char ceiling)\n if (step.channel === \"email\") {\n const resolvedPreview = step.previewText\n ? applyMergeFields(step.previewText, contact.firstName, contact.companyName)\n : undefined;\n return {\n channel: \"email\",\n subject: prefix + applyMergeFields(step.subject ?? \"\", contact.firstName, contact.companyName),\n html: bodyToHtml(resolvedBody + EMAIL_OPTOUT, resolvedPreview),\n };\n }\n return { channel: \"sms\", text: prefix + resolvedBody + SMS_OPTOUT };\n}\n\n// ---- facts / decision types -------------------------------------------------------------------\n\ntype ApptFact = {\n id: string;\n startTime: number; // epoch ms\n endTime: number; // epoch ms\n appointmentStatus: string;\n deleted: boolean;\n};\n\ntype OppFact = {\n id: string;\n pipelineId: string;\n pipelineStageId: string;\n monetaryValue: number;\n status: string;\n};\n\ntype ContactFact = {\n id: string;\n firstName: string;\n companyName: string | null;\n dnd: boolean;\n noEmail?: boolean; // R37: contact has no email address at all; email steps skip DELIBERATELY\n noPhone?: boolean; // R39: same, for SMS. Its absence was the spin. See reachability.ts.\n};\n\ntype Facts = {\n now: number;\n contact: ContactFact;\n opportunities: OppFact[];\n pupTalkAppt: ApptFact | null;\n declinedSignal: boolean;\n hasUnansweredInboundReply: boolean;\n conversationCheckFailed: boolean;\n // v1.5 R27 — epoch ms of the newest outbound message on this contact's thread that this engine did\n // NOT send, or null when there is none / it cannot be told apart from ours. See sendGate.\n foreignOutboundAt: number | null;\n // v1.6 R28 — per-channel consent, read from GHL's dndSettings. true = this channel is opted out.\n channelBlocked: { email: boolean; sms: boolean };\n optOutRequested?: boolean; // R39 — an inbound body matched an opt-out keyword. reachability.ts.\n};\n\ntype Decision =\n | { kind: \"hard_exit\"; status: \"done_hard_exit\" | \"done_customer\" | \"done_booked\" | DeadLetterStatus; reason: string }\n | { kind: \"pause_reply\"; isNewPause: boolean }\n | { kind: \"advance_status\"; status: \"awaiting_appt_outcome\" | \"branch_a\" | \"branch_b\" | \"slow_track\"; branchAnchorAt?: string }\n | { kind: \"soft_exit_21d\" }\n | { kind: \"branch_complete\" }\n | { kind: \"send\"; sequence: \"main\" | \"branch_a\" | \"branch_b\" | \"slow\"; stepIndex: number }\n | { kind: \"skip_step\"; sequence: \"main\" | \"branch_a\" | \"branch_b\" | \"slow\"; stepIndex: number; reason: string }\n | { kind: \"skip\"; reason: string };\n\n// v1.7 — slow template for a progression index AT a moment. Weekly/fortnightly fixed by index;\n// monthly picked by the send's calendar month (July=heat, Dec=holidays — as promised to Kim).\n// Shared by decideAction AND the executor so decided and sent templates cannot drift.\nfunction slowTemplateAt(sentCount: number, nowMs: number, lastSentId?: string | null): { tpl: MessageTemplate; offsetHours: number; phase: string } {\n // v1.7.1 — clamp garbage counters (NaN/negative/string blobs) instead of letting an out-of-range\n // index fall through to \"send monthly now\"; monthly fallback only ever fires in the monthly phase.\n const clean = Math.max(0, Math.floor(Number(sentCount)) || 0);\n const n = nextSlowTouch(clean);\n const tpl = n.phase === \"monthly\" ? monthlyTemplateAvoidingRepeat(new Date(nowMs), lastSentId) : n.template!;\n return { tpl, offsetHours: n.offsetHours, phase: n.phase };\n}\n\nfunction pickPrimaryOpportunity(opps: OppFact[]): OppFact | null {\n return opps.find((o) => o.pipelineId === MAIN_PIPELINE_ID) ?? opps[0] ?? null;\n}\n\n// \"Live\" = not cancelled, not invalid, not soft-deleted. Anything else (new / confirmed / showed /\n// noshow) counts as \"they booked\" for rule 6's purposes — the outcome gets sorted out by rules 7/8.\nfunction apptIsLiveBooked(appt: ApptFact | null): boolean {\n if (!appt || appt.deleted) return false;\n return appt.appointmentStatus !== \"cancelled\" && appt.appointmentStatus !== \"invalid\";\n}\n\n// ---- the core state machine (spec §5). Pure, first-match-wins, same order every pass. NOTES v1.10.\nfunction channelBar(f: Facts, ch: \"email\" | \"sms\"): string | null {\n const gone = missingChannel(f.contact, ch); // R37/R39: no address at all, either channel\n if (gone) return gone;\n if (f.channelBlocked[ch]) return `opted out of ${ch}`;\n return null;\n}\n\nfunction decideAction(f: Facts, s: PuppyState): Decision {\n // Rule 1 + 2 — DND / unsubscribed. Top-level `dnd` = full opt-out, hard exit here. Since v1.6\n // (R28) per-channel opt-outs in `dndSettings` are ALSO read — not here, but as f.channelBlocked,\n // which skip-consumes steps on a blocked channel while the other channel carries on. Both layers\n // are live; this rule is the total-stop one.\n if (f.contact.dnd) {\n return { kind: \"hard_exit\", status: \"done_hard_exit\", reason: \"dnd\" };\n }\n\n // Rules 1b/1c (v1.9) — said stop in words / no way to reach them at all. BELOW rule 1 and ABOVE\n // rule 3, deliberately; both orderings are pinned by tests. Full reasoning in reachability.ts.\n { const rx = reachabilityExit(f); if (rx) return rx; }\n\n const primaryOpp = pickPrimaryOpportunity(f.opportunities);\n\n // Rule 3 — Disqualified stage (human override, outranks everything below it).\n if (primaryOpp?.pipelineStageId === STAGE.DISQUALIFIED) {\n return { kind: \"hard_exit\", status: \"done_hard_exit\", reason: \"disqualified\" };\n }\n\n // Rule 4 — became a paying customer. v1.2: scans ALL opportunities, not just primary (fuzz\n // round finding; full note in NOTES-v1.4.md).\n const becameCustomer = f.opportunities.some(\n (o) => o.pipelineStageId === STAGE.CUSTOMER || o.pipelineStageId === STAGE.WON_PAID || o.monetaryValue > 0,\n );\n if (becameCustomer) {\n return { kind: \"hard_exit\", status: \"done_customer\", reason: \"became a customer\" };\n }\n\n // Rule 4b — booked something else entirely (Free Training Day). NOT an explicit numbered r\n // (full note moved to NOTES-v1.4.md when this file hit val.town's 80,000-char ceiling)\n if (primaryOpp?.pipelineStageId === STAGE.FREE_TRAINING_DAY) {\n return { kind: \"hard_exit\", status: \"done_booked\", reason: \"booked Free Training Day — sequence ends per writing sheet §4\" };\n }\n\n // Rule 5 — inbound reply pending, or: couldn't check at all (fail closed — see header gap #1).\n // conversationCheckFailed must be checked BEFORE hasUnansweredInboundReply: an unreadable signal is\n // never treated as \"confirmed no reply,\" because that would let sends continue for someone who may\n // well have replied — exactly the failure this rule exists to prevent.\n if (f.conversationCheckFailed) {\n return { kind: \"skip\", reason: \"conversation check failed (live API scope gap) — not sending until resolved\" };\n }\n if (f.hasUnansweredInboundReply) {\n // \"First match wins\" still applies every run, so this keeps matching (and keeps blocking rule 10)\n // for as long as the reply sits unanswered — but the SIDE EFFECT (timestamping the pause, creating\n // a task) only happens the first time, guarded by isNewPause. Otherwise every run would create a\n // fresh duplicate task for the same unanswered reply.\n return { kind: \"pause_reply\", isNewPause: s.status !== \"paused_reply\" };\n }\n\n // Rule 6 — a live Pup Talk booking -> awaiting_appt_outcome. Scoped to the Pup Talk calendar\n // (branch copy is Pup-Talk-specific; FTD handled by 4b; full note in NOTES-v1.4.md).\n // v1.7.1 — the slow arm requires the appointment to POSTDATE slow entry (mirrors 6b): a stale\n // historical appointment must not yank a taper contact into branch copy.\n if (s.status === \"main\" && apptIsLiveBooked(f.pupTalkAppt)) {\n return { kind: \"advance_status\", status: \"awaiting_appt_outcome\" };\n }\n if (\n s.status === \"slow_track\" && f.pupTalkAppt && apptIsLiveBooked(f.pupTalkAppt) &&\n f.pupTalkAppt.startTime > new Date(s.slowAnchorAt ?? s.enteredAt).getTime()\n ) {\n return { kind: \"advance_status\", status: \"awaiting_appt_outcome\" };\n }\n\n // Rule 6b (v1.2) — REBOOKED while in a branch. Found independently by the adversarial revi\n // (full note moved to NOTES-v1.4.md when this file hit val.town's 80,000-char ceiling)\n if (\n (s.status === \"branch_a\" || s.status === \"branch_b\") &&\n f.pupTalkAppt &&\n apptIsLiveBooked(f.pupTalkAppt) &&\n s.branchAnchorAt &&\n f.pupTalkAppt.startTime > new Date(s.branchAnchorAt).getTime()\n ) {\n return { kind: \"advance_status\", status: \"awaiting_appt_outcome\" };\n }\n\n // Rule 7 — awaiting -> branch_a (missed): time passed, no show, no cancel. NOTES has the full table.\n if (\n s.status === \"awaiting_appt_outcome\" && s.slowAnchorAt && f.pupTalkAppt &&\n f.pupTalkAppt.appointmentStatus === \"cancelled\"\n ) {\n return { kind: \"advance_status\", status: \"slow_track\" };\n }\n\n if (\n s.status === \"awaiting_appt_outcome\" &&\n f.pupTalkAppt &&\n f.now >= f.pupTalkAppt.endTime &&\n f.pupTalkAppt.appointmentStatus !== \"showed\" &&\n f.pupTalkAppt.appointmentStatus !== \"cancelled\"\n ) {\n return {\n kind: \"advance_status\",\n status: \"branch_a\",\n branchAnchorAt: new Date(f.pupTalkAppt.endTime).toISOString(),\n };\n }\n\n // Rule 8 — awaiting -> branch_b (showed, then declined). declinedSignal NOT CONFIRMED LIVE\n // (header gap #2); branchAnchorAt uses \"now\" per spec's fallback.\n if (\n s.status === \"awaiting_appt_outcome\" &&\n f.pupTalkAppt &&\n f.pupTalkAppt.appointmentStatus === \"showed\" &&\n f.declinedSignal\n ) {\n return { kind: \"advance_status\", status: \"branch_b\", branchAnchorAt: new Date(f.now).toISOString() };\n }\n\n // Rule 9 — 21-day completion. Gated on message 8 having actually SENT, not elapsed time alone\n // (else this outranks rule 10 on the very run msg 8 becomes due and it never sends —\n // NOTES-v1.4.md). Stage never auto-moved; that is Kim's call.\n if (\n s.status === \"main\" &&\n s.lastMainStepSent >= MAIN_SEQUENCE.length &&\n f.now >= new Date(s.enteredAt).getTime() + 21 * DAY_MS\n ) {\n return { kind: \"soft_exit_21d\" };\n }\n\n // Rule 9b — branch exhausted -> done_branch_complete (the type's own terminal; a contact must\n // not sit re-evaluated forever with nothing left to send). NOTES-v1.4.md.\n if (s.status === \"branch_a\" && s.lastBranchStepSent >= BRANCH_A.length) {\n return { kind: \"branch_complete\" };\n }\n if (s.status === \"branch_b\" && s.lastBranchStepSent >= BRANCH_B.length) {\n return { kind: \"branch_complete\" };\n }\n\n // Rule 10 — otherwise, send whatever's next due. v1.1: a due step additionally waits for the send\n // window (inSendWindow). v1.2: and for the per-contact min-gap floor — after an outage, several\n // overdue steps space out ~2h apart instead of one per cron tick. Every deferral leaves state\n // untouched, so a later run simply picks it up.\n const sendGate = (channel: Channel): { ok: boolean; reason: string } => {\n const w = inSendWindow(channel, f.now);\n if (!w.ok) return w;\n if (s.lastSentAt) {\n const gapMs = minSendGapHours() * HOUR_MS;\n const sinceLast = f.now - new Date(s.lastSentAt).getTime();\n // v1.7 — sinceLast >= 0 guard (mirrors R27): a future-dated lastSentAt (clock skew, restored\n // blob) must not freeze the contact until that future date; negative elapsed = ignore the gap.\n if (sinceLast >= 0 && sinceLast < gapMs) {\n return { ok: false, reason: `min send gap (${minSendGapHours()}h) not elapsed — last send ${(sinceLast / HOUR_MS).toFixed(1)}h ago` };\n }\n }\n // v1.9 — exponential backoff after a failed send: 2^failures hours. See reachability.ts.\n { const bo = backoffBar(s, f.now); if (bo) return { ok: false, reason: bo }; }\n // R27 (v1.5) — FOREIGN-SENDER QUIET PERIOD: an outbound newer than ours means another system\n // owns this contact right now; stand down. Fails OPEN. Full rationale: NOTES-v1.4.md.\n if (f.foreignOutboundAt != null) {\n const quietMs = foreignQuietHours() * HOUR_MS;\n const since = f.now - f.foreignOutboundAt;\n if (since >= 0 && since < quietMs) {\n return {\n ok: false,\n reason: `another system messaged this contact ${(since / HOUR_MS).toFixed(1)}h ago — quiet period ${foreignQuietHours()}h`,\n };\n }\n }\n return { ok: true, reason: \"\" };\n };\n if (s.status === \"main\" && s.lastMainStepSent < MAIN_SEQUENCE.length) {\n const step = MAIN_SEQUENCE[s.lastMainStepSent];\n if (isDue(step.offsetHours, s.enteredAt, f.now)) {\n const g = sendGate(step.channel);\n if (!g.ok) return { kind: \"skip\", reason: `main #${s.lastMainStepSent + 1} due but deferred: ${g.reason}` };\n const br = channelBar(f, step.channel);\n if (br) {\n return { kind: \"skip_step\", sequence: \"main\", stepIndex: s.lastMainStepSent, reason: `${br} — step consumed, not sent` };\n }\n return { kind: \"send\", sequence: \"main\", stepIndex: s.lastMainStepSent };\n }\n return { kind: \"skip\", reason: `next main step (#${s.lastMainStepSent + 1}) not due yet` };\n }\n if (s.status === \"branch_a\" && s.lastBranchStepSent < BRANCH_A.length && s.branchAnchorAt) {\n const step = BRANCH_A[s.lastBranchStepSent];\n if (isDue(step.offsetHours, s.branchAnchorAt, f.now)) {\n const g = sendGate(step.channel);\n if (!g.ok) return { kind: \"skip\", reason: `branch A step due but deferred: ${g.reason}` };\n { const br = channelBar(f, step.channel);\n if (br) return { kind: \"skip_step\", sequence: \"branch_a\", stepIndex: s.lastBranchStepSent, reason: `${br} — step consumed, not sent` }; }\n return { kind: \"send\", sequence: \"branch_a\", stepIndex: s.lastBranchStepSent };\n }\n return { kind: \"skip\", reason: \"next branch A step not due yet\" };\n }\n if (s.status === \"branch_b\" && s.lastBranchStepSent < BRANCH_B.length && s.branchAnchorAt) {\n const step = BRANCH_B[s.lastBranchStepSent];\n if (isDue(step.offsetHours, s.branchAnchorAt, f.now)) {\n const g = sendGate(step.channel);\n if (!g.ok) return { kind: \"skip\", reason: `branch B step due but deferred: ${g.reason}` };\n { const br = channelBar(f, step.channel);\n if (br) return { kind: \"skip_step\", sequence: \"branch_b\", stepIndex: s.lastBranchStepSent, reason: `${br} — step consumed, not sent` }; }\n return { kind: \"send\", sequence: \"branch_b\", stepIndex: s.lastBranchStepSent };\n }\n return { kind: \"skip\", reason: \"next branch B step not due yet\" };\n }\n\n // v1.7 — Rule 10s: slow track. Indefinite by design, so no exhaustion exit — the exits are the\n // rules above (reply, booking, customer, DND). Anchor falls back to enteredAt if a legacy blob\n // lands here without slowAnchorAt.\n if (s.status === \"slow_track\") {\n const sentCount = Math.max(0, Math.floor(Number(s.lastSlowStepSent)) || 0);\n const anchor = s.slowAnchorAt ?? s.enteredAt;\n const { tpl, offsetHours, phase } = slowTemplateAt(sentCount, f.now, s.lastSentStepId);\n if (isDue(offsetHours, anchor, f.now)) {\n const g = sendGate(tpl.channel);\n if (!g.ok) return { kind: \"skip\", reason: `slow #${sentCount + 1} (${phase}) due but deferred: ${g.reason}` };\n const sbr = channelBar(f, tpl.channel);\n if (sbr) {\n return { kind: \"skip_step\", sequence: \"slow\", stepIndex: sentCount, reason: `${sbr} — slow step consumed, not sent` };\n }\n return { kind: \"send\", sequence: \"slow\", stepIndex: sentCount };\n }\n return { kind: \"skip\", reason: `next slow touch (#${sentCount + 1}, ${phase}) not due yet` };\n }\n\n return { kind: \"skip\", reason: `status ${s.status} has nothing to evaluate` };\n}\n\n// Pure, no IO. The ONE place PuppyState transitions are written, by cron AND the harness, so tested\n// and shipped behaviour cannot drift. Full note: NOTES-v1.4.md R39.\nfunction applyDecision(decision: Decision, s: PuppyState, nowIso: string): PuppyState {\n const next: PuppyState = { ...s, lastCheckedAt: nowIso };\n switch (decision.kind) {\n case \"hard_exit\":\n next.status = decision.status;\n next.exitReason = decision.reason;\n return next;\n case \"pause_reply\":\n next.status = \"paused_reply\";\n if (decision.isNewPause) {\n next.pausedForReplyAt = nowIso;\n next.exitReason = \"human reply pending\";\n }\n return next;\n case \"advance_status\":\n next.status = decision.status;\n if (decision.branchAnchorAt) next.branchAnchorAt = decision.branchAnchorAt;\n // v1.2 — a branch always restarts at its first message. Why: NOTES-v1.4.md R39.\n if (decision.status === \"branch_a\" || decision.status === \"branch_b\") next.lastBranchStepSent = 0;\n // v1.7.1 — returning to slow_track (cancelled booking) keeps slowAnchorAt and\n // lastSlowStepSent untouched: the taper resumes where it left off.\n return next;\n case \"soft_exit_21d\":\n // v1.7 — 21-day completion now hands the contact to the slow track (Kim's taper);\n // done_soft_21d remains in the type for legacy blobs only.\n next.status = \"slow_track\";\n next.slowAnchorAt = nowIso;\n next.lastSlowStepSent = 0;\n next.exitReason = \"21-day sequence complete — moved to slow track\";\n return next;\n case \"branch_complete\":\n next.status = \"done_branch_complete\";\n next.exitReason = \"branch sequence complete, no reply\";\n return next;\n case \"send\":\n if (decision.sequence === \"main\") next.lastMainStepSent = s.lastMainStepSent + 1;\n else if (decision.sequence === \"slow\") next.lastSlowStepSent = (s.lastSlowStepSent ?? 0) + 1;\n else next.lastBranchStepSent = s.lastBranchStepSent + 1;\n next.lastSentAt = nowIso; // v1.2 — feeds the min-gap pacing floor\n return next;\n case \"skip_step\":\n // v1.6 R28 — the step is consumed, not deferred. Deferring a step whose channel the contact\n // has opted out of would stall that contact forever on a message that can never legally send.\n // lastSentAt is deliberately NOT set: nothing went out, so nothing should start the pacing clock.\n if (decision.sequence === \"main\") next.lastMainStepSent = s.lastMainStepSent + 1;\n else if (decision.sequence === \"slow\") next.lastSlowStepSent = (s.lastSlowStepSent ?? 0) + 1;\n else next.lastBranchStepSent = s.lastBranchStepSent + 1;\n return next;\n case \"skip\":\n return next;\n }\n}\n\n// ---- IO layer: GHL fetch helper (identical shape to the PupsClub val) -----------------------------\n\nasync function j(url: string, ver: string, init?: RequestInit) {\n const tok = await resolveToken(); // v1.2 — env var, else private puppy_config blob (see header note)\n const r = await fetch(url, {\n ...init,\n headers: {\n Authorization: `Bearer ${tok}`,\n Version: ver,\n \"Content-Type\": \"application/json\",\n ...(init?.headers ?? {}),\n },\n });\n if (!r.ok) throw new Error(`${r.status} ${url.split(\"?\")[0]} ${(await r.text()).slice(0, 200)}`);\n return r.json();\n}\n\n// ---- blob state (dynamic import, see Node/tsx shim note above) ------------------------------------\n\nasync function getBlobModule() {\n // Dynamic, not static, so this file's pure logic imports under Node+tsx. Why: NOTES-v1.4.md R39.\n // @ts-expect-error — remote Deno URL specifier; unresolvable (by design) under tsc/Node's module\n // resolution, only ever actually imported at runtime inside a real Deno/val.town environment.\n const mod = await import(\"https://esm.town/v/std/blob\");\n return (mod as any).blob;\n}\n\nasync function loadAllState(): Promise> {\n const blob = await getBlobModule();\n return (await blob.getJSON(\"puppy_state\").catch(() => null)) ?? {};\n}\nasync function saveAllState(state: Record) {\n const blob = await getBlobModule();\n await blob.setJSON(\"puppy_state\", state);\n}\n// v1.8.2. Each run records its own timestamp so the dashboard can report the cadence it OBSERVES\n// rather than one a human typed. See cadence.ts for why, and for the shared shape.\nasync function saveReport(report: any) {\n const blob = await getBlobModule();\n let history: string[] = [];\n try {\n history = appendRunStamp(await blob.getJSON(\"puppy_run_state\").catch(() => null),\n typeof report?.ts === \"string\" ? report.ts : new Date().toISOString());\n } catch { /* bookkeeping is a nicety; never fail a run over it */ }\n await blob.setJSON(\"puppy_run_state\", { ...(report as object), history });\n}\nasync function saveLastError(err: unknown) {\n const blob = await getBlobModule();\n await blob.setJSON(\"puppy_last_error\", err);\n}\n\n// ---- v1.1: journal + summary ----------------------------------------------------------------------\n\ntype JournalRow = { ts: string; contactId: string | null; event: string; detail: string; test?: boolean };\n\n// Appends this run's rows and returns the full merged journal (capped at the newest 2000 rows) so the\n// caller can build the summary from complete history without a second blob read.\nasync function appendJournal(rows: JournalRow[]): Promise {\n const blob = await getBlobModule();\n const existing: JournalRow[] = (await blob.getJSON(\"puppy_journal\").catch(() => null)) ?? [];\n const merged = [...existing, ...rows].slice(-2000);\n if (rows.length) await blob.setJSON(\"puppy_journal\", merged);\n return merged;\n}\n\n// Pure — aggregate the numbers Kim's eventual 30-day report needs. Journal-derived counts\n// (bookedDuringPath, customersDuringPath, sendsByStep) survive state pruning; state-derived counts\n// reflect the current population.\nfunction buildSummary(\n state: Record,\n journal: JournalRow[],\n lastRun: { at: string; testMode: boolean; sent: number; failed: number; enrolled: number },\n) {\n const byStatus: Record = {};\n for (const s of Object.values(state)) byStatus[s.status] = (byStatus[s.status] ?? 0) + 1;\n const sendsByStep: Record = {};\n let bookedDuringPath = 0;\n let customersDuringPath = 0;\n let pausedForHuman = 0;\n let surgeHolds = 0;\n for (const r of journal) {\n if (r.event === \"sent\") sendsByStep[r.detail] = (sendsByStep[r.detail] ?? 0) + 1;\n else if (r.event === \"advance_status\" && r.detail === \"awaiting_appt_outcome\") bookedDuringPath++;\n else if (r.event === \"hard_exit\" && r.detail === \"became a customer\") customersDuringPath++;\n else if (r.event === \"pause_reply\") pausedForHuman++;\n else if (r.event === \"enrollment_surge_hold\") surgeHolds++;\n }\n return {\n at: lastRun.at,\n v: \"1.2\",\n lastRun,\n activeByStatus: byStatus,\n totalTracked: Object.keys(state).length,\n sendsByStep,\n bookedDuringPath,\n customersDuringPath,\n pausedForHuman,\n surgeHolds,\n ...failureCounts(journal, byStatus), // v1.9 — send_failed was journalled and counted by nothing\n };\n}\n\nasync function saveSummary(summary: unknown) {\n const blob = await getBlobModule();\n await blob.setJSON(\"puppy_summary\", summary);\n}\n\n// Pure — v1.1 state hygiene: drop terminal entries untouched for 60+ days. History stays in the\n// journal; the puppy-path-v1 tag still prevents re-enrollment of a pruned contact.\nfunction pruneState(state: Record, nowMs: number): { kept: Record; prunedIds: string[] } {\n const kept: Record = {};\n const prunedIds: string[] = [];\n for (const [id, s] of Object.entries(state)) {\n const stale = TERMINAL_STATUSES.has(s.status) && nowMs - new Date(s.lastCheckedAt).getTime() > 60 * DAY_MS;\n if (stale) prunedIds.push(id);\n else kept[id] = s;\n }\n return { kept, prunedIds };\n}\n\n// Pure — v1.1 enrollment gate (header addendum #1/#2). Given this run's un-enrolled tag matches,\n// decide who enrolls. Over-threshold = bulk-tag accident suspected: enroll nobody, hold until a human\n// clears it (ACKNOWLEDGE_SURGE=true) or the candidate count drops back under the threshold.\nfunction selectEnrollable(\n candidates: T[],\n surgeThreshold: number,\n surgeAcknowledged: boolean,\n): { enroll: T[]; surgeHeld: boolean } {\n if (candidates.length > surgeThreshold && !surgeAcknowledged) {\n return { enroll: [], surgeHeld: true };\n }\n return { enroll: candidates, surgeHeld: false };\n}\n\n// ---- IO layer: GHL reads --------------------------------------------------------------------------\n\nasync function getContact(contactId: string): Promise {\n const r = await j(`${GHL}/contacts/${contactId}`, \"2021-07-28\");\n return r.contact;\n}\n\nasync function getOpenOpportunities(contactId: string): Promise {\n const r = await j(`${GHL}/opportunities/search?location_id=${LOC}&contact_id=${contactId}&limit=10`, \"2021-07-28\");\n return (r.opportunities ?? []).map((o: any) => ({\n id: o.id,\n pipelineId: o.pipelineId,\n pipelineStageId: o.pipelineStageId,\n monetaryValue: o.monetaryValue ?? 0,\n status: o.status,\n }));\n}\n\n// ---- v1.3 (2 Aug 2026) — R19: THE ENROLMENT-SCAN QUOTA FIX -----------------------------\n// (full note moved to NOTES-v1.4.md when this file hit val.town's 80,000-char ceiling)\nconst EXIT_STAGES = [\n \"fd821b4e-bbe6-44de-b754-fa80e4823616\", // Customer\n \"ae173310-f8b1-4399-acb7-ef1fc03d3697\", // Won - Paid\n \"38826f17-1d0e-4bac-b53e-349b67c2c79d\", // Disqualified\n \"43ea02b4-529b-4063-b638-447414d603d2\", // Free Training Day\n];\n\nasync function fetchExitOppIndex(): Promise | null> {\n const index = new Map();\n try {\n for (const stage of EXIT_STAGES) {\n let after: any = null, afterId: any = null, pages = 0;\n while (pages < 12) { // hard ceiling: a runaway page-walk must never be the thing that breaks a run\n let u = `${GHL}/opportunities/search?location_id=${LOC}&pipeline_id=${MAIN_PIPELINE_ID}` +\n `&pipeline_stage_id=${stage}&limit=100`;\n if (after != null) u += `&startAfter=${after}&startAfterId=${afterId}`;\n const r = await j(u, \"2021-07-28\");\n const ops = r.opportunities ?? [];\n if (!ops.length) break;\n for (const o of ops) {\n if (!o.contactId) continue;\n const fact: OppFact = {\n id: o.id,\n pipelineId: o.pipelineId,\n pipelineStageId: o.pipelineStageId,\n monetaryValue: o.monetaryValue ?? 0,\n status: o.status,\n };\n const prev = index.get(o.contactId);\n if (prev) prev.push(fact); else index.set(o.contactId, [fact]);\n }\n pages++;\n after = r.meta?.startAfter; afterId = r.meta?.startAfterId;\n if (!after) break;\n }\n }\n return index;\n } catch {\n // Fail to null, never to an empty map. An empty map would read as \"nobody is a customer\" and\n // could enrol someone who has already bought — the exact mistake this check exists to prevent.\n // Null makes the caller fall back to the per-contact read it used before.\n return null;\n }\n}\n\n// v1.1 (header addendum #5): the Pup Talk calendar's ±90d window holds ~143 events (measured live\n// 27 Jul); fetching it per contact re-downloaded all of them for every active contact every run.\n// Now: one fetch per run, indexed by contactId, latest non-deleted event per contact.\nasync function fetchPupTalkApptIndex(): Promise> {\n const now = Date.now();\n const windowStart = now - 90 * DAY_MS; // look back far enough to still catch a recently-missed appt\n const windowEnd = now + 90 * DAY_MS;\n const r = await j(\n `${GHL}/calendars/events?locationId=${LOC}&calendarId=${PUP_TALK_CALENDAR_ID}&startTime=${windowStart}&endTime=${windowEnd}`,\n \"2021-04-15\",\n );\n const index = new Map();\n for (const e of r.events ?? []) {\n if (!e.contactId || e.deleted) continue;\n const fact: ApptFact = {\n id: e.id,\n startTime: new Date(e.startTime).getTime(),\n endTime: new Date(e.endTime).getTime(),\n appointmentStatus: e.appointmentStatus,\n deleted: !!e.deleted,\n };\n const prev = index.get(e.contactId);\n if (!prev || fact.startTime > prev.startTime) index.set(e.contactId, fact);\n }\n return index;\n}\n\n// See header gap #1. Fails closed: any error, or a response shape this code doesn't recognize, is\n// reported as conversationCheckFailed=true — never silently treated as \"no reply.\"\nasync function getReplyStatus(\n contactId: string,\n enteredAtIso: string,\n st?: PuppyState,\n): Promise {\n // v1.5 R27: lastOutboundAt rides along on the SAME request that rule 5 already makes — the collision\n // guard costs zero extra API calls. It is the conversation's own lastMessageDate, returned only when\n // that last message was outbound; the caller decides whether it was ours.\n let lastOutboundAt: number | null = null;\n try {\n const r = await j(`${GHL}/conversations/search?locationId=${LOC}&contactId=${contactId}&limit=1`, \"2021-07-28\");\n const convo = (r.conversations ?? [])[0];\n if (!convo) return { hasUnansweredInboundReply: false, conversationCheckFailed: false, lastOutboundAt };\n // v1.9 — opt-out words + delivery status, hung off the conversation this call already fetched.\n const rx = await convoExtras(convo, st, j, GHL, Date.now());\n {\n const d = convo.lastMessageDirection ?? convo.direction ?? null;\n const ts = convo.lastMessageDate ?? convo.lastMessageDateTime ?? null;\n if (d === \"outbound\" && ts != null) {\n const n = new Date(ts).getTime();\n if (!Number.isNaN(n)) lastOutboundAt = n;\n }\n }\n // Field name NOT independently proven this session (the 401 blocked confirming it) — tryin\n // (full note moved to NOTES-v1.4.md when this file hit val.town's 80,000-char ceiling)\n const direction = convo.lastMessageDirection ?? convo.direction ?? null;\n if (direction !== \"inbound\" && direction !== \"outbound\") {\n return { hasUnansweredInboundReply: false, conversationCheckFailed: true, lastOutboundAt, ...rx };\n }\n // v1.4 R21 — unreadCount is the second signal; outbound does not clear it. NOTES-v1.4.md R21.\n const unread = Number(convo.unreadCount ?? 0);\n if (direction === \"outbound\") {\n if (unread > 0) {\n return { hasUnansweredInboundReply: true, conversationCheckFailed: false, lastOutboundAt, ...rx };\n }\n return { hasUnansweredInboundReply: false, conversationCheckFailed: false, lastOutboundAt, ...rx };\n }\n const lastTsRaw = convo.lastMessageDate ?? convo.lastMessageDateTime ?? convo.dateUpdated ?? null;\n const lastTs = lastTsRaw != null ? new Date(lastTsRaw).getTime() : NaN;\n if (!Number.isNaN(lastTs) && lastTs < new Date(enteredAtIso).getTime()) {\n // Pre-enrollment history — EXCEPT if it is still unread, in which case somebody wrote in and\n // nobody has answered them, which outranks how old it is.\n if (Number(convo.unreadCount ?? 0) > 0) return { hasUnansweredInboundReply: true, conversationCheckFailed: false, lastOutboundAt, ...rx };\n return { hasUnansweredInboundReply: false, conversationCheckFailed: false, lastOutboundAt, ...rx };\n }\n return { hasUnansweredInboundReply: true, conversationCheckFailed: false, lastOutboundAt, ...rx };\n } catch {\n return { hasUnansweredInboundReply: false, conversationCheckFailed: true, lastOutboundAt };\n }\n}\n\n// ---- IO layer: GHL writes (all proven live this session, see PUPPY-PATH-TEST-REPORT.md) -----------\n\n// v1.7 hardening (6 Aug): in practice mode the SENDERS THEMSELVES refuse anyone except the one\n// sanctioned test record, so safety no longer rests only on enrollment scoping upstream. Fails\n// closed: until resolveTestDummy() has run and set this, practice mode can send to nobody at all.\nlet SANCTIONED_TEST_CONTACT: string | null = null;\nfunction assertSendAllowed(contactId: string, channel: string) {\n if (TEST_MODE && contactId !== SANCTIONED_TEST_CONTACT) {\n throw new Error(`practice mode: refusing ${channel} to ${contactId}; only the sanctioned test record may be messaged`);\n }\n}\n\nasync function sendSms(contactId: string, text: string) {\n assertSendAllowed(contactId, \"sms\");\n // Proven shape, copied verbatim from the PupsClub val, which sends real SMS in production today.\n return j(`${GHL}/conversations/messages`, \"2021-04-15\", {\n method: \"POST\",\n body: JSON.stringify({ type: \"SMS\", contactId, message: text }),\n });\n}\n\nasync function sendEmail(contactId: string, subject: string, html: string) {\n assertSendAllowed(contactId, \"email\");\n // Shape + response (incl. emailMessageId) verified live 27 Jul; full note NOTES-v1.4.md R39.\n return j(`${GHL}/conversations/messages`, \"2021-04-15\", {\n method: \"POST\",\n body: JSON.stringify({ type: \"Email\", contactId, subject, html }),\n });\n}\n\nasync function addTag(contactId: string, tag: string) {\n // Additive, verified live; upsert deliberately not used. Full note: NOTES-v1.4.md R39.\n return j(`${GHL}/contacts/${contactId}/tags`, \"2021-07-28\", {\n method: \"POST\",\n body: JSON.stringify({ tags: [tag] }),\n });\n}\n\nasync function createTask(contactId: string, title: string, body: string) {\n // Shape verified live; assignedTo omitted, no confirmed user id. Full note: NOTES-v1.4.md R39.\n return j(`${GHL}/contacts/${contactId}/tasks`, \"2021-07-28\", {\n method: \"POST\",\n body: JSON.stringify({ title, body, dueDate: new Date().toISOString(), completed: false }),\n });\n}\n\nasync function resolveTestDummy(): Promise<{ id: string; firstName: string; companyName: string | null }> {\n // TEST_MODE's one sanctioned contact (spec §8). +10000000000 is not a working number in any real\n // numbering plan — chosen specifically so an accidental SMS send during testing cannot reach a real\n // person, while still being a syntactically valid phone value GHL will accept on a contact record.\n const up = await j(`${GHL}/contacts/upsert`, \"2021-07-28\", {\n method: \"POST\",\n body: JSON.stringify({\n locationId: LOC,\n firstName: \"ZZTEST\",\n lastName: \"PuppyPath-Dummy\",\n email: \"aizhigitovamir@gmail.com\",\n phone: \"+10000000000\",\n }),\n });\n const c = up.contact;\n SANCTIONED_TEST_CONTACT = c.id;\n return { id: c.id, firstName: c.firstName, companyName: c.companyName ?? null };\n}\n\n// ---- orchestration: cron() (default export — the val.town entry point) ----------------------------\n\nexport default async function cron() {\n // R38: re-resolved first so every later read this pass agrees. See NOTES R38.\n TEST_MODE = resolveMode(Deno.env.get(\"TEST_MODE\"), await (await getBlobModule()).getJSON(\"puppy_mode\").catch(() => null));\n const out: any = {\n ok: true,\n v: \"1.10.0\", // reachability/dead letters/opt-out honoured, re-enrolment, refusal repeat. NOTES v1.10\n\n ts: new Date().toISOString(), // v1.2 — lets the watchdog's staleness check actually work\n testMode: TEST_MODE,\n enrolled: 0,\n sent: 0,\n failed: 0,\n skipped: 0,\n log: [] as string[],\n };\n const journal: JournalRow[] = [];\n const jrow = (contactId: string | null, event: string, detail: string) =>\n journal.push({ ts: new Date().toISOString(), contactId, event, detail, ...(TEST_MODE ? { test: true } : {}) });\n\n // v1.2 — best-effort run lock. Blob storage has no compare-and-swap, so this can't be a perfect\n // mutex, but it shrinks the overlap window (manual trigger colliding with the schedule, or a slow\n // run) from \"the whole run\" to milliseconds. A lock older than RUN_LOCK_TTL_MS is a dead run's\n // leftovers and is ignored.\n const blob = await getBlobModule();\n\n // ---- KILL SWITCH (v1.3). Checked first; fails OPEN. Full note in NOTES-v1.4.md.\n try {\n const kill = await blob.getJSON(\"nurture_kill\").catch(() => null);\n if (kill?.stopped) {\n out.ok = true;\n out.killed = true;\n out.log.push(`STOPPED by kill switch (set ${kill.at ?? \"unknown\"}) — no contact examined this tick`);\n await blob.setJSON(\"puppy_run_state\", out).catch(() => {});\n console.log(\"PUPPYPATH\", JSON.stringify(out));\n return out;\n }\n } catch { /* fail open — see note above */ }\n\n const lock = await blob.getJSON(\"puppy_run_lock\").catch(() => null);\n if (lock?.startedAt && Date.now() - new Date(lock.startedAt).getTime() < RUN_LOCK_TTL_MS) {\n out.log.push(`another run appears active (lock from ${lock.startedAt}) — skipping this tick`);\n console.log(\"PUPPYPATH\", JSON.stringify(out));\n return out;\n }\n await blob.setJSON(\"puppy_run_lock\", { startedAt: new Date().toISOString() }).catch(() => {});\n\n try {\n const state = await loadAllState();\n // v1.2 — existing journal loaded up front: the daily send cap counts today's already-journaled\n // live sends, so the ceiling holds across runs, not just within one.\n const priorJournal: JournalRow[] = (await blob.getJSON(\"puppy_journal\").catch(() => null)) ?? [];\n const todayPrefix = new Date().toISOString().slice(0, 10);\n let sentToday = priorJournal.filter(\n (r) => (r.event === \"sent\" || r.event === \"send_failed\") && r.ts.slice(0, 10) === todayPrefix && !r.test,\n ).length; // v1.9 — ATTEMPTS, not successes: failures were uncapped and cost the same GHL calls\n // v1.1 (addendum #5): one calendar fetch per run, shared by enrollment guard + per-contact facts.\n // R33: wrapped; one 401 used to abort the whole run before any contact was seen.\n let apptIndex: Map;\n try {\n apptIndex = await fetchPupTalkApptIndex();\n } catch (e) {\n apptIndex = new Map();\n out.log.push(`appt index unavailable, continuing without it: ${String((e as Error)?.message ?? e).slice(0, 120)}`);\n }\n let contactIds: string[];\n // v1.2 — opportunities fetched during enrollment eligibility are reused when the same contact is\n // processed later in this run, instead of a redundant second API call.\n const oppsCache = new Map();\n let skippedNotDue = 0; // v1.4 — how many contacts cost zero API calls this run\n // v1.9 — the effects the reachability helpers write through. task is null in practice mode.\n const fctx: Effects = { state, save: saveAllState, log: (l) => out.log.push(l), journal: jrow, task: TEST_MODE ? null : createTask };\n\n // v1.9 — THE DRY TAGGING PASS. Runs in BOTH modes on purpose; applies nothing, ever.\n // Full note, including why it was dead for three deploys: NOTES-v1.4.md, \"the dry tagging pass\".\n try {\n const recent = await j(`${GHL}/contacts/?locationId=${LOC}&limit=100`, \"2021-07-28\");\n await blob.setJSON(\"tag_candidates\", dryScan(recent?.contacts ?? [], new Date().toISOString()));\n } catch { /* a dry scan is never worth failing a run over */ }\n\n if (TEST_MODE) {\n // Spec §8: skip real discovery entirely, operate ONLY on the one sanctioned dummy.\n const dummy = await resolveTestDummy();\n contactIds = [dummy.id];\n if (!state[dummy.id]) {\n state[dummy.id] = freshState(new Date().toISOString());\n await addTag(dummy.id, TAG_ENROLLED).catch((e) =>\n out.log.push(`tag failed on dummy: ${String(e).slice(0, 120)}`)\n );\n out.enrolled++;\n out.log.push(`TEST_MODE: enrolled dummy ${dummy.id}`);\n jrow(dummy.id, \"enrolled\", \"test dummy\");\n }\n } else {\n // v1.1 enrollment: the source tag is the HUMAN enrollment switch. Blocks only what makes\n // enrollment WRONG (existing customer, live booking). DND enforced by rule 1 first pass.\n // Surge hold guards bulk tagging — selectEnrollable. Full note: NOTES-v1.4.md.\n const found = await j(`${GHL}/contacts/search`, \"2021-07-28\", {\n method: \"POST\",\n body: JSON.stringify({\n locationId: LOC,\n pageLimit: 100,\n filters: [{ field: \"tags\", operator: \"contains_set\", value: [TAG_SOURCE_SIGNAL] }],\n }),\n });\n // v1.2 — surface pagination truncation instead of silently ignoring candidates beyond page 1\n // (only reachable when a human pushes a >100 bulk batch through with ACKNOWLEDGE_SURGE).\n const totalTagged = found.total ?? (found.contacts ?? []).length;\n if (totalTagged > (found.contacts ?? []).length) {\n out.log.push(\n `WARNING: ${totalTagged} contacts carry '${TAG_SOURCE_SIGNAL}' but only ${(found.contacts ?? []).length} ` +\n `fit one page — the rest enroll on later runs as earlier ones get the puppy-path-v1 tag`,\n );\n }\n // v1.10 — a dead letter Kim has fixed and re-tagged comes back. reEnrollable, reachability.ts.\n const rawCandidates: any[] = (found.contacts ?? []).filter(\n (c: any) => !(c.tags ?? []).includes(TAG_ENROLLED) && (!state[c.id] || reEnrollable(state[c.id], c)),\n );\n const surgeThreshold = enrollSurgeThreshold();\n const { enroll, surgeHeld } = selectEnrollable(rawCandidates, surgeThreshold, acknowledgeSurge());\n if (surgeHeld) {\n out.log.push(\n `ENROLLMENT SURGE HELD: ${rawCandidates.length} un-enrolled '${TAG_SOURCE_SIGNAL}' contacts found in one run ` +\n `(threshold ${surgeThreshold}) — bulk tagging suspected, enrolling NOBODY until a human clears it ` +\n `(remove the bulk tags, or set ACKNOWLEDGE_SURGE=true). Already-enrolled contacts continue normally.`,\n );\n jrow(null, \"enrollment_surge_hold\", `${rawCandidates.length} candidates vs threshold ${surgeThreshold}`);\n }\n // v1.3 / R19 — one indexed read for the whole candidate set instead of one call each.\n const exitOppIndex = enroll.length ? await fetchExitOppIndex() : null;\n if (enroll.length) {\n out.log.push(\n exitOppIndex\n ? `exit-opp index built (${exitOppIndex.size} contacts across ${EXIT_STAGES.length} stages) — ${enroll.length} candidate(s) screened without per-contact calls`\n : `exit-opp index unavailable — falling back to per-contact reads for ${enroll.length} candidate(s)`,\n );\n }\n for (const c of enroll) {\n let opps: OppFact[];\n if (exitOppIndex) {\n opps = exitOppIndex.get(c.id) ?? [];\n } else {\n await sleep(120); // v1.2 — pacing: GHL fails 401/403 (not 429) over 100 req/10s\n opps = await getOpenOpportunities(c.id);\n }\n oppsCache.set(c.id, opps);\n // Across ALL opportunities, not just primary — spec's \"no opportunity showing Customer/Won-Paid\"\n // reading, and the account's own one-opportunity-per-contact rule makes this a cheap superset.\n const alreadyCustomer = opps.some(\n (o) => o.pipelineStageId === STAGE.CUSTOMER || o.pipelineStageId === STAGE.WON_PAID || o.monetaryValue > 0,\n );\n if (alreadyCustomer) { // v1.10 — TERMINAL, like the unreachable branch below: rule 4 would\n // hard-exit them on the first pass anyway, and without a state entry this refusal repeated\n // every run forever. NOT done_customer: api.ts counts that as WON. NOTES v1.10.\n state[c.id] = { ...freshState(new Date().toISOString()), status: \"done_not_enrolled\", exitReason: \"already a customer when tagged\" };\n out.log.push(`${c.id}: tagged but already a customer — not enrolled`);\n jrow(c.id, \"enroll_refused\", \"already a customer\");\n continue;\n }\n const appt = apptIndex.get(c.id) ?? null;\n if (appt && apptIsLiveBooked(appt)) { const R = \"live booking already exists\";\n // v1.10 — TRANSIENT: the booking may be cancelled, so this must stay re-evaluated and can\n // get no state entry. The repetition is stopped at the journal instead. NOTES v1.10.\n out.log.push(`${c.id}: tagged but ${R} — not enrolled`);\n if (!refusedBefore(priorJournal, c.id, R)) jrow(c.id, \"enroll_refused\", R);\n continue;\n }\n { const eb = enrolmentBar(c); if (eb) { // v1.9 — unreachable. The terminal entry, NOT the\n // tag (they were never on the path), is what stops this refusal repeating every run.\n state[c.id] = { ...freshState(new Date().toISOString()), status: \"done_unreachable\", exitReason: eb };\n out.log.push(`${c.id}: tagged but ${eb} — not enrolled`); jrow(c.id, \"enroll_refused\", eb); continue; } }\n state[c.id] = freshState(new Date().toISOString());\n await addTag(c.id, TAG_ENROLLED).catch((e) => out.log.push(`tag failed on ${c.id}: ${String(e).slice(0, 120)}`));\n out.enrolled++;\n out.log.push(`enrolled ${c.id}`);\n jrow(c.id, \"enrolled\", `via tag '${TAG_SOURCE_SIGNAL}'`);\n }\n contactIds = Object.keys(state);\n }\n\n for (const contactId of contactIds) {\n let s = state[contactId];\n if (!s || TERMINAL_STATUSES.has(s.status)) continue;\n\n // v1.2 — paused_reply contacts get a LIGHTWEIGHT safety pass instead of v1.1's full skip.\n // (full note moved to NOTES-v1.4.md when this file hit val.town's 80,000-char ceiling)\n if (s.status === \"paused_reply\") {\n // v1.4 R22 — the pause timeout, and why it does not resume: NOTES-v1.4.md R22.\n const pausedSince = s.pausedForReplyAt ? new Date(s.pausedForReplyAt).getTime() : null;\n if (pausedSince && Date.now() - pausedSince > pauseTimeoutDays() * DAY_MS) {\n const days = Math.floor((Date.now() - pausedSince) / DAY_MS);\n try {\n if (!TEST_MODE) {\n await createTask(\n contactId,\n `Still waiting on us — replied ${days} days ago, nobody has answered`,\n `This person replied to a follow-up message ${days} days ago. The sequence stopped for them at the time and raised a task, and that task has not been actioned.\\n\\nOpen Conversations, read what they said, and answer it. They are being taken off the automated follow-up either way — they asked a person a question and they deserve a person's answer.`,\n );\n }\n } catch (e) {\n out.log.push(`${contactId}: pause-timeout task failed: ${String(e).slice(0, 100)}`);\n }\n state[contactId] = {\n ...s,\n status: \"done_hard_exit\",\n exitReason: `paused for ${days} days with no human response — escalated and released`,\n lastCheckedAt: new Date().toISOString(),\n };\n out.log.push(`${contactId}: paused ${days}d with no action — escalated, exited`);\n jrow(contactId, \"pause_timeout\", `${days} days unanswered`);\n continue;\n }\n try {\n await sleep(120);\n const contact = await getContact(contactId);\n if (!contact) continue;\n const opportunities = oppsCache.get(contactId) ?? (await getOpenOpportunities(contactId));\n // v1.10 — the paused STOP. No state arg: nothing to reconcile here. NOTES v1.10.\n const pr = await getReplyStatus(contactId, s.enteredAt);\n const facts: Facts = {\n now: Date.now(),\n contact: { id: contactId, firstName: contact.firstName ?? \"\", companyName: contact.companyName ?? null, dnd: !!contact.dnd, noEmail: !contact.email, noPhone: !contact.phone },\n opportunities,\n pupTalkAppt: apptIndex.get(contactId) ?? null,\n declinedSignal: (contact.tags ?? []).includes(PUP_TALK_DECLINED_TAG),\n hasUnansweredInboundReply: false,\n optOutRequested: pr.optOutRequested, // rule 1b outranks rule 5, so this is still reachable\n conversationCheckFailed: true, // pinned: no send can ever pass rule 5 on this pass\n channelBlocked: readChannelConsent(contact),\n foreignOutboundAt: null, // no conversa\n",[524],"6c09572f-654e-4a8d-8b59-03af0e0883d3","SOURCE-BUNDLE.part7.txt","771fe81c-91b7-11f1-b53b-1607ee4eb77e",1093,["D",1786801897338],"THE DOGS SPOT — SOURCE BUNDLE (part 7 of 40)\n\nEVERY source file in this project, engine/ included. Restoring these parts and nothing else gives\nyou a tree that builds, typechecks and runs its own test suite with no network and no val.\n\nengine/ is here as of 14 Aug 2026. It used to be left out because val 1bfa6e81-74e1-4c6c-ab32-118304a4ffff\nholds it, which was true of every engine file except engine/watch.ts: a module the val does not run,\nso it was never deployed, so it lived in one container and nothing else. A reclaim destroyed it.\nscripts/deploy.mjs --check still compares engine/ against the val file by file; that is a second\ncheck on the same files now, not the only copy of them.\n\nRESTORE (needs only node, from an empty folder). Save each part, then run this ON EACH ONE:\n\n node -e 'const fs=require(\"fs\"),p=require(\"path\");const b=fs.readFileSync(process.argv[1],\"utf8\");\n for(const s of b.split(\"\\n=====FILE \").slice(1)){const i=s.indexOf(\" =====\\n\");\n const f=s.slice(0,i),c=s.slice(i+7);fs.mkdirSync(p.dirname(f),{recursive:true});\n fs.writeFileSync(f,c.replace(/\\n$/,\"\"))}' PART.txt\n\nA record named #1, #2, ... is one FILE cut into pieces: concatenate them in order, then\nstrip one trailing newline from the last. scripts/restore.mjs does this for you.\n\nEach part is complete in itself: whole files only, no reassembly, any order.\n\nThen: node scripts/build.mjs (engine/ came out of these parts; nothing to fetch first)\n node scripts/typecheck.mjs\n node tests/run-all.mjs\n node scripts/deploy.mjs --check (pulls nothing, proves the val matches what you restored)\n node tests/negative-controls.mjs (proves the suite above can actually fail)\n\nIN THIS PART (4 of 116 files)\n engine/paths.ts 17699 bytes 4b56baecd359\n engine/payments-source.ts 3147 bytes 0553c7855218\n engine/puppy-detect.ts 12214 bytes 4a48d65d803f\n engine/puppy-messages.ts 16899 bytes 6de869b387fd\n\n================================================================================================\n=====FILE engine/paths.ts =====\n// PATH REGISTRY, the six nurture paths as data, plus the validator that guards them. 2 Aug 2026.\n//\n// WHY\n// The engine was written for one path. Generalising it by rewriting the state machine on a live\n// client system is the kind of refactor that breaks something nobody notices for a week. The\n// cheaper and safer generalisation is to move the *definition* of a path out of code: a path is a\n// tag, a sequence of steps, and a set of exit rules. The engine already treats steps as data\n// (renderStep takes a template); this file makes the whole path a record.\n//\n// RETRACTED, 2 Aug 2026, and the RENDERED SENTENCE corrected 4 Aug: the retraction sat in this\n// comment for two days while the page below carried on printing the claim it retracts. A comment\n// is not a correction. This file used to claim registering paths 2-6 was \"a copy drop, not an\n// engineering job\". That was wrong and it was repeated to the client. The engine does not read this\n// file: puppy_path_v1.1.ts imports MAIN_SEQUENCE/BRANCH_A/BRANCH_B directly from puppy-messages.ts,\n// hardcodes TAG_SOURCE_SIGNAL, and stores Record, one position per contact,\n// not one per path. Dropping steps into a row below would render a green line on this page and send\n// nothing. Path 2 needs the state model, per-path tag mapping, sequence selection and precedence\n// rules built. Days, not an afternoon. This page is a registry and a validator; it is not wiring.\n//\n// THE VALIDATOR IS THE POINT\n// Every path, before it can be registered, has to survive the same checks the test suite runs\n// against the puppy path: no banned wording, no unresolved merge token, SMS inside carrier limits,\n// at least one opt-out line, a booking link that points at a calendar this account actually owns,\n// monotonic timing, and a defined terminal step. A path that fails is refused with reasons rather\n// than half-registered.\n//\n// ?k= the registry: what is defined, what is live, what is missing\n// ?k=&validate=1 run the validator over everything registered\n// ?k=&f=json the same as JSON\n\n// ---- auth ------------------------------------------------------------------------------------\n// v2 (2 Aug, after the adversarial pass): the key is NOT in this file. val.town vals are PUBLIC -\n// proved by fetching this very source with no token, so a literal key here was readable by anyone\n// who found the val, which meant anyone could read Kim's data, stop her system, or trigger a run.\n// Only the SHA-256 digest lives in source now. The digest is useless to a reader and sufficient for\n// a comparison, so publishing the code no longer publishes the secret.\nconst KEY_SHA256 = \"48cd12465712045f70247da1689eeb198a4ce2d98416d8e52fb844581f044f15\";\n\nasync function sha256Hex(s: string): Promise {\n const b = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(s));\n return [...new Uint8Array(b)].map((x) => x.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nasync function authorised(k: string): Promise {\n const override = Deno.env.get(\"NURTURE_ADMIN_KEY_SHA256\");\n const expected = override || KEY_SHA256;\n const got = await sha256Hex(k);\n // Constant-time over equal-length hex digests.\n if (got.length !== expected.length) return false;\n let d = 0;\n for (let i = 0; i < got.length; i++) d |= got.charCodeAt(i) ^ expected.charCodeAt(i);\n return d === 0;\n}\n\n// The one calendar this account owns for training consults. Verified live 2 Aug against\n// GET /calendars/?locationId=, \"Pup Talk Phone Call\". Any booking link in any path must contain it.\nconst OWNED_BOOKING_ID = \"qHuYJ0NEqzibnoqf5Cw3\";\nconst OWNED_BOARDING_FORM = \"thedogsspotga.com/boarding-booking-form\";\n\nexport type Step = {\n id: string;\n channel: \"email\" | \"sms\";\n offsetHours: number;\n subject?: string;\n previewText?: string;\n bodyTemplate: string;\n};\n\nexport type PathDef = {\n key: string;\n label: string;\n sourceTag: string; // applying this tag in the CRM is how a human enrols someone\n enrolledTag: string; // minted by the engine on enrolment\n source: \"engine\" | \"ghl\" | \"off\"; // mutual exclusion: never let a val and a GHL workflow both own a path\n channelsAtLaunch: (\"email\" | \"sms\")[];\n steps: Step[];\n notes: string;\n // v1.5, 2 Aug 2026, THE COLLISION MAP, and the most important field in this file.\n // `source` was always a DECLARATION of who owns a path. It was never checked against what the CRM\n // is actually running. Checked properly today via GET /workflows/?locationId= : the location has\n // 165 workflows, 95 of them PUBLISHED, and every one of the six paths below already has published\n // GoHighLevel automation whose name overlaps it. Declaring `source: \"engine\"` does not switch those\n // off. GoHighLevel exposes no endpoint for reading a contact's workflow enrolments\n // (/contacts/{id}/workflow -> 404) so overlap cannot be detected per contact, only per path, by a\n // human reading each workflow. Until a row here is cleared, treat it as live competition for the\n // same customer's inbox. The engine's R27 quiet-period guard is the runtime backstop; this list is\n // the thing that stops us needing it.\n ghlOverlap: { name: string; status: \"published\" | \"draft\"; version: number }[];\n};\n\n// ---- the registry ---------------------------------------------------------------------------------\n// PUPPY is populated from the deployed module so there is exactly one copy of that copy. The other\n// five are declared with everything except their steps: the tag names, the launch channels and the\n// constraints are all decided, so registering them is `steps: [...]` and nothing else.\n\nimport { MAIN_SEQUENCE, BRANCH_A, BRANCH_B } from \"./puppy-messages.ts\";\n\nexport const PATHS: PathDef[] = [\n {\n key: \"puppy\", label: \"Puppy owners\", sourceTag: \"nurture - puppy\", enrolledTag: \"puppy-path-v1\",\n source: \"engine\", channelsAtLaunch: [\"email\", \"sms\"],\n steps: [...MAIN_SEQUENCE, ...BRANCH_A, ...BRANCH_B] as Step[],\n notes: \"Live in the engine. 8 main + 2 no-show + 2 didn't-buy. The template for the other five.\",\n ghlOverlap: [\n { name: \"1. Wait 1 Day: Initial Nurture - Puppy\", status: \"published\", version: 2 },\n { name: \"1. Wait 1 Day: Initial Nurture\", status: \"published\", version: 2 },\n { name: \"Edited - Main New Nurture (New/Updated)\", status: \"published\", version: 4 },\n { name: \"Secondary Nurture Workflow\", status: \"published\", version: 4 },\n { name: \"A. Removed Tag : Initial Lead Nurtures\", status: \"published\", version: 2 },\n { name: \"Secondary Nurture - PUPPY Workflow\", status: \"draft\", version: 5 },\n { name: \"1. Initial Nurture - Facebook\", status: \"draft\", version: 3 },\n { name: \"1. Initial Nurture - Instagram\", status: \"draft\", version: 3 },\n ],\n },\n {\n key: \"behavior\", label: \"Behavior problems\", sourceTag: \"nurture - behavior\", enrolledTag: \"behavior-path-v1\",\n source: \"off\", channelsAtLaunch: [\"email\", \"sms\"], steps: [],\n notes: \"Largest real demand signal, 172 asks in the gap log. The day-14 aggression email is the highest-risk message in the whole set and Kim reads it personally before this path is switched on.\",\n ghlOverlap: [\n { name: \"Behavior Quiz Submitted\", status: \"published\", version: 3 },\n { name: \"Dialed In Dog ZJ : Free Training Day Quiz\", status: \"published\", version: 16 },\n { name: \"Quiz -. Pup Talk > Notes\", status: \"published\", version: 4 },\n { name: \"Quiz Score Redirect Logic\", status: \"draft\", version: 6 },\n ],\n },\n {\n key: \"boarding\", label: \"Boarding inquiries\", sourceTag: \"nurture - boarding\", enrolledTag: \"boarding-path-v1\",\n source: \"off\", channelsAtLaunch: [\"email\", \"sms\"], steps: [],\n notes: \"The only path allowed to quote prices, and only the boarding ones Kim confirmed. Every mention of hours must carry the appointment-only rule. Booking goes to her website form, never a GHL calendar.\",\n ghlOverlap: [\n { name: \"Boarding Drop-Off - Confirmation + Reminder\", status: \"published\", version: 19 },\n { name: \"Boarding Pick-Up - Confirmation + Reminder\", status: \"published\", version: 25 },\n { name: \"Abandoned Cart - Partial booking\", status: \"published\", version: 5 },\n { name: \"Cancel Boarding - Drop Off\", status: \"published\", version: 3 },\n { name: \"Online Boarding Update > Kennel\", status: \"published\", version: 4 },\n { name: \"Boarding App Webhook\", status: \"published\", version: 18 },\n ],\n },\n {\n key: \"noshow\", label: \"Pup Talk, didn't show\", sourceTag: \"nurture - noshow\", enrolledTag: \"noshow-path-v1\",\n source: \"off\", channelsAtLaunch: [\"email\", \"sms\"], steps: [],\n notes: \"Closes a measured hole: 19 no-shows and 8 cancellations across 145 Pup Talk events with nothing following up.\",\n ghlOverlap: [\n { name: \"Cxld/Canceled Pup Talk\", status: \"published\", version: 7 },\n { name: \"Cxld or No Show - Consult Nurture\", status: \"published\", version: 4 },\n { name: \"Free training day no show nurture\", status: \"published\", version: 9 },\n { name: \"Cxld/Canceled Free Training Day\", status: \"published\", version: 4 },\n { name: \"Tag Added 'No Show' > No Show\", status: \"published\", version: 2 },\n { name: \"Tag Added 'No Show DND' > No Show TO PREVENT ANOTHER BOOKING\", status: \"published\", version: 2 },\n { name: \"Free Training Day abandoned booking\", status: \"published\", version: 8 },\n ],\n },\n {\n key: \"didntbuy\", label: \"Pup Talk, didn't buy\", sourceTag: \"nurture - didntbuy\", enrolledTag: \"didntbuy-path-v1\",\n source: \"off\", channelsAtLaunch: [\"email\", \"sms\"], steps: [],\n notes: \"82 attended and few converted. Kim's $500 discount decision lives near this path, keep them separate until its wording and its own dry/live toggle exist.\",\n ghlOverlap: [\n { name: \"POST CONSULT - NO SALE NURTURE MESSAGES\", status: \"published\", version: 4 },\n { name: \"Tag added 'No Sale' > No Sale Nurture\", status: \"published\", version: 2 },\n ],\n },\n {\n key: \"aged\", label: \"Dormant inquiries\", sourceTag: \"nurture - aged\", enrolledTag: \"aged-path-v1\",\n source: \"off\", channelsAtLaunch: [\"email\"],\n steps: [],\n notes: \"EMAIL ONLY AT LAUNCH, and the audience is far smaller than the headline: of 3,426 dormant contacts only ~164 have an email address and ~2,655 have neither email nor phone. SMS stays held until numbers are validated, stale numbers get a business flagged by carriers, which would damage every other path.\",\n ghlOverlap: [\n { name: \"Tips Nurture\", status: \"published\", version: 7 },\n { name: \"TIPS FACEBOOK CAMPAIGN - SMS Nurture\", status: \"published\", version: 3 },\n { name: \"Auto Replies > tips campaign\", status: \"published\", version: 10 },\n { name: \"Copy - Tips Ad campaign > Auto Responder\", status: \"published\", version: 11 },\n { name: \"Tips ad campaign > response > phone number\", status: \"published\", version: 10 },\n { name: \"Tips Ad campaign > Auto Responder\", status: \"draft\", version: 19 },\n ],\n },\n];\n\n// ---- the validator --------------------------------------------------------------------------------\n\nconst BANNED = [\n { re: /discovery/i, why: 'Kim banned \"discovery call\", it is \"Pup Talk\"' },\n { re: /grooming/i, why: \"grooming is not a service they offer\" },\n { re: /\\$\\s?\\d/, why: \"a price in a message; boarding prices come from the knowledge base, training prices never\" },\n // Templates legitimately contain {{FIRST_NAME}} and {{DOG_NAME}}, they are resolved per contact at\n // render time, and the engine has fallbacks for both when a contact has neither. Anything ELSE in\n // double braces is a token nobody wired up, which is what actually reaches a customer as literal\n // text. Caught by the first validator run, which flagged all 12 real templates: a check that fails\n // on correct input is worse than no check.\n { re: /\\{\\{(?!\\s*(FIRST_NAME|DOG_NAME)\\s*\\}\\})/, why: \"an unrecognised merge token, only {{FIRST_NAME}} and {{DOG_NAME}} are wired up\" },\n { re: /\\[link\\]|\\[phone\\]|INSERT|TODO|LOREM/i, why: \"a placeholder that never got resolved\" },\n];\n\nexport function validatePath(p: PathDef) {\n const errors: string[] = [], warnings: string[] = [];\n if (!p.steps.length) return { key: p.key, registered: false, ok: false, errors: [\"no steps registered yet\"], warnings: [] };\n\n let sawOptOut = false, sawBooking = false;\n const sms = p.steps.filter((s) => s.channel === \"sms\");\n\n for (const s of p.steps) {\n const text = `${s.subject ?? \"\"}\\n${s.previewText ?? \"\"}\\n${s.bodyTemplate}`;\n for (const b of BANNED) if (b.re.test(text)) errors.push(`${s.id}: ${b.why}`);\n if (/\\bstop\\b/i.test(s.bodyTemplate) || /reply\\s+stop/i.test(s.bodyTemplate)) sawOptOut = true;\n if (s.bodyTemplate.includes(OWNED_BOOKING_ID) || s.bodyTemplate.includes(OWNED_BOARDING_FORM)) sawBooking = true;\n if (/leadconnectorhq\\.com\\/widget\\/bookings?\\//.test(s.bodyTemplate) &&\n !s.bodyTemplate.includes(OWNED_BOOKING_ID)) {\n errors.push(`${s.id}: booking link does not point at a calendar this account owns, this is the exact defect found on 2 Aug`);\n }\n if (s.channel === \"sms\" && s.bodyTemplate.length > 320) errors.push(`${s.id}: SMS ${s.bodyTemplate.length} chars, over the 320 ceiling`);\n if (s.channel === \"email\" && !s.subject) errors.push(`${s.id}: email with no subject line`);\n }\n\n const offsets = p.steps.map((s) => s.offsetHours);\n const mainish = p.steps.filter((s) => s.id.startsWith(\"main\"));\n if (mainish.length > 1) {\n for (let i = 1; i < mainish.length; i++) {\n if (mainish[i].offsetHours <= mainish[i - 1].offsetHours) {\n errors.push(`${mainish[i].id}: timing does not move forward (${mainish[i - 1].offsetHours}h then ${mainish[i].offsetHours}h)`);\n }\n }\n }\n if (Math.max(...offsets) < 24 * 21) warnings.push(`longest step is ${Math.round(Math.max(...offsets) / 24)} days, the client was sold a minimum 30-day journey`);\n if (!sawOptOut && sms.length) warnings.push(\"no opt-out wording found in any SMS\");\n if (!sawBooking) warnings.push(\"no booking link anywhere in this path\");\n if (p.source === \"engine\" && p.channelsAtLaunch.includes(\"sms\") && p.key === \"aged\") {\n errors.push(\"aged path must not launch with SMS until the number list has been validated\");\n }\n\n return { key: p.key, registered: true, ok: errors.length === 0, errors, warnings, steps: p.steps.length, sms: sms.length, email: p.steps.length - sms.length };\n}\n\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n if (!(await authorised(url.searchParams.get(\"k\") || \"\"))) {\n return new Response(\"Not found\", { status: 401, headers: { \"content-type\": \"text/plain\" } });\n }\n const results = PATHS.map(validatePath);\n const payload = {\n at: new Date().toISOString(),\n registered: results.filter((r) => r.registered).length,\n awaitingCopy: results.filter((r) => !r.registered).map((r) => r.key),\n live: PATHS.filter((p) => p.source === \"engine\").map((p) => p.key),\n mutualExclusion: \"each path names exactly one owner, engine, ghl, or off. No path can be run by both.\",\n paths: PATHS.map((p) => ({\n key: p.key, label: p.label, sourceTag: p.sourceTag, enrolledTag: p.enrolledTag,\n source: p.source, channelsAtLaunch: p.channelsAtLaunch, steps: p.steps.length, notes: p.notes,\n validation: results.find((r) => r.key === p.key),\n })),\n };\n if (url.searchParams.get(\"f\") === \"json\" || url.searchParams.get(\"validate\") === \"1\") {\n return new Response(JSON.stringify(payload, null, 2), { headers: { \"content-type\": \"application/json\", \"cache-control\": \"no-store\" } });\n }\n const rows = payload.paths.map((p: any) => {\n const v = p.validation;\n const status = !v.registered ? 'awaiting copy'\n : v.ok ? 'passes every check'\n : `${v.errors.length} problem(s)`;\n return `${p.label}
${p.sourceTag}${p.source}${p.steps || \"-\"}${status}${p.notes}`;\n }).join(\"\");\n return new Response(`Nurture paths\n\n
The six nurture paths
\n
${payload.registered} of ${payload.paths.length} have copy registered. Registering the rest is NOT a copy drop: the engine reads its sequences directly and stores one position per contact, not one per path, so each additional path needs the state model, per-path tag mapping, sequence selection and precedence rules built. Days of work each, not an afternoon. This page is a registry and a validator, not the wiring. Every path is checked against the same rules before it can run.
\n${rows}
Path Owner Steps Validator Constraint that governs it
\n
Owner is the mutual-exclusion switch: engine, ghl, or off. Nothing can be run by two systems at once, that is what put a Facebook script on the website in July.
`,\n { headers: { \"content-type\": \"text/html; charset=utf-8\" } });\n}\n\n\n=====FILE engine/payments-source.ts =====\n// SQUARE MONEY AS THE CRM RECORDS IT. New 10 Aug 2026.\n//\n// WHY THIS FILE EXISTS. Until today `money-match.ts` was imported by its own test and by nothing\n// else. There was no call to /payments/transactions anywhere in the repo, so every figure on Kim's\n// money page came from a process that was not in the tree, and the filters below were unwritten\n// rather than misconfigured. This is that missing layer.\n//\n// It is a SEPARATE module on purpose: test MM-h asserts the string `fetch(` never appears in\n// money-match.ts, and that test is worth keeping.\n//\n// The endpoint, and note it rejects `locationId` and wants `altId`:\n// GET /payments/transactions?altId=&altType=location&limit=100&offset=\nimport type { Payment } from \"./money-match.ts\";\n\n// Every source type this location produces, proven live 10 Aug 2026 across all 233 transactions:\n// calendar 158, invoice 61, funnel 11, payment_link 2, manual 1. All 233 carry a contactId.\n// payment_link is IN. Both rows today are failed tests worth $0, but reusable front desk payment\n// links are a live workstream, and a matcher that silently dropped them would report the front\n// desk's first day of takings as zero, with no error, which reads as \"business was quiet\".\nexport const ACCEPTED_SOURCE_TYPES: readonly string[] = Object.freeze([\n \"calendar\", \"invoice\", \"funnel\", \"payment_link\", \"manual\",\n]);\nconst ACCEPTED = new Set(ACCEPTED_SOURCE_TYPES);\n\n// A $0 row is a calendar booking artifact, not money: 171 of 233 live, every one status\n// \"succeeded\". A sub $1 row is a card test: 10 live, $3.05 total, every one pending, belonging to\n// \"emily harris\" and \"automation dogs test\".\n//\n// FILTER ON AMOUNT, NOT ON SOURCE TYPE. Filtering entitySourceType !== \"calendar\" is the near miss:\n// it leaves 13 zero rows standing, which is what invents a phantom payment collision and inflates\n// the booking count. It is also the wrong axis, because invoice/calendar produces both $0 artifacts\n// and real money.\nexport const MIN_REAL_PAYMENT = 1;\nexport const isRealMoney = (p: { amount: number }) => p.amount >= MIN_REAL_PAYMENT;\n\nexport function toPayment(t: any): Payment {\n return {\n id: String(t?._id ?? \"\"),\n amount: Number(t?.amount) || 0,\n status: String(t?.status ?? \"\"),\n contactId: t?.contactId ?? null,\n contactName: t?.contactName ?? null,\n at: t?.createdAt ?? null,\n };\n}\n\nexport type Accepted = { payments: Payment[]; unknownTypes: string[]; dropped: { zeroOrTest: number } };\n\n// An UNRECOGNISED source type is KEPT and REPORTED, never dropped. A new type is a new way money\n// arrives, and dropping it silently is how revenue goes missing without anybody seeing an error.\nexport function acceptPayments(rows: any[]): Accepted {\n const unknown = new Set();\n const kept: Payment[] = [];\n let zeroOrTest = 0;\n for (const t of rows) {\n const st = String(t?.entitySourceType ?? \"\");\n if (st && !ACCEPTED.has(st)) unknown.add(st);\n const p = toPayment(t);\n if (!isRealMoney(p)) { zeroOrTest++; continue; }\n kept.push(p);\n }\n return { payments: kept, unknownTypes: [...unknown].sort(), dropped: { zeroOrTest } };\n}\n\n\n=====FILE engine/puppy-detect.ts =====\n// WHO IS A PUPPY INQUIRY. v1.0, 5 August 2026.\n//\n// WHY THIS FILE EXISTS. The engine enrolls people carrying the tag `nurture - puppy`. Nothing in\n// Kim's account applies that tag: all 5,544 contacts checked, zero carry it. So go-live is three\n// switches, not two, and this is the third.\n//\n// WHY IT IS NOT A ONE-LINE REGEX. The first thing I tried was matching \"puppy\" or an age in weeks\n// or months against the inquiry summary. Over the 800 most recent contacts it returned 29 people,\n// and reading them showed it was wrong about several in ways that matter:\n//\n// * \"Ken Anderson was looking to purchase a puppy. He inquired whether The Dog's Spot GA offered\n// puppies for sale. The agent clarified that they do not sell.\" He would have received\n// forty-one messages about training a puppy he does not own.\n// * \"Charlie, who is 3 years and 4 months old\" matched on \"4 months old\". The dog is three.\n// * \"Evelyn Carter was seeking good homes for her older dogs\" matched on the word \"new puppy\"\n// later in a sentence about rehoming.\n//\n// A false positive here is not a bad row in a spreadsheet. It is a real person getting nineteen\n// months of messages about a puppy they do not have, in Kim's name.\n//\n// SO THIS FILE NEVER APPLIES A TAG. It classifies, it explains itself in one sentence per person,\n// and it hands the list to a human. `confidence` is the whole point: \"clear\" is defensible on its\n// own, \"probable\" wants a glance, \"unclear\" is a question rather than an answer.\n//\n// It also reports its own blind spot, loudly: the inquiry summary is populated on about half of\n// contacts. Anyone with no summary cannot be classified by this at all, and saying so is part of\n// the output rather than a footnote.\n\nexport type Verdict = {\n contactId: string;\n name: string;\n confidence: \"clear\" | \"probable\" | \"unclear\" | \"no\";\n /** One sentence, in plain English, naming the words that decided it. */\n reason: string;\n /** Months, when a dog's age could be read. null when it could not. */\n ageMonths: number | null;\n matched: string[];\n};\n\nexport type DetectSummary = {\n scanned: number;\n withText: number;\n noText: number;\n clear: number;\n probable: number;\n unclear: number;\n no: number;\n};\n\nconst num = (s: string): number | null => {\n const words: Record = {\n one: 1, two: 2, three: 3, four: 4, five: 5, six: 6, seven: 7, eight: 8,\n nine: 9, ten: 10, eleven: 11, twelve: 12, eighteen: 18,\n };\n const t = s.trim().toLowerCase();\n if (/^\\d+(\\.\\d+)?$/.test(t)) return Number(t);\n return words[t] ?? null;\n};\n\n/**\n * The dog's age in months, or null.\n *\n * The \"3 years and 4 months old\" trap is handled by looking for a YEARS reading first and letting\n * it win. A dog described in years is not a puppy however many months are mentioned afterwards.\n */\nexport function ageInMonths(text: string): number | null {\n const t = text.toLowerCase();\n // YEARS FIRST, AND THEY WIN OUTRIGHT.\n // [was: the years pattern required the word \"old\" straight after it, as in \"3-year-old\". So\n // \"Charlie, who is 3 years and 4 months old\" did not match it — the \"old\" belongs to the\n // months — and fell through to the months branch, which read the dog as 4 months. That is\n // the exact false positive this whole file exists to prevent, and the first version of the\n // file still had it. Caught by its own test, not by reading it.]\n const y = t.match(/(\\d+(?:\\.\\d+)?|one|two|three|four|five|six|seven|eight|nine|ten|eleven|twelve)[\\s-]*(?:year|yr)s?\\b/);\n if (y) {\n const n = num(y[1]);\n if (n != null) {\n const m = t.slice(y.index ?? 0).match(/(?:year|yr)s?[\\s,-]*(?:and\\s*)?(\\d+|one|two|three|four|five|six|seven|eight|nine|ten|eleven)[\\s-]*(?:month|mo)s?\\b/);\n return n * 12 + (m ? (num(m[1]) ?? 0) : 0);\n }\n }\n const mo = t.match(/(\\d+(?:\\.\\d+)?|one|two|three|four|five|six|seven|eight|nine|ten|eleven|twelve|eighteen)(?:\\s*-\\s*\\d+)?[\\s-]*(?:month|mo)s?[\\s-]*old/);\n if (mo) { const n = num(mo[1]); if (n != null) return n; }\n const wk = t.match(/(\\d+(?:\\.\\d+)?|one|two|three|four|five|six|seven|eight|nine|ten|eleven|twelve)(?:\\s*-\\s*\\d+)?[\\s-]*(?:week|wk)s?[\\s-]*old/);\n if (wk) { const n = num(wk[1]); if (n != null) return Math.round((n / 4.345) * 10) / 10; }\n return null;\n}\n\n// Reasons someone is NOT a puppy-training inquiry even though the word appears. Each one is here\n// because a real contact in Kim's account tripped it.\nconst DISQUALIFIERS: Array<[RegExp, string]> = [\n [/\\b(purchase|buy|buying|sell|selling|for sale|breeder|adopt(?:ing)? a)\\b[^.]{0,40}\\bpupp/i,\n \"they were asking to buy a puppy, not to train one\"],\n [/\\bpupp\\w*\\b[^.]{0,40}\\b(for sale|to sell|available to buy)\\b/i,\n \"they were asking to buy a puppy, not to train one\"],\n [/\\b(rehome|rehoming|good homes|find(?:ing)? homes|surrender|give away)\\b/i,\n \"they were rehoming dogs rather than asking about training\"],\n [/\\b(do not sell|don't sell|does not sell|doesn't sell)\\b/i,\n \"the reply on file says Kim does not sell dogs, so this was not a training inquiry\"],\n];\n\nconst PUPPY_WORDS = /\\b(pupp(?:y|ies)|new pup\\b|pup\\b)/i;\n// Kim's puppy sequence is written for a young dog. Past about a year it is the wrong sequence.\nconst PUPPY_MAX_MONTHS = 12;\n\n/** Age in the words a person would use. Nobody says a dog is 1.4 months old. */\nexport function sayAge(months: number): string {\n if (months < 2) { const w = Math.round(months * 4.345); return `${w} week${w === 1 ? \"\" : \"s\"} old`; }\n if (months < 24) { const m = Math.round(months); return `${m} month${m === 1 ? \"\" : \"s\"} old`; }\n const y = Math.round(months / 12);\n return `${y} year${y === 1 ? \"\" : \"s\"} old`;\n}\n\nexport function classify(contactId: string, name: string, text: string): Verdict {\n const clean = (text ?? \"\").replace(/\\s+/g, \" \").trim();\n if (!clean) {\n return { contactId, name, confidence: \"unclear\", ageMonths: null, matched: [],\n reason: \"There is nothing written down about what they asked for, so this cannot be decided from the record.\" };\n }\n\n for (const [re, why] of DISQUALIFIERS) {\n const m = clean.match(re);\n if (m) return { contactId, name, confidence: \"no\", ageMonths: ageInMonths(clean), matched: [m[0].slice(0, 60)], reason: `Not a puppy inquiry: ${why}.` };\n }\n\n const age = ageInMonths(clean);\n const saysPuppy = PUPPY_WORDS.test(clean);\n const matched: string[] = [];\n if (saysPuppy) matched.push((clean.match(PUPPY_WORDS) ?? [\"\"])[0]);\n if (age != null) matched.push(`${age} months old`);\n\n if (age != null && age > PUPPY_MAX_MONTHS) {\n return { contactId, name, confidence: \"no\", ageMonths: age, matched,\n reason: `Not a puppy inquiry: the dog is given as ${sayAge(age)}, which is past the sequence.` };\n }\n if (age != null && saysPuppy) {\n return { contactId, name, confidence: \"clear\", ageMonths: age, matched,\n reason: `Called a puppy and given as ${sayAge(age)}, so both signals agree.` };\n }\n // A very young age settles it on its own. No adult dog is four months old, so the word \"puppy\"\n // adds nothing at this end and demanding it would push obvious cases down to \"probable\".\n if (age != null && age <= 6) {\n return { contactId, name, confidence: \"clear\", ageMonths: age, matched,\n reason: `The dog is given as ${sayAge(age)}, which is a puppy whatever words they used.` };\n }\n if (age != null) {\n return { contactId, name, confidence: \"probable\", ageMonths: age, matched,\n reason: `The dog is given as ${sayAge(age)}, which is inside the sequence, but the word puppy is not used.` };\n }\n if (saysPuppy) {\n return { contactId, name, confidence: \"probable\", ageMonths: null, matched,\n reason: \"They call it a puppy, but no age is written down, so how young is a guess.\" };\n }\n return { contactId, name, confidence: \"no\", ageMonths: null, matched: [],\n reason: \"Nothing in what they wrote points at a puppy.\" };\n}\n\nexport function summarise(vs: Verdict[], scanned: number): DetectSummary {\n const by = (c: Verdict[\"confidence\"]) => vs.filter((v) => v.confidence === c).length;\n const noText = vs.filter((v) => v.matched.length === 0 && v.confidence === \"unclear\").length;\n return { scanned, withText: scanned - noText, noText, clear: by(\"clear\"), probable: by(\"probable\"),\n unclear: by(\"unclear\"), no: by(\"no\") };\n}\n\n/**\n * How old is this reading, in words, or null when it is fresh enough not to mention.\n *\n * A dry pass that stopped running would otherwise keep showing its last numbers as though they\n * were this morning's. The engine runs about hourly, so anything past six hours has missed\n * several turns and is worth saying out loud.\n */\nexport function scanAgeNote(atIso: string | null | undefined, nowMs: number): string | null {\n if (!atIso) return null;\n const ms = nowMs - Date.parse(atIso);\n if (!Number.isFinite(ms) || ms < 0) return null;\n const hours = ms / 3_600_000;\n if (hours < 6) return null;\n if (hours < 48) return `This count was last taken about ${Math.round(hours)} hours ago rather than just now, so treat it as a little out of date.`;\n return `This count was last taken about ${Math.round(hours / 24)} days ago, so it has stopped being kept up and the numbers below are old.`;\n}\n\n/** The sentence for the summary, generated from the counts, never written alongside them. */\nexport function detectSentence(s: DetectSummary | null): string {\n if (!s || !s.scanned) return \"No contacts were read, so there is nothing to report here rather than a zero to trust.\";\n const parts = [\n `${s.scanned.toLocaleString(\"en-US\")} contacts were read. ${s.clear} are clearly a puppy inquiry and ${s.probable} probably are.`,\n ];\n if (s.noText) {\n parts.push(`${s.noText} of them have nothing written down about what they asked for, so they cannot be judged from the record at all, either way.`);\n }\n parts.push(\"Nothing has been tagged. This is a list to look at, not an action taken.\");\n return parts.join(\" \");\n}\n\n// ---------------------------------------------------------------------------------------------\n// THE DRY PASS.\n//\n// This file has NO WAY TO APPLY A TAG and that is structural, not a promise: there is no fetch, no\n// POST and no client in it. Everything here takes contacts in and hands verdicts out. The engine\n// calls it on each run, writes the counts down, and applies nothing. When the tagging is finally\n// armed it will be armed somewhere a human had to go and change, not here.\n//\n// The custom-field ids are Kim's account's. `inquiryText` is deliberately forgiving about the\n// shape of a contact, because it is fed straight from the CRM's JSON.\n// ---------------------------------------------------------------------------------------------\nexport const FIELD_INQUIRY_SUMMARY = \"N8Mw4Mmz5ecesIOrQMWm\";\nexport const FIELD_TRAINING_GOAL = \"4EXdybS2XUAaP6tnlncI\";\n\nexport function inquiryText(contact: unknown): string {\n const cfs = (contact as any)?.customFields;\n if (!Array.isArray(cfs)) return \"\";\n const pick = (id: string) => {\n const f = cfs.find((x: any) => x?.id === id);\n const v = f?.value;\n return typeof v === \"string\" || typeof v === \"number\" ? String(v) : \"\";\n };\n return `${pick(FIELD_INQUIRY_SUMMARY)} ${pick(FIELD_TRAINING_GOAL)}`.trim();\n}\n\nexport function classifyContacts(contacts: unknown): Verdict[] {\n if (!Array.isArray(contacts)) return [];\n return contacts\n .filter((c: any) => c && typeof c.id === \"string\")\n .map((c: any) => classify(c.id, String(c.contactName ?? c.firstName ?? \"(no name)\"), inquiryText(c)));\n}\n\nexport type DryScan = {\n at: string;\n summary: DetectSummary;\n /** Ids only, and only the ones worth a human's time. Never names, never message text. */\n clearIds: string[];\n probableIds: string[];\n /** Always false in this file. Present so the panel can state it rather than assume it. */\n applied: false;\n};\n\nexport function dryScan(contacts: unknown, at: string): DryScan {\n const vs = classifyContacts(contacts);\n return {\n at,\n summary: summarise(vs, vs.length),\n clearIds: vs.filter((v) => v.confidence === \"clear\").map((v) => v.contactId),\n probableIds: vs.filter((v) => v.confidence === \"probable\").map((v) => v.contactId),\n applied: false,\n };\n}\n\n\n=====FILE engine/puppy-messages.ts =====\n// PUPPY PATH — message copy module (split from the engine for val.town's 80k/file limit).\n// Copy is VERBATIM from PHASE1-PUPPY-PATH-WRITING-SHEET.md §3 — do not paraphrase here, ever.\ndeclare const Deno: { env: { get(key: string): string | undefined } };\nif (typeof (globalThis as any).Deno === \"undefined\") {\n (globalThis as any).Deno = { env: { get: (k: string) => (globalThis as any).process?.env?.[k] } };\n}\n\n// ---- v1.3 change, 2 Aug 2026 — booking URL. RETRACTION APPENDED, read the whole block ----------\n// The previous value was:\n// https://api.leadconnectorhq.com/widget/bookings/pbe-discovery-9edbddc3-4b5a-406e-9bc3-7f10cb0d3221\n//\n// WHAT I ORIGINALLY WROTE HERE (and it was wrong): that this id \"does NOT belong to this location\"\n// and was the parent agency's own discovery-call widget.\n//\n// RETRACTED, same day, on better evidence. Re-checking GET /calendars/?locationId=BQHJ19uohldYe3eqA0bl\n// field by field shows `pbe-discovery-9edbddc3-4b5a-406e-9bc3-7f10cb0d3221` is the *widget slug of\n// Kim's own \"Pup Talk Phone Call\" calendar* — the same calendar as qHuYJ0NEqzibnoqf5Cw3. Confirmed\n// independently: https://book.thedogsspotga.com/phone (the page the website's own \"Book your Free\n// Pup Talk\" button leads to) contains BOTH strings. /widget/bookings/ and\n// /widget/booking/ are two URL forms for one object; both return 200 and both land on\n// her calendar. The original link was never broken. I inferred \"not hers\" from the \"pbe\" prefix —\n// which is Pet Biz Experts, the agency that set the account up and therefore named the slug — and\n// stated the inference as a verified finding. That is the error, and it is the kind that matters\n// more than the code change.\n//\n// The current value is kept anyway, for one real reason that survives the retraction: the engine\n// watches PUP_TALK_CALENDAR_ID (qHuYJ0NEqzibnoqf5Cw3) to detect a booking, so using the calendar-id\n// form makes the link a lead clicks and the object the engine watches literally the same string,\n// with no slug indirection to go stale. Secondary: the word \"discovery\" does not appear in it, and\n// Kim asked for \"Pup Talk\" instead.\n//\n// Regression test A1 asserts `!includes(\"pbe-\")`. That assertion is now a style rule, not a\n// correctness rule. Left in place; the comment above is the correction of record.\nexport const REAL_BOOKING_URL =\n \"https://api.leadconnectorhq.com/widget/booking/qHuYJ0NEqzibnoqf5Cw3\";\nexport const SHORT_BOOKING_LINK = Deno.env.get(\"SHORT_BOOKING_LINK\") || REAL_BOOKING_URL;\n\n// Phone number: two live candidates, and the earlier note here (\"zero signals point to 912-823-4382\")\n// is CORRECTED as of 2 Aug 2026. Signals for 912-823-4382 turned out to be strong: it is the meeting\n// location on 73 of 193 Pup Talk appointments, it is the number in the default confirmation text of\n// BOTH booking widgets (\"please call our office at (912) 823-4382\"), and thedogsspotga.com/about-5\n// tells customers to ring it to schedule a training drop-off.\n// Still using 912-348-8726, on a narrower and now-honest basis: it is the number in the website\n// footer on every page and behind the home page \"Call Us\" button, so it is the number a lead who\n// found the site already has. Both are real. Kim must pick one before go-live — flagged on the todo\n// list, not decided quietly.\nexport const PHONE_DISPLAY = Deno.env.get(\"PHONE_DISPLAY\") || \"912-348-8726\";\n\nexport type Channel = \"email\" | \"sms\";\n\nexport type MessageTemplate = {\n id: string;\n channel: Channel;\n offsetHours: number;\n subject?: string; // email only\n previewText?: string; // email only\n bodyTemplate: string;\n};\n\n// ---- message copy (PHASE1-PUPPY-PATH-WRITING-SHEET.md §3, VERBATIM — do not paraphrase) ----------\n// {{FIRST_NAME}} is the ONLY per-contact merge token, resolved at render time by\n// v2.0, 4 Aug 2026. {{DOG_NAME}} was removed from every message in this file and in the taper,\n// on Kim's instruction: \"we haven't always got the name and so if we have a placeholder for the\n// puppies name, it reads weird when there's no puppy in there so I think we should go with having\n// the person's name, but not necessarily the puppies name\". Facebook leads, which are four in\n// five of all inquiries, frequently arrive with no dog name at all. Every sentence that used it\n// was REWRITTEN to read naturally without one, rather than having \"your puppy\" substituted in\n// mechanically, because the mechanical version is exactly what she was objecting to.\n// Also on her instruction, same message: toilet -> potty, garden -> yard, and DAYCARE REMOVED\n// ENTIRELY. They do not offer daycare. That is the same class of error as describing grooming as\n// a service, and it had been sitting in four messages.\n// The old comment, for the record:\n// applyMergeFields(). [phone] / [link] are fixed placeholders per the writing sheet's own §1\n// distinction (Title Case = merge field, lower case = placeholder) — resolved ONCE below via real\n// template-literal interpolation of PHONE_DISPLAY / SHORT_BOOKING_LINK, not per contact.\n// **bold** markdown in messages 3/5/6 is rendered to by bodyToHtml() — that is a formatting\n// transform, not a wording change; the words themselves are untouched.\n//\n// v2.1, 6/7 Aug 2026 — five more of her own corrections (handover/REGISTER-AUG7.md §4), confirmed\n// back to her in writing 7 Aug (handover/MESSAGE-TO-KIM-7-AUG.txt, lines 80-83): main-2 no longer\n// opens \"Got your message\" (opens on the welcome instead); \"pitch\" is gone everywhere a Pup Talk is\n// described, in favour of saying what it IS; branch_a-2 and branch_b-1 lose the \"I won't chase\n// you\"/\"won't keep bugging you\" what-I-won't-do framing while the positive \"reach out\"/\"call or\n// text ... anytime\"/\"door's open\" lines next to them are kept, exactly as she asked; branch_b-2's\n// British \"getting on\" becomes \"going\". Tests: tests/kim-copy.test.mjs, section \"THE 6 AUG\n// FOLLOW-UP\".\n\nexport const MAIN_SEQUENCE: MessageTemplate[] = [\n {\n id: \"main-1\",\n channel: \"email\",\n offsetHours: 0,\n subject: \"Getting your puppy off to a good start\",\n previewText: \"A few things that matter more than people expect in these first weeks.\",\n bodyTemplate: `Hi {{FIRST_NAME}},\n\nThanks for getting in touch.\n\nWhether you're bringing a puppy home soon, or yours is already running circles around the kitchen, the timing of what happens next matters more than people expect.\n\nA puppy's window for learning that new people, new dogs, new places and new sounds are all safe starts closing earlier than most owners realize - a lot of that learning is done by around four to five months old. Whatever they meet calmly now tends to stay easy for life. Whatever gets missed is harder to fix later. Not impossible, just harder, and it usually takes longer than it would have the first time round.\n\nOver the next few weeks I'll send you a handful of short, practical emails - biting, potty training, recall, that sort of thing. Real advice, not fluff.\n\nIf you'd rather just talk it through now, that's what a Pup Talk is for - a real conversation with our team about how things are going. Reply to this email, call or text us on ${PHONE_DISPLAY}, or grab a time here: ${SHORT_BOOKING_LINK}.\n\nKim\nThe Dogs Spot`,\n },\n {\n id: \"main-2\",\n channel: \"sms\",\n offsetHours: 2,\n // v2.1, 6/7 Aug — \"Touch 2 loses 'I got your message' and opens on the welcome.\" Kim's own\n // question about the old line: \"What message am I replying to exactly?\" (REGISTER-AUG7.md §4).\n // This can be the first thing a contact hears from her at all, so \"got your message\" did not\n // always make sense; \"welcome\" carries the same warmth without assuming a reply is owed.\n bodyTemplate: `Hi {{FIRST_NAME}}, it's Kim at The Dogs Spot. Welcome! I'll send a few honest, useful puppy emails over the next few weeks. Reply anytime, a real person reads these.`,\n },\n {\n id: \"main-3\",\n channel: \"email\",\n offsetHours: 72, // day 3\n subject: \"Puppy biting: normal, not naughty\",\n previewText: \"What's actually going on when a puppy won't stop mouthing, and what helps.\",\n bodyTemplate: `Hi {{FIRST_NAME}},\n\nIf your puppy has started biting at hands, sleeves, ankles, shoelaces - that's not a behavior problem. It's normal. Puppies explore the world with their mouths the way toddlers explore it with their hands, and it usually gets worse before it gets better, especially once teething starts.\n\nA few things that actually help:\n\n**Redirect, don't just say no.** Keep a toy or a chew within arm's reach of wherever you usually sit, so it's already in your hand before the mouthing starts rather than after. The moment teeth touch skin, swap your hand for the toy. Saying \"no\" tells them to stop; it doesn't tell them what to do instead, and a puppy who is told to stop with nothing to switch to just tries again.\n\n**Watch for the overtired witching hour.** A lot of biting spikes happen when a puppy is overstimulated or short on sleep, not when they're being difficult. A nap often does more than any correction.\n\n**Yelp, don't wrestle.** If it hurts, a short \"ow\" and a pause in play teaches bite inhibition better than pulling your hand away, which can turn into a game.\n\nIt gets better. Most of this settles down significantly by six months, and properly once the adult teeth are in. It feels endless at week two. It isn't.\n\nIf any of that doesn't match what you're seeing, reply and tell me - I read these.\n\nKim\nThe Dogs Spot`,\n },\n {\n id: \"main-4\",\n channel: \"sms\",\n offsetHours: 144, // day 6\n bodyTemplate: `Hi {{FIRST_NAME}}, Kim here. Quick one - how's the biting and potty training going? Totally normal stage either way. Reply and let me know, happy to help.`,\n },\n {\n id: \"main-5\",\n channel: \"email\",\n offsetHours: 216, // day 9\n subject: \"A realistic potty-training timeline\",\n previewText: \"What actually helps, and why one accident isn't a setback.\",\n bodyTemplate: `Hi {{FIRST_NAME}},\n\nPotty training questions are the ones I get asked about most, usually some version of \"is this normal?\" Almost always, yes.\n\nA young puppy's bladder is small and their control over it is genuinely limited - not a matter of trying harder. As a rough guide, a lot of trainers use \"roughly one hour of control for every month of age\" early on, which is why an eight- or ten-week-old puppy needs to go out far more often than seems reasonable.\n\nWhat tends to work:\n\n**A schedule, not a hope.** Out first thing, after every meal, after every nap, after play, and last thing at night - before you think they need it, not after.\n\n**Same spot, same word.** Consistency does more work than any product. Pick a spot, use a calm word or phrase every time, and reward the second they finish outside, not back indoors where the reward disconnects from the act.\n\n**Supervise or contain.** Accidents mostly happen when a puppy has quiet, unsupervised access to another room. A crate, a pen, or simply keeping them in sight closes that gap.\n\n**No telling off for accidents.** By the time you've found it, they have moved on. Telling them off teaches confusion, not house manners.\n\nMost puppies are largely reliable by four to six months, and fully reliable somewhat later. If yours is well past that and still having accidents daily, that's worth looking at properly rather than pushing through - reply and tell me what's happening.\n\nKim\nThe Dogs Spot`,\n },\n {\n id: \"main-6\",\n channel: \"email\",\n offsetHours: 312, // day 13\n subject: \"Recall is a habit, not a hope\",\n previewText: `Why \"come\" is worth starting now, even before it matters.`,\n bodyTemplate: `Hi {{FIRST_NAME}},\n\nRecall - getting your puppy to come back reliably - is the one piece of training that keeps a dog safe for the rest of their life. It's also the easiest one to start too late.\n\nThe mistake most people make isn't training it wrong. It's not starting until it's needed - at the park, off lead, with distractions already in the way. By then you're teaching recall and competing for attention at the same time.\n\nStarted early, it's simple:\n\n**Practice where nothing's competing for attention.** Hallway, living room, yard. Say the word once, and make coming back to you the best thing that happens all day - food, praise, a game, whatever they actually want.\n\n**Never call for something unpleasant.** If \"come\" ever means bath time, nail clipping, or the end of a walk, it stops meaning \"good things happen.\" Go get them for that instead.\n\n**Reward every single time, at first.** Not just the good ones. Recall is a habit you're building, not a trick you're testing.\n\nRecall is the one people most often ask me to look at, usually because it worked in the yard and then stopped working everywhere else. If you'd like a hand with it, a Pup Talk is a free twenty-minute call: ${SHORT_BOOKING_LINK}, or call or text ${PHONE_DISPLAY}.\n\nKim\nThe Dogs Spot`,\n },\n {\n id: \"main-7\",\n channel: \"sms\",\n offsetHours: 408, // day 17\n bodyTemplate: `Hi {{FIRST_NAME}}, no pressure at all - if you'd like to talk through training or boarding for your puppy, we're easy to reach. Call or text ${PHONE_DISPLAY}, or book a time here: ${SHORT_BOOKING_LINK}. Kim, The Dogs Spot`,\n },\n {\n id: \"main-8\",\n channel: \"email\",\n offsetHours: 504, // day 21\n subject: \"The last puppy email from me for now\",\n previewText: \"What matters most from the last three weeks, and an open door.\",\n bodyTemplate: `Hi {{FIRST_NAME}},\n\nThis is the last of the every-few-days emails, so a quick summary of everything I've sent: get your puppy meeting the world calmly while that window's open, expect the biting and treat it as normal, keep the potty-training schedule boring and consistent, and start recall before you need it, not after.\n\nNone of that is complicated. Most of it is just easy to talk yourself out of doing consistently when you're tired and there's a puddle on the floor again.\n\nFrom here I'll slow right down - a short note each week for a few weeks, then less and less, only ever the useful kind. If you'd like to talk any of this through properly - what's normal for your puppy specifically, what training or boarding would actually suit your week, what it costs and when it makes sense to start - that's what a Pup Talk is for. It's a conversation. Reply here, call or text ${PHONE_DISPLAY}, or grab a time yourself: ${SHORT_BOOKING_LINK}.\n\nAnd if now just isn't the right time, that's completely fine too. No hard feelings, and the door doesn't close.\n\nKim\nThe Dogs Spot`,\n },\n];\n\nexport const BRANCH_A: MessageTemplate[] = [\n {\n id: \"branch_a-1\",\n channel: \"sms\",\n offsetHours: 2,\n bodyTemplate: `Hi {{FIRST_NAME}}, it's Kim - looks like we missed each other for your Pup Talk. No worries at all, it happens. Want me to find another time? Just reply and I'll schedule it.`,\n },\n {\n id: \"branch_a-2\",\n channel: \"email\",\n offsetHours: 24, // day +1\n subject: \"Let's find another time\",\n previewText: \"Fifteen minutes, whenever actually suits.\",\n bodyTemplate: `Hi {{FIRST_NAME}},\n\nI noticed we had a Pup Talk scheduled, but we missed each other. No worries at all, I know life gets busy.\n\nIt's a quick, no-pressure call where we'll talk about what's been going on, answer any questions you have, and see whether training with us would be a good fit. And if we're not the right fit, I'll tell you that too.\n\nJust reply with a couple of times that work for you, call or text me at ${PHONE_DISPLAY}, or book a time that's convenient here: ${SHORT_BOOKING_LINK}.\n\nIf I don't hear back, I'll assume now just isn't the right time. Whenever you're ready, just reach out, I'd be happy to help.\n\nKim\nThe Dogs Spot`,\n },\n];\n\nexport const BRANCH_B: MessageTemplate[] = [\n {\n id: \"branch_b-1\",\n channel: \"email\",\n offsetHours: 24, // day +1 after the call\n subject: \"Good talking with you\",\n previewText: \"Just a couple of things from our conversation.\",\n bodyTemplate: `Hi {{FIRST_NAME}},\n\nThanks for the call. It's genuinely useful for me to hear how things are going, even outside of anything you decide to book.\n\nIf it's not the right time for training or boarding with us, that's completely fine. A lot of people need more than one conversation before it's the right moment, and that's how it should work - nobody should sign up on a call because it felt awkward not to.\n\nIf anything changes, or a question comes up later that we didn't cover, reply here or call or text ${PHONE_DISPLAY} anytime. I'd just rather you knew the door's open than wonder.\n\nKim\nThe Dogs Spot`,\n },\n {\n id: \"branch_b-2\",\n channel: \"sms\",\n offsetHours: 192, // day +8 after the call\n bodyTemplate: `Hi {{FIRST_NAME}}, Kim again - no news needed, just checking how it's going for you both. If a question's come up since we spoke, reply here anytime. No pressure either way.`,\n },\n];\n\n\n",[531],"cf4bd546-2941-4b3f-a326-4031435e44ed","SOURCE-BUNDLE.part6.txt","f58f8f72-91ad-11f1-82b0-1607ee4eb77e",1092,["D",1786801896938],46,"THE DOGS SPOT — SOURCE BUNDLE (part 6 of 40)\n\nEVERY source file in this project, engine/ included. Restoring these parts and nothing else gives\nyou a tree that builds, typechecks and runs its own test suite with no network and no val.\n\nengine/ is here as of 14 Aug 2026. It used to be left out because val 1bfa6e81-74e1-4c6c-ab32-118304a4ffff\nholds it, which was true of every engine file except engine/watch.ts: a module the val does not run,\nso it was never deployed, so it lived in one container and nothing else. A reclaim destroyed it.\nscripts/deploy.mjs --check still compares engine/ against the val file by file; that is a second\ncheck on the same files now, not the only copy of them.\n\nRESTORE (needs only node, from an empty folder). Save each part, then run this ON EACH ONE:\n\n node -e 'const fs=require(\"fs\"),p=require(\"path\");const b=fs.readFileSync(process.argv[1],\"utf8\");\n for(const s of b.split(\"\\n=====FILE \").slice(1)){const i=s.indexOf(\" =====\\n\");\n const f=s.slice(0,i),c=s.slice(i+7);fs.mkdirSync(p.dirname(f),{recursive:true});\n fs.writeFileSync(f,c.replace(/\\n$/,\"\"))}' PART.txt\n\nA record named #1, #2, ... is one FILE cut into pieces: concatenate them in order, then\nstrip one trailing newline from the last. scripts/restore.mjs does this for you.\n\nEach part is complete in itself: whole files only, no reassembly, any order.\n\nThen: node scripts/build.mjs (engine/ came out of these parts; nothing to fetch first)\n node scripts/typecheck.mjs\n node tests/run-all.mjs\n node scripts/deploy.mjs --check (pulls nothing, proves the val matches what you restored)\n node tests/negative-controls.mjs (proves the suite above can actually fail)\n\nIN THIS PART (3 of 116 files)\n engine/holiday-deposits.ts 50761 bytes 65026619eb4a\n engine/kim-stories.ts 5461 bytes 66b22bd3d93d\n engine/money-match.ts 10258 bytes 428c6fd65499\n\n================================================================================================\n=====FILE engine/holiday-deposits.ts =====\n// HOLIDAY DEPOSIT TRACKER. v1.0, 6 Aug 2026.\n//\n// WHAT KIM ASKED FOR: she charges a $50 nonrefundable deposit on boarding stays over holidays,\n// and today somebody goes through the bookings by hand to work out who has paid.\n//\n// WHAT THIS CAN AND CANNOT DO, because the difference is the whole honesty of the feature.\n// Square money DOES reach the CRM. It arrives as a note on the contact, like\n// \"[Square] +$355.00 payment tWYOxuFcG9ZqzF7GTnUPfElf2ZEZY (balance $0.00)\"\n// (verified live on 6 Aug against a real contact). So we can see payments that went through\n// Square. We CANNOT see a deposit handed over in cash or taken over the phone. That means this\n// produces a SHORTLIST TO CHECK, never a list of people who have not paid. The word \"unpaid\"\n// is banned from anything this module renders, and a test enforces that.\n//\n// TWO TRAPS FOUND IN HER REAL DATA, both of which would have made Kim chase the wrong people:\n// 1. The same Square payment is written into the notes FIVE times, and the \"(balance ...)\"\n// figures inside those duplicates contradict each other ($355.00 then $0.00 four times).\n// So: dedupe on the payment id, and never read the balance figure.\n// 2. A recurring weekly slot (\"Daycare Enzo\") lands inside every holiday window. Without a\n// recurring filter Kim would be told a regular customer owes her a holiday deposit eight\n// times over. Recurring bookings are excluded.\n//\n// THIS MODULE WRITES NOTHING. No tag, no custom field, no pipeline stage, no message. That is\n// deliberate and it is tested: addTag() elsewhere in this engine is not TEST_MODE-guarded, and\n// this account contains a workflow (\"Add tag 'red flag' = DND\") which proves a single tag here\n// can silence a real customer on six channels. A read-only report cannot do that.\n\nexport type CalEvent = {\n contactId?: string | null;\n title?: string | null;\n startTime?: string | number | null; // carries its own offset, e.g. \"2026-11-25T09:00:00-05:00\"\n // The pick-up. A stay that starts before a holiday window and runs into it is a holiday stay,\n // and without this the module could only see the drop-off day.\n endTime?: string | number | null;\n dateAdded?: string | null;\n appointmentStatus?: string | null;\n // Her CRM really does return BOTH spellings on the same object: 4 of the 13 events on the\n // Boarding Drop Off calendar carry `appoinmentStatus` alongside the correct one (checked live,\n // 6 Aug 2026). They agree today. Reading only one of them is passing a test by luck.\n appoinmentStatus?: string | null;\n isRecurring?: boolean | null;\n deleted?: boolean | null;\n};\n\n// \"direct\" = \"[Square] +$35.00 payment (balance $x)\" — money arriving\n// \"matched\" = \"[Square] Till payment $35.00 on . Matched from Square payment ...\"\n// — a RECONCILIATION record written by the backfill, carrying its own separate id.\n// Both are real and both are live in her account on the same contact, with the same amount and\n// two different ids. See collapseSameMoney() for why that distinction has to survive parsing.\nexport type Payment = { amount: number; id: string; at: string | null; kind: \"direct\" | \"matched\" };\n\nexport type Stay = {\n contactId: string;\n day: string; // local date of the drop-off, \"YYYY-MM-DD\"\n until: string; // local date of the pick-up; equals `day` when the CRM does not say\n dogs: string[]; // one stay can be several dogs (names, best effort)\n dogCount: number; // how many drop-off rows this stay is, whether or not the names parsed\n bookedAt: string | null;\n window: string; // which holiday it falls in, in Kim's words\n};\n\nexport type StayStatus = {\n stay: Stay;\n state: \"seen\" | \"partial\" | \"none_seen\" | \"could_not_check\";\n amountSeen: number;\n note: string; // the plain-English reason, always populated\n};\n\n/** The fourth Thursday of November. Computed, never typed, so it cannot drift year to year.\n * Kim was told Thanksgiving is handled by working it out fresh each year. This is that. */\nexport function thanksgiving(year: number): string {\n // day 1 of November, then walk to the first Thursday, then add three weeks.\n const first = new Date(Date.UTC(year, 10, 1));\n const dow = first.getUTCDay(); // 0 Sun .. 4 Thu\n const firstThu = 1 + ((4 - dow) + 7) % 7;\n const day = firstThu + 21;\n return `${year}-11-${String(day).padStart(2, \"0\")}`;\n}\n\n/** The windows a deposit applies to, as dates, derived rather than hardcoded.\n * Thanksgiving: the Monday before through the Sunday after.\n * Christmas and New Year: 20 Dec through 2 Jan.\n * If Kim wants different edges these are the only two lines to change. */\nexport function holidayWindows(year: number): { name: string; from: string; to: string }[] {\n const t = thanksgiving(year);\n // [was: String(Number(t.slice(8)) + 3) — decimal arithmetic on the day number. Whenever\n // Thanksgiving falls on the 28th (2030, 2041, ...) that produced \"2030-11-31\", a date that does\n // not exist. Two consequences, both live: a stay dropping off Sunday 1 December sorts ABOVE\n // \"2030-11-31\" in a string compare and vanishes from the window, and the card printed the\n // words \"Thanksgiving (Nov 25 to Nov 31)\" to Kim. Real calendar arithmetic now.]\n return [\n { name: \"Thanksgiving\", from: shiftDays(t, -3), to: shiftDays(t, 3) },\n { name: \"Christmas and New Year\", from: `${year}-12-20`, to: `${year + 1}-01-02` },\n ];\n}\n\n/** The local calendar day of an appointment. startTime carries its own offset, so the first ten\n * characters ARE the local day. Parsing it into a Date and reformatting would shift bookings\n * across midnight into or out of a window, which is how a customer gets chased by mistake.\n *\n * A NUMBER is handled separately and deliberately. Two sibling modules that read this same CRM\n * endpoint already defend against an epoch-millisecond startTime, so the shape is real. Returning\n * null for it would have dropped EVERY stay silently and stored \"no holiday stays are booked\" as\n * a fact, in November, with the kennels full. An epoch has no offset, so it is converted in the\n * business's own timezone rather than in whatever timezone the server happens to be in. */\nexport const BUSINESS_TZ = \"America/New_York\";\nexport function localDay(startTime: string | number | null | undefined): string | null {\n if (typeof startTime === \"number\" && Number.isFinite(startTime)) {\n try {\n const p = new Intl.DateTimeFormat(\"en-CA\", { timeZone: BUSINESS_TZ, year: \"numeric\", month: \"2-digit\", day: \"2-digit\" })\n .format(new Date(startTime));\n return /^\\d{4}-\\d{2}-\\d{2}$/.test(p) ? p : null;\n } catch { return null; }\n }\n if (!startTime || typeof startTime !== \"string\" || startTime.length < 10) return null;\n // A STRING ENDING IN Z IS UTC, AND ITS FIRST TEN CHARACTERS ARE NOT THE LOCAL DAY.\n //\n // The slice below is right for \"2026-11-25T21:00:00-05:00\", which carries New York's own offset.\n // It is wrong by a whole day for \"2026-11-26T02:00:00Z\", which is the same instant: every evening\n // drop-off from about 7pm Eastern reads as the NEXT calendar day. A stay on 2 January — the last\n // day of the Christmas and New Year window — moves to the 3rd, falls outside `to`, and the\n // customer silently never appears on Kim's shortlist at all. No error, no \"could not check\".\n //\n // Said plainly: this shape has NOT been seen on this endpoint. Every startTime read live on 6 and\n // 7 August carried an explicit offset. But two sibling modules already defend against an epoch\n // number from this same CRM, a Z suffix is unambiguous when it does appear, and converting it in\n // the business's own timezone costs one branch. Handling it is cheap; slicing it is wrong.\n if (/\\dZ$/.test(startTime)) {\n const t = Date.parse(startTime);\n return Number.isFinite(t) ? localDay(t) : null; // through the epoch branch, in BUSINESS_TZ\n }\n const d = startTime.slice(0, 10);\n return /^\\d{4}-\\d{2}-\\d{2}$/.test(d) ? d : null;\n}\n\n/** WHICH SEASON ARE WE IN. Passed the local date as \"YYYY-MM-DD\", never reading the clock itself,\n * so this is testable and cannot behave differently on the val than it does here.\n * On 1 January the season that matters is still LAST year's — the New Year window runs to the 2nd,\n * and a page that flips to next Thanksgiving on New Year's Day drops the stays happening that day. */\nexport function businessDay(nowIso: string): string {\n // Her business is in New York. Rolling the season over on the UTC date empties the card at 8pm\n // on 2 January, five hours before the season actually ends, while dogs are still in the kennels\n // — and the empty result then gets stored over the real one.\n try {\n const d = new Date(nowIso);\n if (isNaN(d.getTime())) return String(nowIso).slice(0, 10);\n const p = new Intl.DateTimeFormat(\"en-CA\", { timeZone: BUSINESS_TZ, year: \"numeric\", month: \"2-digit\", day: \"2-digit\" }).format(d);\n return /^\\d{4}-\\d{2}-\\d{2}$/.test(p) ? p : String(nowIso).slice(0, 10);\n } catch { return String(nowIso).slice(0, 10); }\n}\n\nexport function seasonYear(today: string): number {\n const y = Number(today.slice(0, 4));\n const md = today.slice(5, 10);\n return md <= \"01-02\" ? y - 1 : y;\n}\n\nexport function windowFor(day: string | null, windows: { name: string; from: string; to: string }[]): string | null {\n if (!day) return null;\n for (const w of windows) if (day >= w.from && day <= w.to) return w.name;\n return null;\n}\n\n/** A STAY, not a moment. Somebody who drops off on 19 December and collects on 27 December has\n * boarded over Christmas and owes the holiday deposit, but their drop-off day is outside the\n * window. Deciding membership on the drop-off day alone dropped exactly the customers a holiday\n * boarding business has most of: the ones who leave the day before they travel. */\nexport function windowForRange(from: string | null, to: string | null, windows: { name: string; from: string; to: string }[]): string | null {\n if (!from) return null;\n const end = to && to >= from ? to : from;\n for (const w of windows) if (from <= w.to && end >= w.from) return w.name;\n return null;\n}\n\n/** Which bookings count. Cancelled, deleted and recurring are all excluded, and the recurring\n * exclusion is the one that matters most: a standing weekly slot is not a holiday stay. */\nexport const DEAD_STATUSES = [\"cancelled\", \"canceled\", \"noshow\", \"no-show\", \"no show\", \"invalid\"];\nexport function eligible(e: CalEvent): boolean {\n if (!e || truthy(e.deleted)) return false;\n // [was: `e.isRecurring === true`. Her CRM has already been caught shipping the misspelled\n // `appoinmentStatus`, so trusting it to always send a real boolean here is a bet, not a fact.\n // A recurring series returned with isRecurring:\"true\" would have put a weekly daycare regular\n // on the list telling him he owes a boarding deposit.]\n if (truthy(e.isRecurring)) return false;\n // BOTH spellings are read, and either one saying cancelled is enough to drop the booking.\n // The asymmetry is deliberate: dropping a live booking means Kim is not prompted about it and\n // she notices; keeping a cancelled one means she chases a customer who already cancelled, and\n // that one she cannot take back.\n // TRIMMED, because this account demonstrably ships padded strings: \"Daycare Enzo \" and\n // \" Boarding Dropoff with Help Test\" are both real titles out of it. One trailing space on a\n // status was enough to make a cancelled booking eligible.\n const states = [e.appointmentStatus, e.appoinmentStatus].map((s) => String(s ?? \"\").trim().toLowerCase());\n // EXPORTED so a test can assert the whole list rather than the one spelling somebody thought\n // of. GHL really does emit `noshow` and `invalid`, and the American spelling is one keystroke\n // away. Letting any of them through puts a customer who cancelled on Kim's chase list, which\n // the comment above calls the mistake she cannot take back.\n const dead = DEAD_STATUSES;\n if (states.some((s) => dead.includes(s))) return false;\n if (!e.contactId) return false;\n // A DAYCARE slot is not a boarding stay and carries no boarding deposit. Until now the ONLY\n // thing keeping the weekly \"Daycare Enzo\" booking off Kim's list was its recurrence flag; a\n // one-off daycare booking in Christmas week would have been billed a $50 boarding deposit.\n // Narrowed: a title that says BOTH is a boarding booking with a note on it, and excluding\n // \"Boarding + daycare drop off with Dan Bonner\" would lose a real holiday stay.\n const title = String(e.title ?? \"\");\n if (/\\bday\\s?care\\b/i.test(title) && !/\\bboarding\\b/i.test(title)) return false;\n return true;\n}\n\n/** Her CRM's booleans are not reliably booleans. Treats \"true\"/\"TRUE\"/1 the same as true, and\n * anything else, including undefined, as false. */\nfunction truthy(v: unknown): boolean {\n if (v === true || v === 1) return true;\n return typeof v === \"string\" && v.trim().toLowerCase() === \"true\";\n}\n\n/** A dog's name out of \"Achilles — Boarding Drop Off\" style titles, best effort and never fatal. */\nexport function dogFromTitle(title: string | null | undefined): string {\n const t = (title || \"\").trim();\n if (!t) return \"\";\n // [was: split on /[—–-]/, which cut \"Jean-Luc — Boarding Drop Off\" down to \"Jean\". A hyphen\n // inside a name is not a separator; a SPACED hyphen is. Kim reads these names before phoning\n // somebody, so the wrong name here is a wrong conversation.]\n const cut = t.split(/\\s[—–-]\\s|[—–]|\\bBoarding\\b|\\bDrop\\s?off\\b/i)[0];\n return cut.trim().replace(/\\s+with\\s+.*$/i, \"\").trim();\n}\n\n/** WHERE THE END OF A STAY ACTUALLY LIVES. A drop-off appointment in her CRM is a TEN MINUTE\n * slot: \"2026-11-25T12:50 to 2026-11-25T13:00\". Its endTime is the end of the handover, not the\n * end of the boarding. The real length of the stay is on a separate Boarding Pick Up calendar —\n * Ghost and Chewy drop off on 25 November and are collected on the 28th, and only the pick-up\n * calendar says so. Without this, \"did this dog board over Christmas\" could only ever be answered\n * by the drop-off date, and everybody who leaves the day before the holiday starts was invisible.\n * The LATEST eligible pick-up on or after the drop-off wins, bounded by the customer's own next\n * booking and by MAX_STAY_DAYS. */\nexport const MAX_STAY_DAYS = 21;\nexport function attachPickups(stays: Stay[], pickups: CalEvent[]): Stay[] {\n const byContact = new Map();\n for (const p of pickups) {\n if (!eligible(p)) continue;\n const d = localDay(p.startTime);\n if (!d || !p.contactId) continue;\n const list = byContact.get(p.contactId) ?? [];\n list.push(d);\n byContact.set(p.contactId, list);\n }\n for (const list of byContact.values()) list.sort();\n // The customer's OWN next drop-off is the hard upper bound. Without it a stay reaches forward\n // and takes a pick-up belonging to a later booking: a 3-night Thanksgiving stay was rendered\n // \"Nov 25 to Dec 27\", and an ordinary 6 November boarding was dragged into a holiday window and\n // billed a deposit. [was: the EARLIEST pick-up on or after the drop-off, which was wrong the\n // other way — one dog of three going home early cut the stay short and deleted it from the\n // window entirely. Her pick-up calendar really does carry one row per dog.]\n // A stay cannot run forever. Without an upper bound an ORPHAN pick-up — and her account has\n // about twenty contacts with pick-ups and no matching drop-off — drags an out-of-season boarding\n // into a holiday window: a 6 November stay with a stray 1 February pick-up record rendered as\n // \"Nov 6 to Feb 1\" on Kim's shortlist.\n const dropDays = new Map();\n for (const s of stays) {\n const list = dropDays.get(s.contactId) ?? [];\n list.push(s.day);\n dropDays.set(s.contactId, list);\n }\n for (const list of dropDays.values()) list.sort();\n return stays.map((s) => {\n const nextDrop = (dropDays.get(s.contactId) ?? []).find((d) => d > s.day);\n // `<=` on the next drop-off, not `<`: a pick-up on the same day as the customer's next\n // booking is the END of this stay, not part of the next one. With a strict `<`, a customer\n // collecting on 27 December and re-boarding the same day lost their Christmas stay entirely.\n const cands = (byContact.get(s.contactId) ?? []).filter((d) =>\n d >= s.day && d <= shiftDays(s.day, MAX_STAY_DAYS) && (!nextDrop || d <= nextDrop));\n const cand = cands.length ? cands[cands.length - 1] : null;\n return cand && cand > s.until ? { ...s, until: cand } : s;\n });\n}\n\n/** One customer dropping three dogs on the same day is ONE stay and ONE deposit question. */\nexport function groupIntoStays(\n events: CalEvent[],\n windows: { name: string; from: string; to: string }[],\n pickups: CalEvent[] = [],\n): Stay[] {\n const by = new Map();\n for (const e of events) {\n if (!eligible(e)) continue;\n const day = localDay(e.startTime);\n const until = localDay(e.endTime) ?? day;\n if (!day) continue;\n const key = `${e.contactId}|${day}`;\n const dog = dogFromTitle(e.title);\n const existing = by.get(key);\n if (existing) {\n if (dog && !existing.dogs.includes(dog)) existing.dogs.push(dog);\n // COUNTED FROM THE ROWS, not from the names. A title that does not parse still means a dog,\n // and the deposit is charged per dog, so counting parsed names would under-charge.\n existing.dogCount++;\n // the LATEST pick-up across the dogs on this stay\n if (until && until > existing.until) existing.until = until;\n // keep the EARLIEST booking time: that is when the deposit became due\n if (e.dateAdded && (!existing.bookedAt || e.dateAdded < existing.bookedAt)) existing.bookedAt = e.dateAdded;\n } else {\n by.set(key, { contactId: e.contactId!, day, until: until ?? day, dogs: dog ? [dog] : [], dogCount: 1, bookedAt: e.dateAdded ?? null, window: \"\" });\n }\n }\n // Pick-ups are attached BEFORE the window filter, because the whole point is that a stay whose\n // drop-off falls outside a window can still run through it.\n const withEnds = attachPickups([...by.values()], pickups);\n const out: Stay[] = [];\n for (const s of withEnds) {\n const win = windowForRange(s.day, s.until, windows);\n if (win) out.push({ ...s, window: win });\n }\n return out.sort((a, b) => (a.day < b.day ? -1 : a.day > b.day ? 1 : 0));\n}\n\n/** Square payments out of contact notes, DEDUPED BY PAYMENT ID.\n * The same payment appears five times in her real data with contradictory balance figures, so\n * the balance is deliberately not read: only the amount and the payment's own id. */\nexport function parseSquarePayments(notes: { body?: string | null; dateAdded?: string | null }[] | null | undefined): Payment[] {\n const out = new Map();\n // EVERY match in EVERY note, not the first match in each.\n // [was: .exec() on each body, i.e. one payment per note. A note holding two Square lines lost\n // the second one. Every parser gap in this function fails in the same direction — less money\n // seen than was paid — and that direction is the one that puts a paying customer on the list.]\n // The amount tolerates whole dollars (\"+$50 payment\") as well as cents, and the id stops at\n // punctuation so a trailing comma cannot become part of the dedupe key.\n const DIRECT = /\\[Square\\]\\s*\\+?\\$([\\d,]+(?:\\.\\d{2})?)\\s+payment\\s+([A-Za-z0-9_-]+)/gi;\n // Format 2: the reconciliation backfill. It carries the REAL payment date in its own text,\n // which is four days earlier than the note's dateAdded on the live example, so the stated\n // date is used and the note's write time is only the fallback. The trailing punctuation after\n // the id is OPTIONAL: on a note that ENDS at the id the whole payment used to vanish.\n const MATCHED = /\\[Square\\][^[]*?Till payment\\s*\\$([\\d,]+(?:\\.\\d{2})?)\\s*on\\s*(\\d{4}-\\d{2}-\\d{2})[\\s\\S]*?Matched from Square payment\\s+([A-Za-z0-9_-]+)/gi;\n const add = (amount: number, id: string, at: string | null, kind: \"direct\" | \"matched\") => {\n if (!Number.isFinite(amount) || !id) return;\n const prev = out.get(id);\n // keep the earliest sighting of a given payment\n if (!prev || (at && prev.at && at < prev.at)) out.set(id, { amount, id, at, kind });\n else if (!prev.at) out.set(id, { amount, id, at, kind });\n };\n for (const n of notes ?? []) {\n const body = n?.body ?? \"\";\n if (!body) continue;\n for (const m of body.matchAll(MATCHED)) add(Number(m[1].replace(/,/g, \"\")), m[3], m[2], \"matched\");\n for (const m of body.matchAll(DIRECT)) add(Number(m[1].replace(/,/g, \"\")), m[2], n?.dateAdded ?? null, \"direct\");\n }\n return [...out.values()].sort((a, b) => String(a.at).localeCompare(String(b.at)));\n}\n\n/** THE SAME $35, TWICE, UNDER TWO IDS.\n * Live on David Newman's contact right now: \"+$35.00 payment z3rQ...\" and \"Till payment $35.00\n * on 2026-07-17. Matched from Square payment 3zu7...\". Same money or two payments? Nothing in\n * the data settles it, and the two readings disagree about whether a $50 deposit is covered.\n * So the conservative reading wins: a \"Matched from\" record of the same amount as a direct\n * payment is treated as describing that same money. Getting this wrong the other way removes a\n * person from the shortlist, and a person who is not on the shortlist is never looked at. */\n/** A CONTACT THAT LOOKS LIKE SOMEBODY TESTING THE BOOKING FORM. Kim's account holds at least two:\n * a contact literally named \"help test\" with three future boarding bookings, and a tagged\n * \"ZZTEST PuppyPath-Dummy\". This does NOT remove the row — a filter that quietly drops a real\n * customer called Mr Test is worse than a label — it flags it, so Kim knows before she picks up\n * the phone to a stranger about $50. */\nexport function looksLikeTestRecord(name: string | null | undefined): boolean {\n // \"tester\" is deliberately absent: Tester is a real surname, and this label appears on Kim's\n // screen right next to a person's name, immediately before she decides whether to phone them.\n return /\\b(test|testing|dummy|zztest|do not use|ignore)\\b/i.test(String(name ?? \"\"));\n}\n\n// 21 DAYS, and the number is not a guess. The one real pair on her account is a payment noted on\n// 31 July reconciling a till payment the backfill states was taken on 17 July: 14.6 days, because\n// the parser deliberately uses the backfill's OWN stated payment date rather than the day the note\n// was written. A fortnight would have been too tight for the only case anybody has ever seen, so\n// the bound carries about 40% headroom over it and still refuses to fold across months.\nexport const COLLAPSE_WINDOW_DAYS = 21;\nexport function collapseSameMoney(payments: Payment[]): { kept: Payment[]; collapsed: number } {\n // IDEMPOTENT, and now DATE-BOUNDED. Both properties are load-bearing.\n //\n // Idempotent [round 6]: every backfill record sharing an amount with a payment folds, so a\n // second pass finds nothing. The layers above assume that.\n //\n // Date-bounded [round 9]: a \"Matched from Square payment\" note is a reconciliation of a payment\n // near it in TIME. The one real pair on her account is four days apart; the code was folding on\n // amount alone, across the customer's whole history. $50 is precisely the amount a repeat\n // customer pays more than once in a year, so a November payment and a December till record were\n // being read as one $50 — deleting a real deposit, demoting a settled stay, and then printing\n // \"nothing unspent on file matches that amount\" and \"nothing else is unaccounted for\" about a\n // customer who had paid twice. 2.3% of generated customers. Same false sentence as round 8's\n // bug, a different door.\n //\n // The bias is unchanged and deliberate: folding keeps somebody ON the shortlist, which costs Kim\n // a glance. NOT folding a genuine duplicate would clear somebody who owes, which costs her $50\n // and she never finds out. The bound only stops folding across months, where \"same money\" stops\n // being a plausible reading at all.\n const directs = payments.filter((p) => p.kind === \"direct\");\n const kept: Payment[] = [];\n let collapsed = 0;\n for (const p of payments) {\n if (p.kind === \"matched\" && directs.some((d) => d.amount === p.amount && withinDays(d.at, p.at, COLLAPSE_WINDOW_DAYS))) {\n collapsed++;\n continue;\n }\n kept.push(p);\n }\n return { kept, collapsed };\n}\n\n/** Are two payment dates close enough to be the same money? A missing date on either side counts\n * as close: an undated record is not evidence that they are far apart. */\nexport function withinDays(a: string | null, b: string | null, days: number): boolean {\n const x = Date.parse(String(a ?? \"\")), y = Date.parse(String(b ?? \"\"));\n if (!Number.isFinite(x) || !Number.isFinite(y)) return true;\n return Math.abs(x - y) <= days * 86_400_000;\n}\n\nexport const DEPOSIT = 50;\n\n/** WHAT THIS STAY OWES. Kim's own money page, taken from her live website: \"Holiday boarding —\n * $50 PER DOG, non-refundable. Deducted from the total boarding cost at drop-off.\"\n * [was: a flat $50 per stay, with a line on the card asking Kim to tell us if it was per dog.\n * It is per dog, and it says so in her own handover pack. Jeffrey Musselwhite's three dogs on\n * 25 November owe $150, and a single $50 payment was clearing that whole stay — the silent\n * direction, where somebody who owes $100 more drops off the list and is never looked at.] */\nexport function depositDue(stay: Stay): number {\n return DEPOSIT * dogsOn(stay);\n}\nexport function dogsOn(stay: Stay): number {\n return Math.max(1, stay.dogCount || stay.dogs.length || 1);\n}\n\n/** THE ONE PLACE THAT DECIDES WHICH PAYMENTS SETTLE A STAY. Returns them, or nothing.\n *\n * This exists because the money bug has now come back FOUR times, and every time through the\n * same crack: the rule for \"is this stay settled\" and the rule for \"what did that cost\" lived in\n * two places and drifted apart. The last version cleared a stay on either one payment for the\n * full amount OR one $50 per dog, and then debited a single $50 — so a two-dog stay settled by a\n * $100 payment debited NOTHING, and the same $100 settled the customer's next stay too. Kim owed\n * $200, $100 arrived, neither row reached her shortlist. 29% of generated multi-stay customers\n * hit it.\n *\n * So there is one function. statusFor asks it what settles the stay; the allocator asks it what\n * to spend. They cannot disagree, because it is the same answer. */\nexport function qualifyingPayments(stay: Stay, payments: Payment[]): Payment[] {\n // OLDEST MONEY FIRST, and never in whatever order the array happened to arrive.\n //\n // [was: `near.find(...)` and `perDog.slice(0, dogs)` straight off the caller's array. Two things\n // came out of that, found by a property test over 841,000 shuffles on 7 August:\n // 1. The same customer, the same payments, a different array order, a different answer. There\n // is no meaningful order on this list — it is whatever the notes endpoint returned — so a\n // row could move between \"Payment on file\" and \"Worth a look\" from one hourly run to the\n // next with nothing whatsoever having changed on her account.\n // 2. Worse, it could starve a later stay. Two real $50 payments, both inside the FIRST stay's\n // window, only the later one inside the SECOND stay's window: settle the first stay with the\n // later payment and the second stay has nothing left it can reach, and reads as unpaid.\n // Settle it with the earlier one and both are correctly settled. Oldest-first is the reading\n // that matches how the money was actually spent, and it is stable.\n // Sorted by id as well as date, so two payments stamped the same second cannot swap either.]\n // A payment with no readable date sorts LAST, not first: \"oldest first\" is a claim, and an\n // undated record is not evidence that it is the oldest. DEFENSIVE ONLY, and there is no negative\n // control for it on purpose: paymentsNearStay compares (p.at || \"\").slice(0, 10) against the\n // window, \"\" is below every real date, so an undated payment is filtered out before this line\n // ever sees it. A control that cannot be made to fail is worse than no control. H86 pins the\n // reachable half of that — an undated record never qualifies for a stay at all.\n const when = (p: Payment) => {\n const t = p.at ? Date.parse(p.at) : NaN;\n return Number.isFinite(t) ? t : Number.POSITIVE_INFINITY;\n };\n const near = [...collapseSameMoney(paymentsNearStay(stay, payments)).kept]\n .sort((a, b) => when(a) - when(b) || String(a.id).localeCompare(String(b.id)));\n const due = depositDue(stay);\n const dogs = dogsOn(stay);\n const whole = near.find((p) => p.amount === due);\n if (whole) return [whole];\n const perDog = near.filter((p) => p.amount === DEPOSIT);\n return perDog.length >= dogs ? perDog.slice(0, dogs) : [];\n}\n\n// HOW A PAYMENT IS MATCHED TO A DEPOSIT, and why the answer is \"it mostly is not\".\n//\n// Nothing in her CRM says what a card payment was FOR. Two attempts at guessing have now both\n// been wrong in a way that costs her money:\n// v1 summed every payment between the booking and the drop-off. A $355 training package cleared\n// a $50 deposit, and being cleared means nobody ever looks at that customer again.\n// v2 narrowed it to ten days around the booking and still summed. That missed a real $50 paid\n// eight days later — the page said \"we cannot find a $50 payment\" one line after printing\n// one — and STILL cleared anybody who happened to settle a $240 invoice that same week.\n//\n// So this version stops guessing. It clears a stay on ONE piece of evidence only: a card payment\n// for EXACTLY the deposit amount, in a wide window around the stay. Anything else is shown to Kim\n// with its date and amount and left for her to judge, which takes her about two seconds per row\n// and is the thing she was doing by hand anyway. A wrong \"worth a look\" costs her a glance. A\n// wrong \"settled\" costs her $50 and she never finds out.\n// HOW SHE ACTUALLY GETS PAID, off her own money page: \"Card — at the counter, or through the\n// website's payments page. This is the normal route and THE ONLY ONE THAT MATCHES ITSELF TO A\n// CUSTOMER RECORD AUTOMATICALLY. Venmo — there is a Venmo page on the website. Zelle — sent to an\n// address inside the Zelle app. Cheque — made payable by post.\"\n// [was: \"may still have been paid in cash or over the phone\", which named neither of the two\n// routes she actually offers. Every one of Venmo, Zelle and cheque is invisible here, so naming\n// them is the difference between Kim knowing where to look and Kim assuming non-payment.]\n// CASH IS NOT ONE OF HER ROUTES. [was: \"Venmo, Zelle, cheque or cash\". Her money page lists\n// exactly four ways to pay — Card, Venmo, Zelle and Cheque — and cash appears nowhere on her site\n// or anywhere in the handover pack. The comment directly above this line names the three invisible\n// routes correctly and the string underneath it invented a fourth. True of cash in general,\n// invented as a thing Kim accepts, and the whole point of this sentence is telling her where else\n// to actually look.]\nexport const OTHER_ROUTES = \"A deposit paid by Venmo, Zelle or a cheque does not reach the card system, so it will not show here.\";\n// HER OTHER DEPOSIT. The same money page publishes a $250 non-refundable TRAINING deposit — which\n// is exactly what five dogs owe at $50 each. The per-dog rule widened the set of amounts that can\n// clear a stay from {$50} to {$50, $100, $150, ...}, and $250 is now in it. Nothing in the data\n// says which a $250 payment was for, so the row says so rather than quietly picking one.\nexport const TRAINING_DEPOSIT = 250;\n/** A SINGLE PAYMENT FOR A MULTI-DOG DEPOSIT IS WEAKER EVIDENCE THAN ONE $50 PER DOG, and the\n * per-dog rule quietly widened the amounts that can clear a stay from {$50} to {$50, $100, $150,\n * $200, $250, ...}. Her published boarding rates are $30-$65 a day, so five nights at $30 is $150\n * — a three-dog deposit — and the total is settled at drop-off, inside the search window. $250\n * is her training deposit exactly. Flagging only $250 patched the rarest collision and left the\n * likelier ones silent. Any lump sum above one dog's deposit now says what else it could be. */\nexport function lumpCaveat(due: number): string {\n // The count comes from the amount due, so a four-dog stay is told four and not \"two or three\" —\n // which was $100-$150 of advice printed on a $200 row, contradicting the rule the same row was\n // applying.\n if (due === TRAINING_DEPOSIT) return ` Worth an eye: $${TRAINING_DEPOSIT} is also what a training deposit costs, so this one payment could be either.`;\n if (due > DEPOSIT) return ` Worth an eye: one payment of this size could also be the boarding total rather than the deposit. ${due / DEPOSIT} separate $${DEPOSIT} payments would be clearer.`;\n return \"\";\n}\nexport const NEAR_WINDOW_BEFORE = 30; // a deposit can be taken before the booking is typed in\n\n/** Every card payment close enough to this stay to be worth putting in front of Kim. */\nexport function paymentsNearStay(stay: Stay, payments: Payment[]): Payment[] {\n if (!stay.bookedAt) return [];\n const lo = shiftDays(stay.bookedAt.slice(0, 10), -NEAR_WINDOW_BEFORE);\n const hi = shiftDays(stay.until || stay.day, 1);\n return payments.filter((p) => {\n const d = (p.at || \"\").slice(0, 10);\n return d >= lo && d <= hi;\n });\n}\n\nconst MONTHS = [\"Jan\", \"Feb\", \"Mar\", \"Apr\", \"May\", \"Jun\", \"Jul\", \"Aug\", \"Sep\", \"Oct\", \"Nov\", \"Dec\"];\n/** \"2026-07-21\" -> \"Jul 21\", the same way round as the stay dates on the card. Kim is American and\n * a row that says \"Nov 25 to Nov 28\" beside \"$50.00 on 21 Jul\" makes her read the date twice. */\nexport function prettyDay(iso: string | null | undefined): string {\n const m = /^(\\d{4})-(\\d{2})-(\\d{2})/.exec(String(iso ?? \"\"));\n return m ? `${MONTHS[Number(m[2]) - 1] ?? m[2]} ${Number(m[3])}` : \"\";\n}\n/** \"Oct 5\", \"Oct 5 and Oct 6\", \"Oct 5, Oct 6 and Oct 7\" — never \"a and b and c\". */\n/** \"on Nov 20\" when three dogs were paid for in one visit, rather than \"on Nov 20, Nov 20 and\n * Nov 20\" — which is how a family of three actually pays, at the counter, in one go. */\nexport function sameDayList(days: string[]): string {\n const uniq = [...new Set(days)];\n return uniq.length === 1 ? `on ${uniq[0]}` : `on ${humanList(uniq)}`;\n}\nexport function humanList(items: string[]): string {\n if (items.length <= 1) return items[0] ?? \"\";\n return `${items.slice(0, -1).join(\", \")} and ${items[items.length - 1]}`;\n}\n/** \"$50.00 on Dec 20\" for three taps on the same day, not the same line three times — which is\n * what a four-dog family paying at the counter produced, and reads as a rendering fault. */\nconst listPayments = (ps: Payment[]) => {\n const byAmountAndDay = new Map();\n for (const p of ps) {\n const day = prettyDay(p.at);\n const k = `${p.amount}|${day}`;\n const prev = byAmountAndDay.get(k);\n if (prev) prev.n++;\n else byAmountAndDay.set(k, { amount: p.amount, day, n: 1 });\n }\n return [...byAmountAndDay.values()]\n .map((g) => `${g.n > 1 ? `${g.n} payments of ` : \"\"}$${g.amount.toFixed(2)} on ${g.day}`)\n .join(\", \");\n};\n\nexport function shiftDays(day: string, delta: number): string {\n const d = new Date(`${day}T00:00:00Z`);\n if (isNaN(d.getTime())) return day;\n d.setUTCDate(d.getUTCDate() + delta);\n return d.toISOString().slice(0, 10);\n}\n\n/** could_not_check NEVER collapses into none_seen. A failed read must not read as \"she owes\". */\nexport function statusFor(\n stay: Stay,\n payments: Payment[] | null,\n // WHAT THE ROW SHOWS vs WHAT THE ROW IS SETTLED BY. `payments` is the money still unspent, which\n // is what may settle this stay. `opts.all` is everything on the account, which is what Kim can\n // see in Square. [was: one list for both, so a stay whose money had already been counted against\n // an earlier stay was told \"no card payment is on file around it AT ALL\" — with the payment\n // sitting right there in her window. 7.9% of generated rows. One step from an accusation, and\n // false: she phones, the customer says \"I paid on the 20th\", and they did.]\n opts: { all?: Payment[]; alreadyCounted?: Set } = {},\n): StayStatus {\n if (payments === null) {\n return { stay, state: \"could_not_check\", amountSeen: 0,\n note: \"We could not read this person's payments just now, so this one is unknown. It is not a finding either way.\" };\n }\n // No booking date means no window to search, so there is no honest answer here.\n // [was: the range fell back to the beginning of time, and a payment from 2019 cleared the stay.]\n if (!stay.bookedAt) {\n return { stay, state: \"could_not_check\", amountSeen: 0,\n note: \"This booking has no record of when it was made, so there is no period to check a deposit against. It is not a finding either way.\" };\n }\n const near = collapseSameMoney(paymentsNearStay(stay, opts.all ?? payments)).kept;\n // THE ONLY THING THAT CLEARS A STAY: a card payment for exactly the deposit. Everything else\n // gets shown to Kim with its date and left to her, because nothing in the data says what a\n // payment was for and two goes at guessing have both cost her money.\n const due = depositDue(stay);\n const dogs = dogsOn(stay);\n // TWO SHAPES OF EXACT EVIDENCE, and nothing else clears a stay: one payment for the whole\n // amount due, or one $50 payment per dog. Both are exact-amount matches. Summing whatever else\n // is on the account is what cleared a customer on a training package two versions ago.\n const exact = qualifyingPayments(stay, payments);\n const ids = new Set(exact.map((p) => p.id));\n const rest = near.filter((p) => !ids.has(p.id));\n // Money that IS in this stay's window but has already paid for one of this customer's earlier\n // stays. Naming it is the difference between an honest row and a false one.\n const counted = rest.filter((p) => opts.alreadyCounted?.has(p.id));\n const countedNote = counted.length\n ? ` ${counted.length === 1 ? `A card payment of $${counted[0].amount.toFixed(2)} on ${prettyDay(counted[0].at)} is` : `${counted.length} card payments totaling $${counted.reduce((n, p) => n + p.amount, 0).toFixed(2)} are`} around this stay too, but ${counted.length === 1 ? \"it has\" : \"they have\"} already been counted against ${counted.length === 1 ? \"an earlier stay\" : \"earlier stays\"} of theirs.`\n : \"\";\n const others = rest.filter((p) => !opts.alreadyCounted?.has(p.id));\n const restNote = (others.length\n ? ` ${others.length === 1 ? \"There is also 1 other card payment\" : `There are also ${others.length} other card payments`} on this account around this stay: ${listPayments(others)}.`\n : \"\") + countedNote;\n if (exact.length) {\n // TWO DIFFERENT PAYMENTS CAN SHARE AN AMOUNT AND A DAY, and then the settled one and the\n // left-over one render identically — which makes a correct allocation look exactly like the\n // money bug this module has fought five times. Say how many landed.\n const twinDay = exact.length === 1\n ? near.filter((p) => p.amount === exact[0].amount && prettyDay(p.at) === prettyDay(exact[0].at)).length\n : 1;\n const ofN = twinDay > 1 ? ` (one of ${twinDay} payments of that amount that day)` : \"\";\n return { stay, state: \"seen\", amountSeen: due,\n note: exact.length === 1\n ? `A card payment for exactly $${due.toFixed(2)} is on file on ${prettyDay(exact[0].at)}${ofN}, which is the deposit for ${dogs === 1 ? \"1 dog\" : `${dogs} dogs`}.${lumpCaveat(due)}${restNote}`\n : `${exact.length} card payments of $${DEPOSIT}.00 are on file, one per dog, ${sameDayList(exact.map((p) => prettyDay(p.at)))}. That is the $${due.toFixed(2)} due for ${dogs} dogs.${restNote}` };\n }\n if (near.length) {\n // SPLIT, deliberately. `others` is money Kim could still match to this stay; `counted` is money\n // that is around it but has already paid for one of the same customer's earlier stays. Lumping\n // them together is how a row ends up implying she has been paid twice, or not at all.\n // A PAYMENT CAN BE SHOWN AND NOT COUNTED. `near` is what Kim can see in this stay's window;\n // `exact` is what may settle it. A record whose fold-twin survives OUTSIDE the window is in the\n // first and not the second, and the row then denied a $50 match one clause before printing\n // \"$50.00 on Oct 15\". 1.3% of rows. The module's own header names that exact sentence shape as\n // the v2 bug it fixed, so it cannot be allowed back in a different branch.\n const blocked = others.filter((p) => p.amount === due || p.amount === DEPOSIT);\n const why = blocked.length\n ? `Square records the same money again outside this stay, so ${blocked.length === 1 ? \"it has\" : \"they have\"} not been counted here`\n : \"nothing unspent on file matches that amount\";\n const shown = others.length\n ? `${others.length === 1 ? \"1 card payment is\" : `${others.length} card payments are`} on file around it: ${listPayments(others)}. Worth a look to see whether the deposit is ${others.length === 1 ? \"that one\" : \"among them\"}.`\n : \"Nothing else on this account is unaccounted for around it.\";\n return { stay, state: \"partial\", amountSeen: others.reduce((n, p) => n + p.amount, 0),\n note: `The deposit on this stay is $${due.toFixed(2)} (${dogs === 1 ? \"1 dog\" : `${dogs} dogs`} at $${DEPOSIT}), and ${why}. ${shown}${countedNote}` };\n }\n return { stay, state: \"none_seen\", amountSeen: 0,\n note: `The deposit on this stay is $${due.toFixed(2)} (${dogs === 1 ? \"1 dog\" : `${dogs} dogs`} at $${DEPOSIT}) and no card payment is on file around it at all. ${OTHER_ROUTES}` };\n}\n\n/** ONE PAYMENT, ONE STAY.\n *\n * statusFor answers about a single stay and is handed the customer's whole payment list, so a\n * regular who books Thanksgiving AND Christmas in the same phone call and pays one $50 deposit\n * had BOTH stays marked settled. Kim was owed $100, $50 arrived, and neither row reached the\n * shortlist. That is the exact failure the module says it exists to prevent, and it is the\n * ordinary case rather than an edge — the two windows are six weeks apart and the search window\n * around each booking overlaps almost completely.\n *\n * So the payments are ALLOCATED. Each exact-deposit payment settles at most one stay, earliest\n * drop-off first, and a payment already spent on one stay is invisible to the next. */\nexport function statusesForCustomer(stays: Stay[], payments: Payment[] | null): StayStatus[] {\n // TIE-BROKEN, not just sorted. [was: `a.day.localeCompare(b.day)` alone. JavaScript's sort is\n // stable, so two stays on the SAME DAY stayed in whatever order the caller passed them, and the\n // one that happened to be first took the money. Same customer, same payments, same day, two\n // bookings: which one reads \"Payment on file\" was decided by array order. Found by shuffling\n // the input 464,000 times. The tie-break is the booking date first — the stay she booked\n // earlier is the one an earlier payment belongs to — then fields that identify the stay, so\n // the answer is the same on every run.]\n const key = (s: Stay) => `${s.day}|${s.bookedAt ?? \"\"}|${s.until ?? \"\"}|${dogsOn(s)}|${(s.dogs ?? []).join(\",\")}`;\n const ordered = [...stays].sort((a, b) => a.day.localeCompare(b.day) || key(a).localeCompare(key(b)));\n if (payments === null) return ordered.map((s) => statusFor(s, null));\n // COLLAPSED ONCE, HERE, BEFORE ANYTHING IS ALLOCATED.\n // [was: statusFor collapsed internally and the allocator marked only the SURVIVING id as spent,\n // so the folded twin was still visible to the next stay. The same two records were read as one\n // payment when judging a stay and as two when allocating across them, and one $50 deposit that\n // Square had written twice — the exact direct+matched pair live on her account — cleared TWO\n // holiday stays, quoting two different dates so it read as two deposits.]\n const money = collapseSameMoney(payments).kept;\n const spent = new Set();\n return ordered.map((s) => {\n const available = money.filter((p) => !spent.has(p.id));\n // `all` IS THE RAW LIST, not the globally collapsed one. [was: `all: money`, and the docstring\n // for `all` says \"everything on the account, which is what Kim can see in Square\" — which the\n // collapsed list is not. A till record folded against a payment OUTSIDE this stay's window\n // vanished from the display, and the row printed the banned sentence: a customer who paid BOTH\n // deposits, fourteen days apart, had her Thanksgiving row read \"no card payment is on file\n // around it at all\". Adding a later payment turned a settled stay into \"nothing at all\".\n // statusFor collapses `all` itself, scoped to this stay's own window, which is the only scope\n // where \"same money\" is a reading rather than a guess.]\n const st = statusFor(s, available, { all: payments, alreadyCounted: new Set(spent) });\n if (st.state === \"seen\") {\n // EARLIEST DROP-OFF FIRST, and the earliest qualifying payment settles it. Both halves are\n // deliberate and both are pinned by H48: without an order, which stay gets the money is\n // whichever way the array happened to arrive.\n // COMPUTED EXACTLY AS statusFor COMPUTES THE ONE IT QUOTES, so the record Kim reads on the\n // row is the record that gets debited. Since collapseSameMoney is idempotent this second\n // pass is a no-op on already-collapsed money, and there is deliberately no control for it:\n // a control that cannot fail is worse than none. H57 is what guards the idempotency this\n // relies on. [was: paymentsNearStay without the collapse, which diverged from the quote.]\n // EVERY payment that settled it, not one of them. [was: `.find(p => p.amount === DEPOSIT)`,\n // which debited nothing at all when a multi-dog stay was settled by one lump sum, and one of\n // N when it was settled per dog. Same money, two stays, both green.]\n for (const p of qualifyingPayments(s, available)) spent.add(p.id);\n }\n return st;\n });\n}\n\n/** The kill switch. If the payment feed itself looks dead, say so instead of telling Kim that\n * every single customer owes her money.\n *\n * MIN_SAMPLE exists because of what happened on the first live run, 6 Aug 15:41Z. Two holiday\n * stays were booked, neither customer had a Square note, and the switch fired: Kim would have\n * been shown \"the payment feed has stopped\" on the strength of two people. Two customers with no\n * Square payment is an ordinary Tuesday, not evidence of an outage. Below the floor the list is\n * shown with its usual caveats, which is the honest reading of a small sample.\n *\n * IT COUNTS CUSTOMERS, NOT BOOKINGS. [was: one entry per stay, so a single regular with five\n * holiday drop-offs and a habit of paying cash cleared the floor on their own and suppressed the\n * whole card. Her real data has one contact with 24 drop-offs. The docstring said \"customers\"\n * and the code counted rows.] */\nexport const MIN_SAMPLE_FOR_DEAD_FEED = 5;\nexport function feedLooksDead(perCustomer: Map | Payment[][], minSample = MIN_SAMPLE_FOR_DEAD_FEED): boolean {\n const lists = perCustomer instanceof Map ? [...perCustomer.values()] : perCustomer;\n return lists.length >= minSample && lists.every((p) => p.length === 0);\n}\n\n/** The sentence Kim reads. Generated from the counts, so the words cannot disagree with them. */\n// Takes anything carrying a `state`, not a full StayStatus: the dashboard regenerates this line\n// from the rows it is about to render, so the two cannot disagree, and a DepositRow is not a Stay.\nexport function depositSentence(statuses: readonly { state: StayStatus[\"state\"] }[], feedDead: boolean): string {\n if (statuses.length === 0) {\n return \"No holiday boarding stays are booked in the deposit windows yet, so there is nothing to check.\";\n }\n const none = statuses.filter((s) => s.state === \"none_seen\").length;\n const partial = statuses.filter((s) => s.state === \"partial\").length;\n const seen = statuses.filter((s) => s.state === \"seen\").length;\n const unknown = statuses.filter((s) => s.state === \"could_not_check\").length;\n if (feedDead) {\n // The old wording claimed \"no Square payment has been recorded against ANYBODY\", which was a\n // claim about people the run had never managed to read. It now says how many it actually read.\n const checked = statuses.length - unknown;\n if (checked <= 0) {\n return `There ${statuses.length === 1 ? \"is 1 holiday stay\" : `are ${statuses.length} holiday stays`} booked, and ${statuses.length === 1 ? \"it could not be checked\" : \"none of them could be checked\"} just now, so there is nothing to report either way yet.`;\n }\n return `There ${statuses.length === 1 ? \"is 1 holiday stay\" : `are ${statuses.length} holiday stays`} booked, and no card payment shows against ${checked === statuses.length ? (statuses.length === 1 ? \"it\" : \"any of them\") : (checked === 1 ? \"the one we could check\" : `any of the ${checked} we could check`)}. That pattern usually means the payment feed has stopped rather than that nobody has paid, so the list is being held back until that is checked.`;\n }\n const bits: string[] = [];\n bits.push(`${statuses.length} holiday ${statuses.length === 1 ? \"stay is\" : \"stays are\"} booked.`);\n if (seen) bits.push(`${seen} ${seen === 1 ? \"has a card payment\" : \"have a card payment\"} on file.`);\n if (none || partial) {\n const n = none + partial;\n // NO FIXED FIGURE HERE. The deposit is $50 per dog, so the amount due differs per row: the\n // headline said \"we cannot find a $50 payment\" above a three-dog stay that owes $150. Each\n // row states its own amount; the headline states none.\n // \"the deposit for it\", not \"what is owed on it\". [was: \"owed\", which is the vocabulary of a\n // debt list. The card's own closing sentence exists to say this is not one, and every other\n // string on it was already careful about this. Plainer, and it names the actual figure's name.]\n bits.push(`${n} ${n === 1 ? \"is worth checking\" : \"are worth checking\"}: we cannot find a card payment matching the deposit for ${n === 1 ? \"it\" : \"them\"}.`);\n }\n if (unknown) bits.push(`${unknown} could not be checked just now.`);\n bits.push(`${OTHER_ROUTES} This is a shortlist to look at rather than a list of people who owe you.`);\n return bits.join(\" \");\n}\n\n\n=====FILE engine/kim-stories.ts =====\n// KIM'S STORIES — the one file that makes the taper personal. v1.8, 4 Aug 2026.\n//\n// THE RULE THIS FILE EXISTS TO ENFORCE: no invented stories, ever. No fictional dogs, no\n// composite customers, no \"a client once told me\". Every `story` below starts as null and stays\n// null until KIM'S OWN WORDS go in. The copy is written to read complete without them — an\n// empty slot renders as nothing, not as a hole.\n//\n// HOW TO FILL ONE IN (the whole procedure, ~5 minutes):\n// 1. Kim answers a question from the Story Capture Sheet (handover/Story-Capture-Sheet.pdf).\n// 2. Paste her answer, lightly tidied but in her words, as the `story` string below.\n// Keep it to 2-4 sentences. First person. No customer surnames without her okay.\n// 3. PUT this one file to the val (same deploy command as always). Nothing else changes.\n// 4. The next send that hits that slot carries her story. Practice mode renders it too,\n// so it can be checked on the panel/journal before anyone real sees it.\n//\n// Slots are ADDITIVE paragraphs: the template holds {{STORY:id}} on its own line; the renderer\n// swaps in the story, or removes the line entirely when null. Both paths are tested.\n\nexport type StorySlot = {\n id: string;\n // The question that gets a usable answer from Kim in 30 seconds — printed on the capture sheet.\n prompt: string;\n // Where it lands, so a human editing this file knows the context without opening the copy file.\n lands: string;\n // Kim's words, or null. Null = the message sends without it and reads complete.\n story: string | null;\n};\n\nexport const STORY_SLOTS: StorySlot[] = [\n {\n id: \"teenage\",\n prompt: \"Name one dog who turned into a teenage terror around 8 months and came good. What did the owner stick with?\",\n lands: \"Slow track week 1 — the adolescence email\",\n story: null,\n },\n {\n id: \"alone_time\",\n prompt: \"Tell me about one dog who couldn't be left alone at first. What actually fixed it?\",\n lands: \"Slow track day 63 — the alone-time email\",\n story: null,\n },\n {\n id: \"vet_visits\",\n prompt: \"Which dog do you know who walks into the vet happy? What did their owner do differently?\",\n lands: \"Slow track day 70 — the vet visits email\",\n story: null,\n },\n {\n id: \"settle\",\n prompt: \"One dog you can picture lying calmly somewhere busy (a patio, a game, a store). How did they get there?\",\n lands: \"Slow track day 119 — the off-switch email\",\n story: null,\n },\n {\n id: \"dog_parks\",\n prompt: \"One thing you've seen go wrong at a dog park that the owner never noticed. What should they have seen?\",\n lands: \"Slow track day 147 — the dog parks email\",\n story: null,\n },\n {\n id: \"nose_work\",\n prompt: \"Name a dog who was 'bad' until they got a job to do. What was the job?\",\n lands: \"Slow track day 175 — the boredom email\",\n story: null,\n },\n {\n id: \"leash_meetings\",\n prompt: \"Which pair of dogs hated each other on leash but got along fine off it, or walking side by side?\",\n lands: \"Slow track day 203 — the leash meetings email\",\n story: null,\n },\n {\n id: \"holidays\",\n prompt: \"What's one thing that happens at the kennel every Thanksgiving or Christmas that owners would never guess?\",\n lands: \"Monthly November — the holiday guests email\",\n story: null,\n },\n];\n\nconst byId = new Map(STORY_SLOTS.map((s) => [s.id, s]));\n\n// Anything SHAPED like a slot token but not a slot we know: an empty id `{{STORY:}}`, a spaced id\n// `{{STORY: a b }}`, the residue a nested token leaves behind after its inner half resolves. None of\n// these is a slot, so none of them is content. They get removed, never shipped.\n// [was: a single pass matching only /\\{\\{STORY:[a-z_]+\\}\\}/, which left `{{STORY:}}` standing\n// after resolving the inner token of `{{STORY:{{STORY:x}}}}`. Caught by tests/stories.test.mjs S5.]\nconst TOKEN_SHAPE = /\\{\\{STORY:[^{}]*\\}\\}/g;\n// Last line of defence: even a half-token fragment must not reach a customer.\nconst TOKEN_FRAGMENT = /\\{\\{STORY:[^}]*\\}{0,2}/g;\n\n// story text, or null. Trims whitespace so a pasted answer can't break the layout.\nexport function storyFor(id: string): string | null {\n const s = byId.get(id)?.story;\n if (!s) return null;\n // A pasted answer can't smuggle a slot token back in (single-pass resolve would ship it raw).\n const t = s.replace(TOKEN_FRAGMENT, \"\").trim();\n return t.length ? t : null;\n}\n\n// Resolve every {{STORY:id}} token in a rendered body. Unknown ids resolve to nothing rather\n// than leaking a token to a customer — and the tests assert every id used in copy exists here.\n//\n// Resolution LOOPS rather than running once. One pass is not enough: a malformed nest only reveals\n// its outer token after the inner one is gone, and a filled story sitting next to a token can shift\n// what the next match sees. The loop is bounded (a pass that changes nothing stops it), so a\n// pathological input costs a few passes rather than hanging.\nexport function resolveStories(text: string): string {\n let out = String(text ?? \"\");\n for (let pass = 0; pass < 8 && out.includes(\"{{STORY:\"); pass++) {\n const before = out;\n out = out.replace(/\\{\\{STORY:([a-z_]+)\\}\\}/g, (_, id) => storyFor(id) ?? \"\");\n out = out.replace(TOKEN_SHAPE, \"\");\n if (out === before) break;\n }\n // Whatever survived the loop is not a slot and is not content.\n out = out.replace(TOKEN_FRAGMENT, \"\");\n return out.replace(/\\n{3,}/g, \"\\n\\n\").trim();\n}\n\n\n=====FILE engine/money-match.ts =====\n// THE MONEY MATCHER. v1.0, 9 Aug 2026.\n//\n// WHAT THIS IS FOR. Kim's question, in her words: \"what are we doing with the money information that\n// comes from square back into the CRM?\" The answer today is: it lands as a note on the customer's\n// file, and nothing ever writes the amount onto the booking. The booking is the only place a report\n// can add money up from, so revenue and ROAS read zero while the money plainly exists.\n//\n// HER RULE, agreed in writing on 9 August at 10:26 PM, verbatim:\n// \"One open opportunity -> automatically assign the payment.\n// Multiple open opportunities -> staff chooses the correct one.\"\n// That is exactly what classify() implements. One card, AUTO. More than one, CHOOSE. None, ORPHAN.\n//\n// WHY THIS SHIPS AS A DRY RUN FIRST, and it is not timidity. Kristian's application also writes\n// opportunities into this same CRM; he confirmed it in writing on 7 August. Until he says whether it\n// writes monetaryValue, two systems would own one field and one would win at random. So this module\n// computes every write it WOULD make, proves the arithmetic, and writes nothing. Flipping it live is\n// one flag, after one sentence from him.\n//\n// NOTHING HERE MUTATES. There is no POST, PUT or PATCH in this file, and a test asserts that.\n\nexport type Payment = {\n id: string;\n amount: number;\n status: string;\n contactId: string | null;\n contactName: string | null;\n at: string | null;\n};\nexport type Opp = {\n id: string;\n contactId: string | null;\n name: string | null;\n monetaryValue: number;\n stage: string;\n createdAt: string | null;\n lastStageChangeAt: string | null;\n};\n\nexport type Verdict = \"AUTO\" | \"CHOOSE\" | \"ORPHAN\" | \"ALREADY_VALUED\";\nexport type Match = {\n payment: Payment;\n verdict: Verdict;\n candidates: Opp[];\n wouldWrite: { oppId: string; value: number } | null;\n why: string;\n};\n\n// A payment only counts as money if it actually completed. Pending and failed are shown to Kim\n// separately and never counted as revenue, because a report that counts a failed card as income is\n// worse than no report.\nexport const COMPLETED = \"succeeded\";\n\n// The point of sale bucket. Square sends counter sales with no customer, and this CRM files them all\n// against one nameless record, so a contactId here does NOT mean a real person was identified.\nexport const isNameless = (p: Payment) =>\n !p.contactName || p.contactName.trim().toLowerCase() === \"unknown\";\n\n// THE ONLY TWO STAGES A PAYMENT MAY EVER BE WRITTEN TO. [Added 10 Aug 2026.]\n// A contact appears on up to eight boards in this location and every empty card looks identical\n// from inside classify(). Proven live: unscoped, $4,020 of $4,685 lands on a card that is not a\n// booking, including $500 onto a Survey Requested card belonging to a customer whose real booking\n// already carries $2,395 and would correctly have been left alone. The exception list also goes\n// from 0 to 10, breaking the promise on Kim's page that nobody has to do anything.\n// Filter HERE, not in the caller: a caller that hands over every board is the normal mistake.\nexport const VALUABLE_STAGES: readonly string[] = Object.freeze([\n \"fd821b4e-bbe6-44de-b754-fa80e4823616\", // 1) Initial Lead Pipeline / Customer\n \"ae173310-f8b1-4399-acb7-ef1fc03d3697\", // 1) Initial Lead Pipeline / Won - Paid\n]);\nconst IN_SCOPE = new Set(VALUABLE_STAGES);\n\nexport function classify(payment: Payment, oppsForContact: Opp[]): Match {\n const inScope = oppsForContact.filter((o) => IN_SCOPE.has(o.stage));\n const open = inScope.filter((o) => o.monetaryValue === 0);\n const valued = inScope.filter((o) => o.monetaryValue > 0);\n\n if (isNameless(payment) || !payment.contactId) {\n return { payment, verdict: \"ORPHAN\", candidates: [], wouldWrite: null,\n why: \"no named customer on the payment, so nothing can be matched to it by any system\" };\n }\n if (inScope.length === 0) {\n return { payment, verdict: \"ORPHAN\", candidates: [], wouldWrite: null,\n why: \"the customer is named but has no booking on the Customer or Won and Paid board to put the money on\" };\n }\n if (open.length === 0 && valued.length > 0) {\n return { payment, verdict: \"ALREADY_VALUED\", candidates: valued, wouldWrite: null,\n why: \"every booking for this customer already carries a value; nothing would be overwritten\" };\n }\n if (open.length === 1) {\n return { payment, verdict: \"AUTO\", candidates: open,\n wouldWrite: { oppId: open[0].id, value: payment.amount },\n why: \"one booking open, so the money goes on it, which is the rule Kim gave\" };\n }\n return { payment, verdict: \"CHOOSE\", candidates: open, wouldWrite: null,\n why: `${open.length} bookings open for this customer, so a person picks; guessing here would invent revenue` };\n}\n\nexport type Write = { oppId: string; value: number; paymentIds: string[] };\n\n// ONE WRITE PER BOOKING, CARRYING THE SUM. [Added 10 Aug 2026.]\n// classify() is per payment because Kim's rule is per payment. The grouping belongs here, in the\n// caller's layer. Without it, a customer who pays twice toward one booking produces two writes to\n// one field and the loser's money vanishes silently. Proven live: Laurie Rubnitz, $120.00 and\n// $90.00, both resolving to opportunity 7yES6q2kajVTQIK6tEx3. Correct value $210.00.\n// The bug self seals: once a wrong value is written the next run sees a non zero field and returns\n// ALREADY_VALUED, so the lost money is unrecoverable without a manual audit.\n// Summing PRESERVES the total, so the $174,115.00 on Kim's page is the correct figure and it is the\n// code that has to catch up with the page.\nexport function planWrites(matches: Match[]): Write[] {\n const byOpp = new Map();\n for (const m of matches) {\n if (m.verdict !== \"AUTO\" || !m.wouldWrite) continue;\n const g = byOpp.get(m.wouldWrite.oppId) ?? { oppId: m.wouldWrite.oppId, amounts: [], paymentIds: [] };\n g.amounts.push(m.wouldWrite.value);\n g.paymentIds.push(m.payment.id);\n byOpp.set(g.oppId, g);\n }\n return [...byOpp.values()].map((g) => ({ oppId: g.oppId, value: sum(g.amounts), paymentIds: g.paymentIds }));\n}\n\nexport type Summary = {\n completed: { count: number; total: number };\n pending: { count: number; total: number };\n failed: { count: number; total: number };\n auto: { count: number; total: number };\n choose: { count: number; total: number };\n orphan: { count: number; total: number };\n alreadyValued: { count: number; total: number };\n coveragePct: number; // of completed money, what this would place on a booking\n valuedNow: { count: number; total: number }; // what the CRM carries today\n valuedAfter: { count: number; total: number }; // what it would carry if the AUTO set were written\n writes: { count: number; total: number }; // ACTUAL write count: one per booking, not per payment\n};\n\nconst sum = (xs: number[]) => Math.round(xs.reduce((a, b) => a + b, 0) * 100) / 100;\n\nexport function summarise(matches: Match[], all: Payment[], valuedToday: Opp[]): Summary {\n const byStatus = (s: string) => all.filter((p) => p.status === s);\n const of = (v: Verdict) => matches.filter((m) => m.verdict === v);\n const amt = (ps: { amount: number }[]) => sum(ps.map((p) => p.amount));\n const pot = (ms: Match[]) => sum(ms.map((m) => m.payment.amount));\n\n const completed = byStatus(COMPLETED);\n const auto = of(\"AUTO\"), choose = of(\"CHOOSE\"), orphan = of(\"ORPHAN\"), av = of(\"ALREADY_VALUED\");\n const writes = planWrites(matches);\n const completedTotal = amt(completed);\n const nowTotal = sum(valuedToday.map((o) => o.monetaryValue));\n\n return {\n completed: { count: completed.length, total: completedTotal },\n pending: { count: byStatus(\"pending\").length, total: amt(byStatus(\"pending\")) },\n failed: { count: byStatus(\"failed\").length, total: amt(byStatus(\"failed\")) },\n auto: { count: auto.length, total: pot(auto) },\n choose: { count: choose.length, total: pot(choose) },\n orphan: { count: orphan.length, total: pot(orphan) },\n alreadyValued: { count: av.length, total: pot(av) },\n // Honesty on the face of it: coverage is what WOULD be placed automatically, out of money that\n // actually completed. Kim is told this number before she ever sees a revenue figure, so a low\n // first month is never a surprise.\n coveragePct: completedTotal > 0 ? Math.round((pot(auto) / completedTotal) * 1000) / 10 : 0,\n valuedNow: { count: valuedToday.length, total: nowTotal },\n // counts BOOKINGS that gain a value, which is the number of writes, not the number of payments\n valuedAfter: { count: valuedToday.length + writes.length, total: sum([nowTotal, pot(auto)]) },\n writes: { count: writes.length, total: sum(writes.map((w) => w.value)) },\n };\n}\n\n// The sentence Kim reads. Generated, never typed, so it cannot drift from the numbers beside it.\nexport function plainEnglish(s: Summary): string {\n const m = (n: number) => \"$\" + n.toLocaleString(\"en-US\", { minimumFractionDigits: 2, maximumFractionDigits: 2 });\n if (s.completed.count === 0) return \"No completed Square payments were found, so there is nothing to place yet.\";\n const parts = [\n `${s.completed.count} Square payments completed, worth ${m(s.completed.total)}.`,\n s.auto.count\n ? `${s.auto.count} of them, worth ${m(s.auto.total)}, belong to a customer with exactly one booking open, so those place themselves.`\n : `None of them belong to a customer with exactly one booking open, so none place themselves yet.`,\n ];\n if (s.choose.count) parts.push(`${s.choose.count}, worth ${m(s.choose.total)}, belong to someone with more than one booking open, so a person picks which one.`);\n if (s.orphan.count) parts.push(`${s.orphan.count}, worth ${m(s.orphan.total)}, arrived with no named customer at all and can never be placed by anything.`);\n if (s.auto.count > s.writes.count) parts.push(`${s.auto.count} payments fill ${s.writes.count} bookings, because some customers paid more than once toward the same booking and those amounts are added together rather than one written over the other.`);\n parts.push(`That would take the money recorded against bookings from ${m(s.valuedNow.total)} to ${m(s.valuedAfter.total)}.`);\n return parts.join(\" \");\n}\n\n",[538],"9283cb69-3428-4fa3-bc93-f8993c9fb47c","SOURCE-BUNDLE.part5.txt","11feec3e-919f-11f1-8a41-1607ee4eb77e",1091,["D",1786801896590],43,"THE DOGS SPOT — SOURCE BUNDLE (part 5 of 40)\n\nEVERY source file in this project, engine/ included. Restoring these parts and nothing else gives\nyou a tree that builds, typechecks and runs its own test suite with no network and no val.\n\nengine/ is here as of 14 Aug 2026. It used to be left out because val 1bfa6e81-74e1-4c6c-ab32-118304a4ffff\nholds it, which was true of every engine file except engine/watch.ts: a module the val does not run,\nso it was never deployed, so it lived in one container and nothing else. A reclaim destroyed it.\nscripts/deploy.mjs --check still compares engine/ against the val file by file; that is a second\ncheck on the same files now, not the only copy of them.\n\nRESTORE (needs only node, from an empty folder). Save each part, then run this ON EACH ONE:\n\n node -e 'const fs=require(\"fs\"),p=require(\"path\");const b=fs.readFileSync(process.argv[1],\"utf8\");\n for(const s of b.split(\"\\n=====FILE \").slice(1)){const i=s.indexOf(\" =====\\n\");\n const f=s.slice(0,i),c=s.slice(i+7);fs.mkdirSync(p.dirname(f),{recursive:true});\n fs.writeFileSync(f,c.replace(/\\n$/,\"\"))}' PART.txt\n\nA record named #1, #2, ... is one FILE cut into pieces: concatenate them in order, then\nstrip one trailing newline from the last. scripts/restore.mjs does this for you.\n\nEach part is complete in itself: whole files only, no reassembly, any order.\n\nThen: node scripts/build.mjs (engine/ came out of these parts; nothing to fetch first)\n node scripts/typecheck.mjs\n node tests/run-all.mjs\n node scripts/deploy.mjs --check (pulls nothing, proves the val matches what you restored)\n node tests/negative-controls.mjs (proves the suite above can actually fail)\n\nIN THIS PART (4 of 116 files)\n engine/facts.ts 16179 bytes 75b784443645\n engine/gads-feed.ts 14745 bytes 18afceaec498\n engine/gads-rows.ts 9321 bytes d675ff4529dc\n engine/gads.ts 10135 bytes f4a1154d25cc\n\n================================================================================================\n=====FILE engine/facts.ts =====\n// ONE SOURCE OF TRUTH PER FACT. v1.0, 4 Aug 2026.\n//\n// THE ROOT CAUSE THIS FILE EXISTS TO KILL:\n// Prose and data were produced separately. Somebody wrote a sentence, something else computed a\n// number, and nothing forced them to agree. Every wrong claim in this project came from that gap:\n// - \"runs every 15 minutes\" beside a timestamp reading 26 minutes ago\n// - \"1,513 records\" that had drifted to 1,514 before a reader saw it\n// - \"35 counter sales totaling $23,463.99\" when the journal holds 40 totalling $28,035.99\n// - \"11 live questions\" in a handover doc while the page rendered 13\n// None of those were typos. Each was a sentence that had no mechanical link to its own subject.\n//\n// THE RULE: a fact is computed once, here, together with the sentence that describes it. Anything\n// that displays it reads from here. If two files can produce the same number independently, one of\n// them is wrong and nobody knows which.\n//\n// EVERY FACT CARRIES ITS PROVENANCE: where it was read and when. `Fact.source` answers \"where did\n// this number come from\" in one hop, which is the test for whether it ships.\n\nexport type Fact = {\n value: T | null; // null means NOT KNOWN, never zero-by-accident\n source: string; // the endpoint or blob it came from, in one hop\n readAt: string; // ISO timestamp of the read that produced it\n note?: string; // anything the reader must know to use it honestly\n};\n\n// Written as function DECLARATIONS rather than generic arrows on purpose.\n// [was: `export const fact = (value: T | null, ...)`. Inside the val that compiles fine, and\n// the dashboard has always rendered correct numbers from it. But esm.town, which is how any\n// OTHER val would import this file, parses a .ts file as .tsx: it read `` as an opening JSX\n// tag and served `export const fact = _jsxs(T, { children: [\"(value: T | null, source...\"] })`\n// — the type signature turned into React children. Anything importing it got garbage that would\n// have thrown at call time, not at import time. The watchdog needs to import this file so that\n// the Square backlog is computed in exactly one place; `function fact(` is unambiguous to\n// both parsers, so it can.]\nexport function fact(value: T | null, source: string, note?: string): Fact {\n return { value, source, readAt: new Date().toISOString(), note };\n}\n\n/** A fact that could not be read. Distinct from a fact whose value is genuinely zero. */\nexport function unknownFact(source: string, note?: string): Fact {\n return { value: null, source, readAt: new Date().toISOString(), note };\n}\n\n// ---------------------------------------------------------------------------------------------\n// THE SQUARE BACKLOG. Previously four numbers typed into a sentence: \"35 counter sales totaling\n// $23,463.99. 14 of the 35 carry enough of a trail; the other 21 arrived with no name.\"\n// An independent re-derivation found 40 / $28,035.99 / 10 / 30. The typed version understated the\n// unlinked money by $4,572 and understated the unresolvable count by 9. It is computed now.\n//\n// The subtlety that makes this worth a function rather than a one-liner: the bridge RE-LOGS the\n// same payment on every retry, so 87 journal rows collapse to 40 distinct payments. Summing rows\n// instead of payments gives $56,369.97, which is double-counting, not a bigger truth.\n// ---------------------------------------------------------------------------------------------\n\nexport type SquareBacklog = {\n payments: number; // distinct payment ids that never matched a contact\n total: number; // their summed value, counting each payment once\n withTrail: number; // carry an email, phone or Square customer id: recoverable with effort\n withTrailTotal: number;\n noTrail: number; // arrived with nothing at all: no permission will ever resolve these\n noTrailTotal: number;\n};\n\n// FIXED 9 Aug 2026. The loop below used to start `if (r.kind !== \"NO-MATCH\") continue`, which\n// meant the comment about reading \"ANY row for this payment\" was a lie: only NO-MATCH rows were\n// ever seen. A payment that failed to match on the first attempt and matched on a later one was\n// still counted as unmatched forever. That overstated the backlog Kim was shown by $10,884.00\n// across 9 payments: 42 payments / $33,535.99 reported, 33 / $22,651.99 true. She has the wrong\n// figure in writing, so this is a correction owed, not just a cleanup.\n// A payment is only unmatched if NO row anywhere in the journal ties it to a contact.\n//\n// FIXED AGAIN 12 Aug 2026, and this one is the reason paymentId() exists as its own function.\n// The guard above is correct and it never fired, because it was guarding the wrong GROUP. The\n// bridge writes two note shapes for one payment:\n// \"payment \" the NO-MATCH row\n// \"backfilled from square payment ; client opp untouched\" the row that RESOLVED it\n// `\\S+` is greedy about punctuation, so the second one keyed on \";\" and the first on \"\".\n// One payment became two, the failing half looked permanently unmatched, and the resolving half\n// sat under a key nothing read. Measured live: 29 payments worth $20,682.00 reported as never\n// having reached a customer when the journal names the contact each was backfilled to, on the\n// same row, at the same second. 33 / $22,651.99 reported, 4 / $1,969.99 true. Kim has the wrong\n// figure in writing for the THIRD time on this one number, so this is a correction owed.\n// THE RULE THIS ENCODES: a guard is only as good as the key that groups the rows it guards.\n// Also read the `id` FIELD: PAY-DUP rows carry the payment id there and have no note at all.\nconst MATCHED_KINDS = new Set([\"REVENUE-ON-CLIENT-OPP\", \"PAYMENT\", \"CAPI-PURCHASE\", \"INVOICE-LINKED\"]);\nexport function paymentIds(row: unknown): string[] {\n const r = row as any;\n const clean = (s: unknown) => String(s ?? \"\").replace(/[;,.]+$/, \"\");\n const out = new Set();\n if (typeof r?.id === \"string\" && r.id) out.add(clean(r.id));\n const m = /payment\\s+(\\S+)/.exec(String(r?.note ?? \"\"));\n if (m) out.add(clean(m[1]));\n out.delete(\"\");\n return [...out];\n}\nexport function squareBacklog(journal: unknown): SquareBacklog | null {\n if (!Array.isArray(journal)) return null;\n const rowsFor = new Map();\n for (const r of journal as any[]) {\n for (const id of paymentIds(r)) {\n (rowsFor.get(id) ?? rowsFor.set(id, []).get(id)!).push(r);\n }\n }\n const byPayment = new Map();\n for (const [id, rs] of rowsFor) {\n if (!rs.some((r) => r?.kind === \"NO-MATCH\")) continue; // never failed: not a backlog item\n if (rs.some((r) => MATCHED_KINDS.has(r?.kind) || (typeof r?.contactId === \"string\" && r.contactId.length > 4))) continue; // matched later\n const amt = rs.map((r) => Number(r?.amount) || 0).find((a) => a > 0) ?? 0;\n const trail = rs.some((r) => r?.hadEmail === true || r?.hadPhone === true || r?.hadCustomerId === true);\n byPayment.set(id, { amt, trail });\n }\n const rows = [...byPayment.values()];\n const sum = (f: (x: { amt: number; trail: boolean }) => boolean) =>\n rows.filter(f).reduce((a, x) => a + x.amt, 0);\n return {\n payments: rows.length,\n total: rows.reduce((a, x) => a + x.amt, 0),\n withTrail: rows.filter((x) => x.trail).length,\n withTrailTotal: sum((x) => x.trail),\n noTrail: rows.filter((x) => !x.trail).length,\n noTrailTotal: sum((x) => !x.trail),\n };\n}\n\n// ---------------------------------------------------------------------------------------------\n// SENTENCES ARE GENERATED FROM VALUES, NEVER COMPOSED ALONGSIDE THEM.\n// Each of these takes the fact and returns the words. There is no path by which the words can\n// describe a different number from the one passed in, because there is only one number.\n// ---------------------------------------------------------------------------------------------\n\nconst money = (n: number) => `$${n.toLocaleString(\"en-US\", { minimumFractionDigits: 2, maximumFractionDigits: 2 })}`;\n\nexport function squareSentence(b: SquareBacklog | null): string {\n if (!b || b.payments === 0) {\n return \"We could not read the payment records just now, so there is nothing to report here rather than a zero to trust.\";\n }\n // WHY THIS NO LONGER SPLITS THE COUNT INTO TRACEABLE AND HOPELESS, 12 Aug 2026.\n // It used to end \"arrived with no name, email or phone attached at all, and nothing will ever\n // resolve those\". That sentence was false. hadEmail/hadPhone/hadCustomerId describe the WEBHOOK\n // PAYLOAD the bridge received, not what Square holds. Checked live against Square: the payment\n // this sentence called hopeless is Caroline Riner, and Square has her name and her phone number.\n // The flags got it exactly backwards for two of the four. A page may not tell an owner a sale is\n // unrecoverable on the strength of a field that was never asking that question.\n // THE RULE: never let a sentence make a claim stronger than the field behind it can carry.\n const parts = [\n `${b.payments} counter sales totaling ${money(b.total)} are recorded but not linked to a name.`,\n \"The exception list names each one with whatever the card reader captured, so they can be placed by hand.\",\n \"This is old filing rather than missing money. Every dollar was collected.\",\n ];\n return parts.join(\" \");\n}\n\n// ---------------------------------------------------------------------------------------------\n// THE PHONE-CALL OMISSION. Two facts sat on the page and were never joined: a channel bucket\n// labelled \"somewhere else\" holding 20 people, and a separate line saying the old source column\n// logged 22 phone calls. An independent cross-tab showed the \"other\" bucket is 20 of 20 phone\n// calls, 100%. The page had the answer twice and printed it as a shrug. Computed now.\n// ---------------------------------------------------------------------------------------------\n\nexport type ContactLike = {\n source?: string | null;\n attribution?: { medium?: string | null } | null;\n dateAdded?: string;\n};\nexport type Win = { startMs: number; endMs: number };\n\n/**\n * What share of the un-named \"other\" medium bucket is explained by phone calls?\n *\n * THE WINDOW IS MANDATORY, and this is not defensive typing. The first version of this function\n * took no window, so it counted every contact ever fetched (nine weeks) and rendered \"all 192 of\n * them are logged as phone calls\" directly beneath a bar that read 20. Same disease, in the code\n * written to cure it: a sentence describing a different population from the chart above it.\n * A caller that cannot supply the window gets null rather than a number from the wrong period.\n */\nexport function otherBucketExplanation(contacts: ContactLike[] | null, w: Win | null): { other: number; phoneInOther: number } | null {\n if (!Array.isArray(contacts) || !contacts.length || !w) return null;\n const inWin = (c: ContactLike) => {\n const t = Date.parse(c.dateAdded ?? \"\");\n return Number.isFinite(t) && t >= w.startMs && t < w.endMs;\n };\n const scoped = contacts.filter(inWin);\n if (!scoped.length) return null;\n const isOther = (c: ContactLike) => /^other$/i.test(String(c.attribution?.medium ?? \"\").trim());\n const isPhone = (c: ContactLike) => /phone/i.test(String(c.source ?? \"\"));\n return {\n other: scoped.filter(isOther).length,\n phoneInOther: scoped.filter((c) => isOther(c) && isPhone(c)).length,\n };\n}\n\nexport function otherBucketSentence(x: { other: number; phoneInOther: number } | null): string {\n if (!x || x.other === 0) return \"\";\n if (x.phoneInOther === 0) {\n return `The ${x.other} filed as \"somewhere else\" carry an arrival record that just says \"other\", and none of them match a logged phone call, so we genuinely cannot place them.`;\n }\n const all = x.phoneInOther === x.other;\n return all\n ? `Worth knowing what \"somewhere else\" actually is: all ${x.other} of them are logged in your CRM as phone calls. Your arrival record has no category for a call, so people who rang you land in that bucket. They are not unknown, they are your callers.`\n : `${x.phoneInOther} of the ${x.other} filed as \"somewhere else\" are logged in your CRM as phone calls. Your arrival record has no category for a call, so callers land in that bucket rather than one of their own.`;\n}\n\n// ---------------------------------------------------------------------------------------------\n// CROSS-ARTIFACT REGISTRY. Any fact that appears in more than one place (page, PDF, ledger, a\n// message to the client) is registered here by name. The consistency test walks this list and\n// fails the build when two artefacts state the same named fact differently. Drift becomes\n// impossible rather than merely unlikely.\n// ---------------------------------------------------------------------------------------------\n\nexport type SharedFact = {\n name: string; // stable id\n pattern: RegExp; // how it appears in prose, capturing the value\n describe: string; // what it is, for the failure message\n};\n\nexport const SHARED_FACTS: SharedFact[] = [\n { name: \"decision_count\", pattern: /(\\d+)\\s+(?:live\\s+)?questions?\\s+(?:on this page\\s+)?(?:are|is)?\\s*wait/i, describe: \"how many questions are waiting on Kim\" },\n { name: \"bootcamp_bookings\", pattern: /(\\d+)\\s+Bootcamp bookings/i, describe: \"Bootcamp bookings on record\" },\n { name: \"bootcamp_ceiling\", pattern: /\\$([\\d,]+)\\s*(?:,|\\.|and|$)/i, describe: \"the Bootcamp exposure ceiling\" },\n { name: \"slow_track_len\", pattern: /(\\d+)\\s+more spread over about\\s+(\\d+)\\s+months/i, describe: \"the slow track length\" },\n { name: \"automations\", pattern: /(?:all\\s+)?(\\d+)\\s+automations/i, describe: \"automations in the account\" },\n];\n\n// ---------------------------------------------------------------------------------------------\n// THE TAG THAT DECIDES WHETHER GO-LIVE REACHES ANYBODY.\n// The engine enrolls on the tag `nurture - puppy`. If nothing applies it, switching the sequence\n// on reaches nobody, and it looks healthy while doing so: the engine reports successful runs with\n// zero enrollments, which is exactly what a working system with no work also looks like.\n//\n// [was: the page said \"1,200 of your most recent contacts were checked and not one carries the\n// tag\". True when it was typed, and a scan size rather than an answer: it left open whether the\n// other four thousand were different. GoHighLevel will filter contacts by tag server-side and\n// return a total, so the real number is one call away. Cross-checked 5 Aug against a full walk of\n// all 5,544 contacts, page by page: \"no sale\" 133, \"tips-nurture\" 155, \"customer\" 1,512, and\n// `nurture - puppy` zero. The filter and the census agree on every one.]\n// ---------------------------------------------------------------------------------------------\nexport type TagCoverage = { tag: string; tagged: number; total: number };\n\nexport function tagCoverageSentence(t: TagCoverage | null): string {\n if (!t || t.total <= 0) {\n return \"We could not read your contact records just now, so this says nothing rather than a zero worth trusting.\";\n }\n if (t.tagged === 0) {\n return `Every one of your ${t.total.toLocaleString(\"en-US\")} contact records was checked just now, and not a single one is marked as a puppy inquiry. Nothing in your account applies that mark, which is why the tagging has to be switched on at the same moment as everything else.`;\n }\n const pct = Math.round((t.tagged / t.total) * 100);\n // [was: \"1 ... are marked ... Those are the people\" — a real reader hit the n=1 case on 9 Aug\n // and the plural read as a glitch on a page that trades on precision. Number agreement is now\n // computed from the count, never assumed.]\n const one = t.tagged === 1;\n return `${t.tagged.toLocaleString(\"en-US\")} of your ${t.total.toLocaleString(\"en-US\")} contact records ${one ? \"is\" : \"are\"} marked as a puppy inquiry, checked just now, which is ${pct < 1 ? \"under 1\" : pct}% of them. ${one ? \"That is the one person\" : \"Those are the people\"} the new messages would pick up.`;\n}\n\n\n=====FILE engine/gads-feed.ts =====\n// THE SCHEDULED CONVERSION FEED. v1.0, 15 Aug 2026.\n//\n// THE CHORE THIS DELETES. Until tonight, somebody had to remember, every week, to open the val\n// endpoint, download a CSV, open Google Ads, find Goals → Conversions → Uploads, and attach the\n// file. The account has already proved what happens to weekly chores here: the last human change\n// to it was 22 Jul 19:21:36 ET, and the 24 days after that returned \"You don't have any changes\n// that match your dates or filters.\" A step that depends on memory is a step that stops.\n//\n// WHAT REPLACES IT. Google Ads' Uploads screen has a Schedules tab that will FETCH a file itself,\n// on a schedule, from one of three sources: Google Sheets, HTTPS, SFTP. Our file already exists at\n// an HTTPS URL. So the whole loop closes by pointing Google at a URL, once, by hand — and then\n// never again. This file is that URL: a stable, cached, unguessable, always-parseable CSV route.\n//\n// WHY IT IS NOT JUST gads.ts WITH A LONGER LEASH. Three differences, each of which is the\n// difference between a thing that runs unattended and a thing that looks like it does:\n//\n// 1. THE SECRET IS IN THE PATH, AND IT IS ITS OWN SECRET.\n// The URL ends in \".csv\" because Google's documented HTTPS setups go out of their way to make\n// it so — Matomo's instructions tell you to append \"&requestType=https&conversion-export.csv\"\n// to a URL that is otherwise all query string, which only makes sense as a file-type sniff on\n// the URL's tail. A path secret gives us a .csv ending for free and needs no query string at\n// all, so nothing depends on Google preserving one.\n// And it is a DIFFERENT secret from the admin key. The URL is pasted into a Google Ads screen\n// where it lives forever, visible to anyone with access to the account. The admin key opens\n// the whole admin surface; this key opens one read-only CSV and nothing else.\n//\n// 2. IT CANNOT SERVE A FILE GOOGLE WILL REJECT.\n// Google fails a scheduled run on a file with headers and no data rows: \"The data type or\n// schema of the data source could not be determined... there is at least one line with valid\n// data.\" A CRM hiccup at the moment Google happens to fetch would do exactly that. So the\n// last good file is cached, and a build that fails OR returns zero rows serves the cache\n// instead of a header-only file. Re-serving last week's rows is free: Google states \"the same\n// conversion won't be imported more than once\" for the same click id + name + time.\n//\n// 3. IT IS BOUNDED IN TIME.\n// The live scan takes ~7s. A scheduled fetcher that waits forever is a scheduled fetcher that\n// one day times out mid-run. The rebuild gets a budget; over it, the cache is served.\n//\n// THE WINDOW, AND WHY 80 DAYS AND NOT 85.\n// Google: \"Offline conversions that were uploaded more than 90 days after the associated last\n// click won't be imported.\" The clock runs from the CLICK, and we do not have the click's\n// timestamp — only the contact's dateAdded, which is at or after it. On this CRM the two are\n// minutes apart (the click lands on a page, the chat or the form makes the contact), but that is\n// an observation, not a guarantee. 80 days of contact age leaves ten days of margin, and because\n// the window moves with the calendar, a row simply stops being emitted before it can start being\n// rejected. Nothing accumulates; nothing needs cleaning up.\n//\n// WHAT THIS STILL CANNOT DO, said plainly rather than left to be discovered:\n// * It cannot create the schedule. Google Ads has no way to do that except a human in the UI,\n// and the Google Ads API route needs a developer token this account does not have.\n// * Nothing here pages anybody. If the schedule is deleted or the fetch starts failing, the\n// evidence is in ?status — it does not come and find you. Every fetch is recorded there with\n// its user-agent and time precisely so that \"is this still running?\" is a question with an\n// answer rather than a shrug.\n// * The two conversion actions it feeds are not account-default goals, so what it uploads is\n// reporting, not bidding, until somebody promotes them.\n\nimport { buildRows, ghlGetter, toCsv, FEED_DAYS, LEAD_NAME, SHOW_NAME } from \"./gads-rows.ts\";\n\n// sha256 of the feed token. The token itself is not in this tree.\nconst FEED_KEY_SHA256 = \"ed8eea7a581590e540c9ea8cbb97dd8661ecb91a38ab5a20cb082199f8976f7b\";\n// The admin key is also accepted, for the same reason it is accepted by gads.ts: it already opens\n// this exact data there, so honouring it here grants nothing new and saves carrying two secrets\n// around when a human wants to check ?status.\nconst ADMIN_KEY_SHA256 = \"48cd12465712045f70247da1689eeb198a4ce2d98416d8e52fb844581f044f15\";\n\nconst BLOB_KEY = \"gads_feed_cache\";\n/** Serve the cache without rebuilding if it is younger than this. Google fetches weekly, so in\n * practice every scheduled fetch rebuilds; this only spares a human clicking twice in a row. */\nconst MAX_AGE_MS = 6 * 3_600_000;\n/** The rebuild's budget. Past it, the cache is served and the status view says the build was slow. */\nconst BUILD_BUDGET_MS = 25_000;\n/** How many fetches to remember. Enough to see a weekly schedule's last three months. */\nconst FETCH_LOG = 14;\nconst FILENAME = \"dogsspot-google-conversions.csv\";\n\ntype FetchNote = { at: string; ua: string; served: string; rows: number; ms: number };\ntype Cache = {\n csv: string;\n rows: number;\n builtAt: string;\n days: number;\n scanned: number;\n clicked: number;\n lastBuild: { at: string; ok: boolean; rows: number; ms: number; error: string };\n fetches: FetchNote[];\n};\n\nasync function sha256Hex(s: string): Promise {\n const b = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(s));\n return [...new Uint8Array(b)].map((x) => x.toString(16).padStart(2, \"0\")).join(\"\");\n}\n/** Constant-time compare against both accepted hashes. Same shape as gads.ts's check. */\nasync function authorised(k: string): Promise {\n if (!k) return false;\n const got = await sha256Hex(k);\n const feed = Deno.env.get(\"NURTURE_GADS_FEED_SHA256\") || FEED_KEY_SHA256;\n const admin = Deno.env.get(\"NURTURE_ADMIN_KEY_SHA256\") || ADMIN_KEY_SHA256;\n let hit = false;\n for (const expected of [feed, admin]) {\n if (got.length !== expected.length) continue;\n let d = 0;\n for (let i = 0; i < got.length; i++) d |= got.charCodeAt(i) ^ expected.charCodeAt(i);\n if (d === 0) hit = true;\n }\n return hit;\n}\n\nasync function ghlToken(): Promise {\n const env = Deno.env.get(\"GHL_TOKEN\");\n if (env) return env;\n const { blob } = await import(\"https://esm.town/v/std/blob\");\n const cfg = (await blob.getJSON(\"puppy_config\").catch(() => null)) as { ghlToken?: string } | null;\n return cfg?.ghlToken ?? \"\";\n}\n\nasync function readCache(): Promise {\n try {\n const { blob } = await import(\"https://esm.town/v/std/blob\");\n return (await blob.getJSON(BLOB_KEY).catch(() => null)) as Cache | null;\n } catch { return null; }\n}\nasync function writeCache(c: Cache): Promise {\n try {\n const { blob } = await import(\"https://esm.town/v/std/blob\");\n await blob.setJSON(BLOB_KEY, c);\n } catch { /* a cache that will not persist must not fail the request Google is making */ }\n}\n\n/**\n * Rebuild, under a wall-clock budget.\n *\n * The losing promise is not cancelled — there is nothing to cancel a half-finished set of CRM\n * reads with — it is simply not waited for. That is deliberate: a slow build that finishes after\n * we have already answered costs nothing, and the alternative (waiting) is the failure mode.\n */\nasync function rebuild(days: number): Promise<{ ok: boolean; rows: number; csv: string; ms: number; error: string; scanned: number; clicked: number }> {\n const t0 = Date.now();\n const blank = { ok: false, rows: 0, csv: \"\", ms: 0, error: \"\", scanned: 0, clicked: 0 };\n try {\n const token = await ghlToken();\n if (!token) return { ...blank, ms: Date.now() - t0, error: \"no GHL token in env or puppy_config blob\" };\n\n const work = buildRows(ghlGetter(token), { days }).then((b) => ({\n ok: true,\n rows: b.rows.length,\n csv: toCsv(b.rows),\n ms: 0,\n error: \"\",\n scanned: b.scanned,\n clicked: b.clicked,\n }));\n const timer = new Promise((res) =>\n setTimeout(() => res({ ...blank, error: `build exceeded ${BUILD_BUDGET_MS}ms` }), BUILD_BUDGET_MS)\n );\n const r = await Promise.race([work, timer]);\n return { ...r, ms: Date.now() - t0 };\n } catch (e) {\n return { ...blank, ms: Date.now() - t0, error: String(e).slice(0, 300) };\n }\n}\n\nconst HOW = {\n once: [\n \"Google Ads → Goals → Conversions → Uploads → the Schedules tab → the blue + button\",\n \"Source: HTTPS. File URL: this URL, ending .csv. Username/password: any value — Google asks for\",\n \"them and does not validate them for HTTPS. Frequency: Weekly. Then Save & preview.\",\n ].join(\" \"),\n needs: `Both conversion actions must already exist, named EXACTLY \"${LEAD_NAME}\" and \"${SHOW_NAME}\", created as Import → CRM/file → conversions from clicks.`,\n watch: \"Add ?status=1 (or /status after the key) to this URL to see when it was last fetched and by what.\",\n};\n\nexport default async function (req: Request): Promise {\n const u = new URL(req.url);\n // The key is the FIRST path segment, with a .csv suffix stripped, or ?k= for a human at a\n // terminal. Anything after it is decoration Google is welcome to keep: /KEY/whatever.csv works,\n // which is what lets the URL end in .csv while carrying no query string at all.\n const segs = u.pathname.split(\"/\").filter(Boolean);\n const fromPath = (segs[0] ?? \"\").replace(/\\.csv$/i, \"\");\n const key = fromPath || (u.searchParams.get(\"k\") ?? \"\");\n if (!(await authorised(key))) {\n // 404 rather than 401: a scanner learns nothing, and Google only ever fetches the right URL.\n return new Response(\"Not found\", { status: 404 });\n }\n\n const wantStatus = /^status/i.test(segs[1] ?? \"\") || u.searchParams.get(\"status\") === \"1\";\n const days = Math.min(Math.max(Number(u.searchParams.get(\"days\")) || FEED_DAYS, 1), 85);\n const ua = (req.headers.get(\"user-agent\") ?? \"\").slice(0, 160);\n const t0 = Date.now();\n\n const cache = await readCache();\n const cachedRows = cache?.rows ?? 0;\n const ageMs = cache?.builtAt ? Date.now() - Date.parse(cache.builtAt) : Infinity;\n const usable = cachedRows > 0 && Number.isFinite(ageMs);\n\n // A status read never rebuilds. It is a question about the machine, not a request for the file,\n // and a status page that costs seven seconds of CRM reads is a status page nobody opens.\n if (wantStatus) {\n const last = cache?.fetches?.[0];\n return Response.json({\n ok: true,\n what: \"Google Ads scheduled offline-conversion feed for The Dogs Spot\",\n file: { rows: cachedRows, builtAt: cache?.builtAt ?? null, ageHours: usable ? +(ageMs / 3_600_000).toFixed(1) : null, days: cache?.days ?? null },\n lastBuild: cache?.lastBuild ?? null,\n lastFetch: last ?? null,\n daysSinceLastFetch: last ? +((Date.now() - Date.parse(last.at)) / 86_400_000).toFixed(2) : null,\n // A weekly schedule that has not fetched in nine days has stopped. Nothing here acts on that\n // — it is a flag for whoever looks, and the honest statement is that somebody has to look.\n scheduleLooksStalled: last ? Date.now() - Date.parse(last.at) > 9 * 86_400_000 : null,\n fetches: cache?.fetches ?? [],\n how: HOW,\n });\n }\n\n let csv = \"\", served = \"\", rows = cachedRows;\n let build: Awaited> | null = null;\n\n if (usable && ageMs < MAX_AGE_MS) {\n csv = cache!.csv;\n served = \"cache-fresh\";\n } else {\n build = await rebuild(days);\n if (build.ok && build.rows > 0) {\n csv = build.csv;\n rows = build.rows;\n served = \"rebuilt\";\n } else if (usable) {\n // Build failed, or succeeded with nothing in it. Either way the last good file is the right\n // answer: Google de-dupes what it has already seen, and a header-only file is a failed run.\n csv = cache!.csv;\n served = build.ok ? \"cache-empty-build\" : \"cache-build-failed\";\n } else {\n // Nothing good to serve and nothing cached. Fail loudly: a failed run in the Uploads tab is\n // information. A file with no rows is a schema error Google reports as something else.\n const why = build.ok ? \"the scan found no Google-clicked contacts in the window\" : build.error;\n await note(cache, { at: new Date().toISOString(), ua, served: \"503\", rows: 0, ms: Date.now() - t0 }, build, days);\n return new Response(`no rows to serve: ${why}\\n`, { status: 503, headers: { \"Content-Type\": \"text/plain; charset=utf-8\" } });\n }\n }\n\n await note(cache, { at: new Date().toISOString(), ua, served, rows, ms: Date.now() - t0 }, build, days, csv, rows);\n\n return new Response(csv, {\n headers: {\n \"Content-Type\": \"text/csv; charset=utf-8\",\n \"Content-Disposition\": `attachment; filename=\"${FILENAME}\"`,\n \"Cache-Control\": \"no-store\",\n \"X-Feed-Served\": served,\n \"X-Feed-Rows\": String(rows),\n },\n });\n}\n\n/**\n * Record the fetch, and the build if there was one, in the same blob as the file.\n *\n * WHY THE TELEMETRY IS NOT OPTIONAL. The whole point of this file is that nobody will be watching\n * it. An automation nobody watches and that cannot say when it last ran is indistinguishable from\n * one that stopped in September. Every fetch leaves its user-agent and its timestamp here, so the\n * question \"did Google actually collect this?\" has an answer that is not a guess.\n */\nasync function note(\n prev: Cache | null,\n f: FetchNote,\n build: { ok: boolean; rows: number; ms: number; error: string; scanned: number; clicked: number; csv: string } | null,\n days: number,\n csv?: string,\n rows?: number,\n): Promise {\n const base: Cache = prev ?? {\n csv: \"\", rows: 0, builtAt: \"\", days, scanned: 0, clicked: 0,\n lastBuild: { at: \"\", ok: false, rows: 0, ms: 0, error: \"\" },\n fetches: [],\n };\n const next: Cache = { ...base, fetches: [f, ...(base.fetches ?? [])].slice(0, FETCH_LOG) };\n if (build) {\n next.lastBuild = { at: f.at, ok: build.ok, rows: build.rows, ms: build.ms, error: build.error };\n // Only a build that produced rows replaces the stored file. A successful scan that found\n // nothing leaves the last good file exactly where it is.\n if (build.ok && build.rows > 0 && csv) {\n next.csv = csv;\n next.rows = rows ?? build.rows;\n next.builtAt = f.at;\n next.days = days;\n next.scanned = build.scanned;\n next.clicked = build.clicked;\n }\n }\n await writeCache(next);\n}\n\n\n=====FILE engine/gads-rows.ts =====\n// GOOGLE ADS OFFLINE CONVERSIONS — THE ROW BUILDER, EXTRACTED SO A SECOND ENDPOINT CAN SHARE IT.\n// v1.0, 15 Aug 2026.\n//\n// WHY THIS FILE EXISTS. engine/gads.ts is the hand-driven endpoint: a human hits it with the admin\n// key, gets JSON to read or a CSV to download, and uploads that file by hand. It works and it is\n// verified live, so it is not touched. What it cannot do is be POLLED: it wants the admin key in a\n// query string, it has no cache, and a bad minute at the CRM turns into an HTTP 500 that a machine\n// on a schedule would simply record as a failed run.\n//\n// engine/gads-feed.ts is the machine-facing twin. Both need the same three things — find the\n// Google-clicked contacts, join them to real outcomes, emit Google's exact column set — so those\n// three things live here rather than being typed twice and drifting.\n//\n// THE COLUMN CONTRACT IS PINNED BY A TEST. tests/gads-feed.test.mjs asserts that the header line\n// and the Parameters line in this file appear VERBATIM in engine/gads.ts. If either file's idea of\n// Google's template changes, that test goes red instead of one endpoint quietly emitting a file\n// Google will reject with \"The selected file is missing data columns\".\n//\n// EVERYTHING HERE IS READ-ONLY AGAINST THE CRM. There is no write path in this module at all.\n\n/** The two conversion actions created in Google Ads on 15 Aug 2026. The names must match EXACTLY. */\nexport const LEAD_NAME = \"CRM Lead (Google)\";\nexport const SHOW_NAME = \"CRM Booking Showed (Google)\";\n\n// Google's own live template, fetched 15 Aug 2026 from\n// https://www.gstatic.com/conversiontracking/conversion-import-template.csv\n// SEVEN columns, not the five in most third-party write-ups. The two consent columns are new and\n// omitting them fails Preview with the unhelpful \"The selected file is missing data columns\".\nexport const CSV_HEADER =\n \"Google Click ID,Conversion Name,Conversion Time,Conversion Value,Conversion Currency,Ad User Data,Ad Personalization\";\n// The Parameters row carries the same number of commas as the header, or the row-length check trips.\nexport const PARAMS_LINE = \"Parameters:TimeZone=+0000,,,,,,\";\n// GRANTED | DENIED | UNSPECIFIED. UNSPECIFIED is the honest value: consent mode is not configured\n// on this account and asserting GRANTED would be a claim about consent collection nobody verified.\nexport const CONSENT = \"UNSPECIFIED\";\n\n/** Hard cap on the lookback. Google drops any conversion uploaded more than 90 days after the\n * click; the click precedes contact creation, so the window on contact age must stay short of it. */\nexport const MAX_DAYS = 85;\n/** What the scheduled feed uses. Ten days of margin under Google's 90, because the gap between the\n * click and the contact record being created is real but unmeasured — see NOTES in gads-feed.ts. */\nexport const FEED_DAYS = 80;\n\nconst LOC = \"BQHJ19uohldYe3eqA0bl\";\nconst GHL = \"https://services.leadconnectorhq.com\";\n// Cloudflare in front of the CRM refuses non-browser clients inconsistently. Every read in this\n// project sends a Chrome UA for that reason; python urllib gets a 1010 and curl with this does not.\nconst UA =\n \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\";\n/** 18 × 100 contacts ≫ any realistic lookback at the observed ~25 new contacts/day. */\nexport const PAGE_CAP = 18;\n\nexport type Row = {\n clickId: string;\n name: string;\n time: string;\n value: number;\n who: string;\n why: string;\n};\n\nexport type Built = {\n rows: Row[];\n scanned: number;\n pages: number;\n clicked: number;\n reachedCutoff: boolean;\n days: number;\n since: string;\n};\n\n/** How the CRM is read. Injected so the tests can drive the whole builder without a network. */\nexport type Getter = (url: string, version: string) => Promise;\n\n/** The real one. Same headers as every other read in this project. */\nexport function ghlGetter(token: string): Getter {\n return async (url: string, version: string) => {\n const r = await fetch(url, {\n headers: {\n Authorization: `Bearer ${token}`,\n Version: version,\n \"User-Agent\": UA,\n Accept: \"application/json\",\n },\n });\n if (!r.ok) throw new Error(`${r.status} ${url.slice(0, 120)}`);\n return r.json();\n };\n}\n\n/**\n * gclid / wbraid / gbraid, plain or URL-encoded, anywhere in the serialised contact.\n * The click id is not a first-class field in GHL: it hides inside attribution URLs and session\n * blobs, and it is very often URL-encoded (gclid%3D...), sometimes doubly (gclid%253D...).\n */\nexport function extractClickId(raw: string): { kind: string; id: string } | null {\n for (const kind of [\"gclid\", \"wbraid\", \"gbraid\"]) {\n const m =\n raw.match(new RegExp(`${kind}(?:%3D|=|%253D)([A-Za-z0-9_-]{20,140})`, \"i\")) ||\n raw.match(new RegExp(`\"${kind}\"\\\\s*:\\\\s*\"([A-Za-z0-9_-]{20,140})\"`, \"i\"));\n if (m) return { kind, id: m[1] };\n }\n return null;\n}\n\n/** Google's documented CSV time shape. No per-row zone: the Parameters line pins UTC for the file. */\nexport function gTime(iso: string, plusMinutes = 0): string {\n const d = new Date(new Date(iso).getTime() + plusMinutes * 60_000);\n const p = (n: number) => String(n).padStart(2, \"0\");\n return `${d.getUTCFullYear()}-${p(d.getUTCMonth() + 1)}-${p(d.getUTCDate())} ` +\n `${p(d.getUTCHours())}:${p(d.getUTCMinutes())}:${p(d.getUTCSeconds())}`;\n}\n\n/** Byte-for-byte the file engine/gads.ts serves: same quoting, same column order, same consent. */\nexport function toCsv(rows: Row[]): string {\n const esc = (s: string) => `\"${String(s).replace(/\"/g, '\"\"')}\"`;\n const lines = [\n PARAMS_LINE,\n CSV_HEADER,\n ...rows.map((r) =>\n [esc(r.clickId), esc(r.name), esc(r.time), r.value, \"USD\", CONSENT, CONSENT].join(\",\")\n ),\n ];\n return lines.join(\"\\n\") + \"\\n\";\n}\n\n/**\n * Walk contacts newest-first to the cutoff, keep the ones carrying a Google click id, and join each\n * to its real outcomes.\n *\n * TRAPS ENCODED HERE so nobody relearns them:\n * * Conversion Time must be AFTER the click. The click precedes contact creation, so a lead row\n * is dateAdded + 5 minutes and a showed row is the appointment start, later still.\n * * GET /opportunities/search with date_added_start/end returns HTTP 200 and ZERO rows silently\n * (proved 15 Aug 2026). Nothing here uses those filters: contacts are paginated by\n * meta.nextPageUrl and cut off locally against dateAdded.\n * * One \"showed\" row per contact — the FIRST attended appointment. Google de-dupes on\n * (click id, conversion name, time), so a later second stay must not become a second sale in\n * the same row; it restates the first.\n * * One unreadable contact must not sink the whole file. Appointment reads are individually\n * caught, and the count of failures is returned rather than thrown.\n */\nexport async function buildRows(\n get: Getter,\n opts: { days?: number; leadValue?: number; showValue?: number; now?: number } = {},\n): Promise {\n const days = Math.min(Math.max(Number(opts.days) || FEED_DAYS, 1), MAX_DAYS);\n const leadValue = Number(opts.leadValue) || 5;\n const showValue = Number(opts.showValue) || 150;\n const now = opts.now ?? Date.now();\n const cutoff = now - days * 86_400_000;\n\n const hits: { id: string; name: string; dateAdded: string; click: { kind: string; id: string } }[] = [];\n let url: string | null = `${GHL}/contacts/?locationId=${LOC}&limit=100`;\n let pages = 0, scanned = 0, reachedCutoff = false;\n while (url && pages < PAGE_CAP && !reachedCutoff) {\n const page = await get(url, \"2021-07-28\");\n const contacts = page?.contacts ?? [];\n for (const c of contacts) {\n scanned++;\n const added = Date.parse(c?.dateAdded ?? \"\");\n if (Number.isFinite(added) && added < cutoff) { reachedCutoff = true; break; }\n const click = extractClickId(JSON.stringify(c));\n if (click) {\n hits.push({\n id: c.id,\n name: [c.firstName, c.lastName].filter(Boolean).join(\" \") || \"(no name)\",\n dateAdded: c.dateAdded,\n click,\n });\n }\n }\n url = page?.meta?.nextPageUrl ?? null;\n pages++;\n }\n\n const rows: Row[] = [];\n for (const h of hits) {\n rows.push({\n clickId: h.click.id,\n name: LEAD_NAME,\n time: gTime(h.dateAdded, 5),\n value: leadValue,\n who: h.name,\n why: `contact created ${h.dateAdded} carrying a ${h.click.kind}`,\n });\n try {\n const appts = await get(`${GHL}/contacts/${h.id}/appointments`, \"2021-04-15\");\n const showed = (appts?.events ?? []).filter((e: any) =>\n /showed|completed/i.test(String(e?.appointmentStatus ?? \"\")) && e?.startTime\n );\n if (showed.length) {\n showed.sort((a: any, b: any) => Date.parse(a.startTime) - Date.parse(b.startTime));\n rows.push({\n clickId: h.click.id,\n name: SHOW_NAME,\n time: gTime(showed[0].startTime),\n value: showValue,\n who: h.name,\n why: `attended ${showed[0].title ?? \"appointment\"} at ${showed[0].startTime}`,\n });\n }\n } catch { /* one unreadable contact must not sink the file */ }\n }\n\n return {\n rows,\n scanned,\n pages,\n clicked: hits.length,\n reachedCutoff,\n days,\n since: new Date(cutoff).toISOString(),\n };\n}\n\n\n=====FILE engine/gads.ts =====\n// GOOGLE ADS OFFLINE CONVERSIONS — built 15 Aug 2026, after the boarding forensics run.\n//\n// WHY THIS EXISTS\n// The account's only website conversion action watches book.thedogsspotga.com/start-5784?submitted=1.\n// Live census 15 Aug: ZERO of the CRM's 5,767 lifetime contacts originated from that funnel, and both\n// boarding forms hold ZERO submissions ever. Meanwhile two Google-clicked contacts arrived in 22 days\n// (found by gclid on their contact records) and one became a boarding customer who showed and rated\n// the stay 10/10 — invisible to Google. The clicks are measured on Google's side; the OUTCOMES are in\n// the CRM. The honest join is an offline-conversion upload keyed on the gclid GHL already stores.\n// No developer token, no tag, no funnel edit required.\n//\n// WHAT IT DOES\n// Scans recent contacts for a Google click id, joins each to its real outcomes, and emits the exact\n// CSV Google Ads' \"Uploads\" screen accepts. Read-only against the CRM: it never writes anything.\n// ?k= JSON preview — what would be uploaded, with per-contact reasoning\n// ?k=&csv=1 the upload file itself (text/csv, Google's format)\n// ?k=&days=35 lookback in days (default 35; hard cap 85 — Google rejects conversions\n// more than 90 days after the click, and the click precedes the contact)\n// &leadValue=5&showValue=150 per-row values; defaults 5 and 150 USD\n//\n// Two conversion names are emitted. BOTH must exist in Google Ads first, created as\n// Goals → Conversions → New conversion action → Import → CRM/file → \"Conversions from clicks\":\n// CRM Lead (Google) — a Google-clicked contact was created in the CRM\n// CRM Booking Showed (Google) — that contact then attended an appointment (\"showed\")\n// The names must match EXACTLY, or Google rejects the rows with \"unknown conversion name\".\n//\n// TRAPS ENCODED HERE, so nobody relearns them\n// * Conversion Time must be AFTER the click. The click precedes contact creation, so lead rows use\n// dateAdded + 5 minutes and showed rows use the appointment start (later still).\n// * The gclid is not a first-class field: it hides inside attribution URLs and session blobs, often\n// URL-ENCODED (gclid%3D). Extraction is by regex over the serialised contact, both encodings.\n// * GET /opportunities/search with date filters returns HTTP 200 + 0 rows SILENTLY (proven 15 Aug).\n// Nothing here uses those filters. Contacts are paginated via meta.nextPageUrl and cut off locally.\n// * Cloudflare blocks non-browser clients inconsistently; all reads send a Chrome UA like the engine.\n\nconst KEY_SHA256 = \"48cd12465712045f70247da1689eeb198a4ce2d98416d8e52fb844581f044f15\";\nconst LOC = \"BQHJ19uohldYe3eqA0bl\";\nconst GHL = \"https://services.leadconnectorhq.com\";\nconst UA =\n \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\";\nconst PAGE_CAP = 18; // 18 × 100 contacts ≫ any realistic lookback at ~25 new contacts/day\n\nasync function sha256Hex(s: string): Promise {\n const b = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(s));\n return [...new Uint8Array(b)].map((x) => x.toString(16).padStart(2, \"0\")).join(\"\");\n}\nasync function authorised(k: string): Promise {\n const expected = Deno.env.get(\"NURTURE_ADMIN_KEY_SHA256\") || KEY_SHA256;\n const got = await sha256Hex(k);\n if (got.length !== expected.length) return false;\n let d = 0;\n for (let i = 0; i < got.length; i++) d |= got.charCodeAt(i) ^ expected.charCodeAt(i);\n return d === 0;\n}\n\nasync function ghlToken(): Promise {\n const env = Deno.env.get(\"GHL_TOKEN\");\n if (env) return env;\n const { blob } = await import(\"https://esm.town/v/std/blob\");\n const cfg = (await blob.getJSON(\"puppy_config\").catch(() => null)) as { ghlToken?: string } | null;\n return cfg?.ghlToken ?? \"\";\n}\n\nasync function j(url: string, version: string, token: string): Promise {\n const r = await fetch(url, {\n headers: { Authorization: `Bearer ${token}`, Version: version, \"User-Agent\": UA, Accept: \"application/json\" },\n });\n if (!r.ok) throw new Error(`${r.status} ${url.slice(0, 120)}`);\n return r.json();\n}\n\n// gclid / wbraid / gbraid, plain or URL-encoded, anywhere in the serialised contact.\nfunction extractClickId(raw: string): { kind: string; id: string } | null {\n for (const kind of [\"gclid\", \"wbraid\", \"gbraid\"]) {\n const m =\n raw.match(new RegExp(`${kind}(?:%3D|=|%253D)([A-Za-z0-9_-]{20,140})`, \"i\")) ||\n raw.match(new RegExp(`\"${kind}\"\\\\s*:\\\\s*\"([A-Za-z0-9_-]{20,140})\"`, \"i\"));\n if (m) return { kind, id: m[1] };\n }\n return null;\n}\n\n// Google's documented CSV time shape, no per-row zone (the Parameters line pins UTC).\nfunction gTime(iso: string, plusMinutes = 0): string {\n const d = new Date(new Date(iso).getTime() + plusMinutes * 60_000);\n const p = (n: number) => String(n).padStart(2, \"0\");\n return `${d.getUTCFullYear()}-${p(d.getUTCMonth() + 1)}-${p(d.getUTCDate())} ` +\n `${p(d.getUTCHours())}:${p(d.getUTCMinutes())}:${p(d.getUTCSeconds())}`;\n}\n\nexport default async function (req: Request): Promise {\n const u = new URL(req.url);\n if (!(await authorised(u.searchParams.get(\"k\") ?? \"\"))) {\n return new Response(\"Not found\", { status: 401 });\n }\n const token = await ghlToken();\n if (!token) return Response.json({ ok: false, error: \"no GHL token in env or puppy_config blob\" }, { status: 500 });\n\n const days = Math.min(Math.max(Number(u.searchParams.get(\"days\")) || 35, 1), 85);\n const leadValue = Number(u.searchParams.get(\"leadValue\")) || 5;\n const showValue = Number(u.searchParams.get(\"showValue\")) || 150;\n const cutoff = Date.now() - days * 86_400_000;\n\n // 1. Walk contacts newest-first until we pass the cutoff.\n const hits: any[] = [];\n let url: string | null = `${GHL}/contacts/?locationId=${LOC}&limit=100`;\n let pages = 0, scanned = 0, reachedCutoff = false;\n while (url && pages < PAGE_CAP && !reachedCutoff) {\n const page = await j(url, \"2021-07-28\", token);\n const contacts = page.contacts ?? [];\n for (const c of contacts) {\n scanned++;\n const added = Date.parse(c.dateAdded ?? \"\");\n if (Number.isFinite(added) && added < cutoff) { reachedCutoff = true; break; }\n const click = extractClickId(JSON.stringify(c));\n if (click) {\n hits.push({\n id: c.id,\n name: [c.firstName, c.lastName].filter(Boolean).join(\" \") || \"(no name)\",\n dateAdded: c.dateAdded,\n click,\n });\n }\n }\n url = page.meta?.nextPageUrl ?? null;\n pages++;\n }\n\n // 2. Join each Google-clicked contact to its real outcomes.\n const rows: { clickId: string; name: string; time: string; value: number; who: string; why: string }[] = [];\n for (const h of hits) {\n rows.push({\n clickId: h.click.id, name: \"CRM Lead (Google)\", time: gTime(h.dateAdded, 5),\n value: leadValue, who: h.name, why: `contact created ${h.dateAdded} carrying a ${h.click.kind}`,\n });\n try {\n const appts = await j(`${GHL}/contacts/${h.id}/appointments`, \"2021-04-15\", token);\n const showed = (appts.events ?? []).filter((e: any) =>\n /showed|completed/i.test(String(e.appointmentStatus ?? \"\")) && e.startTime\n );\n // One \"showed\" conversion per contact — the FIRST attended appointment. Google de-dupes on\n // (click id, name, time), so re-uploads of the same file are safe; new showings restate the\n // same first row rather than inventing a second sale.\n if (showed.length) {\n showed.sort((a: any, b: any) => Date.parse(a.startTime) - Date.parse(b.startTime));\n rows.push({\n clickId: h.click.id, name: \"CRM Booking Showed (Google)\", time: gTime(showed[0].startTime),\n value: showValue, who: h.who ?? h.name, why: `attended ${showed[0].title ?? \"appointment\"} at ${showed[0].startTime}`,\n });\n }\n } catch { /* appointments unreadable for one contact must not sink the file */ }\n }\n\n if (u.searchParams.get(\"csv\") === \"1\") {\n const esc = (s: string) => `\"${String(s).replace(/\"/g, '\"\"')}\"`;\n // Column set taken from Google's own live template, fetched 15 Aug 2026:\n // https://www.gstatic.com/conversiontracking/conversion-import-template.csv\n // It now REQUIRES two consent columns. Omitting them fails Preview with the unhelpful\n // \"The selected file is missing data columns.\" Both are padded onto the Parameters row too,\n // exactly as the template does, or the row count check trips.\n // Ad User Data / Ad Personalization: GRANTED | DENIED | UNSPECIFIED.\n // UNSPECIFIED is the honest value here — Kim's customers are US, consent mode is not\n // configured on this account, and asserting GRANTED would be a claim about consent\n // collection nobody has verified. Google processes US traffic normally on UNSPECIFIED.\n const CONSENT = \"UNSPECIFIED\";\n const lines = [\n \"Parameters:TimeZone=+0000,,,,,,\",\n \"Google Click ID,Conversion Name,Conversion Time,Conversion Value,Conversion Currency,Ad User Data,Ad Personalization\",\n ...rows.map((r) =>\n [esc(r.clickId), esc(r.name), esc(r.time), r.value, \"USD\", CONSENT, CONSENT].join(\",\")\n ),\n ];\n return new Response(lines.join(\"\\n\") + \"\\n\", {\n headers: {\n \"Content-Type\": \"text/csv; charset=utf-8\",\n \"Content-Disposition\": `attachment; filename=\"dogsspot-google-offline-${new Date().toISOString().slice(0, 10)}.csv\"`,\n },\n });\n }\n\n return Response.json({\n ok: true,\n window: { days, since: new Date(cutoff).toISOString() },\n scanned: { contacts: scanned, pages, reachedCutoff },\n googleClickedContacts: hits.length,\n uploadRows: rows.length,\n rows,\n uploadHow:\n \"Google Ads → Goals → Conversions → Uploads → + → 'Upload a file' → this endpoint with &csv=1. \" +\n \"Both conversion actions must already exist as Import→'Conversions from clicks' with EXACTLY these names: \" +\n \"'CRM Lead (Google)' and 'CRM Booking Showed (Google)'.\",\n });\n}\n\n",[546],"4a6b8352-b339-408f-9e43-3a7d500903d6","SOURCE-BUNDLE.part40.txt","99c4a1d0-989e-11f1-8422-1607ee4eb77e",1090,["D",1786801896252],"THE DOGS SPOT — SOURCE BUNDLE (part 40 of 40)\n\nEVERY source file in this project, engine/ included. Restoring these parts and nothing else gives\nyou a tree that builds, typechecks and runs its own test suite with no network and no val.\n\nengine/ is here as of 14 Aug 2026. It used to be left out because val 1bfa6e81-74e1-4c6c-ab32-118304a4ffff\nholds it, which was true of every engine file except engine/watch.ts: a module the val does not run,\nso it was never deployed, so it lived in one container and nothing else. A reclaim destroyed it.\nscripts/deploy.mjs --check still compares engine/ against the val file by file; that is a second\ncheck on the same files now, not the only copy of them.\n\nRESTORE (needs only node, from an empty folder). Save each part, then run this ON EACH ONE:\n\n node -e 'const fs=require(\"fs\"),p=require(\"path\");const b=fs.readFileSync(process.argv[1],\"utf8\");\n for(const s of b.split(\"\\n=====FILE \").slice(1)){const i=s.indexOf(\" =====\\n\");\n const f=s.slice(0,i),c=s.slice(i+7);fs.mkdirSync(p.dirname(f),{recursive:true});\n fs.writeFileSync(f,c.replace(/\\n$/,\"\"))}' PART.txt\n\nA record named #1, #2, ... is one FILE cut into pieces: concatenate them in order, then\nstrip one trailing newline from the last. scripts/restore.mjs does this for you.\n\nEach part is complete in itself: whole files only, no reassembly, any order.\n\nThen: node scripts/build.mjs (engine/ came out of these parts; nothing to fetch first)\n node scripts/typecheck.mjs\n node tests/run-all.mjs\n node scripts/deploy.mjs --check (pulls nothing, proves the val matches what you restored)\n node tests/negative-controls.mjs (proves the suite above can actually fail)\n\nIN THIS PART (1 of 116 files)\n handover/DEPOSIT-SPEC.md 51179 bytes 4f0b188b82d9\n\n================================================================================================\n=====FILE handover/DEPOSIT-SPEC.md =====\n# HOLIDAY DEPOSIT TRACKER - build spec, 6 Aug\n## The finding that changes everything\nSquare payments ARE in the CRM. They land as contact notes, e.g.\n \"[Square] +$355.00 payment tWYOxuFcG9ZqzF7GTnUPfElf2ZEZY (balance $0.00)\"\nVerified live on contact mmc80rVoE52OKMPQUr7G, 6 Aug 00:47. Every previous conclusion that\n\"the CRM never sees Square money\" came from querying /payments/*, products and custom fields.\nNobody queried /contacts/{id}/notes. So the tracker is buildable, and what Kim was told\n(\"we read those payments and do the bookkeeping\") is accurate.\n\n## Two traps found in the same data\n1. The same payment is written FIVE times, with contradictory balance figures in the duplicates\n ($355.00 then $0.00 x4). Dedupe on the payment id. Never trust the balance figure.\n2. Recurring bookings (a standing weekly slot) fall inside any holiday window and would make\n Kim chase regulars who never owed. Filter isRecurring.\n\n## What it must say to Kim, honestly\nNot \"who still owes\". It cannot be that: a deposit taken in cash or over the phone leaves no\ntrace. It is \"holiday stays where we cannot find a $50 payment\" - a shortlist to check, which\nturns going through every holiday booking by hand into checking these few.\n\n## Build\n- engine/holiday-deposits.ts, called from the interval, rendered by dashboard.ts. GET only.\n Test asserts the source contains no POST/PUT/PATCH.\n- Read drop-off calendars only (pick-up would double count each stay).\n- Per distinct contact: GET /contacts/{id}/notes, parse /^\\[Square\\]\\s*\\+\\$([\\d,]+\\.\\d{2})\\s+payment\\s+(\\S+)/\n- Group into stays by contact + drop-off date. Musselwhite has three dogs on one day: one stay.\n- Status: seen / partial / none_seen / could_not_check. could_not_check NEVER collapses to none_seen.\n- Write NOTHING to the CRM. No tag, no field, no stage. addTag is not TEST_MODE-guarded, and\n \"Add tag 'red flag' = DND\" proves a tag here can silence a contact on six channels.\n- Kill switch: if zero Square notes exist in the period, suppress the list and say the feed\n looks dead, rather than printing \"everyone owes\".\n- The word \"unpaid\" must not appear. Suite asserts it.\n\n## Ask Kim before it goes live\nExact holiday window dates. $50 per stay or per dog. Does she ever take the deposit in cash.\n\n---\n\n# BUILT AND LIVE — 6 August 2026\n\n## What shipped\n| file | on the val | what it is |\n|---|---|---|\n| engine/holiday-deposits.ts | script | all the judgement. No fetch, no write verb, enforced by H22. |\n| engine/deposits.ts | http | the only file that touches the CRM. One GET-only door. |\n| engine/deposits-cron.ts | interval | the scheduled refresh. Separate from main.ts on purpose. |\n| engine/dashboard.ts | http | the card Kim reads, from the stored blob, no CRM call at render. |\n\nBlob key `holiday_deposits`. Endpoint `?k=&run=1` collects and stores; `?k=` reads\nback what is stored.\n\n## Watched working, live\n- 2026-08-06T15:41:28Z — first live collection. 2 stays, 2 calendars read, 0 read failures.\n- 2026-08-06T15:42:56Z — second collection after the kill-switch fix. Correct sentence.\n- 2026-08-06 ~15:44Z — card rendered on the live dashboard, both customers named, no accusation.\n\n## Two things the live data changed\n1. **There is a SECOND Square note format.** `[Square] Till payment $35.00 on . Matched from\n Square payment via customer .` It does not match the `+$` pattern this spec started\n with. A customer whose only record was this shape would have read as \"nothing on file\". Both\n formats are parsed now; where the same amount appears as a direct payment AND as a \"Matched\n from\" record, it is counted ONCE, because over-counting takes a real customer off the shortlist\n and nobody ever looks at them again. H23–H26.\n2. **The kill switch fired on a sample of two.** The first live run was about to tell Kim her\n payment feed had stopped because neither of two customers had a Square note. It now needs at\n least 5 customers checked (`MIN_SAMPLE_FOR_DEAD_FEED`). Found by watching it run, not by\n reading the code. H19b.\n\nAlso: her CRM returns BOTH `appointmentStatus` and the misspelled `appoinmentStatus` — on 4 of 13\nevents. They agree today. Both are read, and either one saying cancelled excludes the booking. H28.\n\n## Tests\n30 assertions in holiday-deposits.test.mjs, 12 in deposits-collect.test.mjs, 9 in dashboard.test.mjs\n(D5.1–D5.9). 19 negative controls prove each of those guarantees can actually go red.\n\n## NOT YET OBSERVED — do not claim this works\n`deposits-cron.ts` is registered on the val as type `interval` and the val accepted a second\ninterval file. **It has not been seen firing on its own.** val.town's API exposes no schedule\nfield, so the only proof is the blob's `at` moving forward without anybody triggering it. Until\nthat has been observed, the list refreshes when the endpoint is hit and the page honestly reports\n\"last checked N hours ago\". Baseline to check against: 2026-08-06T15:42:56.924Z.\n\n## Still to ask Kim\nExact window edges (currently Monday-to-Sunday around Thanksgiving, and 20 Dec to 2 Jan).\n$50 per stay or per dog. Whether she ever takes the deposit in cash — that answer decides whether\nthe \"may have been paid another way\" caveat can ever be dropped.\n\n---\n\n# ROUND TWO — 6 August, afternoon\n\nTwo independent adversarial reads were run against the shipped feature. The first found 19\ndefects, the second found 16 more IN THE FIXES. Everything below is what changed as a result.\nBoth reviewers were given the live data and told to run the built code rather than read it.\n\n## The design change that mattered\n\n**It has stopped guessing which payment is the deposit.** Nothing in the CRM says what a card\npayment was for, and two attempts at inferring it were both wrong in the direction that costs Kim\nmoney:\n\n| version | rule | what it got wrong |\n|---|---|---|\n| v1 | sum every payment between booking and drop-off | a $355 training package cleared a $50 deposit; cleared means nobody ever looks again |\n| v2 | sum payments within 10 days of the booking | missed a real $50 paid 8 days later — the card said \"we cannot find a $50 payment\" one line after printing one — and still cleared anyone who settled a $240 invoice that week |\n| v3 | **a card payment for EXACTLY $50 clears a stay. Nothing else does.** | every other payment near the stay is listed with date and amount for Kim to judge |\n\nA wrong \"worth a look\" costs Kim a glance. A wrong \"settled\" costs her $50 and she never finds out.\n\n## Everything else round two changed\n\n- **Stay length comes from the PICK-UP calendars.** A drop-off booking is a ten minute handover\n slot; its endTime says nothing about the stay. Pairing rule: the LATEST eligible pick-up on or\n after the drop-off and BEFORE that customer's next drop-off. Both bounds were found by failure —\n earliest-wins deleted a family whose first dog went home early, and unbounded made a 3-night\n Thanksgiving stay render as \"Nov 25 to Dec 27\".\n- **The kill switch counts customers, not bookings.** Her account has one contact with 24\n drop-offs; counting rows let one cash-paying regular suppress the whole card.\n- **A pick-up calendar that fails is declared on the card.** It was being written into the blob\n and read by nothing — the quietest possible failure, because the stays that vanish are exactly\n the ones the pick-up calendars exist to find.\n- **The unknown count on the card counts ROWS**, matching the table, not customers.\n- Daycare exclusion narrowed: a title saying both daycare and boarding is a boarding booking.\n- `looksLikeTestRecord` no longer matches \"tester\" — Tester is a real surname and this label sits\n next to a person's name.\n- The dead-feed sentence no longer says \"any of the 0 we could check\".\n\n## Two tests that could not fail, and one control suite that could not run\n\n- **H5** (\"cancelled bookings are excluded\") used a fixture dated 2 November, outside every\n window, so it passed with the cancellation filter deleted. Fixture moved inside the window.\n- **H8**'s structural guard matched a pattern that went stale the day `localDay` grew a legitimate\n numeric branch. It now asserts the specific thing it means: the string path slices, never parses.\n- **negative-controls.mjs was truncated by an edit** — the whole runner was deleted. It then\n printed NOTHING and exited 0, which reads as \"all controls passed\". `run-all.mjs` now runs one\n control as a smoke test and goes RED if the control suite prints no result. Fault-injected and\n confirmed to fire.\n\n## State at 16:53 on 6 August\n\n- 15 suites, 262 assertions, 0 failed.\n- **89 negative controls, 89 passing** — every guarantee above can be made to go red on demand.\n- Live run at 16:53:19Z: 2 stays, both worth a look, 2/2 drop-off and 2/2 pick-up calendars read,\n 0 unreadable customers. Card verified on the live dashboard, no accusation in it.\n\n---\n\n# ROUND THREE — 6 August, 17:00. Verdict was NOT CLEAN.\n\nA third independent read was run with instructions to mutate the code and prove the tests catch\nit. Six mutations, five stayed green. Everything below is what that round changed.\n\n## The one that would have cost Kim money, silently\n\n**One $50 payment settled every holiday stay that customer had.** `statusFor` answers about a\nsingle stay and was handed the customer's whole payment list. A regular who books Thanksgiving\nAND Christmas in the same phone call and pays one deposit had BOTH rows go green. Kim was owed\n$100, $50 arrived, and neither row reached the shortlist. This is the ordinary case, not an edge:\nthe two search windows are both anchored on the same booking date and overlap almost completely.\n\nFixed by `statusesForCustomer()`: payments are ALLOCATED, earliest drop-off first, and a payment\nspent on one stay is invisible to the next. H48, plus a negative control.\n\n## The one that would have taken the whole test suite down\n\n`D5.11`'s fixture carried a hardcoded timestamp and the stale-list banner fires on real elapsed\ntime. **From 8 August the entire 269-assertion regression net would have read RED on the wall\nclock, with no code change.** The fixture is now relative to now. Verified green at +48 hours and\nat +400 days by injecting an offset clock.\n\n## The rest\n\n- **A pick-up on the same day as the next drop-off** (collect one dog, board another, same day)\n deleted the stay it was ending — the busiest stay of the season, silently. Bound is `<=` now.\n- **An orphan pick-up dragged an out-of-season boarding onto the shortlist**: a 6 November stay\n rendered \"Nov 6 to Feb 1\". `MAX_STAY_DAYS = 21` caps the reach. Her account has ~20 contacts\n with pick-ups and no matching drop-off, so orphans are the common case.\n- **H42 was pinning that bug** — it asserted the drag HAPPENED, with a follow-up assertion whose\n first disjunct was false and whose second was true whenever the drag occurred. Rewritten to\n forbid it.\n- **One booking with no `dateAdded` blacked out the whole card**: its structurally-empty payment\n list counted as \"we looked and saw nothing\", pushing the dead-feed sample over the floor.\n- **A run where nobody's payments could be read was stored over yesterday's real shortlist**, with\n a FRESH timestamp — content worse, page claiming to be up to date. Now refused.\n- Grammar: \"1 card payment is on file … none of them … among them\".\n- Four guarantees that no test could break (the search window's upper edge, the per-customer\n sample rule, the amber label on a partial row, and the headline counting partial rows) now have\n tests and controls.\n\n## State at 17:21 on 6 August\n\n- 15 suites, **269 assertions**, 0 failed. Green at +48h and +400d on an injected clock.\n- **98 negative controls, 98 passing.**\n- Live run 17:21:23Z: 2 stays, 2/2 drop-off and 2/2 pick-up calendars, 0 unreadable.\n\n## STILL NOT OBSERVED — do not claim this works\n\n`deposits-cron.ts` is registered on the val as a second `interval` file. It has **not been seen\nfiring on its own**. The blob moved once at 15:44:33Z, six seconds after that file was deployed,\nwhich looks like a deploy-triggered first run rather than a schedule. Between 17:21 and 17:29 it\ndid not move. val.town exposes no schedule field on the API, so the only proof is the stored `at`\nadvancing with nobody triggering it. Until that is seen, treat the list as refreshing when the\nendpoint is hit; the card reports its own age and warns past 36 hours.\n\n---\n\n# ROUNDS FOUR, FIVE AND SIX — 6 August, evening. All three: NOT CLEAN.\n\nThree more independent adversarial reads, each told to mutate the code and prove the tests catch\nit. Between them they ran ~110 mutations. The pattern that matters: **the same money bug came back\nthree times, one layer down each time.**\n\n## The money bug, and the three doors it came back through\n\nThe rule is: one $50 deposit settles ONE stay. A regular books Thanksgiving and Christmas in one\nphone call and pays one deposit; if both rows go green, Kim is owed $100, $50 arrived, and neither\nrow reaches the shortlist. She never finds out.\n\n| round | door it came back through | fix |\n|---|---|---|\n| 3 | `statusFor` was handed the customer's whole payment list per stay | `statusesForCustomer` allocates each payment to one stay, earliest first |\n| 4 | the allocator marked only the SURVIVING id of a direct/backfill twin as spent | collapse once, globally, before allocating |\n| 6 | the collapse was one-for-one, so with two backfills and one payment the survivor was folded AGAIN per stay and never spent | the collapse is now IDEMPOTENT: every backfill sharing an amount with a payment folds, so a second pass is a genuine no-op |\n\nRound 6 found it reachable from Kim's real note text at ~1% of generated contacts. H48, H52, H56,\nH57 and D27 now cover the four layers; each has a negative control.\n\n## Test-integrity defects, which matter more than any single bug\n\n- **`run-all.mjs` never rebuilt.** Behavioural assertions import `build/`, structural ones read\n `engine/`. Deleting the allocation from the source and running the suite WITHOUT rebuilding gave\n \"270 assertions passed, RESULT: GREEN\". The runner now builds first, and a failed build is a RED.\n- **`negative-controls.mjs` was truncated by an edit** — the whole runner deleted. It printed\n nothing and exited 0, which reads as \"all controls passed\". `run-all.mjs` now runs one control\n as a smoke test and goes RED if the control suite prints no result.\n- **The suite would have gone RED on the wall clock on 8 August** — a fixture timestamp against a\n 36-hour staleness banner. Fixtures are relative to now; verified green at +2d, +200d and +2y.\n- **D29 was four vacuous assertions** — regexes over main.ts for \"3600_000\", \"holiday_deposits\",\n \"runCollection()\" and \"catch\". Four different real breakages stayed green, including one that\n made the refresh run on every tick and one that made it never run. The rule is a pure function\n now (`needsRefresh`) and is tested as one.\n- **D12/D26/D28 read the raw file**, so a `[was: ...]` note quoting a deleted guard kept them\n green. They read comment-stripped source now, and what the guards DO is tested behaviourally\n through `decideStore`.\n- **H27 could not fail** (its fixture used the deposit amount, where both assertions hold by\n construction). **H5 could not fail** (fixture outside every window). **H42 asserted the bug its\n own comment said was fixed.** All three rewritten.\n- One control was RETIRED rather than retargeted: idempotency made the fault it injected a no-op,\n so it could no longer fail. A control that cannot fail is worse than no control.\n\n## Other real fixes from these rounds\n\n- Drop-off and pick-up calendars are fetched over the SAME range. They were not, so for every stay\n at the tail of the season the customer's own next booking was never fetched and the \"hard upper\n bound\" was structurally blind: a 30 Dec stay rendered \"Dec 30 to Jan 15\" and a January payment\n settled the holiday deposit.\n- A pick-up on the same day as the next drop-off (collect one dog, board another) deleted the stay\n it was ending.\n- An orphan pick-up dragged an out-of-season boarding onto the shortlist as \"Nov 6 to Feb 1\".\n `MAX_STAY_DAYS = 21`.\n- The refresh gate now keys off an ATTEMPT stamp, not the stored list, so a run that legitimately\n declines to store does not get retried every 15 minutes against a CRM that is already unwell.\n- The season rolls over on New York time, not UTC. It was emptying the card at 8pm on 2 January.\n- `deploy.mjs` reports main.ts in BOTH characters and bytes and gates on the stricter. At one point\n it read 79,815 characters and 80,137 bytes — \"185 to spare\" on one measure, over the line on the\n other.\n- One `$50` payment can no longer be quoted on two different settled rows.\n\n## State at 19:23 on 6 August\n\n- 15 suites, **283 assertions**, 0 failed. Green at +2d, +200d and +2y on an injected clock.\n- **118 negative controls, 118 passing.**\n- Live run 19:03:39Z: 2 stays, 2/2 drop-off and 2/2 pick-up calendars, 0 unreadable, stored.\n Engine healthy after the main.ts change (engineOk true, watchdog INFO).\n\n## The refresh, and what is still not proven\n\n`deposits-cron.ts` has still never been observed firing on its own (checked at 15:44, 17:29, 18:32\nand 19:23 — every movement of the blob was a manual run). So the refresh is now called from\n`main.ts`'s interval, which IS watched keeping time. **That has not been observed firing yet\neither** — the attempt stamp was set at 19:03:39Z and the gate is one hour, so the first\nengine-driven refresh is due after 20:03. Do not claim it works until the stored `at` has moved\nwith nobody triggering it.\n\n---\n\n# THE TWO FACTS THAT WERE IN HER OWN HANDOVER PACK — 6 August, 20:30\n\nA seventh review round could not run: the container reverted to a 4 August snapshot and the whole\nfeature was gone from disk. Restored from the val's SOURCE-BUNDLE (9 parts, 34 files, byte-for-byte,\nzero DIFFERS against the live val) plus the engine files pulled from the val itself, and the two\nderived PDFs rebuilt from `scripts/make-pdfs.mjs`. Suite green again at 291 assertions.\n\nThat round did find two things before it stopped, both from `drive2/06_money.html` — the money page\nbuilt from Kim's own live website — and both were live money defects:\n\n## 1. The deposit is $50 PER DOG\n\n> \"Holiday boarding — **$50 per dog**, non-refundable. Deducted from the total boarding cost at\n> drop-off. The booking is not confirmed until the deposit is paid.\"\n\nThe module charged a flat $50 a stay, and the card carried a line asking Kim to tell us if it was\nper dog. It was in her own pack. Jeffrey Musselwhite's three dogs over Thanksgiving owe **$150**,\nand a single $50 payment was clearing the whole stay — the silent direction, where somebody who\nowes $100 more drops off the shortlist and is never looked at again.\n\nNow: `depositDue(stay) = $50 × dogs`, counted from the drop-off ROWS rather than the parsed names\n(her titles include \" Boarding Dropoff with Help Test\", which yields no name at all). A stay\nsettles on one payment for the full amount due, OR on one $50 payment per dog. Nothing else.\nH58, H59, and three negative controls.\n\n## 2. Card is not the only way she gets paid\n\nHer money page lists **Card, Venmo, Zelle and cheque**, and says card is \"the only one that matches\nitself to a customer record automatically\". The copy said a deposit \"may still have been paid in\ncash or over the phone\" — naming neither route she actually offers. Every Venmo, Zelle and cheque\ndeposit is invisible to this feature, so naming them is the difference between Kim knowing where to\nlook and Kim assuming non-payment. H60 and a control.\n\n## And one that fell out of the per-dog change\n\nThe headline said \"we cannot find a $50 payment against it\" directly above a row that owed $150 —\na number in prose contradicting the number beneath it. The headline names no amount now; each row\nstates its own. H61 and a control.\n\n## State at 20:31 on 6 August\n\n- 15 suites, **291 assertions**, 0 failed. 123 negative controls.\n- Live run 20:31:37Z: 1 stay (the second customer's New Year bookings were cancelled in her CRM\n between runs, and were correctly dropped), 2/2 drop-off and 2/2 pick-up calendars, 0 unreadable.\n- The card reads: \"The deposit on this stay is $150.00 (3 dogs at $50) and no card payment is on\n file around it at all. A deposit paid by Venmo, Zelle, cheque or cash does not reach the card\n system, so it will not show here.\"\n\n## Still open\n\n- Two consecutive CLEAN adversarial rounds. Rounds 1-6 were all NOT CLEAN; round 7 could not run.\n- The engine-driven refresh has still not been WATCHED firing. Attempt stamp 20:31:37Z, gate is one\n hour, so the first engine-driven refresh is due after 21:31.\n- Ask Kim: the boarding cancellation policy (her website has nothing on it), and whether the\n Thanksgiving window edges (Monday to Sunday) are the ones she wants.\n\n---\n\n# ROUND SEVEN — 6 August, 21:00. NOT CLEAN. The money bug came back a FOURTH time.\n\nFifty-three mutations run against the code. Forty-six were caught; five of the seven that were not\nsat in the per-dog logic added earlier the same evening.\n\n## The bug, and why it keeps coming back\n\nThe rule for **\"is this stay settled\"** and the rule for **\"what did that cost\"** lived in two\nplaces, and every time the first one grew, the second one did not follow.\n\nThe per-dog change let a stay clear on EITHER one payment for the full amount due OR one $50 per\ndog. The allocator still debited a single $50. So:\n\n- a two-dog stay settled by one $100 payment debited **nothing** — and that same $100 settled the\n customer's next stay too. Kim owed $200, $100 arrived, neither row reached her shortlist.\n- three $50 payments settled two two-dog stays ($150 covering $200), with the middle payment quoted\n on both rows.\n- a two-dog stay settled by $100 debited an unrelated $50 — so the next stay, which that $50\n exactly matched, was told *\"nothing on file matches that amount\"* while showing Kim the $100.\n A payment she can see, on a page saying it is not there.\n\nA property test over 50,000 generated customers: of 5,415 with two or more settled stays,\n**1,567 (29%)** cleared a set of stays that no disjoint allocation of the available payments could\nactually cover.\n\n**The fix is structural, not another patch.** `qualifyingPayments(stay, payments)` is now the only\nthing that decides which payments settle a stay. `statusFor` asks it what settles; the allocator\nasks it what to spend. They cannot disagree, because it is the same answer. H62, H63, H68 and four\nnegative controls.\n\n## The rest of round seven\n\n- **Nothing had ever typechecked this project.** `dogCount` was added to the `Stay` type and two\n object literals were never updated; esbuild strips types without checking them, so the build was\n clean and 290 assertions were green over a real type error. `scripts/typecheck.mjs` now runs a\n Deno-aware `tsc` (waiving only `Deno`, remote https imports, and `./main.ts`), `run-all.mjs`\n gates on it, and the exact defect was re-injected to prove the gate fires.\n- The Dogs column showed two names beside a three-dog charge, because names come from parsed titles\n and the charge comes from booking rows. It now reads \"Achilles, Ghost and 1 more (3 in total)\".\n- **$250 is her published TRAINING deposit and also exactly five dogs at $50.** The per-dog rule\n widened the clearing amounts from {$50} to {$50, $100, $150, $200, $250, ...}, so a $250 match\n now says out loud that it could be either.\n- The headline said \"we cannot find a card payment matching what **they are owed**\" — Kim is owed\n *by* them. `D5.4`'s ban regex only covered \"owes\", so it passed.\n- Three payment dates read \"Oct 5 and Oct 6 and Oct 7\".\n- `deposits-cron.ts` called `runCollection()` with no gate; if val.town ever fires it, it would\n have collected on every tick.\n- The dashboard fixture's `sentence` was hardcoded pre-round-6 copy, so D5.4's Venmo/Zelle\n assertion was satisfied by the fixture rather than by anything the code produces. It is generated\n from `depositSentence` now.\n\n## The refresh: first autonomous run OBSERVED\n\nAt **2026-08-06T20:49:03.612Z the list refreshed with nobody triggering it** — the first time that\nhas been seen. It is not yet known WHICH of the two schedules did it (the engine's interval, or\ndeposits-cron.ts), because nothing recorded the source. It does now: every attempt is stamped with\n`source`, and the read route returns `lastAttemptBy` alongside `lastAttemptAt` and `refreshDueAt`.\nNext refresh due 21:49:03Z. Until a labelled one is seen, the honest claim is \"something works\",\nnot \"the engine works\".\n\nReading the list does NOT write the stamp — checked by a control, because every earlier observation\ntonight was ruined by manual runs pushing the gate an hour further out.\n\n## State at 21:12 on 6 August\n\n- 15 suites, **300 assertions**, 0 failed, typecheck clean. 135 negative controls.\n- All four deposit files deployed and hash-verified on the val.\n\n---\n\n# THE REFRESH: WATCHED WORKING — 6 August, 21:49:13Z\n\nAll evening this was the one thing I would not claim. It is now observed, twice, with the source\nrecorded by the code rather than inferred:\n\n| when | what | source |\n|---|---|---|\n| 2026-08-06T20:49:03.612Z | list refreshed, nobody triggered it | not recorded (the stamp did not exist yet) |\n| 2026-08-06T21:49:13.781Z | list refreshed, nobody triggered it | **deposits-cron** |\n\nOne hour apart, matching the watchdog val's own observed hourly cadence. So val.town does run a\nsecond `interval` file in a val. The earlier note in NOTES-v1.4.md was a statement about what had\nbeen observed, not about the platform, and it is now superseded.\n\nBoth schedules are wired — deposits-cron.ts and main.ts's interval — and both go through the same\n`refreshIfDue`, reading the same attempt stamp. Whichever fires first closes the gate for an hour;\nthe other is a no-op. Nothing needs removing.\n\n**Checking it without breaking it:** GET the endpoint WITHOUT `?run=1`. That returns\n`lastAttemptAt`, `lastAttemptBy` and `refreshDueAt`, and writes nothing. `?run=1` writes the stamp\nand pushes the gate an hour out — which is exactly how every observation before 21:00 got ruined.\n\n# ROUND EIGHT — NOT CLEAN, but the money bug did not come back\n\n300,000 property cases across the allocator: **zero** violations of disjoint coverability, zero\ncross-window clearing, zero payments quoted on two settled rows, zero wrong amounts. The structural\nfix from round seven held. What round eight found instead:\n\n- **A row denied a payment Kim can see in Square. 7.9% of generated rows.** The payment list shown\n on a row was computed from the money still UNSPENT, so a stay whose deposit had already been\n counted against an earlier stay was told \"no card payment is on file around it at all\" — with the\n payment sitting in its own window. One step from an accusation, and false. Rows now show\n everything on the account near the stay and say plainly when money has already been counted\n against an earlier one.\n- **`run-all.mjs` reported GREEN with the seven money-guard tests deleted** — a suite could lose\n assertions and only a global floor of 100 would notice. There is a per-suite ratchet now, and the\n exact deletion was re-injected to prove it fires.\n- **The accusation ban missed \"Not paid\"** — relabelling a row shipped green. The ban is wider now\n and scans the state labels, and the one sentence allowed to use the word \"owe\" is the one that\n denies the accusation: it is removed by exact text before scanning and asserted present, so it\n cannot be deleted to make room for a real one.\n- **D33/D34/D35 were text-presence checks.** A mutation that called `needsRefresh` and threw the\n answer away — collecting from her CRM on every tick — passed all three. The decision is one\n shared function (`refreshIfDue`) that both schedules call, and it is tested by watching it decide.\n- Three dogs paid for in one visit read \"on Nov 20, Nov 20 and Nov 20\".\n- **$150 and $200 collide with her real boarding totals** (published rates $30-$65/day; five nights\n at $30 is $150, exactly a three-dog deposit), and only the rarest collision ($250, her training\n deposit) was flagged. Any single lump sum above one dog's deposit now says what else it could be;\n one $50 per dog is stronger evidence and carries no caveat.\n- `amountSeen` on a multi-dog settled row and the 0/1/many grammar on two strings were unpinned.\n\n## State at 21:52 on 6 August\n\n- 15 suites, **312 assertions**, 0 failed, typecheck clean, per-suite ratchet armed.\n- **143 negative controls.**\n- Live: 1 holiday stay, $150 due for three dogs, refreshing itself hourly.\n\n---\n\n# ROUND NINE — NOT CLEAN. The money bug's fifth door, and it was the collapse.\n\n## The bug\n\n`collapseSameMoney` folded a backfill record into a payment on **amount alone, with no date\nbound** — across a customer's entire history. The justification is one real pair on her account;\nthat pair is 14.6 days apart. $50 is precisely the amount a repeat customer pays more than once in\na year, so a November payment and a December till record were being read as one $50:\n\n- a real deposit deleted,\n- a settled stay demoted to the shortlist,\n- and the row then printing *\"nothing unspent on file matches that amount\"* and *\"nothing else is\n left over around it\"* about a customer who had paid **twice**.\n\n2.3% of generated customers. Setting every payment to `direct` (so the collapse can never fire)\ndrove it to 0.00%, which is how the cause was isolated.\n\n**Fixed with a date bound of 21 days**, and the number is not a guess: the one real pair is 14.6\ndays apart, because the parser deliberately uses the backfill's own stated payment date rather than\nthe day the note was written. A fortnight was written first and was too tight for the only case\nanybody has ever seen. Twenty-one carries about 40% headroom and still refuses to fold across\nmonths. H74 and two controls.\n\n## The test gaps it exposed, which matter as much\n\n- **The accusation ban was a ten-phrase deny-list** on the one invariant this feature exists for.\n It had already been widened once, after \"Not paid\" walked through. Round nine then walked\n \"No payment received\", \"Chase this one\", \"Still to pay\" and \"Deposit missing\" past it, plus a\n card printing *\"Total still to collect from these customers: $250\"* — a dollar total of alleged\n debt, containing no banned word at all. **It is an allow-list now**: the four state labels are\n pinned exactly, and adding a fifth has to come through the test. Running totals are banned\n separately.\n- **Both refresh call sites were guarded by greps.** Wrapping the engine's whole refresh in\n `if (Math.random() < 0)` — so the hourly refresh never fires — passed every string check and\n their ordering. And the scheduled file could call `runCollection` a *second* time outside the\n gate, collecting from her CRM on every tick, while satisfying a negative lookahead on the label.\n Now: the engine's statement is pinned exactly and nothing conditional may sit between the import\n and it; the cron file may contain exactly ONE `runCollection(` and it must be inside the gate.\n- **The `others`/`counted` split was only half pinned.** H69 asserted the \"already counted\"\n sentence was present, never that the payment was absent from the other list — so dropping the\n filter printed the same payment twice in one row, in contradictory terms, and it stayed green.\n\n## Also fixed\n\n- Three taps on one day listed as three identical lines (\"$50.00 on Dec 20, $50.00 on Dec 20,\n $50.00 on Dec 20\"). Now \"3 payments of $50.00 on Dec 20\".\n- \"Nothing else on this account is unaccounted for around it\" — accounting jargon and a double\n negative, immediately followed by a sentence naming a payment that IS around it.\n- \"an earlier stay\" when the money went to two or more.\n- The one string still saying \"Square payment\" where the other nine say \"card payment\".\n\n# THE REFRESH: THREE AUTONOMOUS RUNS, ALL LABELLED\n\n| when | source |\n|---|---|\n| 2026-08-06T20:49:03.612Z | not recorded (the stamp did not exist yet) |\n| 2026-08-06T21:49:13.781Z | **deposits-cron** |\n| 2026-08-06T22:52:28.947Z | **deposits-cron** |\n\nHourly, unattended, and the code names the schedule rather than leaving it to be inferred.\n\n# State at 22:55 on 6 August\n\n- 15 suites, **318 assertions**, 0 failed, typecheck clean, per-suite floors armed.\n- **151 negative controls, 151 passing.**\n- Live: 1 holiday stay, $150 due for three dogs, refreshing itself hourly.\n\n# STILL OWED\n\nTwo consecutive CLEAN adversarial rounds. Nine rounds have run; every one found something real.\nRound 10 is the next one.\n\n---\n\n# ROUND TEN — NOT CLEAN. The money is sound; the guards were not.\n\n**460,000 randomised allocator cases and 15,000 end-to-end collections: zero money defects.** The\nstructural fixes from rounds seven and nine held. What round ten broke instead was every guard\nround nine had added *specifically to be unbreakable*:\n\n- **The DEP_STATE allow-list pinned the constant, not the page.** The render site was free, so a\n ternary produced \"Nothing received\", a new column produced \"$150 to chase\", and a footer produced\n \"Still to collect across these stays: $250\" — all green. The ban underneath was two more\n hand-written regexes, inside a test whose own comment says guessing at English cannot work.\n **Now the RENDERED PAGE is checked three ways:** the column headers must be exactly the five it\n has; the status cell for each of the four states must be exactly its allowed label; and every\n dollar figure on the page must trace back to a row's own note or the headline, so a total of\n alleged debt cannot be synthesised however it is worded.\n- **The engine's exact-statement pin was bypassed by putting the condition BEFORE the import** —\n and again by wrapping the block in a function nothing calls. The hourly refresh never fired, 310\n assertions green. **The whole block is pinned now, and it must appear exactly once.**\n- **The cron file's ONE-`runCollection(` count was bypassed three ways**: aliasing it, handing the\n gate a reader that always returns null (collects every tick), and passing `0` instead of\n `Date.now()` (the gate never opens again, silently). **The whole statement is pinned, and both\n `runCollection` and `refreshIfDue` may appear exactly twice: the import and the call.**\n- **The accusation scan was reading hand-typed fixture notes**, not generated ones. Appending\n \", so they still owe this one.\" to a real branch reached Kim's page green. **It scans generated\n notes across every state now, rendered.**\n\n## Shipped defects it found\n\n- **\"2 are worth checking: we cannot find a card payment matching what ARE owed on them.\"** The\n first line Kim reads, in the common case. H73 checked the count and stopped before the clause.\n- **Five of six cancellation statuses were pinned by nothing** — every test asserted \"cancelled\"\n only. GHL emits `noshow` and `invalid`, and the American spelling is one keystroke away. Any of\n them reaching the list puts a customer who cancelled on her chase list.\n- **`COLLAPSE_WINDOW_DAYS` was pinned but not required to be used** — hardcoding 30 at the call\n site satisfied every assertion, so the documented bound and the effective bound could differ.\n- **Two different payments sharing an amount and a day rendered identically**, which makes a\n correct allocation look exactly like the money bug. Now: \"one of 2 payments of that amount that\n day\".\n\n## State at 23:40 on 6 August\n\n- 15 suites, **326 assertions**, 0 failed, typecheck clean, per-suite floors armed.\n- **161 negative controls**, each injecting one of round ten's own bypasses.\n- Live: 1 holiday stay, $150 due for three dogs, refreshing itself hourly (20:49, 21:49, 22:52 UTC,\n all labelled deposits-cron).\n\n## Still owed\n\nTwo consecutive CLEAN rounds. Ten have run; every one found something. The trend is worth stating\nplainly: rounds 1-9 kept finding defects in the FEATURE, and round ten found none — it found them\nin the tests guarding the feature. That is a different and better place to be, but it is not clean.\n\n---\n\n# ROUND ELEVEN — NOT CLEAN. One live defect, and the three new guards all defeated.\n\n## The live one, and it is the same sentence for the third time\n\n`statusesForCustomer` passed the **globally collapsed** payment list as `opts.all` — the parameter\nwhose own docstring says it is \"everything on the account, which is what Kim can see in Square\",\nwhich the collapsed list is not.\n\nA regular books Thanksgiving and Christmas and pays **both** deposits: $50 at the till on 24 Nov,\n$50 by card on 8 Dec. Fourteen days apart, inside the 21-day collapse bound, so the till record is\nfolded away — and its survivor is outside the Thanksgiving window. That row then read:\n\n> \"The deposit on this stay is $50.00 (1 dog at $50) and **no card payment is on file around it at\n> all.**\"\n\nAdding a later payment turned a settled stay into \"nothing at all\". 0.22% of rows. Fixed by passing\nthe raw list: `statusFor` collapses it itself, scoped to that stay's own window, which is the only\nscope where \"same money\" is a reading rather than a guess. H82 and a control.\n\n## The three guards from round ten, all defeated\n\n- **D30/D35 pinned the blocks but not their reachability.** One statement inserted *above* each\n block kills both schedules, with the pinned text, indentation and identifier counts untouched.\n Kim's list would never refresh again, suite green.\n- **D5.19's money-trace only ever rendered a single settled row**, so a total conditional on there\n being a worth-a-look row — the only shape where such a total makes sense — never appeared in the\n card it scans. It now renders all four row states.\n- **D5.4 is still a deny-list and still loses**: \"they have skipped the deposit\", \"Nothing has come\n in from them yet\", \"Those customers are still to pay\" all reached the card. **Replaced with an\n allow-list on the note cell**: the rendered note must be EXACTLY the note the engine generated,\n escaped, plus at most the one known test-record warning. The card may render a note; it may not\n write one.\n\n## The meta-guard that mattered most\n\n**A test can be hollowed out to a bare `return scoped(3, \"allocations\")` and still print PASS** —\nassertion count unchanged, self-reported check count unchanged, per-suite floors unmoved. I added\ncheck-totals to the harness first and it did not catch it, because the scope number is self-\nreported.\n\nWhat does catch it is a **negative control**: it injects the fault and demands that named test go\nred, and a hollow test cannot go red. So `run-all.mjs` now runs **six money-critical controls on\nevery single test run** — the ones guarding the bug that has come back six times — and goes RED if\nany of them stops firing. Cost: about thirty seconds. Fault-injected: hollowing H62 now fails the\nrun with \"red, but on the wrong test\".\n\n## Also fixed\n\n- `MAX_STAY_DAYS` could be set anywhere from 22 to 86 without a test moving.\n- The same-day clause could drop \"that day\", which would be true of two payments a month apart.\n\n## What I am NOT claiming\n\nA source-reading test cannot prove a call site is *reached*. Round eleven demonstrated that twice,\nand the fix for it is not another text pin — it is the live signal: the card reports its own age and\nwarns past 36 hours, and the attempt stamp records which schedule last ran. A dead schedule shows up\non Kim's page, which is where it matters.\n\n## State at 00:27 on 7 August\n\n- 15 suites, **318 assertions**, 0 failed, typecheck clean, per-suite test AND check floors armed,\n six money guards re-proved every run.\n- **165 negative controls, 165 passing.**\n- Refresh observed autonomously four times: 20:49, 21:49, 22:52, 23:54 UTC, all `deposits-cron`.\n\n## Still owed\n\nTwo consecutive CLEAN rounds. Eleven have run.\n\n---\n\n# ROUND TWELVE — NOT CLEAN. One live contradiction, and the note allow-list was too narrow.\n\n## The live one: a row denied a match one clause before printing it\n\nA payment can be VISIBLE in a stay's window and still not settle it, when its fold-twin survives\noutside that window. The row then read:\n\n> \"The deposit on this stay is $50.00 (1 dog at $50), and **nothing unspent on file matches that\n> amount**. 1 card payment is on file around it: **$50.00 on Oct 15**.\"\n\n1.3% of rows. The module's own header names that exact sentence shape as the v2 bug it was fixed\nfor — it had come back in a different branch. The worse variant lists two $50 payments against a\n$100 two-dog stay in the same breath as denying a match.\n\nIt now says what is true: *\"…and Square records the same money again outside this stay, so it has\nnot been counted here.\"* The plain wording survives for the ordinary case where nothing matches.\nH83 and a control.\n\n## The note allow-list was too narrow, seven ways\n\nD5.20 only ever rendered `seen` rows and only inspected the note cell. A twelfth review put seven\naccusations onto Kim's page with the suite fully green:\n\n- \" They have skipped the deposit.\" — gated on `none_seen`\n- \" Those customers are still to pay.\" — gated on `partial`\n- \"Nothing has come in from them yet. \" — prepended\n- one gated on row DATA rather than state, to prove it was not just about `state`\n- \"Ann Flu **(still to pay)**\" — the Who column\n- \"Fluffy **- deposit missing**\" — the Dogs column\n- the stale banner rewritten to \"will still show here as **having skipped it**\"\n\nNone contains a banned word, which is the point D5.20's own comment makes. It now checks **every\nstate and every cell of the row** — Who, Dogs and note must each be exactly what the engine gave\nit, escaped — and pins the staleness sentence word for word.\n\n## The money-provenance check was a substring test\n\nD5.19 asked \"does this figure appear anywhere in the notes?\", so a total that coincided with any\nrow's figure passed — and with a $50-per-dog deposit those figures are exactly what a debt total\nsums to. This shipped green:\n\n> \"These stays are still short by **$150.00** between them.\"\n\nIt is provenance **by exclusion** now: strip everything the card was given, and any money left over\nwas invented by the card.\n\n## Also\n\n- The Dogs cell's escaping was covered by nothing. Dog names come from appointment titles, which\n her public booking form writes, so that cell is attacker-writable. The shipped code escapes it\n correctly; the guard was missing.\n- The footer's \"Venmo, Zelle, a cheque or cash will not\" could be dropped entirely — D5.12 scanned\n the whole card and was satisfied by the headline.\n- A $200 four-dog row advised \"Two or three separate $50 payments would be clearer\" — $100 to $150\n of advice on a $200 stay, contradicting the rule the same row applies. It names the right number\n now.\n\n## State at 01:31 on 7 August\n\n- 15 suites, **324 assertions**, 0 failed, typecheck clean, test AND check floors, **seven**\n money-critical controls re-proved on every run.\n- **174 negative controls.**\n- Refresh observed autonomously five times: 20:49, 21:49, 22:52, 23:54, 00:54 UTC, all\n `deposits-cron`.\n\n## An honest note on where this is going\n\nTwelve rounds. Rounds 1-9 found defects in the FEATURE. Rounds 10-12 have found almost entirely\ndefects in the TESTS — each round defeating the guard the previous round added, usually by gating\non a row state or a cell the fixture never rendered. That is a real and improving trend, but it is\nnot the same as clean, and I have not claimed it is.\n\n---\n\n# ROUND 14 — 7 August\n\nTen reviewers, eight against different targets at once. Every finding below was reproduced by hand\nbefore it was touched. Most of what came back was not about the deposit feature at all.\n\n## Three test-integrity holes, each the successor of a disaster this project already had\n\n**1. A whole suite could vanish and `run-all` still printed GREEN, exit 0.** Every floor is applied\nby looking a suite up in `rows`, and `rows` only holds suites discovery found. Proved three ways:\ndelete `detect.test.mjs` (14 suites, GREEN, no mention); rename it `.bak` (GREEN, one passive line);\nadd it to `NOT_A_SUITE` (GREEN, appears nowhere at all). Fixed: every key in any floor table must\nappear in `rows` or the run is RED, and `NOT_A_SUITE` is printed on every run.\n\n**2. A test could still be hollowed to `return scoped(N, label)` and print PASS.** Disaster #3, which\ntwo previous fixes were supposed to close. Proved on `H1` — the guard on the exact \"fourth Thursday\"\nmistake Kim made — by deleting all five `eq()` calls: `86 passed, 0 failed, 327 checks`,\nbyte-identical to the honest run, GREEN. Both existing floors are numbers a test AUTHOR TYPES.\nFixed: `ok()`/`eq()` increment a counter inside themselves, a test executing zero assertions is a\nhard failure, and `ASSERT_FLOORS` ratchets that count per suite. Same guard added to the v1 harness.\n\n**3. `negative-controls.mjs` truncated to three entries printed a small, plausible green.** Fixed\nwith `EXPECTED_CONTROL_COUNT`, checked before anything runs and under `--only` too.\n\nTwo more of the same family: **a control could pass on a suite that was already red** (fixed with a\nmemoized clean-tree baseline per suite), and **run-all's seven money guards were matched by NAME**\nso the fault under a name could be swapped and the reassuring line kept printing (fixed with a\nfingerprint of the injected fault). Also `codeOnly()` was defeated by a decoy string constant\ncontaining the code being asserted; whole-line string constants are blanked now, with the residual\nnamed. And `typecheck.mjs` printed \"0 engine files, 0 real error(s)\" and exited 0 on an empty tree.\n\n## Live defects in the feature\n\n**Two customers could drop off the list with nothing looking wrong.** `decideStore` refused an empty\nrun, an all-unknown run, and a real-list-to-nothing run — but not a run that saw FEWER calendars\nthan the stored one. One calendar failing (no retry exists) wrote a partial union over the complete\none with a fresh timestamp; the missing customers get no row at all, not an unknown row. Fixed by\ncomparing how many calendars did NOT answer, so a deleted calendar still stores and so does the\nfirst run.\n\n**The allocator was order-dependent, two ways** (841,000 shuffles). Same-day stays settled in caller\norder; and `qualifyingPayments` took the first array match, which could starve a later stay. Fixed\nwith a deterministic stay tie-break and oldest-money-first. 60,000 shuffles now stable, and the fix\nsettles a case that used to come back half-unpaid.\n\n**Nine crashes in `depositCard`**, each of which takes down the whole dashboard — `rows` non-iterable,\n`dogs` a string, `windows` a string or holding a null, a non-string `day` (invisible with one row,\nbecause `.sort()` never calls the comparator on a one-element array). **The headline was read out of\nthe blob and never checked against the rows underneath it.** **An unparseable `at` skipped the\nstaleness banner entirely.** **An unrecognised state** got a grey dot beside an orange label. **A row\nwith no name** rendered as an anonymous green \"Payment on file\". **Bidi overrides** and unbounded\nlength reached the page from a public booking form. **A UTC drop-off time** would move a stay a whole\nday — not observed on this endpoint, cheap to handle, wrong to slice.\n\n## Copy\n\n**Cash is not one of Kim's routes** — her money page lists Card, Venmo, Zelle, Cheque and nothing\nelse. **\"Daycare\" was on her dashboard**, which she instructed removed from customer copy.\n**\"Nothing collected yet\"** reads as a sentence about money under a heading about deposits.\n**The accusation net missed 45 of 53 candidate sentences** — it had a vocabulary of refusal and none\nof absence or invoicing, and two misses were pure inflection.\n\n## The reversion, and what it cost\n\nAt about 15:10 the container reverted to a snapshot predating the deposit tracker. `scripts/` was\ngone, so `restore.mjs` was gone with it and had to be rewritten before anything could be recovered;\nthe val token was recovered from the session transcript. The restore then returned a MISMATCHED\nrepo: the engine came back at round-14 state because it had been deployed, and tests and handover\ncame back from a bundle written before round 14 because the rebundle had been left to the end.\nSix tests failed for reasons that looked like new bugs and were actually a day-old suite meeting\nday-new code. Roughly half this session's remaining budget went on rebuilding the test side.\n\nThe lesson is not \"check harder\". It is **rebundle the moment the tree is green**, every time,\nbecause the bundle is the only copy of everything that is not the engine. `restore.mjs` now names\nthe eleven files whose absence means the bundle is older than the work, and says so on the way out.\n\n## State at 16:40 on 7 August\n\n- 15 suites, **332 tests**, 0 failed, typecheck clean, test AND check AND assertion floors, every\n floor's suite proved to have actually run.\n- **203 negative controls**, seven pinned by fingerprint in `run-all`, one retired on the record.\n- Engine deployed and verified (v388); bundle rebuilt and pushed (parts 1-11); `restore.mjs --check`\n shows byte-for-byte agreement on every file.\n- Watched live at 03:13:02Z: a real collection through the new storage rule, 2/2 calendars, 2/2\n pick-ups, stored, row note naming three routes rather than four.\n- Refresh observed autonomously at 02:55:55Z, labelled `deposits-cron` — the sixth sighting.\n\n# ROUND 15 — IN FLIGHT, NOT CLEAN\n\nOne reviewer ran before the reversion, against the accusation net. It tested 81 candidate sentences\nand got **69 past the regex and onto the rendered card**, in 17 distinct mechanisms. Fourteen are\nreal. One is fixed:\n\n- **FIXED: the non-breaking space.** \"Jeffrey has not paid his deposit.\" A JS regex literal\n space matches U+0020 and nothing else, so one invisible character defeated every two- and\n three-word alternative at once — ten of about twenty-five — while rendering identically on Kim's\n phone. The scrub now folds NBSP, thin spaces and zero-width characters to ordinary spaces and\n collapses runs, so the regex sees the sentence a reader sees.\n\n**Still open, and the first work of the next session.** The remaining thirteen fall into groups the\nregex has no vocabulary for: negator-verb separation (\"has not YET paid\", \"is yet to pay\"), ellipsis\n(\"the others are settled. Jeffrey hasn't.\"), euphemism (\"not settled\", \"still open\", \"hasn't\ncleared\", \"shortfall\"), imperative (\"collect from Jeffrey before Thursday\"), spelled-out and\nreworded ratios (\"Zero of three\", \"0 out of 3\"), passive absence (\"no deposit was taken\"), the\nprogressive (\"nobody is paying\"), and hyphenation (\"un-paid\").\n\nThe honest conclusion is that this is the third time the blocklist has been widened and the third\ntime it has been beaten. **A denylist over free prose cannot be completed.** The next round should\nstop widening it and make the note cell an ALLOW-LIST by construction: every Kim-facing sentence is\ngenerated from a small closed set of templates, and the test reconstructs each rendered string from\nits template plus the row's data and demands an exact match — the same provenance-by-exclusion\nargument already used for the money figures. The regex stays as a second line, not the first.\n\n\n",[554],"74f1abbd-787f-4078-8758-d31dd8d98cb0","SOURCE-BUNDLE.part4.txt","987dc3f2-90c3-11f1-8748-1607ee4eb77e",1089,["D",1786801895712],45,"THE DOGS SPOT — SOURCE BUNDLE (part 4 of 40)\n\nEVERY source file in this project, engine/ included. Restoring these parts and nothing else gives\nyou a tree that builds, typechecks and runs its own test suite with no network and no val.\n\nengine/ is here as of 14 Aug 2026. It used to be left out because val 1bfa6e81-74e1-4c6c-ab32-118304a4ffff\nholds it, which was true of every engine file except engine/watch.ts: a module the val does not run,\nso it was never deployed, so it lived in one container and nothing else. A reclaim destroyed it.\nscripts/deploy.mjs --check still compares engine/ against the val file by file; that is a second\ncheck on the same files now, not the only copy of them.\n\nRESTORE (needs only node, from an empty folder). Save each part, then run this ON EACH ONE:\n\n node -e 'const fs=require(\"fs\"),p=require(\"path\");const b=fs.readFileSync(process.argv[1],\"utf8\");\n for(const s of b.split(\"\\n=====FILE \").slice(1)){const i=s.indexOf(\" =====\\n\");\n const f=s.slice(0,i),c=s.slice(i+7);fs.mkdirSync(p.dirname(f),{recursive:true});\n fs.writeFileSync(f,c.replace(/\\n$/,\"\"))}' PART.txt\n\nA record named #1, #2, ... is one FILE cut into pieces: concatenate them in order, then\nstrip one trailing newline from the last. scripts/restore.mjs does this for you.\n\nEach part is complete in itself: whole files only, no reassembly, any order.\n\nThen: node scripts/build.mjs (engine/ came out of these parts; nothing to fetch first)\n node scripts/typecheck.mjs\n node tests/run-all.mjs\n node scripts/deploy.mjs --check (pulls nothing, proves the val matches what you restored)\n node tests/negative-controls.mjs (proves the suite above can actually fail)\n\nIN THIS PART (4 of 116 files)\n\n engine/decisions.ts 24235 bytes 613969c51185\n engine/deposits-cron.ts 2221 bytes 9f774e1fa586\n engine/deposits.ts 22047 bytes 04da4c1ffef5\n\n================================================================================================\n=====FILE engine/dashboard.ts#2 =====\nem holds\" : \"them hold\"} up the email half, which cannot start until ${blocking === 1 ? \"it is\" : \"they are\"} answered.`} They are the first card below, most pressing first.
` : \"\"}\n\n
Waiting on you
\n
The ones written out in full are the ones worth your time first: anything holding up the email half, anything already affecting customers, and anything about money. The rest can wait as long as you like. Each one says how we know it is real and what happens if you never answer, because for most of them the answer is nothing bad. They are numbered, so a reply saying \"yes to 1 and 3\" is a complete answer. The numbers stay attached to the same questions week to week, so the list below runs out of order once the quieter ones are tucked away. Send it to Amir on Upwork, or say it on the next call.
\n${decRows}\n
\n\n${stale.length || missing.length || truncated.length ? `
Heads up: ${\n stale.length ? `${esc(stale.map((s) => `${s} (last read ${ago(sectionAge(s))})`).join(\", \"))} could not be read at this moment, so ${stale.length === 1 ? \"that number is the last one\" : \"those numbers are the last ones\"} we read successfully. ` : \"\"\n}${missing.length ? `${esc(missing.join(\" and \"))} could not be read and there is no earlier reading to show, so ${missing.length === 1 ? \"it shows\" : \"they show\"} as n/a. ` : \"\"\n}${truncated.length ? `you have enough records that we stopped reading partway through rather than keep you waiting, so ${truncated.length === 1 ? \"the count of\" : \"the counts of\"} ${esc(truncated.join(\" and \"))} ${truncated.length === 1 ? \"is a floor\" : \"are floors\"}, not ${truncated.length === 1 ? \"a total\" : \"totals\"}. The real number is that one or higher, never lower. ` : \"\"\n}Every other number on this page was read fresh just now. Refreshing in a few minutes normally gets the rest.
` : \"\"}\n\n
\n${tile(\"New inquiries\", na(inq), inq != null && inqPrev != null ? `last 7 days, ${vs(inq, inqPrev)}` : \"last 7 days\", undefined)}\n${tile(\"Pup Talks on the calendar\", pt ? String(pt.booked) : \"n/a\", pt && ptPrev ? `held in the last 7 days, ${vs(pt.booked, ptPrev.booked)}` : \"held in the last 7 days\")}\n${tile(\"Showed up\", pt ? String(pt.showed) : \"n/a\", pt ? (() => {\n const un = Math.max(0, pt.booked - pt.showed - pt.noshow);\n const bits = [`of the ${pt.booked} held`];\n if (pt.noshow) bits.push(`${pt.noshow} did not show`);\n // every appointment in the denominator has to be accounted for, or the reader is left doing\n // subtraction on the front tile and finding a number missing\n if (un) bits.push(`${un} ${un === 1 ? \"has\" : \"have\"} not been marked yet, so this figure is flattering by up to ${un}`);\n const tail = pt.cancelled ? ` A further ${pt.cancelled} cancelled ahead of time and ${pt.cancelled === 1 ? \"is\" : \"are\"} not counted in the ${pt.booked}.` : \"\";\n return bits.join(\", \") + \".\" + tail;\n })() : \"last 7 days\")}\n${tile(\"New customers\", won ? String(won.count) : \"n/a\", truncated.includes(\"customers\") ? \"reached the Customer stage. At least this many: see the note above\" : won && wonPrev ? `reached the Customer stage, ${vs(won.count, wonPrev.count)}` : \"reached the Customer stage, last 7 days\", undefined)}\n
\n\n${depositCard(dep, depR.ok, ago)}\n\n${funnelReady ? `
From first contact to paying customer
\n
Four counts over the same 7 days. An inquiry is any new person who reached you and landed in your CRM: a Facebook or Instagram message, a form, the chat box, or a phone call somebody logged.
\n${funnelHtml}\n
Before reading that first gap as bad news: ${socialShare != null ? `${socialShare}% of these inquiries` : \"most of these inquiries\"} arrived as a message on Facebook or Instagram, and a message costs the sender nothing, so plenty were never close to booking. Worth knowing what this cannot tell you: your CRM's arrival record has no category for a phone call at all, so callers are not separated out here. The old source column logged ${esc(String(phoneLogged ?? \"some\"))} phone calls this week, but that column is blank for most people, so neither of us can put a firm number on how many of these actually rang you. The first three rows follow the same people through. The last one does not, and it would be dishonest to draw an arrow to it: somebody who became a customer this week usually first got in touch weeks or months ago, so they are not part of the ${esc(String(inq))} above. Read it as four true counts over the same seven days rather than one conversion rate. The gap between inquiries and Pup Talks is the widest of them, and it is the one worth a conversation.
\n
` : \"\"}\n\n
Is everything working?
\n${checkRow(crmOk, \"Your CRM\", crmOk ? \"Answering normally. This page just read it.\" : crmPartial ? `Answered for some things but not for ${esc(crmDown.join(\" and \"))} just now. If this is still showing in an hour, tell Amir.` : \"Did not answer just now. If this is still showing in an hour, tell Amir.\")}\n${checkRow(engineOk, \"The follow-up system\", kill?.stopped\n ? \"Stopped by the big red button. Nothing is being sent.\"\n : engineAgeMin == null ? \"No check-in recorded yet.\"\n : `Last checked itself ${ago(run?.ts)}. ${lateSentence(engineLate, engineCadence)}`)}\n${checkRow(wdOk, \"The watchdog\", wd\n ? wdNeverRanItself\n ? `${wd.headline} Last look ${ago(wd.ts)}, started by hand. ${neverRanItselfSentence(wdTrackingSince, wdManualSince)}`\n : `${wd.headline} Last look ${ago(wd.ts)}. ${lateSentence(wdLate, wdCadence)}${wdLate.state === \"late\" ? \" Treat that last report as out of date until it looks again.\" : \"\"}`\n : \"No report from the watchdog yet.\")}\n${meta ? checkRow(true, \"Facebook ad spend\", \"Connected and reporting. Your spend is in the advertising section below.\")\n : metaPending ? `
•
Facebook ad spend
Half connected. Your ad account is named here, and Facebook has not yet given us permission to read what you spend on it, so the connection does not work yet. That is one setting on Amir's side, not a fault. It is the only reason this page can show you what came in but not what it cost.
`\n : metaErr ? checkRow(false, \"Facebook ad spend\", `Not reading right now: ${metaErr}`)\n : `
•
Facebook ad spend
Not linked yet, so this page cannot show what you spent. Where your inquiries came from is shown below regardless, because that comes from your own records rather than from Facebook.
`}\n
\n\n
Where the last 7 days of inquiries came from
\n${chan ? `
${chanBar}
${chanLegend}
` : `
Could not read this just now.
`}\n${cover ? `
${cover.known === cover.total ? `Every one of these ${cover.total}` : `${cover.known} of these ${cover.total}`} carries a record of how they arrived, though for some that record just says \"other\", so treat the named channels as the solid part. Worth knowing: the CRM's own \"source\" column is blank for ${esc(String(((srcAll ?? []) as any[]).find((s: any) => s.source === \"no source recorded\")?.n ?? 0))} of these, so any list built off that column will look like you have no idea where your customers come from. You do. It is recorded one field over.
` : \"\"}\n${otherBucket && otherBucketSentence(otherBucket) ? `
${esc(otherBucketSentence(otherBucket))}
` : \"\"}\n${campRows ? `
Which ads they answered
${campRows}
${\n campShown < campTotal\n ? `The ${Math.min(5, (camps ?? []).length)} biggest, covering ${campShown} of the ${campTotal} people who answered a named ad. The remaining ${campTotal - campShown} are spread across ${Math.max(0, (camps ?? []).length - 5)} smaller ones. `\n : `All ${campTotal} people who answered a named ad. `\n}${inq != null && campTotal < inq ? `The other ${inq - campTotal} of your ${inq} inquiries came in without a campaign attached, which is normal for people who message you directly rather than clicking an ad. ` : \"\"}These are the campaign names exactly as they appear in your ad account. Counted from your own records rather than from Facebook, so it stays true whether or not the ad account is linked.
` : \"\"}\n
\n\n
New inquiries, week by week
\n${buckets ? `
${bars}
Eight weeks, oldest on the left. The last bar is the last 7 days.${trendLine ? ` ${esc(trendLine)}` : \"\"}
` : `
Could not read this just now.
`}\n
\n\n${meta || metaErr ? `
What the advertising cost
\n${adCard(\"Facebook and Instagram\", !!meta, meta ? money(meta.spend) : \"\", meta ? String(meta.conv) : \"\", metaErr ? `Not reading right now: ${metaErr}` : \"\")}\n${meta ? `
Spend covers the seven full days up to yesterday, which is the last day the ad platform reports as final. Set against the ${esc(String(inq ?? \"n/a\"))} inquiries above, that is ${meta && inq ? esc(money(meta.spend / inq)) : \"n/a\"} each.
` : \"\"}\n${googleErr ? `
Google: ${esc(googleErr)}
` : \"\"}\n
` : \"\"}\n\n
What we have been doing
\n
Newest first. Each line names how it was checked, so you can pick any one and hold it up against the thing itself. Anything marked \"my mistake\" is one of mine, kept here on purpose rather than quietly fixed.
\n${logRows || `
Nothing recorded yet.
`}\n${logRest ? `
${logRest} older ${logRest === 1 ? \"entry\" : \"entries\"}
${logRestRows}
` : \"\"}\n
\n\n
One thing worth fixing in the CRM
\n
${valued != null && valuedTotal != null && won2Total\n ? `A price gets written on about one deal in ${Math.max(2, Math.round(won2Total / Math.max(1, valued)))}: ${valued} of your ${won2Total} customer records carry one, ${money(valuedTotal)} between them. The most recent was ${valuedRecentMs ? esc(prettyDate(new Date(valuedRecentMs).toISOString()) + \" \" + new Date(valuedRecentMs).getUTCFullYear()) : \"further back than these records reach\"}. So the habit exists and it lapsed.`\n : \"Most of your deals do not carry a value.\"}${lostCount != null ? ` Across all ${won2Total} of those records, ${lostCount === 0 ? \"not one is marked won or lost\" : `${lostCount} ${lostCount === 1 ? \"is\" : \"are\"} marked lost and none at all are marked won`}.` : \"\"} So to be plain about it: this card carries no money in it, in or out, only counts of people. That is why it counts people reaching the Customer stage rather than showing you revenue: a figure built on that few would be worse than no figure at all. Writing the price on each deal as it closes is the single change that would let this page show you what a week was worth.
\n\n
The follow-up system, in detail
\n${modeKnown\n ? `
${practice ? \"⚠\" : \"✓\"}
${practice ? \"Practice mode\" : \"Live\"}
${practice ? \"It is doing everything except actually sending. Nobody real is being messaged. It goes live only when you say the word.\" : \"Real messages are going to real people.\"}
`\n : `
⚠
Practice or live: could not check
The system's own record did not answer just now, so this page will not guess. Refresh in a minute.
`}\n${stateKnown\n ? `
0 ? WARN : GOOD}\">${pausedN > 0 ? \"⚠\" : \"✓\"}
${pausedN > 0 ? `${pausedN} person${pausedN === 1 ? \"\" : \"s\"} replied and ${pausedN === 1 ? \"is\" : \"are\"} waiting on you` : \"Nobody is waiting on a reply from you\"}
${pausedN > 0 ? \"The system stepped back the moment they wrote to you. Answer them in your inbox; that is the only job this system ever hands you.\" : \"When somebody replies, the system stops messaging them and they appear here. That is the only job it ever hands you.\"}
\n
${realPeople ? \"✓\" : \"⚠\"}
${realPeople === 0 ? (practice ? \"Nobody real is in the sequence yet\" : \"Nobody is in the sequence right now\") : `${realPeople} in a sequence`}
${realPeople > 0\n ? \"People currently walking through the follow-up messages.\"\n // THE EMPTY CASE, AND WHICH EMPTY IT IS. Empty-and-practice, empty-and-live and\n // empty-and-we-cannot-tell are three different facts and read differently; the unknown branch\n // must not contain the phrase the watchdog scans this page for. Full note: NOTES-dashboard.md.\n : practice\n ? `In practice mode the system runs against ${activeN === 0 ? \"no records at all\" : `${activeN} test record${activeN === 1 ? \"\" : \"s\"} of ours`} and has never sent to or processed one of your actual inquiries. That is deliberate: it is how we prove the machinery works without touching anybody. People join by carrying the tag \"${esc(SOURCE_TAG)}\". A person can put that tag on today, and anyone marked simply waits, untouched, until the switch is thrown. No automation applies the tag yet, so that tagging gets switched on in the same move as go-live.`\n : !modeKnown\n ? `There is nobody in the sequence at this moment. Whether the system is set to run in practice or for real could not be read when this page opened, so this page will not tell you which, and the row a little above says the same thing. That is a failed read of one small record, not a fault in the follow-up itself. Nothing on this line is a claim about who has or has not been messaged, and nothing here is waiting on you. Refresh in a minute and it should be able to answer.`\n : `The system is live and there is nobody in it at this moment. That is what an empty week looks like rather than a fault: everyone who joined has either booked, become a customer, or reached the end of their three weeks. Nothing needs doing and nothing is waiting on you. The next person joins on their own, as soon as the mark \"${esc(SOURCE_TAG)}\" is on their record. Worth knowing which way to read a long empty run: if this line still says nobody a week from now while the new inquiries count at the top of this page keeps climbing, that is people arriving and not being marked, and it is worth telling Amir.`}
`\n : `
⚠
Who is in the system: could not check
This page will not show you a zero it cannot stand behind. Refresh in a minute.
`}\n
\n\n
Read live ${esc(prettyDate(new Date(now + tz * 60_000).toISOString()) + \" at \" + new Date(now + tz * 60_000).toISOString().slice(11, 16))} Georgia time. The four counts at the top, the funnel, both breakdowns and the week-by-week chart ${stale.length || missing.length || truncated.length ? \"were read from your own systems just now, apart from the ones named at the top\" : \"were read from your own systems just now\"}. The questions and the list of work are written by hand, and each one carries the check that backs it.
\n`;\n\n return new Response(html, { headers: { \"content-type\": \"text/html; charset=utf-8\", \"cache-control\": \"no-store\" } });\n}\n\n\n=====FILE engine/decisions.ts =====\n// WHAT IS WAITING ON KIM. v1.2, 4 Aug 2026.\n//\n// WHY THIS FILE EXISTS: two independent readers were handed the dashboard cold. Both said the\n// same thing without prompting. Kim: \"there is no list of what I'm being asked, no button, no\n// 'Kim: 3 things waiting on you'.\" Candace: \"exactly one requires anything from us, buried\n// fifth-from-top, styled identically to eight items needing nothing, with no owner.\" A page that\n// reports state but never asks for a decision quietly turns the reader into a spectator.\n//\n// THE RULE: an item goes here only when it is genuinely blocked on Kim, it is written in her\n// words, and it says what happens if she says yes AND what happens if she says nothing. No item\n// nags. No item implies she is late. \"Nothing\" is always an acceptable answer, and where that is\n// true the item says so.\n//\n// EVERY ITEM MIRRORS A NUMBERED ROW IN THE COMMITMENTS LEDGER, so the page and the ledger cannot\n// drift apart. The `ref` is that row. If you add one here, add it there in the same commit.\n//\n// v1.2, after the second stranger test. Three findings, all fair:\n// 1. Every item carries `evidence` now. The work log below it sets a standard of proof (\"How we\n// know\" on every line) and this card was exempting itself from that standard while sitting\n// ABOVE it. The reader noticed within one read.\n// 2. No item may hardcode a live number. The old K11 text said \"two of this week's went\n// unmarked\" while the tiles, reading the same account, showed none unmarked in their window.\n// A number typed into prose goes stale the day after it is typed. Live figures arrive through\n// `Ctx` and are rendered by a function, or they are not stated.\n// 3. The $250 Bootcamp cohort is a decision about her customers' money and was sitting twelve\n// rows down in the work log rather than here. \"Wrong things promoted\", exactly.\n\nexport type Ctx = {\n unmarkedPupTalks?: number | null; // appointments with no showed/no-show mark yet, this window\n inquiriesPerWeek?: number | null; // live count, so the volume a YES commits her to is never typed\n // computed by facts.ts from the bridge journal. The typed version of this sentence was wrong in\n // all four of its numbers and understated the money by $4,572.\n squareSentence?: string | null;\n // Live, from a server-side tag filter over the WHOLE contact base. Never a scan size.\n puppyTagSentence?: string | null;\n // What the tagging step WOULD pick up, measured on the engine's last run. Null until it has run\n // one, so the page never implies a dry pass happened when none did.\n tagScanSentence?: string | null;\n};\n\nexport type Decision = {\n ref: string; // ledger row, e.g. \"K8\"\n ask: string; // the question, in Kim's vocabulary, ending in a question mark\n why: string | ((c: Ctx) => string); // what it unblocks or prevents\n // A function when the evidence contains a figure. A number in evidence is still a number,\n // and it drifts exactly like a number in prose does.\n evidence: string | ((c: Ctx) => string);\n ifYes?: string | ((c: Ctx) => string); // what saying yes costs. May depend on live figures.\n ifNothing: string; // what happens if she never answers. Honest, including \"nothing bad\".\n weight: \"blocking\" | \"worth doing\" | \"whenever\";\n liveNow?: boolean; // already affecting real customers today, as opposed to pending\n // v1.5. Three separate readers, independently, came to this page worrying about money and found\n // the only question about money filed last and folded away. Weight measures urgency; this\n // measures whether the reader will go looking for it. Money always shows.\n surface?: boolean;\n /** An extra paragraph computed at render time. Never a place to put a typed figure. */\n extra?: (c: Ctx) => string;\n};\n\n// v1.6, 14 Aug 2026, AFTER GO-LIVE. The follow-up system was switched from practice to live on the\n// evening of 11 August. This file did not notice for three days, and three of its cards went on\n// telling Kim the opposite while two real people were being messaged:\n// 1. K8, \"When do we do the switch-on together?\", was an answered question, and its `ifNothing`\n// (\"The new messages stay in practice mode and nobody is messaged by them\") was the single\n// most misleading sentence on her page. DELETED rather than reworded: a card whose question\n// has been answered by an event is not a card, it is a record, and records live in\n// worklog.ts. The go-live is written up there, dated, with evidence she can check herself.\n// 2. K1's `ifYes` said the wording \"still does not send until the switch-on above is scheduled\n// too\". It sends. Corrected. K1 is also no longer `blocking`: it carries a stated default\n// (\"Wednesday's corrections stand as given\"), which by finding 2 of v1.3 below makes it an\n// answered question, and nothing about a wording re-read holds up the email half.\n// 3. K12's `ifNothing` said \"Texting can still go live on its own\". Texting IS live on its own.\n// And WEIGHT_LABEL: `blocking` no longer means \"holds up go-live\", because nothing does. It\n// means the EMAIL half cannot start, which is true of exactly one item, K12. The enum name is\n// left alone on purpose; renaming a type to fix a label is how a rename becomes a refactor.\n//\n// v1.3, after the third stranger test, which read this file as well as the page. Four findings:\n// 1. The type stated the rule as \"what happens if she says yes AND if she says nothing\" and then\n// implemented only half of it. `ifYes` now exists and is filled wherever a yes has a cost.\n// 2. `weight: \"blocking\"` was applied to two items that do not block. An item carrying a stated\n// default is an answered question; a December deposit does not gate a puppy sequence. The\n// headline counts blockers, so mislabelling one puts a wrong number at the top of the page.\n// 3. The genuine email go-live blocker was in the ledger and NOT here, so a reader answering\n// every card would believe the runway was clear when the email half cannot deliver.\n// 4. The page detected \"already reaching customers\" by regex-matching this file's prose, so a\n// reword would have silently disabled the warning. It is a field now.\n\nexport const DECISIONS: Decision[] = [\n // [K8, \"When do we do the switch-on together?\", was removed on 14 Aug 2026. The switch-on\n // happened on the evening of 11 August, so the question had nothing left to ask, and the card\n // was telling Kim the messages \"stay in practice mode and nobody is messaged by them\" while\n // two real people were partway through them. It is not reworded and it is not silently\n // dropped: the event it was asking about is written up as a dated entry in worklog.ts, and the\n // fact that this page carried the wrong answer for three days is written up there too, under\n // \"my mistake\", where her page keeps my errors on purpose.]\n {\n ref: \"K1\",\n ask: \"The wording changes you asked for are in. Want a fresh read, or is Wednesday's answer the answer?\",\n why: \"On Wednesday you gave the wording its verdict and its corrections in one go: open message two on the welcome, say what a Pup Talk is rather than what it is not, drop the lines about what we will not do, and say \\\"going\\\" not \\\"getting on\\\", plus the hot-day water note and back-to-school for August. Every one of those went into the copy on 9 August and each is now pinned by its own automated check so it cannot drift back. The write-ups you hold were regenerated from the changed copy the same day.\",\n evidence: \"Both write-ups were generated from the live system rather than from a draft, so what you read is exactly what would send. Your Wednesday message is the answer of record; the 9 August regeneration carries your changes.\",\n // v1.4. This read \"roughly 190 new people a week\" while the page counted 186 four inches\n // above it. The volume a YES commits her to is the whole weight of the question, so it is\n // counted at render time or it is not stated as a number at all.\n // [was: \"It still does not send until the switch-on above is scheduled too.\" It sends. The\n // system went live on the evening of 11 August and these are the words real people have been\n // receiving since. Corrected 14 Aug 2026.]\n ifYes: \"Nothing else about the wording comes back to you. These are the words going out to real people now, so a change from you would land on every message that has not been sent yet, including the rest of the messages for anyone already partway through.\",\n ifNothing: \"Your Wednesday corrections stand as given and the copy stays exactly as regenerated.\",\n // [was: \"blocking\", when blocking meant \"holds up go-live\". Go-live has happened, and a card\n // whose ifNothing is a stated default was never a blocker by this file's own rule anyway.]\n weight: \"worth doing\",\n },\n {\n ref: \"K2\",\n ask: \"Which number should customers see, 912-348-8726 or 912-823-4382?\",\n why: \"It goes at the bottom of every message that leaves the system, so it needs to be the one you actually want ringing.\",\n evidence: \"Both numbers are live on your account and both are cleared for texting. On 4 August, only one of them was on your website footer: 912-348-8726.\",\n ifNothing: \"We use 912-348-8726, the one already on your website. This one has a default, so it does not hold anything up; it is here because it is your name on the message.\",\n weight: \"worth doing\",\n },\n {\n ref: \"KB1\",\n ask: \"Bootcamp deposits: you answered this on Wednesday. Anything to add, or is it closed?\",\n why: \"Your Wednesday answer is the answer of record: most people pay the deposit over the phone, the one or two who paid the wrong amount were corrected at drop off, everyone ultimately paid the right price, and the website payment was set up to go to PayPal rather than Square. So the earlier worry on this card, that money might have gone missing while the form said $250, is answered by you: nothing was underpaid. The form itself was fixed to $500 on 2 August and stays fixed.\",\n evidence: \"The wrong figure was found inside the booking form's own settings, corrected and published, and the live site was then searched end to end for '$250' with no hits left. Your Wednesday message about PayPal, the phone payments and nothing being underpaid is the answer of record; the payment matching this card used to ask for is no longer needed unless you want it.\",\n ifYes: \"If you ever want the belt-and-braces version, we match the 17 bookings against the payment records and hand you the list. Deciding to look is not deciding to chase.\",\n ifNothing: \"Closed on your say-so. The form is fixed and your answer stands.\",\n extra: (c) => c.squareSentence ? `Separately, on the same subject of money the records cannot place: ${c.squareSentence}` : \"\",\n weight: \"worth doing\",\n surface: true,\n },\n {\n ref: \"K6\",\n ask: \"Should people who have already booked keep getting the safety tips?\",\n why: \"Right now the follow-ups stop the moment somebody books. Some owners like the tips continuing; some find it odd to still be sold at after they said yes.\",\n evidence: \"Read from the sequence itself: booking is a stop condition on every path, including the slow track.\",\n ifNothing: \"They stop at booking, which is the safer of the two.\",\n weight: \"worth doing\",\n },\n {\n ref: \"K11\",\n ask: \"Can we ask the front desk to mark every Pup Talk showed or no-show?\",\n why: (c) =>\n c.unmarkedPupTalks\n ? `${c.unmarkedPupTalks} of the Pup Talks in the last 7 days ${c.unmarkedPupTalks === 1 ? \"has\" : \"have\"} no mark against ${c.unmarkedPupTalks === 1 ? \"it\" : \"them\"} yet, so the show-up figure on this page is better than the truth by up to that many. It is a ten second job at the desk.`\n : \"When one goes unmarked the show-up figure on this page comes out better than the truth, because an unmarked appointment is not counted as a miss. None are unmarked right now, and keeping it that way is a ten second job at the desk.\",\n evidence: \"Counted live from your calendar each time this page loads, not typed in here.\",\n ifYes: \"Nothing to build. It is a habit at the desk, and the number on this page stops flattering itself.\",\n ifNothing: \"The show-up figure drifts optimistic whenever one is missed, and this page keeps saying so. Nothing else is affected.\",\n weight: \"worth doing\",\n },\n {\n ref: \"K7\",\n ask: \"You have two review-request automations both switched on. Which one do you want to keep?\",\n why: \"You have two review-request workflows switched on at once, with near-identical names. We cannot read a workflow's steps through the interface we have, so we cannot promise you both actually fire, but two published copies is the usual shape of a customer being asked twice, and it is worth ten seconds of your time.\",\n evidence: \"Read from all 165 automations on 4 August: \\\"New Review Request WF\\\" and \\\"Update- New Review Request WF\\\" are both published. What we could NOT do is open either one and read its steps, because that call is not available to us. So this is two live copies, not a confirmed double send.\",\n ifNothing: \"Both stay switched on. If they do both fire, the double ask continues; it is not damaging, it just looks careless.\",\n weight: \"worth doing\",\n liveNow: true,\n },\n {\n ref: \"K12\",\n ask: \"The four domain lines: you said yes on Wednesday and asked for instructions. Ready for them on Upwork today?\",\n why: \"This is the real blocker on the email half, and on Wednesday you answered it: happy to add the four lines, just need to know how and where. Checked on 4 August, your domain tells the internet that Google and Wix are allowed to send email in your name, and nobody else. Until the four lines go in, every follow-up email would come from a server your domain does not stand behind, and a lot of them would land in spam. Texting is unaffected: that is verified separately and already works.\",\n evidence: \"Read from your domain's own public records. They list Google and Wix and nothing else. The settings needed are generated by your CRM and are four short lines of text. Your Wednesday yes is the answer of record; the step-by-step instructions for the Wix screen are written and come to you on Upwork.\",\n ifYes: \"You paste the four lines where the instructions show, it takes about ten minutes, and the emails can start going out alongside the texts that are already going out.\",\n // [was: \"Texting can still go live on its own.\" It did, on the evening of 11 August, and it is\n // running. The sentence was written before that and read afterwards as though nothing had\n // been switched on at all. Corrected 14 Aug 2026.]\n ifNothing: \"Texting carries on by itself, exactly as it is doing now. The emails cannot start, and this stays the one thing standing in their way.\",\n weight: \"blocking\",\n },\n {\n ref: \"K10\",\n ask: \"Costs against what it brings in: you said go ahead on Wednesday. The spend half now reads live. Want the walkthrough this week?\",\n why: \"You answered on Wednesday: \\\"I absolutely wanna know what all this costs against what it brings in, go ahead.\\\" Since 9 August the spend half is no longer waiting on anybody: Facebook granted the read permission, so the advertising card on this page now shows real dollars from the ad platform every time it loads. What the page still cannot show is the money coming back, because your CRM does not record a value on a sale. Closing that half is Amir's job and it is on his list, not yours.\",\n evidence: \"The spend connection was watched working on 9 August: the page read $671.72 and 159 started conversations for the last 7 full days straight from Facebook. The earning side is nearly blank in your CRM: 53 of your customer records carry a dollar value, $166,235.00 between them, and every one of those was last touched on 30 June, so nothing in the last six weeks has had a value put on it.\",\n ifYes: \"Half an hour together, real spend against real bookings, and the cost-per-lead for each campaign on paper in front of you.\",\n ifNothing: \"The spend keeps showing on this page either way. The what-it-brings-in half waits until the CRM records a value on a sale.\",\n weight: \"worth doing\",\n surface: true,\n },\n {\n ref: \"K13\",\n ask: \"Can we retire the access key you pasted into the Upwork thread on 31 July?\",\n why: \"It is a working key to your CRM sitting in a chat log. Nothing has gone wrong that we know of, and we have no way to tell whether anybody else has used it, which is exactly why it should not be sitting there. It is simply not where a key should live.\",\n evidence: \"The message was still in the thread on 4 August. On Wednesday evening you went to delete the key yourself and said you were not entirely sure it worked. That attempt is on record; what has not happened yet is anyone confirming the old key is actually dead, and until that check runs the honest state is: probably retired, not yet proven.\",\n ifYes: \"Two minutes, and one loose end closed.\",\n ifNothing: \"A working key to your customer list stays in a chat log that other people can be added to. Nothing has gone wrong so far, and nobody can promise it will not.\",\n weight: \"worth doing\",\n liveNow: true,\n },\n {\n ref: \"K14\",\n ask: \"Can we take the holiday boarding deposit automatically instead of by hand?\",\n why: \"You already have a product in your CRM called \\\"Holiday boarding deposit\\\" set at $50, fully configured, and it does not appear on a single order in the payment history we can see. Your boarding bookings go through the form on your website instead, so the CRM never gets the chance to take the money or record that it arrived. That is why somebody is checking by hand.\",\n evidence: \"Read from your own product list: \\\"Holiday boarding deposit\\\" and \\\"New Client Boarding Deposit\\\" both exist at $50, and not one order in your recent payment history references either.\",\n ifYes: \"Two sizes of job, and Amir will lay out both before anything is built: record the deposit against the customer automatically so you get a list rather than a memory, or take it as part of the booking so nobody can complete one without paying.\",\n ifNothing: \"It stays a manual check every holiday season.\",\n weight: \"worth doing\",\n },\n {\n ref: \"K15\",\n ask: \"You have five no-sale and tips follow-up sequences running, plus two auto-responders. Do you want me to go through them for overlap?\",\n why: \"They are all published and live. The one that looked accidental, \\\"Copy - Tips Ad campaign > Auto Responder\\\", you answered on 5 August: the copy is Milton's on purpose, and it answers on Facebook comments as well as in Messenger, so it stays exactly as it is. What is left of this question is smaller: whether Amir reads the five sequences so nobody can end up getting two sets of messages from you on the same afternoon.\",\n evidence: \"Read from all 165 automations on 4 August: seven published and one draft. Five are follow-up sequences; two are auto-responders and call routing, so the real number to review is nearer five. Your 5 August message is the answer of record on the copy workflow.\",\n ifYes: \"Amir reads all of them and tells you which are earning their place, before anything new is built.\",\n ifNothing: \"They keep running as they are, which is now the known-good state you described.\",\n weight: \"worth doing\",\n },\n {\n ref: \"K9\",\n ask: \"Would you tell us a story or two from the kennel?\",\n why: \"There are eight places in the follow-up messages where a real thing that happened to a real dog would land far better than general advice. They are written to read perfectly well empty, and they are empty today, because made up stories are not something we will put in your name.\",\n evidence: \"The eight places are marked in the sequence you have already read. Each one has a fallback line that reads normally with no story in it, which is what is running now.\",\n ifNothing: \"The messages read exactly as you have already seen them, which costs you nothing.\",\n weight: \"whenever\",\n },\n {\n ref: \"K16\",\n ask: \"Do you want the one untranscribed call from 4 August looked at, or is the answer enough?\",\n why: \"Mostly answered on 6 August. No transcript exists on any call older than about three months, and since then almost every call with speech has one. What is not settled is why the old ones have none: either transcription was switched on around 11 May, or transcripts are deleted once they reach about ninety days. Both look the same from here, and the second one would mean you are quietly losing call history every month. One query a week from now tells us which, and it costs nothing.\",\n // [was, twice over: first \"Every call in your account was checked\" (it was 62 of them), then\n // \"the writing-down step has simply never been switched on\". That second claim was inferred\n // from the API showing no transcript on any of the 62 call records, and the inference was\n // wrong: the API simply does not carry transcripts on those records. On 5 August a call from\n // that same morning was opened in the CRM and its transcript was watched rendering, word by\n // word. Transcription is on. The claim below is what has actually been observed.]\n evidence:\n \"Sixty-two of your calls were checked from your most recently active conversations: 54 carry a full audio recording, about two and a quarter hours of it, and the recordings play. The 8 without one were calls nobody answered. Then a call from the morning of 5 August was opened directly in the CRM and its written transcript was watched rendering, and a second call from 4:54 that same afternoon shows its transcript in the CRM as well, so transcription is on and working at least sometimes. What has not been found yet is a call that is missing its transcript, which is why your report matters: one example from you of a call where the transcript used to be there, or should be, pins down the pattern in minutes.\",\n ifYes:\n \"Point at one call where the transcript is missing, or tell us roughly when they disappeared for you, and the comparison between that call and the transcribed one from that morning does the rest: same number or different, human or Chloe, long or short, before or after a settings change.\",\n ifNothing:\n \"Nothing breaks. Recording keeps working and at least some calls keep getting transcripts, but the ones that are missing stay a puzzle solved by trial and error instead of by one example from you.\",\n weight: \"worth doing\",\n },\n];\n\nexport const WEIGHT_ORDER: Record = { blocking: 0, \"worth doing\": 1, whenever: 2 };\n// [was: blocking: \"Holds up go-live\". Nothing holds up go-live any more, because it happened on\n// the evening of 11 August. What the label now marks is the one half of the system that still\n// cannot start: email. Corrected 14 Aug 2026.]\nexport const WEIGHT_LABEL: Record = {\n blocking: \"Holds up the email half\",\n \"worth doing\": \"Worth doing\",\n whenever: \"Whenever you like\",\n};\nexport function sortedDecisions(ds: Decision[] = DECISIONS): Decision[] {\n return [...ds].sort((a, b) => WEIGHT_ORDER[a.weight] - WEIGHT_ORDER[b.weight]);\n}\nexport const blockingCount = (ds: Decision[] = DECISIONS) => ds.filter((d) => d.weight === \"blocking\").length;\n/** Resolve a `why` that may depend on live figures. */\nexport const whyText = (d: Decision, c: Ctx): string => (typeof d.why === \"function\" ? d.why(c) : d.why);\n/** Same treatment for ifYes: a volume figure must be counted, never typed. */\nexport const ifYesText = (d: Decision, c: Ctx): string | undefined =>\n d.ifYes == null ? undefined : (typeof d.ifYes === \"function\" ? d.ifYes(c) : d.ifYes);\nexport const extraText = (d: Decision, c: Ctx): string => (d.extra ? d.extra(c) : \"\");\n/** Evidence gets the same treatment as why/ifYes: a figure in it is computed, never typed. */\nexport const evidenceText = (d: Decision, c: Ctx): string =>\n typeof d.evidence === \"function\" ? d.evidence(c) : d.evidence;\n\n\n=====FILE engine/deposits-cron.ts =====\n// THE HOLIDAY DEPOSIT REFRESH, ON A SCHEDULE. v1.0, 6 Aug 2026.\n//\n// WHY IT IS ITS OWN FILE AND NOT A LINE IN main.ts. main.ts is hard-capped at 80,000 characters\n// and has 679 left. Squeezing this in would mean deleting something that is already load-bearing\n// to make room for something new, on the entry point that runs Kim's follow-up system. A second\n// scheduled file costs nothing and cannot take the engine down with it.\n//\n// IT ONLY READS. Everything it does is inside runCollection(), which reads two calendars and some\n// contact notes and writes one blob. There is no path from here to a message, a tag or a customer.\n//\n// IT NEVER SHOUTS. If the CRM is unreachable this logs and returns. The dashboard already knows\n// how to say \"last checked N hours ago\", so a missed run degrades into a visibly older timestamp\n// rather than into an alarm or, worse, an empty list presented as fact.\nimport { runCollection, refreshIfDue, ATTEMPT_KEY, BLOB_KEY, type DepositBlob, type DepositRow } from \"./deposits.ts\";\n\nexport default async function (): Promise {\n try {\n // THE SAME GATE main.ts USES, through the same function, so the two cannot drift.\n const blob = (await import(\"https://esm.town/v/std/blob\")).blob;\n const g = await refreshIfDue(() => blob.getJSON(ATTEMPT_KEY) as any, () => runCollection(false, \"deposits-cron\"), Date.now());\n if (!g.ran) { console.log(`[deposits] ${g.why}`); return; }\n const o = (await blob.getJSON(BLOB_KEY)) as DepositBlob | null;\n if (!o) { console.log(`[deposits] ${g.why}, and nothing is stored`); return; }\n const worth = (o.rows ?? []).filter((x: DepositRow) => x.state === \"none_seen\" || x.state === \"partial\").length;\n console.log(`[deposits] ${o.rows.length} stay(s), ${worth} worth checking, ${o.readFailures} unreadable, drop-off calendars ${o.calendarsRead}/${o.calendarsAsked}, pick-up calendars ${o.pickupsRead}/${o.pickupsAsked}`);\n } catch (e) {\n // A scheduled job that throws on val.town shows up as a failed run and pages nobody usefully.\n // The honest outcome of a failed refresh is an older timestamp on the page, which is visible.\n console.log(`[deposits] refresh failed: ${String(e).slice(0, 200)}`);\n }\n}\n\n\n=====FILE engine/deposits.ts =====\n// HOLIDAY DEPOSIT COLLECTOR. The only part of this feature that touches her CRM. v1.0, 6 Aug 2026.\n//\n// WHY IT IS A SEPARATE FILE. holiday-deposits.ts holds all the judgement and a test asserts that\n// it contains no fetch() and no write verb at all. That assertion is only worth something if the\n// network code lives somewhere else, so it lives here. This file fetches and stores; it decides\n// nothing. Every decision is made by a function imported from the module that cannot reach the\n// network.\n//\n// WHAT IT DOES, IN ORDER\n// 1. asks both Boarding Drop Off calendars for the events inside this season's deposit windows\n// 2. groups them into stays (one customer, one day, however many dogs)\n// 3. reads each of those customers' notes, which is where Square money lands\n// 4. writes the answer into the `holiday_deposits` blob\n// The dashboard renders that blob and never repeats any of this, so Kim's page stays fast and\n// cannot be broken by a slow CRM.\n//\n// GET ONLY. Every request in here is a GET. There is no code path that tags, messages, moves or\n// updates anybody, and there is no argument that makes one appear.\n//\n// A FAILED READ IS NOT A ZERO. If a customer's notes cannot be read, that customer is recorded as\n// unknown, with the reason, and stays unknown all the way to Kim's screen. The one thing this\n// feature must never do is turn a network hiccup into \"this person has not paid\".\n//\n// ?k= the stored answer, as JSON\n// ?k=&run=1 re-collect from the live CRM, then store and return it\ndeclare const Deno: { env: { get(k: string): string | undefined } };\nif (typeof (globalThis as any).Deno === \"undefined\") {\n (globalThis as any).Deno = { env: { get: (k: string) => (globalThis as any).process?.env?.[k] } };\n}\nimport {\n holidayWindows, seasonYear, groupIntoStays, parseSquarePayments, statusFor, feedLooksDead,\n depositSentence, paymentsNearStay, statusesForCustomer, shiftDays, businessDay, type CalEvent, type Payment, type StayStatus,\n} from \"./holiday-deposits.ts\";\n\nconst GHL = \"https://services.leadconnectorhq.com\";\nconst LOC = \"BQHJ19uohldYe3eqA0bl\";\n// Both drop-off calendars. One customer appears on BOTH of these in her live data, which is why\n// the union is taken rather than whichever one someone remembers first.\nexport const BOARDING_CALENDARS = [\"wS5N8WN4BbzznaLjEg1N\", \"ZmmjQJszkRMUltfEbumB\"];\n// The matching PICK UP calendars. A drop-off appointment is a ten minute handover slot, so the\n// only place the length of a stay is written down is here. Read on 6 Aug: Ghost and Chewy drop\n// off on 25 Nov and are collected on the 28th, and nothing on the drop-off calendar says that.\nexport const PICKUP_CALENDARS = [\"1FnbK7pQp1ViZWIzX9SR\", \"bN6wWGJa0qKq0QGRg4CC\"];\n// How far past the last window to look for the pick-up that ends a stay running over New Year.\nexport const LOOKAHEAD_DAYS = 30;\nexport const BLOB_KEY = \"holiday_deposits\";\n// How far before the first holiday window to look for bookings. A stay that starts earlier and\n// runs into the window is still a holiday stay; the query filters on drop-off time, so it has to\n// be fetched before it can be judged.\nexport const LOOKBACK_DAYS = 21;\n// The notes endpoint takes NO paging parameters (it 422s on limit and on offset), so the only\n// defence against a silently truncated list is to treat a response at the cap as unreadable.\n// 100 is the usual GHL page size; the largest real list across 60 sampled contacts was 3.\nexport const NOTES_UNPAGEABLE_CAP = 100;\n// How often the list is refreshed off the engine's schedule.\nexport const REFRESH_EVERY_MS = 3_600_000;\n// The ATTEMPT stamp, written on every try. Gating on the stored list instead means a run that\n// legitimately declines to store — no credential, no calendar, everybody unreadable, an empty\n// season held back — leaves the gate open, and the engine then retries every 15 minutes forever\n// against a CRM that is already unwell.\nexport const ATTEMPT_KEY = \"holiday_deposits_attempt\";\n\n/** Is it time to look again? Pure, so the rule can be tested instead of inspected as text.\n * An unreadable or missing stamp opens the gate: never having looked, and not being able to tell\n * when we last looked, both mean look now. A NaN must not close it forever. */\n/** THE WHOLE \"should I collect now\" STEP, in one place, so both schedules run the same code and a\n * test can watch it decide. [was: hand-rolled in main.ts and again in deposits-cron.ts, checked\n * by greps for the word `needsRefresh`. A mutation that called needsRefresh and threw the answer\n * away — collecting from her CRM on every tick — passed all three of those greps.] */\nexport async function refreshIfDue(\n readStamp: () => Promise<{ at?: string } | null>,\n run: () => Promise<{ ok: boolean; error?: string }>,\n nowMs: number,\n): Promise<{ ran: boolean; why: string }> {\n const last = await readStamp().catch(() => null);\n if (!needsRefresh(last?.at, nowMs)) return { ran: false, why: \"not due yet\" };\n const r = await run();\n return { ran: true, why: r.ok ? \"collected\" : `not stored: ${r.error ?? \"unknown\"}` };\n}\n\nexport function needsRefresh(lastAttemptAt: string | null | undefined, nowMs: number, everyMs = REFRESH_EVERY_MS): boolean {\n if (!lastAttemptAt) return true;\n const t = Date.parse(String(lastAttemptAt));\n if (!Number.isFinite(t)) return true;\n return nowMs - t > everyMs;\n}\n\n/** Whether a finished collection may replace what is stored. Pure, so all four refusals are\n * testable; they used to be reachable only through the live blob and were checked as regexes. */\nexport function decideStore(out: DepositBlob, prev: DepositBlob | null, force = false): { store: boolean; error?: string } {\n // A collection that could not read a single calendar is NOT stored: overwriting a good answer\n // with an empty one would show Kim \"no holiday stays booked\" the first time her CRM blinked.\n if (out.calendarsRead === 0) return { store: false, error: \"no calendar answered, so the stored list was left alone\" };\n // NOR a collection in which every single row is unknown. The calendars answered, so the guard\n // above lets it through, and the blob would be replaced with a page of \"could not check\" AND a\n // fresh timestamp — the content gets worse while the page claims to have just been updated.\n if (out.rows.length > 0 && out.rows.every((r) => r.state === \"could_not_check\")) {\n return { store: false, error: \"nobody's payments could be read, so the stored list was left alone\" };\n }\n // NOR a run that has gone from a real list to nothing. A renamed calendar answers 200 with an\n // EMPTY events array, which is well formed and passes both guards above; in December that\n // silently replaces her shortlist with \"nothing to check\". A season really can empty out, so\n // this is not permanent: it holds the old list, says why, and the card starts ageing visibly.\n if (!force && out.rows.length === 0 && (prev?.rows?.length ?? 0) > 0) {\n return { store: false, error: `the boarding calendars answered but returned no holiday bookings at all, where the stored list has ${prev!.rows.length}. That is usually a renamed calendar rather than an empty season, so the stored list was left alone. Re-run with force=1 to accept it.` };\n }\n // NOR A RUN THAT SEES LESS THAN THE STORED ONE DID.\n //\n // This is the hole the three guards above left open, and it is the worst of the four because it\n // is silent. There are two boarding calendars precisely because one customer can appear on\n // either; the row list is their union. If ONE calendar fails — a transient 5xx, a revoked scope,\n // a rename — `calendarsRead` comes back 1 of 2, every guard above passes, and the partial union\n // is written straight over the complete one. The customers who only ever appear on the calendar\n // that failed do not become \"could not check\" rows. Their bookings were never fetched, so they\n // get NO ROW AT ALL: they vanish off Kim's shortlist entirely, under a banner that says one\n // calendar did not answer but cannot say who is missing. There is no retry anywhere in this\n // file, so one blip is enough. Found on 7 August; nothing guarded it.\n //\n // Compared by how many did NOT answer, not by the raw count, so genuinely deleting a calendar\n // (2 asked and read, then 1 asked and read) still stores.\n const missedNow = (out.calendarsAsked - out.calendarsRead) + (out.pickupsAsked - out.pickupsRead);\n const missedBefore = prev ? (prev.calendarsAsked - prev.calendarsRead) + (prev.pickupsAsked - prev.pickupsRead) : 0;\n if (!force && prev && missedNow > missedBefore) {\n return { store: false, error: `this run could not read ${missedNow} calendar(s) where the stored list was missing ${missedBefore}, so it sees fewer bookings than what is already saved. A shorter list with a newer timestamp is worse than the saved one going visibly stale, so the stored list was left alone.` };\n }\n return { store: true };\n}\nconst KEY_SHA256 = \"48cd12465712045f70247da1689eeb198a4ce2d98416d8e52fb844581f044f15\";\n\nasync function sha256Hex(s: string): Promise {\n const b = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(s));\n return [...new Uint8Array(b)].map((x) => x.toString(16).padStart(2, \"0\")).join(\"\");\n}\nasync function authorised(k: string): Promise {\n const expected = Deno.env.get(\"NURTURE_ADMIN_KEY_SHA256\") || KEY_SHA256;\n const got = await sha256Hex(k);\n if (got.length !== expected.length) return false;\n let d = 0;\n for (let i = 0; i < got.length; i++) d |= got.charCodeAt(i) ^ expected.charCodeAt(i);\n return d === 0;\n}\nasync function blobMod() { return (await import(\"https://esm.town/v/std/blob\")).blob; }\nasync function token(): Promise {\n const env = Deno.env.get(\"GHL_TOKEN\");\n if (env) return env;\n const cfg = await (await blobMod()).getJSON(\"puppy_config\").catch(() => null);\n return (cfg as any)?.ghlToken;\n}\n\n// The single door to the network, and it only knows one verb. Named so that a reader checking\n// \"can this thing write to her account\" gets their answer from the signature.\nasync function getJson(path: string, version: string, tok: string): Promise {\n const r = await fetch(`${GHL}${path}`, {\n method: \"GET\",\n // curl's UA is not decoration: her CRM rejects requests without it.\n headers: { Authorization: `Bearer ${tok}`, Version: version, \"User-Agent\": \"curl/8.5.0\" },\n signal: AbortSignal.timeout(20_000),\n });\n if (!r.ok) throw new Error(`HTTP ${r.status}`);\n return r.json();\n}\n\nexport type DepositRow = {\n contactId: string;\n name: string;\n day: string;\n until: string;\n dogs: string[];\n dogCount: number;\n window: string;\n state: StayStatus[\"state\"];\n amountSeen: number;\n note: string;\n};\nexport type DepositBlob = {\n at: string;\n season: number;\n windows: { name: string; from: string; to: string }[];\n rows: DepositRow[];\n sentence: string;\n feedDead: boolean;\n readFailures: number;\n calendarsRead: number;\n calendarsAsked: number;\n pickupsRead: number;\n pickupsAsked: number;\n};\n\nconst dayMs = (d: string) => Date.parse(`${d}T00:00:00Z`);\n\n/** Every page of a contact's notes, or null if we could not be sure we had them all.\n * Returning a SHORT list would be indistinguishable from a customer with no payments, so a read\n * that cannot be completed returns null and the customer is reported as unknown. */\nasync function allNotes(io: { get: (p: string, v: string) => Promise }, contactId: string): Promise {\n // NO QUERY STRING. [was: `?limit=100&offset=N`, written to fix a truncation worry. This endpoint\n // rejects both: it answers 422 \"property limit should not exist\" to any parameter at all, so\n // every customer became a failed read. It shipped, and both live customers came back \"could not\n // check\" ninety seconds later. It was caught by running it against her account, not by the 250\n // assertions that stayed green — the fixtures answered a URL the real CRM refuses.]\n const d = await io.get(`/contacts/${contactId}/notes`, \"2021-07-28\");\n // A 200 with no notes ARRAY is a response we do not understand, not a customer with no notes.\n if (!Array.isArray(d?.notes)) return null;\n // The endpoint takes no paging parameters, so it returns the lot or it does not. If a response\n // ever comes back at exactly the cap, we cannot tell a full list from a truncated one, and an\n // unknown is the only honest answer. Across 60 sampled contacts on 6 Aug the largest was 3.\n if (d.notes.length >= NOTES_UNPAGEABLE_CAP) return null;\n return d.notes;\n}\n\n/** COLLECT. `io` is injected so the whole thing can be run against fixtures in a test without a\n * network, and so there is exactly one place in this file that can talk to her CRM. */\nexport async function collect(\n io: { get: (path: string, version: string) => Promise },\n todayIso: string,\n): Promise {\n const season = seasonYear(businessDay(todayIso));\n const windows = holidayWindows(season);\n const from = windows[0].from, to = windows[windows.length - 1].to;\n\n // ---- the bookings ----\n const events: CalEvent[] = [];\n let calendarsRead = 0;\n for (const cal of BOARDING_CALENDARS) {\n try {\n // LOOK BACK BEFORE THE WINDOW. A dog dropped off on 19 December and collected on the 27th\n // has boarded over Christmas, but the query filters on the drop-off time, so without this\n // reach-back those bookings are never even fetched. windowForRange decides membership.\n // The SAME range as the pick-ups on purpose. [was: drop-offs stopped at the end of the\n // window while pick-ups reached 30 days past it, so for every stay at the tail of the season\n // the customer's own next booking was never fetched. `nextDrop` came back undefined, the\n // \"hard upper bound\" was structurally blind exactly where it mattered, and a 30 Dec stay\n // swallowed the 15 Jan pick-up of a 10 Jan booking — rendering \"Dec 30 to Jan 15\" and\n // letting a January payment settle the holiday deposit. Out-of-window bookings fetched this\n // way are filtered out by the overlap rule; they are here to be next-drop-off markers.]\n const q = `locationId=${LOC}&calendarId=${cal}&startTime=${dayMs(shiftDays(from, -LOOKBACK_DAYS))}&endTime=${dayMs(shiftDays(to, LOOKAHEAD_DAYS))}`;\n const d = await io.get(`/calendars/events?${q}`, \"2021-04-15\");\n // A 200 that does not carry an events ARRAY is not an empty calendar, it is a response we do\n // not understand. [was: `d?.events ?? []`, which counted a renamed key, a partial payload or\n // a stale calendarId as \"read, and she has no bookings\" — and stored that over a good list.]\n if (!Array.isArray(d?.events)) throw new Error(\"no events array in the response\");\n for (const e of d.events) events.push(e as CalEvent);\n calendarsRead++;\n } catch { /* one calendar down is reported below, never silently treated as \"no bookings\" */ }\n }\n // The pick-ups. A calendar that does not answer here is NOT fatal: without it a stay is judged\n // on its drop-off day alone, which is exactly what the module did before, so the list gets\n // smaller rather than wrong. It is reported all the same.\n const pickups: CalEvent[] = [];\n let pickupsRead = 0;\n for (const cal of PICKUP_CALENDARS) {\n try {\n const q = `locationId=${LOC}&calendarId=${cal}&startTime=${dayMs(shiftDays(from, -LOOKBACK_DAYS))}&endTime=${dayMs(shiftDays(to, LOOKAHEAD_DAYS))}`;\n const d = await io.get(`/calendars/events?${q}`, \"2021-04-15\");\n if (!Array.isArray(d?.events)) throw new Error(\"no events array in the response\");\n for (const e of d.events) pickups.push(e as CalEvent);\n pickupsRead++;\n } catch { /* reported on the card: a stay is then judged on its drop-off day alone */ }\n }\n\n const stays = groupIntoStays(events, windows, pickups);\n\n // ---- the money ----\n const rows: DepositRow[] = [];\n // KEYED BY CUSTOMER. The kill switch's floor is written in customers (\"five people with no card\n // payment\"), so a customer with five holiday drop-offs must count once, not five times.\n const perCustomer = new Map();\n let readFailures = 0;\n\n // BY CUSTOMER, not by stay, so one $50 deposit cannot settle two of the same person's bookings.\n const byCustomer = new Map();\n for (const s of stays) {\n const list = byCustomer.get(s.contactId) ?? [];\n list.push(s);\n byCustomer.set(s.contactId, list);\n }\n\n for (const [contactId, own] of byCustomer) {\n let pays: Payment[] | null = null;\n try {\n const notes = await allNotes(io, contactId);\n // A 200 with no notes ARRAY is a response we do not understand, not a customer with no\n // notes. [was: `d?.notes ?? []`, so a rate-limit soft-fail or a changed response shape\n // rendered as \"No Square payment is on file\" — a confident finding built on nothing.]\n pays = notes === null ? null : parseSquarePayments(notes);\n } catch { pays = null; }\n if (pays === null) readFailures++;\n\n let nm = \"\";\n try {\n const c = await io.get(`/contacts/${contactId}`, \"2021-07-28\");\n const ct = c?.contact ?? c;\n nm = [ct?.firstName, ct?.lastName].filter(Boolean).join(\" \").trim() || ct?.contactName || \"\";\n } catch { nm = \"\"; }\n // A name we could not read is shown as that, not as a blank that reads like a bug.\n const name = nm || \"name not readable\";\n\n // WHAT THE KILL SWITCH IS ALLOWED TO SEE: money in the period this run is judging, for\n // customers we actually searched. A stay with no booking date has NO searchable window, so\n // paymentsNearStay returns a structural empty for it; counting that as \"we looked and saw no\n // money\" let one missing field push the sample over the floor and black out the whole card.\n if (pays !== null && own.some((s) => s.bookedAt)) {\n const near = own.filter((s) => s.bookedAt).flatMap((s) => paymentsNearStay(s, pays!));\n perCustomer.set(contactId, near);\n }\n\n for (const st of statusesForCustomer(own, pays)) {\n rows.push({\n contactId, name, day: st.stay.day, until: st.stay.until, dogs: st.stay.dogs,\n dogCount: st.stay.dogCount, window: st.stay.window, state: st.state, amountSeen: st.amountSeen, note: st.note,\n });\n }\n }\n rows.sort((a, b) => a.day.localeCompare(b.day));\n\n const feedDead = feedLooksDead(perCustomer);\n const statuses: StayStatus[] = rows.map((r) => ({\n stay: { contactId: r.contactId, day: r.day, until: r.until, dogs: r.dogs, dogCount: r.dogCount, bookedAt: null, window: r.window },\n state: r.state, amountSeen: r.amountSeen, note: r.note,\n }));\n\n return {\n at: todayIso, season, windows, rows,\n sentence: depositSentence(statuses, feedDead),\n feedDead, readFailures,\n calendarsRead, calendarsAsked: BOARDING_CALENDARS.length,\n pickupsRead, pickupsAsked: PICKUP_CALENDARS.length,\n };\n}\n\n/** ONE PLACE where a collection is run and stored, so the scheduled run and the manual run cannot\n * drift apart. deposits-cron.ts calls this; so does the endpoint below. */\nexport async function runCollection(force = false, source = \"unknown\"): Promise<{ ok: boolean; error?: string; out?: DepositBlob }> {\n const b = await blobMod();\n // Stamped BEFORE the work, so a collection that fails, times out or declines to store still\n // closes the gate for an hour rather than being retried on every tick.\n // WITH WHO STARTED IT. Two schedules can reach this — the engine's interval and deposits-cron.ts\n // — plus a person hitting the endpoint. On 6 Aug the list refreshed at 20:49 with nobody\n // triggering it, which was the first autonomous refresh ever observed, and there was no way to\n // tell WHICH schedule did it. \"It works\" and \"which one works\" are different facts.\n await b.setJSON(ATTEMPT_KEY, { at: new Date().toISOString(), source }).catch(() => {});\n const tok = await token();\n if (!tok) return { ok: false, error: \"no CRM credential resolved, so nothing was collected\" };\n const out = await collect({ get: (p, v) => getJson(p, v, tok) }, new Date().toISOString());\n const prev = (await b.getJSON(BLOB_KEY).catch(() => null)) as DepositBlob | null;\n const d = decideStore(out, prev, force);\n if (!d.store) return { ok: false, error: d.error, out };\n await b.setJSON(BLOB_KEY, out);\n return { ok: true, out };\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n if (!(await authorised(url.searchParams.get(\"k\") || \"\"))) {\n return new Response(\"Not found\", { status: 401, headers: { \"content-type\": \"text/plain\" } });\n }\n const json = (o: unknown, status = 200) =>\n new Response(JSON.stringify(o, null, 2), { status, headers: { \"content-type\": \"application/json\", \"cache-control\": \"no-store\" } });\n\n try {\n if (url.searchParams.get(\"run\") !== \"1\") {\n const b = await blobMod();\n const stored = await b.getJSON(BLOB_KEY).catch(() => null);\n // THE ATTEMPT STAMP COMES BACK TOO, and reading it does not write it. Without this, \"the\n // list has not moved\" is ambiguous between \"the schedule never tried\" and \"it tried and\n // declined to store\" — and those need completely different fixes. Every observation of the\n // refresh so far has been unable to tell them apart.\n const attempt: any = await b.getJSON(ATTEMPT_KEY).catch(() => null);\n return json({ ...(stored ?? { at: null, rows: [], sentence: \"This has not been collected yet.\" }),\n lastAttemptAt: attempt?.at ?? null,\n lastAttemptBy: attempt?.source ?? null,\n refreshDueAt: attempt?.at && Number.isFinite(Date.parse(attempt.at))\n ? new Date(Date.parse(attempt.at) + REFRESH_EVERY_MS).toISOString() : null });\n }\n const r = await runCollection(url.searchParams.get(\"force\") === \"1\", \"endpoint\");\n return r.ok ? json(r.out) : json({ error: r.error, ...(r.out ?? {}) }, 503);\n } catch (e) {\n return json({ error: String(e).slice(0, 500) }, 500);\n }\n}\n\n",[561],"a3ae812e-acf1-4f2d-bd12-8ef6a9afba00",["D",1786982941194],[28],"58a91ebc-56e2-4e15-89ed-707a84d27248","SOURCE-BUNDLE.part38.txt","272a8e58-9832-11f1-a957-1607ee4eb77e",1208,["D",1786982940180],"THE DOGS SPOT — SOURCE BUNDLE (part 38 of 47)\n\nEVERY source file in this project, engine/ included. Restoring these parts and nothing else gives\nyou a tree that builds, typechecks and runs its own test suite with no network and no val.\n\nengine/ is here as of 14 Aug 2026. It used to be left out because val 1bfa6e81-74e1-4c6c-ab32-118304a4ffff\nholds it, which was true of every engine file except engine/watch.ts: a module the val does not run,\nso it was never deployed, so it lived in one container and nothing else. A reclaim destroyed it.\nscripts/deploy.mjs --check still compares engine/ against the val file by file; that is a second\ncheck on the same files now, not the only copy of them.\n\nRESTORE (needs only node, from an empty folder). Save each part, then run this ON EACH ONE:\n\n node -e 'const fs=require(\"fs\"),p=require(\"path\");const b=fs.readFileSync(process.argv[1],\"utf8\");\n for(const s of b.split(\"\\n=====FILE \").slice(1)){const i=s.indexOf(\" =====\\n\");\n const f=s.slice(0,i),c=s.slice(i+7);fs.mkdirSync(p.dirname(f),{recursive:true});\n fs.writeFileSync(f,c.replace(/\\n$/,\"\"))}' PART.txt\n\nA record named #1, #2, ... is one FILE cut into pieces: concatenate them in order, then\nstrip one trailing newline from the last. scripts/restore.mjs does this for you.\n\nEach part is complete in itself: whole files only, no reassembly, any order.\n\nThen: node scripts/build.mjs (engine/ came out of these parts; nothing to fetch first)\n node scripts/typecheck.mjs\n node tests/run-all.mjs\n node scripts/deploy.mjs --check (pulls nothing, proves the val matches what you restored)\n node tests/negative-controls.mjs (proves the suite above can actually fail)\n\nIN THIS PART (3 of 129 files)\n scripts/watch-run.mjs 27955 bytes 5804e851e1ac\n watchdog/main.ts 44124 bytes ddcb8d47f63b\n watchdog/run.ts 1286 bytes 6d26da771392\n\n================================================================================================\n=====FILE scripts/watch-run.mjs =====\n#!/usr/bin/env node\n// THE EARLY WARNING RUN. Generator, 12 Aug 2026.\n//\n// WHAT THIS IS. Kim asked for \"some kind of early warning system so a five month gap like this\n// can't quietly happen again\". The gap she means: her CRM recorded no payment amounts after\n// 19 February 2026 and nobody noticed until August, because staff had started ringing sales\n// straight into the Square app and the CRM was simply cut out. Nothing errored, so nothing\n// alerted. This script pulls the live data, runs engine/watch.ts over it, and writes a short\n// report.\n//\n// READ ONLY, DEPLOYS NOTHING, SCHEDULES NOTHING. Three GETs (the CRM's payment transactions, the\n// CRM's most recent contacts, and the Square bridge's own journal) and two local files out, plus a\n// small local notes file so it can tell whether a running total ever goes backwards.\n//\n// WHY IT DOES NOT RE-DERIVE WHICH PAYMENTS ARE UNMATCHED. That rule already exists twice, in\n// engine/facts.ts squareBacklog() and in scripts/exception-report-lib.mjs, cross checked against\n// each other on every exception report run. A third hand-copy is how Kim ended up quoted a wrong\n// backlog figure in writing once already ($10,884.00 across 9 payments, engine/facts.ts:64-69).\n// So this imports unmatchedPaymentRows() from the existing library and reconciles what it derives\n// against it before anything is written (see reconcileOrDie below). This report EXTENDS the weekly\n// exception report; it does not repeat it. That one answers \"which payments did not match\". This\n// one answers \"has something stopped happening at all\".\n//\n// USAGE\n// node scripts/watch-run.mjs\n// ENV OVERRIDES (all optional)\n// WATCH_OUT_DIR default: /mnt/user-data/outputs\n// WATCH_STATE_FILE default: /reports/watch-state.json (the running totals it remembers)\n// WATCH_DATE default: today, formatted D-Mon\n// GHL_TOKEN default: read from the same place the other read only scripts read it\n// BRIDGE_URL default: read from engine/dashboard.ts\n// BRIDGE_ADMIN required for the live bridge journal; never stored in source\n// WATCH_OFFLINE_DIR offline mode: read payments.json / contacts.json / journal.json from here\n// instead of the network. Used for debugging only, never for a real report.\n// WATCH_NOW judge everything as if it were this moment, ignoring anything dated later.\n// This is how the claim \"it would have caught 19 February\" is replayed\n// against the real payment history rather than asserted.\n\nimport { spawnSync } from \"node:child_process\";\nimport { readFileSync, writeFileSync, mkdirSync, existsSync } from \"node:fs\";\nimport { join, dirname, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\n\nconst HERE = dirname(fileURLToPath(import.meta.url));\nconst ROOT = resolve(HERE, \"..\");\n\nfunction shout(msg) { console.error(`\\n!!!! ${msg} !!!!\\n`); }\nfunction die(msg) { shout(msg); process.exit(1); }\n\n// -------------------------------------------------------------------------------------------\n// STEP 0. Rebuild engine/ -> build/ before importing anything from it. Same rule and the same\n// reason as tests/run-all.mjs and scripts/exception-report.mjs: on 6 August a suite reported 270\n// assertions passing against code that had been deleted, because nobody rebuilt first. A monitor\n// running against stale logic is worse than no monitor, since its whole job is to be believed.\n// -------------------------------------------------------------------------------------------\n{\n const b = spawnSync(\"node\", [join(ROOT, \"scripts\", \"build.mjs\")], { encoding: \"utf8\", timeout: 300_000 });\n if (b.status !== 0) die(`BUILD FAILED. Refusing to run a monitor built from logic that will not compile.\\n${(b.stdout ?? \"\") + (b.stderr ?? \"\")}`.trim());\n}\n\nconst W = await import(join(ROOT, \"build\", \"watch.js\"));\nconst { unmatchedPaymentRows } = await import(join(ROOT, \"scripts\", \"exception-report-lib.mjs\"));\n\n// -------------------------------------------------------------------------------------------\n// STEP 1. Credentials. Secrets are environment-only because the deployed source is public.\n// -------------------------------------------------------------------------------------------\nconst DASHBOARD_TS = process.env.DASHBOARD_TS_PATH || join(ROOT, \"engine\", \"dashboard.ts\");\nif (!existsSync(DASHBOARD_TS)) die(`cannot find ${DASHBOARD_TS}. Restore it before running this.`);\nconst dashboardSrc = readFileSync(DASHBOARD_TS, \"utf8\");\nconst readConstFrom = (text, name) => (new RegExp(`const\\\\s+${name}\\\\s*=\\\\s*\"([^\"]+)\"`).exec(text) ?? [])[1] ?? null;\n\nconst admin = process.env.BRIDGE_ADMIN || \"\";\nif (admin.length < 24) die(\"BRIDGE_ADMIN is missing or too short. Set the rotated credential in the environment; source fallbacks are forbidden.\");\n\nconst BRIDGE = process.env.BRIDGE_URL || readConstFrom(dashboardSrc, \"BRIDGE\");\nif (!BRIDGE) die(`could not find a BRIDGE literal in ${DASHBOARD_TS}`);\nconst LOC = readConstFrom(dashboardSrc, \"LOC\");\nif (!LOC) die(`could not find the location id (LOC) in ${DASHBOARD_TS}`);\nconst GHL = readConstFrom(dashboardSrc, \"GHL\") || \"https://services.leadconnectorhq.com\";\n\n// The CRM token. Same source the other read only scripts in this tree use rather than a fresh copy.\nfunction ghlToken() {\n if (process.env.GHL_TOKEN) return process.env.GHL_TOKEN;\n for (const p of [\n \"/home/claude/dogsspot/tests/aged_audit.py\",\n \"/home/claude/dogsspot/handover/honour-optouts.py\",\n ]) {\n if (!existsSync(p)) continue;\n const m = /pit-[a-f0-9]{8}-[a-f0-9-]+/.exec(readFileSync(p, \"utf8\"));\n if (m) { console.log(`CRM token: read from ${p}`); return m[0]; }\n }\n return null;\n}\nconst TOKEN = ghlToken();\nif (!TOKEN) die(\"no CRM token found. Set GHL_TOKEN or restore the file it is normally read from.\");\n\n// The User-Agent is not decoration: this API rejects the default node fetch agent.\nconst HEADERS = { Authorization: `Bearer ${TOKEN}`, Version: \"2021-07-28\", \"User-Agent\": \"curl/8.5.0\" };\nconst OFFLINE = process.env.WATCH_OFFLINE_DIR || null;\nif (OFFLINE) console.log(`offline mode: reading fixtures from ${OFFLINE} instead of the network`);\n\nasync function getJson(url, what, headers) {\n let res;\n try { res = await fetch(url, { headers, signal: AbortSignal.timeout(45_000) }); }\n catch (e) { die(`${what} fetch threw: ${e.message}`); }\n if (!res.ok) die(`${what} fetch failed: HTTP ${res.status}`);\n return res.json();\n}\nconst offlineJson = (name) => JSON.parse(readFileSync(join(OFFLINE, name), \"utf8\"));\n\n// -------------------------------------------------------------------------------------------\n// STEP 2. THE CRM's PAYMENT TRANSACTIONS, every page. Walking every page matters: a reader that\n// stops at page one is exactly the shape of fault check 5 exists to catch, and it would be quietly\n// producing a monitor that under-reports rather than an error anybody sees.\n// -------------------------------------------------------------------------------------------\nlet payments = [];\nlet paymentsTotalCount = null;\nif (OFFLINE) {\n const p = offlineJson(\"payments.json\");\n payments = p.data ?? p;\n paymentsTotalCount = p.totalCount ?? payments.length;\n} else {\n for (let offset = 0, guard = 0; guard < 60; guard++, offset += 100) {\n const body = await getJson(\n `${GHL}/payments/transactions?altId=${encodeURIComponent(LOC)}&altType=location&limit=100&offset=${offset}`,\n `payment transactions at offset ${offset}`, HEADERS);\n const page = Array.isArray(body?.data) ? body.data : [];\n if (paymentsTotalCount === null) paymentsTotalCount = Number(body?.totalCount ?? 0) || null;\n payments.push(...page);\n if (page.length < 100) break;\n }\n}\nif (!payments.length) die(\"the CRM returned ZERO payment transactions. A monitor that inspects nothing is a blind spot, not an all clear. Nothing written.\");\n{\n const ids = new Set(payments.map((p) => p?._id));\n if (ids.size !== payments.length) shout(`paging returned ${payments.length} rows but only ${ids.size} distinct ids. Duplicates across pages would inflate every count below.`);\n if (paymentsTotalCount && payments.length !== paymentsTotalCount) {\n shout(`read ${payments.length} payment rows but the CRM says it holds ${paymentsTotalCount}. Paging stopped early or the total moved while reading.`);\n }\n}\nconsole.log(`Read ${payments.length} payment transactions from the CRM (it reports ${paymentsTotalCount ?? \"an unknown\"} in total).`);\n\n// -------------------------------------------------------------------------------------------\n// STEP 3. THE CRM's MOST RECENT CONTACTS. One page, newest first: enough to measure how often new\n// people arrive, which is what makes \"the leads stopped\" visible without walking 5,700 records.\n// -------------------------------------------------------------------------------------------\nlet contacts = [], contactsTotal = null;\nif (OFFLINE) {\n const c = offlineJson(\"contacts.json\");\n contacts = c.contacts ?? c;\n contactsTotal = c.meta?.total ?? contacts.length;\n} else {\n const body = await getJson(`${GHL}/contacts/?locationId=${encodeURIComponent(LOC)}&limit=100`, \"contacts\", HEADERS);\n contacts = Array.isArray(body?.contacts) ? body.contacts : [];\n contactsTotal = Number(body?.meta?.total ?? 0) || null;\n}\nconsole.log(`Read ${contacts.length} of the most recent contact records (the CRM reports ${contactsTotal ?? \"an unknown number\"} in total).`);\n\n// -------------------------------------------------------------------------------------------\n// STEP 4. THE SQUARE BRIDGE's OWN JOURNAL. Read only, ?dump=1.\n// -------------------------------------------------------------------------------------------\nlet journal = OFFLINE\n ? offlineJson(\"journal.json\")\n : await getJson(`${BRIDGE}?dump=1&admin=${encodeURIComponent(admin)}`, \"bridge journal\", undefined);\nif (!Array.isArray(journal)) die(`the bridge journal did not come back as a list (got ${typeof journal}).`);\nif (!journal.length) shout(\"the bridge journal came back EMPTY. That is itself a finding and the bridge check below will say so, but it is worth a human's eyes now.\");\nconsole.log(`Read ${journal.length} rows from the Square bridge journal.`);\n\n// -------------------------------------------------------------------------------------------\n// STEP 5. SHAPE THE LIVE DATA INTO WHAT THE CHECKS TAKE. Every judgement lives in\n// engine/watch.ts; everything here is selection, so that nothing decides anything untested.\n// -------------------------------------------------------------------------------------------\n// WATCH_NOW EXISTS SO THE CENTRAL CLAIM CAN BE REPLAYED RATHER THAN ASSERTED. Every judgement\n// below is made against a clock this file is handed, so the same code can be pointed at the real\n// payment history as it stood on any past date and asked what it would have said that morning.\n// \"This would have caught 19 February\" is otherwise a sentence with nothing underneath it.\nconst NOW = process.env.WATCH_NOW ? Date.parse(process.env.WATCH_NOW) : Date.now();\nif (!Number.isFinite(NOW)) die(`WATCH_NOW is not a date I can read: ${process.env.WATCH_NOW}`);\nif (process.env.WATCH_NOW) console.log(`REPLAY: judging everything as if it were ${new Date(NOW).toISOString()}. Records after that moment are ignored.`);\n// A RECORD DATED AFTER THE MOMENT WE ARE JUDGING IS NOT EVIDENCE. On a live run this drops\n// nothing. On a replay it is what makes the replay honest: without it the silence check would see\n// a payment from three months after the date it is pretending to be, and report that everything\n// was fine on a morning when it was not.\nconst notAfterNow = (rows, at) => {\n const kept = rows.filter((r) => {\n const t = Date.parse(String(at(r) ?? \"\"));\n return !Number.isFinite(t) || t <= NOW;\n });\n return { kept, dropped: rows.length - kept.length };\n};\n{\n const p = notAfterNow(payments, (r) => r?.createdAt);\n const c = notAfterNow(contacts, (r) => r?.dateAdded);\n const j = notAfterNow(journal, (r) => r?.ts);\n if (p.dropped || c.dropped || j.dropped) {\n console.log(`Ignoring records dated after the moment being judged: ${p.dropped} payments, ${c.dropped} contacts, ${j.dropped} journal rows.`);\n }\n payments = p.kept; contacts = c.kept; journal = j.kept;\n if (!payments.length) die(\"after ignoring records dated later than the moment being judged, there are ZERO payment records left. Nothing to inspect is a blind spot, not an all clear.\");\n}\n\nconst REAL_MONEY = 1; // engine/payments-source.ts MIN_REAL_PAYMENT: below a dollar is a card test,\n // and a $0 row is a calendar booking artifact rather than money.\nconst amountOf = (p) => Number(p?.amount) || 0;\nconst atOf = (p) => p?.createdAt ?? null;\n\n// 5a. STREAMS FOR THE SILENCE CHECK. Each is a thing that normally produces records. The first is\n// the one that went quiet on 19 February.\nconst bySourceType = new Map();\nfor (const p of payments) {\n const st = String(p?.entitySourceType ?? \"unknown\");\n if (!bySourceType.has(st)) bySourceType.set(st, []);\n bySourceType.get(st).push(p);\n}\nconst SOURCE_NAMES = {\n invoice: \"invoices paid in your CRM\",\n calendar: \"bookings taken in your CRM\",\n funnel: \"online form payments\",\n payment_link: \"payment links\",\n manual: \"payments entered by hand\",\n};\nconst streams = [\n {\n name: \"payments with money on them in your CRM\",\n timestamps: payments.filter((p) => amountOf(p) >= REAL_MONEY).map(atOf),\n whereToLook: \"Open the Square app and check what has been taken there over the same period. If Square shows sales your CRM does not, sales are being rung up in a way that never reaches a customer record, which is exactly what happened after 19 February 2026.\",\n },\n {\n name: \"new people arriving in your CRM\",\n timestamps: contacts.map((c) => c?.dateAdded ?? null),\n whereToLook: \"Check that your website forms and ad campaigns are still switched on and still pointing at your CRM.\",\n },\n ...[...bySourceType.entries()].sort().map(([st, rows]) => ({\n name: SOURCE_NAMES[st] || `payments of type ${st}`,\n timestamps: rows.map(atOf),\n })),\n];\n\n// 5b. THE MATCH RATIO. Which payments the Square bridge saw, and which of them ever reached a\n// customer record. The unmatched set comes from the existing, tested library; this only groups.\nconst paymentIdsInJournal = new Map();\nfor (const r of journal) {\n const m = /payment\\s+(\\S+)/.exec(String(r?.note ?? \"\"));\n if (!m) continue;\n const ts = Date.parse(String(r?.ts ?? \"\"));\n const at = Number.isFinite(ts) ? ts : null;\n const prev = paymentIdsInJournal.get(m[1]);\n if (prev === undefined || (at !== null && (prev === null || at < prev))) paymentIdsInJournal.set(m[1], at);\n}\nconst unmatchedRows = unmatchedPaymentRows(journal);\nconst unmatchedIds = new Set(unmatchedRows.map((r) => r.paymentId));\n\n// RECONCILE OR DIE (LESSONS #8: reconcile any subset against its parent before it leaves the\n// building). Every payment the exception report calls unmatched must be one this run has seen. If\n// it is not, this file's grouping and the library's grouping have drifted apart and neither number\n// can be trusted.\nfunction reconcileOrDie() {\n const missing = [...unmatchedIds].filter((id) => !paymentIdsInJournal.has(id));\n if (missing.length) {\n shout(\"RECONCILIATION FAILED. The exception report's list of unmatched payments contains ids this run never saw in the journal. Nothing written.\");\n for (const id of missing.slice(0, 10)) console.error(` - ${id}`);\n process.exit(1);\n }\n console.log(`Reconciled: all ${unmatchedIds.size} payments the exception report calls unmatched are among the ${paymentIdsInJournal.size} the journal mentions.`);\n}\nreconcileOrDie();\n\nconst seen = [...paymentIdsInJournal.entries()].map(([id, atMs]) => ({ id, atMs, matched: !unmatchedIds.has(id) }));\nconst RATIO_WINDOW_DAYS = Number(process.env.WATCH_RATIO_WINDOW_DAYS || 7);\nconst RATIO_WINDOWS = Number(process.env.WATCH_RATIO_WINDOWS || 6);\nconst ratioPoints = W.ratioBuckets(seen, NOW, RATIO_WINDOW_DAYS, RATIO_WINDOWS);\n\n// 5c. THE FEBRUARY SHAPE. Activity is every payment record the CRM holds, whatever its value,\n// because a booking with $0 against it is still a dog in the building. Dollars are the real money\n// recorded against them. Read together, these two say whether the work is happening while the\n// takings are not being written down.\nconst REVENUE_WINDOW_DAYS = Number(process.env.WATCH_REVENUE_WINDOW_DAYS || 28);\nconst REVENUE_WINDOWS = Number(process.env.WATCH_REVENUE_WINDOWS || 7);\nconst activity = payments.map((p) => ({\n atMs: Date.parse(String(atOf(p) ?? \"\")) || null,\n dollars: amountOf(p) >= REAL_MONEY ? amountOf(p) : 0,\n}));\nconst revenuePeriods = W.revenuePeriods(activity, NOW, REVENUE_WINDOW_DAYS, REVENUE_WINDOWS);\n\n// 5d. THE RUNNING TOTALS, and the notes file that remembers them between runs. A local file, not\n// a live system: nothing here writes to the CRM, to Square or to the bridge.\nconst STATE_FILE = process.env.WATCH_STATE_FILE || join(ROOT, \"reports\", \"watch-state.json\");\nconst MAX_SNAPSHOTS = 60;\nlet priorSnapshots = [];\nif (existsSync(STATE_FILE)) {\n try {\n const parsed = JSON.parse(readFileSync(STATE_FILE, \"utf8\"));\n priorSnapshots = Array.isArray(parsed?.snapshots) ? parsed.snapshots : [];\n console.log(`Read ${priorSnapshots.length} earlier readings of the running totals from ${STATE_FILE}.`);\n } catch (e) {\n shout(`could not read ${STATE_FILE} (${e.message}). Treating this as a first run, so nothing can be compared this time.`);\n }\n} else {\n console.log(`No earlier readings at ${STATE_FILE}: this is a first run, so the running totals have nothing to be compared against yet.`);\n}\n\nconst counters = {\n crmPaymentRecords: paymentsTotalCount ?? payments.length,\n crmPaymentDollarsLifetime: Math.round(payments.reduce((a, p) => a + (amountOf(p) >= REAL_MONEY ? amountOf(p) : 0), 0) * 100) / 100,\n crmContactRecords: contactsTotal ?? contacts.length,\n bridgeJournalRows: journal.length,\n bridgePaymentsSeen: paymentIdsInJournal.size,\n};\nconst counterLabels = {\n crmPaymentRecords: \"The number of payment records in your CRM\",\n crmPaymentDollarsLifetime: \"The total value of every payment your CRM has ever recorded\",\n crmContactRecords: \"The number of people in your CRM\",\n bridgeJournalRows: \"The number of things the Square link has written down\",\n bridgePaymentsSeen: \"The number of Square sales the link has seen\",\n};\nconst snapshots = [...priorSnapshots, { at: new Date(NOW).toISOString(), counters }].slice(-MAX_SNAPSHOTS);\n\n// -------------------------------------------------------------------------------------------\n// STEP 6. RUN THE CHECKS. Every judgement in the report below is made here and nowhere else.\n// -------------------------------------------------------------------------------------------\nconst report = W.runWatch({\n nowMs: NOW,\n streams,\n ratio: { subject: \"Square payments\", points: ratioPoints },\n revenue: { subject: \"your bookings\", periods: revenuePeriods },\n journal,\n snapshots,\n counterLabels,\n});\n\n// A CHECK THAT INSPECTED NOTHING MUST HAVE SAID SO. runWatch enforces this itself; this is the\n// second pair of eyes, because the whole report rests on it (LESSONS #2).\n{\n const blind = W.blindSpots(report.checks);\n if (blind.length) die(`${blind.length} check(s) inspected zero items and raised nothing: ${blind.map((c) => c.check).join(\", \")}. The monitor is not watching what it claims to.`);\n const quiet = report.checks.filter((c) => c.inspected === 0);\n if (quiet.length) shout(`${quiet.length} check(s) inspected zero items: ${quiet.map((c) => c.check).join(\", \")}. Each has raised a finding about itself, which is in the report.`);\n}\n\n// -------------------------------------------------------------------------------------------\n// STEP 7. WRITE IT. Client safe copy rules enforced mechanically, same two rules the weekly\n// exception report enforces, from the one shared implementation in engine/watch.ts.\n// -------------------------------------------------------------------------------------------\nconst now = new Date(NOW);\nconst MONTHS = [\"Jan\", \"Feb\", \"Mar\", \"Apr\", \"May\", \"Jun\", \"Jul\", \"Aug\", \"Sep\", \"Oct\", \"Nov\", \"Dec\"];\nconst dateSuffix = process.env.WATCH_DATE || `${now.getUTCDate()}-${MONTHS[now.getUTCMonth()]}`;\nconst md = W.watchReportMarkdown(report, `Early warning check, ${dateSuffix}`);\n{\n const problems = W.copyProblems(md);\n if (problems.length) {\n shout(\"CLIENT SAFE COPY CHECK FAILED. Nothing written.\");\n for (const p of problems) console.error(` - ${p}`);\n process.exit(1);\n }\n console.log('Client safe copy check passed: no dashes as punctuation, no \"daycare\".');\n}\n\n// -------------------------------------------------------------------------------------------\n// STEP 7b. THE PAGE THE OWNER ACTUALLY READS.\n//\n// The markdown above is the engine's own rendering and it prints its workings: \"The figures behind\n// that: records: 1, needed: 5\", \"read 790 journal rows\", and a timestamp in GMT for a business in\n// Georgia. That is a debugging view, and it went out to a client. This renders the same report as\n// something a person can read on a laptop: her own clock, no key and value pairs, no counts of\n// rows in a log she has never heard of, and every blind spot followed by the thing to do about it.\n// The engine's own view is kept and written to the repo, because when a figure is queried the\n// workings have to still exist somewhere.\n// -------------------------------------------------------------------------------------------\nconst HER_TIMEZONE = process.env.WATCH_TIMEZONE || \"America/New_York\"; // Ellabell, Georgia\nconst inHerTime = (d, opts) => new Intl.DateTimeFormat(\"en-US\", { timeZone: HER_TIMEZONE, ...opts }).format(d);\n// Day, month, year, spelled out. \"12-Aug\" is ambiguous about the year and \"08/12\" is ambiguous\n// about the month, and this file is meant to still make sense when it is opened next spring.\nconst herDate = (d) => new Intl.DateTimeFormat(\"en-GB\", { timeZone: HER_TIMEZONE, day: \"numeric\", month: \"long\", year: \"numeric\" }).format(d);\nconst herClock = (d) => inHerTime(d, { hour: \"numeric\", minute: \"2-digit\", hour12: true }).replace(/ /g, \" \").toLowerCase();\nconst countWord = (n) => ([\"no\", \"one\", \"two\", \"three\", \"four\", \"five\", \"six\", \"seven\", \"eight\", \"nine\", \"ten\"][n] ?? String(n));\n\nconst ordered = [...report.findings].sort((a, b) => {\n const rank = { urgent: 0, attention: 1, note: 2 };\n return (rank[a.severity] ?? 3) - (rank[b.severity] ?? 3);\n});\nconst loud = ordered.filter((f) => f.severity !== \"note\");\nconst notes = ordered.filter((f) => f.severity === \"note\");\nconst inspectedTotal = report.checks.reduce((a, c) => a + (c.inspected ?? 0), 0);\n\nconst clientPage = [\n `# Early warning check, ${herDate(now)}`,\n ``,\n loud.length\n ? `**${countWord(loud.length).replace(/^./, (c) => c.toUpperCase())} ${loud.length === 1 ? \"thing needs\" : \"things need\"} your attention.** They are first, below.`\n : `**Nothing in your records looks wrong.** ${countWord(report.checks.length).replace(/^./, (c) => c.toUpperCase())} checks ran and read ${inspectedTotal.toLocaleString(\"en-US\")} records between them.`,\n ``,\n `Everything below was read at ${herClock(now)} on ${herDate(now)}, your time.`,\n ``,\n ...(loud.length ? [\n `## What needs your attention`,\n ``,\n ...loud.flatMap((f) => [f.sentence, ``, f.checkFirst ? `**Start here:** ${f.checkFirst}` : ``, ``]),\n ] : []),\n ...(notes.length ? [\n `## ${countWord(notes.length).replace(/^./, (c) => c.toUpperCase())} ${notes.length === 1 ? \"thing this cannot see yet\" : \"things this cannot see yet\"}`,\n ``,\n `${notes.length === 1 ? \"This is\" : \"These are\"} not ${notes.length === 1 ? \"a problem\" : \"problems\"} with your business. ${notes.length === 1 ? \"It is\" : \"They are\"} the monitor telling you where it is not able to judge anything yet, which is worth knowing rather than reading as a clean result.`,\n ``,\n ...notes.flatMap((f) => [f.sentence, ``, f.checkFirst ? `**Start here:** ${f.checkFirst}` : ``, ``]),\n ] : []),\n `## What it looked at`,\n ``,\n `| What it watches | What it found |`,\n `|---|---|`,\n ...report.checks.map((c) => `| ${c.title} | ${c.findings.length === 0 ? \"Nothing out of the ordinary\" : `${countWord(c.findings.length)} ${c.findings.length === 1 ? \"thing\" : \"things\"} to tell you, above`} |`),\n ``,\n `## What it is still not good at`,\n ``,\n `Replayed over your own records it would have raised this in the days after 19 February 2026 rather than in August. It is also noisy: the same replay sounds an alarm in weeks when nothing was wrong, and an alarm that cries wolf trains everybody to ignore it. Quietening it down is the next job on it, and I would rather say so than have you find out.`,\n ``,\n `Amir`,\n ``,\n].filter((l) => l !== null).join(\"\\n\").replace(/\\n{3,}/g, \"\\n\\n\");\n{\n const problems = W.copyProblems(clientPage);\n if (/\\b(records|needed|rows|journal|GMT|UTC)\\s*:/i.test(clientPage)) problems.push(\"a key and value debug pair is still in the page\");\n if (/\\bGMT\\b|\\bUTC\\b/.test(clientPage)) problems.push(\"a time is stamped in GMT for a business in Georgia\");\n if (problems.length) {\n shout(\"CLIENT SAFE COPY CHECK FAILED ON THE PAGE FOR THE OWNER. Nothing written.\");\n for (const p of problems) console.error(` - ${p}`);\n process.exit(1);\n }\n console.log(`The owner's page passed: her own clock (${HER_TIMEZONE}), no key and value pairs, no dashes as punctuation.`);\n}\n\nconst OUT_DIR = process.env.WATCH_OUT_DIR || \"/mnt/user-data/outputs\";\nmkdirSync(OUT_DIR, { recursive: true });\n// The client file is named for what it is and dated in full. \"12-Aug\" is ambiguous about the year\n// on a file somebody opens next spring.\nconst clientName = process.env.WATCH_CLIENT_FILENAME || `Early-warning-check-${herDate(now).replace(/ /g, \"-\")}.md`;\nconst mdPath = join(OUT_DIR, clientName);\nwriteFileSync(mdPath, clientPage);\n// The engine's own view and the full workings stay in the repo, not in the client's folder. A\n// page of key and value pairs and a JSON file are the wrong shape for the person this is for.\nconst WORKINGS_DIR = process.env.WATCH_WORKINGS_DIR || join(ROOT, \"reports\");\nmkdirSync(WORKINGS_DIR, { recursive: true });\nconst enginePath = join(WORKINGS_DIR, `early-warning-${dateSuffix}-workings.md`);\nconst jsonPath = join(WORKINGS_DIR, `early-warning-${dateSuffix}.json`);\nwriteFileSync(enginePath, md);\nwriteFileSync(jsonPath, JSON.stringify(report, null, 2) + \"\\n\");\n\n// The notes file is written LAST and only once everything else succeeded. If the run dies halfway\n// this reading is not recorded, so the next run still compares against the last complete one\n// rather than against a half filled snapshot.\nmkdirSync(dirname(STATE_FILE), { recursive: true });\nwriteFileSync(STATE_FILE, JSON.stringify({ snapshots }, null, 2) + \"\\n\");\n\nconsole.log(\"\");\nconsole.log(`Wrote ${mdPath} (the page for the owner)`);\nconsole.log(`Wrote ${enginePath} (the engine's own view, kept out of her folder)`);\nconsole.log(`Wrote ${jsonPath} (the full workings, kept out of her folder)`);\nconsole.log(`Wrote ${STATE_FILE} (${snapshots.length} readings kept)`);\nconsole.log(\"\");\nconsole.log(\"=========================== THE REPORT ===========================\");\nconsole.log(md);\nconsole.log(\"========================= WHAT EACH CHECK READ =========================\");\nfor (const c of report.checks) {\n console.log(`${c.check.padEnd(14)} inspected ${String(c.inspected).padStart(6)} ${c.inspectedLabel}, raised ${c.findings.length}`);\n}\nconsole.log(\"\");\nconsole.log(`SUMMARY: ${report.findings.filter((f) => f.severity === \"urgent\").length} urgent, ` +\n `${report.findings.filter((f) => f.severity === \"attention\").length} attention, ` +\n `${report.findings.filter((f) => f.severity === \"note\").length} notes, ` +\n `across ${report.checks.length} checks and ${report.inspected} records inspected.`);\n\n\n=====FILE watchdog/main.ts =====\n// dogsspot_watchdog — v1.7 (14 Aug 2026: reads Kim's own status page and checks its mode wording against the engine) / v1.6 (5 Aug 2026: knowledge-base tamper watch, shared Square figures, scheduled-vs-manual run stamps) / v1.5 (4 Aug 2026: GHL direct health + workflow tamper detection + puppy send-failure scan + panel surfacing via wd_public)\n//\n// WHY THIS EXISTS\n// Three automations run unattended against a live client account: the Pups Club announcer,\n// the reschedule notifier, and the Square/GoHighLevel revenue bridge. Every one of them fails\n// SILENTLY. A dead scheduler, a rotated token, a disabled webhook subscription and a genuinely\n// quiet trading day all look identical from the outside: nothing happens, and nobody finds out\n// until a customer complains or a month of revenue is missing from a report.\n//\n// This val is the supervisor. It reads the state the other three leave behind, applies the\n// checks a human would apply, and emails only when something is actually wrong — plus one\n// all-clear a week so that silence from the watchdog is never itself ambiguous.\n//\n// It is strictly READ-ONLY against the client's GoHighLevel account. It writes nothing but its\n// own digest blob. That is deliberate: a supervisor that can change things is a second thing\n// that can break things.\n\nimport { blob } from \"https://esm.town/v/std/blob\";\nimport { email } from \"https://esm.town/v/std/email\";\n\nconst BRIDGE_URL = \"https://amir5--41ace24c7e2111f18c9d1607ee4eb77e.web.val.run\";\n// Kim's own status page. Read, never written to, and read with the VIEW key rather than the admin\n// one so that a leak of this val's traffic could not stop her follow-up.\nconst DASHBOARD_URL = \"https://amir5--fb119304902811f182781607ee4eb77e.web.val.run\";\n\nconst DIGEST_KEY = \"wd_digest\";\nconst ALERT_KEY = \"wd_last_alert\";\nconst CHECK_KEY = \"wd_last_check\";\nconst MODE_WORDING_KEY = \"wd_mode_wording\";\n// Rendering Kim's dashboard costs a dozen or so CRM reads, so this one check is throttled rather\n// than run on every pass. What it catches is introduced by a DEPLOY, not by the passage of time,\n// so four looks a day is the right shape; the trade is written down here rather than left as a\n// number somebody has to guess at.\nconst MODE_WORDING_EVERY_MIN = 6 * 60;\n\n// v1.2 — EMAIL DISCIPLINE, learned the hard way.\n// v1.1 emailed about a createOpp error that was already fixed, simply because the error sat\n// inside a rolling 24-hour window. A monitor that reports history rather than change is a\n// monitor that gets filtered into a folder within a week. Two rules now:\n// 1. Only conditions NEWER than the previous check can raise an alarm.\n// 2. Only CRITICAL reaches the inbox. WARNING and INFO live in the digest, which is always\n// complete and always available — they are for reading on purpose, not for interrupting.\nconst NEW_ERROR_EMAIL_THRESHOLD = 3;\n\n// The two cron vals run every 15 minutes. 90 minutes of silence is ~6 missed cycles: comfortably\n// past a transient platform blip, comfortably short of a day's lost sends.\nconst CRON_STALE_MIN = 90;\n// Square is bursty. A real trading day produces traffic, but a genuinely quiet weekend does not,\n// so 72h avoids crying wolf over a slow Sunday while still catching a disabled subscription.\nconst INBOUND_STALE_H = 72;\nconst ERROR_LOOKBACK_H = 24;\n// Re-send an unchanged alert at most once a day. An alert that repeats hourly is an alert that\n// gets filtered into a folder and never read again.\nconst REALERT_H = 24;\n\ntype Sev = \"CRITICAL\" | \"WARNING\" | \"INFO\";\ninterface Finding {\n sev: Sev;\n system: string;\n what: string;\n why: string;\n}\n\nconst nowMs = Date.now();\nconst ageMin = (iso?: string) => (iso ? (nowMs - Date.parse(iso)) / 60000 : Infinity);\nconst fmtAge = (min: number) =>\n !isFinite(min)\n ? \"never\"\n : min < 60\n ? `${Math.round(min)} min ago`\n : min < 2880\n ? `${(min / 60).toFixed(1)} h ago`\n : `${(min / 1440).toFixed(1)} days ago`;\n\nasync function getBlob(key: string): Promise {\n try {\n return await blob.getJSON(key);\n } catch {\n return null;\n }\n}\n\nasync function sha256Hex(s: string): Promise {\n const b = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(s));\n return [...new Uint8Array(b)].map((x) => x.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\n/** The dashboard's work-log card is dated history and legitimately says \"practice mode was on\" of\n * July and early August. It is fenced with two HTML comments (see the note beside LOG_SHOWN in\n * engine/dashboard.ts) and the mode-wording check skips what is between them.\n * If either fence is missing the whole page is scanned instead. A check that silently stops\n * checking is the failure it exists to prevent, so it fails noisy, not quiet. */\nfunction withoutDatedHistory(html: string): { text: string; fenced: boolean } {\n const A = \"\", B = \"\";\n const i = html.indexOf(A), j = html.indexOf(B);\n if (i < 0 || j < 0 || j < i) return { text: html, fenced: false };\n return { text: html.slice(0, i) + html.slice(j + B.length), fenced: true };\n}\n\n/** A cron that stopped firing writes no new state, so staleness is the only honest signal. */\nfunction checkCron(\n name: string,\n state: { ok?: boolean; ts?: string; failed?: number; log?: string[] } | null,\n findings: Finding[],\n) {\n if (!state) {\n findings.push({\n sev: \"CRITICAL\",\n system: name,\n what: \"no state blob at all\",\n why: \"The val has never completed a run, or its state was wiped. It is not doing its job.\",\n });\n return;\n }\n const age = ageMin(state.ts);\n if (!state.ts) {\n findings.push({\n sev: \"INFO\",\n system: name,\n what: \"state has no timestamp yet\",\n why: \"Running a version from before run-timestamps were added. Staleness cannot be checked until it next runs.\",\n });\n } else if (age > CRON_STALE_MIN) {\n findings.push({\n sev: \"CRITICAL\",\n system: name,\n what: `last completed run ${fmtAge(age)}`,\n why: \"Expected every 15 minutes. The scheduler has stopped, or every run is now throwing before it can write state. Sends are being missed right now.\",\n });\n }\n if (state.ok === false) {\n findings.push({\n sev: \"CRITICAL\",\n system: name,\n what: \"last run reported ok:false\",\n why: \"The run completed but knew it had failed. Check the log field in its state blob.\",\n });\n }\n if ((state.failed ?? 0) > 0) {\n findings.push({\n sev: \"WARNING\",\n system: name,\n what: `${state.failed} message(s) failed to send on the last run`,\n why: \"A real customer did not receive a message they should have received. Worth checking who.\",\n });\n }\n}\n\n/** Recent entries in the *_last_error blobs, which the vals write on an unhandled throw. */\nasync function checkErrorBlob(name: string, key: string, findings: Finding[]) {\n const e = await getBlob<{ at?: string; error?: string }>(key);\n if (!e?.at) return;\n const age = ageMin(e.at);\n if (age < ERROR_LOOKBACK_H * 60) {\n findings.push({\n sev: \"WARNING\",\n system: name,\n what: `threw an error ${fmtAge(age)}: ${String(e.error).slice(0, 160)}`,\n why: \"That run did no work. With retries in place this should now be rare — if it repeats, it is not a transient blip.\",\n });\n }\n}\n\n// `trigger` says WHO started this pass. It defaults to \"interval\" because that is how val.town\n// calls the default export: with no arguments. run.ts passes \"manual\" explicitly.\n// [was: no argument at all, so a hand-triggered run and a scheduled one left identical\n// footprints. The dashboard then measured the gaps between those footprints and told Kim\n// \"left to itself it runs about every 95 minutes\" — a sentence about a rhythm, computed from\n// stamps that were mostly me pressing the button. On 4-5 Aug the engine fired on the hour, ten\n// gaps of exactly 60 minutes, while the watchdog fired ZERO times in the same 5h18m window.\n// Its interval is not running, and nothing could say so because nothing knew the difference.]\nexport default async function watchdog(trigger?: unknown) {\n // WHO STARTED THIS PASS, decided by ELIMINATION rather than by trusting the argument.\n // [was: `trigger: \"interval\" | \"manual\" = \"interval\"`, on the assumption that val.town calls\n // the default export with no arguments so the default would apply. It does not: the scheduler\n // passes it something of its own. So `trigger === \"interval\"` was false on every scheduled\n // run, autoHistory stayed empty forever, and the dashboard reported \"nothing on a schedule has\n // been recorded\" while main.ts was firing perfectly and writing to the plain history two lines\n // later. I read that empty list and nearly concluded a second time that the timer was dead.\n // Only run.ts passes the literal string \"manual\"; anything else, including whatever the\n // platform hands us, is a scheduled run.]\n const isManual = trigger === \"manual\";\n const findings: Finding[] = [];\n // v1.5.1 (review fix #12), ONE checkpoint read and ONE scan-start stamp shared by every\n // journal scan, so rows written while this very run executes land in the NEXT window\n // instead of vanishing between two different reads of the checkpoint.\n const scanStartIso = new Date().toISOString();\n const prevCheck = await getBlob<{ ts?: string }>(CHECK_KEY);\n const sinceMsShared = prevCheck?.ts ? Date.parse(prevCheck.ts) : nowMs - ERROR_LOOKBACK_H * 3600_000;\n\n // ---- the two cron vals -------------------------------------------------\n checkCron(\"Pups Club announcer\", await getBlob(\"pups2_state\"), findings);\n checkCron(\"Reschedule notifier\", await getBlob(\"apptn_state\"), findings);\n await checkErrorBlob(\"Pups Club announcer\", \"pups2_last_error\", findings);\n await checkErrorBlob(\"Reschedule notifier\", \"apptn_last_error\", findings);\n\n // ---- Puppy Path engine (added 30 Jul — v1.4; cadence corrected v1.5, and again v1.7) ----\n // [was: \"The engine runs every 15 minutes (not hourly as first noted), so 90 min staleness =\n // six missed ticks.\" Both halves are wrong and the correction went the wrong way. Measured\n // 14 Aug 2026 over the 39 most recent gaps in `puppy_run_state.history`: 36 of them fell\n // between 60.0 and 61.0 minutes and the longest was 64.2. It runs about once an hour.\n // CRON_STALE_MIN is 90, which is shared with the two genuine 15-minute crons above, so this\n // check fires after ONE missed hourly pass plus 26 minutes of headroom rather than after\n // six missed ticks. That has not misfired yet and the observed jitter does not reach it, but\n // it is a much thinner margin than the old comment implied and it is written down here so\n // the next person sizing it is sizing it against a measurement.]\n // Its run report carries `ts` from engine v1.2+.\n checkCron(\"Puppy Path\", await getBlob(\"puppy_run_state\"), findings);\n await checkErrorBlob(\"Puppy Path\", \"puppy_last_error\", findings);\n const psum = await getBlob<{ surgeHolds?: number }>(\"puppy_summary\");\n if ((psum?.surgeHolds ?? 0) > 0) {\n findings.push({\n sev: \"WARNING\",\n system: \"Puppy Path\",\n what: `enrollment surge hold recorded (${psum!.surgeHolds} total)`,\n why: \"More tagged contacts appeared in one run than the safety threshold allows — bulk tagging suspected. Enrollment is frozen until the extra tags are removed or ACKNOWLEDGE_SURGE=true is set. Check puppy_journal.\",\n });\n }\n\n // ---- cancelled appointments that have not happened yet -----------------\n // Written by the reschedule notifier each run. Every entry is a customer who cancelled and is\n // still queued to be reminded about it, because GoHighLevel does not remove a contact from a\n // reminder workflow when the appointment is cancelled — a contact already on a wait step stays\n // there and the send fires anyway. Until an explicit workflow exit exists, this is the only\n // thing standing between that and a customer having to ask twice.\n const cf = await getBlob<{ ts?: string; n?: number; items?: any[] }>(\"apptn_cancelled_future\");\n if (cf && (cf.n ?? 0) > 0) {\n const soonest = (cf.items ?? [])\n .map((i) => i?.startTime)\n .filter(Boolean)\n .sort()[0];\n findings.push({\n sev: \"WARNING\",\n system: \"Appointments\",\n what: `${cf.n} cancelled appointment(s) still in the future${soonest ? `, soonest ${String(soonest).slice(0, 16).replace(\"T\", \" \")}` : \"\"}`,\n why: \"Each one is a customer who may still be reminded about an appointment they cancelled. Check apptn_cancelled_future for the contact ids.\",\n });\n }\n\n // ---- the bridge is reachable ------------------------------------------\n let bridgeVersion = \"unreachable\";\n try {\n const r = await fetch(BRIDGE_URL, { signal: AbortSignal.timeout(15000) });\n const t = await r.text();\n if (!r.ok) {\n findings.push({\n sev: \"CRITICAL\",\n system: \"Square bridge\",\n what: `health check returned HTTP ${r.status}`,\n why: \"Square is posting payments at an endpoint that is not answering. Revenue attribution is dead while this is true.\",\n });\n } else {\n bridgeVersion = (t.match(/v[\\d.]+/) ?? [\"?\"])[0];\n }\n } catch {\n findings.push({\n sev: \"CRITICAL\",\n system: \"Square bridge\",\n what: \"health check did not respond\",\n why: \"The endpoint Square delivers payments to is down. Every payment arriving now is being lost.\",\n });\n }\n\n // ---- is Square still delivering at all? --------------------------------\n // This is the check that did not exist before, and the one most likely to catch a silent\n // multi-week outage: a webhook subscription that has been disabled looks exactly like a\n // quiet week unless something is counting inbound requests.\n const inbound = await getBlob<{ ts?: string; n?: number }>(\"m2_last_inbound\");\n const inAge = ageMin(inbound?.ts);\n if (!inbound?.ts) {\n findings.push({\n sev: \"INFO\",\n system: \"Square bridge\",\n what: \"no inbound request recorded yet\",\n why: \"Heartbeat tracking was only just added. This clears itself the first time Square posts anything.\",\n });\n } else if (inAge > INBOUND_STALE_H * 60) {\n findings.push({\n sev: \"CRITICAL\",\n system: \"Square bridge\",\n what: `no inbound webhook for ${fmtAge(inAge)}`,\n why: \"Either the business has taken no payments at all, or the Square webhook subscription has been disabled or its URL changed. Check Square's Developer dashboard before assuming it is quiet.\",\n });\n }\n\n // ---- bridge errors, but only ones that are actually NEW -----------------\n // Anything already seen on a previous run is history, not news. This is the specific fix\n // for v1.1 alarming on a createOpp failure that the v3.7 bridge deploy had already resolved.\n const journal = (await getBlob(\"m2_bridge_journal\")) ?? [];\n const fresh = journal.filter((r) => Date.parse(r?.ts ?? 0) > sinceMsShared);\n const newErrs = fresh.filter((r) => r?.kind === \"ERROR\");\n const newNoMatch = fresh.filter((r) => r?.kind === \"NO-MATCH\" || r?.kind === \"REFUND-NO-MATCH\");\n\n if (newErrs.length) {\n findings.push({\n sev: \"WARNING\",\n system: \"Square bridge\",\n what: `${newErrs.length} NEW error(s) since the last check — latest: ${String(newErrs.at(-1)?.error).slice(0, 140)}`,\n why: \"Each one is a payment that did not get attached to a customer record. New errors after a period of quiet usually mean a fix has regressed or an upstream API has changed.\",\n });\n }\n if (newNoMatch.length) {\n findings.push({\n sev: \"INFO\",\n system: \"Square bridge\",\n what: `${newNoMatch.length} new payment(s) arrived with no contact details`,\n why: \"Expected while the Square access token is outstanding. Counted here so the backlog is visible, not because anything is broken.\",\n });\n }\n\n // ---- the POS gap, computed ONCE, in the same place everything else computes it ----------\n // Reported as INFO and never emailed: it is a known, accepted, historic condition.\n //\n // [was: this block did its own dedup and its own arithmetic, and both were wrong.\n // (1) It only counted rows carrying NEITHER an email NOR a phone, which dropped 14 of the 87\n // NO-MATCH rows — payments that are still unattributed — and reported 35 payments worth\n // $23,463.99 against a true 40 worth $28,035.99. Understated by $4,572.\n // (2) It deduped by the note TEXT rather than by payment id.\n // (3) `resolvable` counted journal ROWS and was then subtracted from a PAYMENT count, so the\n // \"21 arrived with no identifying detail\" was 35 payments minus 14 rows: two different\n // units, one subtraction, a number that meant nothing.\n // The dashboard already computed this correctly from engine/facts.ts. Two computations of one\n // fact is how the wrong number reached a client message in the first place, so this one is\n // deleted rather than repaired: the watchdog now reads the same function the page reads.\n // Verified 5 Aug against an independent third derivation of the raw journal in Python:\n // 40 payments, $28,035.99, 10 with a trail worth $4,418.99, 30 without worth $23,617.00.]\n //\n // Imported dynamically and unpinned, on purpose. Unpinned so it always matches what the\n // dashboard is showing Kim; dynamic so that if esm.town is having a moment, the watchdog says\n // it could not read the figure instead of dying or, worse, reporting a stale one.\n const backlog = await (async () => {\n try {\n const m = await import(\"https://esm.town/v/amir5/dogsspot_puppy_path/facts.ts\");\n return { ok: true as const, b: m.squareBacklog(journal), say: m.squareSentence as (x: unknown) => string };\n } catch (e) {\n return { ok: false as const, err: String((e as Error)?.message ?? e).slice(0, 200) };\n }\n })();\n\n if (!backlog.ok) {\n findings.push({\n sev: \"WARNING\",\n system: \"Square bridge\",\n what: \"The counter-sale backlog could not be computed this pass\",\n why: `The shared figures module would not load (${backlog.err}). No number is reported rather than a stale or invented one. One pass failing is a blip; several in a row is worth a look.`,\n });\n } else if (backlog.b && backlog.b.payments > 0) {\n findings.push({\n sev: \"INFO\",\n system: \"Square bridge\",\n // No number in `what`. Every figure lives in one generated sentence below, so there is no\n // second place for one of them to drift.\n what: \"Counter sales are recorded but not linked to a name\",\n why: backlog.say(backlog.b) + \" Historic backlog, not a live defect, and the same figures the dashboard shows.\",\n });\n }\n\n // ---- is the GoHighLevel token still alive? -----------------------------\n // Deliberately inferred rather than tested directly. val.town scopes environment variables\n // per val, so giving this watchdog its own copy of the GoHighLevel token would mean a second\n // place the client's credentials live, for no gain. The two cron vals already authenticate\n // against that account every 15 minutes and record what they got back — so their telemetry\n // IS the token check. A dead token cannot produce a healthy calendar count.\n const pupsS = await getBlob(\"pups2_state\");\n const apptnS = await getBlob(\"apptn_state\");\n const calCount = apptnS?.calendars ?? 0;\n const evCount = (apptnS?.events ?? 0) + (pupsS?.events ?? 0);\n const bothFresh = ageMin(pupsS?.ts) < CRON_STALE_MIN && ageMin(apptnS?.ts) < CRON_STALE_MIN;\n if (bothFresh && calCount === 0 && evCount === 0) {\n findings.push({\n sev: \"CRITICAL\",\n system: \"GoHighLevel access\",\n what: \"both crons ran but read zero calendars and zero appointments\",\n why: \"That combination means authentication, not a quiet week — a quiet week still returns the calendar list. The shared token has almost certainly been revoked or expired. Every automation is down until it is replaced.\",\n });\n }\n // Surface any authentication failure the crons logged against individual calendars. A 401 on\n // one calendar while others succeed is a permissions scope problem, not a dead token, and the\n // two need very different responses.\n for (const [nm, st] of [[\"Pups Club announcer\", pupsS], [\"Reschedule notifier\", apptnS]] as const) {\n const authLog = (st?.log ?? []).filter((l: string) => /\\b40[13]\\b/.test(l));\n if (authLog.length) {\n findings.push({\n sev: \"WARNING\",\n system: nm,\n what: `authentication refused on ${authLog.length} calendar(s): ${String(authLog[0]).slice(0, 120)}`,\n why: \"Other calendars in the same run worked, so this is that calendar's permissions rather than the token itself. Appointments on it are invisible to the automation until it is fixed.\",\n });\n }\n }\n\n // ---- v1.5: puppy engine send failures, NEW ones only --------------------\n // The engine journals send_failed per contact. History is not news (same discipline as the\n // bridge errors above): only rows newer than the previous watchdog pass can raise anything.\n {\n const pj = (await getBlob(\"puppy_journal\")) ?? [];\n const newFails = pj.filter((r) => Date.parse(r?.ts ?? 0) > sinceMsShared && /fail|error/i.test(String(r?.event ?? \"\")));\n if (newFails.length >= 1) {\n findings.push({\n sev: newFails.length >= 3 ? \"CRITICAL\" : \"WARNING\",\n system: \"Puppy Path\",\n what: `${newFails.length} NEW failed action(s) in the engine journal — latest: ${String(newFails.at(-1)?.detail ?? \"\").slice(0, 120)}`,\n why: \"Each row is a message or check that did not complete. The engine retries by design, but new failures after quiet usually mean a credential, a rate limit, or an API change.\",\n });\n }\n }\n\n // ---- v1.7: DOES KIM'S PAGE AGREE WITH THE ENGINE ABOUT WHETHER IT IS SENDING? ---------------\n // THE FAILURE THIS EXISTS FOR, and it is not hypothetical. The engine went live on the evening\n // of 11 August. Kim's status page went on telling her, for three days, that the messages \"stay\n // in practice mode and nobody is messaged by them\", while two real people were partway through\n // them. Nothing in this file noticed, because nothing in this file had ever read a customer-\n // facing page. Every other check here reads state; this one reads what the client is told.\n //\n // It is deliberately a check on WORDS, not on a flag. The mode flag was correct the whole time.\n // What was wrong was the English wrapped around it, and English is what she acts on. A page that\n // is wrong about whether it is messaging her customers is the same failure that lost her last\n // supplier, wearing the opposite sign.\n //\n // CRITICAL, so it emails: there is no version of \"the live system tells the client it is not\n // live\" that should sit in a digest waiting to be read on purpose.\n let modeWording = \"not reached\";\n try {\n const runState = await getBlob<{ testMode?: unknown }>(\"puppy_run_state\");\n if (runState?.testMode !== false) {\n // Nothing to contradict. Practice-mode wording is correct in practice mode, and an engine\n // that has not reported a mode gets no opinion from us either way.\n modeWording = runState?.testMode === true\n ? \"not applicable, the engine reports practice mode\"\n : \"not applicable, the engine has not reported a mode\";\n } else {\n const gate = await getBlob<{ ts?: string }>(MODE_WORDING_KEY);\n const sinceLast = ageMin(gate?.ts);\n if (sinceLast < MODE_WORDING_EVERY_MIN) {\n modeWording = `skipped this pass, last read ${fmtAge(sinceLast)}`;\n } else {\n // The view key, derived exactly as engine/api.ts and engine/dashboard.ts derive it, from\n // the CRM token this watchdog already resolves. No second secret, and no admin key here.\n let tok = Deno.env.get(\"GHL_TOKEN\");\n if (!tok) tok = (await getBlob<{ ghlToken?: string }>(\"puppy_config\"))?.ghlToken ?? undefined;\n if (!tok) {\n modeWording = \"skipped, no token to build the view link from\";\n findings.push({\n sev: \"INFO\", system: \"Kim's status page\",\n what: \"the mode-wording check could not build a view link\",\n why: \"No CRM token was available to this val, so the page was not read. The engine's own mode flag is still checked everywhere else.\",\n });\n } else {\n const viewKey = \"tds_view_\" + (await sha256Hex(tok + \":view\")).slice(0, 32);\n const r = await fetch(`${DASHBOARD_URL}?k=${encodeURIComponent(viewKey)}`, { signal: AbortSignal.timeout(25000) });\n if (!r.ok) {\n modeWording = `http ${r.status}`;\n findings.push({\n sev: r.status === 401 ? \"WARNING\" : \"CRITICAL\",\n system: \"Kim's status page\",\n what: `the page returned HTTP ${r.status} to the view link`,\n why: r.status === 401\n ? \"The view key is derived from the CRM token. A 401 usually means that token was rotated and the view links Kim and her staff hold have changed with it. Nothing is sending wrongly; her page may simply not open for her.\"\n : \"This is the page Kim opens to see whether her follow-up is working. It is not answering. She cancelled her last supplier over exactly this kind of silence.\",\n });\n } else {\n const body = await r.text();\n const { text, fenced } = withoutDatedHistory(body);\n const hits = text.match(/practice mode/gi) ?? [];\n modeWording = `read ${body.length} chars, dated history ${fenced ? \"fenced off\" : \"NOT FENCED, whole page scanned\"}, ${hits.length} present-tense mention(s) of practice mode`;\n if (hits.length > 0) {\n findings.push({\n sev: \"CRITICAL\",\n system: \"Kim's status page\",\n what: `the engine reports LIVE and her page says \"practice mode\" ${hits.length} time(s)${fenced ? \"\" : \" (the dated-history fence is missing from the page, so this count includes the work log and may be innocent)\"}`,\n why: \"The system is sending to real customers and the page she reads says it is not. This is the 11 August failure repeating: for three days her page told her nobody was being messaged while two people were partway through the sequence. Fix the wording on the page, not the flag on the engine.\",\n });\n }\n }\n await blob.setJSON(MODE_WORDING_KEY, { ts: new Date().toISOString(), result: modeWording }).catch(() => {});\n }\n }\n }\n } catch (e) {\n // Same discipline as the knowledge-base watch below: a check that quietly did not run is worse\n // than one that ran and found nothing, because only one of them is distinguishable from health.\n modeWording = `failed: ${String((e as Error)?.message ?? e).slice(0, 120)}`;\n findings.push({\n sev: \"WARNING\", system: \"Kim's status page\",\n what: \"the mode-wording check did not run this pass\",\n why: `${modeWording}. Nothing is broken in Kim's account because of this; it means nobody is checking that her page agrees with the engine until it runs again.`,\n });\n }\n\n // Set by the knowledge-base watch below and reported in the digest, so \"it ran and saw eight\"\n // is visible rather than inferred from the absence of an alarm.\n let kbWatch = \"not reached\";\n // ---- v1.5: GoHighLevel reachable + workflow registry tamper check -------\n // Direct read, token from the SAME blob the engine already uses (puppy_config) or env — no\n // new place for credentials to live. Answers two questions nothing else answered: is the CRM\n // API itself up, and did anyone add/remove/publish/unpublish a workflow since the last look.\n // The second matters because a second contractor works in this account: a silently published\n // nurture is exactly how double-sends start.\n try {\n let tok = Deno.env.get(\"GHL_TOKEN\");\n if (!tok) tok = (await getBlob<{ ghlToken?: string }>(\"puppy_config\"))?.ghlToken ?? undefined;\n if (!tok) {\n findings.push({ sev: \"INFO\", system: \"GoHighLevel access\", what: \"no token available to the watchdog\", why: \"Direct reachability and workflow tamper checks skipped. The inferred token check above still runs.\" });\n } else {\n const wr = await fetch(\"https://services.leadconnectorhq.com/workflows/?locationId=BQHJ19uohldYe3eqA0bl\", {\n headers: { Authorization: `Bearer ${tok}`, Version: \"2021-04-15\", \"User-Agent\": \"curl/8.5.0\" },\n signal: AbortSignal.timeout(20000),\n });\n if (!wr.ok) {\n findings.push({\n sev: \"CRITICAL\", system: \"GoHighLevel access\",\n what: `workflow list read returned HTTP ${wr.status}`,\n why: \"The CRM API refused a read that worked before. Token revoked, scope changed, or platform outage — every automation reads this account, so treat as down until confirmed otherwise.\",\n });\n } else {\n const wfs = (await wr.json())?.workflows ?? [];\n const reg = wfs.map((w: any) => [w.id, w.name, w.status, String(w.updatedAt ?? w.dateUpdated ?? \"\")]).sort();\n const enc = new TextEncoder().encode(JSON.stringify(reg));\n const hashBuf = await crypto.subtle.digest(\"SHA-256\", enc);\n const hash = [...new Uint8Array(hashBuf)].map((b) => b.toString(16).padStart(2, \"0\")).join(\"\").slice(0, 16);\n const published = wfs.filter((w: any) => w.status === \"published\").length;\n const prev = await getBlob<{ hash?: string; count?: number; published?: number; names?: Record }>(\"wd_wf_registry\");\n const names: Record = {};\n // v1.5.1 (fix #14), updatedAt travels in the name string so an EDITED-in-place workflow\n // (same name, same status, new content) shows up as a named change, not a blank alarm.\n for (const w of wfs) names[w.id] = `${w.name} [${w.status}] @${String(w.updatedAt ?? w.dateUpdated ?? \"\").slice(0, 16)}`;\n if (wfs.length === 0 && (prev?.count ?? 0) > 0) {\n // v1.5.1 (fix #13), a malformed-but-200 response must not wipe the baseline and fire\n // a bogus \"everything removed\" alarm followed by \"everything added\" on recovery.\n findings.push({ sev: \"WARNING\", system: \"GoHighLevel workflows\", what: \"workflow list came back EMPTY on a 200 response\", why: \"Almost certainly a transient API glitch. The tamper baseline was NOT overwritten; if this repeats across passes, treat it as an outage.\" });\n } else if (prev?.hash && prev.hash !== hash) {\n const prevIds = new Set(Object.keys(prev.names ?? {}));\n const nowIds = new Set(Object.keys(names));\n const added = [...nowIds].filter((i) => !prevIds.has(i)).map((i) => names[i]);\n const removed = [...prevIds].filter((i) => !nowIds.has(i)).map((i) => (prev.names ?? {})[i]);\n const changed = [...nowIds].filter((i) => prevIds.has(i) && (prev.names ?? {})[i] !== names[i]).map((i) => `${(prev.names ?? {})[i]} -> ${names[i]}`);\n findings.push({\n sev: \"CRITICAL\", system: \"GoHighLevel workflows\",\n what: `the workflow registry CHANGED (${prev.count} -> ${wfs.length} workflows, ${prev.published} -> ${published} published). Added: ${added.slice(0, 3).join(\"; \") || \"none\"}. Removed: ${removed.slice(0, 3).join(\"; \") || \"none\"}. Changed: ${changed.slice(0, 3).join(\"; \") || \"none\"}`,\n why: \"Nobody on this project changed workflows. If this was not Kim or Kristian acting deliberately, something is editing the account. A newly PUBLISHED nurture can double-message customers the engine also handles. This alert emails immediately and the change is kept in wd_wf_changes.\",\n });\n // v1.5.1 (fix #10), append-only evidence trail, capped at the newest 20 changes, so\n // the single-blob digest overwrite can never destroy what changed and when.\n const hist = (await getBlob(\"wd_wf_changes\")) ?? [];\n hist.push({ ts: new Date().toISOString(), from: prev.hash, to: hash, added, removed, changed });\n await blob.setJSON(\"wd_wf_changes\", hist.slice(-20)).catch(() => {});\n await blob.setJSON(\"wd_wf_registry\", { ts: new Date().toISOString(), hash, count: wfs.length, published, names });\n } else if (wfs.length > 0 || (prev?.count ?? 0) === 0) {\n await blob.setJSON(\"wd_wf_registry\", { ts: new Date().toISOString(), hash, count: wfs.length, published, names });\n }\n }\n\n // ---- v1.6: the KNOWLEDGE BASES, watched the same way as the workflows ----------------\n // `kbWatch` ends up in the digest snapshot so a human can see, at a glance, that this ran\n // and what it saw. A check whose only evidence is the absence of an alarm is not evidence.\n // WHY. The consolidated knowledge base is what Chloe answers customers from. It carries the\n // rules that cost the client relationship if they slip: no training prices, opening hours\n // never without the appointment-only line, no grooming, \"Pup Talk\" and never \"discovery\n // call\". It was edited at 02:38 on 5 August, by somebody, and nothing noticed. Workflows\n // have been watched since v1.5; the documents that decide what Kim's business SAYS were not.\n //\n // The API gives names, timestamps and a count of what is inside each base, but not the text\n // of the documents. So this cannot check the wording. It can say \"something changed, here,\n // on this date\", which turns a silent edit into a question somebody asks.\n try {\n const kr = await fetch(\"https://services.leadconnectorhq.com/knowledge-base/?locationId=BQHJ19uohldYe3eqA0bl\", {\n headers: { Authorization: `Bearer ${tok}`, Version: \"2021-07-28\", \"User-Agent\": \"curl/8.5.0\" },\n signal: AbortSignal.timeout(12000),\n });\n if (!kr.ok) kbWatch = `http ${kr.status}`;\n else {\n const kbs = (await kr.json())?.data?.knowledgeBases ?? [];\n kbWatch = `read ${kbs.length} knowledge base(s)`;\n const names: Record = {};\n for (const k of kbs) names[k.id] = `${k.name} @${String(k.updatedAt ?? \"\").slice(0, 16)}`;\n const prev = await getBlob<{ names?: Record; count?: number }>(\"wd_kb_registry\");\n // The comparison itself lives in engine/registry-diff.ts and is unit-tested there, so it\n // is not a check that has only ever been seen not firing. Imported unpinned, same as the\n // Square figures, so there is one implementation rather than two that can drift apart.\n const rd = await import(\"https://esm.town/v/amir5/dogsspot_puppy_path/registry-diff.ts\");\n if (rd.looksLikeAGlitch(kbs.length, prev?.count)) {\n findings.push({ sev: \"WARNING\", system: \"GoHighLevel knowledge bases\", what: \"the knowledge base list came back EMPTY on a 200 response\", why: \"Almost certainly a transient API glitch. The baseline was NOT overwritten, so the next good pass will not fire a bogus 'everything came back' alarm.\" });\n } else if (prev?.names) {\n const c = rd.registryDiff(prev.names, names);\n if (c.changed) {\n findings.push({\n sev: \"WARNING\",\n system: \"GoHighLevel knowledge bases\",\n what: \"a knowledge base changed since the last look\",\n why: rd.registrySentence(c, \"her knowledge bases\") +\n \" This is what Chloe answers customers from, so a change here changes what the business says. Worth asking who made it and re-reading the wording rules against it. Not an alarm on its own: Kim edits her own knowledge base and that is exactly as it should be.\",\n });\n const hist = (await getBlob(\"wd_kb_changes\")) ?? [];\n hist.push({ ts: new Date().toISOString(), added: c.added, removed: c.removed, edited: c.edited });\n await blob.setJSON(\"wd_kb_changes\", hist.slice(-20)).catch(() => {});\n }\n await blob.setJSON(\"wd_kb_registry\", { ts: new Date().toISOString(), count: kbs.length, names });\n } else if (kbs.length) {\n await blob.setJSON(\"wd_kb_registry\", { ts: new Date().toISOString(), count: kbs.length, names });\n }\n }\n } catch (e) {\n // NOT SWALLOWED SILENTLY. The dynamic import can fail, the endpoint can move, and a bare\n // catch here would mean the knowledge-base watch was simply not running while everything\n // downstream reported healthy. That is the same shape as the dry tagging pass, which was\n // deployed, hash-verified, green on every test and dead for three deploys because nothing\n // checked that the code had actually executed.\n kbWatch = `failed: ${String((e as Error)?.message ?? e).slice(0, 120)}`;\n findings.push({\n sev: \"WARNING\", system: \"GoHighLevel knowledge bases\",\n what: \"the knowledge-base watch did not run this pass\",\n why: `${kbWatch}. Nothing is broken in Kim's account because of this; it means nobody is watching her knowledge bases until it runs again. Several passes in a row is worth a look.`,\n });\n }\n }\n } catch (e) {\n findings.push({ sev: \"WARNING\", system: \"GoHighLevel access\", what: `direct reachability check failed: ${String(e).slice(0, 100)}`, why: \"Could not confirm the CRM API is up. If the crons are also stale this is an outage; if they are fresh it is likely a transient timeout.\" });\n }\n\n // ---- assemble ----------------------------------------------------------\n const rank: Record = { CRITICAL: 0, WARNING: 1, INFO: 2 };\n findings.sort((a, b) => rank[a.sev] - rank[b.sev]);\n const worst: Sev | \"OK\" = findings.find((f) => f.sev === \"CRITICAL\")\n ? \"CRITICAL\"\n : findings.find((f) => f.sev === \"WARNING\")\n ? \"WARNING\"\n : findings.length\n ? \"INFO\"\n : \"OK\";\n\n const digest = {\n ts: new Date().toISOString(),\n worst,\n bridgeVersion,\n findings,\n snapshot: {\n pups: pupsS,\n apptn: apptnS,\n lastInbound: inbound,\n journalRows: journal.length,\n knowledgeBases: kbWatch,\n // \"It ran and saw nothing\" and \"it never ran\" must not look alike in here.\n modeWording,\n },\n };\n await blob.setJSON(DIGEST_KEY, digest);\n\n // v1.5 — one tiny public-facing summary the control panel renders in plain English, so Kim\n // can see that an independent second system is checking the first one. No details here beyond\n // a headline; the digest carries the full findings for whoever investigates.\n // v1.5.2 — the watchdog's own footprints. The dashboard used to grade this system purely on the\n // contents of its last report, so a watchdog that had silently stopped an hour ago still showed\n // a green tick on the strength of a stale \"nothing wrong\". It now reports how punctual the\n // watchdog has actually been, measured from these stamps rather than asserted by anyone.\n let wdHistory: string[] = [];\n let autoHistory: string[] = [];\n try {\n const prevPub = await blob.getJSON(\"wd_public\").catch(() => null);\n wdHistory = Array.isArray(prevPub?.history) ? prevPub.history.filter((x: unknown) => typeof x === \"string\") : [];\n if (!wdHistory.length && typeof prevPub?.ts === \"string\") wdHistory = [prevPub.ts];\n autoHistory = Array.isArray(prevPub?.autoHistory) ? prevPub.autoHistory.filter((x: unknown) => typeof x === \"string\") : [];\n } catch { /* never fail a watchdog run over its own bookkeeping */ }\n if (wdHistory[wdHistory.length - 1] !== digest.ts) wdHistory.push(digest.ts);\n // ONLY a scheduled pass counts towards the rhythm. A cadence measured over button presses is a\n // measurement of the person pressing the button.\n if (!isManual && autoHistory[autoHistory.length - 1] !== digest.ts) autoHistory.push(digest.ts);\n\n await blob.setJSON(\"wd_public\", {\n ts: digest.ts,\n history: wdHistory.slice(-40),\n autoHistory: autoHistory.slice(-40),\n // The last time it ran WITHOUT being asked. Null means it has never run on its own, which is\n // a different and much worse thing than \"it is a bit late\".\n lastAutoTs: autoHistory.length ? autoHistory[autoHistory.length - 1] : null,\n lastTrigger: isManual ? \"manual\" : \"scheduled\",\n worst,\n headline:\n worst === \"OK\"\n ? \"The independent watchdog checked everything and found nothing wrong.\"\n : worst === \"INFO\"\n ? \"The watchdog is running; only informational notes on file, nothing wrong.\"\n : worst === \"WARNING\"\n ? `The watchdog flagged ${findings.filter((f) => f.sev === \"WARNING\").length} thing(s) for Amir to look at. Anything urgent turns this line red and says to call him; this is the level below that.`\n : \"The watchdog found a problem and has alerted Amir. If this stays red for more than an hour, call him.\",\n }).catch(() => {});\n\n // ---- decide whether to actually email ----------------------------------\n // CRITICAL always reaches the inbox. A run of genuinely new bridge errors does too, because\n // a fix regressing is worth interrupting someone for. Everything else waits in the digest.\n const criticals = findings.filter((f) => f.sev === \"CRITICAL\");\n const worthWaking = criticals.length > 0 || newErrs.length >= NEW_ERROR_EMAIL_THRESHOLD;\n\n // v1.5.1 (review fix #11), ages and counts stripped before fingerprinting: \"1.6 h ago\"\n // becoming \"1.8 h ago\" is the same condition, and re-emailing it every pass trains the\n // inbox to ignore the address. REALERT_H still re-sends an unchanged alert daily.\n const stableWhat = (s: string) => s.replace(/\\d+(?:\\.\\d+)?\\s*(?:h|min|minute|hour|day)s?\\b/g, \"N\").replace(/\\d{4}-\\d{2}-\\d{2}[T ][\\d:.]+Z?/g, \"T\").slice(0, 60);\n const fingerprint = worthWaking\n ? criticals.map((f) => `${f.system}:${stableWhat(f.what)}`).join(\"|\") +\n (newErrs.length >= NEW_ERROR_EMAIL_THRESHOLD ? `|errors` : \"\")\n : \"\";\n\n const last = await getBlob<{ fp?: string; ts?: string }>(ALERT_KEY);\n const changed = fingerprint !== (last?.fp ?? \"\");\n const stale = ageMin(last?.ts) > REALERT_H * 60;\n const isMonday = new Date().getUTCDay() === 1;\n\n let sent = false;\n if (fingerprint && (changed || stale)) {\n // CRITICAL and WARNING only in the body. INFO is digest-only by design — a known,\n // accepted condition restated in an alert email is how alerts stop being read.\n const body = findings\n .filter((f) => f.sev !== \"INFO\")\n .map((f) => `[${f.sev}] ${f.system}\\n ${f.what}\\n ${f.why}`)\n .join(\"\\n\\n\");\n await email({\n subject: `Dogs Spot systems — action needed`,\n text: `${body}\\n\\n---\\nChecked ${digest.ts}\\nBridge ${bridgeVersion} · journal ${journal.length} rows\\nOnly conditions newer than the previous check can trigger this email. Warnings and notes that did not meet that bar are in the digest, not here.`,\n });\n await blob.setJSON(ALERT_KEY, { fp: fingerprint, ts: digest.ts });\n sent = true;\n } else if (!fingerprint && isMonday && ageMin(last?.ts) > 6 * 24 * 60) {\n const notes = findings.length\n ? `\\n\\nOpen items, none urgent:\\n` +\n findings.map((f) => ` · ${f.system} — ${f.what}`).join(\"\\n\")\n : \"\";\n await email({\n subject: \"Dogs Spot systems — all clear\",\n text: `Nothing wrong across the announcer, the reschedule notifier and the Square bridge.${notes}\\n\\nChecked ${digest.ts}\\nBridge ${bridgeVersion} · journal ${journal.length} rows\\n\\nWeekly confirmation that the watchdog itself is alive.`,\n });\n await blob.setJSON(ALERT_KEY, { fp: \"\", ts: digest.ts });\n sent = true;\n }\n\n // Stamp the checkpoint LAST, so a crash mid-run does not silently swallow new errors.\n // v1.5.1 (fix #12), the checkpoint is the SCAN START: rows journaled while this run was\n // executing stay newer than the stamp and surface on the next pass instead of vanishing.\n await blob.setJSON(CHECK_KEY, { ts: scanStartIso });\n\n return { ...digest, emailed: sent };\n}\n\n\n\n=====FILE watchdog/run.ts =====\n// CHECK NOW — manual trigger for the watchdog, mirroring the engine's run.ts pattern.\n// Same admin key as the control panel, digest-only in source, one code path: this imports the\n// exact watchdog() the scheduler calls. Added v1.5 so a deploy can be verified the minute it\n// ships instead of waiting for the next scheduled pass.\nimport watchdog from \"./main.ts\";\n\nconst KEY_SHA256 = \"48cd12465712045f70247da1689eeb198a4ce2d98416d8e52fb844581f044f15\";\nasync function sha256Hex(s: string): Promise {\n const b = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(s));\n return [...new Uint8Array(b)].map((x) => x.toString(16).padStart(2, \"0\")).join(\"\");\n}\nexport default async function (req: Request): Promise {\n const k = new URL(req.url).searchParams.get(\"k\") || \"\";\n const expected = Deno.env.get(\"NURTURE_ADMIN_KEY_SHA256\") || KEY_SHA256;\n if ((await sha256Hex(k)) !== expected) {\n return new Response(\"Not found\", { status: 401 });\n }\n // \"manual\" so this press does not get counted as the watchdog keeping its own schedule.\n const out = await watchdog(\"manual\");\n return new Response(JSON.stringify({ triggeredAt: new Date().toISOString(), result: out ?? \"ran\" }, null, 2), {\n headers: { \"content-type\": \"application/json\" },\n });\n}\n\n\n",[572],"fbfa7bc6-44c9-4f59-98b5-c24115347804","SOURCE-BUNDLE.part37.txt","3b739f62-9823-11f1-be16-1607ee4eb77e",1207,["D",1786982939016],"THE DOGS SPOT — SOURCE BUNDLE (part 37 of 47)\n\nEVERY source file in this project, engine/ included. Restoring these parts and nothing else gives\nyou a tree that builds, typechecks and runs its own test suite with no network and no val.\n\nengine/ is here as of 14 Aug 2026. It used to be left out because val 1bfa6e81-74e1-4c6c-ab32-118304a4ffff\nholds it, which was true of every engine file except engine/watch.ts: a module the val does not run,\nso it was never deployed, so it lived in one container and nothing else. A reclaim destroyed it.\nscripts/deploy.mjs --check still compares engine/ against the val file by file; that is a second\ncheck on the same files now, not the only copy of them.\n\nRESTORE (needs only node, from an empty folder). Save each part, then run this ON EACH ONE:\n\n node -e 'const fs=require(\"fs\"),p=require(\"path\");const b=fs.readFileSync(process.argv[1],\"utf8\");\n for(const s of b.split(\"\\n=====FILE \").slice(1)){const i=s.indexOf(\" =====\\n\");\n const f=s.slice(0,i),c=s.slice(i+7);fs.mkdirSync(p.dirname(f),{recursive:true});\n fs.writeFileSync(f,c.replace(/\\n$/,\"\"))}' PART.txt\n\nA record named #1, #2, ... is one FILE cut into pieces: concatenate them in order, then\nstrip one trailing newline from the last. scripts/restore.mjs does this for you.\n\nEach part is complete in itself: whole files only, no reassembly, any order.\n\nThen: node scripts/build.mjs (engine/ came out of these parts; nothing to fetch first)\n node scripts/typecheck.mjs\n node tests/run-all.mjs\n node scripts/deploy.mjs --check (pulls nothing, proves the val matches what you restored)\n node tests/negative-controls.mjs (proves the suite above can actually fail)\n\nIN THIS PART (8 of 129 files)\n scripts/exception-report.mjs 29815 bytes 89c482ec4752\n scripts/make-pdfs.mjs 3426 bytes a0bd60e73eb3\n scripts/make-status-pdf.py 5325 bytes f9e2a1c9b495\n scripts/make_pdf.py 5467 bytes e04360bb178c\n scripts/occupancy-evidence.py 6560 bytes 12d3c046affa\n scripts/restore.mjs 11672 bytes 1f2ef1369633\n scripts/transcript_census_wide.py 9146 bytes 09fd4dbd4d57\n scripts/typecheck.mjs 2737 bytes ada69b4e39fb\n\n================================================================================================\n=====FILE scripts/exception-report.mjs =====\n#!/usr/bin/env node\n// THE WEEKLY SQUARE EXCEPTION REPORT. Generator, 11 Aug 2026.\n//\n// WHAT THIS IS. Promised to Kim in writing (handover/REPLY-TO-KIM-11-AUG.txt, \"I want to add a\n// short weekly list of any Square sale that did not reach a customer record\"). Every run reads the\n// Square-to-GoHighLevel bridge's own journal, asks the bridge which payments never reached a\n// contact using the SAME rule the client was already told about, and writes a CSV plus a short\n// summary. Nothing here is scheduled and nothing here writes to a live system: two GETs to the\n// bridge (the journal dump and the Square detail lookup), both read only, and two local files out.\n//\n// WHY IT DOES NOT HAND-COPY THE MATCHING RULE. The rule that decides \"unmatched\" is\n// engine/facts.ts squareBacklog(). Copying its logic into a second file is exactly how Kim ended up\n// with a wrong number in writing once already: on 9 Aug she was told 42 payments / $33,535.99, a\n// figure that only ever read the FIRST attempt at each payment, when the true count, reading every\n// attempt, is 33 / $22,651.99 (engine/facts.ts:64-69). $10,884.00 of backlog that had already\n// cleared was still being reported as owed. So this script imports the real, current\n// squareBacklog() (via build/facts.js, transpiled fresh from engine/facts.ts on every run, never a\n// stale copy) for the numbers Kim sees, and only re-derives the per-payment LIST locally, because\n// squareBacklog() itself returns totals, not rows. That second derivation is then reconciled\n// against the imported function's totals below and the run refuses to ship if they disagree by so\n// much as a cent or a row (see reconcileOrDie). LESSONS.md #8 asks for exactly this standing check\n// once this report exists: \"reconcile any subset against its parent total before it leaves the\n// building.\" This is that check.\n//\n// WHAT COUNTS AS THE WEEKLY LIST. \"Weekly\" describes the CADENCE this is meant to run on, not a\n// seven day filter on the journal. The list is the entire current backlog, same as the number Kim\n// was quoted, because a payment that missed its match three weeks ago and still has not been fixed\n// is exactly the kind of thing that must not \"age out\" of a list whose whole purpose is that\n// nothing sits unnoticed. LESSONS.md #8 is the same lesson from the other direction: a filter\n// boundary that quietly became \"the\" result understated the backlog to 29 / $19,822 once already.\n// No date filtering happens anywhere in this file.\n//\n// USAGE\n// node scripts/exception-report.mjs\n// ENV OVERRIDES\n// BRIDGE_URL default: read from engine/dashboard.ts\n// BRIDGE_ADMIN required for live mode; never stored in source\n// EXCEPTION_REPORT_OUT_DIR default: /mnt/user-data/outputs\n// EXCEPTION_REPORT_DATE default: today, formatted D-Mon e.g. \"11-Aug\"\n// EXCEPTION_REPORT_JOURNAL_FILE offline mode: read journal JSON from this local file, skip the\n// network fetch entirely (used by tests/manual debugging only)\n\nimport { spawnSync } from \"node:child_process\";\nimport { readFileSync, writeFileSync, mkdirSync, existsSync } from \"node:fs\";\nimport { join, dirname, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\n\nconst HERE = dirname(fileURLToPath(import.meta.url));\nconst ROOT = resolve(HERE, \"..\"); // /home/claude/restore\n\nfunction shout(msg) {\n console.error(`\\n!!!! ${msg} !!!!\\n`);\n}\nfunction die(msg) {\n shout(msg);\n process.exit(1);\n}\n\n// -------------------------------------------------------------------------------------------\n// STEP 0. Rebuild engine/ -> build/, always, before importing anything from it. Copied straight\n// from tests/run-all.mjs's own \"REBUILD FIRST, ALWAYS\" — the incident that rule guards against\n// (6 Aug: real logic deleted from an engine file, suite run without rebuilding, 270 assertions\n// \"passed\" against stale code) is exactly the failure mode a report script must not repeat, because\n// nobody reviews this output as carefully as a red test suite.\n// -------------------------------------------------------------------------------------------\n{\n const b = spawnSync(\"node\", [join(ROOT, \"scripts\", \"build.mjs\")], { encoding: \"utf8\", timeout: 300_000 });\n if (b.status !== 0) {\n die(`BUILD FAILED. Refusing to generate a report against logic that will not even compile.\\n${(b.stdout ?? \"\") + (b.stderr ?? \"\")}`.trim());\n }\n}\n\nconst { squareBacklog, squareSentence } = await import(join(ROOT, \"build\", \"facts.js\"));\nconst { unmatchedPaymentRows, reconcile, cents, paymentUniverse, journalAmount } = await import(join(ROOT, \"scripts\", \"exception-report-lib.mjs\"));\n\n// -------------------------------------------------------------------------------------------\n// STEP 1. Credentials. Secrets are environment-only because the deployed source is public.\n// -------------------------------------------------------------------------------------------\nconst DASHBOARD_TS = process.env.DASHBOARD_TS_PATH || join(ROOT, \"engine\", \"dashboard.ts\");\nif (!existsSync(DASHBOARD_TS)) die(`cannot find ${DASHBOARD_TS}. Restore it before running this report.`);\nconst dashboardSrc = readFileSync(DASHBOARD_TS, \"utf8\");\n\nfunction readConstFrom(text, name) {\n const m = new RegExp(`const\\\\s+${name}\\\\s*=\\\\s*\"([^\"]+)\"`).exec(text);\n return m ? m[1] : null;\n}\n\nconst admin = process.env.BRIDGE_ADMIN || \"\";\nif (admin.length < 24) {\n die(\"BRIDGE_ADMIN is missing or too short. Set the rotated credential in the environment; source fallbacks are forbidden.\");\n}\n\nconst BRIDGE = process.env.BRIDGE_URL || readConstFrom(dashboardSrc, \"BRIDGE\");\nif (!BRIDGE) die(`could not find a BRIDGE literal in ${DASHBOARD_TS}`);\n\n// -------------------------------------------------------------------------------------------\n// STEP 2. Fetch the journal. READ ONLY: a GET on ?dump=1. Zero rows inspected is a hard failure,\n// never an empty success (LESSONS.md #2) — it almost certainly means the fetch broke, not that\n// nothing happened.\n// -------------------------------------------------------------------------------------------\nlet journal;\nconst journalFileOverride = process.env.EXCEPTION_REPORT_JOURNAL_FILE;\nif (journalFileOverride) {\n console.log(`offline mode: reading journal from ${journalFileOverride} instead of the network`);\n journal = JSON.parse(readFileSync(journalFileOverride, \"utf8\"));\n} else {\n const dumpUrl = `${BRIDGE}?dump=1&admin=${encodeURIComponent(admin)}`;\n let res;\n try {\n res = await fetch(dumpUrl);\n } catch (e) {\n die(`journal fetch threw: ${e.message}`);\n }\n if (!res.ok) die(`journal fetch failed: HTTP ${res.status} from ${BRIDGE}?dump=1`);\n journal = await res.json();\n}\n\nif (!Array.isArray(journal)) die(`journal did not come back as an array (got ${typeof journal}). Cannot inspect anything.`);\nif (journal.length === 0) die(`journal came back with ZERO rows. A report that inspects zero rows is a FAILURE, not an empty success. Not writing anything.`);\n\nconst journalTimestamps = journal.map((r) => r?.ts).filter(Boolean).sort();\nconst spanStart = journalTimestamps[0] ?? \"unknown\";\nconst spanEnd = journalTimestamps[journalTimestamps.length - 1] ?? \"unknown\";\nconsole.log(`Inspected ${journal.length} journal rows, spanning ${spanStart} to ${spanEnd}.`);\nif (journal.length < 100) {\n shout(`only ${journal.length} journal rows read; the brief describes roughly 780. This is not a hard failure (the journal legitimately grows or could be pruned) but it is worth a human's eyes before this ships.`);\n}\n\n// -------------------------------------------------------------------------------------------\n// STEP 3. THE NUMBERS KIM SEES: the real, current squareBacklog(), imported, not retyped.\n// -------------------------------------------------------------------------------------------\nconst backlog = squareBacklog(journal);\nif (!backlog) die(\"squareBacklog(journal) returned null even though the journal is a non-empty array. The reconciliation logic itself has changed shape; stop and look before shipping anything.\");\n\n// -------------------------------------------------------------------------------------------\n// STEP 4. THE LIST: a second, independent derivation of the same rule, so this report can name\n// individual payments (squareBacklog() only returns aggregates). unmatchedPaymentRows(), imported\n// from exception-report-lib.mjs above, mirrors engine/facts.ts squareBacklog() lines 72-98 and\n// carries the same MATCHED-LATER GUARD that closes the $10,884 / 9 payment hole documented there\n// and in tests/exception-report.test.mjs.\n// -------------------------------------------------------------------------------------------\nconst rows = unmatchedPaymentRows(journal);\n\n// -------------------------------------------------------------------------------------------\n// STEP 5. RECONCILE OR DIE. The list built above must add up to exactly what the real\n// squareBacklog() says, in count and in every dollar (reconcile(), same lib import). If it does\n// not, something has drifted between the two derivations and this script refuses to ship a number\n// Kim cannot trust. LESSONS.md #8's standing check — a subset plus its remainder equals the\n// parent total — is inside reconcile() too.\n// -------------------------------------------------------------------------------------------\nfunction reconcileOrDie(rows, backlog) {\n const r = reconcile(rows, backlog);\n if (!r.ok) {\n shout(\"RECONCILIATION FAILED. This report does NOT match engine/facts.ts squareBacklog(). Nothing was written.\");\n for (const p of r.problems) console.error(` - ${p}`);\n process.exit(1);\n }\n console.log(`Reconciled: ${rows.length} payments / $${r.listTotal.toFixed(2)} matches squareBacklog() exactly ` +\n `(${backlog.withTrail} with a trail worth $${backlog.withTrailTotal.toFixed(2)}, ${backlog.noTrail} with none worth $${backlog.noTrailTotal.toFixed(2)}).`);\n return r;\n}\n\nreconcileOrDie(rows, backlog);\n\n// -------------------------------------------------------------------------------------------\n// STEP 6. ENRICH each unmatched payment with Square's own detail via the bridge's read only\n// lookup route (?lookup=, capped at 90 ids per call by the bridge itself; chunked here so this\n// still works the week the backlog exceeds that). A lookup failure downgrades that row rather\n// than aborting the run: the count and total already reconciled above and are the part Kim\n// actually needs not to miss.\n// -------------------------------------------------------------------------------------------\nasync function lookupSquareDetails(ids) {\n const out = new Map();\n const failures = [];\n const CHUNK = 90;\n for (let i = 0; i < ids.length; i += CHUNK) {\n const chunk = ids.slice(i, i + CHUNK);\n const url = `${BRIDGE}?lookup=${chunk.map(encodeURIComponent).join(\",\")}&admin=${encodeURIComponent(admin)}`;\n let res;\n try {\n res = await fetch(url);\n } catch (e) {\n shout(`Square lookup request threw for ${chunk.length} payment(s): ${e.message}`);\n failures.push(...chunk);\n continue;\n }\n if (!res.ok) {\n shout(`Square lookup HTTP ${res.status} for ${chunk.length} payment(s). Those rows will ship without Square detail.`);\n failures.push(...chunk);\n continue;\n }\n const body = await res.json();\n for (const r of body.results ?? []) out.set(r.id, r);\n for (const id of chunk) if (!out.has(id)) failures.push(id);\n }\n return { out, failures };\n}\n\n// THE PARENT TOTAL. [Added 12 Aug 2026.] LESSONS.md #8 says a subset may not leave the building\n// without the population it came out of, and until now this report had none: \"33 unlinked\" was\n// quoted against nothing, which is how three wrong versions of it in a row all looked plausible.\n// paymentUniverse() is the same id parser this file already trusts for the subset, applied to\n// every payment the bridge has ever logged, so the two cannot drift.\n//\n// Every payment is looked up in Square, not just the unmatched ones, because the journal does not\n// always carry an amount: PAY-DUP rows have no amount field at all, and five payments worth\n// $1,410.00 live are reachable only through those rows. A parent total summed from the journal\n// alone would understate the population by that much and the subset would look larger than it is.\nconst universe = paymentUniverse(journal);\nconst { out: lookups, failures: lookupFailures } = await lookupSquareDetails([...universe.payments.keys()].sort());\nconsole.log(`Square lookup: ${universe.payments.size - lookupFailures.length} of ${universe.payments.size} payments enriched` +\n (lookupFailures.length ? `, ${lookupFailures.length} FAILED (${lookupFailures.join(\", \")}).` : \".\"));\n\nconst amountOf = (id) => {\n const s = Number(lookups.get(id)?.amount);\n return Number.isFinite(s) ? s : journalAmount(universe.payments.get(id));\n};\nconst universeTotal = [...universe.payments.keys()].reduce((a, id) => a + amountOf(id), 0);\nconst linkedTotal = universe.linked.reduce((a, id) => a + amountOf(id), 0);\nconst unlinkedTotal = universe.unlinked.reduce((a, id) => a + amountOf(id), 0);\n{\n const p = [];\n if (universe.linked.length + universe.unlinked.length !== universe.payments.size) p.push(`linked ${universe.linked.length} + unlinked ${universe.unlinked.length} does not equal the ${universe.payments.size} payments seen`);\n if (cents(linkedTotal + unlinkedTotal) !== cents(universeTotal)) p.push(`linked $${linkedTotal.toFixed(2)} + unlinked $${unlinkedTotal.toFixed(2)} does not equal $${universeTotal.toFixed(2)}`);\n if (universe.unlinked.length !== backlog.payments) p.push(`paymentUniverse() says ${universe.unlinked.length} unlinked, squareBacklog() says ${backlog.payments}`);\n if (cents(unlinkedTotal) !== cents(backlog.total)) p.push(`the unlinked total from Square is $${unlinkedTotal.toFixed(2)} and squareBacklog() says $${backlog.total.toFixed(2)}`);\n if (p.length) {\n shout(\"THE SUBSET DOES NOT RECONCILE AGAINST ITS POPULATION. Nothing was written.\");\n for (const x of p) console.error(` - ${x}`);\n process.exit(1);\n }\n console.log(`Population: ${universe.payments.size} payments $${universeTotal.toFixed(2)} = ${universe.linked.length} linked $${linkedTotal.toFixed(2)} + ${universe.unlinked.length} unlinked $${unlinkedTotal.toFixed(2)}.`);\n}\n\n// Per-payment lookup errors (Square answered the batch but not this one id, e.g. a 404 on that\n// payment) versus payments never asked about are both surfaced the same way in the CSV.\nlet amountMismatches = 0;\nconst enriched = rows.map((row) => {\n const sq = lookups.get(row.paymentId) ?? null;\n const lookupStatus = !sq ? \"not looked up\" : sq.error ? `Square error ${sq.error}` : \"ok\";\n const cust = sq?.square_customer ?? null;\n // Square's own customer records carry stray whitespace on some names (e.g. \"Jonathan \" /\n // \"Jameson \" with trailing spaces baked in) — collapse runs of whitespace rather than pass a\n // double-spaced name through to a client-facing document.\n const name = [cust?.given_name, cust?.family_name].map((s) => (s ?? \"\").trim()).filter(Boolean).join(\" \").replace(/\\s+/g, \" \").trim()\n || (sq?.cardholder_name ?? \"\").trim()\n || null;\n if (sq?.amount != null && cents(sq.amount) !== cents(row.amount)) {\n amountMismatches++;\n shout(`payment ${row.paymentId}: journal amount $${row.amount.toFixed(2)} does not match Square's own amount $${Number(sq.amount).toFixed(2)}. Row is included with the journal figure (the reconciled one); check this one by hand.`);\n }\n const lineItems = (sq?.line_items ?? [])\n .map((li) => `${li?.name ?? \"item not named\"} x${li?.quantity ?? \"?\"}`)\n .join(\"; \");\n // WHAT SQUARE ACTUALLY HOLDS, which is a different question from row.hasTrail.\n // hasTrail is built from hadEmail/hadPhone/hadCustomerId, and those describe the WEBHOOK PAYLOAD\n // the bridge received, not Square's customer record. Live on 12 Aug 2026 they are backwards for\n // two of the four: the payment the flags call unrecoverable is Caroline Riner and Square holds\n // her name and her phone number, while the payment the flags call recoverable carries a Square\n // customer id whose record is empty. This report is what Kim uses to decide which sales are\n // worth chasing, so the column she reads is derived from Square. row.hasTrail is left untouched\n // because reconcile() checks it against squareBacklog()'s own withTrail/noTrail split.\n const holds = [];\n if (name) holds.push(\"a name\");\n if (cust?.phone_number) holds.push(\"a phone number\");\n if (cust?.email_address) holds.push(\"an email address\");\n const whatSquareHolds = holds.length ? holds.join(\", \").replace(/, ([^,]*)$/, \" and $1\") : \"nothing at all\";\n const flagDisagrees = row.hasTrail !== (holds.length > 0);\n return {\n ...row,\n lookupStatus,\n whatSquareHolds,\n squareCanIdentifyThem: holds.length > 0,\n flagDisagrees,\n squareCreatedAt: sq?.created_at ?? null,\n customerName: name,\n customerEmail: cust?.email_address ?? null,\n customerPhone: cust?.phone_number ?? null,\n cardBrand: sq?.card_brand ?? null,\n cardLast4: sq?.last_4 ?? null,\n paymentStatus: sq?.status ?? null,\n lineItems,\n receiptUrl: sq?.receipt_url ?? null,\n receiptNumber: sq?.receipt_number ?? null,\n orderId: sq?.order_id ?? null,\n squareCustomerId: sq?.customer_id ?? cust?.reference_id ?? null,\n };\n});\nif (amountMismatches) shout(`${amountMismatches} payment(s) have a journal amount that disagrees with Square's own amount. See warnings above.`);\n\n// -------------------------------------------------------------------------------------------\n// THE ORDER A FILE CLAIMS IS THE SOURCE'S ORDER, NEVER OURS.\n//\n// unmatchedPaymentRows() returns its rows sorted by the FIRST TIME OUR OWN JOURNAL SAW each\n// payment, which is the right order for a log and the wrong order for a sentence that says \"in\n// the order the payments arrived\". Live proof, 27 July 2026: Square took $1,000.00 at 17:07:42\n// and $795.00 at 17:07:57, and our journal noticed the $795.00 first. This report printed\n// $795.00 above $1,000.00 and told the reader that was the order they arrived in. Fifteen seconds\n// is harmless; the habit is not, because the same claim is made about lists where the order is\n// the whole point. So the list is re-sorted here by Square's own timestamp, falling back to ours\n// only when Square has nothing to say, and the fallback is counted so the sentence below can say\n// which order it is actually in.\nlet orderedBySquare = true;\nfor (const r of enriched) if (!r.squareCreatedAt) orderedBySquare = false;\nenriched.sort((a, b) =>\n String(a.squareCreatedAt ?? a.firstSeen ?? \"\").localeCompare(String(b.squareCreatedAt ?? b.firstSeen ?? \"\")));\n{\n const p = [];\n for (let i = 1; i < enriched.length; i++) {\n const x = String(enriched[i - 1].squareCreatedAt ?? enriched[i - 1].firstSeen ?? \"\");\n const y = String(enriched[i].squareCreatedAt ?? enriched[i].firstSeen ?? \"\");\n if (x > y) p.push(`rows ${i} and ${i + 1} are out of order`);\n }\n if (p.length) { shout(\"THE LIST IS NOT IN THE ORDER IT CLAIMS. Nothing written.\"); p.forEach((x) => console.error(\" - \" + x)); process.exit(1); }\n console.log(`Order check passed: ${enriched.length} rows, oldest first, by ${orderedBySquare ? \"Square's own timestamp\" : \"Square's own timestamp where it has one and ours where it does not\"}.`);\n}\n\nconst namedCount = enriched.filter((r) => r.customerName).length;\nconsole.log(`Of the ${enriched.length}, ${namedCount} came back from Square with a customer name on file.`);\n\n// -------------------------------------------------------------------------------------------\n// STEP 7. WRITE THE CSV. Plain numbers, no currency symbols or thousands separators, so it opens\n// cleanly as data rather than as text. One row per distinct unmatched payment, oldest first.\n// -------------------------------------------------------------------------------------------\nfunction csvField(v) {\n const s = v === null || v === undefined ? \"\" : String(v);\n return /[\",\\n]/.test(s) ? `\"${s.replace(/\"/g, '\"\"')}\"` : s;\n}\nfunction toCsv(headers, records) {\n const lines = [headers.map(csvField).join(\",\")];\n for (const rec of records) lines.push(headers.map((h) => csvField(rec[h])).join(\",\"));\n return lines.join(\"\\n\") + \"\\n\";\n}\n\nconst CSV_HEADERS = [\n \"payment_id\", \"journal_first_seen\", \"journal_last_seen\", \"journal_row_count\",\n \"amount_usd\", \"what_square_holds\", \"square_can_identify_them\",\n // These three describe the webhook payload the bridge received, NOT Square's records, and they\n // are named so nobody reads them as an answer to \"can this sale be placed\". See the comment on\n // whatSquareHolds above: live, they get it backwards for half this list.\n \"journal_flag_called_it_recoverable\", \"had_email_at_ingest\", \"had_phone_at_ingest\", \"had_square_customer_id_at_ingest\",\n \"square_created_at\", \"customer_name\", \"customer_email\", \"customer_phone\",\n \"card_brand\", \"card_last4\", \"payment_status\", \"line_items\",\n \"receipt_url\", \"receipt_number\", \"order_id\", \"square_customer_id\", \"square_lookup_status\",\n];\nconst csvRecords = enriched.map((r) => ({\n payment_id: r.paymentId,\n journal_first_seen: r.firstSeen,\n journal_last_seen: r.lastSeen,\n journal_row_count: r.journalRowCount,\n amount_usd: r.amount.toFixed(2),\n what_square_holds: r.whatSquareHolds,\n square_can_identify_them: r.squareCanIdentifyThem ? \"yes\" : \"no\",\n journal_flag_called_it_recoverable: r.hasTrail ? \"yes\" : \"no\",\n had_email_at_ingest: r.hadEmailAtIngest ? \"yes\" : \"no\",\n had_phone_at_ingest: r.hadPhoneAtIngest ? \"yes\" : \"no\",\n had_square_customer_id_at_ingest: r.hadCustomerIdAtIngest ? \"yes\" : \"no\",\n square_created_at: r.squareCreatedAt,\n customer_name: r.customerName ?? \"(no name on file)\",\n customer_email: r.customerEmail ?? \"\",\n customer_phone: r.customerPhone ?? \"\",\n card_brand: r.cardBrand ?? \"\",\n card_last4: r.cardLast4 ?? \"\",\n payment_status: r.paymentStatus ?? \"\",\n line_items: r.lineItems || \"\",\n receipt_url: r.receiptUrl ?? \"\",\n receipt_number: r.receiptNumber ?? \"\",\n order_id: r.orderId ?? \"\",\n square_customer_id: r.squareCustomerId ?? \"\",\n square_lookup_status: r.lookupStatus,\n}));\nconst csv = toCsv(CSV_HEADERS, csvRecords);\n\n// -------------------------------------------------------------------------------------------\n// STEP 8. WRITE THE SUMMARY. Client safe: US spelling, no dashes as punctuation (hyphens inside a\n// literal product name or a phone number are the only exception, per HANDOFF.md section 10's\n// voice rule), and the word \"daycare\" never appears (she does not offer it; HANDOFF.md section 6\n// and 10 both call this a factual error, not a preference). Both rules are self checked below and\n// the run fails loudly rather than ship copy that breaks either one.\n// -------------------------------------------------------------------------------------------\nconst money = (n) => `$${n.toLocaleString(\"en-US\", { minimumFractionDigits: 2, maximumFractionDigits: 2 })}`;\n\nfunction fmtDate(iso) {\n if (!iso) return \"date unknown\";\n const d = new Date(iso);\n if (Number.isNaN(d.getTime())) return \"date unknown\";\n const months = [\"Jan\", \"Feb\", \"Mar\", \"Apr\", \"May\", \"Jun\", \"Jul\", \"Aug\", \"Sep\", \"Oct\", \"Nov\", \"Dec\"];\n return `${d.getUTCDate()} ${months[d.getUTCMonth()]}`;\n}\n\nconst now = new Date();\nconst dateSuffix = process.env.EXCEPTION_REPORT_DATE ||\n `${now.getUTCDate()}-${[\"Jan\", \"Feb\", \"Mar\", \"Apr\", \"May\", \"Jun\", \"Jul\", \"Aug\", \"Sep\", \"Oct\", \"Nov\", \"Dec\"][now.getUTCMonth()]}`;\n\n// The last column USED to be \"Recoverable\", read straight off r.hasTrail. That column told Kim\n// that Caroline Riner, whose name and phone number are sitting in Square, could not be placed,\n// and that a sale with no name, no email and no phone anywhere could be. It is derived from\n// Square now. See the whatSquareHolds comment in STEP 6.\nconst mdRows = enriched.map((r) => {\n const contact = r.customerEmail || r.customerPhone || \"none on file\";\n return `| ${fmtDate(r.squareCreatedAt || r.firstSeen)} | ${money(r.amount)} | ${r.customerName ?? \"(no name on file)\"} | ${contact} | ${r.whatSquareHolds} |`;\n});\nconst flagsWrong = enriched.filter((r) => r.flagDisagrees);\n\nconst explainer = squareSentence(backlog); // generated straight from the reconciled numbers above\n\nconst mdParts = [];\nmdParts.push(`# Weekly Square exception report, ${dateSuffix}`);\nmdParts.push(\"\");\nmdParts.push(\"Hi Kim,\");\nmdParts.push(\"\");\nmdParts.push(`This is the short weekly list I promised: every Square sale that has not reached a customer record in your CRM. This run read all ${journal.length} rows in the bridge's payment journal, covering ${fmtDate(spanStart)} to ${fmtDate(spanEnd)}, and asked Square directly for the receipt behind each of the ${backlog.payments} unmatched payments it found.`);\nmdParts.push(\"\");\nmdParts.push(explainer);\nmdParts.push(\"\");\nif (backlog.payments > 0) {\n mdParts.push(`Square could put a name to ${namedCount} of the ${backlog.payments}. The full list, oldest first, in the order Square itself took the money${orderedBySquare ? \"\" : \", except where Square has no time recorded and our own is used instead\"}:`);\n mdParts.push(\"\");\n mdParts.push(\"| Date | Amount | Customer | Contact | What Square holds for them |\");\n mdParts.push(\"|---|---|---|---|---|\");\n mdParts.push(...mdRows);\n mdParts.push(\"\");\n mdParts.push(`That last column comes from Square's own customer records, asked just now, one call per payment. An earlier version of this list built it from a flag the card reader sets at the moment of sale, and that flag turns out to describe the message the till sent rather than what Square keeps, so it was wrong about ${flagsWrong.length} of these ${backlog.payments}.`);\n mdParts.push(\"\");\n mdParts.push(`Card details, the Square receipt link and what was rung up for every row are in the attached CSV, ${`exception-report-${dateSuffix}.csv`}.`);\n} else {\n mdParts.push(\"Nothing to list this week. Every Square payment reached a customer record.\");\n}\nmdParts.push(\"\");\nmdParts.push(`Here is the whole population those ${backlog.payments} came out of, so the figure can be checked against something rather than quoted on its own. The bridge has handled ${universe.payments.size} card sales worth ${money(universeTotal)} since it was switched on. ${universe.linked.length} of them worth ${money(linkedTotal)} reached a customer record, and ${universe.unlinked.length} worth ${money(unlinkedTotal)} did not. Those two add back to ${money(universeTotal)} exactly, and the ${money(unlinkedTotal)} is the same figure your CRM engine's own reconciliation logic produces, computed separately and checked against this list row by row.`);\nmdParts.push(\"\");\nmdParts.push(\"Amir\");\nconst md = mdParts.join(\"\\n\") + \"\\n\";\n\n// SELF CHECK: the two client facing rules, enforced mechanically rather than trusted by eye.\n{\n const problems = [];\n if (/daycare/i.test(md)) problems.push('the word \"daycare\" appears in the summary');\n // Dash as punctuation: an em dash, an en dash, or a hyphen with a space on both sides. Table\n // pipes and the markdown header rule \"|---|\" are excluded; phone numbers (E.164, no spaces\n // around the hyphen) and the file's own hyphenated name are the documented exceptions and do\n // not match this pattern because they carry no surrounding space.\n const proseOnly = md.split(\"\\n\").filter((l) => !l.startsWith(\"|\")).join(\"\\n\");\n if (/—|–/.test(proseOnly)) problems.push(\"an em dash or en dash appears in the summary\");\n if (/\\s-\\s/.test(proseOnly)) problems.push('a hyphen is used as punctuation (surrounded by spaces) in the summary');\n if (problems.length) {\n shout(\"CLIENT-SAFE COPY CHECK FAILED. Not writing the summary.\");\n for (const p of problems) console.error(` - ${p}`);\n process.exit(1);\n }\n console.log(\"Client-safe copy check passed: no dashes as punctuation, no \\\"daycare\\\".\");\n}\n\n// -------------------------------------------------------------------------------------------\n// STEP 9. WRITE THE FILES.\n// -------------------------------------------------------------------------------------------\n// NOT A CLIENT FILE ANY MORE, 12 Aug 2026. This report and the counter sales pack were two\n// documents about the same four payments, sent together, and the second one pointed at a\n// companion CSV that was not even in the send. Duplicate documents about one thing are the exact\n// confusion the client was apologised to for. The internal weekly report stays, because the\n// reconciliation it runs against engine/facts.ts squareBacklog() is worth having; it writes to the\n// repo, and the file the client reads is Counter-sales-with-no-customer.csv, built by\n// scripts/counter-sales-correction.mjs in the same run as everything else she is sent.\nconst OUT_DIR = process.env.EXCEPTION_REPORT_OUT_DIR || join(ROOT, \"reports\");\nif (OUT_DIR === \"/mnt/user-data/outputs\") {\n shout(\"this report is internal and must not be written into the client's folder. Unset EXCEPTION_REPORT_OUT_DIR.\");\n process.exit(1);\n}\nmkdirSync(OUT_DIR, { recursive: true });\nconst csvPath = join(OUT_DIR, `exception-report-${dateSuffix}.csv`);\nconst mdPath = join(OUT_DIR, `exception-report-${dateSuffix}.md`);\nwriteFileSync(csvPath, csv);\nwriteFileSync(mdPath, md);\n\nconsole.log(\"\");\nconsole.log(`Wrote ${csvPath} (${csvRecords.length} data rows)`);\nconsole.log(`Wrote ${mdPath}`);\nconsole.log(\"\");\nconsole.log(`SUMMARY: ${backlog.payments} unmatched payments totaling ${money(backlog.total)} as of ${new Date().toISOString()}.`);\nconsole.log(` ${backlog.withTrail} with a trail worth ${money(backlog.withTrailTotal)}; ${backlog.noTrail} with none worth ${money(backlog.noTrailTotal)}.`);\nconsole.log(` Reconciled against engine/facts.ts squareBacklog() exactly. ${journal.length} journal rows inspected.`);\n\n\n=====FILE scripts/make-pdfs.mjs =====\n// REBUILD THE CLIENT PDFs, end to end, from the live message set.\n//\n// WHY THIS EXISTS. The container was reclaimed twice in two days. The second time, everything\n// restored from the bundle except `handover/TheDogsSpot-First3Weeks.pdf`, and the cross-artifact\n// suite went red because a live fact in the claims registry is that PDF's page count. Binaries are\n// not in the bundle and should not be: they are DERIVED, and a backup of a derived artifact is a\n// backup of the wrong thing.\n//\n// What was actually missing was this file. `scripts/make_pdf.py` reads `/tmp/msgs.json`, in a\n// shape it never documents — an object keyed by track, not the flat array you would naturally\n// write — and that shape lived only in my head. First attempt at regenerating after the reclaim\n// produced `'list' object has no attribute 'get'`.\n//\n// Run: node scripts/make-pdfs.mjs\nimport { writeFileSync, existsSync } from \"node:fs\";\nimport { spawnSync } from \"node:child_process\";\nimport { join, dirname, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\n\nconst ROOT = resolve(dirname(fileURLToPath(import.meta.url)), \"..\");\nconst TRACKS = [\"MAIN_SEQUENCE\", \"BRANCH_A\", \"BRANCH_B\", \"SLOW_WEEKLY\", \"SLOW_FORTNIGHTLY\", \"SLOW_MONTHLY_BANK\"];\n\nif (!existsSync(join(ROOT, \"build/engine.js\"))) {\n console.log(\"build/engine.js is missing. Run: node scripts/build.mjs\");\n process.exit(1);\n}\nconst E = await import(join(ROOT, \"build/engine.js\"));\n\n// THE SHAPE make_pdf.py EXPECTS: an object keyed by track name, each value an array of messages.\nconst byTrack = {};\nfor (const k of TRACKS) byTrack[k] = E[k] ?? [];\nconst total = Object.values(byTrack).reduce((a, v) => a + v.length, 0);\nif (!total) { console.log(\"no messages found in build/engine.js: refusing to build an empty PDF\"); process.exit(1); }\nwriteFileSync(\"/tmp/msgs.json\", JSON.stringify(byTrack));\nconsole.log(`${total} messages: ${Object.entries(byTrack).map(([k, v]) => `${k}=${v.length}`).join(\" \")}`);\n\n// The claims registry states these page counts as LIVE facts about the documents Kim was sent, so\n// a rebuild that changes them is a real change and the cross-artifact suite will say so.\nconst EXPECTED = { \"TheDogsSpot-First3Weeks.pdf\": 6, \"TheDogsSpot-AllMessages.pdf\": 14 };\n\nlet bad = 0;\nfor (const [arg, name] of [[\"short\", \"TheDogsSpot-First3Weeks.pdf\"], [null, \"TheDogsSpot-AllMessages.pdf\"]]) {\n const r = spawnSync(\"python3\", [join(ROOT, \"scripts/make_pdf.py\"), ...(arg ? [arg] : [])],\n { encoding: \"utf8\", cwd: ROOT });\n if (r.status !== 0) { console.log(`FAILED ${name}:\\n${(r.stdout + r.stderr).trim().slice(0, 500)}`); bad++; continue; }\n // Page count without a PDF library, the same way the claims registry counts them.\n const buf = (await import(\"node:fs\")).readFileSync(join(ROOT, \"handover\", name)).toString(\"latin1\");\n const pages = (buf.match(/\\/Type\\s*\\/Page[^s]/g) || []).length;\n const want = EXPECTED[name];\n const ok = pages === want;\n if (!ok) bad++;\n console.log(`${ok ? \"ok \" : \"PAGE COUNT CHANGED\"} ${name} ${pages} pages${ok ? \"\" : ` (the message Kim already has says ${want})`}`);\n}\nif (bad) {\n console.log(\"\\nA page count that has moved is not automatically wrong, but Kim was told a number.\");\n console.log(\"Either put the copy back, or update tests/claims-registry.mjs and say so in the next message.\");\n process.exit(1);\n}\nconsole.log(\"\\nboth PDFs rebuilt, page counts match what Kim was told\");\n\n\n\n=====FILE scripts/make-status-pdf.py =====\n\"\"\"Build the client-facing PDFs from a markdown-ish source.\n\nHouse style, matched to scripts/make_pdf.py so Kim's documents look like one family:\nHelvetica, sentence-case headings (never all-caps — she flagged that on 14 Aug), blue\nlabels, grey notes. Tables get thin grey rules and a light header row.\n\nSource format, one block per line-group:\n # Title -> H1 (once, first line)\n > subtitle -> SUB, the grey line under the title\n ## Heading -> H2\n | a | b | c | -> table row (consecutive rows become one table; first is the header)\n - text -> bullet\n ! text -> callout box (the things she must not miss)\n ~ text -> small grey note\n anything else -> body paragraph. **bold** works everywhere.\n\nRun: python3 scripts/make-status-pdf.py SOURCE.md OUT.pdf\n\"\"\"\nimport re, sys\nfrom reportlab.lib.pagesizes import LETTER\nfrom reportlab.lib.styles import getSampleStyleSheet, ParagraphStyle\nfrom reportlab.lib.units import inch\nfrom reportlab.lib import colors\nfrom reportlab.lib.enums import TA_LEFT\nfrom reportlab.platypus import (SimpleDocTemplate, Paragraph, Spacer, HRFlowable,\n Table, TableStyle, KeepTogether)\n\nsrc, out = sys.argv[1], sys.argv[2]\nss = getSampleStyleSheet()\nINK, GREY, BLUE = colors.HexColor('#111111'), colors.HexColor('#5a5a5a'), colors.HexColor('#2a78d6')\nH1 = ParagraphStyle('H1', parent=ss['Title'], fontName='Helvetica-Bold', fontSize=19, leading=23,\n alignment=TA_LEFT, spaceAfter=3, textColor=INK)\nSUB = ParagraphStyle('SUB', parent=ss['Normal'], fontSize=10, leading=14, textColor=GREY, spaceAfter=13)\nH2 = ParagraphStyle('H2', parent=ss['Heading2'], fontName='Helvetica-Bold', fontSize=13, leading=16,\n spaceBefore=15, spaceAfter=5, textColor=INK)\nBODY = ParagraphStyle('BODY', parent=ss['Normal'], fontSize=10, leading=14.5, spaceAfter=6)\nBULL = ParagraphStyle('BULL', parent=BODY, leftIndent=14, bulletIndent=3, spaceAfter=3)\nNOTE = ParagraphStyle('NOTE', parent=ss['Normal'], fontSize=9, leading=12.5, textColor=GREY, spaceAfter=9)\nCELL = ParagraphStyle('CELL', parent=ss['Normal'], fontSize=9, leading=12)\nCELLB = ParagraphStyle('CELLB', parent=CELL, fontName='Helvetica-Bold')\nCALL = ParagraphStyle('CALL', parent=BODY, fontSize=10, leading=14.5, leftIndent=9, rightIndent=9,\n spaceBefore=3, spaceAfter=3)\n\nesc = lambda t: t.replace('&', '&').replace('<', '<').replace('>', '>')\nfmt = lambda t: re.sub(r'\\*\\*(.+?)\\*\\*', r'\\1', esc(t))\n\ndef table(rows):\n head, body = rows[0], rows[1:]\n data = [[Paragraph(fmt(c), CELLB) for c in head]] + \\\n [[Paragraph(fmt(c), CELL) for c in r] for r in body]\n n = len(head)\n w = {2: [2.5, 4.2], 3: [2.0, 1.5, 3.2], 4: [1.7, 1.2, 1.6, 2.2], 5: [1.5, 1.0, 1.2, 1.2, 1.8]}.get(n)\n t = Table(data, colWidths=[x * inch for x in w] if w else None, repeatRows=1, hAlign='LEFT')\n t.setStyle(TableStyle([\n ('BACKGROUND', (0, 0), (-1, 0), colors.HexColor('#f2f5f8')),\n ('LINEBELOW', (0, 0), (-1, 0), 0.7, colors.HexColor('#c8d2dc')),\n ('LINEBELOW', (0, 1), (-1, -2), 0.35, colors.HexColor('#e4e4e4')),\n ('VALIGN', (0, 0), (-1, -1), 'TOP'),\n ('LEFTPADDING', (0, 0), (-1, -1), 6), ('RIGHTPADDING', (0, 0), (-1, -1), 6),\n ('TOPPADDING', (0, 0), (-1, -1), 5), ('BOTTOMPADDING', (0, 0), (-1, -1), 5),\n ]))\n return t\n\nflow, pending, first = [], [], True\ndef flush():\n if pending:\n flow.append(table(pending)); flow.append(Spacer(1, 9)); pending.clear()\n\nfor raw in open(src, encoding='utf-8').read().split('\\n'):\n line = raw.rstrip()\n if line.startswith('|'):\n pending.append([c.strip() for c in line.strip('|').split('|')]); continue\n flush()\n if not line.strip():\n continue\n if line.startswith('# '):\n flow.append(Paragraph(fmt(line[2:]), H1)); first = False\n elif line.startswith('> '):\n flow.append(Paragraph(fmt(line[2:]), SUB))\n flow.append(HRFlowable(width=\"100%\", thickness=0.6, color=colors.HexColor('#dddddd'), spaceAfter=6))\n elif line.startswith('## '):\n flow.append(Paragraph(fmt(line[3:]), H2))\n elif line.startswith('- '):\n flow.append(Paragraph(fmt(line[2:]), BULL, bulletText='•'))\n elif line.startswith('! '):\n box = Table([[Paragraph(fmt(line[2:]), CALL)]], colWidths=[6.7 * inch], hAlign='LEFT')\n box.setStyle(TableStyle([\n ('BACKGROUND', (0, 0), (-1, -1), colors.HexColor('#fdf6e6')),\n ('LINEBEFORE', (0, 0), (0, -1), 2.2, colors.HexColor('#e0a63c')),\n ('LEFTPADDING', (0, 0), (-1, -1), 10), ('RIGHTPADDING', (0, 0), (-1, -1), 10),\n ('TOPPADDING', (0, 0), (-1, -1), 8), ('BOTTOMPADDING', (0, 0), (-1, -1), 8)]))\n flow.append(box); flow.append(Spacer(1, 9))\n elif line.startswith('~ '):\n flow.append(Paragraph(fmt(line[2:]), NOTE))\n else:\n flow.append(Paragraph(fmt(line), BODY))\nflush()\n\nSimpleDocTemplate(out, pagesize=LETTER, leftMargin=0.85 * inch, rightMargin=0.85 * inch,\n topMargin=0.8 * inch, bottomMargin=0.8 * inch,\n title=flow[0].text if flow else out, author='Amir Aizhigitov').build(flow)\n\nfrom pypdf import PdfReader\nprint(f\"ok {out} {len(PdfReader(out).pages)} pages\")\n\n\n=====FILE scripts/make_pdf.py =====\nimport json, re, sys\nfrom reportlab.lib.pagesizes import LETTER\nfrom reportlab.lib.styles import getSampleStyleSheet, ParagraphStyle\nfrom reportlab.lib.units import inch\nfrom reportlab.lib import colors\nfrom reportlab.platypus import SimpleDocTemplate, Paragraph, Spacer, HRFlowable, KeepTogether\nfrom reportlab.lib.enums import TA_LEFT\n\nD = json.load(open('/tmp/msgs.json'))\nSHORT = len(sys.argv) > 1 and sys.argv[1] == \"short\"\nss = getSampleStyleSheet()\nH1 = ParagraphStyle('H1', parent=ss['Title'], fontName='Helvetica-Bold', fontSize=19, leading=23, alignment=TA_LEFT, spaceAfter=3, textColor=colors.HexColor('#111111'))\nSUB = ParagraphStyle('SUB', parent=ss['Normal'], fontSize=10, leading=14, textColor=colors.HexColor('#5a5a5a'), spaceAfter=13)\nH2 = ParagraphStyle('H2', parent=ss['Heading2'], fontName='Helvetica-Bold', fontSize=13, leading=16, spaceBefore=15, spaceAfter=5, textColor=colors.HexColor('#111111'))\nLBL = ParagraphStyle('LBL', parent=ss['Normal'], fontName='Helvetica-Bold', fontSize=9, leading=12, textColor=colors.HexColor('#2a78d6'), spaceAfter=1)\nSUBJ= ParagraphStyle('SUBJ', parent=ss['Normal'], fontName='Helvetica-Bold', fontSize=10.5, leading=14, spaceAfter=3)\nBODY= ParagraphStyle('BODY', parent=ss['Normal'], fontSize=10, leading=14.5, spaceAfter=6)\nNOTE= ParagraphStyle('NOTE', parent=ss['Normal'], fontSize=9, leading=12.5, textColor=colors.HexColor('#5a5a5a'), spaceAfter=9)\n\nesc = lambda t: t.replace('&','&').replace('<','<').replace('>','>')\ndef fmt(t):\n t = esc(t)\n t = re.sub(r'\\{\\{STORY:[^}]+\\}\\}\\s*', '', t)\n t = t.replace('{{FIRST_NAME}}', '[their name]')\n return re.sub(r'\\*\\*(.+?)\\*\\*', r'\\1', t)\nday = lambda m: round(m.get('offsetHours', 0) / 24)\n\nflow = [Paragraph(\"The Dogs Spot: the first three weeks\" if SHORT else \"The Dogs Spot: every follow-up message\", H1),\n Paragraph(\"Every word below was read out of the running system, not retyped from a draft, so what you read is exactly what would send. Everything you sent over is in it: the puppy-name placeholder is gone from every message, the American wording is fixed throughout, the service you do not offer is no longer mentioned anywhere, and both of the missed-Pup-Talk messages are now your rewrite rather than mine. The Touch numbers restart at 1 in each part below.\", SUB),\n HRFlowable(width=\"100%\", thickness=0.6, color=colors.HexColor('#dddddd'), spaceAfter=4)]\n\nSEC = [(\"The first 21 days\",\"MAIN_SEQUENCE\",\"Eight messages over three weeks, counted the way you read them: Touch 1 is the first thing a customer receives. Later parts start their own count again.\"),\n (\"If they book a Pup Talk and do not show\",\"BRANCH_A\",\"Two messages. Both are your rewrite, word for word.\"),\n (\"After a Pup Talk that did not turn into a booking\",\"BRANCH_B\",\"Two messages. No pressure in either.\")]\nif not SHORT:\n SEC += [(\"Then weekly for a month\",\"SLOW_WEEKLY\",\"Four messages. No asks on any of them.\"),\n (\"Then every two weeks for six months\",\"SLOW_FORTNIGHTLY\",\"Thirteen messages.\"),\n (\"Then monthly, indefinitely\",\"SLOW_MONTHLY_BANK\",\"Twelve messages, one a month, seasonal where it fits. These repeat each year.\")]\n\nfor title, key, blurb in SEC:\n flow += [Paragraph(title, H2), Paragraph(blurb, NOTE)]\n for i, m in enumerate(D.get(key, []), 1):\n parts = [Paragraph(f\"TOUCH {i} · {'TEXT MESSAGE' if m['channel']=='sms' else 'EMAIL'} · {'day ' + str(day(m)) if key=='MAIN_SEQUENCE' else ('monthly slot ' + str(i) + ' of 12' if key=='SLOW_MONTHLY_BANK' else '+' + str(day(m)) + ' days')}\", LBL)]\n if m.get('subject'): parts.append(Paragraph(\"Subject: \" + fmt(m['subject']), SUBJ))\n for para in [p for p in re.split(r'\\n\\s*\\n', m['bodyTemplate']) if p.strip()]:\n parts.append(Paragraph(fmt(para).replace('\\n','
'), BODY))\n if m['channel'] == 'sms': parts.append(Paragraph(\"Every text ends with: Reply STOP to stop these texts.\", NOTE))\n parts.append(HRFlowable(width=\"100%\", thickness=0.4, color=colors.HexColor('#eeeeee'), spaceAfter=6))\n flow.append(KeepTogether(parts))\n\nif SHORT:\n flow += [Paragraph(\"What happens after these three weeks\", H2),\n Paragraph(\"The slow track picks up: weekly for a month, then every two weeks for six months, then one a month from there on, cycling the same twelve seasonal ones year after year. That is in the companion document if you want it, and nothing about it changed.\", BODY)]\nflow.append(Paragraph(\"The rules that run underneath all of it\", H2))\nfor line in [\"Anyone who replies comes off the track immediately and gets a person instead.\",\n \"Anyone who books comes off the track.\",\n \"Anyone who texts STOP never hears from the system again, on any track.\",\n \"Nothing sends late at night, and no texts on a Sunday.\",\n \"Nothing has sent to anybody yet. The whole thing is in practice mode until you say the word.\"]:\n flow.append(Paragraph(\"• \" + esc(line), BODY))\n\nout = \"handover/TheDogsSpot-First3Weeks.pdf\" if SHORT else \"handover/TheDogsSpot-AllMessages.pdf\"\nSimpleDocTemplate(out, pagesize=LETTER, leftMargin=0.85*inch, rightMargin=0.85*inch, topMargin=0.7*inch, bottomMargin=0.7*inch,\n title=(\"The Dogs Spot: the first three weeks\" if SHORT else \"The Dogs Spot: every follow-up message\"), author=\"Amir Aizhigitov\").build(flow)\nprint(\"built\", out)\n\n\n\n=====FILE scripts/occupancy-evidence.py =====\nfrom reportlab.lib.pagesizes import A4\nfrom reportlab.lib.styles import getSampleStyleSheet, ParagraphStyle\nfrom reportlab.lib.units import mm\nfrom reportlab.lib import colors\nfrom reportlab.platypus import SimpleDocTemplate, Paragraph, Spacer, Table, TableStyle, KeepTogether\n\nOUT = \"/mnt/user-data/outputs/OCCUPANCY-EVIDENCE-10-Aug.pdf\"\nss = getSampleStyleSheet()\nINK = colors.HexColor(\"#14171a\"); MUT = colors.HexColor(\"#5b6570\")\nACC = colors.HexColor(\"#1c5d99\"); RED = colors.HexColor(\"#b3261e\")\n\nH1 = ParagraphStyle(\"H1\", parent=ss[\"Normal\"], fontName=\"Helvetica-Bold\", fontSize=16, leading=19, textColor=INK, spaceAfter=1)\nSUB = ParagraphStyle(\"SUB\", parent=ss[\"Normal\"], fontName=\"Helvetica\", fontSize=9, leading=12, textColor=MUT, spaceAfter=10)\nS = ParagraphStyle(\"S\", parent=ss[\"Normal\"], fontName=\"Helvetica-Bold\", fontSize=11.5, leading=14, textColor=ACC, spaceBefore=11, spaceAfter=4)\nB = ParagraphStyle(\"B\", parent=ss[\"Normal\"], fontName=\"Helvetica\", fontSize=9.2, leading=12.3, textColor=INK, spaceAfter=4)\nLI = ParagraphStyle(\"LI\", parent=B, leftIndent=11, spaceAfter=2.5)\nBIG = ParagraphStyle(\"BIG\", parent=ss[\"Normal\"], fontName=\"Helvetica-Bold\", fontSize=12.5, leading=15, textColor=RED, spaceAfter=5)\nCELL = ParagraphStyle(\"CELL\", parent=ss[\"Normal\"], fontName=\"Helvetica\", fontSize=8.6, leading=11.2, textColor=INK)\nKEY = ParagraphStyle(\"KEY\", parent=CELL, fontName=\"Helvetica-Bold\")\n\nst = []\ndef sec(t): st.append(Paragraph(t, S))\ndef p(t, s=B): st.append(Paragraph(t, s))\ndef bl(items):\n for t in items: st.append(Paragraph(\"•\" + t, LI))\ndef box(rows, widths, head=None):\n data = [[Paragraph(c, KEY if i == 0 else CELL) for i, c in enumerate(r)] for r in rows]\n if head: data = [[Paragraph(h, KEY) for h in head]] + data\n t = Table(data, colWidths=widths)\n style = [(\"FONT\",(0,0),(-1,-1),\"Helvetica\",8.6),(\"VALIGN\",(0,0),(-1,-1),\"TOP\"),\n (\"BOTTOMPADDING\",(0,0),(-1,-1),4),(\"TOPPADDING\",(0,0),(-1,-1),4),\n (\"LINEBELOW\",(0,0),(-1,-2),0.4,colors.HexColor(\"#dfe4e9\"))]\n if head: style += [(\"TEXTCOLOR\",(0,0),(-1,0),MUT),(\"LINEBELOW\",(0,0),(-1,0),0.8,colors.HexColor(\"#b9c2cb\"))]\n t.setStyle(TableStyle(style)); st.append(t)\n\np(\"Occupancy: the two systems, read side by side\", H1)\np(\"Both read on Sunday 9 August 2026 within twenty minutes of each other. Every figure below is a \"\n \"screen reading, not a calculation of mine. Prepared for the 11:00 acceptance meeting.\", SUB)\n\nsec(\"The headline\")\np(\"Kristian's application says 171 dogs are in the building today. Milton's booking portal says 24. \"\n \"The kennel list in Milton's portal totals 50 kennels.\", BIG)\np(\"171 dogs cannot be in a fifty kennel facility. This is not a discrepancy to reconcile, it is \"\n \"a number that cannot be true.\")\n\nsec(\"Side by side\")\nbox([\n [\"In house today\", \"24\", \"171\", \"7.1x over\"],\n [\"Boarding\", \"11\", \"137\", \"12.5x over\"],\n [\"Board and train / boot camp\", \"13\", \"34\", \"2.6x over\"],\n [\"Arriving today\", \"0\", \"not shown\", \"\"],\n [\"Departing today\", \"0\", \"not shown\", \"\"],\n [\"Booked for tomorrow\", \"dogs booked out to 18 Sep\", \"0\", \"wrong the other way\"],\n [\"Peak next 7 days\", \"at least 24, nobody departs before 10 Aug\", \"0\", \"wrong the other way\"],\n [\"Kennel capacity\", \"50 (20 regular, 10 small, 20 special needs)\", \"not shown\", \"\"],\n], [46*mm, 52*mm, 40*mm, 30*mm], head=[\"\", \"Milton's portal\", \"Kristian's app\", \"\"])\np(\"Milton's portal read at 21:29 UK, its own footer showing \\\"Synced 9:29 PM\\\". Kristian's application \"\n \"read at 22:09 UK, twenty minutes later.\", SUB)\n\nsec(\"The excuse that is now closed off\")\np(\"Earlier this evening his dashboard carried a red error: \\\"Last attempt failed: GHL contacts API \"\n \"error 401: Invalid Private Integration token\\\", stamped 1:40 PM. His integration record in the CRM \"\n \"was renamed from APP v2 to APP v3 and updated at 6:48 PM, so the token was reissued.\")\np(\"At 21:09 the same dashboard reads \\\"Last GHL sync: Aug 9, 5:00 PM. Last attempt: success.\\\" And it \"\n \"still says 171. The sync is healthy and the number is still seven times reality. Whatever is wrong \"\n \"is not the connection.\")\n\nsec(\"What is actually wrong, in one sentence\")\np(\"The application counts every stay that was ever opened and never closed. Milton's portal shows the \"\n \"oldest dog in house arrived on 6 July and is not due out until 14 August, and it shows zero arrivals \"\n \"and zero departures today. Kristian's app shows 171 today and 0 tomorrow, which is the exact signature \"\n \"of a system that accumulates historical rows into \\\"today\\\" and has nothing at all in the future.\")\np(\"His own ChangeLog claims the opposite in four places: pickup linked to originating stay, pickup \"\n \"calendars do not create independent occupancy rows, multi day stays preserved through departure, and \"\n \"active stay and dashboard semantics aligned.\")\n\nsec(\"Kim's own examples, confirmed in Milton's portal\")\nbox([\n [\"Gina Wright\", \"Kristian's app returned \\\"No bookings found\\\". Milton's portal has both her dogs: \"\n \"Rudy, 5 Aug to 11 Aug, kennel R-01, Non Graduate, confirmed; and Raven, 5 Aug to 11 Aug, \"\n \"kennel R-03, Graduated, confirmed. Paired drop off and pick up, named kennels, one line each.\"],\n [\"George Fitzgerald\", \"The customer from the Chloe calls. Huey is in kennel R-13, 7 Aug to 10 Aug, \"\n \"confirmed. Chloe asked him whether he was a first time customer.\"],\n], [30*mm, 138*mm])\n\nsec(\"Questions this puts on the table\")\nbl([\n \"The sync now reports success. Why does the dashboard still say 171?\",\n \"How is a number larger than the kennel capacity being displayed at all? What is the upper bound check?\",\n \"Why is tomorrow zero when Milton's portal has dogs booked through to 18 September?\",\n \"The ChangeLog states multi day stays are preserved through departure. Which line of code does that, and \"\n \"when did it last run?\",\n \"Milton's portal knows this correctly today. What does it do that the new application does not?\",\n])\n\nsec(\"The recommendation\")\np(\"Do not accept the occupancy or dashboard items. They are not close. Milton's portal stays the \"\n \"operational source of truth until Kristian's screen matches it every day for a full week, checked \"\n \"daily against the same two readings above. That check takes two minutes a day and it is the only \"\n \"honest gate on switching over.\")\n\nSimpleDocTemplate(OUT, pagesize=A4, leftMargin=18*mm, rightMargin=18*mm, topMargin=15*mm,\n bottomMargin=13*mm, title=\"Occupancy evidence, 9 August 2026\").build(st)\nprint(\"wrote\", OUT)\n\n\n\n=====FILE scripts/restore.mjs =====\n// RESTORE. Rebuild this whole repo from the val, from an empty folder, with one command.\n//\n// WHY THIS EXISTS. The container has now been reclaimed and reverted to an older snapshot four\n// times. Every time, the recovery is the same three steps and every time they are done from\n// memory. On 6 August I did step one wrong: I fetched all nine SOURCE-BUNDLE parts, concatenated\n// them, and split the result on the file marker. Each part carries its own header block, so that\n// header ended up glued onto the end of the previous part's last file. Five suites came back with\n// \"SyntaxError: Unexpected identifier 'DOGS'\" — the bundle's own title text, sitting inside a test\n// file. The bundle's embedded instructions said to run the split PER PART. They were right; I did\n// not read them.\n//\n// So the procedure is a file now, not a memory:\n// 1. EVERY source file comes out of the SOURCE-BUNDLE parts, ONE PART AT A TIME. engine/ is in\n// the bundle since 14 Aug 2026; see the note at the top of scripts/bundle.mjs for what it\n// cost to find out that \"the val holds the engine\" was true of all but one file.\n// 2. the deployed engine files are then re-read from the val itself, through the API (not\n// esm.town, which prepends a pragma comment and breaks every hash), as the authoritative copy\n// of what is actually running. Anything the val does not hold stays as the bundle restored it.\n// 3. the two PDFs are DERIVED and are rebuilt from their recipe, never restored\n//\n// Usage: node scripts/restore.mjs (restores everything)\n// node scripts/restore.mjs --check (restores to a temp dir and diffs, changes nothing)\nimport { writeFileSync, mkdirSync, existsSync, readFileSync } from \"node:fs\";\nimport { spawnSync } from \"node:child_process\";\nimport { join, dirname, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\n\nconst ROOT = resolve(dirname(fileURLToPath(import.meta.url)), \"..\");\nconst VAL = \"1bfa6e81-74e1-4c6c-ab32-118304a4ffff\";\nconst TOKEN = process.env.VALTOWN_TOKEN || readTokenFromDeploy();\n// main.ts on the val is puppy_path_v1.1.ts here; every other engine file keeps its name.\nconst RENAMED = { \"main.ts\": \"puppy_path_v1.1.ts\" };\n\nfunction readTokenFromDeploy() {\n try { return (readFileSync(join(ROOT, \"scripts/deploy.mjs\"), \"utf8\").match(/vtwn_[A-Za-z0-9]+/) || [])[0]; }\n catch { return undefined; }\n}\nconst H = { Authorization: `Bearer ${TOKEN}`, \"Cache-Control\": \"no-cache\" };\nconst out = (p) => (CHECK ? join(TMP, p) : join(ROOT, p));\nconst CHECK = process.argv.includes(\"--check\");\nconst TMP = join(ROOT, \".restore-check\");\n\nasync function get(path) {\n const r = await fetch(`https://api.val.town/v2/vals/${VAL}/files/content?path=${encodeURIComponent(path)}`, { headers: H });\n if (!r.ok) throw new Error(`${path}: HTTP ${r.status}`);\n return r.text();\n}\n\nif (!TOKEN) { console.log(\"RESTORE FAILED: no val.town token. Set VALTOWN_TOKEN.\"); process.exit(1); }\n\n/** Every file on the val, PAGED. A one page listing is a cap wearing a different hat. */\nasync function listVal() {\n const all = [];\n for (let offset = 0, guard = 0; guard < 20; guard++, offset += 100) {\n const r = await fetch(`https://api.val.town/v2/vals/${VAL}/files?path=&recursive=true&limit=100&offset=${offset}`, { headers: H });\n if (!r.ok) throw new Error(`listing the val: HTTP ${r.status}`);\n const page = (await r.json()).data ?? [];\n all.push(...page);\n if (page.length < 100) break;\n }\n return all;\n}\n\nconst valFiles = await listVal();\n\nlet files = 0;\nconst pending = new Map();\n// ---- 1. the bundle, ONE PART AT A TIME. This is the step that goes wrong. ------------------\n//\n// HOW MANY PARTS THERE ARE IS ASKED, NEVER COUNTED TO.\n// [was: `for (let i = 1; i <= 20; i++)`, breaking on the first part that 404s. A guess that was\n// right when the bundle was nine parts and quietly wrong from the day it passed twenty. On\n// 14 Aug 2026 the val held 23 parts and this loop read 20 of them, restored a tree missing\n// three parts' worth of files, and printed two cheerful counts underneath it. Then engine/\n// joined the bundle and it became 35. A recovery script that silently restores most of the\n// backup is the same failure as a backup that silently drops a directory, one step later.]\nconst partNo = (p) => Number((/\\.part(\\d+)\\.txt$/.exec(p) ?? [])[1] ?? 1);\nconst partNames = valFiles\n .map((f) => f.path)\n .filter((p) => /^SOURCE-BUNDLE(\\.part\\d+)?\\.txt$/.test(p))\n .sort((a, b) => partNo(a) - partNo(b));\nif (!partNames.length) { console.log(\"RESTORE FAILED: no SOURCE-BUNDLE on the val.\"); process.exit(1); }\n// AND THEY HAVE TO BE CONTIGUOUS. A missing part in the middle is a hole in the backup, and the\n// files in it are gone whether or not anything says so.\n{\n const nums = partNames.map(partNo);\n const holes = [];\n for (let i = 1; i <= Math.max(...nums); i++) if (!nums.includes(i)) holes.push(i);\n if (holes.length) {\n console.log(`RESTORE FAILED: the bundle on the val is missing part(s) ${holes.join(\", \")} of ${Math.max(...nums)}.`);\n console.log(\"Every part carries whole files, so a missing part is a set of files that will not come back.\");\n process.exit(1);\n }\n}\nconsole.log(`the val holds ${partNames.length} bundle part(s); reading every one of them, one at a time`);\nfor (const name of partNames) {\n const body = await get(name);\n for (const chunk of body.split(\"\\n=====FILE \").slice(1)) {\n const j = chunk.indexOf(\" =====\\n\");\n const name = chunk.slice(0, j);\n const content = chunk.slice(j + 7).replace(/\\n$/, \"\");\n // A record named \"#1\", \"#2\", ... is one FILE cut into pieces because it is bigger than\n // a bundle part. They are appended in the order the parts are read, which is the order they\n // were written. negative-controls.mjs passed the val's own 80,000-character per-file ceiling\n // on 6 August and the bundle could not be written at all until this existed.\n const m = /^(.*)#(\\d+)$/.exec(name);\n if (m) { pending.set(m[1], (pending.get(m[1]) ?? \"\") + content); continue; }\n const dest = out(name);\n mkdirSync(dirname(dest), { recursive: true });\n writeFileSync(dest, content);\n files++;\n }\n}\nfor (const [name, content] of pending) {\n const dest = out(name);\n mkdirSync(dirname(dest), { recursive: true });\n writeFileSync(dest, content);\n files++;\n}\nconsole.log(`restored ${files} files from the bundle${pending.size ? ` (${pending.size} rejoined from chunks)` : \"\"}`);\n\n// ---- 2. the engine, from the val itself -----------------------------------------------------\n//\n// SECOND OPINION SINCE 14 AUG 2026, NOT THE ONLY COPY. engine/ is inside the bundle now (see the\n// note at the top of scripts/bundle.mjs), so step 1 has already written every engine file. This\n// step overwrites them with what the val is actually running, which is the more authoritative\n// answer for anything deployed. An engine file the val does NOT hold, because it is a module the\n// val never runs, is left exactly as the bundle restored it. That file is engine/watch.ts, and it\n// being in neither place is what cost a day.\nlet engine = 0;\nfor (const f of valFiles) {\n if (!/\\.(ts|md)$/.test(f.path) || f.path.startsWith(\"SOURCE-BUNDLE\")) continue;\n const dest = out(join(\"engine\", RENAMED[f.path] ?? f.path));\n mkdirSync(dirname(dest), { recursive: true });\n writeFileSync(dest, await get(f.path));\n engine++;\n}\nconsole.log(`restored ${engine} engine files from the val`);\n\n// WHAT IS MISSING MATTERS AS MUCH AS WHAT CAME BACK.\n//\n// On 7 August the container reverted to a snapshot that predated the deposit tracker entirely.\n// This script restored 36 files and 23 engine files and said so cheerfully. What it did not say\n// was that the ENGINE came back at the state it had been deployed at, and TESTS and HANDOVER came\n// back from a bundle written twelve hours earlier — so the code had a day of fixes in it and the\n// suite that proves them did not. That mismatch is invisible in the two counts above, and the\n// first sign of it was six tests failing for reasons that looked like new bugs.\n//\n// The lesson is not \"check harder\". It is REBUNDLE AS SOON AS THE TREE IS GREEN, every time,\n// because the bundle is the only copy of everything that is not the engine. This list is the\n// cheap half: a restore that comes back without a test runner in it is not a restore.\nconst MUST_EXIST = [\n \"tests/run-all.mjs\", \"tests/_harness.mjs\", \"tests/negative-controls.mjs\",\n \"tests/dashboard.test.mjs\", \"tests/holiday-deposits.test.mjs\", \"tests/deposits-collect.test.mjs\",\n \"scripts/build.mjs\", \"scripts/deploy.mjs\", \"scripts/bundle.mjs\", \"scripts/typecheck.mjs\",\n \"handover/DEPOSIT-SPEC.md\",\n // THE ONE THE VAL CANNOT SUPPLY. engine/watch.ts is the early warning monitor, it is not\n // deployed because the val does not run it, and on 12 Aug 2026 that meant it existed in exactly\n // one container. If a restore comes back without it, the bundle is older than the fix and this\n // is the line that says so instead of a test suite failing to import an hour later.\n \"engine/watch.ts\", \"tests/watch.test.mjs\", \"scripts/watch-run.mjs\",\n];\nconst missing = MUST_EXIST.filter((f) => !existsSync(out(f)));\nif (missing.length) {\n console.log(`\\nINCOMPLETE RESTORE — ${missing.length} expected file(s) are not in the bundle:`);\n for (const f of missing) console.log(` ${f}`);\n console.log(\"The bundle on the val is older than the work. Do not trust a green run until this is resolved.\");\n}\n\nif (CHECK) {\n // Every restored file must already match what is on disk. A difference means the disk has work\n // the val has never seen — which is the thing to find out BEFORE the next reclaim, not after.\n const d = spawnSync(\"diff\", [\"-rq\", \"--exclude=.restore-check\", TMP, ROOT], { encoding: \"utf8\" });\n const drift = (d.stdout || \"\").split(\"\\n\").filter((l) => l.startsWith(\"Files \") && l.includes(\"differ\"));\n console.log(drift.length ? `\\n${drift.length} file(s) on disk differ from the val:\\n${drift.join(\"\\n\")}` : \"\\nno drift: every restored file matches what is on disk\");\n process.exit(drift.length ? 1 : 0);\n}\n\n// ---- 3. the derived artifacts, rebuilt rather than restored --------------------------------\n// A FAILED REBUILD HERE IS A FAILED RESTORE. [was: it logged \"PDF rebuild FAILED\" and carried on\n// to print \"Now run: node tests/run-all.mjs\", exit 0. That is how occurrence #2 of the missing\n// First3Weeks.pdf rotted into occurrence #3: the restore said it was done, the operator moved on,\n// and the next person to notice was cross-artifact.test.mjs dying on ENOENT — which kills the\n// runner before its floors, its missing-suite check and its money guards ever run. A restore that\n// cannot reproduce a derived artifact has not restored the tree.]\nif (existsSync(join(ROOT, \"scripts/make-pdfs.mjs\"))) {\n const r = spawnSync(\"node\", [join(ROOT, \"scripts/make-pdfs.mjs\")], { encoding: \"utf8\", cwd: ROOT, timeout: 300_000 });\n if (r.status !== 0) {\n console.log(`PDF rebuild FAILED:\\n${(r.stdout + r.stderr).slice(0, 600)}`);\n console.log(\"\\nThe derived artifacts are not reproducible in this container, so the restore is INCOMPLETE.\");\n console.log(\"cross-artifact.test.mjs reads handover/TheDogsSpot-First3Weeks.pdf and will die on ENOENT\");\n console.log(\"before run-all.mjs reaches a single floor or money guard. Fix this before trusting a green.\");\n process.exit(1);\n }\n console.log(\"rebuilt both PDFs from their recipe\");\n}\n\nconsole.log(\"\\nNow run: node tests/run-all.mjs (it rebuilds engine/ -> build/ itself)\");\nconsole.log(\" node scripts/deploy.mjs --check (should show zero DIFFERS)\");\n\n\n\n=====FILE scripts/transcript_census_wide.py =====\n#!/usr/bin/env python3\n\"\"\"\nWide transcript-coverage census.\nSTRICTLY READ-ONLY: GET requests only.\n\nWalks conversations sorted by recent activity (most recent first),\nfor each conversation collects every TYPE_CALL message, and for each\ncall checks the transcription endpoint and the recording endpoint.\n\nCheckpoints progress to disk continuously so partial results survive\na timeout.\n\"\"\"\nimport json, time, sys, os, re, signal\n\nimport requests\n\nREPO = \"/home/claude/dogsspot\"\nTOK = None\nwith open(os.path.join(REPO, \"tests\", \"aged_audit.py\")) as f:\n txt = f.read()\nm = re.search(r\"pit-[a-f0-9]{8}-[a-f0-9-]*\", txt)\nTOK = m.group(0)\n\nBASE = \"https://services.leadconnectorhq.com\"\nLOC = \"BQHJ19uohldYe3eqA0bl\"\nHDRS_CONV = {\n \"Authorization\": f\"Bearer {TOK}\",\n \"User-Agent\": \"curl/8.5.0\",\n \"Version\": \"2021-04-15\",\n}\n\nSTATE_PATH = os.path.join(REPO, \"logs\", \"transcript-census-wide-state.json\")\nOUT_PATH = os.path.join(REPO, \"logs\", \"transcript-census-wide.json\")\n\nSOFT_DEADLINE_SECONDS = float(sys.argv[1]) if len(sys.argv) > 1 else 500.0\nTARGET_CONVERSATIONS = int(sys.argv[2]) if len(sys.argv) > 2 else 300\n\nSTART = time.time()\n\n\ndef elapsed():\n return time.time() - START\n\n\ndef get(url, params=None, max_retries=4):\n for attempt in range(max_retries):\n try:\n r = requests.get(url, headers=HDRS_CONV, params=params, timeout=30)\n except requests.exceptions.RequestException as e:\n print(f\" ! request exception on {url}: {e}\", flush=True)\n time.sleep(2)\n continue\n if r.status_code == 429:\n print(f\" ! 429 rate-limited on {url}, backing off 5s\", flush=True)\n time.sleep(5)\n continue\n return r\n return r\n\n\ndef load_state():\n if os.path.exists(STATE_PATH):\n with open(STATE_PATH) as f:\n return json.load(f)\n return {\n \"conversations_scanned\": [], # list of {id, contactName, lastMessageDate}\n \"conversations_scanned_ids\": [],\n \"calls\": [], # list of call records\n \"cursor_start_after_date\": None,\n \"conversation_ids_seen\": [],\n \"done_collecting_conversations\": False,\n \"conversations_to_walk\": [], # queue of conversation dicts not yet message-scanned\n \"next_walk_index\": 0,\n \"errors\": [],\n }\n\n\ndef save_state(state):\n tmp = STATE_PATH + \".tmp\"\n with open(tmp, \"w\") as f:\n json.dump(state, f)\n os.replace(tmp, STATE_PATH)\n\n\ndef main():\n state = load_state()\n seen_conv_ids = set(state[\"conversation_ids_seen\"])\n\n # Phase 1: collect conversations sorted by recent activity until we have\n # TARGET_CONVERSATIONS or run out, or hit ~30% of deadline budget.\n collect_deadline = SOFT_DEADLINE_SECONDS * 0.35\n if not state[\"done_collecting_conversations\"]:\n start_after_date = state[\"cursor_start_after_date\"]\n while len(state[\"conversations_to_walk\"]) < TARGET_CONVERSATIONS and elapsed() < collect_deadline:\n params = {\n \"locationId\": LOC,\n \"limit\": 100,\n \"sort\": \"desc\",\n \"sortBy\": \"last_message_date\",\n }\n if start_after_date:\n params[\"startAfterDate\"] = start_after_date\n r = get(f\"{BASE}/conversations/search\", params=params)\n time.sleep(0.3)\n if r is None or r.status_code != 200:\n code = r.status_code if r is not None else \"NO_RESPONSE\"\n print(f\"conversations/search FAILED status={code} body={r.text[:300] if r is not None else ''}\", flush=True)\n state[\"errors\"].append({\"phase\": \"conv_search\", \"status\": code, \"body\": r.text[:300] if r is not None else \"\"})\n break\n data = r.json()\n convs = data.get(\"conversations\", [])\n print(f\"[collect] got {len(convs)} conversations, total queued={len(state['conversations_to_walk'])}, elapsed={elapsed():.0f}s\", flush=True)\n if not convs:\n state[\"done_collecting_conversations\"] = True\n break\n new_count = 0\n for c in convs:\n if c[\"id\"] not in seen_conv_ids:\n seen_conv_ids.add(c[\"id\"])\n state[\"conversations_to_walk\"].append({\n \"id\": c[\"id\"],\n \"contactId\": c.get(\"contactId\"),\n \"contactName\": c.get(\"contactName\") or c.get(\"fullName\"),\n \"lastMessageDate\": c.get(\"lastMessageDate\"),\n \"lastMessageType\": c.get(\"lastMessageType\"),\n })\n new_count += 1\n start_after_date = convs[-1][\"lastMessageDate\"]\n state[\"cursor_start_after_date\"] = start_after_date\n state[\"conversation_ids_seen\"] = list(seen_conv_ids)\n if len(convs) < 100:\n state[\"done_collecting_conversations\"] = True\n break\n save_state(state)\n save_state(state)\n\n print(f\"[collect] DONE collecting: {len(state['conversations_to_walk'])} conversations queued, elapsed={elapsed():.0f}s\", flush=True)\n\n # Phase 2: walk each conversation's messages, find TYPE_CALL, check transcription + recording.\n queue = state[\"conversations_to_walk\"]\n idx = state[\"next_walk_index\"]\n calls = state[\"calls\"]\n scanned = state[\"conversations_scanned\"]\n\n while idx < len(queue) and elapsed() < SOFT_DEADLINE_SECONDS:\n conv = queue[idx]\n conv_id = conv[\"id\"]\n # fetch all messages for this conversation (paginate)\n last_message_id = None\n page_count = 0\n conv_calls_found = 0\n while page_count < 10: # safety cap: 10 pages * 100 = 1000 messages\n params = {\"limit\": 100}\n if last_message_id:\n params[\"lastMessageId\"] = last_message_id\n r = get(f\"{BASE}/conversations/{conv_id}/messages\", params=params)\n time.sleep(0.3)\n page_count += 1\n if r is None or r.status_code != 200:\n code = r.status_code if r is not None else \"NO_RESPONSE\"\n print(f\" ! messages FETCH FAILED conv={conv_id} status={code}\", flush=True)\n state[\"errors\"].append({\"phase\": \"messages\", \"conv\": conv_id, \"status\": code})\n break\n data = r.json()\n mblock = data.get(\"messages\", {})\n msgs = mblock.get(\"messages\", [])\n for msg in msgs:\n if msg.get(\"messageType\") == \"TYPE_CALL\":\n conv_calls_found += 1\n call_id = msg[\"id\"]\n call_record = {\n \"id\": call_id,\n \"conv\": conv_id,\n \"contact\": conv.get(\"contactId\"),\n \"name\": conv.get(\"contactName\"),\n \"at\": msg.get(\"dateAdded\"),\n \"dir\": msg.get(\"direction\"),\n \"status\": (msg.get(\"meta\") or {}).get(\"call\", {}).get(\"status\"),\n \"dur\": (msg.get(\"meta\") or {}).get(\"call\", {}).get(\"duration\"),\n }\n # transcription check\n tr = get(f\"{BASE}/conversations/locations/{LOC}/messages/{call_id}/transcription\")\n time.sleep(0.3)\n call_record[\"transcript\"] = str(tr.status_code) if tr is not None else \"ERR\"\n # recording check\n rec = get(f\"{BASE}/conversations/messages/{call_id}/locations/{LOC}/recording\")\n time.sleep(0.3)\n call_record[\"recording\"] = str(rec.status_code) if rec is not None else \"ERR\"\n calls.append(call_record)\n if not mblock.get(\"nextPage\") or not msgs:\n break\n new_last = mblock.get(\"lastMessageId\")\n if not new_last or new_last == last_message_id:\n break\n last_message_id = new_last\n\n scanned.append({\n \"id\": conv_id,\n \"contactName\": conv.get(\"contactName\"),\n \"lastMessageDate\": conv.get(\"lastMessageDate\"),\n \"calls_found\": conv_calls_found,\n })\n idx += 1\n state[\"next_walk_index\"] = idx\n if idx % 10 == 0:\n print(f\"[walk] {idx}/{len(queue)} conversations scanned, {len(calls)} calls found so far, elapsed={elapsed():.0f}s\", flush=True)\n save_state(state)\n\n save_state(state)\n print(f\"[walk] STOPPED at {idx}/{len(queue)} conversations scanned, {len(calls)} calls found, elapsed={elapsed():.0f}s\", flush=True)\n\n # Write final output summary\n with open(OUT_PATH, \"w\") as f:\n json.dump({\n \"conversations_scanned_count\": len(scanned),\n \"conversations_scanned\": scanned,\n \"calls\": calls,\n \"errors\": state[\"errors\"],\n }, f, indent=1)\n print(f\"Wrote {OUT_PATH}\", flush=True)\n print(f\"DONE_FLAG idx={idx} queue_len={len(queue)} done_collecting={state['done_collecting_conversations']}\", flush=True)\n\n\nif __name__ == \"__main__\":\n main()\n\n\n\n=====FILE scripts/typecheck.mjs =====\n// TYPECHECK. Nothing in this project has ever run one, and on 6 August an adversarial pass found\n// why that matters: `dogCount` was added to the Stay type and two object literals in deposits.ts\n// were never updated. esbuild strips types without checking them, so the build was clean, the\n// suite was green, and the defect was invisible. It happened to be harmless. The next one might\n// not be.\n//\n// It is NOT a plain tsc run: this code targets Deno on val.town, so `Deno`, remote https imports\n// and .ts import specifiers are all correct here and all errors to tsc. Those three classes are\n// filtered by name, and the filter is deliberately narrow — anything else is a real error.\n//\n// Usage: node scripts/typecheck.mjs\nimport { spawnSync } from \"node:child_process\";\nimport { readdirSync, writeFileSync, rmSync } from \"node:fs\";\nimport { join, dirname, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\n\nconst ROOT = resolve(dirname(fileURLToPath(import.meta.url)), \"..\");\nconst SHIM = join(ROOT, \"engine\", \"_deno-shim.d.ts\");\n// The three things that are true on val.town and false to tsc.\nconst DENO_ONLY = [\n /Cannot find name 'Deno'/,\n /Cannot find module 'https:\\/\\//,\n /Cannot find module '\\.\\/main\\.ts'/, // run.ts imports the val's entry point by its val name\n];\n\nwriteFileSync(SHIM, \"declare const Deno: { env: { get(k: string): string | undefined } };\\nexport {};\\n\");\ntry {\n const files = readdirSync(join(ROOT, \"engine\")).filter((f) => f.endsWith(\".ts\") && !f.endsWith(\".d.ts\"));\n // A TYPECHECK THAT CHECKS NOTHING IS NOT A TYPECHECK. With engine/ emptied this printed\n // \"0 engine files, 0 real error(s)\" and exited 0 — the exact shape of the zero-scope failure\n // this project keeps finding. scripts/build.mjs has had this guard since the start; this did not.\n if (!files.length) {\n console.log(\"TYPECHECK FAILURE: found 0 .ts files under engine/. A check that checks nothing is not a check.\");\n process.exit(1);\n }\n const r = spawnSync(\"npx\", [\"--yes\", \"tsc\", \"--noEmit\", \"--skipLibCheck\", \"--target\", \"es2022\",\n \"--module\", \"preserve\", \"--moduleResolution\", \"bundler\", \"--allowImportingTsExtensions\",\n ...files.map((f) => join(\"engine\", f))], { encoding: \"utf8\", cwd: ROOT, timeout: 300_000 });\n const lines = `${r.stdout ?? \"\"}${r.stderr ?? \"\"}`.split(\"\\n\").filter((l) => /error TS/.test(l));\n const real = lines.filter((l) => !DENO_ONLY.some((re) => re.test(l)));\n const waived = lines.length - real.length;\n console.log(`typecheck: ${files.length} engine files, ${real.length} real error(s), ${waived} val.town-only waived`);\n if (real.length) { console.log(real.slice(0, 25).join(\"\\n\")); process.exit(1); }\n} finally {\n rmSync(SHIM, { force: true });\n}\n\n\n",[579],"2d70804e-cb61-4b30-a081-77bb4a8c49bd","SOURCE-BUNDLE.part36.txt","3b0a5598-9823-11f1-8573-1607ee4eb77e",1206,["D",1786982937874],"THE DOGS SPOT — SOURCE BUNDLE (part 36 of 47)\n\nEVERY source file in this project, engine/ included. Restoring these parts and nothing else gives\nyou a tree that builds, typechecks and runs its own test suite with no network and no val.\n\nengine/ is here as of 14 Aug 2026. It used to be left out because val 1bfa6e81-74e1-4c6c-ab32-118304a4ffff\nholds it, which was true of every engine file except engine/watch.ts: a module the val does not run,\nso it was never deployed, so it lived in one container and nothing else. A reclaim destroyed it.\nscripts/deploy.mjs --check still compares engine/ against the val file by file; that is a second\ncheck on the same files now, not the only copy of them.\n\nRESTORE (needs only node, from an empty folder). Save each part, then run this ON EACH ONE:\n\n node -e 'const fs=require(\"fs\"),p=require(\"path\");const b=fs.readFileSync(process.argv[1],\"utf8\");\n for(const s of b.split(\"\\n=====FILE \").slice(1)){const i=s.indexOf(\" =====\\n\");\n const f=s.slice(0,i),c=s.slice(i+7);fs.mkdirSync(p.dirname(f),{recursive:true});\n fs.writeFileSync(f,c.replace(/\\n$/,\"\"))}' PART.txt\n\nA record named #1, #2, ... is one FILE cut into pieces: concatenate them in order, then\nstrip one trailing newline from the last. scripts/restore.mjs does this for you.\n\nEach part is complete in itself: whole files only, no reassembly, any order.\n\nThen: node scripts/build.mjs (engine/ came out of these parts; nothing to fetch first)\n node scripts/typecheck.mjs\n node tests/run-all.mjs\n node scripts/deploy.mjs --check (pulls nothing, proves the val matches what you restored)\n node tests/negative-controls.mjs (proves the suite above can actually fail)\n\nIN THIS PART (3 of 129 files)\n\n scripts/deploy.mjs 16375 bytes ed4f319c3937\n scripts/exception-report-lib.mjs 10990 bytes 41108f8adbad\n\n================================================================================================\n=====FILE scripts/counter-sales-correction.mjs#2 =====\n\n a later payment, and there is no matching payment in your CRM either`;\n } else {\n evidence = \"there is no Square payment and no CRM payment of this amount for this customer\";\n }\n\n const whyBits = [];\n if (namedAsATest) whyBits.push(`the record it was raised against is called ${storedName || name}`);\n if (tooSmallToBeASale) whyBits.push(`${money(amt)} is too small to be a sale, it is somebody testing a card`);\n if (!isTest) whyBits.push(`${money(amt)} is a normal size for a sale and nothing about it looks like a test`);\n const why = `${whyBits.join(\", and \").replace(/^./, (ch) => ch.toUpperCase())}.`;\n\n // AN ACTION THAT CANNOT BE CARRIED OUT IS NOT AN ACTION. \"Chase it\" on a row with no customer\n // name on it sends her looking for a person who is not named anywhere, so that row gets the step\n // that actually comes first.\n const noOneToChase = name === \"No customer name on file\";\n const action = alreadyPaid ? \"Close it, this one has already been paid\"\n : isTest ? \"Close it, there is nothing to collect\"\n : noOneToChase ? \"Work out who it was first, then chase it\"\n : \"Chase it\";\n\n return {\n \"Real money or test row\": isTest ? \"Test row\" : \"Real money\",\n \"Invoice number, type this into the invoice search in your CRM\": i.invoiceNumber ?? \"\",\n \"Date raised\": isoDay(i.createdAt),\n \"Customer\": name,\n \"Email\": cd.email && !PLACEHOLDER_EMAIL.test(String(cd.email)) ? cd.email : \"No email on file\",\n \"Phone\": cd.phoneNo || \"No phone on file\",\n \"Amount (US dollars)\": amt.toFixed(2),\n \"Still owed (US dollars)\": invDue(i).toFixed(2),\n \"What to do\": action,\n \"Why I call it that\": why,\n \"Has it been paid another way\": paid,\n \"How I can tell\": `${evidence.replace(/^./, (ch) => ch.toUpperCase())}.${notes.length ? ` Also worth knowing: ${notes.join(\"; \")}.` : \"\"}`,\n \"Invoice state in your CRM\": i.status,\n \"Where it was raised\": SOURCE_NAME[i.source] ?? titleCase(String(i.source ?? \"not recorded\").replace(/_/g, \" \")),\n _amount: amt,\n _isTest: isTest,\n _number: i.invoiceNumber ?? \"\",\n };\n}).sort((a, b) => (a._isTest === b._isTest ? b._amount - a._amount || String(a._number).localeCompare(String(b._number)) : (a._isTest ? 1 : -1)));\n\nconst realRows = invoiceRows.filter((r) => !r._isTest);\nconst testRows = invoiceRows.filter((r) => r._isTest);\nconst realTotal = realRows.reduce((a, r) => a + r._amount, 0);\nconst testTotal = testRows.reduce((a, r) => a + r._amount, 0);\n{\n const p = [];\n if (realRows.length + testRows.length !== invoiceRows.length) p.push(\"real money plus test rows does not equal the unresolved invoices\");\n if (cents(realTotal + testTotal) !== cents(unresolvedTotal)) p.push(`real money ${money(realTotal)} plus test rows ${money(testTotal)} does not equal ${money(unresolvedTotal)}`);\n for (let k = 1; k < invoiceRows.length; k++) {\n if (!invoiceRows[k - 1]._isTest && invoiceRows[k]._isTest) continue;\n if (invoiceRows[k - 1]._isTest && !invoiceRows[k]._isTest) p.push(\"the rows are not sorted with real money first\");\n }\n if (p.length) { shout(\"INVOICE SPLIT RECONCILIATION FAILED. Nothing written.\"); p.forEach((x) => console.error(\" - \" + x)); process.exit(1); }\n}\n\n// -------------------------------------------------------------------------------------------\n// FILE 2. THE CORRECTION PAGE. Every figure below is interpolated from a computed variable.\n// -------------------------------------------------------------------------------------------\nconst four = fourRows;\nconst namedBySquare = four.filter((r) => r._buyer !== \"No name in Square\");\nconst withACandidate = four.filter((r) => r._match);\nconst flagTooHarsh = flagDisagreements.filter((x) => x.direction === \"flag too harsh\");\nconst flagTooGenerous = flagDisagreements.filter((x) => x.direction === \"flag too generous\");\nconst oldFour = history.thirdWithTrail.map((x) => x.id);\nconst stillInTheFour = oldFour.filter((id) => unlinkedIds.includes(id));\nconst promotedIntoTheFour = unlinkedIds.filter((id) => !oldFour.includes(id));\n// Sales in file 1 that were settled on more than one card, so the row count and the purchase\n// count are not the same number and the page says which is which.\nconst splitTenderSales = [...new Set(four.map((r) => r._orderId).filter(Boolean))]\n .map((oid) => ({ oid, ids: four.filter((r) => r._orderId === oid) }))\n .filter((g) => g.ids.length > 1)\n .map((g) => ({\n ids: g.ids.map((r) => r._id),\n buyer: g.ids[0]._buyer,\n date: g.ids[0]._date,\n total: g.ids[0]._wholeSale,\n paid: g.ids.reduce((a, r) => a + r._amount, 0),\n }));\n// A split sale's card amounts must add up to the order it belongs to, or the receipt is telling\n// two stories and neither may be quoted.\nfor (const g of splitTenderSales) {\n if (cents(g.paid) !== cents(g.total)) die(`the cards on order for ${g.buyer} add to ${money(g.paid)} and Square says the sale was ${money(g.total)}. Do not quote either figure until that is explained.`);\n}\nconst splitTenderRowCount = splitTenderSales.reduce((a, g) => a + g.ids.length, 0);\nconst actualPurchases = four.length - splitTenderSales.reduce((a, g) => a + g.ids.length - 1, 0);\n// Does every sale Square could name also have a CRM candidate? If the two sets are the same rows\n// the sentence says so once instead of printing two numbers that happen to be equal.\nconst namedAndMatchedAreTheSameRows = namedBySquare.length === withACandidate.length &&\n namedBySquare.every((r) => withACandidate.some((x) => x._id === r._id));\n\nconst md = [\n `# Your counter sales: the corrected figure`,\n ``,\n `## The number`,\n ``,\n `**${four.length} counter ${plural(four.length, \"sale\", \"sales\")} worth ${money(unlinkedTotal)} ${plural(four.length, \"is\", \"are\")} recorded without a customer attached.** That is the whole of it.`,\n ``,\n `You were told ${history.thirdFigure.length} sales worth ${money(history.thirdFigureTotal)}. That was wrong, and it was the third wrong version of this one number I have sent you. The ${history.semicolonBug.length} sales worth ${money(history.semicolonBugTotal)} in between are fine: every one of them reached a named customer record on the day it was taken, and my count could not see it.`,\n ``,\n `## What it changes about the money`,\n ``,\n `Nothing. Every dollar was collected either way. ${money(universeTotal)} came through the card reader across ${allIds.length} sales, and all ${allIds.length} of them are in your Square account, settled. This was never money at risk. It is a filing question, and the filing turns out to be in far better shape than I told you.`,\n ``,\n `## What it changes about the work`,\n ``,\n `A great deal. The list of sales somebody has to place by hand goes from ${history.thirdFigure.length} to ${four.length}. ${namedBySquare.length === four.length ? `Square holds a name for every one of the ${four.length}` : `Square holds a name for ${namedBySquare.length} of the ${four.length}`}, and ${namedAndMatchedAreTheSameRows ? `every one of those ${withACandidate.length} already has` : `${withACandidate.length} of them already ${plural(withACandidate.length, \"has\", \"have\")}`} a likely match in your CRM waiting for you to confirm it. That is an afternoon at most, not a project.`,\n ``,\n `## What caused it`,\n ``,\n `My count treated one sale as two whenever Square told us about it twice, so ${history.semicolonBug.length} sales worth ${money(history.semicolonBugTotal)} that had already reached a customer were counted as though they never had. It is fixed, and every figure now has to be produced twice by two separate methods that agree before I am allowed to send it to you.`,\n ``,\n `## The arithmetic, so you can check me`,\n ``,\n `| | Sales | Value |`,\n `|---|---|---|`,\n `| Every sale that ever failed to find a customer on its first try | ${history.everFailed.length} | ${money(history.everFailedTotal)} |`,\n `| Less those that found one on a later try, corrected 9 August 2026 | ${history.matchedLater.length} | ${money(history.matchedLaterTotal)} |`,\n `| **The figure you were given** | **${history.thirdFigure.length}** | **${money(history.thirdFigureTotal)}** |`,\n `| Less those that had already reached a named customer | ${history.semicolonBug.length} | ${money(history.semicolonBugTotal)} |`,\n `| **The true figure** | **${four.length}** | **${money(unlinkedTotal)}** |`,\n ``,\n `And the whole population those come out of, so the ${four.length} can be checked against something: since the Square connection was switched on it has handled ${allIds.length} sales worth ${money(universeTotal)}. ${linkedIds.length} worth ${money(linkedTotal)} reached a customer record and ${unlinkedIds.length} worth ${money(unlinkedTotal)} did not. Those two add back to ${money(universeTotal)} exactly.`,\n ``,\n `## One thing to watch when you compare this to the old note`,\n ``,\n `The old note also had a four in it: \"four with a partial trail worth ${money(history.thirdWithTrailTotal)}\". Those are not these four. ${stillInTheFour.length} of that old four ${plural(stillInTheFour.length, \"is\", \"are\")} in this list, ${oldFour.length - stillInTheFour.length} turned out to have reached a customer after all, and ${promotedIntoTheFour.length} ${plural(promotedIntoTheFour.length, \"sale that the old note counted\", \"sales that the old note counted\")} among the \"no name at all\" group ${plural(promotedIntoTheFour.length, \"is\", \"are\")} in this list instead. The two fours are different sets of sales and the same word for both is a coincidence, not a sign that nothing moved.`,\n ``,\n `## And one claim in the old note I have to withdraw`,\n ``,\n `The old note said ${history.thirdNoTrail.length} sales \"arrived with no name, email or phone attached at all\". That was wrong, and it was wrong for ${flagDisagreements.length} of ${plural(four.length, \"the one sale\", \"the \" + four.length + \" sales\")} on this list${flagTooHarsh.length ? `, including ${plural(flagTooHarsh.length, \"one sale\", flagTooHarsh.length + \" sales\")} I called unrecoverable that ${plural(flagTooHarsh.length, \"has\", \"have\")} a full name and a phone number sitting in Square all along` : \"\"}. Every buyer detail below was asked of Square itself, one question per sale, on 12 August 2026.`,\n ``,\n `## The list`,\n ``,\n `In the order Square took the money, oldest first.`,\n ``,\n `| Date | Amount | Buyer | Phone | What was bought | Likely match in your customer list |`,\n `|---|---|---|---|---|---|`,\n ...four.map((r) => `| ${fmtDate(r._date)} | ${money(r._amount)} | ${r._buyer} | ${r._phone || \"none in Square\"} | ${r._bought} | ${r._match ? `${r._match} (${r[\"How sure I am\"].toLowerCase()})` : \"no match found\"} |`),\n ``,\n splitTenderSales.length\n ? `${splitTenderRowCount} of those lines are one purchase rather than ${splitTenderRowCount}. ${splitTenderSales.map((g) => `The ${g.ids.length} payments from ${g.buyer} on ${fmtDate(g.date)} are a single sale of ${money(g.total)} settled on ${g.ids.length} cards.`).join(\" \")} So the ${four.length} lines above are ${actualPurchases} actual ${plural(actualPurchases, \"purchase\", \"purchases\")}, and the ${money(unlinkedTotal)} is right either way.`\n : \"\",\n ``,\n `Card type and last four digits, a link to the Square receipt for each one, the booking each would land on if you confirm it and the reason behind every match are in the spreadsheet beside this note, ${F_COUNTER_CSV}, one row per payment.`,\n ``,\n `## The work that is actually left`,\n ``,\n `Separately from the ${four.length} above, there is a bigger and more useful piece of work. ${linkedIds.length} sales worth ${money(linkedTotal)} did reach a named customer, and the amount was never written onto that customer's booking. The booking is the only place a report adds money up from, which is why your revenue reports have been reading low. ${writtenPayments} of those ${plural(writtenPayments, \"sale\", \"sales\")}, worth ${money(writtenTotal)}, would go onto ${writeRows.length} ${plural(writeRows.length, \"booking\", \"bookings\")} with no judgement call needed, and ${leftAlone.length} worth ${money(leftAloneTotal)} would be left alone with a reason recorded for each. That plan is written out in full in ${F_WRITE_CSV}, with ${F_WRITE_MD} beside it explaining what you are looking at. Nothing in it has been run.`,\n ``,\n `One more thing worth saying plainly, because two lists got confused once already. This list and your unpaid invoices are not the same thing and never were. A counter sale with no customer is money that HAS arrived and is not filed against anybody. An unpaid invoice is money you asked for that has not arrived. There are ${four.length} of the first and they are in this file; the second are in ${F_INVOICES_CSV}.`,\n ``,\n `Amir`,\n ``,\n].filter((x) => x !== null).join(\"\\n\");\n\n// -------------------------------------------------------------------------------------------\n// THE SECOND PAGE. The write back plan used to carry four banner rows above its column headers,\n// which made the spreadsheet unopenable: row 1 became the header, so every real row had fifteen\n// fields against a one field header. Prose belongs in a page, a table belongs in a table, and\n// this is the page.\n// -------------------------------------------------------------------------------------------\nconst leftAloneSorted = [...leftAlone].sort((a, b) => b.amount - a.amount || String(a.buyer).localeCompare(String(b.buyer)));\nconst writeMd = [\n `# Money that is sitting off your bookings`,\n ``,\n `## Nothing here has been done`,\n ``,\n `**${F_WRITE_CSV} is a description of a change, not the change.** Not one figure has been written to your CRM, and none will be until you have looked at this and said so. Every number in it was read out of Square and out of your CRM on 12 August 2026.`,\n ``,\n `## What it is`,\n ``,\n `${linkedIds.length} card sales worth ${money(linkedTotal)} reached a named customer in your CRM, and the amount was never put on that customer's booking. The booking is the only place a report adds money up from, which is why your revenue reports read low. ${F_WRITE_CSV} is the list of what would go where.`,\n ``,\n `| | Sales | Value |`,\n `|---|---|---|`,\n `| Would go onto a booking, no judgement needed | ${writtenPayments} | ${money(writtenTotal)} |`,\n `| Would be left alone, with a reason for each | ${leftAlone.length} | ${money(leftAloneTotal)} |`,\n `| **Every sale that reached a named customer** | **${linkedIds.length}** | **${money(linkedTotal)}** |`,\n ``,\n `The ${writtenPayments} land on ${writeRows.length} ${plural(writeRows.length, \"booking\", \"bookings\")}, because some customers paid more than once toward the same booking. Where that happened the payments are added together, never written one over the other. The ${leftAlone.length} that would be left alone are in ${F_LEFT_CSV}, one row each, with the reason.`,\n ``,\n `And so the ${linkedIds.length} can be checked against something bigger: since the Square connection was switched on it has handled ${allIds.length} sales worth ${money(universeTotal)}. ${linkedIds.length} worth ${money(linkedTotal)} reached a customer record and ${unlinkedIds.length} worth ${money(unlinkedTotal)} did not. Those two add back to ${money(universeTotal)} exactly, and the ${unlinkedIds.length} are the subject of ${F_COUNTER_MD}.`,\n ``,\n `## Where money is allowed to land, and where it is not`,\n ``,\n `Only two boards: ${BOARDS_PHRASE}. Those are the boards a booking lives on. Nothing in this plan touches any other board, because money put on a record that is not a booking is worse than money left off one: it reads as income in a place nothing adds up from.`,\n ``,\n looksLikeAPriceList ? `## One question for you before any of this happens` : ``,\n looksLikeAPriceList ? `` : ``,\n looksLikeAPriceList ? `This one is about your books rather than about software, so it is yours to answer and not mine. ${priceListNotice.replace(/^READ THIS BEFORE ANY OF IT IS RUN\\. /, \"\")}` : ``,\n ``,\n `## What I need from you`,\n ``,\n `Open ${F_WRITE_CSV} and look down the customer names and the amounts. If a row looks wrong, say so and it comes out. If the whole thing looks right, say so and I will run it and send you the list of what changed. Either way nothing moves until you answer.`,\n ``,\n `Amir`,\n ``,\n].filter((x) => x !== \"\" || true).join(\"\\n\").replace(/\\n{3,}/g, \"\\n\\n\");\n\n// ===========================================================================================\n// THE PRICE LIST AND THE PAYMENT LINKS. Every price below is read from her CRM and checked\n// against Square's own catalogue before it is printed. The file this replaces ended every row\n// with a product reference and a price reference, which are ours and mean nothing to her.\n// ===========================================================================================\nconst SQUARE_TRAINING_CATEGORIES = new Set([\"New Training Prices\", \"Upgrades\"]);\nconst squarePrice = new Map(); // tidy item name -> price Square charges\nfor (const it of squareCatalog.items ?? []) {\n if (!SQUARE_TRAINING_CATEGORIES.has(it.category)) continue;\n const key = normName(String(it.item ?? \"\").replace(/^\\*/, \"\"));\n const p = Number((it.variations ?? [])[0]?.price);\n if (key && Number.isFinite(p)) squarePrice.set(key, { price: p, category: it.category, name: String(it.item ?? \"\").replace(/^\\*/, \"\").trim() });\n}\nconst priceIdsNeeded = crmProducts.filter((p) => p.status !== \"active\" || isoDay(p.createdAt) === isoDay(RUN_AT.toISOString())).map((p) => p._id);\nconst crmPrices = await fetchCrmPrices(priceIdsNeeded);\nconst priceOf = (productId) => {\n const list = crmPrices[productId] ?? [];\n if (list.length !== 1) die(`product ${productId} has ${list.length} prices and this file assumes exactly one. Nothing written.`);\n return list[0].amount;\n};\n\nconst liveProducts = crmProducts.filter((p) => p.status === \"active\" && isoDay(p.createdAt) === isoDay(RUN_AT.toISOString()));\nconst archivedProducts = crmProducts.filter((p) => p.status !== \"active\");\n// The claim in the client message is that all 19 now exist at the exact Square price. That is a\n// checkable claim, so it is checked, and a disagreement stops the run rather than shipping.\n{\n const p = [];\n for (const prod of liveProducts) {\n const sq = squarePrice.get(normName(prod.name));\n if (!sq) { p.push(`${prod.name} is set up in the CRM and is not in Square's training categories`); continue; }\n if (cents(priceOf(prod._id)) !== cents(sq.price)) p.push(`${prod.name} is ${money(priceOf(prod._id))} in the CRM and ${money(sq.price)} in Square`);\n }\n const missing = [...squarePrice.values()].filter((sq) => !liveProducts.some((prod) => normName(prod.name) === normName(sq.name)));\n for (const m of missing) p.push(`${m.name} is in Square at ${money(m.price)} and is not set up in the CRM`);\n if (p.length) { shout(\"THE CRM PRICE LIST AND SQUARE DISAGREE. Nothing written.\"); p.forEach((x) => console.error(\" - \" + x)); process.exit(1); }\n console.log(`Price check passed: all ${liveProducts.length} training prices in the CRM match Square, penny for penny.`);\n}\n\n// Which invoices, if any, were ever charged against a price that has now been archived. Derived\n// from the invoices themselves rather than remembered, because \"nothing was affected\" is the kind\n// of reassurance that has to be true on the day it is read.\nconst invoicesUsingProduct = new Map();\nfor (const i of invoices) for (const it of i.invoiceItems ?? []) {\n const pid = it?.productId; if (!pid) continue;\n (invoicesUsingProduct.get(pid) ?? invoicesUsingProduct.set(pid, []).get(pid)).push(i);\n}\n// WHICH NEW PRICE REPLACED WHICH OLD ONE. Stated once, and checked against both catalogues rather\n// than guessed from the names. A near name match got this wrong on the first run: \"Leash Free\n// program\" begins the same way as \"Leash Free to Elite (Bundle)\", and the file cheerfully said an\n// old $3,600.00 program had been replaced by a $500.00 upgrade. A wrong pairing here reads as a\n// price change the owner never made, so an unrecognised archived price stops the run.\nconst REPLACED_BY = {\n \"basic bootcamp\": \"Basic Bootcamp\",\n \"community program\": \"Community Program\",\n \"leash free program\": \"Leash Free/Off Leash\",\n \"bundle program\": \"Elite Immersion (Bundle)\",\n};\nconst replacementFor = (archived) => {\n const want = REPLACED_BY[normName(archived.name)];\n if (!want) die(`the archived price \"${archived.name.trim()}\" is not in the list of what replaced what. Add it before this file goes out, because a guess here misstates a price.`);\n const hit = liveProducts.find((p) => normName(p.name) === normName(want));\n if (!hit) die(`the archived price \"${archived.name.trim()}\" says it was replaced by \"${want}\" and no live product of that name is in the CRM.`);\n return hit;\n};\n\n// THE SAME OLD PRICE, STILL SITTING IN SQUARE. Archiving the old price in her CRM does not touch\n// Square, and the client has been asked in writing to archive the Square duplicates herself\n// because that account cannot be reached from here. Without this the file reads as though the job\n// were finished. Derived by matching the archived amount against Square's own older item list, so\n// it stays true if she archives one of them tomorrow.\nconst NEW_SQUARE_CATEGORIES = SQUARE_TRAINING_CATEGORIES;\nconst squareStillHasAtPrice = (amount) => (squareCatalog.items ?? [])\n .filter((it) => !NEW_SQUARE_CATEGORIES.has(it.category))\n .filter((it) => (it.variations ?? []).some((v) => cents(Number(v?.price)) === cents(amount)))\n .map((it) => String(it.item ?? \"\").trim());\n\nconst GROUP_NAME = { \"New Training Prices\": \"Training program\", \"Upgrades\": \"Upgrade\" };\nconst priceRows = [\n ...liveProducts.map((prod) => {\n const sq = squarePrice.get(normName(prod.name));\n const amount = priceOf(prod._id);\n return {\n \"Group\": GROUP_NAME[sq.category] ?? sq.category,\n \"Service\": prod.name.trim(),\n \"Price (US dollars)\": amount.toFixed(2),\n \"What has been done\": `Set up in your CRM on ${fmtDate(prod.createdAt)} at ${money(amount)}, which is what Square charges for it.`,\n \"What you need to do\": \"Make the payment link for this one. The steps are in Payment-links-steps.md.\",\n \"Payment link, paste it in here once you have made it\": \"\",\n _sort: [sq.category === \"New Training Prices\" ? 0 : 1, amount],\n };\n }),\n ...archivedProducts.map((prod) => {\n const was = priceOf(prod._id);\n const now = replacementFor(prod);\n const nowPrice = now ? priceOf(now._id) : null;\n const used = invoicesUsingProduct.get(prod._id) ?? [];\n const paidUsed = used.filter((i) => SETTLED.has(i.status));\n const stillInSquare = squareStillHasAtPrice(was);\n const diff = nowPrice === null ? null : was - nowPrice;\n const gap = diff === null ? \"\" : diff > 0 ? `${money(Math.abs(diff))} above what you charge now` : diff < 0 ? `${money(Math.abs(diff))} below what you charge now` : \"the same as what you charge now\";\n return {\n \"Group\": \"Old price, archived\",\n \"Service\": prod.name.trim(),\n \"Price (US dollars)\": was.toFixed(2),\n \"What has been done\": `Archived in your CRM on ${fmtDate(prod.updatedAt)} and nothing was deleted. It was ${money(was)}, ${gap}${now ? `, and it is replaced by ${now.name.trim()} at ${money(nowPrice)}` : \"\"}. ` +\n (used.length\n ? `It was used on ${used.length} ${plural(used.length, \"invoice\", \"invoices\")}, ${plural(paidUsed.length, \"and that one is\", \"of which \" + paidUsed.length + \" are\")} paid: ${used.map((i) => `number ${i.invoiceNumber}`).join(\" and \")}. Each one was read in full before the change and again afterwards, and they are identical.`\n : \"No invoice and no order in your CRM has ever been charged against it.\"),\n \"What you need to do\": (stillInSquare.length\n ? `Square still has ${stillInSquare.map((n) => `\"${n}\"`).join(\" and \")} at ${money(was)} in its own item list, and that is one of the old duplicates I have asked you to archive in Square, because I cannot reach Square to do it. In your CRM, nothing: if you ever want this price back, open Payments, then Products, find ${prod.name.trim()} and set it to active.`\n : `Nothing. If you ever want it back, open Payments, then Products, find ${prod.name.trim()} and set it to active.`),\n \"Payment link, paste it in here once you have made it\": \"Not needed, this one is archived\",\n _sort: [2, was],\n };\n }),\n].sort((a, b) => a._sort[0] - b._sort[0] || a._sort[1] - b._sort[1]);\n\nconst linksToMake = priceRows.filter((r) => r[\"Group\"] !== \"Old price, archived\");\n{\n const p = [];\n if (linksToMake.length + archivedProducts.length !== priceRows.length) p.push(\"the live prices plus the archived prices do not equal the rows in this file\");\n if (p.length) { shout(\"PRICE LIST RECONCILIATION FAILED. Nothing written.\"); p.forEach((x) => console.error(\" - \" + x)); process.exit(1); }\n}\n\n// -------------------------------------------------------------------------------------------\n// THE UNPAID INVOICES PAGE.\n// -------------------------------------------------------------------------------------------\nconst byStatus = new Map();\nfor (const i of invoices) {\n const g = byStatus.get(i.status) ?? { status: i.status, n: 0, total: 0, due: 0, settled: SETTLED.has(i.status) };\n g.n++; g.total += invTotal(i); g.due += invDue(i); byStatus.set(i.status, g);\n}\nconst toChase = invoiceRows.filter((r) => r[\"What to do\"].includes(\"hase it\"));\nconst toCloseAsPaid = invoiceRows.filter((r) => r[\"What to do\"].startsWith(\"Close it, this one has already\"));\nconst toCloseAsNothing = invoiceRows.filter((r) => r[\"What to do\"].startsWith(\"Close it, there is nothing\"));\nconst oldestInvoice = unresolvedInvoices[0];\nconst invoiceMd = [\n `# Your unpaid invoices`,\n ``,\n `## The number`,\n ``,\n `**${unresolvedInvoices.length} invoices worth ${money(unresolvedTotal)} have not been settled.** Every one of them is in ${F_INVOICES_CSV}, one row each. The oldest was raised on ${fmtDate(oldestInvoice?.createdAt)}.`,\n ``,\n `## How much of that is worth your time`,\n ``,\n `Not all of it, and I would rather tell you which than let you find out one call at a time.`,\n ``,\n `| | Invoices | Value |`,\n `|---|---|---|`,\n `| Real money | ${realRows.length} | ${money(realTotal)} |`,\n `| Test rows | ${testRows.length} | ${money(testTotal)} |`,\n `| **Every unpaid invoice** | **${invoiceRows.length}** | **${money(unresolvedTotal)}** |`,\n ``,\n `The first column of ${F_INVOICES_CSV} says which each row is, in those words, and the real money is sorted to the top so you never have to scroll past a quarter of a dollar to find ${money(realRows[0]?._amount ?? 0)}. The column beside it says why I put each row where I put it.`,\n ``,\n `**That cut is my judgement and you are meant to disagree with it where you want to.** The rule I used is two lines: anything under ${money(TEST_MONEY_CEILING)} is somebody testing a card reader rather than a sale, and anything raised against a record with the word test in its name is somebody testing the software. Every row is in the file either way, so moving one from one side to the other is a decision you can make on the spot.`,\n ``,\n `## What to do with them`,\n ``,\n `| What to do | Invoices | Value |`,\n `|---|---|---|`,\n `| Chase it, including ${invoiceRows.filter((r) => r[\"What to do\"].startsWith(\"Work out\")).length} where you have to work out who it was first | ${toChase.length} | ${money(toChase.reduce((a, r) => a + r._amount, 0))} |`,\n `| Close it, this one has already been paid | ${toCloseAsPaid.length} | ${money(toCloseAsPaid.reduce((a, r) => a + r._amount, 0))} |`,\n `| Close it, there is nothing to collect | ${toCloseAsNothing.length} | ${money(toCloseAsNothing.reduce((a, r) => a + r._amount, 0))} |`,\n `| **Every unpaid invoice** | **${invoiceRows.length}** | **${money(unresolvedTotal)}** |`,\n ``,\n `The ${toCloseAsPaid.length} already paid ${plural(toCloseAsPaid.length, \"one was\", \"ones were\")} paid on a duplicate invoice raised the same day. The customer is not out of pocket and you are not owed anything; the record simply never caught up. ${F_INVOICES_CSV} names the invoice that was actually paid, so you can check before you close anything.`,\n ``,\n `## The whole population, so this list can be checked against something`,\n ``,\n `| Invoice state in your CRM | Settled | Invoices | Value | Still owed |`,\n `|---|---|---|---|---|`,\n ...[...byStatus.values()].sort((a, b) => b.n - a.n).map((g) => `| ${g.status} | ${g.settled ? \"settled\" : \"not settled\"} | ${g.n} | ${money(g.total)} | ${money(g.due)} |`),\n `| **all** | | **${invoices.length}** | **${money(parentInvoiceTotal)}** | **${money(invoices.reduce((a, i) => a + invDue(i), 0))}** |`,\n ``,\n `Your CRM holds ${invoices.length} invoices worth ${money(parentInvoiceTotal)} in all. ${settledInvoices.length} worth ${money(settledTotal)} are settled and ${unresolvedInvoices.length} worth ${money(unresolvedTotal)} are not. Those two add back to ${money(parentInvoiceTotal)} exactly.`,\n ``,\n `## What this list is not`,\n ``,\n `It is not the counter sales list, and the two were sent to you as if they were one list once, which was my fault. An unpaid invoice is money you asked for that has not arrived. A counter sale with no customer is money that HAS arrived and is not filed against anybody. Different piles, different sizes: ${unresolvedInvoices.length} invoices here and ${unlinkedIds.length} unfiled counter ${plural(unlinkedIds.length, \"sale\", \"sales\")} in ${F_COUNTER_CSV}. Neither of them is eight.`,\n ``,\n `There is a third pile, bigger than both, and it is the one worth your attention: ${writtenPayments} card ${plural(writtenPayments, \"payment\", \"payments\")} worth ${money(writtenTotal)} that reached a named customer and were never put on that customer's booking, plus ${leftAlone.length} worth ${money(leftAloneTotal)} I would leave alone. That is ${F_WRITE_CSV}, and ${F_WRITE_MD} beside it explains it. Nothing on it has been run.`,\n ``,\n `Amir`,\n ``,\n].join(\"\\n\");\n\n// SELF CHECK: the client facing copy rules, enforced by the machine rather than trusted by eye.\n// The list has grown since the last run, because every item on it was a real defect in a file a\n// client had already been sent.\nfunction copyProblems(text, label) {\n const problems = [];\n const say = (m) => problems.push(`${label}: ${m}`);\n if (/daycare/i.test(text)) say('the word \"daycare\" appears');\n // HER OWN BOARD NAME IS HER DATA. One of the two boards money may land on is called \"Won - Paid\"\n // and the hyphen in it is hers. It is lifted out before the punctuation rule runs, so the rule\n // stays strict everywhere else instead of being weakened to accommodate one string.\n const hers = BOARDS.reduce((t, b) => t.split(b).join(\"\"), text);\n const prose = hers.split(\"\\n\").filter((l) => !l.startsWith(\"|\")).join(\"\\n\");\n if (/—|–/.test(prose)) say(\"an em dash or en dash appears\");\n if (/\\s-\\s/.test(prose)) say(\"a hyphen is used as punctuation\");\n if (/\\bNaN\\b|\\$NaN|undefined|null\\b/.test(prose)) say(\"a computed value failed to render and left NaN, undefined or null in the copy\");\n // RELATIVE DATES. \"244 days old\" and \"2 days ago\" are both true only on the day they are written\n // and quietly wrong every day after. Absolute dates only.\n if (/\\b(yesterday|tomorrow|today|last week|next week|this week|this evening|days ago|days old|earlier today)\\b/i.test(prose)) say(\"a relative date appears; absolute dates only\");\n // INTERNAL RECORD IDS. The CRM's ids are 20 characters of mixed case, Square's payment ids 29,\n // its customer ids 26, and the CRM's invoice and product ids 24 hex characters. None of them\n // mean anything to a reader and every one of them makes a page look like a machine wrote it\n // for another machine. A Square receipt link is allowed: she clicks it and sees her own sale.\n const withoutLinks = text.replace(/https:\\/\\/\\S+/g, \" \");\n const idish = withoutLinks.match(/\\b(?=[A-Za-z0-9]*[a-z])(?=[A-Za-z0-9]*[A-Z0-9])[A-Za-z0-9]{20,}\\b/g) ?? [];\n const hexish = withoutLinks.match(/\\b[0-9a-f]{24}\\b/g) ?? [];\n if (idish.length || hexish.length) say(`an internal record id appears: ${[...idish, ...hexish].slice(0, 4).join(\", \")}`);\n if (/\\/(mnt|home|tmp|Users)\\//.test(withoutLinks)) say(\"a file path appears\");\n return problems;\n}\n{\n const problems = [...copyProblems(md, F_COUNTER_MD), ...copyProblems(writeMd, F_WRITE_MD), ...copyProblems(invoiceMd, F_INVOICES_MD)];\n if (problems.length) { shout(\"CLIENT-SAFE COPY CHECK FAILED. Nothing written.\"); problems.forEach((p) => console.error(\" - \" + p)); process.exit(1); }\n console.log(\"Client-safe copy check passed on all three pages: no dashes as punctuation, no relative dates, no record ids, no file paths, no unrendered values.\");\n}\n\n// -------------------------------------------------------------------------------------------\n// OUT. ONE TABLE PER FILE, HEADER ON ROW 1, EVERY ROW THE SAME WIDTH. No banner rows, no second\n// table stacked under the first: a spreadsheet reads row 1 as the header and everything after it\n// as data, and a file that breaks that rule opens as nonsense on the client's laptop.\n// -------------------------------------------------------------------------------------------\nconst OUT = process.env.CORRECTION_OUT_DIR || \"/mnt/user-data/outputs\";\nmkdirSync(OUT, { recursive: true });\n\n// Only the columns a person reads. The keys starting with an underscore stay in this process.\nconst readerColumns = (rows) => Object.keys(rows[0] ?? {}).filter((k) => !k.startsWith(\"_\"));\n\nconst FOUR_HEADERS = readerColumns(fourRows);\nconst INV_HEADERS = readerColumns(invoiceRows);\nconst PRICE_HEADERS = readerColumns(priceRows);\nconst WB_HEADERS = readerColumns(writeRows);\nconst LEFT_HEADERS = [\"Customer\", \"Date it was taken\", \"Amount (US dollars)\", \"Why it is being left alone\", \"Square receipt link, open this to see the sale\"];\nconst leftRows = leftAloneSorted.map((r) => ({\n \"Customer\": r.buyer,\n \"Date it was taken\": r.date,\n \"Amount (US dollars)\": r.amount.toFixed(2),\n \"Why it is being left alone\": `${r.why.charAt(0).toUpperCase()}${r.why.slice(1)}.`,\n \"Square receipt link, open this to see the sale\": r.receipt,\n}));\n\n// EVERY FILE IS CHECKED BEFORE IT IS WRITTEN, not after it has been sent. Rectangular, header on\n// row 1, no id column, and the totals in the page beside it match the rows in the table.\nfunction csvProblems(name, headers, rows) {\n const problems = [];\n const text = toCsv(headers, rows);\n const parsed = parseCsv(text);\n if (parsed.length !== rows.length + 1) problems.push(`${name}: parses as ${parsed.length} rows and should be ${rows.length + 1} including the header`);\n const widths = new Set(parsed.map((r) => r.length));\n if (widths.size !== 1) problems.push(`${name}: rows are not all the same width (${[...widths].join(\", \")})`);\n if (parsed[0].join(\"\u0001\") !== headers.join(\"\u0001\")) problems.push(`${name}: row 1 is not the header`);\n for (const h of headers) if (/_id$|^id$|\\bid\\b/i.test(h)) problems.push(`${name}: column \"${h}\" looks like an internal identifier`);\n const body = parsed.slice(1).flat().join(\"\\n\");\n const p = copyProblems(body, name);\n problems.push(...p);\n return problems;\n}\n// A tiny reader, deliberately not the writer's own code: a table that only the program that wrote\n// it can read is exactly the failure being fixed here.\nfunction parseCsv(text) {\n const rows = []; let row = []; let field = \"\"; let quoted = false;\n for (let i = 0; i < text.length; i++) {\n const ch = text[i];\n if (quoted) {\n if (ch === '\"') { if (text[i + 1] === '\"') { field += '\"'; i++; } else quoted = false; }\n else field += ch;\n } else if (ch === '\"') quoted = true;\n else if (ch === \",\") { row.push(field); field = \"\"; }\n else if (ch === \"\\n\") { row.push(field); rows.push(row); row = []; field = \"\"; }\n else if (ch !== \"\\r\") field += ch;\n }\n if (field !== \"\" || row.length) { row.push(field); rows.push(row); }\n return rows;\n}\n\n{\n const problems = [\n ...csvProblems(F_COUNTER_CSV, FOUR_HEADERS, fourRows),\n ...csvProblems(F_WRITE_CSV, WB_HEADERS, writeRows),\n ...csvProblems(F_LEFT_CSV, LEFT_HEADERS, leftRows),\n ...csvProblems(F_INVOICES_CSV, INV_HEADERS, invoiceRows),\n ...csvProblems(F_PRICES_CSV, PRICE_HEADERS, priceRows),\n ];\n if (problems.length) { shout(\"SPREADSHEET SHAPE CHECK FAILED. Nothing written.\"); problems.forEach((x) => console.error(\" - \" + x)); process.exit(1); }\n console.log(`Spreadsheet shape check passed: 5 files, one table each, header on row 1, ${FOUR_HEADERS.length}, ${WB_HEADERS.length}, ${LEFT_HEADERS.length}, ${INV_HEADERS.length} and ${PRICE_HEADERS.length} columns, every row the same width.`);\n}\n\nwriteFileSync(join(OUT, F_COUNTER_CSV), toCsv(FOUR_HEADERS, fourRows));\nwriteFileSync(join(OUT, F_COUNTER_MD), md);\nwriteFileSync(join(OUT, F_WRITE_CSV), toCsv(WB_HEADERS, writeRows));\nwriteFileSync(join(OUT, F_WRITE_MD), writeMd);\nwriteFileSync(join(OUT, F_LEFT_CSV), toCsv(LEFT_HEADERS, leftRows));\nwriteFileSync(join(OUT, F_INVOICES_CSV), toCsv(INV_HEADERS, invoiceRows));\nwriteFileSync(join(OUT, F_INVOICES_MD), invoiceMd);\nwriteFileSync(join(OUT, F_PRICES_CSV), toCsv(PRICE_HEADERS, priceRows));\n\n// -------------------------------------------------------------------------------------------\n// THE RECEIPTS\n// -------------------------------------------------------------------------------------------\nconsole.log(\"\\nQUERIES AND ROW COUNTS\");\nfor (const q of QUERIES) console.log(` ${String(q.rows).padStart(6)} ${q.what.padEnd(16)} ${q.url}`);\n\nconsole.log(\"\\nRECONCILIATION LINE 1, the population\");\nconsole.log(` ${allIds.length} payments ${money(universeTotal)} = ${linkedIds.length} reached a customer ${money(linkedTotal)} + ${unlinkedIds.length} did not ${money(unlinkedTotal)}`);\nconsole.log(\"\\nRECONCILIATION LINE 2, the history of the number\");\nconsole.log(` ${history.everFailed.length} ever failed ${money(history.everFailedTotal)} = ${history.matchedLater.length} matched later ${money(history.matchedLaterTotal)} + ${history.thirdFigure.length} the figure sent ${money(history.thirdFigureTotal)}`);\nconsole.log(` ${history.thirdFigure.length} the figure sent ${money(history.thirdFigureTotal)} = ${history.semicolonBug.length} lost to the grouping key ${money(history.semicolonBugTotal)} + ${unlinkedIds.length} truly unlinked ${money(unlinkedTotal)}`);\nconsole.log(\"\\nRECONCILIATION LINE 0, the invoices\");\nconsole.log(` ${invoices.length} invoices ${money(parentInvoiceTotal)} = ${settledInvoices.length} settled ${money(settledTotal)} + ${unresolvedInvoices.length} unpaid ${money(unresolvedTotal)}`);\nconsole.log(` ${unresolvedInvoices.length} unpaid ${money(unresolvedTotal)} = ${realRows.length} real money ${money(realTotal)} + ${testRows.length} test rows ${money(testTotal)}`);\nconsole.log(\"\\nRECONCILIATION LINE 4, the price list\");\nconsole.log(` ${priceRows.length} rows = ${linksToMake.length} prices live in the CRM needing a payment link + ${archivedProducts.length} old prices archived`);\nconsole.log(\"\\nRECONCILIATION LINE 3, the write back\");\nconsole.log(` ${linkedIds.length} reached a customer ${money(linkedTotal)} = ${writtenPayments} would be written ${money(writtenTotal)} across ${writeRows.length} bookings + ${leftAlone.length} left alone ${money(leftAloneTotal)}`);\n\nif (amountSilentInJournal.length) {\n console.log(`\\nNOTE: ${amountSilentInJournal.length} payments worth ${money(amountSilentInJournal.reduce((a, x) => a + x.square, 0))} appear in the journal only on rows that carry no amount field, so their value is Square's figure alone:`);\n for (const x of amountSilentInJournal) console.log(` ${money(x.square).padStart(10)} ${x.id}`);\n}\nif (refundedPayments.size) {\n console.log(`\\nREFUNDS seen against payments in this population: ${refundedPayments.size}`);\n for (const g of refundedPayments.values()) console.log(` ${money(g.amount).padStart(10)} ${g.paymentId} ${[...g.kinds].join(\", \")}`);\n}\nconsole.log(\"\\nTHE FOUR, in the order Square took the money\");\nfor (const r of four) console.log(` ${r._createdAt} ${money(r._amount).padStart(10)} ${r._buyer.padEnd(22)} ${r[\"How sure I am\"].padEnd(34)} ${r._id}`);\nconsole.log(\"\\nPAYMENTS LEFT ALONE IN THE WRITE BACK\");\nfor (const r of leftAloneSorted) console.log(` ${money(r.amount).padStart(10)} ${r.buyer.padEnd(22)} ${r.why}`);\nconsole.log(`\\nWHAT THE BOOKING VALUE FIELD HOLDS TODAY: ${cardsWithValue} of ${opportunities.length} opportunities carry a value, using ${distinctValues.length} distinct figures:`);\nfor (const [v, n] of distinctValues) console.log(` ${money(v).padStart(12)} on ${n} cards`);\nconsole.log(`\\nHER BOARD NAMES, as her own CRM spells them: ${BOARDS.map((b) => `\"${b}\"`).join(\" and \")}`);\n\nconsole.log(\"\");\nfor (const f of [F_COUNTER_CSV, F_COUNTER_MD, F_WRITE_CSV, F_WRITE_MD, F_LEFT_CSV, F_INVOICES_CSV, F_INVOICES_MD, F_PRICES_CSV]) console.log(`Wrote ${join(OUT, f)}`);\nconsole.log(\"\\nNO WRITE WAS EXECUTED. Every call in this run was a read.\");\n\n\n\n=====FILE scripts/deploy.mjs =====\n// DEPLOY AND VERIFY. engine/*.ts -> the live val, then read every file back and compare hashes.\n//\n// Everything in here was learned by getting it wrong once:\n//\n// * PUT /v2/vals/{id}/files?path=X updates a file IN PLACE and keeps its interval trigger. POST\n// creates, and wants `path` in the QUERYSTRING, not the body. Get that wrong and the engine\n// stops running on its schedule with no error anywhere.\n// * engine/puppy_path_v1.1.ts is called main.ts on the val. It is the interval entry point. That\n// rename is the single most confusing thing about this deployment and it is why NAMES exists.\n// * READS ARE CACHED. A GET straight after a PUT returns the OLD content and the old hash. It\n// looks exactly like a write that silently failed. Send Cache-Control: no-cache, or check the\n// `version` field on the file listing, which is never stale.\n// [was: I read a file back, saw the old hash, and was one step from re-deploying over a write\n// that had already landed. The version number said 129 and the content said otherwise.]\n// * EVERY file is hard-capped at 80,000 characters, not just main.ts. Long comment blocks go in a\n// NOTES-*.md beside the code, which is a `file` on the val and inert: NOTES-v1.4.md for main.ts,\n// NOTES-dashboard.md for dashboard.ts. Every file this script pushes is measured against the cap\n// BEFORE anything is uploaded, and one that is over is refused here rather than by the API.\n// [was: this line named main.ts alone, and the only size the script printed was main.ts's — after\n// the push loop had already run. So the cap was rediscovered on 14 Aug 2026 the expensive way:\n// a push of dashboard.ts came back 400 `body/content must NOT have more than 80000 characters`\n// at 80,910, and Kim's status page went on serving the previous deploy — text an audit had\n// already proved false — while the corrected file sat in the tree unable to land. A ceiling\n// checked on one file is not checked.]\n//\n// Usage:\n// node scripts/deploy.mjs --check # compare only, change nothing (default)\n// node scripts/deploy.mjs --push # upload anything that differs, then verify\n// node scripts/deploy.mjs --push --only kim-stories.ts\n// node scripts/deploy.mjs --bundle # store handover/SOURCE-BUNDLE.part*.txt on the val\nimport { readFileSync, readdirSync } from \"node:fs\";\nimport { createHash } from \"node:crypto\";\nimport { join, dirname, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\n\nconst ROOT = resolve(dirname(fileURLToPath(import.meta.url)), \"..\");\nconst TOKEN = (process.env.VAL_TOWN_API_TOKEN ?? \"\").trim();\nconst VAL = (process.env.VAL_TOWN_VAL_ID ?? \"\").trim();\n\nif (!TOKEN || !VAL) {\n console.error(\n \"Deployment credentials are not configured. Set VAL_TOWN_API_TOKEN and VAL_TOWN_VAL_ID \" +\n \"in the shell or a secure secret manager; they must never be committed to this project.\",\n );\n process.exit(2);\n}\n\n// local file name -> name on the val. Only the entry point differs.\nconst NAMES = { \"puppy_path_v1.1.ts\": \"main.ts\" };\n// val file types. Getting this wrong turns a module into an endpoint or vice versa.\nconst TYPES = {\n \"main.ts\": \"interval\",\n // A SECOND scheduled file. It refreshes the holiday deposit list and nothing else. It is separate\n // from main.ts because main.ts is at its character ceiling and because a job that reads two\n // calendars must not be able to take the follow-up engine down with it.\n \"deposits-cron.ts\": \"interval\",\n // The early-warning monitor must wake on its own schedule; the report it produces is served by\n // the separate HTTP view below.\n \"watch-cron.ts\": \"interval\",\n \"run.ts\": \"http\", \"report.ts\": \"http\", \"paths.ts\": \"http\", \"gads.ts\": \"http\",\n \"dashboard.ts\": \"http\", \"api.ts\": \"http\", \"aged.ts\": \"http\", \"deposits.ts\": \"http\",\n \"watch-view.ts\": \"http\",\n // Kim's daily attribution/dashboard endpoint. It must remain an HTTP file: the safe default for\n // an unlisted module is `script`, which would silently remove the page on a later full deploy.\n \"tracking.ts\": \"http\",\n // The URL Google Ads' scheduled upload fetches. It MUST be `http`; deployed as a `script` (the\n // default this map exists to override) it would have no endpoint at all, and the schedule would\n // be pointed at a URL that never existed. gads-rows.ts beside it is a plain module and correctly\n // takes the default.\n \"gads-feed.ts\": \"http\",\n \"google-ads-ingest.ts\": \"http\",\n \"NOTES-v1.4.md\": \"file\",\n // dashboard.ts's own notes file, added 14 Aug 2026 when that file hit the same ceiling main.ts\n // did. A SECOND notes file rather than more of the first: two files at their cap appending to one\n // document is a collision waiting to happen, and a `file` is inert either way.\n \"NOTES-dashboard.md\": \"file\",\n // every SOURCE-BUNDLE part is a `file` too; handled by the prefix rule in typeFor()\n};\nconst typeFor = (name) => TYPES[name] ?? (name.startsWith(\"SOURCE-BUNDLE\") ? \"file\" : \"script\");\n\n// THE CAP, AND WHY IT IS MEASURED IN BOTH UNITS.\n//\n// val.town refuses any file over 80,000 characters with HTTP 400 and the body\n// `body/content must NOT have more than 80000 characters`. Nothing is pushed before every file has\n// been measured against it.\n// [was: main.ts only, printed after the push loop. See the note at the top of this file for what\n// that cost on 14 Aug 2026.]\n//\n// BOTH UNITS. The cap is documented in characters and `.length` counts UTF-16 units, but nothing\n// here has ever confirmed val.town is not counting BYTES — and these files carry em-dashes and\n// curly quotes, so the two numbers differ by hundreds. On 6 Aug main.ts read 79,815 characters and\n// 80,137 bytes at the same moment: \"185 to spare\" on one measure and over the line on the other.\n// The push was accepted, which is evidence the cap is characters, but the stricter number is the\n// one worth watching, so both are printed and the gate uses the worse of the two.\nconst CAP = 80_000;\n// NEAR is not decoration. A file within this of the ceiling is one ordinary edit from a 400, and\n// the number is only useful while there is still room to act on it.\nconst NEAR = 5_000;\nconst sizeOf = (src) => {\n const chars = src.length;\n const bytes = Buffer.byteLength(src, \"utf8\");\n return { chars, bytes, worst: Math.max(chars, bytes), spare: CAP - Math.max(chars, bytes) };\n};\nconst sizeLine = (s) => `${s.chars.toLocaleString()} characters / ${s.bytes.toLocaleString()} bytes`;\n\nconst sha = (s) => createHash(\"sha256\").update(s).digest(\"hex\").slice(0, 12);\nconst has = (flag) => process.argv.includes(flag);\nconst arg = (flag) => { const i = process.argv.indexOf(flag); return i > -1 ? process.argv[i + 1] : null; };\n\nconst api = (path, init = {}) =>\n fetch(`https://api.val.town/v2/vals/${VAL}${path}`, {\n ...init,\n headers: {\n Authorization: `Bearer ${TOKEN}`,\n // Never optional on a read. See the note at the top of this file.\n \"Cache-Control\": \"no-cache\",\n ...(init.body ? { \"Content-Type\": \"application/json\" } : {}),\n ...(init.headers ?? {}),\n },\n });\n\nasync function readLive(name) {\n const r = await api(`/files/content?path=${encodeURIComponent(name)}&_=${sha(name + Math.random())}`);\n if (!r.ok) return null;\n const text = await r.text();\n // The content endpoint returns a JSON error object rather than a status code for a missing file.\n if (text.startsWith('{\"error\"')) return null;\n return text;\n}\n\nasync function versionOf(name) {\n const r = await api(`/files?path=${encodeURIComponent(name)}`);\n if (!r.ok) return null;\n const j = await r.json();\n return (j.data ?? [])[0]?.version ?? null;\n}\n\n/**\n * Read back and compare, RETRYING. A read straight after a write can return the previous content\n * for a few seconds even with Cache-Control: no-cache, so a single read that disagrees is not\n * evidence of a failed write.\n * [was: one read. It reported a bundle part as \"PUSHED BUT DID NOT VERIFY\" when the write had\n * landed perfectly — the version number was already correct while the content endpoint was\n * still serving the old body. That is a false alarm that invites re-pushing over good data.]\n */\nasync function verifyLive(name, content, tries = 4) {\n for (let i = 0; i < tries; i++) {\n const live = await readLive(name);\n if (live !== null && sha(live) === sha(content)) return { ok: true, live };\n if (i < tries - 1) await new Promise((r) => setTimeout(r, 1500 * (i + 1)));\n }\n return { ok: false, live: await readLive(name) };\n}\n\nasync function push(name, content) {\n const body = JSON.stringify({ content, type: typeFor(name) });\n // PUT UPDATES, POST CREATES. A PUT at a path that does not exist yet returns 404 \"File not\n // found\", which reads like a permissions or naming problem and is neither.\n // [was: PUT only. The first genuinely new engine file since this script was written —\n // puppy-detect.ts — failed to deploy with a 404 and the script had no idea why.]\n let r = await api(`/files?path=${encodeURIComponent(name)}`, { method: \"PUT\", body });\n if (r.status === 404) {\n r = await api(`/files?path=${encodeURIComponent(name)}`, { method: \"POST\", body });\n }\n if (r.ok) return { ok: true, status: r.status };\n return { ok: false, status: r.status, detail: (await r.text()).slice(0, 300) };\n}\n\n// The bundle parts are inert `file` entries on the val: the project's second home, next to the\n// code they describe. Same push-and-verify path as everything else, so they cannot rot silently.\nasync function pushBundle() {\n const dir = join(ROOT, \"handover\");\n const parts = readdirSync(dir).filter((f) => /^SOURCE-BUNDLE.*\\.txt$/.test(f)).sort();\n if (!parts.length) { console.log(\"no bundle parts found. Run: node scripts/bundle.mjs\"); return 1; }\n let bad = 0;\n for (const name of parts) {\n const content = readFileSync(join(dir, name), \"utf8\");\n // Same gate, same units, same helper as the engine files below. [was: `content.length` alone,\n // so a part whose bytes were over the cap while its characters were under it was pushed anyway\n // and had to be refused by the API instead.]\n const size = sizeOf(content);\n if (size.worst > CAP) { console.log(`${name} OVER THE ${CAP.toLocaleString()}-CHARACTER CAP (${sizeLine(size)}) — NOT PUSHED. Re-split it: node scripts/bundle.mjs`); bad++; continue; }\n const r = await push(name, content);\n if (!r.ok) { console.log(`${name} PUSH FAILED ${r.status}: ${r.detail}`); bad++; continue; }\n const v = await verifyLive(name, content);\n console.log(`${name} ${sizeLine(size)} ${v.ok ? `verified (v${await versionOf(name)})` : \"DID NOT VERIFY after 4 reads\"}`);\n if (!v.ok) bad++;\n }\n return bad;\n}\n\n// Branch BEFORE the engine comparison below, which runs at top level.\nif (has(\"--bundle\")) {\n const bad = await pushBundle();\n if (bad) console.log(`\\n${bad} bundle part(s) failed.`);\n process.exit(bad ? 1 : 0);\n}\n\nconst only = arg(\"--only\");\n// ---- THE CAP, MEASURED ON EVERY FILE, BEFORE ANY OF THEM IS PUSHED --------------------------\n//\n// Read and measured here, once, ahead of the first upload: an over-cap file is then refused by this\n// script rather than by a 400 halfway through a deploy. Printed every run for anything within NEAR\n// of the ceiling, because a number nobody sees until it breaks is the same as no number at all —\n// which is exactly how dashboard.ts reached 80,910 without anyone noticing it was close.\n//\n// MEASURED ACROSS ALL OF engine/, INCLUDING UNDER --only. The doctrine one block down used to read\n// \"say the number every time, not just when it breaks\", and a run narrowed to one file is still a\n// run: `--only kim-stories.ts` must not be the reason nobody was told main.ts had 418 characters\n// left. The REFUSAL below is scoped to what this run would actually push; the numbers are not.\nconst sizedAll = readdirSync(join(ROOT, \"engine\"))\n .filter((f) => f.endsWith(\".ts\") || f.endsWith(\".md\"))\n .map((f) => {\n const src = readFileSync(join(ROOT, \"engine\", f), \"utf8\");\n return { file: f, name: NAMES[f] ?? f, src, ...sizeOf(src) };\n });\nconst locals = sizedAll.filter((x) => !only || x.name === only || x.file === only);\n\nif (!locals.length) { console.log(\"nothing to deploy: engine/ has no source files\"); process.exit(1); }\n\nconst over = sizedAll.filter((s) => s.worst > CAP);\nconst near = sizedAll.filter((s) => s.worst <= CAP && s.spare < NEAR).sort((a, b) => a.spare - b.spare);\n\nconsole.log(`${CAP.toLocaleString()}-character cap: ${sizedAll.length} file(s) measured, ${over.length} over, ${near.length} within ${NEAR.toLocaleString()} of it`);\nfor (const s of near) {\n console.log(` ${s.name.padEnd(21)} ${sizeLine(s)} ${s.spare.toLocaleString()} to spare on the stricter of the two`);\n}\nfor (const s of over) {\n console.log(` ${s.name.padEnd(21)} ${sizeLine(s)} OVER BY ${(-s.spare).toLocaleString()} — WILL NOT BE PUSHED`);\n console.log(` ${\" \".repeat(21)} val.town answers 400 body/content must NOT have more than ${CAP} characters.`);\n console.log(` ${\" \".repeat(21)} Move long comment blocks into a NOTES-*.md registered in TYPES as a \\`file\\`,`);\n console.log(` ${\" \".repeat(21)} leaving a one-line pointer at each site. Move comments, never behaviour.`);\n}\nif (!near.length && !over.length) console.log(` every file has more than ${NEAR.toLocaleString()} characters of headroom`);\nconsole.log(\"\");\n\nlet drift = 0, pushed = 0, failed = 0;\nconsole.log(`${has(\"--push\") ? \"PUSH\" : \"CHECK\"} ${locals.length} files val ${VAL}\\n`);\nconsole.log(\"local file val name local live state\");\n\nfor (const { file, name, src: local, worst } of locals) {\n let live = await readLive(name);\n let state;\n\n if (live === null) state = \"MISSING ON VAL\";\n else if (sha(live) === sha(local)) state = \"same\";\n else state = \"DIFFERS\";\n\n // REFUSED HERE, NOT BY THE API. The rest of the deploy still goes, exactly as an over-cap bundle\n // part does not stop the parts either side of it; the run exits non-zero at the bottom.\n if (state !== \"same\" && worst > CAP) {\n state = `${state}, but OVER THE ${CAP.toLocaleString()}-CHARACTER CAP — NOT PUSHED`;\n } else if (state !== \"same\" && has(\"--push\")) {\n const r = await push(name, local);\n if (!r.ok) { state = `PUSH FAILED ${r.status}: ${r.detail}`; failed++; }\n else {\n // Verify by re-reading, uncached and with retries. A 2xx is not proof.\n const v = await verifyLive(name, local);\n live = v.live;\n if (v.ok) { state = `pushed, verified (v${await versionOf(name)})`; pushed++; }\n else { state = `PUSHED BUT DID NOT VERIFY after 4 reads (live ${live === null ? \"missing\" : sha(live)})`; failed++; }\n }\n } else if (state !== \"same\") drift++;\n\n console.log(`${file.padEnd(26)} ${name.padEnd(21)} ${sha(local).slice(0, 8).padEnd(12)} ${(live === null ? \"-\" : sha(live).slice(0, 8)).padEnd(12)} ${state}`);\n}\n\n// Every file's ceiling is checked and printed at the top of the run now, before anything is\n// uploaded. This is the same fact said at the end, where the exit code is decided.\n// [was: main.ts's size alone, read here, printed here, and gated here — AFTER the push loop. So\n// even for the one file it did cover it was a post-mortem: the 400 came first and the number\n// came second. Every other file it did not cover at all.]\n// Said of engine/ as a whole, not of this run's --only scope: a file over the cap is undeployable\n// whether or not this particular invocation was going to touch it, and a narrowed run is the last\n// place a ceiling should be allowed to go unmentioned.\nif (over.length) {\n console.log(`\\n${over.length} file(s) in engine/ are over the ${CAP.toLocaleString()}-character cap:`);\n for (const s of over) console.log(` ${s.file} -> ${s.name} ${sizeLine(s)} (over by ${(-s.spare).toLocaleString()})`);\n console.log(\"None of them can deploy until it is back under the cap. Move comments, not behaviour.\");\n process.exit(1);\n}\n\nif (failed) { console.log(`\\n${failed} file(s) failed to deploy or verify.`); process.exit(1); }\nif (has(\"--push\")) console.log(`\\n${pushed} pushed and verified, ${locals.length - pushed} already matching.`);\nelse if (drift) { console.log(`\\n${drift} file(s) differ from the val. Run with --push.`); process.exit(1); }\nelse console.log(\"\\nlive matches local, every file.\");\n\n\n=====FILE scripts/exception-report-lib.mjs =====\n// PURE LOGIC for the weekly Square exception report, split out of exception-report.mjs so\n// tests/exception-report.test.mjs can call the exact code the generator runs, on a synthetic\n// journal, with no network and no CLI side effects. Same reason engine/facts.ts's squareBacklog is\n// tested directly rather than through the dashboard that renders it.\n//\n// THE ONE RULE THIS FILE EXISTS TO ENFORCE, TWICE. This mirrors engine/facts.ts squareBacklog()\n// (read it there first) closely enough to be checked line by line against it, because\n// squareBacklog() only returns totals and this report needs to name individual payments. Two\n// independent readings of the same rule is the point: reconcile() below cross checks this file's\n// list against the real, imported squareBacklog() and refuses to agree unless every count and\n// every dollar match.\n//\n// THE TRAP ($10,884.00 across 9 payments, engine/facts.ts:64-69): the bridge re-logs a payment on\n// every retry. A payment that logs a NO-MATCH row and THEN, on a later attempt, a row that DOES\n// carry a match (kind REVENUE-ON-CLIENT-OPP, PAYMENT, CAPI-PURCHASE, INVOICE-LINKED, or any row at\n// all with a contactId) is matched, full stop. The two lines marked MATCHED-LATER GUARD below are\n// the entire fix. Removing either one reintroduces the exact bug Kim was quoted a wrong number\n// over. tests/exception-report.test.mjs asserts both that the guard excludes the trap payments AND\n// that removing it is what the reconciliation check would catch.\n\nexport const MATCHED_KINDS = new Set([\"REVENUE-ON-CLIENT-OPP\", \"PAYMENT\", \"CAPI-PURCHASE\", \"INVOICE-LINKED\"]);\n\n// Refund rows carry their own id namespace (a refund id, not a payment id). They must never be\n// counted as payments, in either direction: a refund id in the population would inflate the\n// denominator, and a refund's contactId would mark a payment \"linked\" that never was.\nexport const REFUND_KINDS = new Set([\n \"REFUND\", \"REFUND-NO-MATCH\", \"REFUND-PENDING\", \"REFUND-DUP\", \"REFUND-PENDING-APPLIED\", \"BAD-REFUND\",\n]);\n\n// A bridge self test, not a Square sale. The bridge posts itself a $1.00 payment with an id of\n// this shape to prove the pipe works; Square 404s it because no such payment exists. It is LINKED\n// (it carries a contactId), so it never touched the unmatched list, but leaving it in the\n// population puts a dollar of invented revenue in the denominator.\nexport const SELF_TEST_PAYMENT_ID = /^(TESTPAY|captest)[-_]/i;\n\n/**\n * Every Square payment id a single journal row refers to, in every shape the bridge writes one.\n *\n * THE TRAILING PUNCTUATION BUG, found live 12 Aug 2026, and the reason this is a function.\n * engine/facts.ts squareBacklog() and unmatchedPaymentRows() below both group by\n * `/payment\\s+(\\S+)/` against the row's note. `\\S+` is greedy about punctuation, and the bridge\n * writes two note shapes for the same payment:\n * \"payment \" (the NO-MATCH row)\n * \"backfilled from square payment ; client opp untouched\" (the row that RESOLVED it)\n * The second one yields \";\" WITH THE SEMICOLON, which is a different map key from \"\".\n * So one payment becomes two payments: the NO-MATCH half looks permanently unmatched and the\n * resolved half sits under a key nothing ever reads. The MATCHED-LATER GUARD is correct and never\n * fires, because the matched row is not in the group it is guarding.\n *\n * Measured on the live journal: 29 payments worth $20,682.00 were being reported as never having\n * reached a customer record when the bridge's own journal names the contact each one was\n * backfilled to, at the same timestamp, with a contactId on the row. That is the same class of\n * error as the $10,884.00 overstatement of 9 Aug, one layer down: that one read only the first\n * ATTEMPT, this one reads only half the KEY.\n *\n * Trailing punctuation is stripped, and the id field the bridge puts on PAY-DUP rows (which have\n * no note at all) is read as well.\n */\nexport function squarePaymentIdsInRow(row) {\n const out = new Set();\n if (REFUND_KINDS.has(row?.kind)) return out; // refund ids live in their own namespace\n const clean = (s) => String(s ?? \"\").replace(/[;,.]+$/, \"\");\n if (typeof row?.id === \"string\" && row.id) out.add(clean(row.id));\n const m = /payment\\s+(\\S+)/.exec(String(row?.note ?? \"\"));\n if (m) out.add(clean(m[1]));\n for (const id of out) if (!id || SELF_TEST_PAYMENT_ID.test(id)) out.delete(id);\n return out;\n}\n\n/**\n * THE DENOMINATOR. Every distinct Square payment id the bridge has EVER logged, linked or not.\n *\n * WHY THIS EXISTS ALONGSIDE unmatchedPaymentRows(). That function answers \"which payments never\n * reached a contact\", which is a subset, and LESSONS.md #8 is explicit that a subset may not leave\n * the building without its parent total. There was no parent total to reconcile against until now.\n *\n * THE SECOND READER (do not remove). unmatchedPaymentRows() and engine/facts.ts squareBacklog()\n * both find a payment id by regexing `payment ` out of the row's NOTE. That is correct for\n * every row those two functions need, but it is NOT the whole journal: the bridge writes\n * `journal({ kind: \"PAY-DUP\", contactId, id: paymentId })` (bridge-main v3.10, addPayment) with an\n * `id` FIELD and NO note at all. Those rows are invisible to a note regex. Read live on 12 Aug\n * 2026: 88 payment ids are reachable through notes, 93 through notes plus the id field. The 5\n * extra are all already linked, so the unmatched SUBSET is unaffected and the two functions stay\n * correct; what changes is that \"33 unlinked\" can finally be quoted against a real population\n * (33 of 93) instead of against nothing. Counting every attempt, in every shape the bridge writes\n * it, is the same rule as the MATCHED-LATER GUARD, one step out.\n *\n * Journal in; { payments: Map, linked: string[], unlinked: string[] } out.\n */\nexport function paymentUniverse(journal) {\n const empty = { payments: new Map(), linked: [], unlinked: [] };\n if (!Array.isArray(journal)) return empty;\n const payments = new Map();\n for (const r of journal) {\n for (const id of squarePaymentIdsInRow(r)) (payments.get(id) ?? payments.set(id, []).get(id)).push(r);\n }\n const linked = [], unlinked = [];\n for (const [id, rs] of payments) {\n // Same test as the MATCHED-LATER GUARD: any row, any attempt, that ties this payment to a\n // contact means linked, full stop.\n const isLinked = rs.some((r) => MATCHED_KINDS.has(r?.kind) || (typeof r?.contactId === \"string\" && r.contactId.length > 4));\n (isLinked ? linked : unlinked).push(id);\n }\n return { payments, linked, unlinked };\n}\n\n/** The amount the journal carries for a payment: the first positive one on any of its rows. */\nexport function journalAmount(rows) {\n return (rows ?? []).map((r) => Number(r?.amount) || 0).find((a) => a > 0) ?? 0;\n}\n\n/**\n * Every distinct Square payment that logged at least one NO-MATCH row and was NEVER matched on\n * any later attempt. Journal in, one row per unmatched payment out, oldest first.\n */\nexport function unmatchedPaymentRows(journal) {\n if (!Array.isArray(journal)) return [];\n // Uses squarePaymentIdsInRow, NOT an inline regex. See THE TRAILING PUNCTUATION BUG at the top\n // of this file: an inline `/payment\\s+(\\S+)/` here keyed the resolving row under \";\" and\n // the failing row under \"\", so the MATCHED-LATER GUARD below guarded a group the matched\n // row was not in, and 29 payments worth $20,682.00 read as unmatched forever.\n const rowsFor = new Map();\n for (const r of journal) {\n for (const id of squarePaymentIdsInRow(r)) {\n (rowsFor.get(id) ?? rowsFor.set(id, []).get(id)).push(r);\n }\n }\n const out = [];\n for (const [id, rs] of rowsFor) {\n if (!rs.some((r) => r?.kind === \"NO-MATCH\")) continue; // never failed: not a backlog item\n // MATCHED-LATER GUARD (do not remove, see file header): any matched row anywhere in this\n // payment's history means the payment is matched, no matter how many times it failed first.\n if (rs.some((r) => MATCHED_KINDS.has(r?.kind) || (typeof r?.contactId === \"string\" && r.contactId.length > 4))) continue;\n const amt = rs.map((r) => Number(r?.amount) || 0).find((a) => a > 0) ?? 0;\n const trail = rs.some((r) => r?.hadEmail === true || r?.hadPhone === true || r?.hadCustomerId === true);\n const tss = rs.map((r) => r?.ts).filter(Boolean).sort();\n out.push({\n paymentId: id,\n amount: amt,\n hasTrail: trail,\n hadEmailAtIngest: rs.some((r) => r?.hadEmail === true),\n hadPhoneAtIngest: rs.some((r) => r?.hadPhone === true),\n hadCustomerIdAtIngest: rs.some((r) => r?.hadCustomerId === true),\n journalRowCount: rs.length,\n firstSeen: tss[0] ?? null,\n lastSeen: tss[tss.length - 1] ?? null,\n });\n }\n out.sort((a, b) => String(a.firstSeen ?? \"\").localeCompare(String(b.firstSeen ?? \"\")));\n return out;\n}\n\nexport function cents(n) { return Math.round(Number(n) * 100); }\n\n/**\n * Cross checks a row list from unmatchedPaymentRows() against the real squareBacklog() aggregate.\n * Pure: returns {ok, problems, listTotal, withTrailTotal, noTrailTotal} rather than exiting, so\n * both the CLI (which shouts and exits on failure) and tests (which assert on the result) can use\n * it the same way.\n */\nexport function reconcile(rows, backlog) {\n const problems = [];\n if (!backlog) {\n return { ok: false, problems: [\"squareBacklog() returned null\"], listTotal: 0, withTrailTotal: 0, noTrailTotal: 0 };\n }\n const withTrail = rows.filter((r) => r.hasTrail);\n const noTrail = rows.filter((r) => !r.hasTrail);\n const listTotal = rows.reduce((a, x) => a + x.amount, 0);\n const withTrailTotal = withTrail.reduce((a, x) => a + x.amount, 0);\n const noTrailTotal = noTrail.reduce((a, x) => a + x.amount, 0);\n\n if (rows.length !== backlog.payments) problems.push(`payment count: list has ${rows.length}, squareBacklog() says ${backlog.payments}`);\n if (cents(listTotal) !== cents(backlog.total)) problems.push(`total: list sums to $${listTotal.toFixed(2)}, squareBacklog() says $${backlog.total.toFixed(2)}`);\n if (withTrail.length !== backlog.withTrail) problems.push(`with-trail count: ${withTrail.length} vs squareBacklog() ${backlog.withTrail}`);\n if (noTrail.length !== backlog.noTrail) problems.push(`no-trail count: ${noTrail.length} vs squareBacklog() ${backlog.noTrail}`);\n if (cents(withTrailTotal) !== cents(backlog.withTrailTotal)) problems.push(`with-trail total: $${withTrailTotal.toFixed(2)} vs squareBacklog() $${backlog.withTrailTotal.toFixed(2)}`);\n if (cents(noTrailTotal) !== cents(backlog.noTrailTotal)) problems.push(`no-trail total: $${noTrailTotal.toFixed(2)} vs squareBacklog() $${backlog.noTrailTotal.toFixed(2)}`);\n if (cents(withTrailTotal + noTrailTotal) !== cents(backlog.total)) problems.push(`with-trail + no-trail does not equal the total`);\n\n return { ok: problems.length === 0, problems, listTotal, withTrailTotal, noTrailTotal };\n}\n\n\n",[586],"707695de-a658-46e4-88eb-d1bdeac9aa10","SOURCE-BUNDLE.part35.txt","8a7ac07e-97ea-11f1-a03f-1607ee4eb77e",1205,["D",1786982936896],"THE DOGS SPOT — SOURCE BUNDLE (part 35 of 47)\n\nEVERY source file in this project, engine/ included. Restoring these parts and nothing else gives\nyou a tree that builds, typechecks and runs its own test suite with no network and no val.\n\nengine/ is here as of 14 Aug 2026. It used to be left out because val 1bfa6e81-74e1-4c6c-ab32-118304a4ffff\nholds it, which was true of every engine file except engine/watch.ts: a module the val does not run,\nso it was never deployed, so it lived in one container and nothing else. A reclaim destroyed it.\nscripts/deploy.mjs --check still compares engine/ against the val file by file; that is a second\ncheck on the same files now, not the only copy of them.\n\nRESTORE (needs only node, from an empty folder). Save each part, then run this ON EACH ONE:\n\n node -e 'const fs=require(\"fs\"),p=require(\"path\");const b=fs.readFileSync(process.argv[1],\"utf8\");\n for(const s of b.split(\"\\n=====FILE \").slice(1)){const i=s.indexOf(\" =====\\n\");\n const f=s.slice(0,i),c=s.slice(i+7);fs.mkdirSync(p.dirname(f),{recursive:true});\n fs.writeFileSync(f,c.replace(/\\n$/,\"\"))}' PART.txt\n\nA record named #1, #2, ... is one FILE cut into pieces: concatenate them in order, then\nstrip one trailing newline from the last. scripts/restore.mjs does this for you.\n\nEach part is complete in itself: whole files only, no reassembly, any order.\n\nThen: node scripts/build.mjs (engine/ came out of these parts; nothing to fetch first)\n node scripts/typecheck.mjs\n node tests/run-all.mjs\n node scripts/deploy.mjs --check (pulls nothing, proves the val matches what you restored)\n node tests/negative-controls.mjs (proves the suite above can actually fail)\n\nIN THIS PART (1 of 129 files)\n\n\n================================================================================================\n=====FILE scripts/counter-sales-correction.mjs#1 =====\n#!/usr/bin/env node\n// THE COUNTER SALES CORRECTION PACK. Generator, 12 Aug 2026.\n//\n// WHY THIS EXISTS. The client has, in writing, \"33 counter sales worth $22,651.99 are recorded but\n// not linked to a customer, four with a partial trail worth $2,829.99 and 29 worth $19,822.00 that\n// arrived with no name, email or phone attached at all\". That is the THIRD wrong version of this\n// one number (42 / $33,535.99, then 29 / $19,822.00, then 33 / $22,651.99). The true figure is\n// 4 payments worth $1,969.99. LESSONS.md #14 has the cause: the grouping KEY, not the rule.\n//\n// WHAT IT WRITES (all to /mnt/user-data/outputs, override with CORRECTION_OUT_DIR):\n// counter-sales-not-linked.csv the four, each verified against Square itself\n// counter-sales-CORRECTION.md one page for the owner, leading with the corrected figure\n// writeback-dry-run.csv the real remaining work: money on a named customer, not on a booking\n//\n// NOTHING HERE WRITES TO A LIVE SYSTEM. Every call is a GET except POST /contacts/search, which is\n// GoHighLevel's read route for contacts and mutates nothing. There is no PUT, PATCH or DELETE in\n// this file, and no code path that sets an opportunity value. File 3 describes a write; it is not\n// one. Same posture as engine/money-match.ts and scripts/client-files-rebuild.mjs, and for the\n// same reason: another application also writes opportunities in this location, so until its owner\n// confirms whether it owns monetaryValue, two systems would own one field and one would win at\n// random.\n//\n// THE RULES IT ENFORCES, each one already paid for:\n// - THE RULE IS IMPORTED, NEVER RETYPED (LESSONS #14). paymentUniverse() and\n// squarePaymentIdsInRow() come from scripts/exception-report-lib.mjs, the tested parser. A\n// fourth hand written copy of \"which payments are unlinked\" is how the first three went wrong.\n// - AND THEN CHECKED BY A METHOD THAT SHARES NO CODE WITH IT. independentUnmatched() below\n// re-derives the same set by SET SUBTRACTION with a shape based id parser, and the run dies if\n// the two disagree. Two readings that share a helper share its bugs.\n// - A SUBSET NEVER SHIPS WITHOUT ITS PARENT (LESSONS #8). Every population is printed as \"n of N\"\n// and the remainder is proved to add back, in rows and in cents, or the run dies.\n// - NEVER TRUST A FLAG TO ANSWER A QUESTION IT WAS NOT ASKED (engine/facts.ts squareSentence).\n// hadEmail/hadPhone/hadCustomerId describe the WEBHOOK PAYLOAD, not what Square holds. Live,\n// they are backwards for two of the four. Every buyer detail in file 1 comes from Square's own\n// record through ?lookup=, and the disagreement is printed rather than smoothed over.\n// - NO DASHES AS PUNCTUATION, AND NEVER THE WORD \"DAYCARE\", in anything the client reads.\n// Checked mechanically at the end, same as scripts/exception-report.mjs.\n// - SENTENCES ARE GENERATED FROM VALUES. Every figure in the markdown is interpolated from a\n// computed variable. No number is typed beside prose anywhere in this file.\n//\n// USAGE\n// source /home/claude/.ghlenv && node scripts/counter-sales-correction.mjs\n// ENV\n// GHL_TOKEN, BRIDGE_ADMIN required\n// CORRECTION_OUT_DIR default /mnt/user-data/outputs\n// CORRECTION_CACHE_DIR if set, raw API responses are cached here and reused on re-run\n\nimport { writeFileSync, mkdirSync, existsSync, readFileSync } from \"node:fs\";\nimport { join, dirname, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\n\nconst HERE = dirname(fileURLToPath(import.meta.url));\nconst ROOT = resolve(HERE, \"..\");\nconst { paymentUniverse, journalAmount, cents } = await import(join(ROOT, \"scripts\", \"exception-report-lib.mjs\"));\n\nconst shout = (m) => console.error(`\\n!!!! ${m} !!!!\\n`);\nconst die = (m) => { shout(m); process.exit(1); };\n\nconst LOCATION = \"BQHJ19uohldYe3eqA0bl\";\nconst GHL = \"https://services.leadconnectorhq.com\";\nconst BRIDGE = \"https://amir5--41ace24c7e2111f18c9d1607ee4eb77e.web.val.run\";\nconst UA = \"curl/8.5.0\"; // the API 403s without this exact User-Agent. Not optional, not cosmetic.\nconst TOKEN = process.env.GHL_TOKEN;\nconst ADMIN = process.env.BRIDGE_ADMIN;\nif (!TOKEN) die(\"GHL_TOKEN is not set. `source /home/claude/.ghlenv` first.\");\nif (!ADMIN) die(\"BRIDGE_ADMIN is not set. `source /home/claude/.ghlenv` first.\");\n\n// THE TWO STAGES A PAYMENT MAY EVER BE WRITTEN TO. Asserted equal to engine/money-match.ts's own\n// list below: the scope lives in both places on purpose, and an unscoped write puts money on a\n// Survey Requested card (proven live, $4,020 of $4,685 landed off the booking board).\nconst VALUABLE_STAGES = [\"fd821b4e-bbe6-44de-b754-fa80e4823616\", \"ae173310-f8b1-4399-acb7-ef1fc03d3697\"];\n// USE HER NAMES FOR HER THINGS. This map is filled from the client's own pipeline definition at\n// run time and is deliberately EMPTY here. A typed copy of a board name drifts silently: this file\n// carried \"Won and Paid\" for weeks and the board in her CRM is called \"Won - Paid\". A client\n// reading a board name that does not exist on her screen cannot check anything we tell her.\nconst STAGE_NAME = {};\nconst IN_SCOPE = new Set(VALUABLE_STAGES);\n{\n const src = readFileSync(join(ROOT, \"engine\", \"money-match.ts\"), \"utf8\");\n for (const s of VALUABLE_STAGES) {\n if (!src.includes(s)) die(`stage ${s} is not in engine/money-match.ts VALUABLE_STAGES. The two scope lists have drifted; fix that before planning a write.`);\n }\n}\n\nconst CACHE = process.env.CORRECTION_CACHE_DIR || \"\";\nif (CACHE) mkdirSync(CACHE, { recursive: true });\nconst cacheGet = (k) => (CACHE && existsSync(join(CACHE, k)) ? JSON.parse(readFileSync(join(CACHE, k), \"utf8\")) : null);\nconst cachePut = (k, v) => { if (CACHE) writeFileSync(join(CACHE, k), JSON.stringify(v)); return v; };\nconst sleep = (ms) => new Promise((r) => setTimeout(r, ms));\n\n// THE QUERY LOG. Every figure has to be traceable to the call that produced it and the row count\n// that came back, so every fetch appends here and the whole log prints at the end.\nconst QUERIES = [];\nconst logQuery = (what, url, rows) => { QUERIES.push({ what, url, rows }); return rows; };\n\nasync function jsonFetch(url, opts = {}, tries = 6) {\n let last = null;\n for (let t = 0; t < tries; t++) {\n try {\n const res = await fetch(url, { ...opts, headers: { \"User-Agent\": UA, Accept: \"application/json\", ...(opts.headers ?? {}) } });\n const text = await res.text();\n if (!res.ok) { last = `HTTP ${res.status}: ${text.slice(0, 200)}`; await sleep(1200 * (t + 1)); continue; }\n return JSON.parse(text);\n } catch (e) { last = e.message; await sleep(1200 * (t + 1)); }\n }\n die(`fetch failed after ${tries} tries: ${url.replace(/admin=[^&]+/, \"admin=\")}\\n last error: ${last}`);\n}\nconst ghlHeaders = { Authorization: `Bearer ${TOKEN}`, Version: \"2021-07-28\" };\n\n// -------------------------------------------------------------------------------------------\n// FETCHES. An empty page is retried, never believed, and the stop condition is the STATED TOTAL\n// as it stood at the FIRST page (LESSONS #15: a walk once stopped at 900 of 5,708 and reported\n// 900 as the whole CRM). Zero rows anywhere is a hard failure, never an empty success.\n// -------------------------------------------------------------------------------------------\nasync function fetchAllContacts() {\n const hit = cacheGet(\"contacts.json\"); if (hit) return logQuery(\"contacts\", \"POST /contacts/search {locationId, pageLimit:100, searchAfter}\", hit.length), hit;\n const all = []; const seen = new Set(); let searchAfter = null; let stated = null; let target = null; let empties = 0;\n while (true) {\n const body = { locationId: LOCATION, pageLimit: 100, ...(searchAfter ? { searchAfter } : {}) };\n const d = await jsonFetch(`${GHL}/contacts/search`, { method: \"POST\", headers: { ...ghlHeaders, \"Content-Type\": \"application/json\" }, body: JSON.stringify(body) });\n const page = d?.contacts ?? [];\n stated = d?.total ?? stated;\n if (target === null && stated != null) target = stated;\n if (page.length === 0) { if (++empties >= 3) break; await sleep(2500); continue; }\n empties = 0;\n for (const c of page) if (!seen.has(c.id)) { seen.add(c.id); all.push(c); }\n searchAfter = page[page.length - 1]?.searchAfter;\n if (target != null && all.length >= target) break;\n if (!searchAfter) break;\n }\n if (all.length === 0) die(\"contacts came back with ZERO rows. That is a broken read, not an empty CRM.\");\n if (target != null && all.length < target) die(`contact pagination is short: collected ${all.length}, the CRM held ${target} when this read began.`);\n if (stated != null && stated > all.length) console.log(` note: contacts grew from ${target} to ${stated} during the read; the ${all.length} read is the snapshot these files describe.`);\n logQuery(\"contacts\", \"POST /contacts/search {locationId, pageLimit:100, searchAfter}\", all.length);\n return cachePut(\"contacts.json\", all);\n}\n\nasync function fetchAllOpportunities() {\n const hit = cacheGet(\"opportunities.json\"); if (hit) return logQuery(\"opportunities\", `GET /opportunities/search?location_id=${LOCATION}&limit=100 (+nextPageUrl)`, hit.length), hit;\n const all = []; const seen = new Set(); let empties = 0; let stated = null; let target = null;\n let url = `${GHL}/opportunities/search?location_id=${LOCATION}&limit=100`;\n while (url) {\n const d = await jsonFetch(url, { headers: ghlHeaders });\n const page = d?.opportunities ?? []; const meta = d?.meta ?? {};\n stated = meta.total ?? stated;\n if (target === null && stated != null) target = stated;\n if (page.length === 0) { if (++empties >= 3) break; await sleep(2500); continue; }\n empties = 0;\n for (const o of page) if (!seen.has(o.id)) { seen.add(o.id); all.push(o); }\n if (target != null && all.length >= target) break;\n url = meta.nextPageUrl;\n }\n if (all.length === 0) die(\"opportunities came back with ZERO rows.\");\n if (target != null && all.length < target) die(`opportunity pagination is short: collected ${all.length}, the CRM held ${target} when this read began.`);\n if (stated != null && stated > all.length) console.log(` note: opportunities grew from ${target} to ${stated} during the read; the ${all.length} read is the snapshot these files describe.`);\n logQuery(\"opportunities\", `GET /opportunities/search?location_id=${LOCATION}&limit=100 (+nextPageUrl)`, all.length);\n return cachePut(\"opportunities.json\", all);\n}\n\n// INVOICES. `offset` is mandatory on this route or it 422s, and a page that comes back exactly\n// full is never the last page however tempting. Moved here from scripts/client-files-rebuild.mjs\n// so that one run produces the whole client pack: two generators writing files about the same\n// business on the same day is how a client ends up holding two documents that disagree.\nasync function fetchAllInvoices() {\n const hit = cacheGet(\"invoices.json\"); if (hit) return logQuery(\"invoices\", `GET /invoices/?altId=${LOCATION}&altType=location&limit=100&offset=<0..>`, hit.length), hit;\n const LIMIT = 100; const all = []; let stated = null;\n for (let offset = 0; offset < 5000; offset += LIMIT) {\n const d = await jsonFetch(`${GHL}/invoices/?altId=${LOCATION}&altType=location&limit=${LIMIT}&offset=${offset}`, { headers: ghlHeaders });\n const page = d?.invoices ?? [];\n stated = d?.total ?? stated;\n all.push(...page);\n if (page.length < LIMIT) break;\n }\n if (all.length === 0) die(\"invoices came back with ZERO rows. That is a broken read, not an empty business.\");\n if (stated != null && all.length !== stated) die(`invoice pagination is short: collected ${all.length}, the API says total ${stated}.`);\n logQuery(\"invoices\", `GET /invoices/?altId=${LOCATION}&altType=location&limit=100&offset=<0..>`, all.length);\n return cachePut(\"invoices.json\", all);\n}\n\n// THE CRM'S OWN PAYMENT RECORDS. Used only to answer \"has this invoice been settled another way\",\n// never as the Square population. This route rejects locationId and wants altId/altType.\nasync function fetchAllTransactions() {\n const hit = cacheGet(\"transactions.json\"); if (hit) return logQuery(\"payment transactions\", `GET /payments/transactions?altId=${LOCATION}&altType=location&limit=100&offset=<0..>`, hit.length), hit;\n const LIMIT = 100; const all = []; let stated = null;\n for (let offset = 0; offset < 20000; offset += LIMIT) {\n const d = await jsonFetch(`${GHL}/payments/transactions?altId=${LOCATION}&altType=location&limit=${LIMIT}&offset=${offset}`, { headers: ghlHeaders });\n const page = d?.data ?? d?.transactions ?? [];\n stated = d?.totalCount ?? d?.total ?? stated;\n all.push(...page);\n if (page.length < LIMIT) break;\n }\n if (all.length === 0) die(\"payment transactions came back with ZERO rows. That is a broken read, not an empty business.\");\n logQuery(\"payment transactions\", `GET /payments/transactions?altId=${LOCATION}&altType=location&limit=100&offset=<0..>`, all.length);\n return cachePut(\"transactions.json\", all);\n}\n\n// THE PRICE LIST, BOTH SIDES OF IT. Her CRM's products and prices, and Square's own catalogue, so\n// the claim \"set up at the exact Square price\" is checked against Square rather than asserted.\nasync function fetchCrmProducts() {\n const hit = cacheGet(\"products.json\"); if (hit) return logQuery(\"products\", `GET /products/?locationId=${LOCATION}&limit=100`, hit.length), hit;\n const d = await jsonFetch(`${GHL}/products/?locationId=${LOCATION}&limit=100`, { headers: ghlHeaders });\n const all = d?.products ?? [];\n if (all.length === 0) die(\"products came back with ZERO rows.\");\n logQuery(\"products\", `GET /products/?locationId=${LOCATION}&limit=100`, all.length);\n return cachePut(\"products.json\", all);\n}\nasync function fetchCrmPrices(productIds) {\n const hit = cacheGet(\"prices.json\"); if (hit) return logQuery(\"product prices\", `GET /products//price?locationId=${LOCATION}`, Object.keys(hit).length), hit;\n const out = {};\n for (const id of productIds) {\n const d = await jsonFetch(`${GHL}/products/${id}/price?locationId=${LOCATION}&limit=100`, { headers: ghlHeaders });\n out[id] = (d?.prices ?? []).map((p) => ({ id: p._id, name: p.name, amount: Number(p.amount) || 0, currency: p.currency }));\n }\n logQuery(\"product prices\", `GET /products//price?locationId=${LOCATION}`, Object.keys(out).length);\n return cachePut(\"prices.json\", out);\n}\nasync function fetchSquareCatalog() {\n const hit = cacheGet(\"catalog.json\"); if (hit) return logQuery(\"square catalogue\", \"GET ?catalog=1&admin=\", (hit.items ?? []).length), hit;\n const d = await jsonFetch(`${BRIDGE}?catalog=1&admin=${encodeURIComponent(ADMIN)}`);\n if (!Array.isArray(d?.items) || d.items.length === 0) die(\"the Square catalogue came back empty.\");\n logQuery(\"square catalogue\", \"GET ?catalog=1&admin=\", d.items.length);\n return cachePut(\"catalog.json\", d);\n}\n\n// HER BOARD NAMES, READ FROM HER CRM. Never typed into this file. See STAGE_NAME above.\nasync function fetchPipelines() {\n const hit = cacheGet(\"pipelines.json\"); if (hit) return logQuery(\"pipelines\", `GET /opportunities/pipelines?locationId=${LOCATION}`, hit.length), hit;\n const d = await jsonFetch(`${GHL}/opportunities/pipelines?locationId=${LOCATION}`, { headers: ghlHeaders });\n const all = d?.pipelines ?? [];\n if (all.length === 0) die(\"pipelines came back with ZERO rows, so this run cannot know what the client calls her own boards.\");\n logQuery(\"pipelines\", `GET /opportunities/pipelines?locationId=${LOCATION}`, all.length);\n return cachePut(\"pipelines.json\", all);\n}\n\nasync function fetchJournal() {\n const hit = cacheGet(\"journal.json\"); if (hit) return logQuery(\"bridge journal\", \"GET ?dump=1&admin=\", hit.length), hit;\n const j = await jsonFetch(`${BRIDGE}?dump=1&admin=${encodeURIComponent(ADMIN)}`);\n if (!Array.isArray(j)) die(`journal did not come back as an array (got ${typeof j}).`);\n if (j.length === 0) die(\"journal came back with ZERO rows. That is a failure, not an empty week.\");\n logQuery(\"bridge journal\", \"GET ?dump=1&admin=\", j.length);\n return cachePut(\"journal.json\", j);\n}\n\nasync function fetchSquare(ids) {\n const hit = cacheGet(\"square.json\"); if (hit) return logQuery(\"square lookup\", \"GET ?lookup=&admin=\", hit.length), hit;\n const out = []; const CHUNK = 45; // the bridge caps at 90; 45 keeps the URL comfortably short\n for (let i = 0; i < ids.length; i += CHUNK) {\n const d = await jsonFetch(`${BRIDGE}?lookup=${ids.slice(i, i + CHUNK).map(encodeURIComponent).join(\",\")}&admin=${encodeURIComponent(ADMIN)}`);\n out.push(...(d?.results ?? []));\n }\n if (out.length !== ids.length) die(`Square lookup returned ${out.length} of ${ids.length} requested payments. Every figure below depends on Square's own record, so a partial answer is not usable.`);\n logQuery(\"square lookup\", \"GET ?lookup=&admin=\", out.length);\n return cachePut(\"square.json\", out);\n}\n\n// -------------------------------------------------------------------------------------------\n// THE INDEPENDENT SECOND READING. Shares no code with paymentUniverse().\n//\n// paymentUniverse() groups a payment's rows by id and applies a guard per group. This does the\n// opposite: it builds two SETS and subtracts one from the other, and it finds ids by SHAPE and by\n// the grammatical slot they sit in rather than by a greedy \\S+ capture. If the two ever disagree\n// the run stops, because a number that only one method can produce is exactly what put three\n// wrong figures in the client's inbox.\n// -------------------------------------------------------------------------------------------\nconst SQUARE_PAYMENT_ID = /^[A-Za-z0-9]{29}$/; // refund ids are 73 chars with an underscore,\nconst SELF_TEST = /^(TESTPAY|captest|TESTREF)[-_]/i; // opportunity ids 20, invoice ids 28\nfunction independentIdsOnRow(r) {\n const found = new Set();\n for (const m of String(r?.note ?? \"\").matchAll(/\\bpayment\\s+([A-Za-z0-9]+)/g)) found.add(m[1]);\n if (typeof r?.id === \"string\" && r.id) found.add(r.id);\n const out = new Set();\n for (const t of found) if (SQUARE_PAYMENT_ID.test(t) && !SELF_TEST.test(t)) out.add(t);\n return out;\n}\nfunction independentUnmatched(journal) {\n const all = new Set(), onAContactRow = new Set();\n for (const r of journal) {\n const ids = independentIdsOnRow(r);\n for (const id of ids) all.add(id);\n if (typeof r?.contactId === \"string\" && r.contactId.trim().length > 4) for (const id of ids) onAContactRow.add(id);\n }\n return { all, linked: onAContactRow, unmatched: new Set([...all].filter((id) => !onAContactRow.has(id))) };\n}\n\n// -------------------------------------------------------------------------------------------\n// NORMALISERS. One definition each, so \"same phone\" cannot mean two different things.\n// -------------------------------------------------------------------------------------------\nconst normPhone = (p) => { const d = String(p ?? \"\").replace(/\\D/g, \"\"); const t = d.length === 11 && d.startsWith(\"1\") ? d.slice(1) : d; return t.length === 10 ? t : null; };\nconst normEmail = (e) => { const s = String(e ?? \"\").trim().toLowerCase(); return s || null; };\nconst normName = (n) => String(n ?? \"\").toLowerCase().replace(/[^a-z ]/g, \"\").replace(/\\s+/g, \" \").trim() || null;\nconst money = (n) => `$${Number(n).toLocaleString(\"en-US\", { minimumFractionDigits: 2, maximumFractionDigits: 2 })}`;\nconst plural = (n, one, many) => (n === 1 ? one : many);\nconst csvField = (v) => { const s = v === null || v === undefined ? \"\" : String(v); return /[\",\\n]/.test(s) ? `\"${s.replace(/\"/g, '\"\"')}\"` : s; };\n// THE HEADER ROW GOES THROUGH THE SAME ESCAPING AS EVERY OTHER ROW. It did not, and the moment a\n// column was given a name a person could read (\"Square receipt link, open this to see the sale\")\n// the comma inside it split the header into two columns and every spreadsheet mis-shaped the file.\nconst toCsv = (headers, records) => [headers.map(csvField).join(\",\"), ...records.map((r) => headers.map((h) => csvField(r[h])).join(\",\"))].join(\"\\n\") + \"\\n\";\nconst fmtDate = (iso) => {\n const d = new Date(iso); if (Number.isNaN(d.getTime())) return \"date unknown\";\n const M = [\"January\", \"February\", \"March\", \"April\", \"May\", \"June\", \"July\", \"August\", \"September\", \"October\", \"November\", \"December\"];\n return `${d.getUTCDate()} ${M[d.getUTCMonth()]} ${d.getUTCFullYear()}`;\n};\n// Dates inside a spreadsheet column stay in year, month, day order so a sort on the column works\n// and no reader has to guess whether 07/08 is July or August. Dates in prose are spelled out.\nconst isoDay = (iso) => String(iso ?? \"\").slice(0, 10);\n// Names as a person writes them. The CRM stores \"kylie smalley\" and Square stores \"AMERICAN_EXPRESS\";\n// neither is how the owner would write it down, and a client file is not the place to show either.\nconst titleCase = (s) => String(s ?? \"\").trim().replace(/\\b([a-z])/g, (m0) => m0.toUpperCase());\n// A person's name as her CRM spells it. The lowercased contactName field loses the capital in\n// \"McIntosh\"; the first and last name fields keep it, so those are preferred and contactName is\n// only a fallback. Never invent a capital the CRM does not hold.\nconst personName = (c) => {\n const parts = [c?.firstName, c?.lastName].map((x) => String(x ?? \"\").trim()).filter(Boolean);\n return parts.length ? parts.join(\" \") : titleCase(c?.contactName ?? \"\");\n};\nconst CARD_NAME = (brand) => {\n const b = String(brand ?? \"\").trim().toUpperCase();\n if (!b) return \"Card type not recorded\";\n const known = { VISA: \"Visa\", MASTERCARD: \"Mastercard\", AMERICAN_EXPRESS: \"American Express\", DISCOVER: \"Discover\", DISCOVER_DINERS: \"Discover Diners\", JCB: \"JCB\", CHINA_UNIONPAY: \"China UnionPay\", SQUARE_GIFT_CARD: \"Square gift card\" };\n return known[b] ?? titleCase(b.replace(/_/g, \" \").toLowerCase());\n};\n\n// THE FILE NAMES LIVE HERE ONCE. Every cross reference in every page below is interpolated from\n// these, so a rename can never leave one page pointing at a file that no longer exists. The old\n// names (writeback-dry-run.csv, counter-sales-not-linked.csv, counter-sales-CORRECTION.md) were\n// ours, not hers: she cannot search for a word she has never used.\nconst F_COUNTER_CSV = \"Counter-sales-with-no-customer.csv\";\nconst F_COUNTER_MD = \"Counter-sales-with-no-customer.md\";\nconst F_WRITE_CSV = \"Money-to-put-on-bookings.csv\";\nconst F_WRITE_MD = \"Money-to-put-on-bookings.md\";\nconst F_LEFT_CSV = \"Payments-left-alone-and-why.csv\";\nconst F_INVOICES_CSV = \"Unpaid-invoices.csv\";\nconst F_INVOICES_MD = \"Unpaid-invoices.md\";\nconst F_PRICES_CSV = \"Payment-links-and-prices.csv\";\n\n// ===========================================================================================\n// MAIN\n// ===========================================================================================\nconst RUN_AT = new Date();\n// \"Today\" is true for one day and quietly wrong every day after, and these files are kept. Every\n// sentence that wants to say \"right now\" names the date instead.\nconst AS_AT = fmtDate(RUN_AT.toISOString());\nconsole.log(`Reading live. Location ${LOCATION}. As of ${RUN_AT.toISOString()}.\\n`);\n\nconst [contacts, opportunities, journal, pipelines, invoices, transactions, crmProducts, squareCatalog] = await Promise.all([\n fetchAllContacts(), fetchAllOpportunities(), fetchJournal(), fetchPipelines(), fetchAllInvoices(), fetchAllTransactions(),\n fetchCrmProducts(), fetchSquareCatalog(),\n]);\nconst universe = paymentUniverse(journal);\nconst square = await fetchSquare([...universe.payments.keys()].sort());\nconst sqById = new Map(square.map((s) => [s.id, s]));\n\n// HER NAMES, FILLED IN FROM HER OWN CRM. A stage this run cannot name is a stage this run has no\n// business writing about, so a missing name stops the run rather than falling back to a guess.\nfor (const p of pipelines) for (const s of p?.stages ?? []) if (IN_SCOPE.has(s?.id)) STAGE_NAME[s.id] = String(s?.name ?? \"\").trim();\nfor (const s of VALUABLE_STAGES) if (!STAGE_NAME[s]) die(`stage ${s} is in the write scope and no pipeline in this CRM names it. Nothing written.`);\nconst BOARDS = VALUABLE_STAGES.map((s) => STAGE_NAME[s]);\nconst BOARDS_PHRASE = `${BOARDS.slice(0, -1).join(\", \")} or ${BOARDS[BOARDS.length - 1]}`;\nconsole.log(`Her board names, read from her own pipelines: ${BOARDS.map((b) => `\"${b}\"`).join(\" and \")}.`);\n\n// -------------------------------------------------------------------------------------------\n// GATE 1. The two independent readings must agree, exactly, before anything is computed from\n// either. This is the check that would have caught all three previous wrong numbers.\n// -------------------------------------------------------------------------------------------\nconst indep = independentUnmatched(journal);\n{\n const p = [];\n const a = [...indep.unmatched].sort(), b = [...universe.unlinked].sort();\n if (a.length !== b.length || a.some((x, i) => x !== b[i])) {\n p.push(`unmatched sets differ. set subtraction: ${a.length} (${a.join(\", \")}). paymentUniverse(): ${b.length} (${b.join(\", \")})`);\n }\n const u = [...indep.all].sort(), v = [...universe.payments.keys()].sort();\n if (u.length !== v.length || u.some((x, i) => x !== v[i])) {\n p.push(`populations differ. set subtraction sees ${u.length} payment ids, paymentUniverse() sees ${v.length}. only in one: ${[...u.filter((x) => !v.includes(x)), ...v.filter((x) => !u.includes(x))].join(\", \")}`);\n }\n if (p.length) { shout(\"THE TWO INDEPENDENT READINGS DISAGREE. This is the most important thing in this run. Nothing written.\"); p.forEach((x) => console.error(\" - \" + x)); process.exit(1); }\n console.log(`Independent check PASSED: set subtraction and paymentUniverse() name the same ${universe.payments.size} payments and the same ${universe.unlinked.length} unlinked, id for id.`);\n}\n\n// -------------------------------------------------------------------------------------------\n// THE AMOUNT. Square is the authority on what a card was charged; the journal is a log of\n// attempts and does not always carry an amount at all (PAY-DUP rows have no amount field). Where\n// both speak they must agree, or the total depends on which system you asked, and that is fatal.\n// -------------------------------------------------------------------------------------------\nconst amountOf = (id) => { const s = Number(sqById.get(id)?.amount); return Number.isFinite(s) ? s : journalAmount(universe.payments.get(id)); };\nconst amountSilentInJournal = [];\n{\n const p = [];\n for (const [id, rows] of universe.payments) {\n const j = journalAmount(rows), s = Number(sqById.get(id)?.amount ?? NaN);\n if (!Number.isFinite(s)) { p.push(`payment ${id}: Square returned no amount`); continue; }\n if (j === 0) { amountSilentInJournal.push({ id, square: s }); continue; } // journal never logged one\n if (cents(j) !== cents(s)) p.push(`payment ${id}: the journal says ${money(j)} and Square says ${money(s)}`);\n }\n if (p.length) { shout(\"THE JOURNAL AND SQUARE DISAGREE ON AN AMOUNT. Nothing written.\"); p.forEach((x) => console.error(\" - \" + x)); process.exit(1); }\n}\n\n// -------------------------------------------------------------------------------------------\n// REFUNDS. A refund id lives in its own namespace and is shaped \"_\", so the\n// payment a refund belongs to is recoverable. A payment with a refund against it must never have\n// its full amount proposed onto a booking.\n// -------------------------------------------------------------------------------------------\nconst refundedPayments = new Map();\nfor (const r of journal) {\n if (!/^REFUND/.test(String(r?.kind ?? \"\"))) continue;\n const tok = (String(r?.note ?? \"\").match(/refund\\s+(\\S+)/) ?? [])[1] ?? r?.id ?? \"\";\n const paymentId = String(tok).split(\"_\")[0];\n if (!universe.payments.has(paymentId)) continue;\n const g = refundedPayments.get(paymentId) ?? { paymentId, kinds: new Set(), amount: 0 };\n g.kinds.add(r.kind); g.amount = Math.max(g.amount, Number(r.amount) || 0);\n refundedPayments.set(paymentId, g);\n}\n\n// -------------------------------------------------------------------------------------------\n// THE PARENT TOTAL, and the split that must add back to it.\n// -------------------------------------------------------------------------------------------\nconst allIds = [...universe.payments.keys()];\nconst linkedIds = [...universe.linked].sort((a, b) => String(sqById.get(a)?.created_at ?? \"\").localeCompare(String(sqById.get(b)?.created_at ?? \"\")));\nconst unlinkedIds = [...universe.unlinked].sort((a, b) => String(sqById.get(a)?.created_at ?? \"\").localeCompare(String(sqById.get(b)?.created_at ?? \"\")));\nconst universeTotal = allIds.reduce((a, id) => a + amountOf(id), 0);\nconst linkedTotal = linkedIds.reduce((a, id) => a + amountOf(id), 0);\nconst unlinkedTotal = unlinkedIds.reduce((a, id) => a + amountOf(id), 0);\n{\n const p = [];\n if (linkedIds.length + unlinkedIds.length !== allIds.length) p.push(`linked ${linkedIds.length} + unlinked ${unlinkedIds.length} does not equal ${allIds.length} seen`);\n if (cents(linkedTotal + unlinkedTotal) !== cents(universeTotal)) p.push(`linked ${money(linkedTotal)} + unlinked ${money(unlinkedTotal)} does not equal ${money(universeTotal)}`);\n if (p.length) { shout(\"POPULATION RECONCILIATION FAILED. Nothing written.\"); p.forEach((x) => console.error(\" - \" + x)); process.exit(1); }\n}\n\n// -------------------------------------------------------------------------------------------\n// THE HISTORY OF THE NUMBER, re-derived rather than remembered, so the correction page can show\n// its own arithmetic. Three figures have been in writing; each one is reproduced here from the\n// live journal by running the rule as it stood at the time.\n// -------------------------------------------------------------------------------------------\nconst MATCHED_KINDS = new Set([\"REVENUE-ON-CLIENT-OPP\", \"PAYMENT\", \"CAPI-PURCHASE\", \"INVOICE-LINKED\"]);\nconst history = (() => {\n const byGreedyNoteKey = new Map();\n for (const r of journal) { const m = /payment\\s+(\\S+)/.exec(String(r?.note ?? \"\")); if (m) (byGreedyNoteKey.get(m[1]) ?? byGreedyNoteKey.set(m[1], []).get(m[1])).push(r); }\n const amt = (rs) => rs.map((r) => Number(r?.amount) || 0).find((a) => a > 0) ?? 0;\n const isMatched = (rs) => rs.some((r) => MATCHED_KINDS.has(r?.kind) || (typeof r?.contactId === \"string\" && r.contactId.length > 4));\n const failed = [...byGreedyNoteKey].filter(([, rs]) => rs.some((r) => r?.kind === \"NO-MATCH\"));\n const everFailed = failed.map(([id, rs]) => ({ id, amount: amt(rs) }));\n const thirdFigure = failed.filter(([, rs]) => !isMatched(rs)).map(([id, rs]) => ({ id, amount: amt(rs), trail: rs.some((r) => r?.hadEmail === true || r?.hadPhone === true || r?.hadCustomerId === true) }));\n const matchedLater = everFailed.filter((x) => !thirdFigure.some((y) => y.id === x.id));\n const semicolonBug = thirdFigure.filter((x) => !universe.unlinked.includes(x.id));\n const sum = (xs) => xs.reduce((a, x) => a + x.amount, 0);\n return {\n everFailed, everFailedTotal: sum(everFailed),\n matchedLater, matchedLaterTotal: sum(matchedLater),\n thirdFigure, thirdFigureTotal: sum(thirdFigure),\n thirdWithTrail: thirdFigure.filter((x) => x.trail), thirdWithTrailTotal: sum(thirdFigure.filter((x) => x.trail)),\n thirdNoTrail: thirdFigure.filter((x) => !x.trail), thirdNoTrailTotal: sum(thirdFigure.filter((x) => !x.trail)),\n semicolonBug, semicolonBugTotal: sum(semicolonBug),\n };\n})();\n{\n const p = [];\n if (history.matchedLater.length + history.thirdFigure.length !== history.everFailed.length) p.push(\"matched later plus still unmatched does not equal every payment that ever failed\");\n if (cents(history.matchedLaterTotal + history.thirdFigureTotal) !== cents(history.everFailedTotal)) p.push(\"the history dollars do not add back\");\n if (history.semicolonBug.length + unlinkedIds.length !== history.thirdFigure.length) p.push(\"the semicolon group plus the true unlinked does not equal the figure the client holds\");\n if (cents(history.semicolonBugTotal + unlinkedTotal) !== cents(history.thirdFigureTotal)) p.push(\"the semicolon dollars plus the true unlinked dollars do not equal the figure the client holds\");\n if (p.length) { shout(\"THE HISTORY OF THE NUMBER DOES NOT RECONCILE. Nothing written.\"); p.forEach((x) => console.error(\" - \" + x)); process.exit(1); }\n}\n\n// -------------------------------------------------------------------------------------------\n// CRM CANDIDATE MATCHING, for the four. Two tiers, and the tier is always stated.\n// PROOF an exact phone, email or full name hit, and exactly one contact answers to it.\n// PROBABLE the surname matches exactly and the first initial matches, on a different number.\n// Offered as a question, never as an answer. A merge is a decision about a person's\n// records and it belongs to the owner, not to this script.\n// Two candidates is not a better guess than one, it is a question, and this says so.\n// -------------------------------------------------------------------------------------------\nconst byPhone = new Map(), byEmail = new Map(), byName = new Map(), bySurname = new Map();\nconst push = (m, k, v) => { if (k) (m.get(k) ?? m.set(k, []).get(k)).push(v); };\nfor (const c of contacts) {\n push(byPhone, normPhone(c.phone), c);\n push(byEmail, normEmail(c.email), c);\n push(byName, normName(c.contactName || [c.firstName, c.lastName].filter(Boolean).join(\" \")), c);\n push(bySurname, normName(c.lastName), c);\n for (const ap of c.additionalPhones ?? []) push(byPhone, normPhone(typeof ap === \"string\" ? ap : ap?.phone), c);\n for (const ae of c.additionalEmails ?? []) push(byEmail, normEmail(typeof ae === \"string\" ? ae : ae?.email), c);\n}\nconst contactById = new Map(contacts.map((c) => [c.id, c]));\n\nfunction findCandidate(sq) {\n const c = sq?.square_customer ?? {};\n const given = String(c.given_name ?? \"\").trim(), family = String(c.family_name ?? \"\").trim();\n const full = [given, family].filter(Boolean).join(\" \") || String(sq?.cardholder_name ?? \"\").trim();\n const ph = normPhone(c.phone_number), em = normEmail(c.email_address), nm = normName(full);\n const hits = new Map(); const ev = [];\n const add = (list, label) => { if (list?.length) { ev.push(label); for (const x of list) hits.set(x.id, x); } };\n add(ph && byPhone.get(ph), `exact phone match on ${c.phone_number}`);\n add(em && byEmail.get(em), `exact email match on ${c.email_address}`);\n add(nm && byName.get(nm), `exact name match on \"${full}\"`);\n const proof = [...hits.values()];\n if (proof.length === 1) return { tier: \"proof\", contact: proof[0], evidence: ev.join(\"; \"), candidates: proof };\n if (proof.length > 1) return { tier: \"several\", contact: null, evidence: `${proof.length} contacts answer to this buyer (${ev.join(\"; \")}), so a person picks`, candidates: proof };\n // PROBABLE tier\n const sur = normName(family);\n const near = sur ? (bySurname.get(sur) ?? []).filter((x) => normName(x.firstName)?.[0] === normName(given)?.[0]) : [];\n if (near.length === 1) {\n const x = near[0];\n const bits = [`surname \"${family}\" matches exactly`, `first name is \"${x.firstName}\" in the CRM and \"${given}\" in Square`];\n if (ph && normPhone(x.phone) && ph !== normPhone(x.phone)) bits.push(`the phone numbers are different, ${c.phone_number} in Square and ${x.phone} in the CRM`);\n return { tier: \"probable\", contact: x, evidence: bits.join(\"; \"), candidates: near };\n }\n if (near.length > 1) return { tier: \"several\", contact: null, evidence: `${near.length} contacts share this surname and first initial, so a person picks`, candidates: near };\n return { tier: \"none\", contact: null, evidence: \"Square holds no name, no email and no phone for this sale, so there is nothing to match a customer on\", candidates: [] };\n}\n\n// -------------------------------------------------------------------------------------------\n// SPLIT TENDER. One sale settled on two cards is two payments against ONE Square order, and each\n// payment's line items describe the WHOLE order, not that card's share. Printing a line item\n// total of $1,795.00 beside a card that was charged $795.00 is exactly the kind of number beside\n// a sentence that this project keeps being burned by, so the relationship is stated instead.\n// -------------------------------------------------------------------------------------------\nconst paymentsByOrder = new Map();\nfor (const id of allIds) {\n const oid = sqById.get(id)?.order_id;\n if (oid) (paymentsByOrder.get(oid) ?? paymentsByOrder.set(oid, []).get(oid)).push(id);\n}\nconst orderTotal = (s) => (s?.line_items ?? []).reduce((a, li) => a + (Number(li?.total) || 0), 0);\n\n// -------------------------------------------------------------------------------------------\n// FILE 3, COMPUTED FIRST because file 1 needs to be able to say which booking a confirmed match\n// would land on, and whether that booking is already due to receive money in this same plan.\n//\n// Scope: the payments that DID reach a named customer. Those are the real remaining work, and\n// they are a different population from file 1's four, which is why the two files never share a\n// row and their counts add back to the parent total rather than overlapping.\n//\n// Kim's rule, agreed in writing 9 Aug: one open booking, assign it; more than one, a person\n// chooses. Scoped to the two stage IDS, summed per booking, never overwriting a non zero value.\n// -------------------------------------------------------------------------------------------\nconst oppsByContact = new Map();\nfor (const o of opportunities) {\n if (!IN_SCOPE.has(o.pipelineStageId) || !o.contactId) continue;\n (oppsByContact.get(o.contactId) ?? oppsByContact.set(o.contactId, []).get(o.contactId)).push(o);\n}\n\nconst leftAlone = [];\nconst plan = new Map();\nfor (const id of linkedIds) {\n const rows = universe.payments.get(id) ?? [];\n const s = sqById.get(id) ?? {};\n const sc = s.square_customer ?? {};\n const buyer = [sc.given_name, sc.family_name].map((x) => String(x ?? \"\").trim()).filter(Boolean).join(\" \") || String(s.cardholder_name ?? \"\").trim() || \"(Square holds no name)\";\n // EVERY REASON BELOW IS WRITTEN FOR THE OWNER, not for us. No record ids, no log vocabulary:\n // she has to be able to act on the sentence without asking anybody what a word in it means.\n const item = { id, amount: amountOf(id), date: String(s.created_at ?? \"\").slice(0, 10), buyer, receipt: s.receipt_url ?? \"\" };\n const reject = (why) => leftAlone.push({ ...item, why });\n\n const contactIds = [...new Set(rows.filter((r) => typeof r?.contactId === \"string\" && r.contactId.length > 4).map((r) => r.contactId))];\n if (contactIds.length !== 1) { reject(contactIds.length === 0 ? \"the Square connection never recorded a customer for this payment\" : `the Square connection recorded ${contactIds.length} different customers against this one payment, so a person picks`); continue; }\n const contact = contactById.get(contactIds[0]);\n if (!contact) { reject(\"the customer record this payment was filed against is no longer in your CRM\"); continue; }\n if (refundedPayments.has(id)) { reject(\"this payment was refunded, so its full amount must not be added to a booking\"); continue; }\n\n const inScope = oppsByContact.get(contact.id) ?? [];\n if (!inScope.length) { reject(`the customer is named and has no booking on the ${BOARDS_PHRASE} board to put the money on`); continue; }\n const open = inScope.filter((o) => Number(o.monetaryValue || 0) === 0);\n const valued = inScope.filter((o) => Number(o.monetaryValue || 0) > 0);\n if (!open.length) { reject(`every booking for this customer already carries a figure (${valued.map((o) => money(o.monetaryValue)).join(\", \")}), and nothing here overwrites a figure another system may own`); continue; }\n if (open.length !== 1) { reject(`${open.length} bookings for this customer show no dollars, so a person picks which one`); continue; }\n\n const o = open[0];\n const g = plan.get(o.id) ?? { opp: o, contact, items: [] };\n g.items.push(item); plan.set(o.id, g);\n}\n\n// -------------------------------------------------------------------------------------------\n// FILE 1. THE FOUR. Every buyer detail comes from Square's own record, not from the journal's\n// flags, and where the two disagree the disagreement is a column of its own.\n// -------------------------------------------------------------------------------------------\nconst flagDisagreements = [];\nconst fourRows = unlinkedIds.map((id) => {\n const s = sqById.get(id) ?? {};\n const c = s.square_customer ?? {};\n const rows = universe.payments.get(id) ?? [];\n const name = [c.given_name, c.family_name].map((x) => String(x ?? \"\").trim()).filter(Boolean).join(\" \").replace(/\\s+/g, \" \") || String(s.cardholder_name ?? \"\").trim();\n const m = findCandidate(s);\n\n // THE FLAGS versus SQUARE. hadEmail/hadPhone/hadCustomerId describe the webhook payload the\n // bridge received. Square is the record of what Square holds. Where they differ, say so.\n const flagSaysTrail = rows.some((r) => r?.hadEmail === true || r?.hadPhone === true || r?.hadCustomerId === true);\n const squareHasSomething = Boolean(name || c.email_address || c.phone_number);\n let flagVerdict = \"the journal flag and Square agree\";\n if (flagSaysTrail && !squareHasSomething) { flagVerdict = \"the journal flag said there was something to go on and Square holds no name, no email and no phone\"; flagDisagreements.push({ id, direction: \"flag too generous\" }); }\n if (!flagSaysTrail && squareHasSomething) { flagVerdict = \"the journal flag said there was nothing to go on and Square holds a name and a phone number\"; flagDisagreements.push({ id, direction: \"flag too harsh\" }); }\n\n // WHERE IT WOULD GO IF THE MATCH IS CONFIRMED. Same rule and same two stages as file 3, so the\n // two files cannot recommend different things about one customer.\n let landsOn = \"\", landsOnId = \"\", landsOnCurrent = \"\", landsOnAlreadyDue = \"\";\n if (m.contact) {\n const inScope = oppsByContact.get(m.contact.id) ?? [];\n const open = inScope.filter((o) => Number(o.monetaryValue || 0) === 0);\n if (open.length === 1) {\n const o = open[0];\n landsOnId = o.id;\n landsOnCurrent = Number(o.monetaryValue || 0).toFixed(2);\n const due = plan.get(o.id);\n landsOnAlreadyDue = due ? due.items.reduce((a, x) => a + x.amount, 0).toFixed(2) : \"0.00\";\n landsOn = `${o.name ?? \"(booking not named)\"} on the ${STAGE_NAME[o.pipelineStageId]} board, which shows ${money(o.monetaryValue || 0)} as at ${AS_AT}` + (due ? ` and is already due to receive ${money(Number(landsOnAlreadyDue))} in ${F_WRITE_CSV}` : \"\");\n } else if (inScope.length === 0) {\n landsOn = `this customer has no booking on the ${BOARDS_PHRASE} board, so there is nowhere to put it yet`;\n } else {\n landsOn = `${open.length} bookings for this customer show no dollars, so a person picks which one`;\n }\n }\n\n // SPLIT TENDER. Another payment against the same Square order means one sale on two cards. The\n // other card is named by ITS AMOUNT, not by its reference number: she can see two amounts on one\n // receipt, and a reference number tells her nothing she can use.\n const siblings = (paymentsByOrder.get(s.order_id) ?? []).filter((x) => x !== id);\n const whole = orderTotal(s);\n const splitNote = siblings.length\n ? `Yes. This was one sale of ${money(whole)} paid on ${siblings.length + 1} cards. This card paid ${money(amountOf(id))} and the other ${plural(siblings.length, \"card paid\", \"cards paid\")} ${siblings.map((x) => money(amountOf(x))).join(\" and \")}.`\n : \"No, one card, one sale.\";\n\n const refund = refundedPayments.get(id);\n const bought = (s.line_items ?? []).map((li) => (li?.name ? `${li.name} x${li?.quantity ?? \"1\"}` : \"The receipt does not name what was bought\")).join(\"; \")\n || \"The receipt does not name what was bought\";\n // KEYS THAT START WITH AN UNDERSCORE NEVER REACH THE CLIENT. They exist so the checks below and\n // the note beside this file can be built from the same row, without a reference number, a record\n // id or a status code ever appearing in a column she reads.\n return {\n \"Date of sale\": isoDay(s.created_at),\n \"Amount (US dollars)\": amountOf(id).toFixed(2),\n \"Name Square holds\": name || \"No name in Square\",\n \"Phone Square holds\": c.phone_number || \"No phone in Square\",\n \"What was bought\": bought,\n \"Card\": CARD_NAME(s.card_brand),\n \"Last four digits\": s.last_4 ?? \"\",\n \"One sale on two cards\": splitNote,\n \"Best match in your customer list\": m.contact ? personName(m.contact) : \"No match found\",\n \"How sure I am\": m.tier === \"proof\" ? \"Certain\" : m.tier === \"probable\" ? \"Likely, please confirm\" : m.tier === \"several\" ? \"More than one person could be this, please pick\" : \"No match found\",\n \"Why I think that\": m.evidence,\n \"Where the money would go if you confirm it\": landsOn || \"Nowhere yet, there is no one to attach it to\",\n \"Square receipt link, open this to see the sale\": s.receipt_url ?? \"\",\n _id: id,\n _date: isoDay(s.created_at),\n _createdAt: s.created_at ?? \"\",\n _amount: amountOf(id),\n _buyer: name || \"No name in Square\",\n _phone: c.phone_number ?? \"\",\n _bought: bought,\n _match: m.contact ? personName(m.contact) : \"\",\n _tier: m.tier,\n _orderId: s.order_id ?? \"\",\n _wholeSale: whole,\n _status: s.status ?? \"\",\n _flagVerdict: flagVerdict,\n _refunded: Boolean(refund),\n };\n});\n{\n const p = [];\n if (fourRows.length !== unlinkedIds.length) p.push(\"the file has a different row count from the unlinked set\");\n const t = fourRows.reduce((a, r) => a + r._amount, 0);\n if (cents(t) !== cents(unlinkedTotal)) p.push(`the file sums to ${money(t)} and the unlinked set is ${money(unlinkedTotal)}`);\n if (fourRows.some((r) => r._status !== \"COMPLETED\")) p.push(\"a payment in this file is not COMPLETED in Square, so it may not be counted as money collected\");\n // THE ORDER A FILE CLAIMS IS THE SOURCE'S ORDER, NEVER OURS. This list says \"oldest first\", and\n // oldest means the moment Square took the card, not the moment our own log noticed it. Two\n // payments 15 seconds apart on 27 July were once printed in the wrong order for exactly that\n // reason, in a file that told the reader it was in the order the payments arrived.\n for (let i = 1; i < fourRows.length; i++) {\n if (String(fourRows[i - 1]._createdAt) > String(fourRows[i]._createdAt)) p.push(\"this file claims oldest first and is not in Square's own time order\");\n }\n if (p.length) { shout(\"FILE 1 RECONCILIATION FAILED. Nothing written.\"); p.forEach((x) => console.error(\" - \" + x)); process.exit(1); }\n}\n\n// -------------------------------------------------------------------------------------------\n// FILE 3, RENDERED. The plan itself was computed above, before file 1, so that file 1 can name\n// the booking a confirmed match would land on.\n// -------------------------------------------------------------------------------------------\nconst writeRows = [...plan.values()].map((g) => {\n const cur = Number(g.opp.monetaryValue || 0);\n const items = [...g.items].sort((a, b) => String(a.date).localeCompare(String(b.date)));\n const delta = items.reduce((a, x) => a + x.amount, 0);\n return {\n \"Customer\": personName(g.contact),\n \"Booking\": g.opp.name ?? \"\",\n \"Board it sits on\": STAGE_NAME[g.opp.pipelineStageId],\n \"Amount showing on it now (US dollars)\": cur.toFixed(2),\n \"Amount to add (US dollars)\": delta.toFixed(2),\n \"Amount it would show afterwards (US dollars)\": (cur + delta).toFixed(2),\n \"How many payments make that up\": items.length,\n \"When those payments were taken\": items.map((x) => x.date).join(\"; \"),\n \"What each one was (US dollars)\": items.map((x) => x.amount.toFixed(2)).join(\"; \"),\n \"How I know\": `Square took ${plural(items.length, \"this payment\", \"these payments\")} from ${personName(g.contact)} and your CRM filed ${plural(items.length, \"it\", \"them\")} against that customer's record, but no dollars were ever put on the booking itself.`,\n \"Would this write over a figure already there\": cur > 0 ? \"YES, DO NOT RUN THIS ROW\" : \"No, the box is empty\",\n _increase: delta,\n _current: cur,\n _count: items.length,\n _stage: g.opp.pipelineStageId,\n _paymentIds: items.map((x) => x.id),\n _booking: g.opp.name ?? \"\",\n };\n}).sort((a, b) => b._increase - a._increase || String(a[\"Customer\"]).localeCompare(String(b[\"Customer\"])));\n\nconst writtenPayments = writeRows.reduce((a, r) => a + r._count, 0);\nconst writtenTotal = writeRows.reduce((a, r) => a + r._increase, 0);\nconst leftAloneTotal = leftAlone.reduce((a, r) => a + r.amount, 0);\n{\n const p = [];\n if (writtenPayments + leftAlone.length !== linkedIds.length) p.push(`${writtenPayments} written + ${leftAlone.length} left alone does not equal the ${linkedIds.length} payments that reached a customer`);\n if (cents(writtenTotal + leftAloneTotal) !== cents(linkedTotal)) p.push(`written ${money(writtenTotal)} + left alone ${money(leftAloneTotal)} does not equal ${money(linkedTotal)}`);\n if (writeRows.some((r) => r._current > 0)) p.push(\"a planned write would overwrite a non zero value\");\n if (writeRows.some((r) => !IN_SCOPE.has(r._stage))) p.push(\"a planned write is outside the two allowed stages\");\n if (new Set(writeRows.flatMap((r) => r._paymentIds)).size !== writtenPayments) p.push(\"a payment appears on more than one booking\");\n if (writeRows.some((r) => r._paymentIds.some((x) => refundedPayments.has(x)))) p.push(\"a refunded payment is in the write plan\");\n // NO ID COLUMN MEANS THE NAME HAS TO BE ENOUGH. If two bookings in this plan share a name and a\n // board, a reader cannot tell which row is which, and the file has to grow a column rather than\n // ship ambiguous. Checked rather than assumed.\n {\n const keys = writeRows.map((r) => `${r._booking}\\u0000${r[\"Board it sits on\"]}`);\n if (new Set(keys).size !== keys.length) p.push(\"two bookings in this plan share a name and a board, so a reader cannot tell the rows apart without an identifier\");\n }\n // The same rule as the counter sales list: where the file states an order it is the source's own\n // order. These payment dates come from Square's record of when the card was taken.\n for (const r of writeRows) {\n const d = r[\"When those payments were taken\"].split(\"; \");\n for (let i = 1; i < d.length; i++) if (d[i - 1] > d[i]) p.push(`the payments on ${r[\"Customer\"]}'s row are not in the order Square took them`);\n }\n if (writeRows.some((r) => r._paymentIds.some((x) => unlinkedIds.includes(x)))) p.push(\"an unlinked payment leaked into the write plan\");\n if (p.length) { shout(\"WRITE-BACK RECONCILIATION FAILED. Nothing written.\"); p.forEach((x) => console.error(\" - \" + x)); process.exit(1); }\n}\n\n// WHAT THE FIELD BEING WRITTEN ACTUALLY HOLDS TODAY. Checked, never assumed, because \"sum the\n// payment onto monetaryValue\" is only obviously right if that field already holds payments.\nconst valueShape = new Map();\nfor (const o of opportunities) { const v = Number(o.monetaryValue || 0); if (v > 0) valueShape.set(v, (valueShape.get(v) ?? 0) + 1); }\nconst distinctValues = [...valueShape.entries()].sort((a, b) => b[1] - a[1]);\nconst cardsWithValue = distinctValues.reduce((a, [, n]) => a + n, 0);\nconst looksLikeAPriceList = distinctValues.length > 0 && distinctValues.length <= 5;\nconst priceListNotice = looksLikeAPriceList\n ? `READ THIS BEFORE ANY OF IT IS RUN. ${cardsWithValue} of your ${opportunities.length.toLocaleString(\"en-US\")} cards carried a figure in the value column when I read them on ${AS_AT}, and between them they use only ${distinctValues.length} different ${plural(distinctValues.length, \"figure\", \"figures\")}, ${distinctValues.map(([v]) => money(v)).join(\", \")}. That is the shape of a price list, not of money taken. If that column holds the price of the program, then an empty card means no price was set rather than nobody has paid, and adding a counter sale to it makes the column mean two different things on different rows. Deciding what that column is for is your call and not this file's, so nothing here has been run.`\n : \"\";\n\n// ===========================================================================================\n// THE UNPAID INVOICES. A different population from everything above and it is labelled as one.\n// An unpaid invoice is money asked for that has not arrived; a counter sale with no customer is\n// money that HAS arrived and is not filed against anybody. Those two lists were once sent as if\n// they were the same list, so from here on each one says what it is not.\n// ===========================================================================================\n// Settled is enumerated as a positive list rather than assumed to be the single word \"paid\". An\n// unknown status counted as unresolved would invent a debt and counted as settled would hide one,\n// so an unknown status stops the run.\nconst SETTLED = new Set([\"paid\", \"void\", \"voided\", \"cancelled\", \"canceled\", \"written_off\", \"partially_paid\"]);\nconst UNRESOLVED = new Set([\"draft\", \"sent\", \"overdue\", \"viewed\", \"partially_paid_unsettled\"]);\n{\n const unknown = [...new Set(invoices.map((i) => i.status))].filter((s) => !SETTLED.has(s) && !UNRESOLVED.has(s));\n if (unknown.length) die(`invoice status(es) this report has no rule for: ${unknown.join(\", \")}. Classify them before shipping a number.`);\n}\nconst invTotal = (i) => Number(i.total ?? i.invoiceTotal ?? 0) || 0;\nconst invDue = (i) => Number(i.amountDue ?? 0) || 0;\nconst parentInvoiceTotal = invoices.reduce((a, i) => a + invTotal(i), 0);\nconst unresolvedInvoices = invoices.filter((i) => !SETTLED.has(i.status)).sort((a, b) => String(a.createdAt).localeCompare(String(b.createdAt)));\nconst settledInvoices = invoices.filter((i) => SETTLED.has(i.status));\nconst unresolvedTotal = unresolvedInvoices.reduce((a, i) => a + invTotal(i), 0);\nconst settledTotal = settledInvoices.reduce((a, i) => a + invTotal(i), 0);\n{\n const p = [];\n if (unresolvedInvoices.length + settledInvoices.length !== invoices.length) p.push(\"unresolved plus settled does not equal all invoices\");\n if (cents(unresolvedTotal + settledTotal) !== cents(parentInvoiceTotal)) p.push(`unresolved ${money(unresolvedTotal)} plus settled ${money(settledTotal)} does not equal ${money(parentInvoiceTotal)}`);\n if (p.length) { shout(\"INVOICE RECONCILIATION FAILED. Nothing written.\"); p.forEach((x) => console.error(\" - \" + x)); process.exit(1); }\n}\n\n// THE NAME COMES FROM THE CUSTOMER RECORD, NOT FROM WHATEVER THE INVOICE HAPPENED TO STORE. One\n// invoice in this list showed a customer called \"(410) 804-1833\", because that is what somebody\n// typed at the counter. Her CRM knows that person perfectly well. A phone number where a name\n// should be is not a data problem she has to solve, it is one we have to stop printing.\nconst PLACEHOLDER_EMAIL = /^auto\\.generated@pos\\.payment$/i;\nconst NAMELESS = new Set([\"unknown\", \"\", \"no name\", \"customer\", \"your dog\"]);\nconst looksLikeAPhoneNumber = (s) => /^[\\s()+\\-.\\d]{7,}$/.test(String(s ?? \"\").trim());\nconst sharedCounterContactIds = new Set(\n contacts.filter((c) => PLACEHOLDER_EMAIL.test(String(c.email ?? \"\")) || NAMELESS.has(String(c.contactName ?? \"\").trim().toLowerCase()))\n .map((c) => c.id),\n);\nfunction resolveCustomer(i) {\n const cd = i.contactDetails ?? {};\n const stored = String(cd.name ?? \"\").trim();\n const c = contactById.get(cd.id);\n const notes = [];\n let name = \"\";\n if (c && sharedCounterContactIds.has(c.id)) {\n name = \"No customer name on file\";\n notes.push(\"this one was rung up against the shared counter record your card reader uses, so there is no person on it to chase\");\n } else if (c) {\n name = personName(c);\n if (stored && normName(stored) && normName(stored) !== normName(name) && !looksLikeAPhoneNumber(stored)) {\n notes.push(`the invoice was typed up under the name ${stored} and the customer record now reads ${name}`);\n }\n } else if (stored && !looksLikeAPhoneNumber(stored) && !NAMELESS.has(stored.toLowerCase())) {\n name = titleCase(stored);\n notes.push(\"the customer record this was raised against has since been deleted from your CRM, so the email and phone on the invoice are all there is to go on\");\n } else {\n name = \"No customer name on file\";\n notes.push(\"the customer record this was raised against has since been deleted from your CRM\");\n }\n return { name, notes };\n}\n\n// SQUARE CANNOT SPEAK ABOUT WHAT IT NEVER SAW. Its record here begins the day the connection was\n// switched on, so for anything raised before that it is silent rather than negative. Saying \"no\n// Square payment found\" about a December invoice would be a date boundary passed off as a finding.\nconst squareCoverageStart = square.map((s) => s.created_at).filter(Boolean).sort()[0] ?? journal.map((r) => r?.ts).filter(Boolean).sort()[0];\nconst squareByKey = new Map();\nfor (const s of square) {\n const c = s.square_customer ?? {};\n for (const k of [normPhone(c.phone_number), normEmail(c.email_address), normName([c.given_name, c.family_name].filter(Boolean).join(\" \"))]) {\n if (k) (squareByKey.get(k) ?? squareByKey.set(k, []).get(k)).push(s);\n }\n}\nconst invoiceById = new Map(invoices.map((i) => [i._id, i]));\nconst SOURCE_NAME = { mobile_pos: \"Rung up at the counter\", payments_subscription: \"A subscription in your CRM\", manual: \"Entered by hand\" };\n\n// REAL MONEY OR A TEST ROW. This cut is a judgement and the file says so in the page beside it.\n// The rule is two lines long on purpose, so she can disagree with it row by row: anything under\n// five dollars is somebody testing a card reader rather than a sale, and anything raised against\n// a record with the word \"test\" in its name is somebody testing the software. Everything else is\n// treated as real money even where it is awkward, because deciding otherwise on a customer's\n// behalf is how a real unpaid invoice quietly disappears off a list.\nconst TEST_MONEY_CEILING = 5;\nconst invoiceRows = unresolvedInvoices.map((i) => {\n const cd = i.contactDetails ?? {};\n const amt = invTotal(i);\n const { name, notes } = resolveCustomer(i);\n const storedName = String(cd.name ?? \"\").trim();\n const namedAsATest = /\\btest\\b/i.test(storedName) || /\\btest\\b/i.test(name);\n const tooSmallToBeASale = amt < TEST_MONEY_CEILING;\n const isTest = namedAsATest || tooSmallToBeASale;\n\n const inSquareWindow = i.createdAt && squareCoverageStart && i.createdAt >= squareCoverageStart;\n const keys = [normPhone(cd.phoneNo), normEmail(cd.email), normName(cd.name)].filter(Boolean);\n const sqHits = [...new Set(keys.flatMap((k) => squareByKey.get(k) ?? []))].filter((s) => cents(s.amount) === cents(amt));\n const txHits = sharedCounterContactIds.has(cd.id) ? [] : transactions.filter((t) =>\n t.status === \"succeeded\" && cents(Number(t.amount) || 0) === cents(amt) && t.contactId && t.contactId === cd.id);\n\n let paid = \"No sign of it either way\";\n let evidence = \"\";\n let alreadyPaid = false;\n if (sqHits.length) {\n const s = sqHits[0];\n paid = \"Yes, in Square\";\n evidence = `Square took ${money(s.amount)} from this customer on ${fmtDate(s.created_at)}, and the receipt is at ${s.receipt_url}`;\n alreadyPaid = true;\n } else if (txHits.length) {\n const t = txHits[0];\n const sib = invoiceById.get(t.entitySourceId) ?? invoiceById.get(t.entityId);\n paid = \"Yes, in your CRM\";\n evidence = sib\n ? `the same customer paid ${money(t.amount)} on ${fmtDate(t.createdAt)} against invoice ${sib.invoiceNumber}, which is a duplicate of this one raised the same day and is marked paid`\n : `your CRM recorded a payment of ${money(t.amount)} from this customer on ${fmtDate(t.createdAt)}`;\n alreadyPaid = true;\n } else if (!inSquareWindow) {\n paid = \"Square cannot say\";\n evidence = `this was raised before the Square connection started recording on ${fmtDate(squareCoverageStart)}, so Square can neither confirm nor rule out\n",[593],"ea6eab98-be36-4e09-9351-8d121ddcafd6","SOURCE-BUNDLE.part34.txt","8a22a736-97ea-11f1-902a-1607ee4eb77e",1204,["D",1786982935942],"THE DOGS SPOT — SOURCE BUNDLE (part 34 of 47)\n\nEVERY source file in this project, engine/ included. Restoring these parts and nothing else gives\nyou a tree that builds, typechecks and runs its own test suite with no network and no val.\n\nengine/ is here as of 14 Aug 2026. It used to be left out because val 1bfa6e81-74e1-4c6c-ab32-118304a4ffff\nholds it, which was true of every engine file except engine/watch.ts: a module the val does not run,\nso it was never deployed, so it lived in one container and nothing else. A reclaim destroyed it.\nscripts/deploy.mjs --check still compares engine/ against the val file by file; that is a second\ncheck on the same files now, not the only copy of them.\n\nRESTORE (needs only node, from an empty folder). Save each part, then run this ON EACH ONE:\n\n node -e 'const fs=require(\"fs\"),p=require(\"path\");const b=fs.readFileSync(process.argv[1],\"utf8\");\n for(const s of b.split(\"\\n=====FILE \").slice(1)){const i=s.indexOf(\" =====\\n\");\n const f=s.slice(0,i),c=s.slice(i+7);fs.mkdirSync(p.dirname(f),{recursive:true});\n fs.writeFileSync(f,c.replace(/\\n$/,\"\"))}' PART.txt\n\nA record named #1, #2, ... is one FILE cut into pieces: concatenate them in order, then\nstrip one trailing newline from the last. scripts/restore.mjs does this for you.\n\nEach part is complete in itself: whole files only, no reassembly, any order.\n\nThen: node scripts/build.mjs (engine/ came out of these parts; nothing to fetch first)\n node scripts/typecheck.mjs\n node tests/run-all.mjs\n node scripts/deploy.mjs --check (pulls nothing, proves the val matches what you restored)\n node tests/negative-controls.mjs (proves the suite above can actually fail)\n\nIN THIS PART (1 of 129 files)\n scripts/client-files-rebuild.mjs 49964 bytes 6d2e5016119c\n\n================================================================================================\n=====FILE scripts/client-files-rebuild.mjs =====\n#!/usr/bin/env node\n// THE TWO POPULATIONS, REBUILT FROM LIVE DATA. Generator, 12 Aug 2026.\n//\n// WHY THIS EXISTS. A client was sent a file of Square counter PAYMENTS and understood it to be a\n// list of unresolved draft INVOICES. They are two different populations that happen to be\n// adjacent, and neither one had a file that reconciled against a parent total. This builds both,\n// from live reads, plus the write-back each unlinked payment would produce if the matcher were\n// ever switched on.\n//\n// WHAT IT WRITES (all to /mnt/user-data/outputs, override with CLIENT_FILES_OUT_DIR):\n// unresolved-draft-invoices.csv every invoice not in a settled state\n// unresolved-draft-invoices.md the same, in a paragraph, reconciled against all 57 invoices\n// square-payments-unlinked.csv every Square payment the bridge sees with no CRM contact\n// writeback-dry-run.csv the exact write each confident match would make\n//\n// NOTHING HERE WRITES TO A LIVE SYSTEM. Every call is a GET except POST /contacts/search, which is\n// GoHighLevel's read route for contacts and mutates nothing. There is no PUT or PATCH in this\n// file and no code path that sets an opportunity value; file 3 is a description of a write, not a\n// write. Same posture as engine/money-match.ts, and for the same reason: Kristian's application\n// also writes opportunities in this location, so until he confirms whether it owns monetaryValue,\n// two systems would own one field and one would win at random.\n//\n// THE RULES IT ENFORCES, because each one has already cost this account money:\n// - A SUBSET NEVER SHIPS WITHOUT ITS PARENT (LESSONS #8). Every population below is printed as\n// \"n of N\" and the remainder is proved to add back to N, in rows and in cents, or the run dies.\n// \"29 / $19,822.00\" once shipped as the whole Square backlog when it was 33 / $22,651.99: the\n// four with-a-trail payments worth $2,829.99 had been cut off by a filter that read as a\n// finding. That exact subtraction is asserted against below.\n// - COUNT EVERY ATTEMPT, NOT THE FIRST (LESSONS #3). Imported from exception-report-lib.mjs\n// rather than retyped, and extended: paymentUniverse() reads the PAY-DUP `id` field as well as\n// the note, because the bridge logs later attempts in a shape a note regex cannot see.\n// - ZERO INSPECTED IS A FAILURE, NEVER A PASS (LESSONS #2). Every fetch loop below refuses to\n// treat an empty page as the end of the data; live proof it matters is in the header of\n// fetchAllContacts().\n// - NO DASHES AS PUNCTUATION IN CLIENT COPY, checked mechanically at the end, same as\n// scripts/exception-report.mjs.\n//\n// USAGE\n// node scripts/client-files-rebuild.mjs\n// ENV\n// GHL_TOKEN, BRIDGE_ADMIN required (source /home/claude/.ghlenv)\n// CLIENT_FILES_OUT_DIR default /mnt/user-data/outputs\n// CLIENT_FILES_CACHE_DIR if set, raw API responses are cached here and reused on re-run\n// CLIENT_FILES_ASOF ISO date used for \"days old\"; default now\n\nimport { writeFileSync, mkdirSync, existsSync, readFileSync } from \"node:fs\";\nimport { join, dirname, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\n\nconst HERE = dirname(fileURLToPath(import.meta.url));\nconst ROOT = resolve(HERE, \"..\");\nconst { paymentUniverse, journalAmount, cents, unmatchedPaymentRows } = await import(join(ROOT, \"scripts\", \"exception-report-lib.mjs\"));\n\nconst shout = (m) => console.error(`\\n!!!! ${m} !!!!\\n`);\nconst die = (m) => { shout(m); process.exit(1); };\n\nconst LOCATION = \"BQHJ19uohldYe3eqA0bl\";\nconst GHL = \"https://services.leadconnectorhq.com\";\nconst BRIDGE = \"https://amir5--41ace24c7e2111f18c9d1607ee4eb77e.web.val.run\";\n// The API 403s without this exact User-Agent. Not optional, not cosmetic.\nconst UA = \"curl/8.5.0\";\nconst TOKEN = process.env.GHL_TOKEN;\nconst ADMIN = process.env.BRIDGE_ADMIN;\nif (!TOKEN) die(\"GHL_TOKEN is not set. `source /home/claude/.ghlenv` first.\");\nif (!ADMIN) die(\"BRIDGE_ADMIN is not set. `source /home/claude/.ghlenv` first.\");\n\n// SUPERSEDED FOR CLIENT DELIVERY, 12 Aug 2026. The invoice pack, the counter sales pack and the\n// write back plan are now built by scripts/counter-sales-correction.mjs in ONE run, because two\n// generators writing files about the same business on the same day is how a client ends up\n// holding two documents that disagree. This one's write back is also the narrower, older\n// population (37 payments worth $24,651.99) and its figures are superseded by that run's\n// (49 worth $37,660.00). It is kept because its invoice evidence logic was lifted from here and\n// its fetch discipline is worth reading, and it is fenced off from the client's folder so it can\n// never overwrite a delivered file by accident.\n{\n const target = process.env.CLIENT_FILES_OUT_DIR || \"/mnt/user-data/outputs\";\n if (target === \"/mnt/user-data/outputs\") {\n die(\"this script no longer writes the client's folder. scripts/counter-sales-correction.mjs builds the whole pack in one run. Set CLIENT_FILES_OUT_DIR to a scratch directory if you want its working files.\");\n }\n}\n\nconst CACHE = process.env.CLIENT_FILES_CACHE_DIR || \"\";\nif (CACHE) mkdirSync(CACHE, { recursive: true });\nconst cacheGet = (k) => (CACHE && existsSync(join(CACHE, k)) ? JSON.parse(readFileSync(join(CACHE, k), \"utf8\")) : null);\nconst cachePut = (k, v) => { if (CACHE) writeFileSync(join(CACHE, k), JSON.stringify(v)); return v; };\n\nconst ASOF = process.env.CLIENT_FILES_ASOF ? new Date(process.env.CLIENT_FILES_ASOF) : new Date();\nconst sleep = (ms) => new Promise((r) => setTimeout(r, ms));\n\n// THE QUERY LOG. Every number in the report has to be traceable to the call that produced it and\n// the row count that came back, so every fetch appends here and the whole log is printed at the end.\nconst QUERIES = [];\nconst logQuery = (what, url, rows) => { QUERIES.push({ what, url, rows }); return rows; };\n\nasync function jsonFetch(url, opts = {}, tries = 6) {\n let last = null;\n for (let t = 0; t < tries; t++) {\n try {\n const res = await fetch(url, { ...opts, headers: { \"User-Agent\": UA, Accept: \"application/json\", ...(opts.headers ?? {}) } });\n const text = await res.text();\n if (!res.ok) { last = `HTTP ${res.status}: ${text.slice(0, 200)}`; await sleep(1200 * (t + 1)); continue; }\n return JSON.parse(text);\n } catch (e) { last = e.message; await sleep(1200 * (t + 1)); }\n }\n die(`fetch failed after ${tries} tries: ${url.replace(/admin=[^&]+/, \"admin=\")}\\n last error: ${last}`);\n}\nconst ghlHeaders = { Authorization: `Bearer ${TOKEN}`, Version: \"2021-07-28\" };\n\n// -------------------------------------------------------------------------------------------\n// FETCH 1. INVOICES. `offset` is mandatory on this route or it 422s. Page until a page comes back\n// SHORT: a page that returns exactly the limit is never the last page, however tempting.\n// -------------------------------------------------------------------------------------------\nasync function fetchAllInvoices() {\n const hit = cacheGet(\"invoices.json\"); if (hit) return logQuery(\"invoices\", `GET /invoices/?altId=${LOCATION}&altType=location&limit=100&offset=<0..>`, hit), hit;\n const LIMIT = 100; const all = []; let stated = null;\n for (let offset = 0; offset < 5000; offset += LIMIT) {\n const url = `${GHL}/invoices/?altId=${LOCATION}&altType=location&limit=${LIMIT}&offset=${offset}`;\n const d = await jsonFetch(url, { headers: ghlHeaders });\n const page = d?.invoices ?? [];\n stated = d?.total ?? stated;\n all.push(...page);\n if (page.length < LIMIT) break;\n }\n if (all.length === 0) die(\"invoices came back with ZERO rows. That is a broken read, not an empty business.\");\n if (stated != null && all.length !== stated) die(`invoice pagination is short: collected ${all.length}, the API says total ${stated}.`);\n logQuery(\"invoices\", `GET /invoices/?altId=${LOCATION}&altType=location&limit=100&offset=<0..>`, all.length);\n return cachePut(\"invoices.json\", all);\n}\n\n// -------------------------------------------------------------------------------------------\n// FETCH 2. PAYMENT TRANSACTIONS as the CRM itself recorded them. This route rejects `locationId`\n// and wants altId/altType. Used only as corroboration for \"has this invoice been paid another\n// way\", never as the Square population.\n// -------------------------------------------------------------------------------------------\nasync function fetchAllTransactions() {\n const hit = cacheGet(\"transactions.json\"); if (hit) return logQuery(\"payment transactions\", `GET /payments/transactions?altId=${LOCATION}&altType=location&limit=100&offset=<0..>`, hit.length), hit;\n const LIMIT = 100; const all = []; let stated = null;\n for (let offset = 0; offset < 20000; offset += LIMIT) {\n const url = `${GHL}/payments/transactions?altId=${LOCATION}&altType=location&limit=${LIMIT}&offset=${offset}`;\n const d = await jsonFetch(url, { headers: ghlHeaders });\n const page = d?.data ?? [];\n stated = d?.totalCount || stated;\n all.push(...page);\n if (page.length < LIMIT) break;\n }\n if (all.length === 0) die(\"payment transactions came back with ZERO rows.\");\n if (stated != null && all.length !== stated) die(`transaction pagination is short: collected ${all.length}, the API says totalCount ${stated}.`);\n logQuery(\"payment transactions\", `GET /payments/transactions?altId=${LOCATION}&altType=location&limit=100&offset=<0..>`, all.length);\n return cachePut(\"transactions.json\", all);\n}\n\n// -------------------------------------------------------------------------------------------\n// FETCH 3. CONTACTS. POST /contacts/search is a read; it is the only non GET in this file.\n//\n// AN EMPTY PAGE HERE IS A LIE, AND IT LIED ON THIS EXACT DATA. On the first live run the cursor\n// walk stopped at 900 of 5,708 contacts because one page came back with an empty array, and a\n// loop that treats \"no rows\" as \"no more rows\" reported 900 as the whole CRM. Re-issuing the\n// identical request with the identical cursor returned a full page. LESSONS #2 in the wild: the\n// stop condition is the STATED TOTAL, and an empty page is retried, never believed.\n// -------------------------------------------------------------------------------------------\nasync function fetchAllContacts() {\n const hit = cacheGet(\"contacts.json\"); if (hit) return logQuery(\"contacts\", \"POST /contacts/search {locationId, pageLimit:100, searchAfter}\", hit.length), hit;\n // THE TARGET IS THE TOTAL AS IT STOOD WHEN THE WALK STARTED, not the total as it stands when the\n // walk ends. This is a live CRM and contacts are created while the read is running; a strict\n // equality against a moving total fails a complete read for the wrong reason. Short of the\n // opening total is a hard failure. Past it is growth during the read, and is only worth a note.\n const all = []; const seen = new Set(); let searchAfter = null; let stated = null; let target = null; let empties = 0;\n while (true) {\n const body = { locationId: LOCATION, pageLimit: 100, ...(searchAfter ? { searchAfter } : {}) };\n const d = await jsonFetch(`${GHL}/contacts/search`, { method: \"POST\", headers: { ...ghlHeaders, \"Content-Type\": \"application/json\" }, body: JSON.stringify(body) });\n const page = d?.contacts ?? [];\n stated = d?.total ?? stated;\n if (target === null && stated != null) target = stated;\n if (page.length === 0) {\n if (++empties >= 3) break;\n await sleep(2500); continue;\n }\n empties = 0;\n for (const c of page) if (!seen.has(c.id)) { seen.add(c.id); all.push(c); }\n searchAfter = page[page.length - 1]?.searchAfter;\n if (target != null && all.length >= target) break;\n if (!searchAfter) break;\n }\n if (all.length === 0) die(\"contacts came back with ZERO rows.\");\n if (target != null && all.length < target) die(`contact pagination is short: collected ${all.length}, the CRM held ${target} when this read began. Refusing to match names against a partial CRM.`);\n if (stated != null && stated > all.length) console.log(` note: contacts grew from ${target} to ${stated} while this read was running; the ${all.length} read is the snapshot this report describes.`);\n logQuery(\"contacts\", \"POST /contacts/search {locationId, pageLimit:100, searchAfter}\", all.length);\n return cachePut(\"contacts.json\", all);\n}\n\n// -------------------------------------------------------------------------------------------\n// FETCH 4. OPPORTUNITIES, for the write-back scope. Same empty-page discipline.\n// -------------------------------------------------------------------------------------------\nasync function fetchAllOpportunities() {\n const hit = cacheGet(\"opportunities.json\"); if (hit) return logQuery(\"opportunities\", `GET /opportunities/search?location_id=${LOCATION}&limit=100 (+nextPageUrl)`, hit.length), hit;\n // Same live-growth discipline as fetchAllContacts(): the target is the total at the first page.\n const all = []; const seen = new Set(); let empties = 0; let stated = null; let target = null;\n let url = `${GHL}/opportunities/search?location_id=${LOCATION}&limit=100`;\n while (url) {\n const d = await jsonFetch(url, { headers: ghlHeaders });\n const page = d?.opportunities ?? []; const meta = d?.meta ?? {};\n stated = meta.total ?? stated;\n if (target === null && stated != null) target = stated;\n if (page.length === 0) {\n if (++empties >= 3) break;\n await sleep(2500); continue;\n }\n empties = 0;\n for (const o of page) if (!seen.has(o.id)) { seen.add(o.id); all.push(o); }\n if (target != null && all.length >= target) break;\n url = meta.nextPageUrl;\n }\n if (all.length === 0) die(\"opportunities came back with ZERO rows.\");\n if (target != null && all.length < target) die(`opportunity pagination is short: collected ${all.length}, the CRM held ${target} when this read began.`);\n if (stated != null && stated > all.length) console.log(` note: opportunities grew from ${target} to ${stated} while this read was running; the ${all.length} read is the snapshot this report describes.`);\n logQuery(\"opportunities\", `GET /opportunities/search?location_id=${LOCATION}&limit=100 (+nextPageUrl)`, all.length);\n return cachePut(\"opportunities.json\", all);\n}\n\n// -------------------------------------------------------------------------------------------\n// FETCH 5+6. THE BRIDGE: its journal, then Square's own record of every payment in it.\n// -------------------------------------------------------------------------------------------\nasync function fetchJournal() {\n const hit = cacheGet(\"journal.json\"); if (hit) return logQuery(\"bridge journal\", \"GET ?dump=1&admin=\", hit.length), hit;\n const j = await jsonFetch(`${BRIDGE}?dump=1&admin=${encodeURIComponent(ADMIN)}`);\n if (!Array.isArray(j)) die(`journal did not come back as an array (got ${typeof j}).`);\n if (j.length === 0) die(\"journal came back with ZERO rows. That is a failure, not an empty week.\");\n logQuery(\"bridge journal\", \"GET ?dump=1&admin=\", j.length);\n return cachePut(\"journal.json\", j);\n}\nasync function fetchSquare(ids) {\n const hit = cacheGet(\"square.json\"); if (hit) return logQuery(\"square lookup\", \"GET ?lookup=&admin=\", hit.length), hit;\n const out = []; const CHUNK = 45; // the bridge caps at 90; 45 keeps the URL comfortably short\n for (let i = 0; i < ids.length; i += CHUNK) {\n const d = await jsonFetch(`${BRIDGE}?lookup=${ids.slice(i, i + CHUNK).map(encodeURIComponent).join(\",\")}&admin=${encodeURIComponent(ADMIN)}`);\n out.push(...(d?.results ?? []));\n }\n if (out.length !== ids.length) shout(`Square lookup returned ${out.length} of ${ids.length} requested payments.`);\n logQuery(\"square lookup\", \"GET ?lookup=&admin=\", out.length);\n return cachePut(\"square.json\", out);\n}\n\n// -------------------------------------------------------------------------------------------\n// NORMALISERS. One definition each, used by every matcher below, so \"same phone\" cannot mean two\n// different things in two places.\n// -------------------------------------------------------------------------------------------\nconst normPhone = (p) => { const d = String(p ?? \"\").replace(/\\D/g, \"\"); const t = d.length === 11 && d.startsWith(\"1\") ? d.slice(1) : d; return t.length === 10 ? t : null; };\nconst normEmail = (e) => { const s = String(e ?? \"\").trim().toLowerCase(); return s || null; };\nconst normName = (n) => String(n ?? \"\").toLowerCase().replace(/[^a-z ]/g, \"\").replace(/\\s+/g, \" \").trim() || null;\nconst money = (n) => `$${Number(n).toLocaleString(\"en-US\", { minimumFractionDigits: 2, maximumFractionDigits: 2 })}`;\nconst daysBetween = (a, b) => Math.floor((a.getTime() - b.getTime()) / 86400000);\n\nfunction csvField(v) { const s = v === null || v === undefined ? \"\" : String(v); return /[\",\\n]/.test(s) ? `\"${s.replace(/\"/g, '\"\"')}\"` : s; }\nfunction toCsv(headers, records) {\n return [headers.join(\",\"), ...records.map((r) => headers.map((h) => csvField(r[h])).join(\",\"))].join(\"\\n\") + \"\\n\";\n}\n\n// ===========================================================================================\n// MAIN\n// ===========================================================================================\nconsole.log(`Reading live. Location ${LOCATION}. As of ${ASOF.toISOString()}.\\n`);\n\nconst [invoices, transactions, contacts, opportunities, journal] = await Promise.all([\n fetchAllInvoices(), fetchAllTransactions(), fetchAllContacts(), fetchAllOpportunities(), fetchJournal(),\n]);\n\nconst universe = paymentUniverse(journal);\nconst square = await fetchSquare([...universe.payments.keys()].sort());\nconst sqById = new Map(square.map((s) => [s.id, s]));\n\n// -------------------------------------------------------------------------------------------\n// FILE 1. UNRESOLVED INVOICES.\n//\n// \"Unresolved\" is defined as NOT SETTLED, and settled is enumerated as a positive list rather\n// than assumed to be the single word \"paid\". If the CRM ever returns a status this file has never\n// seen, the run stops instead of quietly filing it on one side or the other: an unknown status\n// silently counted as unresolved would invent a debt, and silently counted as settled would hide\n// one. That choice is the whole reason a subset needs a parent total.\n// -------------------------------------------------------------------------------------------\nconst SETTLED = new Set([\"paid\", \"void\", \"voided\", \"cancelled\", \"canceled\", \"written_off\", \"partially_paid\"]);\nconst UNRESOLVED = new Set([\"draft\", \"sent\", \"overdue\", \"viewed\", \"partially_paid_unsettled\"]);\n{\n const unknown = [...new Set(invoices.map((i) => i.status))].filter((s) => !SETTLED.has(s) && !UNRESOLVED.has(s));\n if (unknown.length) die(`invoice status(es) this report has no rule for: ${unknown.join(\", \")}. Classify them before shipping a number.`);\n}\nconst invTotal = (i) => Number(i.total ?? i.invoiceTotal ?? 0) || 0;\nconst invDue = (i) => Number(i.amountDue ?? 0) || 0;\n\nconst parentInvoiceTotal = invoices.reduce((a, i) => a + invTotal(i), 0);\nconst byStatus = new Map();\nfor (const i of invoices) {\n const g = byStatus.get(i.status) ?? { status: i.status, n: 0, total: 0, due: 0, settled: SETTLED.has(i.status) };\n g.n++; g.total += invTotal(i); g.due += invDue(i); byStatus.set(i.status, g);\n}\nconst unresolvedInvoices = invoices.filter((i) => !SETTLED.has(i.status)).sort((a, b) => String(a.createdAt).localeCompare(String(b.createdAt)));\nconst settledInvoices = invoices.filter((i) => SETTLED.has(i.status));\n\n// RECONCILE OR DIE: the subset plus its remainder is the parent, in rows and in cents.\n{\n const p = [];\n if (unresolvedInvoices.length + settledInvoices.length !== invoices.length) p.push(\"unresolved + settled does not equal all invoices\");\n const u = unresolvedInvoices.reduce((a, i) => a + invTotal(i), 0);\n const s = settledInvoices.reduce((a, i) => a + invTotal(i), 0);\n if (cents(u + s) !== cents(parentInvoiceTotal)) p.push(`unresolved ${money(u)} + settled ${money(s)} does not equal all invoices ${money(parentInvoiceTotal)}`);\n if (p.length) { shout(\"INVOICE RECONCILIATION FAILED. Nothing written.\"); p.forEach((x) => console.error(\" - \" + x)); process.exit(1); }\n}\n\n// \"Has this customer since paid another way?\" Two independent looks, both reported, neither\n// allowed to speak beyond its own coverage:\n// a) SQUARE, through the bridge. Its journal begins 13 July 2026, so it is SILENT about, not\n// negative on, anything raised before that. Saying \"no Square payment found\" about a\n// December invoice would be a filter boundary passed off as a finding.\n// b) THE CRM's own transaction list, which reaches back to November 2025.\n// A shared nameless point of sale contact record (one record every counter sale is filed against)\n// can never supply evidence about a particular invoice, so it is excluded by name.\nconst journalTs = journal.map((r) => r?.ts).filter(Boolean).sort();\nconst squareCoverageStart = square.map((s) => s.created_at).filter(Boolean).sort()[0] ?? journalTs[0];\nconst NAMELESS = new Set([\"unknown\", \"\", \"no name\", \"customer\"]);\nconst namelessContactIds = new Set(\n invoices.filter((i) => NAMELESS.has(String((i.contactDetails ?? {}).name ?? \"\").trim().toLowerCase()))\n .map((i) => (i.contactDetails ?? {}).id).filter(Boolean),\n);\n\nconst squareByKey = new Map();\nfor (const s of square) {\n const c = s.square_customer ?? {};\n for (const k of [normPhone(c.phone_number), normEmail(c.email_address), normName([c.given_name, c.family_name].filter(Boolean).join(\" \"))]) {\n if (k) (squareByKey.get(k) ?? squareByKey.set(k, []).get(k)).push(s);\n }\n}\nconst invoiceById = new Map(invoices.map((i) => [i._id, i]));\n\nconst invoiceRows = unresolvedInvoices.map((i) => {\n const cd = i.contactDetails ?? {};\n const amt = invTotal(i);\n const created = i.createdAt;\n const inSquareWindow = created && squareCoverageStart && created >= squareCoverageStart;\n const keys = [normPhone(cd.phoneNo), normEmail(cd.email), normName(cd.name)].filter(Boolean);\n const sqHits = [...new Set(keys.flatMap((k) => squareByKey.get(k) ?? []))].filter((s) => cents(s.amount) === cents(amt));\n // CRM side: a succeeded transaction for the SAME contact record and the SAME amount. Recorded\n // with what it actually settled, because it usually settled a different invoice.\n const txHits = namelessContactIds.has(cd.id) ? [] : transactions.filter((t) =>\n t.status === \"succeeded\" && cents(Number(t.amount) || 0) === cents(amt) && t.contactId && t.contactId === cd.id);\n\n let paidAnotherRoute = \"no evidence either way\";\n let evidence = \"\";\n let action = \"chase\";\n if (sqHits.length) {\n const s = sqHits[0];\n paidAnotherRoute = \"yes, in Square\";\n evidence = `Square payment ${s.id} for ${money(s.amount)} on ${String(s.created_at).slice(0, 10)}`;\n action = \"close\";\n } else if (txHits.length) {\n const t = txHits[0];\n const sib = invoiceById.get(t.entitySourceId) ?? invoiceById.get(t.entityId);\n paidAnotherRoute = \"yes, in the CRM\";\n evidence = sib\n ? `the same customer paid ${money(t.amount)} on ${String(t.createdAt).slice(0, 10)} against invoice ${sib.invoiceNumber} (status ${sib.status}), a duplicate of this one raised the same day`\n : `CRM payment ${t._id} for ${money(t.amount)} on ${String(t.createdAt).slice(0, 10)}`;\n action = \"close\";\n } else if (!inSquareWindow) {\n paidAnotherRoute = \"cannot tell from Square\";\n evidence = `raised before the payment bridge began recording on ${String(squareCoverageStart).slice(0, 10)}, so Square cannot confirm or rule out a later payment; no matching CRM payment either`;\n } else {\n evidence = \"no Square payment and no CRM payment of this amount for this customer\";\n }\n return {\n invoice_number: i.invoiceNumber ?? \"\",\n status: i.status,\n date_created: String(created).slice(0, 10),\n days_old: created ? daysBetween(ASOF, new Date(created)) : \"\",\n customer_name: cd.name ?? \"(no name on the invoice)\",\n customer_email: cd.email ?? \"\",\n customer_phone: cd.phoneNo ?? \"\",\n amount_usd: amt.toFixed(2),\n amount_due_usd: invDue(i).toFixed(2),\n paid_by_another_route: paidAnotherRoute,\n evidence,\n recommended_action: action,\n crm_contact_id: cd.id ?? \"\",\n invoice_id: i._id,\n invoice_source: i.source ?? \"\",\n };\n});\n\n// -------------------------------------------------------------------------------------------\n// FILE 2. SQUARE PAYMENTS WITH NO CUSTOMER RECORD, and the population they came out of.\n//\n// The best guess is only ever offered with the evidence that produced it, and only when exactly\n// ONE contact answers to it. Two candidates is not a better guess than one, it is a question for\n// a person, and this file says so rather than picking.\n// -------------------------------------------------------------------------------------------\nconst byPhone = new Map(), byEmail = new Map(), byName = new Map();\nconst push = (m, k, v) => { if (k) (m.get(k) ?? m.set(k, []).get(k)).push(v); };\nfor (const c of contacts) {\n push(byPhone, normPhone(c.phone), c);\n push(byEmail, normEmail(c.email), c);\n push(byName, normName(c.contactName || [c.firstName, c.lastName].filter(Boolean).join(\" \")), c);\n for (const ap of c.additionalPhones ?? []) push(byPhone, normPhone(typeof ap === \"string\" ? ap : ap?.phone), c);\n for (const ae of c.additionalEmails ?? []) push(byEmail, normEmail(typeof ae === \"string\" ? ae : ae?.email), c);\n}\n\n// KNOWN EDGE CASE, carried in code so it cannot be forgotten between runs. Square has Caroline\n// Riner on one number and the CRM has \"carolyn riner\" on another. Same human, two records, and\n// this file FLAGS that without joining them: a merge is a decision about a person's records that\n// belongs to the client, and an automatic join on a near name is exactly how two real customers\n// with similar names get fused.\nconst FLAGGED_NEAR_MATCHES = [\n { squarePhone: \"+19123466931\", squareName: \"Caroline Riner\", crmContactId: \"CGpAJDIFtEPnjtD8OxQ6\", crmName: \"carolyn riner\", crmPhone: \"+19124328482\" },\n];\n\n// THE DRIFT, MEASURED AND PRINTED RATHER THAN QUIETLY CORRECTED. unmatchedPaymentRows() is the\n// rule that produced the figure the client already has in writing. paymentUniverse() is the same\n// rule with the grouping key fixed (see squarePaymentIdsInRow). Where they disagree, every\n// payment in the gap is named below with the contact the bridge itself says it reached, because a\n// number in a client's inbox is not corrected by a quieter number in a newer file.\nconst oldRule = unmatchedPaymentRows(journal);\nconst oldRuleTotal = oldRule.reduce((a, r) => a + r.amount, 0);\nconst nowLinked = oldRule\n .filter((r) => !universe.unlinked.includes(r.paymentId))\n .map((r) => {\n const rows = universe.payments.get(r.paymentId) ?? [];\n const hit = rows.find((x) => typeof x?.contactId === \"string\" && x.contactId.length > 4);\n return { ...r, contactId: hit?.contactId ?? \"\", note: hit?.note ?? \"\", kind: hit?.kind ?? \"\" };\n });\nconst nowLinkedTotal = nowLinked.reduce((a, r) => a + r.amount, 0);\n\n// Payments the bridge DID tie to a contact but deliberately left the booking alone: kind\n// REVENUE-ON-CLIENT-OPP, \"client opp untouched\". The contact is not the problem for these; the\n// money simply is not on the card a report can add up from. They are the real body of the write\n// back, and they are NOT unlinked, so they do not belong in file 2.\nconst revenueOnClientOpp = new Map();\nfor (const [id, rows] of universe.payments) {\n const r = rows.find((x) => x?.kind === \"REVENUE-ON-CLIENT-OPP\" && typeof x?.contactId === \"string\" && x.contactId.length > 4);\n if (r) revenueOnClientOpp.set(id, r);\n}\n\nconst unlinkedIds = [...universe.unlinked].sort((a, b) => String(sqById.get(a)?.created_at ?? \"\").localeCompare(String(sqById.get(b)?.created_at ?? \"\")));\nconst paymentRows = unlinkedIds.map((id) => {\n const s = sqById.get(id) ?? {};\n const c = s.square_customer ?? {};\n const name = [c.given_name, c.family_name].map((x) => String(x ?? \"\").trim()).filter(Boolean).join(\" \").replace(/\\s+/g, \" \") || String(s.cardholder_name ?? \"\").trim();\n const ph = normPhone(c.phone_number), em = normEmail(c.email_address), nm = normName(name);\n const ev = []; const cands = new Map();\n const add = (list, label) => { if (list?.length) { ev.push(label); for (const x of list) cands.set(x.id, x); } };\n add(ph && byPhone.get(ph), \"exact phone match\");\n add(em && byEmail.get(em), \"exact email match\");\n add(nm && byName.get(nm), \"exact name match\");\n const list = [...cands.values()];\n const near = FLAGGED_NEAR_MATCHES.find((f) => normPhone(f.squarePhone) === ph || normName(f.squareName) === nm);\n return {\n payment_id: id,\n date: String(s.created_at ?? \"\").slice(0, 10),\n amount_usd: Number(s.amount ?? journalAmount(universe.payments.get(id))).toFixed(2),\n buyer_name: name || \"(no name in Square)\",\n buyer_phone: c.phone_number ?? \"\",\n buyer_email: c.email_address ?? \"\",\n card_last4: s.last_4 ?? \"\",\n card_brand: s.card_brand ?? \"\",\n receipt_url: s.receipt_url ?? \"\",\n best_guess_contact_id: list.length === 1 ? list[0].id : \"\",\n best_guess_contact_name: list.length === 1 ? (list[0].contactName ?? \"\") : \"\",\n match_evidence: list.length === 1 ? ev.join(\", \") : (list.length === 0 ? \"no candidate\" : `${list.length} candidates, a person picks`),\n candidate_count: list.length,\n candidates_if_many: list.length > 1 ? list.map((x) => `${x.id} ${x.contactName ?? \"\"}`).join(\"; \") : \"\",\n flag: near\n ? `same human as CRM contact ${near.crmContactId} \"${near.crmName}\" on ${near.crmPhone}, on a different number. Two records, one person. Flagged, NOT merged, and NOT written to.`\n : \"\",\n _cand: list.length === 1 ? list[0] : null,\n _amount: Number(s.amount ?? journalAmount(universe.payments.get(id))),\n };\n});\n\n// RECONCILE OR DIE: total the bridge sees, minus linked, equals unlinked, in rows and cents.\nconst linkedIds = universe.linked;\nconst sqAmount = (id) => Number(sqById.get(id)?.amount ?? journalAmount(universe.payments.get(id))) || 0;\nconst universeTotal = [...universe.payments.keys()].reduce((a, id) => a + sqAmount(id), 0);\nconst linkedTotal = linkedIds.reduce((a, id) => a + sqAmount(id), 0);\nconst unlinkedTotal = unlinkedIds.reduce((a, id) => a + sqAmount(id), 0);\n{\n const p = [];\n if (linkedIds.length + unlinkedIds.length !== universe.payments.size) p.push(`linked ${linkedIds.length} + unlinked ${unlinkedIds.length} does not equal ${universe.payments.size} seen`);\n if (cents(linkedTotal + unlinkedTotal) !== cents(universeTotal)) p.push(`linked ${money(linkedTotal)} + unlinked ${money(unlinkedTotal)} does not equal ${money(universeTotal)}`);\n if (paymentRows.length !== unlinkedIds.length) p.push(\"the unlinked file has a different row count from the unlinked set\");\n // The journal's own amount and Square's own amount must agree on every unlinked payment, or the\n // dollar figure depends on which system you asked.\n for (const id of unlinkedIds) {\n const j = journalAmount(universe.payments.get(id)), s = Number(sqById.get(id)?.amount ?? NaN);\n if (Number.isFinite(s) && cents(j) !== cents(s)) p.push(`payment ${id}: journal says ${money(j)}, Square says ${money(s)}`);\n }\n if (p.length) { shout(\"PAYMENT RECONCILIATION FAILED. Nothing written.\"); p.forEach((x) => console.error(\" - \" + x)); process.exit(1); }\n}\n\n// -------------------------------------------------------------------------------------------\n// FILE 3. THE WRITE-BACK DRY RUN. Kim's rule, agreed in writing: one open booking, assign it;\n// more than one, a person chooses. engine/money-match.ts is the same rule and the same two stage\n// ids; the scope lives in BOTH places on purpose and is asserted equal below, because an\n// unscoped write puts money on a Survey Requested card.\n// -------------------------------------------------------------------------------------------\nconst VALUABLE_STAGES = [\"fd821b4e-bbe6-44de-b754-fa80e4823616\", \"ae173310-f8b1-4399-acb7-ef1fc03d3697\"];\nconst STAGE_NAME = { \"fd821b4e-bbe6-44de-b754-fa80e4823616\": \"Customer\", \"ae173310-f8b1-4399-acb7-ef1fc03d3697\": \"Won and Paid\" };\nconst IN_SCOPE = new Set(VALUABLE_STAGES);\nconst oppsByContact = new Map();\nfor (const o of opportunities) {\n if (!IN_SCOPE.has(o.pipelineStageId) || !o.contactId) continue;\n (oppsByContact.get(o.contactId) ?? oppsByContact.set(o.contactId, []).get(o.contactId)).push(o);\n}\n\nconst contactById = new Map(contacts.map((c) => [c.id, c]));\n\n// THE WRITE-BACK POPULATION IS BOTH GROUPS, LABELLED, NEVER BLENDED. A plan built only from the\n// unlinked payments would describe four payments and ignore the $20,682.00 the bridge tied to a\n// named customer and then deliberately did not put on the booking. A plan that blended them would\n// repeat the mistake this whole exercise exists to undo. So each row carries which it is.\nconst wbCandidates = [\n ...paymentRows.map((r) => ({\n payment_id: r.payment_id, date: r.date, amount: r._amount, buyer_name: r.buyer_name,\n link_state: \"not linked to any contact\",\n contact: r._cand, flag: r.flag,\n match_evidence: r.match_evidence, candidate_count: r.candidate_count,\n })),\n ...[...revenueOnClientOpp.entries()].map(([id, row]) => {\n const s = sqById.get(id) ?? {};\n const c = s.square_customer ?? {};\n const name = [c.given_name, c.family_name].map((x) => String(x ?? \"\").trim()).filter(Boolean).join(\" \") || String(s.cardholder_name ?? \"\").trim();\n return {\n payment_id: id, date: String(s.created_at ?? \"\").slice(0, 10),\n amount: Number(s.amount ?? journalAmount(universe.payments.get(id))) || 0,\n buyer_name: name || \"(no name in Square)\",\n link_state: \"linked to a contact, money not on the booking\",\n contact: contactById.get(row.contactId) ?? null, flag: \"\",\n match_evidence: `the bridge's own journal booked this payment to contact ${row.contactId} and left the booking untouched`,\n candidate_count: contactById.has(row.contactId) ? 1 : 0,\n };\n }),\n].sort((a, b) => String(a.date).localeCompare(String(b.date)));\n\nconst notWritten = [];\nconst plan = new Map();\nfor (const r of wbCandidates) {\n const reject = (why) => notWritten.push({ ...r, why });\n if (r.flag) { reject(\"flagged as the same human under two records; a person confirms before any money moves\"); continue; }\n if (!r.contact) { reject(r.candidate_count === 0 ? \"no CRM contact answers to this buyer\" : \"more than one CRM contact answers to this buyer\"); continue; }\n const inScope = oppsByContact.get(r.contact.id) ?? [];\n if (!inScope.length) { reject(\"the customer is named but has no booking on the Customer or Won and Paid board\"); continue; }\n const open = inScope.filter((o) => Number(o.monetaryValue || 0) === 0);\n const valued = inScope.filter((o) => Number(o.monetaryValue || 0) > 0);\n if (!open.length && valued.length) { reject(`every booking for this customer already carries a value (${valued.map((o) => money(o.monetaryValue)).join(\", \")}); nothing would be overwritten`); continue; }\n if (open.length !== 1) { reject(`${open.length} bookings open for this customer, so a person picks`); continue; }\n const o = open[0];\n const g = plan.get(o.id) ?? { opp: o, contact: r.contact, amounts: [], rows: [] };\n g.amounts.push(r.amount); g.rows.push(r); plan.set(o.id, g);\n}\n// SUM, NEVER OVERWRITE. One write per booking carrying the total, because two writes to one field\n// means the loser's money vanishes silently and the next run reads a non zero value and stops.\nconst writeRows = [...plan.values()]\n .map((g) => {\n const cur = Number(g.opp.monetaryValue || 0);\n const delta = g.amounts.reduce((a, x) => a + x, 0);\n return {\n contact_id: g.contact.id,\n contact_name: g.contact.contactName ?? \"\",\n opportunity_id: g.opp.id,\n opportunity_name: g.opp.name ?? \"\",\n pipeline_stage_id: g.opp.pipelineStageId,\n pipeline_stage_name: STAGE_NAME[g.opp.pipelineStageId],\n current_value_usd: cur.toFixed(2),\n new_value_usd: (cur + delta).toFixed(2),\n delta_usd: delta.toFixed(2),\n payment_count: g.amounts.length,\n payment_ids: g.rows.map((r) => r.payment_id).join(\"; \"),\n payment_dates: g.rows.map((r) => r.date).join(\"; \"),\n payment_amounts_usd: g.amounts.map((x) => x.toFixed(2)).join(\"; \"),\n payment_link_state: [...new Set(g.rows.map((r) => r.link_state))].join(\"; \"),\n match_evidence: [...new Set(g.rows.map((r) => r.match_evidence))].join(\"; \"),\n would_overwrite: cur > 0 ? \"YES, DO NOT RUN\" : \"no, the field is empty\",\n };\n })\n .sort((a, b) => Number(b.delta_usd) - Number(a.delta_usd));\n\n// RECONCILE OR DIE: written + not written equals the write-back population, and nothing overwrites.\nconst writtenTotal = writeRows.reduce((a, r) => a + Number(r.delta_usd), 0);\nconst notWrittenTotal = notWritten.reduce((a, r) => a + r.amount, 0);\nconst wbTotal = wbCandidates.reduce((a, r) => a + r.amount, 0);\n{\n const p = [];\n const covered = writeRows.reduce((a, r) => a + Number(r.payment_count), 0) + notWritten.length;\n if (covered !== wbCandidates.length) p.push(`write-back covers ${covered} payments, the candidate set has ${wbCandidates.length}`);\n if (cents(writtenTotal + notWrittenTotal) !== cents(wbTotal)) p.push(`written ${money(writtenTotal)} + not written ${money(notWrittenTotal)} does not equal the candidate set ${money(wbTotal)}`);\n if (new Set(wbCandidates.map((r) => r.payment_id)).size !== wbCandidates.length) p.push(\"a payment appears twice in the write-back candidate set\");\n const bad = writeRows.filter((r) => Number(r.current_value_usd) > 0);\n if (bad.length) p.push(`${bad.length} planned write(s) would overwrite a non zero value`);\n const outOfScope = writeRows.filter((r) => !IN_SCOPE.has(r.pipeline_stage_id));\n if (outOfScope.length) p.push(`${outOfScope.length} planned write(s) are outside the two allowed stages`);\n if (p.length) { shout(\"WRITE-BACK RECONCILIATION FAILED. Nothing written.\"); p.forEach((x) => console.error(\" - \" + x)); process.exit(1); }\n}\n\n// WHAT THE FIELD BEING WRITTEN ACTUALLY HOLDS TODAY. Checked rather than assumed, because \"sum\n// the payment onto monetaryValue\" is only obviously right if that field already holds payments.\n// Live, every non zero monetaryValue in the whole location is one of a tiny set of identical\n// figures, which is the shape of a PRICE LIST, not of accumulated takings. If that is what it is,\n// then an empty card does not mean \"nobody has paid\", it means \"no price was set\", and writing a\n// part payment there changes what the column means on every card it touches. That is a decision\n// about her books, so it is surfaced here and not resolved by this script.\nconst valueShape = new Map();\nfor (const o of opportunities) {\n const v = Number(o.monetaryValue || 0);\n if (v > 0) valueShape.set(v, (valueShape.get(v) ?? 0) + 1);\n}\nconst distinctValues = [...valueShape.entries()].sort((a, b) => b[1] - a[1]);\n\n// -------------------------------------------------------------------------------------------\n// OUT\n// -------------------------------------------------------------------------------------------\nconst OUT = process.env.CLIENT_FILES_OUT_DIR || \"/mnt/user-data/outputs\";\nmkdirSync(OUT, { recursive: true });\n\nconst INV_HEADERS = [\"invoice_number\", \"status\", \"date_created\", \"days_old\", \"customer_name\", \"customer_email\", \"customer_phone\",\n \"amount_usd\", \"amount_due_usd\", \"paid_by_another_route\", \"evidence\", \"recommended_action\", \"crm_contact_id\", \"invoice_id\", \"invoice_source\"];\nconst PAY_HEADERS = [\"payment_id\", \"date\", \"amount_usd\", \"buyer_name\", \"buyer_phone\", \"buyer_email\", \"card_brand\", \"card_last4\",\n \"receipt_url\", \"best_guess_contact_id\", \"best_guess_contact_name\", \"match_evidence\", \"candidate_count\", \"candidates_if_many\", \"flag\"];\nconst WB_HEADERS = [\"contact_id\", \"contact_name\", \"opportunity_id\", \"opportunity_name\", \"pipeline_stage_id\", \"pipeline_stage_name\",\n \"current_value_usd\", \"new_value_usd\", \"delta_usd\", \"payment_count\", \"payment_ids\", \"payment_dates\", \"payment_amounts_usd\",\n \"payment_link_state\", \"match_evidence\", \"would_overwrite\"];\n\nwriteFileSync(join(OUT, \"unresolved-draft-invoices.csv\"), toCsv(INV_HEADERS, invoiceRows));\nwriteFileSync(join(OUT, \"square-payments-unlinked.csv\"), toCsv(PAY_HEADERS, paymentRows));\nwriteFileSync(join(OUT, \"writeback-dry-run.csv\"), toCsv(WB_HEADERS, writeRows));\n\n// The companion summary. Client facing, so the copy rules are enforced by the machine at the end.\nconst chase = invoiceRows.filter((r) => r.recommended_action === \"chase\");\nconst close = invoiceRows.filter((r) => r.recommended_action === \"close\");\nconst unresolvedTotal = unresolvedInvoices.reduce((a, i) => a + invTotal(i), 0);\nconst settledTotal = settledInvoices.reduce((a, i) => a + invTotal(i), 0);\nconst statusLines = [...byStatus.values()].sort((a, b) => b.n - a.n)\n .map((g) => `| ${g.status} | ${g.settled ? \"settled\" : \"unresolved\"} | ${g.n} | ${money(g.total)} | ${money(g.due)} |`);\nconst oldest = invoiceRows.length ? invoiceRows[0] : null;\n\nconst md = [\n \"# Unresolved draft invoices\",\n \"\",\n \"## What this file is\",\n \"\",\n `Every invoice in the CRM that has not been settled, which is ${unresolvedInvoices.length} invoices worth ${money(unresolvedTotal)}, all of it still outstanding. ` +\n `That figure is a share of a whole and here is the whole: the location holds ${invoices.length} invoices worth ${money(parentInvoiceTotal)} in total, of which ${settledInvoices.length} worth ${money(settledTotal)} are settled, ` +\n `so ${settledInvoices.length} plus ${unresolvedInvoices.length} is ${invoices.length} and ${money(settledTotal)} plus ${money(unresolvedTotal)} is ${money(parentInvoiceTotal)}. ` +\n `${oldest ? `The oldest has been sitting for ${oldest.days_old} days. ` : \"\"}` +\n `${close.length} of the ${unresolvedInvoices.length} can be closed rather than chased, because the customer paid by another route and the record simply never caught up, and ${chase.length} still have no payment against them. ` +\n \"One thing worth saying plainly, because it is the reason this file exists in this form. This list is not the same thing as the Square counter payments list, and the two were run together in an earlier conversation. \" +\n \"An unresolved invoice is money you asked for that has not arrived. A Square counter payment with no customer record is money that HAS arrived and is not filed against anybody. \" +\n `They are different populations of different sizes: ${unresolvedInvoices.length} invoices here, ${unlinkedIds.length} unfiled payments in the file beside it, and neither of them is eight. ` +\n \"Both files are attached so the two can be told apart from now on.\",\n \"\",\n \"## The whole population, so this subset can be checked against it\",\n \"\",\n \"| Status | Settled | Invoices | Value | Still due |\",\n \"|---|---|---|---|---|\",\n ...statusLines,\n `| **all** | | **${invoices.length}** | **${money(parentInvoiceTotal)}** | **${money(invoices.reduce((a, i) => a + invDue(i), 0))}** |`,\n \"\",\n \"## The unresolved invoices\",\n \"\",\n \"| Invoice | Raised | Days | Customer | Amount | Status | Paid another way | Action |\",\n \"|---|---|---|---|---|---|---|---|\",\n ...invoiceRows.map((r) => `| ${r.invoice_number} | ${r.date_created} | ${r.days_old} | ${r.customer_name} | ${money(Number(r.amount_usd))} | ${r.status} | ${r.paid_by_another_route} | ${r.recommended_action} |`),\n \"\",\n \"The reason behind every entry in that last pair of columns is in the CSV beside this file, one row per invoice, along with each customer's email and phone.\",\n \"\",\n \"## How the numbers reconcile\",\n \"\",\n `Invoices: ${invoices.length} in total worth ${money(parentInvoiceTotal)}. ${settledInvoices.length} settled worth ${money(settledTotal)}, ${unresolvedInvoices.length} unresolved worth ${money(unresolvedTotal)}. The two add back to the total exactly.`,\n \"\",\n `Square payments: the bridge has seen ${universe.payments.size} payments worth ${money(universeTotal)}. ${linkedIds.length} worth ${money(linkedTotal)} reached a customer record, ${unlinkedIds.length} worth ${money(unlinkedTotal)} did not. The two add back to the total exactly.`,\n \"\",\n `Write back: ${wbCandidates.length} payments worth ${money(wbTotal)} have money that is not on a booking. ${writeRows.reduce((a, r) => a + Number(r.payment_count), 0)} of them worth ${money(writtenTotal)} would go onto ${writeRows.length} bookings, and ${notWritten.length} worth ${money(notWrittenTotal)} would be left alone with a reason recorded for each. The two add back to ${money(wbTotal)} exactly. Nothing has been written; this is a description of a write.`,\n \"\",\n \"## One correction you should know about\",\n \"\",\n nowLinked.length\n ? `An earlier count of the Square payments that never reached a customer record said ${oldRule.length} payments worth ${money(oldRuleTotal)}. The true figure is ${unlinkedIds.length} worth ${money(unlinkedTotal)}. ` +\n `The ${nowLinked.length} payments worth ${money(nowLinkedTotal)} in between did reach a customer record: the payment bridge recorded the customer for each one, by name, and the earlier count could not see that because of the way it read its own log. ` +\n \"Those payments are not missing money and they never were. What is true of them is narrower and more fixable: the customer is on the record and the amount is not yet on the booking, which is why revenue reports still read low. Every one of them is listed in the write back file with the customer it belongs to.\"\n : \"No correction is outstanding on these numbers.\",\n \"\",\n].join(\"\\n\");\n\n{\n const problems = [];\n if (/daycare/i.test(md)) problems.push('the word \"daycare\" appears');\n const prose = md.split(\"\\n\").filter((l) => !l.startsWith(\"|\")).join(\"\\n\");\n if (/—|–/.test(prose)) problems.push(\"an em dash or en dash appears\");\n if (/\\s-\\s/.test(prose)) problems.push(\"a hyphen is used as punctuation\");\n if (problems.length) { shout(\"CLIENT-SAFE COPY CHECK FAILED. Summary not written.\"); problems.forEach((p) => console.error(\" - \" + p)); process.exit(1); }\n}\nwriteFileSync(join(OUT, \"unresolved-draft-invoices.md\"), md);\n\n// -------------------------------------------------------------------------------------------\n// THE RECEIPTS\n// -------------------------------------------------------------------------------------------\nconsole.log(\"QUERIES AND ROW COUNTS\");\nfor (const q of QUERIES) console.log(` ${String(q.rows).padStart(6)} ${q.what.padEnd(22)} ${q.url}`);\nconsole.log(\"\");\nconsole.log(`INVOICES ${invoices.length} in total ${money(parentInvoiceTotal)} = ${settledInvoices.length} settled ${money(settledTotal)} + ${unresolvedInvoices.length} unresolved ${money(unresolvedTotal)}`);\nconsole.log(` of the ${unresolvedInvoices.length}: ${chase.length} to chase, ${close.length} to close`);\nconsole.log(`PAYMENTS ${universe.payments.size} seen ${money(universeTotal)} = ${linkedIds.length} linked ${money(linkedTotal)} + ${unlinkedIds.length} unlinked ${money(unlinkedTotal)}`);\nconsole.log(`WRITE BACK ${wbCandidates.length} candidates ${money(wbTotal)} = ${writeRows.reduce((a, r) => a + Number(r.payment_count), 0)} written ${money(writtenTotal)} across ${writeRows.length} bookings + ${notWritten.length} left alone ${money(notWrittenTotal)}`);\nconsole.log(\"\");\nif (nowLinked.length) {\n shout(`THE SHARED RULE IS STILL WRONG IN engine/facts.ts. unmatchedPaymentRows()/squareBacklog() report ${oldRule.length} unmatched payments worth ${money(oldRuleTotal)}. ` +\n `${nowLinked.length} of those, worth ${money(nowLinkedTotal)}, ARE matched: the grouping key keeps the trailing semicolon from \"backfilled from square payment ; client opp untouched\", ` +\n `so the row that resolved the payment lands under a different key from the row that failed it. One .replace(/[;,.]+$/, \"\") in the id extractor. Not changed here: it moves a number the client already has in writing.`);\n console.log(\"PAYMENTS THE OLD RULE CALLS UNMATCHED THAT THE JOURNAL ITSELF RESOLVED:\");\n for (const r of nowLinked) console.log(` ${money(r.amount).padStart(10)} ${r.paymentId} -> contact ${r.contactId} (${r.kind})`);\n console.log(\"\");\n}\nfor (const [f, n] of [[\"unresolved-draft-invoices.csv\", invoiceRows.length], [\"unresolved-draft-invoices.md\", \"summary\"], [\"square-payments-unlinked.csv\", paymentRows.length], [\"writeback-dry-run.csv\", writeRows.length]]) {\n console.log(`Wrote ${join(OUT, f)} (${typeof n === \"number\" ? n + \" data rows\" : n})`);\n}\nconsole.log(\"\");\nconsole.log(\"REASONS A PAYMENT WAS NOT WRITTEN:\");\nfor (const r of notWritten) console.log(` ${money(r.amount).padStart(10)} ${r.buyer_name.padEnd(20)} ${r.payment_id} ${r.why}`);\nconsole.log(\"\");\nconsole.log(`WHAT monetaryValue HOLDS TODAY: ${distinctValues.reduce((a, [, n]) => a + n, 0)} of ${opportunities.length} opportunities carry a value, and they use only ${distinctValues.length} distinct figures:`);\nfor (const [v, n] of distinctValues) console.log(` ${money(v).padStart(12)} on ${n} cards`);\nif (distinctValues.length <= 5) {\n shout(\"READ THIS BEFORE ANY WRITE IS TURNED ON. Every non zero value in this location is one of a handful of identical figures, \" +\n \"which is what a PRICE LIST looks like, not what accumulated payments look like. If that field holds the program price, an empty card \" +\n \"means no price was set rather than nobody has paid, and summing a Square payment onto it makes the column mean two different things \" +\n \"on different rows. The dry run below is still the correct plan under the rule as written; what needs a human is whether that rule is \" +\n \"the right one for a field that currently reads as a price. It also explains the payments left alone above: a card showing \" +\n `${money(distinctValues[0][0])} is a priced card, not a paid one, so \"already valued\" is not evidence the money was recorded.`);\n}\nconsole.log(\"NO WRITE WAS EXECUTED. Every call in this run was a read.\");\n\n\n",[600],"1eab96b0-27b5-4d8f-95a2-01d8245d7458","SOURCE-BUNDLE.part33.txt","89c3c018-97ea-11f1-8d7d-1607ee4eb77e",1203,["D",1786982934410],7,"THE DOGS SPOT — SOURCE BUNDLE (part 33 of 47)\n\nEVERY source file in this project, engine/ included. Restoring these parts and nothing else gives\nyou a tree that builds, typechecks and runs its own test suite with no network and no val.\n\nengine/ is here as of 14 Aug 2026. It used to be left out because val 1bfa6e81-74e1-4c6c-ab32-118304a4ffff\nholds it, which was true of every engine file except engine/watch.ts: a module the val does not run,\nso it was never deployed, so it lived in one container and nothing else. A reclaim destroyed it.\nscripts/deploy.mjs --check still compares engine/ against the val file by file; that is a second\ncheck on the same files now, not the only copy of them.\n\nRESTORE (needs only node, from an empty folder). Save each part, then run this ON EACH ONE:\n\n node -e 'const fs=require(\"fs\"),p=require(\"path\");const b=fs.readFileSync(process.argv[1],\"utf8\");\n for(const s of b.split(\"\\n=====FILE \").slice(1)){const i=s.indexOf(\" =====\\n\");\n const f=s.slice(0,i),c=s.slice(i+7);fs.mkdirSync(p.dirname(f),{recursive:true});\n fs.writeFileSync(f,c.replace(/\\n$/,\"\"))}' PART.txt\n\nA record named #1, #2, ... is one FILE cut into pieces: concatenate them in order, then\nstrip one trailing newline from the last. scripts/restore.mjs does this for you.\n\nEach part is complete in itself: whole files only, no reassembly, any order.\n\nThen: node scripts/build.mjs (engine/ came out of these parts; nothing to fetch first)\n node scripts/typecheck.mjs\n node tests/run-all.mjs\n node scripts/deploy.mjs --check (pulls nothing, proves the val matches what you restored)\n node tests/negative-controls.mjs (proves the suite above can actually fail)\n\nIN THIS PART (2 of 129 files)\n scripts/bundle.mjs 18216 bytes 37ce8957a42b\n scripts/call-sheet.py 8994 bytes dd5f22d83f3c\n\n================================================================================================\n=====FILE scripts/bundle.mjs =====\n// THE BUNDLE. Everything that is not already on the val, in one restorable text file.\n//\n// WHY. The working container was reclaimed mid-session on 4 August and took the test suite, the\n// build script and the PDF generator with it. The engine survived only because val.town happened\n// to hold a complete copy. Nothing else had a second home. This gives the rest of the project one.\n//\n// The bundle is plain text with file markers, not an archive, for three reasons: it can be read by\n// a human who has lost everything else, it survives being pasted through a chat window, and it can\n// live on the val as an inert `file` next to the code it tests.\n//\n// Restore, from nothing, needing only node:\n// node -e 'const fs=require(\"fs\"),p=require(\"path\");const b=fs.readFileSync(\"BUNDLE.txt\",\"utf8\");\n// for(const s of b.split(\"\\n=====FILE \").slice(1)){const i=s.indexOf(\" =====\\n\");\n// const f=s.slice(0,i),c=s.slice(i+7);fs.mkdirSync(p.dirname(f),{recursive:true});\n// fs.writeFileSync(f,c.replace(/\\n$/,\"\"))}'\n//\n// Usage: node scripts/bundle.mjs [--out handover/SOURCE-BUNDLE.txt]\nimport { readFileSync, writeFileSync, readdirSync, statSync } from \"node:fs\";\nimport { createHash } from \"node:crypto\";\nimport { join, dirname, resolve, relative } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\n\nconst ROOT = resolve(dirname(fileURLToPath(import.meta.url)), \"..\");\n\n// ENGINE/ IS IN THE BUNDLE SINCE 14 AUG 2026, AND THIS IS THE REASON.\n//\n// It used to be deliberately absent, on the reasoning that the val holds it and scripts/deploy.mjs\n// verifies it file by file. That was true of every engine file except one. engine/watch.ts, the\n// early warning monitor, was written on 12 August and never deployed, because it is a module the\n// val does not run: scripts/watch-run.mjs imports it locally. So it was on no val and in no bundle.\n// A container reclaim then destroyed the only copy of ~990 lines, and it had to be rebuilt from its\n// own test suite. Nothing anywhere noticed the gap, because \"the val holds the engine\" was an\n// assumption stated in a comment rather than a thing anything checked.\n//\n// WHY THIS FIX RATHER THAN THE OTHER ONE. The alternative was to keep engine/ out and have this\n// script list the val and refuse to write while any source file is in neither place. That is a\n// better-sounding fix and a worse one:\n// * It makes taking a backup depend on the network and on a live credential, at exactly the\n// moment those are least likely to be available. A backup tool that refuses to run is worse\n// than one that carries some redundancy.\n// * It can only ever be true at the moment of writing. A file deleted from the val tomorrow is\n// in neither place from tomorrow, and today's bundle, written under a green check, still would\n// not carry it.\n// * Two homes that are actually independent is the whole point. The val is one system, with one\n// owner and one account, and \"it is also on the val\" is not a second home when the val is the\n// first one.\n// The cost of carrying engine/ is bundle parts, which is a number. The cost of not carrying it has\n// now been paid once, in a day of rebuilding.\n//\n// .md as well as .ts, because scripts/deploy.mjs deploys both from engine/ and compares hashes on\n// both, so a restore that drops NOTES-v1.4.md comes back reporting drift against the val.\nconst INCLUDE = [\n { dir: \"engine\", match: /\\.(ts|md)$/ },\n { dir: \"tests\", match: /\\.(mjs|ts|json)$/ }, // .json since 9 Aug: tests/fixtures/ is source, not pulled data\n { dir: \"scripts\", match: /\\.(mjs|py)$/ },\n // The watchdog is a SEPARATE val, so scripts/deploy.mjs --check does not cover it and a reclaim\n // leaves no local copy. Its own val is a real second home, but the bundle should hold everything\n // that is not in the main val, and until now it quietly did not.\n { dir: \"watchdog\", match: /\\.ts$/ },\n];\nconst EXTRA = [\n // THE RESUME FILE FIRST. It is the only thing that stops the next session starting from scratch,\n // and on 7 August it would have been the single most valuable file to have had in the bundle.\n // AWAITING-AMIR is the ONLY channel for anything needing his approval, and it used to live only\n // in /mnt/user-data/outputs, which does not survive a container reclaim. A pending draft to the\n // client is not a derived artifact; losing it loses the work. Bundled since 9 Aug.\n \"handover/AWAITING-AMIR.md\",\n // HANDOFF.md IS AT THE REPO ROOT AND NOWHERE ELSE. On 9 Aug it briefly existed twice, at the root\n // and in handover/, and the bundle carried the handover/ one. A cold read caught it: the backup\n // held a THREE COMMIT OLD handoff whose §13 told the next session to fetch 13 of the 14 parts.\n // A backup of a stale copy of the recovery instructions is the worst possible failure here.\n // The guard below refuses to write a bundle while a second copy exists.\n \"HANDOFF.md\",\n // QUEUE.md is what §1 tells a new session to open after HANDOFF. It was not in the bundle, so a\n // reclaim destroyed the one file the handoff points at. MINED-*.md are the only receipts behind\n // the commercials in §3, including the Upwork contract number. money-page.html is the SOURCE of\n // Monday's client deliverable, and \"put the generator in the repo\" is useless when the repo is\n // not the durable thing. All four bundled since 9 Aug.\n \"QUEUE.md\",\n \"MINED-OLD-TREES.md\",\n \"MINED-HANDOVER.md\",\n \"reports/money-page.html\",\n \"reports/square-revenue-explainer.html\",\n \"reports/money-and-marketing.html\",\n \"BOARD-10-AUG.md\",\n \"BOARD-11-AUG.md\",\n \"AMIR-DO-THIS.md\",\n \"handover/KIM-MESSAGE-10-AUG-FINAL.txt\",\n \"BUILD-PLAN-10-AGENTS.md\",\n \"handover/bridge-main-v3.10.ts\",\n \"handover/KRISTIAN-EMAIL-DRAFT.txt\",\n \"handover/TEAM-EMAIL-DRAFT.txt\",\n \"scripts/exception-report.mjs\",\n \"LESSONS.md\",\n \"handover/RESUME.md\",\n \"handover/REGISTER-AUG7.md\",\n \"handover/SWEEP-7-AUG.md\",\n \"handover/AUTOPILOT.md\",\n \"handover/DRAFTS-WHILE-AWAY.md\",\n \"handover/MESSAGE-TO-KIM-7-AUG.txt\",\n \"reports/Friday-Report-7-Aug-2026.html\",\n \"handover/PLAN-TO-FINISH.md\",\n \"handover/SEND-TO-KIM.txt\",\n \"handover/REPLY-AUG5.txt\",\n \"handover/REGISTER-AUG5.md\",\n \"handover/AMIR_TODO.md\",\n \"handover/NURTURE-REVIEW-FOR-KIM.md\",\n \"handover/DEPOSIT-SPEC.md\",\n];\n// NOT INCLUDED, on purpose: the PDFs and the spreadsheet. They are DERIVED, and backing up a\n// derived artifact backs up the wrong thing. What has to survive is the recipe, and after the\n// 5 August reclaim it turned out the recipe did not — scripts/make_pdf.py reads an input shape it\n// never documented. scripts/make-pdfs.mjs is that missing step, and it is in the bundle.\n\nconst arg = (f, d) => { const i = process.argv.indexOf(f); return i > -1 && process.argv[i + 1] ? process.argv[i + 1] : d; };\nconst sha = (s) => createHash(\"sha256\").update(s).digest(\"hex\");\n\n// RECURSIVE since 9 Aug 2026. This used to read one level only, so tests/fixtures/ was skipped in\n// silence: the fixture the money suite reads was never in the bundle, and a tree restored after the\n// container loss that evening came back RED for a file the bundle had quietly declined to carry.\n// A backup that drops a directory without saying so is worse than one that fails loudly.\nconst files = [];\nconst walk = (abs, match, out) => {\n for (const f of readdirSync(abs).sort()) {\n const p = join(abs, f);\n if (statSync(p).isDirectory()) walk(p, match, out);\n else if (match.test(f)) out.push(relative(ROOT, p));\n }\n};\nfor (const { dir, match } of INCLUDE) walk(join(ROOT, dir), match, files);\nfor (const f of EXTRA) { try { statSync(join(ROOT, f)); files.push(f); } catch { /* not fatal */ } }\n\nif (!files.length) { console.log(\"BUNDLE FAILED: nothing to bundle. A bundle of nothing is worse than none.\"); process.exit(1); }\n\n// ONE HANDOFF, AT THE ROOT. See the note in EXTRA. Two copies means the bundle silently backs up\n// whichever one this list happens to name, and the other is the one being read and edited.\ntry {\n statSync(join(ROOT, \"handover/HANDOFF.md\"));\n console.log(\"BUNDLE FAILED: handover/HANDOFF.md exists. There must be exactly ONE handoff, at the repo root.\");\n console.log(\"On 9 Aug the duplicate meant the backup held a stale handoff that told the next session to fetch 13 of 14 parts.\");\n process.exit(1);\n} catch (e) { if (e?.code !== \"ENOENT\") throw e; }\n// And the thing that must never silently drop out again.\nif (!files.includes(\"HANDOFF.md\")) { console.log(\"BUNDLE FAILED: HANDOFF.md is not in the bundle.\"); process.exit(1); }\n\n// ---------------------------------------------------------------------------------------------\n// NO SOURCE FILE MAY EXIST IN NEITHER PLACE.\n//\n// Adding engine/ to INCLUDE above fixes the file that was lost. It does not fix the SHAPE of the\n// mistake, which was a hand-maintained list of directories and an assumption about where the rest\n// lived. The next directory somebody adds falls outside that list in exactly the same silence.\n//\n// So the bundle is checked against the TREE rather than against the val: every file of source code\n// under this repo has to be in the bundle, or nothing is written. Compared against the tree rather\n// than the val because the tree is here, needs no token, and cannot go stale between the check and\n// the write.\n//\n// Derived output is excluded by name and for a stated reason, never by pattern, so that excluding\n// something stays a deliberate act with an argument attached.\n// ---------------------------------------------------------------------------------------------\n// .json is in here because tests/fixtures/ is source: the money suite reads a fixture it cannot\n// run without, and that fixture is exactly what a one-level directory walk dropped in silence on\n// 9 Aug (LESSONS #1). A sweep that only knows about code would not notice it going again.\nconst CODE = /\\.(ts|mjs|cjs|py|json)$/;\nconst DERIVED = new Map([\n [\"build\", \"transpiled from engine/ by scripts/build.mjs; restoring it would restore stale copies\"],\n [\"node_modules\", \"not ours, and reinstallable\"],\n [\"logs\", \"test-run OUTPUT, written by tests/harness.mjs on every run. Nothing reads it back, and\\n a stale copy restored into a fresh tree would read as a result that was never produced.\"],\n [\"reports\", \"output this project WRITES: the monitor's workings and the generated client pages. \" +\n \"The three html files in there that are sources rather than output are named in EXTRA above.\"],\n]);\nconst sweep = [];\nconst walkAll = (abs) => {\n for (const f of readdirSync(abs).sort()) {\n if (f.startsWith(\".\")) continue;\n const p = join(abs, f);\n if (statSync(p).isDirectory()) { if (!DERIVED.has(f)) walkAll(p); continue; }\n if (CODE.test(f)) sweep.push(relative(ROOT, p));\n }\n};\nwalkAll(ROOT);\n// A SWEEP THAT SWEPT NOTHING IS NOT A CHECK (LESSONS #2). This has to be able to fail loudly if\n// the walk is ever pointed somewhere empty, or it becomes another green that means nothing.\nif (!sweep.length) {\n console.log(\"BUNDLE FAILED: the source sweep found ZERO source files. A check that checks nothing is not a check.\");\n process.exit(1);\n}\n{\n const inBundle = new Set(files);\n const homeless = sweep.filter((f) => !inBundle.has(f));\n if (homeless.length) {\n console.log(`BUNDLE FAILED: ${homeless.length} source file(s) would exist in NEITHER place.`);\n console.log(\"Each of these is code in this repo that the bundle does not carry. That is how engine/watch.ts was\");\n console.log(\"lost on 12 Aug 2026: one file, in one container, backed up by nothing. Add the directory to INCLUDE\");\n console.log(\"or the file to EXTRA, or add it to DERIVED with a reason. Do not delete this check.\");\n for (const f of homeless) console.log(` ${f}`);\n process.exit(1);\n }\n console.log(`source sweep: ${sweep.length} source files in the tree, all ${files.length} bundle entries account for them` +\n ` (excluded by name: ${[...DERIVED.keys()].join(\", \")})`);\n}\n\nconst MAX_PART = 78_000;\n// A SINGLE FILE CAN NOW EXCEED A WHOLE PART. negative-controls.mjs passed 80,000 characters on\n// 6 August — the val's own per-file ceiling — and the packer, which only ever splits BETWEEN\n// files, produced a part the val refused. A backup that cannot be written is not a backup, and\n// this is the file the whole disaster-recovery story rests on. Oversized files are cut into\n// numbered CHUNK records and rejoined on restore, in order.\nconst CHUNK = 60_000;\n\n// A file bigger than CHUNK becomes several records named \"#1\", \"#2\", ... which the\n// restore rejoins in order. Everything else is unchanged, so old parts and new parts read the same.\nconst records = [];\nconst manifest = [];\nfor (const f of files) {\n const content = readFileSync(join(ROOT, f), \"utf8\");\n manifest.push(` ${f.padEnd(38)} ${String(content.length).padStart(7)} bytes ${sha(content).slice(0, 12)}`);\n if (content.length <= CHUNK) { records.push({ name: f, body: content }); continue; }\n const n = Math.ceil(content.length / CHUNK);\n for (let i = 0; i < n; i++) records.push({ name: `${f}#${i + 1}`, body: content.slice(i * CHUNK, (i + 1) * CHUNK) });\n console.log(` (${f} is ${content.length.toLocaleString()} chars, split across ${n} records)`);\n}\nconst parts = records.map((r) => `\\n=====FILE ${r.name} =====\\n${r.body}`);\nconst recNames = records.map((r) => r.name);\n\n// val.town caps EVERY file at 80,000 characters, not just main.ts. So the bundle ships in parts,\n// split at FILE boundaries: each part is a complete, independently restorable bundle of whole\n// files. Nothing has to be concatenated in the right order, and losing one part costs you the\n// files in that part rather than the whole archive.\n\n\nconst header = (partNo, partCount, partFiles) => [\n \"THE DOGS SPOT — SOURCE BUNDLE\" + (partCount > 1 ? ` (part ${partNo} of ${partCount})` : \"\"),\n \"\",\n \"EVERY source file in this project, engine/ included. Restoring these parts and nothing else gives\",\n \"you a tree that builds, typechecks and runs its own test suite with no network and no val.\",\n \"\",\n \"engine/ is here as of 14 Aug 2026. It used to be left out because val 1bfa6e81-74e1-4c6c-ab32-118304a4ffff\",\n \"holds it, which was true of every engine file except engine/watch.ts: a module the val does not run,\",\n \"so it was never deployed, so it lived in one container and nothing else. A reclaim destroyed it.\",\n \"scripts/deploy.mjs --check still compares engine/ against the val file by file; that is a second\",\n \"check on the same files now, not the only copy of them.\",\n \"\",\n \"RESTORE (needs only node, from an empty folder). Save each part, then run this ON EACH ONE:\",\n \"\",\n ` node -e 'const fs=require(\"fs\"),p=require(\"path\");const b=fs.readFileSync(process.argv[1],\"utf8\");`,\n ` for(const s of b.split(\"\\\\n=====FILE \").slice(1)){const i=s.indexOf(\" =====\\\\n\");`,\n ` const f=s.slice(0,i),c=s.slice(i+7);fs.mkdirSync(p.dirname(f),{recursive:true});`,\n ` fs.writeFileSync(f,c.replace(/\\\\n$/,\"\"))}' PART.txt`,\n \"\",\n \"A record named #1, #2, ... is one FILE cut into pieces: concatenate them in order, then\",\n \"strip one trailing newline from the last. scripts/restore.mjs does this for you.\",\n \"\",\n \"Each part is complete in itself: whole files only, no reassembly, any order.\",\n \"\",\n \"Then: node scripts/build.mjs (engine/ came out of these parts; nothing to fetch first)\",\n \" node scripts/typecheck.mjs\",\n \" node tests/run-all.mjs\",\n \" node scripts/deploy.mjs --check (pulls nothing, proves the val matches what you restored)\",\n \" node tests/negative-controls.mjs (proves the suite above can actually fail)\",\n \"\",\n `IN THIS PART (${partFiles.length} of ${files.length} files)`,\n ...partFiles.map((f) => manifest[files.indexOf(f)]),\n \"\",\n \"=\".repeat(96),\n].join(\"\\n\");\n\n// Pack files into parts, largest-first, each part under the cap.\nconst sizeOf = (i) => parts[i].length;\nconst packs = [];\nlet cur = [];\nlet curLen = 2000; // rough header allowance\nrecNames.forEach((f, i) => {\n if (cur.length && curLen + sizeOf(i) > MAX_PART) { packs.push(cur); cur = []; curLen = 2000; }\n cur.push(i); curLen += sizeOf(i);\n});\nif (cur.length) packs.push(cur);\n\nconst outBase = arg(\"--out\", join(ROOT, \"handover/SOURCE-BUNDLE\")).replace(/\\.txt$/, \"\");\nconst written = [];\npacks.forEach((idxs, n) => {\n const partFiles = idxs.map((i) => recNames[i]);\n const body = header(n + 1, packs.length, partFiles) + idxs.map((i) => parts[i]).join(\"\\n\") + \"\\n\";\n const out = packs.length === 1 ? `${outBase}.txt` : `${outBase}.part${n + 1}.txt`;\n writeFileSync(out, body);\n written.push({ out, body, partFiles });\n console.log(`${out} ${body.length.toLocaleString()} chars ${partFiles.length} files`);\n});\n\n// Prove the bundle round-trips before claiming it is a backup. A backup that has never been\n// restored is a hope, not a backup.\nconst roundTrip = new Map();\nfor (const { body } of written) {\n for (const s of body.split(\"\\n=====FILE \").slice(1)) {\n const i = s.indexOf(\" =====\\n\");\n const name = s.slice(0, i);\n const chunk = s.slice(i + 7);\n const m = /^(.*)#(\\d+)$/.exec(name);\n // ONE trailing newline comes from the join between records, whatever the chunk itself ends\n // with, so stripping exactly one recovers the chunk byte-for-byte.\n if (m) roundTrip.set(m[1], (roundTrip.get(m[1]) ?? \"\") + chunk.replace(/\\n$/, \"\"));\n else roundTrip.set(name, chunk.replace(/\\n$/, \"\"));\n }\n}\nconst broken = [];\nfor (const f of files) {\n const original = readFileSync(join(ROOT, f), \"utf8\");\n const restored = roundTrip.get(f);\n if (restored == null) broken.push(`${f}: missing from every part`);\n else if (sha(restored) !== sha(original)) broken.push(`${f}: does not round-trip (${sha(original).slice(0, 8)} -> ${sha(restored).slice(0, 8)})`);\n}\nconst over = written.filter((w) => w.body.length > 80_000).map((w) => w.out);\nif (over.length) { console.log(`\\nOVER THE 80,000 CHARACTER VAL LIMIT: ${over.join(\", \")}`); process.exit(1); }\nif (broken.length) { console.log(\"\\nROUND-TRIP FAILED, this is not a backup:\\n\" + broken.join(\"\\n\")); process.exit(1); }\nconsole.log(`round-trip verified: all ${files.length} files restore byte-for-byte across ${packs.length} part(s)`);\n\n\n\n=====FILE scripts/call-sheet.py =====\nimport sys\nfrom reportlab.lib.pagesizes import A4\nfrom reportlab.lib.styles import getSampleStyleSheet, ParagraphStyle\nfrom reportlab.lib.units import mm\nfrom reportlab.lib import colors\nfrom reportlab.platypus import SimpleDocTemplate, Paragraph, Spacer, HRFlowable, Table, TableStyle, KeepTogether\n\nOUT = \"/mnt/user-data/outputs/CALL-SHEET-9-Aug-8pm.pdf\"\nss = getSampleStyleSheet()\nINK = colors.HexColor(\"#14171a\")\nMUT = colors.HexColor(\"#5b6570\")\nACC = colors.HexColor(\"#1c5d99\")\nWARN = colors.HexColor(\"#b45309\")\n\nH = ParagraphStyle(\"H\", parent=ss[\"Normal\"], fontName=\"Helvetica-Bold\", fontSize=17, leading=20, textColor=INK, spaceAfter=2)\nSUB = ParagraphStyle(\"SUB\", parent=ss[\"Normal\"], fontName=\"Helvetica\", fontSize=9.5, leading=13, textColor=MUT, spaceAfter=8)\nS = ParagraphStyle(\"S\", parent=ss[\"Normal\"], fontName=\"Helvetica-Bold\", fontSize=11, leading=14, textColor=ACC, spaceBefore=10, spaceAfter=4)\nB = ParagraphStyle(\"B\", parent=ss[\"Normal\"], fontName=\"Helvetica\", fontSize=9.4, leading=12.6, textColor=INK, spaceAfter=3)\nLI = ParagraphStyle(\"LI\", parent=B, leftIndent=10, bulletIndent=1, spaceAfter=2.5)\nNOTE = ParagraphStyle(\"NOTE\", parent=B, fontName=\"Helvetica-Oblique\", textColor=MUT)\nBIG = ParagraphStyle(\"BIG\", parent=ss[\"Normal\"], fontName=\"Helvetica-Bold\", fontSize=10.5, leading=13.5, textColor=INK, spaceAfter=3)\n\nst = []\n\n\ndef sec(t):\n st.append(Paragraph(t, S))\n\n\ndef p(t, style=B):\n st.append(Paragraph(t, style))\n\n\ndef bl(items, style=LI):\n for t in items:\n st.append(Paragraph(\"•\" + t, style))\n\n\nst.append(Paragraph(\"The Dogs Spot APP — acceptance walkthrough\", H))\nst.append(Paragraph(\"Sunday 9 August, 8:00–9:00pm UK (3:00pm Georgia). One hour. \"\n \"meet.google.com/kii-bcbi-ihm · dial in (GB) +44 20 3873 3170 PIN 177 520 765 1562#\", SUB))\n\nrows = [\n [\"Organiser\", \"Kristian Moore, Moore Cre8ive (solutions@moorecre8ive.com) — he built the app\"],\n [\"Also on\", \"Kim Hicks (otchx4@gmail.com) · you (iziguickbooks@gmail.com)\"],\n [\"Your RSVP\", \"Accepted 9 Aug 16:16 UK. Kim's still showed as awaiting at that moment.\"],\n [\"Screen share\", \"No. Kristian demos from his screen. Nothing is asked of yours.\"],\n [\"Talk split\", \"Kristian ~half, Kim ~40%, you ~10%. You are there to observe and ask.\"],\n]\nt = Table(rows, colWidths=[26 * mm, 148 * mm])\nt.setStyle(TableStyle([\n (\"FONT\", (0, 0), (0, -1), \"Helvetica-Bold\", 9),\n (\"FONT\", (1, 0), (1, -1), \"Helvetica\", 9),\n (\"TEXTCOLOR\", (0, 0), (0, -1), MUT),\n (\"TEXTCOLOR\", (1, 0), (1, -1), INK),\n (\"VALIGN\", (0, 0), (-1, -1), \"TOP\"),\n (\"BOTTOMPADDING\", (0, 0), (-1, -1), 3.5),\n (\"TOPPADDING\", (0, 0), (-1, -1), 3.5),\n (\"LINEBELOW\", (0, 0), (-1, -2), 0.4, colors.HexColor(\"#e3e7eb\")),\n]))\nst.append(t)\n\nsec(\"Why this call exists\")\np(\"Kristian has been building The Dog's Spot application since before May. On 21 July he declared development \"\n \"complete and asked Kim to start acceptance. Kim refused to sign anything until she had seen it running live in \"\n \"her own accounts. This hour is that inspection. If it goes well, ownership transfer starts and a 30 day warranty \"\n \"clock begins. If it does not, the failures get written into a punch list and he fixes them first.\")\n\nsec(\"What will actually happen, in order\")\nbl([\n \"Retest of Chloe. Kim caught seven faults on real customer calls last Thursday and demanded they be \"\n \"fixed before today, not demonstrated live. Expect Kristian to walk through each and show it now works.\",\n \"Live walkthrough of the app at app.thedogsspotga.com, the 21 July build, against the signed agreement, \"\n \"his ChangeLog, and the 22 May punch list.\",\n \"Punch list. Anything still wrong gets written down for correction and retest.\",\n \"Handoff talk. Repo, Supabase, Railway, cron access, documentation, operating guides, runbook. This is \"\n \"where your name comes up: you receive Chloe and the GHL side after he signs off.\",\n])\n\nsec(\"The seven Chloe faults being retested (Kim's list, from her 7 Aug email)\")\nbl([\n \"Chloe offered training program calendars to a man asking for day care. Wrong service selection.\",\n \"Every single time she said “we have assigned one of our team members”, no task, text or notification \"\n \"was ever created. Nobody was assigned. She said it on four calls.\",\n \"A first time boarding customer, Monique: drop off booked correctly, then the pickup was created as a Pup \"\n \"Talk, and Chloe told her the stay was confirmed anyway.\",\n \"The first time boarding staff review task was never created.\",\n \"She must not confirm a stay unless both appointments really exist.\",\n \"She must not claim a handoff happened unless it happened.\",\n \"The retry / rollback / staff handoff path in his own document has to be shown actually working.\",\n])\np(\"Not on the list: the 9:30am drop off refusal. That was a four hour minimum notice rule on the calendar. \"\n \"Kim changed it herself to 15 minutes and told Kristian in writing so it would not be confused with his fixes.\", NOTE)\n\nsec(\"What Kristian has already put in writing\")\nbl([\n \"The app is live at app.thedogsspotga.com, 21 July build, migrations and environment variables applied, \"\n \"but still deployed in his accounts, not Kim's. Transfer comes after QA.\",\n \"GoHighLevel owns the booking link, calendars, appointments and automations. The app is the customer portal \"\n \"on top. He will move the permanent booking link at closeout.\",\n \"His July GHL work: Facebook and SMS bots, Chloe's voice configuration and routing, calendar IDs and service \"\n \"mappings, booking / reschedule / cancel / handoff workflows, paired drop off and pickup logic, first time \"\n \"customer approval, contact, opportunity, tag, note and custom field configuration.\",\n \"23 approved calendars. DIY Private Lesson, Pack Walks and Accelerator Weekly are excluded. He states none \"\n \"have been renamed, archived, duplicated or added since reconciliation.\",\n \"The app writes back into GHL: contacts, appointments, opportunities, tags, notes, custom fields, appointment \"\n \"statuses and workflows. Dog profiles, vaccination records, forms, trainer notes and occupancy stay in his app.\",\n \"He asked, in writing, that you observe and change nothing in the application, calendar mappings, \"\n \"workflows or Chloe until QA is documented. Kim agreed. That is the freeze.\",\n])\n\nsec(\"Say these five things. Nothing else is required of you.\")\nbl([\n \"The boundary, out loud. “Reporting, ads, tracking and the nurture messages are mine and carry on. \"\n \"The app, the calendars, the workflows and Chloe I am not touching until your handover is documented.” \"\n \"Saying it makes you the professional in the room rather than the unknown third party.\",\n \"What writes back, and when. His app writes opportunities, tags and custom fields into the same records \"\n \"my tracking reads. Ask for the list and the timing so nothing collides.\",\n \"Does the app touch opportunity value or stage? Kim asked you today whether reporting depends on \"\n \"“Won”. If his app moves stages or writes deal values, that changes the answer. Ask.\",\n \"What exactly do I receive at handoff, and when? Documentation, operating guide, runbook, credential \"\n \"sheet, repo and Supabase and Railway access. Ask for a date.\",\n \"Two calendars. Kim asked Thursday for a Free Training Day pick up calendar and a second Pup Talk \"\n \"calendar for Candice. Creating them is exactly what the freeze forbids. Ask both of them, on the call, \"\n \"whether the freeze covers those two. Then it is answered in front of witnesses.\",\n])\n\nsec(\"Two things worth a quiet question\")\nbl([\n \"A private integration named APP v2, created by Kristian Moore, was last used in Kim's CRM at 4:00pm \"\n \"today. His app is live against her account right now. Not wrong, just worth knowing before he says it is not \"\n \"deployed in her environment.\",\n \"A second integration named Integration, created by Laurice Eclipse, was also used today. \"\n \"Unknown name. Kim's open question about who edited Chloe at 10:30pm on 5 August is still unanswered. \"\n \"“Who else has a token in this account?” is a fair thing to ask.\",\n])\n\nsec(\"If you are asked about your side\")\np(\"Ad tracking is fixed and reading live: $718.98 spent last week, $4.11 a lead, 175 new inquiries. The follow up \"\n \"system is built, tested and running in practice mode, sending to nobody, waiting on Kim to pick a switch on \"\n \"moment. The corrected weekly report goes to her tomorrow. That is the whole of it. You do not need to defend \"\n \"anything tonight.\")\n\nSimpleDocTemplate(OUT, pagesize=A4, leftMargin=18 * mm, rightMargin=18 * mm,\n topMargin=15 * mm, bottomMargin=14 * mm,\n title=\"The Dogs Spot APP acceptance walkthrough, call sheet\").build(st)\nprint(\"wrote\", OUT)\n\n\n",[607],"1e65e845-c781-4ded-b85f-3a4b25349d2e","SOURCE-BUNDLE.part32.txt","895f80c6-97ea-11f1-8f32-1607ee4eb77e",1202,["D",1786982933596],"THE DOGS SPOT — SOURCE BUNDLE (part 32 of 47)\n\nEVERY source file in this project, engine/ included. Restoring these parts and nothing else gives\nyou a tree that builds, typechecks and runs its own test suite with no network and no val.\n\nengine/ is here as of 14 Aug 2026. It used to be left out because val 1bfa6e81-74e1-4c6c-ab32-118304a4ffff\nholds it, which was true of every engine file except engine/watch.ts: a module the val does not run,\nso it was never deployed, so it lived in one container and nothing else. A reclaim destroyed it.\nscripts/deploy.mjs --check still compares engine/ against the val file by file; that is a second\ncheck on the same files now, not the only copy of them.\n\nRESTORE (needs only node, from an empty folder). Save each part, then run this ON EACH ONE:\n\n node -e 'const fs=require(\"fs\"),p=require(\"path\");const b=fs.readFileSync(process.argv[1],\"utf8\");\n for(const s of b.split(\"\\n=====FILE \").slice(1)){const i=s.indexOf(\" =====\\n\");\n const f=s.slice(0,i),c=s.slice(i+7);fs.mkdirSync(p.dirname(f),{recursive:true});\n fs.writeFileSync(f,c.replace(/\\n$/,\"\"))}' PART.txt\n\nA record named #1, #2, ... is one FILE cut into pieces: concatenate them in order, then\nstrip one trailing newline from the last. scripts/restore.mjs does this for you.\n\nEach part is complete in itself: whole files only, no reassembly, any order.\n\nThen: node scripts/build.mjs (engine/ came out of these parts; nothing to fetch first)\n node scripts/typecheck.mjs\n node tests/run-all.mjs\n node scripts/deploy.mjs --check (pulls nothing, proves the val matches what you restored)\n node tests/negative-controls.mjs (proves the suite above can actually fail)\n\nIN THIS PART (3 of 129 files)\n tests/wiring.test.mjs 38367 bytes b3a409b5e85a\n scripts/blueprint.py 19292 bytes 965b5a5582d8\n scripts/build.mjs 4894 bytes 2adde512c9b9\n\n================================================================================================\n=====FILE tests/wiring.test.mjs =====\n// THE WIRING. v1.0, 14 Aug 2026.\n//\n// WHY THIS FILE EXISTS, stated as the defect rather than as the fix.\n//\n// On 14 August an adversarial pass mutated a copy of this tree and deleted FIVE of the previous\n// night's headline fixes from cron(), one at a time. The suite stayed 25 suites / 563 assertions /\n// 0 failed / GREEN for every one of them:\n//\n// * `noPhone: !contact.phone` deleted from BOTH Facts sites — 0 occurrences of noPhone left in the\n// compiled JS, and the spin that fix exists to stop was back: an SMS step coming due for a\n// phoneless contact, forever, uncapped.\n// * `optOutRequested: reply.optOutRequested` deleted — opt-outs never detected in production.\n// * `await honourOptOut(...)` deleted — the DND write never happens, ever, for anybody.\n// * the `onDeliveryStatus(...)` call deleted — delivery never reconciled, so GHL's \"queued\" goes on\n// being recorded as \"delivered\" at the measured 7.3% undelivered rate.\n//\n// The helpers in reachability.ts are tested thoroughly — 96 assertions across reachability.test.mjs\n// and dead-letter.test.mjs. What was tested by NOTHING was the wiring from cron() into them. Every\n// one of those fixes could have been silently un-shipped by a future refactor and this wall would\n// have stayed green, which is this project's own standing lesson (\"a test that doesn't run in the\n// suite doesn't exist\") in a new form: a helper nothing calls is a test that doesn't run.\n//\n// SO THESE TESTS DRIVE THE REAL EXPORTED cron() — the val.town entry point itself, out of build/ —\n// with the network, the clock and the blob store replaced, and assert on WHAT CAME OUT: which HTTP\n// calls were made, and what was written to the blobs. No test in this file asserts on source text;\n// a structural grep is exactly what the deletions above walked straight past.\n//\n// EACH TEST WAS PROVED TO GO RED. Every call site named above was deleted in a scratch copy of the\n// tree, the copy rebuilt, and this suite run against it. The red proof is in the handover report;\n// the pairing is written next to each test as \"RED IF: ...\".\n//\n// THE THREE FAKES.\n// fetch — a router that records every request. Nothing in this file can reach the real GHL.\n// clock — Date pinned to Tuesday 11 Aug 2026, 10:00 America/New_York. Not decoration: the send\n// window is 09:00-19:00 business-local, so on a real clock \"no SMS was sent\" would pass\n// for the wrong reason every night and every Sunday, which is a test that lies twice a day.\n// blob — cron() does `await import(\"https://esm.town/v/std/blob\")`, which Node cannot resolve at\n// all. A module-resolution hook redirects that one specifier to an in-memory store. This\n// is the reason nobody had integration-tested cron() before; it is about twenty lines.\nimport { register } from \"node:module\";\nimport { readFileSync } from \"node:fs\";\nimport { suite, ok, eq, scoped, codeOnly, liveAssertions } from \"./_harness.mjs\";\n\nconst { at, t, done, header } = suite(\"wiring\");\n\n// ---- fake 1: the blob store, injected by redirecting the esm.town specifier ------------------------\nconst FAKE_BLOB = \"data:text/javascript,\" + encodeURIComponent(`\nconst store = () => (globalThis.__WIRING_BLOB__ ??= new Map());\nexport const blob = {\n getJSON: async (k) => { const s = store(); if (!s.has(k)) throw new Error(\"no such blob: \" + k); return s.get(k); },\n setJSON: async (k, v) => { store().set(k, JSON.parse(JSON.stringify(v))); },\n};\n`);\nregister(\"data:text/javascript,\" + encodeURIComponent(`\nconst FAKE = ${JSON.stringify(FAKE_BLOB)};\nexport async function resolve(spec, ctx, next) {\n if (spec === \"https://esm.town/v/std/blob\") return { url: FAKE, shortCircuit: true };\n return next(spec, ctx);\n}\n`));\n\n// ---- fake 2: the clock -----------------------------------------------------------------------------\nconst RealDate = globalThis.Date;\nconst NOW = RealDate.parse(\"2026-08-11T14:00:00.000Z\"); // Tuesday, 10:00 America/New_York\nclass FixedDate extends RealDate {\n constructor(...a) { if (a.length === 0) super(NOW); else super(...a); }\n static now() { return NOW; }\n}\nconst HOUR = 3600000;\nconst DAY = 24 * HOUR;\nconst ago = (ms) => new RealDate(NOW - ms).toISOString();\n\n// ---- fake 3: fetch ---------------------------------------------------------------------------------\nconst GHL = \"https://services.leadconnectorhq.com\";\nconst reply = (json, status = 200) => ({\n ok: status >= 200 && status < 300,\n status,\n json: async () => json,\n text: async () => JSON.stringify(json),\n});\n\n/** Routes are tried in order; the first match wins, so a test's own routes override the defaults. */\nfunction makeFetch(routes) {\n const calls = [];\n const fn = async (url, init = {}) => {\n const method = String(init.method ?? \"GET\").toUpperCase();\n const u = String(url);\n let body = null;\n try { body = init.body ? JSON.parse(init.body) : null; } catch { body = init.body; }\n const rec = { method, url: u, path: u.split(\"?\")[0].replace(GHL, \"\"), body };\n calls.push(rec);\n for (const r of routes) {\n if (r.method && r.method !== method) continue;\n if (!r.match.test(u)) continue;\n return reply(typeof r.reply === \"function\" ? r.reply(rec) : r.reply);\n }\n return reply({});\n };\n fn.calls = calls;\n fn.of = (method, re) => calls.filter((c) => c.method === method && re.test(c.url));\n return fn;\n}\n\nconst DEFAULT_ROUTES = [\n { method: \"GET\", match: /\\/calendars\\/events/, reply: { events: [] } },\n { method: \"GET\", match: /\\/contacts\\/\\?locationId=/, reply: { contacts: [] } }, // the dry tagging scan\n { method: \"POST\", match: /\\/contacts\\/search$/, reply: { contacts: [], total: 0 } },\n { method: \"GET\", match: /\\/opportunities\\/search/, reply: { opportunities: [] } },\n { method: \"GET\", match: /\\/conversations\\/search/, reply: { conversations: [] } },\n { method: \"GET\", match: /\\/conversations\\/[^/]+\\/messages/, reply: { messages: { messages: [] } } },\n { method: \"POST\", match: /\\/conversations\\/messages$/, reply: { messageId: \"sent-msg-1\" } },\n];\n\n// GHL_TOKEN must be in the environment BEFORE the engine module is evaluated: it reads it once, at\n// module load, into a module-level `let`. So the import is dynamic and happens here, not at the top.\nprocess.env.GHL_TOKEN = \"wiring-test-token\";\nconst E = await import(\"../build/engine.js\");\nconst cron = E.default;\n\n/**\n * One run of the REAL cron(), against the three fakes. Returns everything a test could want to\n * assert on: the run's own output, every HTTP call it made, and every blob it wrote.\n */\nasync function runCron({ state = {}, journal = [], routes = [], mode = \"live\", store } = {}) {\n const blobs = store ?? new Map();\n if (state) blobs.set(\"puppy_state\", state);\n if (journal?.length) blobs.set(\"puppy_journal\", journal);\n globalThis.__WIRING_BLOB__ = blobs;\n process.env.TEST_MODE = mode === \"live\" ? \"false\" : \"true\";\n\n const fetchFake = makeFetch([...routes, ...DEFAULT_ROUTES]);\n const realFetch = globalThis.fetch;\n const realLog = console.log;\n const logs = [];\n globalThis.fetch = fetchFake;\n globalThis.Date = FixedDate;\n console.log = (...a) => logs.push(a.map(String).join(\" \"));\n let out;\n try {\n out = await cron();\n } finally {\n globalThis.fetch = realFetch;\n globalThis.Date = RealDate;\n console.log = realLog;\n }\n return {\n out,\n f: fetchFake,\n store: blobs,\n logs,\n state: blobs.get(\"puppy_state\") ?? {},\n journal: blobs.get(\"puppy_journal\") ?? [],\n summary: blobs.get(\"puppy_summary\") ?? {},\n run: blobs.get(\"puppy_run_state\") ?? {},\n smsSends: fetchFake.calls.filter((c) => c.method === \"POST\" && /\\/conversations\\/messages$/.test(c.url) && c.body?.type === \"SMS\"),\n emailSends: fetchFake.calls.filter((c) => c.method === \"POST\" && /\\/conversations\\/messages$/.test(c.url) && c.body?.type === \"Email\"),\n dndWrites: fetchFake.calls.filter((c) => c.method === \"PUT\" && /\\/contacts\\/[^/]+$/.test(c.url) && c.body?.dndSettings),\n tasks: fetchFake.calls.filter((c) => c.method === \"POST\" && /\\/tasks$/.test(c.url)),\n tags: fetchFake.calls.filter((c) => c.method === \"POST\" && /\\/tags$/.test(c.url)),\n };\n}\n\nconst contactRoute = (c) => ({ method: \"GET\", match: new RegExp(`/contacts/${c.id}$`), reply: { contact: c } });\nconst convoRoute = (contactId, convo) => ({\n method: \"GET\",\n match: new RegExp(`/conversations/search\\\\?.*contactId=${contactId}`),\n reply: { conversations: convo ? [convo] : [] },\n});\nconst messagesRoute = (convoId, messages) => ({\n method: \"GET\",\n match: new RegExp(`/conversations/${convoId}/messages`),\n reply: { messages: { messages } },\n});\n\nconst mainState = (over = {}) => ({ ...E.freshState(ago(3 * HOUR)), status: \"main\", ...over });\nconst SMS_STEP = E.MAIN_SEQUENCE.findIndex((m) => m.channel === \"sms\");\nconst rowsFor = (journal, event) => journal.filter((r) => r.event === event);\n\n// ===================================================================================================\nheader(\"noPhone — THE FULL PASS. A contact with no phone number must cost zero SMS attempts.\");\n\n// RED IF: `noPhone: !contact.phone` is deleted from the Facts literal in the per-contact pass.\n// Without it channelBar cannot see the missing number, the step is sent rather than consumed, and the\n// POST below appears. That POST is the whole spin: sendSms throws, the catch used to write nothing,\n// dueAt never moved, and the same decision came back every tick, uncapped, ~24 times a day forever.\nawait at(\"W-1 an SMS step falling due for a phoneless contact produces NO SMS and consumes the step\", async () => {\n const c = { id: \"c-nophone\", firstName: \"Dana\", email: \"dana@example.com\", phone: null, tags: [], dnd: false };\n const r = await runCron({\n state: { [c.id]: mainState({ enteredAt: ago((E.MAIN_SEQUENCE[SMS_STEP].offsetHours + 1) * HOUR), lastMainStepSent: SMS_STEP }) },\n routes: [contactRoute(c), convoRoute(c.id, null)],\n });\n eq(r.smsSends.length, 0, \"an SMS was POSTed to a contact with no phone number — the spin is back\");\n eq(r.out.sent, 0, \"the run counted a send that could not physically have happened\");\n // and it did not merely defer: the step is CONSUMED, so the sequence carries on for this person\n eq(r.state[c.id].lastMainStepSent, SMS_STEP + 1, \"the step was deferred, not consumed — that is the spin\");\n eq(r.state[c.id].status, \"main\", \"a missing phone number should not end the whole sequence\");\n // v1.13 — a MISSING ADDRESS is journalled as skip_step_no_address, not as an opt-out. The two\n // used to share one event name, so Kim's activity page showed contacts as having opted out when\n // they had simply never given us an address. Dana has no phone; she has opted out of nothing.\n const skipped = rowsFor(r.journal, \"skip_step_no_address\");\n eq(skipped.length, 1, \"nothing was journalled: a message that silently never went out is invisible\");\n eq(rowsFor(r.journal, \"skip_step_channel_optout\").length, 0,\n \"a missing phone number was filed as an opt-out — that misreports the customer's own choice\");\n ok(/no phone number on the record/.test(skipped[0].detail), `wrong reason: ${skipped[0].detail}`);\n return scoped(7, \"assertions\");\n});\n\n// RED IF: the same deletion. With no phone AND no email, rule 1c is what ends them; without noPhone\n// the contact reads as \"email is missing, SMS is fine\" and consumes all 8 steps in silence, then\n// fires the soft_exit_21d task telling Kim the puppy path FINISHED for somebody who received nothing.\nawait at(\"W-2 a contact with neither address ends as done_unreachable, and gets no task\", async () => {\n const c = { id: \"c-none\", firstName: \"Sam\", email: null, phone: null, tags: [], dnd: false };\n const r = await runCron({\n state: { [c.id]: mainState({ enteredAt: ago(2 * HOUR), lastMainStepSent: 0 }) },\n routes: [contactRoute(c), convoRoute(c.id, null)],\n });\n eq(r.state[c.id].status, \"done_unreachable\", \"an uncontactable contact is still walking the sequence\");\n eq(r.state[c.id].exitReason, E.UNREACHABLE_REASON);\n eq(r.smsSends.length + r.emailSends.length, 0, \"a message was sent to a contact with no address of any kind\");\n eq(r.tasks.length, 0, \"bulk-tagging 300 of these would put 265 tasks in Kim's CRM in one run\");\n ok(E.TERMINAL_STATUSES.has(r.state[c.id].status), \"done_unreachable is not terminal, so this repeats forever\");\n return scoped(5, \"assertions\");\n});\n\n// RED IF: `noPhone: !contact.phone` is deleted from the Facts literal in the PAUSED-REPLY pass.\n// That pass is a second, separate Facts site. It pins conversationCheckFailed, so nothing it does can\n// ever send — but rule 1c still runs on it, and it is the only thing that ends an uncontactable\n// paused contact instead of leaving them parked until the 14-day timeout.\nawait at(\"W-3 the paused pass has its own Facts site, and it sees the missing phone too\", async () => {\n const c = { id: \"c-paused-none\", firstName: \"Ada\", email: null, phone: null, tags: [], dnd: false };\n const r = await runCron({\n state: { [c.id]: mainState({ status: \"paused_reply\", pausedForReplyAt: ago(2 * DAY), lastMainStepSent: 2 }) },\n routes: [contactRoute(c), convoRoute(c.id, null)],\n });\n eq(r.state[c.id].status, \"done_unreachable\", \"the paused pass cannot see a missing phone number\");\n eq(r.smsSends.length, 0);\n return scoped(2, \"assertions\");\n});\n\n// ===================================================================================================\nheader(\"optOutRequested + honourOptOut — an UNSUBSCRIBE reply must reach the CRM as a DND write\");\n\n// RED IF EITHER: `optOutRequested: reply.optOutRequested` deleted (the contact routes to pause_reply\n// instead — paused, a task raised, no opt-out recorded, and sending RESUMES once a human answers), or\n// `await honourOptOut(...)` deleted (the hard exit still happens, but nothing is ever written to GHL,\n// so Chloe, Ava and the 165 workflows go on messaging somebody who asked us all to stop).\n// The two assertions are deliberately independent so the pair cannot both be satisfied by one of them.\nawait at(\"W-4 an inbound UNSUBSCRIBE hard-exits AND writes Email DND permanent to the live CRM\", async () => {\n const c = { id: \"c-optout\", firstName: \"Priya\", email: \"p@example.com\", phone: \"+15551234567\", tags: [], dnd: false };\n const r = await runCron({\n state: { [c.id]: mainState({ enteredAt: ago(2 * HOUR), lastMainStepSent: 0 }) },\n routes: [\n contactRoute(c),\n convoRoute(c.id, { id: \"cv-optout\", lastMessageDirection: \"inbound\", lastMessageDate: ago(HOUR), unreadCount: 1 }),\n messagesRoute(\"cv-optout\", [{ id: \"m1\", direction: \"inbound\", body: \"UNSUBSCRIBE\" }]),\n ],\n });\n eq(r.state[c.id].status, \"done_hard_exit\", \"the opt-out was swallowed by pause_reply, which resumes sending later\");\n eq(r.state[c.id].exitReason, E.OPTOUT_REASON);\n eq(r.dndWrites.length, 1, \"no DND was written to GHL: every email footer's promise is unkept\");\n eq(r.dndWrites[0].body.dndSettings.Email.status, \"permanent\", \"the write is not the field consent.ts reads\");\n ok(/c-optout$/.test(r.dndWrites[0].url), `the DND was written to the wrong contact: ${r.dndWrites[0].url}`);\n eq(r.smsSends.length + r.emailSends.length, 0, \"a message went out on the same pass as the opt-out\");\n eq(rowsFor(r.journal, \"hard_exit\").length, 1, \"the exit is not on Kim's activity log at all\");\n return scoped(7, \"assertions\");\n});\n\n// The same wiring, from the state a replying customer is ACTUALLY in. A customer replies with a\n// question -> paused_reply -> nobody answers -> the customer replies STOP. Before this, the paused\n// pass pinned conversationCheckFailed and never set optOutRequested, so that STOP was never seen:\n// no DND write, and 14 days later they were released as done_hard_exit for the wrong reason.\nawait at(\"W-5 a PAUSED contact's later STOP is detected, exits for the right reason, and writes DND\", async () => {\n const c = { id: \"c-paused-stop\", firstName: \"Ben\", email: \"b@example.com\", phone: \"+15550000000\", tags: [], dnd: false };\n const r = await runCron({\n state: { [c.id]: mainState({ status: \"paused_reply\", pausedForReplyAt: ago(2 * DAY), lastMainStepSent: 3 }) },\n routes: [\n contactRoute(c),\n convoRoute(c.id, { id: \"cv-ps\", lastMessageDirection: \"inbound\", lastMessageDate: ago(HOUR), unreadCount: 1 }),\n messagesRoute(\"cv-ps\", [{ id: \"m9\", direction: \"inbound\", body: \"STOP\" }]),\n ],\n });\n eq(r.state[c.id].status, \"done_hard_exit\");\n eq(r.state[c.id].exitReason, E.OPTOUT_REASON, \"released for the wrong reason: 'paused with no human response'\");\n eq(r.dndWrites.length, 1, \"the paused pass detected the STOP but never honoured it\");\n eq(r.dndWrites[0].body.dndSettings.Email.status, \"permanent\");\n return scoped(4, \"assertions\");\n});\n\n// ===================================================================================================\nheader(\"onDeliveryStatus — a 2xx from GHL means QUEUED, and 7.3% of this account's SMS never land\");\n\n// RED IF: the `onDeliveryStatus(...)` call is deleted from the per-contact pass. Note what is asserted\n// and what is not: the READ still happens without it (it rides on convoExtras inside getReplyStatus),\n// so asserting only \"the read happened\" would stay green through the deletion. The assertions that\n// matter are the EFFECTS — the counter moved, the row was journalled, the pass stopped.\nawait at(\"W-6 a message that came back undelivered is reconciled: counted, journalled, and stops the pass\", async () => {\n const c = { id: \"c-undeliv\", firstName: \"Cal\", email: \"c@example.com\", phone: \"+15551112222\", tags: [], dnd: false };\n const r = await runCron({\n state: {\n [c.id]: mainState({\n enteredAt: ago(10 * DAY), lastMainStepSent: 1, lastSentAt: ago(30 * 60000),\n lastMessageId: \"m-old\", lastMessageChannel: \"sms\", sendFailures: 0,\n }),\n },\n routes: [\n contactRoute(c),\n convoRoute(c.id, { id: \"cv-d\", lastMessageDirection: \"outbound\", lastMessageDate: ago(30 * 60000), unreadCount: 0 }),\n messagesRoute(\"cv-d\", [{ id: \"m-old\", direction: \"outbound\", status: \"undelivered\", body: \"hi\" }]),\n ],\n });\n ok(r.f.of(\"GET\", /\\/conversations\\/cv-d\\/messages/).length >= 1, \"the message page was never read back at all\");\n eq(r.state[c.id].lastDeliveryStatus, \"undelivered\", \"GHL's 'queued' is still being recorded as delivered\");\n eq(r.state[c.id].sendFailures, 1, \"an undelivered message did not count against the contact\");\n eq(rowsFor(r.journal, \"delivery_failed\").length, 1, \"the failure is nowhere on Kim's activity log\");\n eq(r.state[c.id].lastMessageId, null, \"the id was not cleared, so the same failure can be counted twice\");\n eq(r.out.failed, 1, \"the run did not count it as a failure\");\n eq(r.smsSends.length, 0, \"the pass carried on and sent anyway, before the backoff could apply\");\n return scoped(7, \"assertions\");\n});\n\n// The other half of the same wiring: a delivery status that CANNOT be read is recorded as the literal\n// \"unknown\" and journalled as unknown. facts.ts:1-12's standing rule — a failed read is never filed\n// as \"fine\". Nothing about a healthy contact may be inferred from a read that did not happen.\nawait at(\"W-7 a delivery status that could not be read is recorded as unknown, not as success\", async () => {\n const c = { id: \"c-unk\", firstName: \"Nia\", email: \"n@example.com\", phone: \"+15553334444\", tags: [], dnd: false };\n const r = await runCron({\n state: {\n [c.id]: mainState({\n enteredAt: ago(10 * DAY), lastMainStepSent: 1, lastSentAt: ago(30 * 60000),\n lastMessageId: \"m-gone\", lastMessageChannel: \"sms\",\n }),\n },\n routes: [\n contactRoute(c),\n convoRoute(c.id, { id: \"cv-u\", lastMessageDirection: \"outbound\", lastMessageDate: ago(30 * 60000), unreadCount: 0 }),\n messagesRoute(\"cv-u\", [{ id: \"somebody-elses-message\", direction: \"outbound\", status: \"delivered\" }]),\n ],\n });\n eq(r.state[c.id].lastDeliveryStatus, \"unknown\", \"another system's delivered status was claimed as ours\");\n eq(r.state[c.id].sendFailures ?? 0, 0, \"an unreadable status was counted as a failure\");\n eq(rowsFor(r.journal, \"delivery_unknown\").length, 1, \"an unreadable status left no trace\");\n return scoped(3, \"assertions\");\n});\n\n// ===================================================================================================\nheader(\"RE-ENROLMENT — a dead letter Kim has fixed and re-tagged must actually come back\");\n\n// The candidate filter was `!tags.includes(TAG_ENROLLED) && !state[c.id]`, and a dead-letter entry\n// sits in state untouched (the loop `continue`s on any terminal status) until pruneState drops it at\n// 60 days. So the CRM task's own instruction — \"remove the puppy-path-v1 tag and re-tag them\" —\n// produced zero candidates. Four contacts, one run: exactly one of them may come back.\nawait at(\"W-8 a fixed and re-tagged dead letter re-enrols; a customer and a hard exit do NOT\", async () => {\n const fixed = { id: \"dl-fixed\", firstName: \"Rosa\", email: null, phone: \"+15559998888\", tags: [\"nurture - puppy\"], dnd: false };\n const stillBroken = { id: \"dl-broken\", firstName: \"Tom\", email: null, phone: null, tags: [\"nurture - puppy\"], dnd: false };\n const customer = { id: \"was-customer\", firstName: \"Lee\", email: \"l@example.com\", phone: \"+15557776666\", tags: [\"nurture - puppy\"], dnd: false };\n const optedOut = { id: \"was-optout\", firstName: \"Kit\", email: \"k@example.com\", phone: \"+15555554444\", tags: [\"nurture - puppy\"], dnd: false };\n const term = (status, extra = {}) => ({ ...E.freshState(ago(20 * DAY)), status, lastCheckedAt: ago(20 * DAY), ...extra });\n const r = await runCron({\n state: {\n [fixed.id]: term(\"done_send_failed\", { sendFailures: 3, exitReason: \"3 consecutive send failures\" }),\n [stillBroken.id]: term(\"done_unreachable\", { exitReason: E.UNREACHABLE_REASON }),\n [customer.id]: term(\"done_customer\", { exitReason: \"became a customer\" }),\n [optedOut.id]: term(\"done_hard_exit\", { exitReason: E.OPTOUT_REASON }),\n },\n routes: [\n { method: \"POST\", match: /\\/contacts\\/search$/, reply: { contacts: [fixed, stillBroken, customer, optedOut], total: 4 } },\n contactRoute(fixed), contactRoute(stillBroken), contactRoute(customer), contactRoute(optedOut),\n convoRoute(fixed.id, null),\n ],\n });\n eq(r.state[fixed.id].status, \"main\", \"Kim fixed the number and re-tagged, and nothing happened\");\n eq(r.state[fixed.id].sendFailures, 0, \"the old failure count came back with them and will dead-letter them early\");\n eq(r.state[fixed.id].lastMessageId ?? null, null, \"a stale message id survived re-enrolment\");\n eq(r.tags.filter((x) => /dl-fixed/.test(x.url)).length, 1, \"re-enrolment did not apply the puppy-path-v1 tag\");\n eq(r.out.enrolled, 1, `${r.out.enrolled} contacts enrolled; exactly one was eligible`);\n // the three that must NOT come back, each for its own reason\n eq(r.state[customer.id].status, \"done_customer\", \"a re-tag resurrected a CUSTOMER into the nurture sequence\");\n eq(r.state[optedOut.id].status, \"done_hard_exit\", \"a re-tag undid an OPT-OUT: the one thing a tag must never do\");\n eq(r.state[stillBroken.id].status, \"done_unreachable\", \"a contact with still no phone and no email was re-admitted\");\n // ...and the still-broken one must not have cost a journal row either, or this is defect 4 again\n eq(rowsFor(r.journal, \"enroll_refused\").filter((x) => x.contactId === stillBroken.id).length, 0,\n \"the unreachable contact was re-refused, which writes an identical journal row on every run forever\");\n return scoped(9, \"assertions\");\n});\n\n// ===================================================================================================\nheader(\"ENROL REFUSALS — 39 of the last 40 rows on Kim's live page are the same sentence\");\n\n// `enroll_refused` wrote a journal row and no state entry, so the same contact was refused on every\n// run forever. At ~24-30 rows a day the 2,000-row journal cap evicts all real history in about two\n// months. TWO RUNS, because one run cannot show a repeat.\nawait at(\"W-9 a refusal is written ONCE, not on every run — terminal by state, transient by journal\", async () => {\n const cust = { id: \"r-cust\", firstName: \"Max\", email: \"m@example.com\", phone: \"+15551110000\", tags: [\"nurture - puppy\"], dnd: false };\n const booked = { id: \"r-booked\", firstName: \"Eve\", email: \"e@example.com\", phone: \"+15552220000\", tags: [\"nurture - puppy\"], dnd: false };\n const routes = [\n { method: \"POST\", match: /\\/contacts\\/search$/, reply: { contacts: [cust, booked], total: 2 } },\n {\n method: \"GET\",\n match: new RegExp(`pipeline_stage_id=${E.STAGE.CUSTOMER}`),\n reply: { opportunities: [{ id: \"o1\", contactId: cust.id, pipelineId: E.MAIN_PIPELINE_ID, pipelineStageId: E.STAGE.CUSTOMER, monetaryValue: 0, status: \"open\" }] },\n },\n {\n method: \"GET\",\n match: /\\/calendars\\/events/,\n reply: { events: [{ id: \"ev1\", contactId: booked.id, startTime: new RealDate(NOW + 2 * DAY).toISOString(), endTime: new RealDate(NOW + 2 * DAY + HOUR).toISOString(), appointmentStatus: \"confirmed\" }] },\n },\n contactRoute(cust), contactRoute(booked),\n ];\n const store = new Map();\n const r1 = await runCron({ state: {}, routes, store });\n eq(rowsFor(r1.journal, \"enroll_refused\").length, 2, \"the two refusals were not recorded at all\");\n eq(r1.out.enrolled, 0, \"a customer or an already-booked lead was enrolled\");\n eq(r1.state[cust.id].status, \"done_not_enrolled\", \"the customer refusal left no state entry, so it repeats every run\");\n // NOT done_customer: api.ts:157 counts done_customer as WON, off the state. Marking somebody who\n // was ALREADY a customer before the path touched them would credit this engine with a sale it had\n // nothing to do with, on the one number the client judges the system by.\n eq(Number(r1.summary.activeByStatus?.done_customer ?? 0), 0, \"an existing customer is being counted as one this engine won\");\n eq(Number(r1.summary.customersDuringPath ?? 0), 0, \"a refusal is being counted as a conversion during the path\");\n eq(r1.state[booked.id] ?? null, null, \"a live booking is TRANSIENT and must not be barred by a state entry\");\n\n const r2 = await runCron({ state: r1.state, routes, store });\n eq(rowsFor(r2.journal, \"enroll_refused\").length, 2, \"the second run wrote the same refusals again — this is the log-eater\");\n eq(r2.out.enrolled, 0);\n // and the transient one is still being RE-EVALUATED, not permanently barred: it is still a candidate\n ok(r2.logs.concat(r2.out.log).join(\"\\n\").includes(\"live booking already exists\"),\n \"the booked contact stopped being re-evaluated, so a cancelled booking would never let them enrol\");\n return scoped(9, \"assertions\");\n});\n\n// ===================================================================================================\nheader(\"THE VERSION KIM READS\");\n\n// api.ts renders `System version ${d.engineVersion}` on her page, and engineVersion is read off the\n// puppy_run_state blob that cron() writes at the end of every run. So the number she reads is whatever\n// out.v says — which is why it sat at 1.7.1 through v1.8, v1.9 and this build.\nawait at(\"W-10 the version Kim's page shows is the one this build actually writes\", async () => {\n const r = await runCron({ state: {}, routes: [] });\n const src = codeOnly(readFileSync(new URL(\"../engine/puppy_path_v1.1.ts\", import.meta.url), \"utf8\"));\n // cron()'s OWN literal, not buildSummary's separate `v: \"1.2\"` schema version further up the file.\n const outLiteral = src.slice(src.indexOf(\"const out: any = {\"), src.indexOf(\"const out: any = {\") + 300);\n const declared = (outLiteral.match(/\\bv:\\s*\"([\\d.]+)\"/) || [])[1];\n ok(declared, \"no version literal found in the engine source at all\");\n eq(r.run.v, declared, \"the run blob does not carry the version the source declares\");\n ok(r.run.v !== \"1.7.1\", \"the version is still 1.7.1, three builds after 1.7.1\");\n // the other half of the wire: api.ts must still read it off that blob rather than typing its own\n const api = codeOnly(readFileSync(new URL(\"../engine/api.ts\", import.meta.url), \"utf8\"));\n ok(/engineVersion:\\s*run\\?\\.v/.test(api), \"Kim's page no longer reads the version from the run blob\");\n return scoped(4, \"assertions\");\n});\n\n// ===================================================================================================\nheader(\"THE RAILS THIS FILE MUST NOT BREAK\");\n\n// A cheap end-to-end sanity check that the harness above is exercising the real engine and not a\n// hollow shell: the happy path must still send, still tag, still journal, still write the summary.\n// Without this, every assertion in this file could be satisfied by a cron() that does nothing at all.\nawait at(\"W-11 the happy path still sends, and the fakes are wired to the real engine\", async () => {\n const c = { id: \"c-happy\", firstName: \"Joy\", email: \"j@example.com\", phone: \"+15556667777\", tags: [], dnd: false };\n const r = await runCron({\n state: { [c.id]: mainState({ enteredAt: ago(2 * HOUR), lastMainStepSent: 0 }) },\n routes: [contactRoute(c), convoRoute(c.id, null)],\n });\n eq(r.out.sent, 1, \"the happy path sends nothing: every 'nothing was sent' assertion above is vacuous\");\n eq(r.emailSends.length, 1, \"main step 1 is an email and it did not go out\");\n ok(/The Dogs Spot/.test(String(r.emailSends[0].body.html)), \"the rendered body is not the real copy\");\n ok(/Reply UNSUBSCRIBE/.test(String(r.emailSends[0].body.html)), \"the CAN-SPAM footer is missing from a live send\");\n eq(r.state[c.id].lastMainStepSent, 1, \"the step was not consumed\");\n eq(r.state[c.id].lastMessageId, \"sent-msg-1\", \"the receipt was discarded, so delivery can never be reconciled\");\n eq(rowsFor(r.journal, \"sent\").length, 1);\n ok(Number(r.summary.totalTracked) >= 1, \"the summary the dashboard reads was not written\");\n return scoped(8, \"assertions\");\n});\n\n// PRACTICE MODE IS STILL PRACTICE MODE. The one guarantee that must survive every change in this\n// file: with TEST_MODE on, the senders refuse anybody except the sanctioned dummy, and no DND is\n// written to a real customer's record.\nawait at(\"W-12 practice mode touches exactly one contact and writes no DND\", async () => {\n const dummy = { id: \"ZZTEST-1\", firstName: \"ZZTEST\", email: \"aizhigitovamir@gmail.com\", phone: \"+10000000000\", tags: [], dnd: false };\n const r = await runCron({\n mode: \"practice\",\n state: {},\n routes: [\n { method: \"POST\", match: /\\/contacts\\/upsert$/, reply: { contact: dummy } },\n contactRoute(dummy),\n convoRoute(dummy.id, { id: \"cv-t\", lastMessageDirection: \"inbound\", lastMessageDate: ago(HOUR), unreadCount: 1 }),\n messagesRoute(\"cv-t\", [{ id: \"mt\", direction: \"inbound\", body: \"unsubscribe\" }]),\n ],\n });\n eq(r.out.testMode, true, \"practice mode did not arm\");\n eq(r.dndWrites.length, 0, \"practice mode wrote a permanent DND into the client's real CRM\");\n eq(Object.keys(r.state).length, 1, \"practice mode touched more than the one sanctioned record\");\n ok(r.state[dummy.id], \"the sanctioned dummy was not the contact it operated on\");\n return scoped(4, \"assertions\");\n});\n\n// ===================================================================================================\nheader(\"THIS SUITE'S OWN FLOOR\");\n\n// WHY A SUITE IS CARRYING ITS OWN RATCHET, which is not where ratchets live in this project.\n//\n// run-all.mjs holds FLOORS and ASSERT_FLOORS for every discovered suite, and this one has an entry\n// in neither: on its first honest run the runner printed `NOT FLOORED (1): wiring.test.mjs`, which\n// is a warning by design, not a red. tests/run-all.mjs is on the explicit do-not-touch list of BOTH\n// agents working this tree tonight — checked with the other one directly rather than assumed — so\n// the entry cannot be added by either of us and has gone upward as an unowned change.\n//\n// Which leaves this file in the exact state it was written to make impossible, one level up: an\n// unfloored suite can be hollowed out to two tests without a single number moving anywhere. The\n// twelve tests above prove that deleting a call site in cron() turns something red. Nothing proved\n// that deleting the tests themselves did.\n//\n// THE PRECEDENT IS THIS PROJECT'S OWN. run-all.mjs on taper-test.ts: \"Fixed on both ends 14 Aug: the\n// suite counts live assertions and reports them, and the floor below is real.\" Both ends. Only one\n// end is available to me, so I am building that one.\n//\n// liveAssertions() is incremented inside ok() and eq() THEMSELVES — _harness.mjs's whole point, and\n// the one count in this project a test author cannot type. Deleting or gutting any test above drops\n// it. This is defeatable in exactly one way, by editing the literal below in the same diff as the\n// deletion, where it sits as a number directly next to the thing it is lying about. That is the same\n// exposure ASSERT_FLOORS itself has, and it is the best a file can do about its own size.\n// ===================================================================================================\nheader(\"THE COPY MUST MATCH WHAT THE ENGINE WILL ACTUALLY DO — the no-email promise\");\n\n// RED IF: `noEmail:` is deleted from the renderStep() call in cron(), or `bodyIfNoEmail` is removed\n// from main-2, or the variant-picking line in renderStep goes.\n//\n// THE DEFECT THIS PINS. main-1 is an email at +0h. A contact with no email address has it CONSUMED,\n// silently — correct for the engine, since an unguarded send 4xxs and retries hourly forever. Two\n// hours later main-2 arrives by text saying \"I'll send a few honest, useful puppy emails over the\n// next few weeks\", to somebody the engine decided at +0h would never get one. It is the FIRST thing\n// they ever hear from Kim, and it is a promise the system has already privately cancelled. Trace of\n// a phone-only contact over 30 days: three texts, zero emails, and no closing message either\n// (main-8 is an email too).\n//\n// It is asserted here rather than in a copy test because reachability.test.mjs R-3 and\n// consent-guard.test.mjs CG-10 both assert, correctly, that a missing email must NOT silence the\n// SMS. Those tests are right and stay. The defect was never the send — it was the words.\nawait at(\"W-14 a contact with no email address is not texted a promise of emails\", async () => {\n const noEmail = { id: \"c-noemail\", firstName: \"Dana\", email: null, phone: \"+19125550143\", tags: [], dnd: false };\n const r = await runCron({\n state: { [noEmail.id]: mainState({ enteredAt: ago((E.MAIN_SEQUENCE[SMS_STEP].offsetHours + 1) * HOUR), lastMainStepSent: SMS_STEP }) },\n routes: [contactRoute(noEmail), convoRoute(noEmail.id, null)],\n });\n eq(r.smsSends.length, 1, \"the welcome text did not go out at all, so this test proves nothing\");\n const text = String(r.smsSends[0].body?.message ?? \"\");\n ok(!/\\be-?mail/i.test(text), `the text promises email to a contact with no email address: ${text}`);\n ok(/by text/i.test(text), `the no-email variant did not render; body was: ${text}`);\n\n // The other half, and the reason this is a variant rather than a rewrite: a contact who CAN\n // receive email must still be told the emails are coming, because for them they are.\n const hasEmail = { id: \"c-hasemail\", firstName: \"Dana\", email: \"dana@example.com\", phone: \"+19125550143\", tags: [], dnd: false };\n const r2 = await runCron({\n state: { [hasEmail.id]: mainState({ enteredAt: ago((E.MAIN_SEQUENCE[SMS_STEP].offsetHours + 1) * HOUR), lastMainStepSent: SMS_STEP }) },\n routes: [contactRoute(hasEmail), convoRoute(hasEmail.id, null)],\n });\n eq(r2.smsSends.length, 1, \"the ordinary path stopped sending the welcome text\");\n ok(/emails/i.test(String(r2.smsSends[0].body?.message ?? \"\")), \"a contact WITH an email stopped being told the emails are coming\");\n return scoped(5, \"assertions\");\n});\n\n// RED IF: the `|| !!facts.channelBlocked?.email` arm is dropped from that same call.\n// Someone who has said no to email gets no emails either, so the promise is equally untrue to them\n// — and this arm is the one a refactor drops first, because the blank-address case is the one\n// everybody remembers.\nawait at(\"W-15 an email opt-out gets the same honest text as a missing address\", async () => {\n const c = {\n id: \"c-emailoptout\", firstName: \"Dana\", email: \"dana@example.com\", phone: \"+19125550143\", tags: [], dnd: false,\n dndSettings: { Email: { status: \"permanent\" } },\n };\n const r = await runCron({\n state: { [c.id]: mainState({ enteredAt: ago((E.MAIN_SEQUENCE[SMS_STEP].offsetHours + 1) * HOUR), lastMainStepSent: SMS_STEP }) },\n routes: [contactRoute(c), convoRoute(c.id, null)],\n });\n eq(r.smsSends.length, 1, \"the text did not go out, so this proves nothing\");\n const text = String(r.smsSends[0].body?.message ?? \"\");\n ok(!/\\be-?mail/i.test(text), `an email opt-out was still promised emails: ${text}`);\n eq(r.emailSends.length, 0, \"an email went to a contact who opted out of email\");\n return scoped(4, \"assertions\");\n});\n\nawait at(\"W-13 this suite still runs every assertion it used to (its own floor, until run-all has one)\", async () => {\n const ran = liveAssertions();\n // 69 since v1.13: W-1 gained an assertion proving a missing address is NOT filed as an opt-out.\n // 77 since the no-email promise fix: W-14 and W-15 added nine between them.\n // RAISING IT when tests are added is the point. LOWERING IT is the move this line exists to make\n // visible: if you are here because assertions were deliberately merged or removed, say so in the\n // commit, and say it next to the number.\n ok(ran >= 77, `only ${ran} assertions ran in this file; the floor is 77. A wiring test that stopped ` +\n `running is a deleted call site nobody will notice — that is the entire premise of this file.`);\n // And the twelve guarantees are still individually registered, not merged into one fat test that\n // happens to clear the count. Read off the file's own source with comments and whole-line string\n // constants stripped, so neither a `[was: ...]` note nor a decoy literal can supply the text.\n const self = codeOnly(readFileSync(new URL(\"./wiring.test.mjs\", import.meta.url), \"utf8\"));\n const registered = (self.match(/await at\\(\"W-\\d+/g) ?? []).length;\n ok(registered >= 15, `only ${registered} W-tests are registered in this file; there were 15`);\n return scoped(2, \"floors\");\n});\n\nawait done();\n\n\n=====FILE scripts/blueprint.py =====\nfrom reportlab.lib.pagesizes import A4\nfrom reportlab.lib.styles import getSampleStyleSheet, ParagraphStyle\nfrom reportlab.lib.units import mm\nfrom reportlab.lib import colors\nfrom reportlab.platypus import (SimpleDocTemplate, Paragraph, Spacer, Table, TableStyle,\n PageBreak, KeepTogether, HRFlowable)\n\nOUT = \"/mnt/user-data/outputs/CALL-BLUEPRINT-9-Aug.pdf\"\nss = getSampleStyleSheet()\nINK = colors.HexColor(\"#14171a\"); MUT = colors.HexColor(\"#5b6570\")\nACC = colors.HexColor(\"#1c5d99\"); RED = colors.HexColor(\"#b3261e\")\nGRN = colors.HexColor(\"#1a6b3c\"); BG = colors.HexColor(\"#f4f6f8\")\n\nH1 = ParagraphStyle(\"H1\", parent=ss[\"Normal\"], fontName=\"Helvetica-Bold\", fontSize=16, leading=19, textColor=INK, spaceAfter=1)\nSUB = ParagraphStyle(\"SUB\", parent=ss[\"Normal\"], fontName=\"Helvetica\", fontSize=9, leading=12, textColor=MUT, spaceAfter=9)\nS = ParagraphStyle(\"S\", parent=ss[\"Normal\"], fontName=\"Helvetica-Bold\", fontSize=11.5, leading=14, textColor=ACC, spaceBefore=11, spaceAfter=4)\nB = ParagraphStyle(\"B\", parent=ss[\"Normal\"], fontName=\"Helvetica\", fontSize=9.2, leading=12.3, textColor=INK, spaceAfter=3)\nLI = ParagraphStyle(\"LI\", parent=B, leftIndent=11, spaceAfter=2.5)\nQ = ParagraphStyle(\"Q\", parent=B, fontName=\"Helvetica-Bold\", textColor=INK, spaceBefore=5, spaceAfter=1)\nA = ParagraphStyle(\"A\", parent=B, leftIndent=11, textColor=colors.HexColor(\"#20303f\"), spaceAfter=1)\nNOTE= ParagraphStyle(\"NOTE\", parent=B, fontName=\"Helvetica-Oblique\", textColor=MUT, leftIndent=11, spaceAfter=4)\n\nst = []\ndef sec(t): st.append(Paragraph(t, S))\ndef p(t, s=B): st.append(Paragraph(t, s))\ndef bl(items, s=LI):\n for t in items: st.append(Paragraph(\"•\" + t, s))\ndef qa(q, a, note=None):\n blk=[Paragraph(q, Q), Paragraph(a, A)]\n if note: blk.append(Paragraph(note, NOTE))\n st.append(KeepTogether(blk))\nCELL = ParagraphStyle(\"CELL\", parent=ss[\"Normal\"], fontName=\"Helvetica\", fontSize=8.6, leading=11.4, textColor=INK)\nKEY = ParagraphStyle(\"KEY\", parent=CELL, fontName=\"Helvetica-Bold\")\ndef box(rows, widths, head=None):\n rows = [[Paragraph(c, KEY if i == 0 else CELL) for i, c in enumerate(r)] for r in rows]\n data = ([head] if head else []) + rows\n t = Table(data, colWidths=widths)\n style=[(\"FONT\",(0,0),(-1,-1),\"Helvetica\",8.6),(\"VALIGN\",(0,0),(-1,-1),\"TOP\"),\n (\"TEXTCOLOR\",(0,0),(-1,-1),INK),(\"BOTTOMPADDING\",(0,0),(-1,-1),4),(\"TOPPADDING\",(0,0),(-1,-1),4),\n (\"LINEBELOW\",(0,0),(-1,-2),0.4,colors.HexColor(\"#dfe4e9\")),\n (\"FONT\",(0,0),(0,-1),\"Helvetica-Bold\",8.6)]\n if head: style += [(\"FONT\",(0,0),(-1,0),\"Helvetica-Bold\",8),(\"TEXTCOLOR\",(0,0),(-1,0),MUT),\n (\"LINEBELOW\",(0,0),(-1,0),0.8,colors.HexColor(\"#b9c2cb\"))]\n t.setStyle(TableStyle(style)); st.append(t)\n\n# ============================ PAGE 1 ============================\np(\"The Dogs Spot: your blueprint for tonight\", H1)\np(\"Sunday 9 August, 20:00 to 21:00 Oxford time (3:00pm for Kim in Georgia). \"\n \"meet.google.com/kii-bcbi-ihm. Dial in (GB) +44 20 3873 3170 PIN 177 520 765 1562#.\", SUB)\n\nsec(\"The whole thing in five sentences\")\np(\"Kim Hicks owns a dog boarding and training business in Savannah, Georgia. She is paying two \"\n \"separate people. Kristian Moore has spent months building her a custom web application \"\n \"plus Chloe, the AI that answers her phone, and he is many months late. You were hired \"\n \"separately for the marketing side: ad tracking, reporting, and the automatic follow up messages. \"\n \"Tonight is Kristian's final exam, where Kim checks whether what he built actually works before \"\n \"she signs it off and takes ownership. You are in the room because you inherit Chloe and the \"\n \"GoHighLevel side the moment he signs off, so you need to see the condition of what is coming \"\n \"to you.\")\n\nsec(\"Why you specifically are on this call\")\np(\"Kim put it in writing to Kristian on 4 August: \\\"I've also engaged another developer, Amir, \"\n \"who is helping me with the ongoing GoHighLevel ecosystem, tracking, reporting, and future \"\n \"automation work. Since his work will need to integrate with the platform you've built, I'd like \"\n \"him to join the acceptance walkthrough.\\\"\")\np(\"And in her Chloe email on 7 August: \\\"Amir is included for visibility because he will be \"\n \"taking Chloe over once Kristian's handoff has been completed.\\\"\")\np(\"So your job tonight is to receive information, not to give it. You are the incoming owner \"\n \"doing a survey on a house before contracts exchange. Nobody expects you to perform.\")\n\nsec(\"The cast\")\nbox([\n [\"Kim Hicks\", \"The client. Pays you both. Sharp, thorough, writes long. Has spent this week \"\n \"documenting Kristian's failures in forensic detail. Not angry at you.\"],\n [\"Kristian Moore\", \"Moore Cre8ive. Built the app and Chloe. Under pressure. Wants sign off and \"\n \"the 30 day warranty clock started. Has asked, politely, that you touch nothing.\"],\n [\"Chloe\", \"Not a person. The AI voice agent that answers Kim's phones and books appointments. \"\n \"Built inside GoHighLevel. Becomes yours after handover.\"],\n [\"Candice\", \"Kim's new staff member, started around 2 August. The second Pup Talk calendar is for her.\"],\n], [26*mm, 148*mm])\n\nsec(\"What has actually happened since the start of August\")\nbox([\n [\"2 Aug\", \"You welcomed Candice. The Bootcamp deposit on the website was corrected from $250 to $500.\"],\n [\"4 Aug\", \"Kim tells Kristian she has hired you, and asks him five hard questions in advance so the \"\n \"walkthrough is not spent explaining. She refuses to accept the app until she has seen it \"\n \"running in her own accounts.\"],\n [\"6 Aug\", \"Kim sends you a very long message: six wording changes to the follow up messages, a \"\n \"request for tag cleanup, questions about deposits, and her answers to your question cards. \"\n \"She says the old puppy workflow has never been used and can be switched off any time.\"],\n [\"7 Aug\", \"The bad day. Four real customers call in and Chloe mishandles all four. Kim writes the \"\n \"whole thing up and sends it to Kristian, copying you, demanding seven fixes before tonight. \"\n \"Kristian replies with a long defence of what is built. They agree a freeze: you observe, \"\n \"you change nothing in the app, calendars, workflows or Chloe.\"],\n [\"7 Aug\", \"You send the Friday report at 11:46pm. One line in it is wrong.\"],\n [\"8 Aug\", \"You catch it yourself at 7:33am and correct it to her: you had read the wrong field, and \"\n \"her Facebook tracking was working all along.\"],\n [\"9 Aug\", \"Today. Facebook ad permission fixed and watched working. Corrected report rebuilt. Kim \"\n \"answers your question cards and says yes to the three that were holding up go live.\"],\n], [16*mm, 158*mm])\n\nst.append(PageBreak())\n\n# ============================ PAGE 2 ============================\np(\"What the hour will look like\", H1)\np(\"Kristian shares his screen. You share nothing. Roughly: Kristian speaks half, Kim forty percent, you ten.\", SUB)\n\nsec(\"The running order\")\nbox([\n [\"0 to 20 min\", \"Chloe retest. Kristian walks through the seven things Kim caught on Friday and \"\n \"shows they are fixed. Kim will be testing him hard. Say nothing here unless asked.\"],\n [\"20 to 40 min\", \"The app walkthrough. app.thedogsspotga.com, the 21 July build. He demonstrates \"\n \"features against the contract and the ChangeLog. This is the part you need to watch \"\n \"closely, because this is what you inherit.\"],\n [\"40 to 50 min\", \"The punch list. Anything still broken gets written down for correction and retest.\"],\n [\"50 to 60 min\", \"Handover talk. Documentation, operating guide, runbook, credentials, GitHub, \"\n \"Supabase, Railway. This is your slot. Ask your questions here.\"],\n], [22*mm, 152*mm])\n\nsec(\"The seven Chloe faults, so you understand what you are watching\")\np(\"All four calls were the same customer, George Fitzgerald, plus one first time boarder, Monique Burnett.\")\nbl([\n \"Chloe offered training program appointments to a man who just wanted his dog looked after for the day.\",\n \"Four separate times she told a caller \\\"we have assigned one of our team members to get back to you\\\" \"\n \"and no task, text or notification was ever created. Nobody was assigned. Nobody knew.\",\n \"Monique's boarding drop off was created correctly, then her pickup was created as a Pup Talk by \"\n \"mistake, and Chloe told her the stay was confirmed anyway.\",\n \"The staff review task that is supposed to fire for a first time boarder never fired.\",\n \"Chloe must not confirm a stay unless both the drop off and the pickup really exist.\",\n \"Chloe must not say a handoff happened unless it happened.\",\n \"The retry and rollback path described in his own document has to be shown working.\",\n])\np(\"Not his fault, and Kim has said so in writing: Chloe refusing a 9:30am change was a four hour minimum \"\n \"notice rule on the calendar. Kim changed it herself to fifteen minutes.\", NOTE)\n\nsec(\"What Kristian has already claimed in writing, so you can spot a change of story\")\nbl([\n \"The app is live, running the 21 July build, but still deployed in his accounts, not Kim's. \"\n \"Transfer happens after QA.\",\n \"GoHighLevel owns the booking link, the calendars, the appointments and the automations. His app is \"\n \"the customer facing portal on top of that.\",\n \"23 approved calendars, and he states none have been renamed, archived, duplicated or added.\",\n \"His app writes into GoHighLevel: contacts, appointments, opportunities, tags, notes, custom fields, \"\n \"appointment statuses and workflows. Underline that one. It is the same data your reporting reads.\",\n \"Chloe is configured directly in GoHighLevel and is separate from his app's code.\",\n])\n\nst.append(PageBreak())\n\n# ============================ PAGE 3 ============================\np(\"What they will ask you, and exactly what to say\", H1)\np(\"Every answer below is true today. You are not memorising a script, you are being handed the facts.\", SUB)\n\nsec(\"From Kristian\")\nqa(\"\\\"Have you made any changes to the account?\\\"\",\n \"\\\"No. Nothing in the application, the calendar mappings, the workflows or Chloe. My side has been \"\n \"reporting, ad tracking and the follow up messages, which sit separately.\\\"\",\n \"True. The freeze has been kept. Nothing you built touches his configuration.\")\nqa(\"\\\"What access do you have?\\\"\",\n \"\\\"Kim set me up with a private integration key so the reporting can read the account. It reads, it \"\n \"does not reconfigure anything.\\\"\")\nqa(\"\\\"What are you planning to change after handover?\\\"\",\n \"\\\"Nothing until your handover is documented and I have read it. After that I will come back to Kim \"\n \"with a plan rather than start changing things.\\\"\")\n\nsec(\"From Kim\")\nqa(\"\\\"Amir, does this affect your tracking?\\\"\",\n \"\\\"It might. What I need to know is what the app writes into the CRM and when, because my reporting \"\n \"reads the same records. That is one of my questions for tonight.\\\"\")\nqa(\"\\\"Amir, can you fix that?\\\"\",\n \"\\\"I can once it is mine. Tonight it is still Kristian's to correct, and I do not want to touch it \"\n \"while you are still testing his work, or neither of you will know what changed.\\\"\",\n \"This is the single most likely trap. Do not take on Chloe work tonight. It is not yours yet and \"\n \"fixing it would wreck the QA baseline she is trying to establish.\")\nqa(\"\\\"When will my things be done?\\\"\",\n \"\\\"Monday: the list that stopped loading, your domain lines, and the corrected numbers. Tuesday: the \"\n \"review workflows and the message overlap. The tag cleanup, the Free Training Day rebuild and your two \"\n \"calendars all sit inside the freeze, so they go the day after it lifts, and that is partly what tonight \"\n \"decides. The Pups Club unsubscribe I can do either way.\\\"\",\n \"Do not promise Wednesday for the tag cleanup or the Free Training Day rebuild. Both are workflow \"\n \"changes and both are frozen. Putting the delay on the freeze rather than on you is also just true.\")\nqa(\"\\\"What about the two calendars I asked for?\\\"\",\n \"\\\"That is a question for both of you. Creating calendars is exactly what the freeze covers, and \"\n \"Kristian has told you no calendars have been added since his reconciliation. Tell me the freeze does \"\n \"not apply to those two and they are built tomorrow.\\\"\",\n \"Getting this answered in front of both of them is one of your five goals. Half an hour of work is \"\n \"sitting behind a yes.\")\n\nsec(\"If you do not know, say one of these. Never bluff.\")\np(\"Not knowing is completely normal for the person who has not built it. Bluffing is the only thing that \"\n \"would actually damage you tonight.\")\nbl([\n \"\\\"I do not want to guess at that. Let me check it properly and come back to you today.\\\"\",\n \"\\\"That is Kristian's side until handover, so I would rather he answered it than me speculating.\\\"\",\n \"\\\"I have not looked at that yet, so I do not have an answer I would stand behind.\\\"\",\n \"\\\"Can you show me what you are seeing?\\\" — buys you a minute and usually answers the question for you.\",\n \"\\\"Let me write that down and come back to you on it.\\\" Then actually write it down.\",\n])\np(\"If a technical question goes over your head entirely: \\\"Say that back to me in terms of what the \"\n \"customer experiences, and I will tell you whether it touches my side.\\\" That is a senior move, not \"\n \"a dodge, and it works every time.\")\n\nst.append(PageBreak())\np(\"Her open list, and what the freeze blocks\", H1)\np(\"If she asks when things will be done, this is the page. Half of it is waiting on tonight.\", SUB)\nbox([\n [\"The list that stopped loading\", \"She screenshotted her contact list dying mid scroll on 6 Aug, and \"\n \"separately said her page shows times but no dates. Never reproduced. The oldest thing outstanding. \"\n \"Not frozen. Monday.\"],\n [\"The four domain lines\", \"Four DNS records for Wix so her follow up emails send from thedogsspotga.com \"\n \"instead of a shared address. They do not exist yet because no sending domain is set up in her CRM. \"\n \"Not frozen. Monday.\"],\n [\"Free Training Day pick up calendar\", \"Her words: 30 minute appointments, bookable from 3:30pm with the \"\n \"last start at 4:30 so everything finishes by 5pm, with the usual appointment workflows. Twenty minutes \"\n \"of work. FROZEN.\"],\n [\"Second Pup Talk calendar\", \"Her words: a copy of the existing one under a different name, so Candice can \"\n \"book a customer straight onto a trainer's Pup Talk and the team can tell at a glance whose call it is. \"\n \"Ten minutes of work. FROZEN.\"],\n [\"Tag cleanup\", \"Remove tags not in use and ones not attached to a real customer. She also asked to track \"\n \"when a tag is applied, which her CRM does not record, so that half needs building. FROZEN.\"],\n [\"Free Training Day workflow\", \"The one that chased four people who had already booked. She built it \"\n \"herself and is open to a rebuild, with her watching. FROZEN.\"],\n [\"Review workflows\", \"Open both and settle whether her customers are being asked for a review twice. \"\n \"Reading only, not frozen. Tuesday.\"],\n [\"Message overlap\", \"Five no sale and tips sequences plus two auto responders. Confirm nothing double \"\n \"fires. Reading only, not frozen. Tuesday.\"],\n [\"Pups Club unsubscribe\", \"Her words: a way for subscription members to unsubscribe themselves. \"\n \"Doable either way.\"],\n [\"The switch on\", \"Fifteen minutes with her watching. Tagging on, new messages on, old workflow off. \"\n \"Waiting only on her picking a moment.\"],\n], [40*mm, 134*mm])\n\nst.append(PageBreak())\n\n# ============================ PAGE 4 ============================\np(\"What you must come away with\", H1)\np(\"If you get these five, the call was a success regardless of how it goes for Kristian.\", SUB)\n\nsec(\"Your five\")\nbox([\n [\"1\", \"Say the boundary out loud. \\\"Reporting, ads, tracking and the follow up messages are mine \"\n \"and carry on. The app, the calendars, the workflows and Chloe I am not touching until your \"\n \"handover is documented.\\\" Say this early. It makes you the professional in the room.\"],\n [\"2\", \"What does the app write into the CRM, and when? He listed contacts, appointments, \"\n \"opportunities, tags, notes and custom fields. Get the timing, so his writes and mine do not \"\n \"overwrite each other.\"],\n [\"3\", \"Does the app set opportunity value or move pipeline stages? Kim asked you today whether \"\n \"reporting depends on things being marked Won. If his app touches values or stages, your answer \"\n \"to her changes. This one is worth more than it sounds.\"],\n [\"4\", \"What exactly do I receive at handover, and on what date? Documentation, operating guide, \"\n \"runbook, credential sheet, GitHub, Supabase, Railway. Ask for a date, not a stage.\"],\n [\"5\", \"Do the two calendars fall under the freeze? Ask both of them together, get one answer.\"],\n], [8*mm, 166*mm])\n\nsec(\"Do not do these\")\nbl([\n \"Do not offer to fix anything of Chloe's tonight. Not yours yet, and it destroys Kim's clean test.\",\n \"Do not pile on about his failures. Kim is doing that thoroughly and it is her job, not yours. \"\n \"You come out of this better by being the calm one. He may also be the person you have to work with \"\n \"for another month.\",\n \"Do not promise a date for anything you have not scoped. \\\"I will come back to you with a date \"\n \"tomorrow\\\" is a complete answer.\",\n \"Do not raise the access key issue on this call. That is between you and Kim, and not in front \"\n \"of an outgoing contractor.\",\n \"Do not discuss money, yours or his.\",\n])\n\nsec(\"Numbers in your pocket, if you are asked how your side is doing\")\nbox([\n [\"Ad spend\", \"$718.98 last week. Facebook $554.98, Google $164.00.\"],\n [\"Cost per lead\", \"$4.11 overall. Best campaign $4.63, worst $10.87.\"],\n [\"New inquiries\", \"175 last week, down 22 on the week before.\"],\n [\"Facebook tracking\", \"Fixed today. The permission was missing since the connection was first built. \"\n \"The page now reads spend live from Meta.\"],\n [\"Follow up system\", \"Built, tested, running in practice mode. Has never messaged a real customer. \"\n \"Fifteen minutes from live once Kim picks a moment.\"],\n [\"The honest gap\", \"Revenue and ROAS do not work yet, because payment amounts never land on the \"\n \"booking record. That is the next build.\"],\n], [30*mm, 144*mm])\n\nsec(\"Last thing\")\np(\"You have been doing this properly. This week you caught your own mistake before the client did and \"\n \"corrected it inside twelve hours, which is more than the other contractor on this call can say about \"\n \"a four month overrun. Turn up, listen, ask your five, and write things down. That is the entire job \"\n \"tonight.\")\n\nSimpleDocTemplate(OUT, pagesize=A4, leftMargin=18*mm, rightMargin=18*mm, topMargin=14*mm,\n bottomMargin=12*mm, title=\"The Dogs Spot, call blueprint, 9 August\").build(st)\nprint(\"wrote\", OUT)\n\n\n\n=====FILE scripts/build.mjs =====\n// THE BUILD. engine/*.ts -> build/*.js, so the .mjs suites can import the same code the val runs.\n//\n// This file exists because the mapping used to live in my head and in shell history. A container\n// reclaim took the shell history with it. Anything a rebuild depends on is written down here.\n//\n// WHY IT TRANSPILES RATHER THAN BUNDLES. val.town runs seventeen separate files that import each\n// other, so at runtime there is exactly ONE copy of each module. A bundle per entry point gives\n// each entry its own private copy of everything below it: fill in a story slot and the engine's\n// copy would change while the story module's copy would not, and a test comparing the two would\n// pass on a system that is actually broken. So: every engine file is transpiled one-to-one, the\n// \".ts\" in each import specifier is rewritten to \".js\", and the friendly names the tests import\n// (build/engine.js, build/taper.js, build/stories.js) are thin re-export aliases onto that graph.\n// [was: `esbuild engine/puppy_path_v1.1.ts --outfile=build/engine.js` typed by hand, per file,\n// with --bundle on some and not others. A clean rebuild from source produced a build/ that\n// could not even be imported. The committed build/ had drifted from the source it came from.]\n//\n// Usage:\n// node scripts/build.mjs # engine/ -> build/\n// node scripts/build.mjs --src A --out B # build a copy of the tree somewhere else\nimport { spawnSync } from \"node:child_process\";\nimport { mkdirSync, existsSync, readdirSync, readFileSync, writeFileSync, rmSync } from \"node:fs\";\nimport { join, dirname, resolve, basename } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\n\nconst ROOT = resolve(dirname(fileURLToPath(import.meta.url)), \"..\");\n\n// Friendly name the tests import -> the engine source file behind it.\nexport const ALIASES = {\n engine: \"puppy_path_v1.1\",\n taper: \"taper-messages\",\n stories: \"kim-stories\",\n messages: \"puppy-messages\",\n};\n// Aliases that also need the source's default export forwarded.\nconst ALIAS_HAS_DEFAULT = new Set([\"engine\"]);\n\nconst arg = (flag, fallback) => {\n const i = process.argv.indexOf(flag);\n return i > -1 && process.argv[i + 1] ? process.argv[i + 1] : fallback;\n};\n\nexport function build({ src = join(ROOT, \"engine\"), out = join(ROOT, \"build\"), quiet = false } = {}) {\n const failures = [];\n if (!existsSync(src)) return [`source folder ${src} does not exist`];\n\n const sources = readdirSync(src).filter((f) => f.endsWith(\".ts\"));\n if (!sources.length) return [`no .ts files in ${src}: a build that builds nothing is not a build`];\n\n mkdirSync(out, { recursive: true });\n // Clear stale artifacts so a deleted source cannot leave a ghost module behind that tests import.\n for (const f of readdirSync(out)) if (f.endsWith(\".js\")) rmSync(join(out, f), { force: true });\n\n // 1. Transpile one-to-one. No bundling: the module graph is the point.\n const r = spawnSync(\"npx\", [\n \"--yes\", \"esbuild\",\n ...sources.map((f) => join(src, f)),\n \"--format=esm\",\n `--outdir=${out}`,\n \"--log-level=warning\",\n ], { encoding: \"utf8\" });\n if (r.status !== 0) return [`esbuild: ${(r.stderr || r.stdout || \"\").trim().slice(0, 800)}`];\n\n // 2. Rewrite import specifiers: \"./foo.ts\" -> \"./foo.js\". esbuild leaves them alone when it is\n // not bundling, and node will not resolve a .ts specifier.\n let rewritten = 0;\n for (const f of readdirSync(out).filter((x) => x.endsWith(\".js\"))) {\n const p = join(out, f);\n const before = readFileSync(p, \"utf8\");\n const after = before.replace(/(from\\s*[\"'])(\\.\\.?\\/[^\"']+?)\\.ts([\"'])/g, \"$1$2.js$3\");\n if (after !== before) { writeFileSync(p, after); rewritten++; }\n }\n\n // 3. Friendly-name aliases. Re-exports, not copies, so there is still one module underneath.\n for (const [alias, source] of Object.entries(ALIASES)) {\n if (!existsSync(join(out, `${source}.js`))) { failures.push(`alias ${alias}: ${source}.js was not built`); continue; }\n const lines = [\n `// Generated by scripts/build.mjs. Re-export, not a copy: one module underneath.`,\n `export * from \"./${source}.js\";`,\n ];\n if (ALIAS_HAS_DEFAULT.has(alias)) lines.push(`export { default } from \"./${source}.js\";`);\n writeFileSync(join(out, `${alias}.js`), lines.join(\"\\n\") + \"\\n\");\n }\n\n if (!quiet) {\n console.log(`transpiled ${sources.length} engine files -> ${out}`);\n console.log(`rewrote .ts import specifiers in ${rewritten} files`);\n console.log(`aliases: ${Object.entries(ALIASES).map(([a, s]) => `${a}.js -> ${s}.js`).join(\", \")}`);\n }\n return failures;\n}\n\nif (import.meta.url === `file://${process.argv[1]}`) {\n const failures = build({ src: arg(\"--src\", join(ROOT, \"engine\")), out: arg(\"--out\", join(ROOT, \"build\")) });\n if (failures.length) { console.log(\"\\nBUILD FAILED:\\n\" + failures.join(\"\\n\")); process.exit(1); }\n console.log(\"\\nbuild ok\");\n}\n\n\n",[615],"324e338f-bb40-46e2-90ca-7d5e9dbcb224","SOURCE-BUNDLE.part31.txt","88f1060a-97ea-11f1-aaa3-1607ee4eb77e",1201,["D",1786982932445],"THE DOGS SPOT — SOURCE BUNDLE (part 31 of 47)\n\nEVERY source file in this project, engine/ included. Restoring these parts and nothing else gives\nyou a tree that builds, typechecks and runs its own test suite with no network and no val.\n\nengine/ is here as of 14 Aug 2026. It used to be left out because val 1bfa6e81-74e1-4c6c-ab32-118304a4ffff\nholds it, which was true of every engine file except engine/watch.ts: a module the val does not run,\nso it was never deployed, so it lived in one container and nothing else. A reclaim destroyed it.\nscripts/deploy.mjs --check still compares engine/ against the val file by file; that is a second\ncheck on the same files now, not the only copy of them.\n\nRESTORE (needs only node, from an empty folder). Save each part, then run this ON EACH ONE:\n\n node -e 'const fs=require(\"fs\"),p=require(\"path\");const b=fs.readFileSync(process.argv[1],\"utf8\");\n for(const s of b.split(\"\\n=====FILE \").slice(1)){const i=s.indexOf(\" =====\\n\");\n const f=s.slice(0,i),c=s.slice(i+7);fs.mkdirSync(p.dirname(f),{recursive:true});\n fs.writeFileSync(f,c.replace(/\\n$/,\"\"))}' PART.txt\n\nA record named #1, #2, ... is one FILE cut into pieces: concatenate them in order, then\nstrip one trailing newline from the last. scripts/restore.mjs does this for you.\n\nEach part is complete in itself: whole files only, no reassembly, any order.\n\nThen: node scripts/build.mjs (engine/ came out of these parts; nothing to fetch first)\n node scripts/typecheck.mjs\n node tests/run-all.mjs\n node scripts/deploy.mjs --check (pulls nothing, proves the val matches what you restored)\n node tests/negative-controls.mjs (proves the suite above can actually fail)\n\nIN THIS PART (1 of 129 files)\n tests/watch.test.mjs 42519 bytes b7e784a35337\n\n================================================================================================\n=====FILE tests/watch.test.mjs =====\n// THE EARLY WARNING MONITOR — does each check actually fire, and does it actually stay quiet.\n//\n// WHY BOTH POLARITIES, EVERY TIME. LESSONS #4: the consent predicate was inverted and survived\n// 394 assertions, because the only test that touched it grepped the source text instead of calling\n// the function. A monitor is the worst possible place to repeat that, because a check that can\n// never fire and a check that fires constantly both end in the same place: the owner stops reading\n// it. So every check below is tested twice, by CALLING it, on data built to make it fire and on\n// data built to make it hold its tongue.\n//\n// THE FEBRUARY FIXTURE (W20 and W40) is the shape of the incident this whole module exists for:\n// bookings carried on arriving at full volume while the dollars recorded against them went to\n// zero, and nothing errored anywhere. If those two tests ever pass on a monitor that reports\n// nothing, the monitor is decorative.\n//\n// tests/negative-controls.mjs breaks each check in turn and demands the named test here go red.\nimport { readFileSync } from \"node:fs\";\nimport * as W from \"../build/watch.js\";\nimport { suite, ok, eq, scoped, codeOnly } from \"./_harness.mjs\";\nconst { t, done, header } = suite(\"watch\");\n\nconst HOUR = 3_600_000;\nconst DAY = 24 * HOUR;\nconst NOW = Date.parse(\"2026-08-12T12:00:00.000Z\");\nconst iso = (ms) => new Date(ms).toISOString();\n\n/**\n * n records arriving every `everyH` hours, the last of them `quietForH` hours before `now`.\n * Deterministic jitter, never Math.random: a fixture that differs between runs is a fixture that\n * cannot be argued about when it fails.\n */\nfunction ticks(n, everyH, quietForH, jitterH = 0, now = NOW) {\n const out = [];\n for (let i = 0; i < n; i++) {\n const back = quietForH + (n - 1 - i) * everyH;\n // The LAST record is exactly where the caller asked for it. Jitter on it would move the very\n // date the silence sentence quotes, and a fixture whose own headline date is approximate\n // cannot be used to assert that the sentence names the right day.\n const jitter = jitterH && i < n - 1 ? ((i * 7919) % 1000) / 1000 * jitterH : 0;\n out.push(iso(now - (back + jitter) * HOUR));\n }\n return out;\n}\n\n/** Timestamps built from an explicit list of gaps, newest last, ending `quietForH` before now. */\nfunction fromGaps(gapsH, quietForH, now = NOW) {\n const out = [iso(now - quietForH * HOUR)];\n let back = quietForH;\n for (const g of gapsH) { back += g; out.unshift(iso(now - back * HOUR)); }\n return out;\n}\n\nconst sev = (fs, s) => fs.filter((f) => f.severity === s);\nconst all = (r) => r.findings;\n\nheader(\"THE MEASUREMENT: a rhythm read off the source itself\");\n\nt(\"W1 rhythmOf refuses to invent a rhythm from too little evidence, and finds one when there is enough\", () => {\n for (let n = 0; n < W.MIN_RECORDS_FOR_RHYTHM; n++) {\n eq(W.rhythmOf(ticks(n, 24, 1)), null, `claimed a rhythm from ${n} records`);\n }\n const r = W.rhythmOf(ticks(W.MIN_RECORDS_FOR_RHYTHM, 24, 1));\n ok(r !== null, \"refused to measure a rhythm it has enough records for\");\n eq(r.records, W.MIN_RECORDS_FOR_RHYTHM);\n eq(Math.round(r.normalGapH), 24, \"did not read a 24 hour cadence off a 24 hour fixture\");\n return scoped(W.MIN_RECORDS_FOR_RHYTHM + 1, \"record counts tried\");\n});\n\nt(\"W2 one long outage in the history does not become the yardstick\", () => {\n // Nineteen daily arrivals with a single 18 day hole in the middle: the exact shape of this\n // account's real January. Read against the MAXIMUM gap, the next outage would need 18 days\n // before anything noticed. The median and the 90th percentile both have to ignore it.\n const daily = ticks(20, 24, 1);\n const withHole = [...daily.slice(0, 10), ...daily.slice(10).map((s) => iso(Date.parse(s) + 18 * DAY))];\n const r = W.rhythmOf(withHole);\n ok(r !== null, \"could not measure the fixture at all\");\n ok(r.longestGapH > 400, `the fixture does not actually contain a long hole: longest gap ${r.longestGapH}h`);\n ok(r.normalGapH < 30, `the median gap was dragged to ${r.normalGapH}h by one hole`);\n ok(r.quietGapH < 200, `the quiet-spell figure was dragged to ${r.quietGapH}h by one hole`);\n ok(r.expectByH < r.longestGapH, \"the threshold is the longest outage, so the next one is invisible until it beats a record\");\n return scoped(withHole.length, \"timestamps measured\");\n});\n\nt(\"W3 a rhythm is measured from recent history, so a source that changes pace re-baselines\", () => {\n const old = ticks(40, 48, 24 + 40 * 2); // used to arrive every two days\n const recent = ticks(20, 2, 1); // now arrives every two hours\n const r = W.rhythmOf([...old, ...recent]);\n ok(r.normalGapH < 6, `still measuring the old pace: ${r.normalGapH}h`);\n eq(r.gapsUsed, W.MAX_GAPS_CONSIDERED, \"did not limit itself to recent history\");\n return scoped(60, \"timestamps measured\");\n});\n\nheader(\"CHECK 1: SILENCE WHERE THERE SHOULD BE NOISE (this is the 19 February check)\");\n\nconst dailySource = (quietForH, name = \"invoices paid in your CRM\") =>\n [{ name, timestamps: ticks(30, 24, quietForH, 6) }];\n\nt(\"W4 FIRES: a source that arrives daily has said nothing for a month\", () => {\n const r = W.silenceFindings(dailySource(30 * 24), NOW);\n eq(r.findings.length, 1, \"a month of silence on a daily source raised nothing\");\n eq(r.findings[0].severity, \"urgent\");\n eq(r.inspected, 30, \"did not report how many records it read\");\n ok(/30 days/.test(r.findings[0].sentence), `the sentence does not carry the size of the gap: ${r.findings[0].sentence}`);\n ok(r.findings[0].numbers.quietForHours >= 30 * 24, \"the numbers behind the sentence disagree with it\");\n ok(r.findings[0].checkFirst.length > 20, \"no first thing to check\");\n return scoped(30, \"timestamps inspected\");\n});\n\nt(\"W5 STAYS QUIET: the same source, on time\", () => {\n const r = W.silenceFindings(dailySource(2), NOW);\n eq(r.findings.length, 0, `a source that arrived two hours ago was reported as silent: ${JSON.stringify(r.findings.map((f) => f.sentence))}`);\n eq(r.inspected, 30, \"a quiet result must still say how much it read\");\n return scoped(30, \"timestamps inspected\");\n});\n\nt(\"W6 STAYS QUIET: a gap that is longer than usual but still inside what this source normally does\", () => {\n // Arrives daily but has an ordinary 3 day quiet spell every so often. At 3.2 days it is well\n // past the median and squarely inside its own habit. Firing here is how a monitor gets ignored.\n const gaps = Array.from({ length: 29 }, (_, i) => (i % 7 === 0 ? 72 : 24));\n const ts = fromGaps(gaps, 3.2 * 24);\n const r = W.silenceFindings([{ name: \"invoices paid in your CRM\", timestamps: ts }], NOW);\n eq(r.findings.length, 0, `fired on an ordinary quiet spell this source has every week: ${JSON.stringify(r.findings.map((f) => f.numbers))}`);\n return scoped(ts.length, \"timestamps inspected\");\n});\n\nt(\"W7 STAYS QUIET overnight on a busy source, which is the false alarm that would kill this report\", () => {\n // New contact records arrive about every 25 minutes during the day and stop overnight. Judged\n // on gaps alone this source is \"silent for twenty times its normal gap\" every single night.\n const ts = [];\n for (let d = 0; d < 6; d++) {\n for (let i = 0; i < 24; i++) ts.push(iso(NOW - (d * 24 + 10 + i * 0.42) * HOUR));\n }\n const r = W.silenceFindings([{ name: \"new people arriving in your CRM\", timestamps: ts }], NOW);\n eq(r.findings.length, 0, \"fired at 3am on a business that is shut at 3am\");\n return scoped(ts.length, \"timestamps inspected\");\n});\n\nt(\"W8 severity escalates: out of character is a look this week, twice past that is today\", () => {\n const r0 = W.rhythmOf(ticks(30, 24, 1));\n const justPast = W.silenceFindings([{ name: \"invoices paid in your CRM\", timestamps: ticks(30, 24, r0.expectByH * 1.2) }], NOW);\n const wellPast = W.silenceFindings([{ name: \"invoices paid in your CRM\", timestamps: ticks(30, 24, r0.expectByH * 2.5) }], NOW);\n eq(justPast.findings.map((f) => f.severity), [\"attention\"]);\n eq(wellPast.findings.map((f) => f.severity), [\"urgent\"]);\n return scoped(2, \"severity bands\");\n});\n\nt(\"W9 a source with too little history raises a note about itself, and is never a silent pass\", () => {\n const r = W.silenceFindings([{ name: \"payment links\", timestamps: ticks(2, 24, 900 * 24) }], NOW);\n eq(r.findings.length, 1, \"a source nothing is watching passed silently\");\n eq(r.findings[0].severity, \"note\");\n ok(/not enough/i.test(r.findings[0].sentence), r.findings[0].sentence);\n ok(!/urgent/i.test(r.findings[0].sentence), \"an unwatchable source was dressed up as an alarm\");\n return scoped(2, \"timestamps inspected\");\n});\n\nt(\"W10 ZERO SCOPE: handed nothing, it raises a finding about itself rather than an all clear\", () => {\n for (const nothing of [null, undefined, [], [{ name: \"x\", timestamps: [] }], [{ name: \"x\", timestamps: [\"not a date\"] }]]) {\n const r = W.silenceFindings(nothing, NOW);\n eq(r.inspected, 0, `claimed to have inspected something from ${JSON.stringify(nothing)}`);\n eq(r.findings.length, 1, \"inspected zero and said nothing\");\n eq(r.findings[0].severity, \"urgent\");\n ok(/nothing at all/i.test(r.findings[0].sentence), r.findings[0].sentence);\n }\n return scoped(5, \"empty inputs tried\");\n});\n\nt(\"W11 THE 19 FEBRUARY SHAPE: money payments stop dead, and it is caught within a fortnight\", () => {\n // Payments carrying money arrived through January and February at this account's real pace, then\n // stopped on 19 February 2026 and never resumed. Nothing errored. The question this test asks is\n // not \"does it eventually notice\" but \"how long did it take\", because five months was the answer\n // that cost $22,651.99.\n const lastPayment = Date.parse(\"2026-02-19T16:26:21.000Z\");\n const history = ticks(40, 20, 0, 30, lastPayment); // 40 payments, roughly daily, ending that day\n let firstFireDays = null;\n for (let d = 1; d <= 60 && firstFireDays === null; d++) {\n const asOf = lastPayment + d * DAY;\n const r = W.silenceFindings([{ name: \"payments with money on them in your CRM\", timestamps: history }], asOf);\n if (r.findings.some((f) => f.severity === \"urgent\" || f.severity === \"attention\")) firstFireDays = d;\n }\n ok(firstFireDays !== null, \"five months of silence on the payment feed never raised anything at all\");\n ok(firstFireDays <= 14, `took ${firstFireDays} days to notice the payment feed had stopped`);\n const atFiveMonths = W.silenceFindings([{ name: \"payments with money on them in your CRM\", timestamps: history }], lastPayment + 151 * DAY);\n eq(sev(all(atFiveMonths), \"urgent\").length, 1, \"five months in, it is not urgent\");\n ok(/19 February 2026/.test(atFiveMonths.findings[0].sentence), `the sentence does not name the last day money was seen: ${atFiveMonths.findings[0].sentence}`);\n ok(/about 5 months/.test(atFiveMonths.findings[0].sentence), `the sentence does not say how long it has been: ${atFiveMonths.findings[0].sentence}`);\n return scoped(60, \"days simulated after the last payment\");\n});\n\nt(\"W12 several sources are judged separately, each against its own rhythm\", () => {\n const r = W.silenceFindings([\n { name: \"invoices paid in your CRM\", timestamps: ticks(30, 24, 40 * 24) }, // daily, silent 40 days: fires\n { name: \"bookings taken in your CRM\", timestamps: ticks(30, 24, 3) }, // daily, current: quiet\n { name: \"online form payments\", timestamps: ticks(30, 14 * 24, 20 * 24) }, // fortnightly, 20 days: quiet\n ], NOW);\n eq(r.findings.length, 1, `judged the fortnightly source by the daily source's clock: ${JSON.stringify(r.findings.map((f) => f.numbers.source))}`);\n eq(r.findings[0].numbers.source, \"invoices paid in your CRM\");\n eq(r.inspected, 90);\n return scoped(90, \"timestamps across 3 sources\");\n});\n\nheader(\"CHECK 2: A RATIO COLLAPSE (payments still arrive, matching stops)\");\n\nconst steady = (n, share, count = 5) =>\n Array.from({ length: count }, (_, i) => ({ label: `w${i}`, endMs: NOW - (count - 1 - i) * 7 * DAY, total: n, matched: Math.round(n * share) }));\n\nt(\"W13 FIRES: payments keep arriving and the share reaching a customer record collapses\", () => {\n const points = [...steady(20, 0.95, 4), { label: \"latest\", endMs: NOW, total: 20, matched: 2 }];\n const r = W.matchRatioFindings(points, \"Square payments\");\n eq(r.findings.length, 1, \"a collapse from 95% to 10% raised nothing\");\n eq(r.findings[0].severity, \"urgent\");\n eq(r.findings[0].numbers.latestUnmatched, 18);\n eq(r.findings[0].numbers.baselineSharePercent, 95);\n eq(r.inspected, 100, \"did not report the number of payments it read\");\n ok(/still arriving/.test(r.findings[0].sentence), r.findings[0].sentence);\n return scoped(100, \"payments inspected\");\n});\n\nt(\"W14 STAYS QUIET: the same volumes with the share holding steady\", () => {\n const r = W.matchRatioFindings(steady(20, 0.95, 5), \"Square payments\");\n eq(r.findings.length, 0, `reported a collapse on a flat 95%: ${JSON.stringify(r.findings.map((f) => f.numbers))}`);\n eq(r.inspected, 100);\n return scoped(100, \"payments inspected\");\n});\n\nt(\"W15 STAYS QUIET: the share going UP is not a collapse\", () => {\n const points = [...steady(20, 0.5, 4), { label: \"latest\", endMs: NOW, total: 20, matched: 20 }];\n eq(W.matchRatioFindings(points, \"Square payments\").findings.length, 0, \"an improvement was reported as a problem\");\n return scoped(100, \"payments inspected\");\n});\n\nt(\"W16 STAYS QUIET: ordinary week to week wobble is not a collapse\", () => {\n const points = [...steady(20, 0.9, 4), { label: \"latest\", endMs: NOW, total: 20, matched: 17 }]; // 85%\n eq(W.matchRatioFindings(points, \"Square payments\").findings.length, 0, \"fired on a 5 point wobble, which is how a monitor gets ignored\");\n return scoped(100, \"payments inspected\");\n});\n\nt(\"W17 an EMPTY latest window is reported as an absence, never as a collapse to zero percent\", () => {\n // The trap: 0 matched out of 0 arriving is not 0% matching. Calling it a collapse would raise a\n // second alarm for one fault and name the wrong cause, sending her to look at the matcher when\n // the payments never arrived at all.\n const points = [...steady(20, 0.95, 4), { label: \"latest\", endMs: NOW, total: 0, matched: 0 }];\n const r = W.matchRatioFindings(points, \"Square payments\");\n eq(r.findings.length, 1);\n eq(r.findings[0].severity, \"note\", \"an empty window was raised as a matching failure\");\n ok(/different problem/.test(r.findings[0].sentence), r.findings[0].sentence);\n ok(!/collapse|stopped matching/i.test(r.findings[0].sentence), \"an absence was described as a matching failure\");\n return scoped(80, \"payments inspected\");\n});\n\nt(\"W18 a latest window too thin to judge says so instead of returning a verdict\", () => {\n const points = [...steady(20, 0.95, 4), { label: \"latest\", endMs: NOW, total: 2, matched: 0 }];\n const r = W.matchRatioFindings(points, \"Square payments\");\n eq(r.findings.length, 1);\n eq(r.findings[0].severity, \"note\", \"delivered a verdict on two payments\");\n ok(/too few/.test(r.findings[0].sentence), r.findings[0].sentence);\n return scoped(82, \"payments inspected\");\n});\n\nt(\"W19 ZERO SCOPE: no payments at all raises a finding about the check itself\", () => {\n for (const nothing of [null, undefined, [], [{ label: \"a\", endMs: NOW, total: 0, matched: 0 }]]) {\n const r = W.matchRatioFindings(nothing, \"Square payments\");\n eq(r.inspected, 0);\n eq(r.findings.length, 1, \"inspected zero payments and reported nothing\");\n eq(r.findings[0].severity, \"urgent\");\n }\n return scoped(4, \"empty inputs tried\");\n});\n\nheader(\"CHECK 3: A REVENUE CHANNEL GOING QUIET WHILE ACTIVITY CONTINUES (the February shape)\");\n\n// THE FEBRUARY FIXTURE. Six ordinary periods of about 45 bookings and about $7,000 taken, then a\n// period in which the same number of bookings arrived and not one dollar was recorded against\n// them. This is what the live account actually did: 48 payment records and $7,386.50 in February,\n// then 37 records and $0.00 in March, 21 and $0.00 in April, 18 and $0.00 in May.\nconst FEBRUARY_SHAPE = [\n { label: \"period 1\", endMs: NOW - 6 * 28 * DAY, activity: 44, dollars: 7100.00 },\n { label: \"period 2\", endMs: NOW - 5 * 28 * DAY, activity: 47, dollars: 6890.50 },\n { label: \"period 3\", endMs: NOW - 4 * 28 * DAY, activity: 41, dollars: 7402.25 },\n { label: \"period 4\", endMs: NOW - 3 * 28 * DAY, activity: 48, dollars: 7386.50 },\n { label: \"period 5\", endMs: NOW - 2 * 28 * DAY, activity: 45, dollars: 6950.00 },\n { label: \"period 6\", endMs: NOW - 1 * 28 * DAY, activity: 46, dollars: 7210.00 },\n { label: \"the month nobody noticed\", endMs: NOW, activity: 37, dollars: 0 },\n];\n\nt(\"W20 THE FEBRUARY FIXTURE: bookings carry on at full volume, the dollars go to zero, and it is caught\", () => {\n const r = W.revenueChannelFindings(FEBRUARY_SHAPE, \"your bookings\");\n eq(r.findings.length, 1, \"the exact shape of the five month gap raised NOTHING\");\n eq(r.findings[0].severity, \"urgent\");\n eq(r.findings[0].numbers.latestActivity, 37);\n eq(r.findings[0].numbers.latestDollars, 0);\n eq(r.findings[0].numbers.usualDollars, 7155);\n eq(r.findings[0].numbers.shareOfMoneyMissing, 100);\n eq(r.inspected, 308, \"did not report how many records of activity it read\");\n ok(/\\$0\\.00/.test(r.findings[0].sentence), `the sentence does not carry the zero: ${r.findings[0].sentence}`);\n ok(/\\$7,155\\.00/.test(r.findings[0].sentence), `the sentence does not carry the usual figure: ${r.findings[0].sentence}`);\n ok(/somewhere your CRM never hears about/.test(r.findings[0].sentence), \"the sentence does not tell her what it means\");\n return scoped(7, \"periods compared\");\n});\n\nt(\"W21 STAYS QUIET: a genuinely quiet trading period, where the bookings fell too\", () => {\n // Money down AND work down together is a slow month, which she can already see. Raising it would\n // be inventing an alarm about business conditions, and every invented alarm spends the attention\n // the real one will need.\n const quiet = [...FEBRUARY_SHAPE.slice(0, 6), { label: \"a slow month\", endMs: NOW, activity: 6, dollars: 900 }];\n const r = W.revenueChannelFindings(quiet, \"your bookings\");\n eq(r.findings.length, 0, `called a slow month a broken integration: ${JSON.stringify(r.findings.map((f) => f.sentence))}`);\n eq(r.inspected, 277);\n return scoped(7, \"periods compared\");\n});\n\nt(\"W22 STAYS QUIET: an ordinary period with money and bookings both normal\", () => {\n const normal = [...FEBRUARY_SHAPE.slice(0, 6), { label: \"an ordinary month\", endMs: NOW, activity: 45, dollars: 7050 }];\n eq(W.revenueChannelFindings(normal, \"your bookings\").findings.length, 0, \"fired on a completely ordinary month\");\n return scoped(7, \"periods compared\");\n});\n\nt(\"W23 STAYS QUIET: takings down by half is a trading question, not a broken link\", () => {\n const half = [...FEBRUARY_SHAPE.slice(0, 6), { label: \"a thinner month\", endMs: NOW, activity: 45, dollars: 3600 }];\n eq(W.revenueChannelFindings(half, \"your bookings\").findings.length, 0, \"a 50% dip was reported as a system failure\");\n return scoped(7, \"periods compared\");\n});\n\nt(\"W24 a failure that has run long enough to become the baseline is declared unjudgeable, not clean\", () => {\n // The honest limit of this check, asserted rather than left to be discovered. Once every period\n // in view is already at zero there is nothing left to fall from. It must say so out loud, because\n // silence here would read as a clean bill of health for the exact fault it was built for.\n const normalized = Array.from({ length: 6 }, (_, i) => ({ label: `

Segment	Count	Share	What can be done
Has an email	${c.emailable}	${pct(c.emailable, d.total)}	Address inventory only; not permission to release.
Email + consent snapshot clear	${c.releaseReady ?? 0}	${pct(c.releaseReady ?? 0, d.total)}	The only rows allowed into the dry-run batch plan.
Email, consent unknown	${c.consentUnknown ?? c.emailable}	${pct(c.consentUnknown ?? c.emailable, d.total)}	Held until each full contact DND snapshot is read.
Email blocked / DND	${c.emailBlocked ?? 0}	${pct(c.emailBlocked ?? 0, d.total)}	Excluded from the release.
Phone only	${c.phoneOnly}	${pct(c.phoneOnly, d.total)}	SMS — held until numbers are validated. Stale numbers get a business flagged by carriers.
Neither	${c.unreachable}	${pct(c.unreachable, d.total)}	Nothing by email or text. Reachable only inside Messenger, within Meta's window.
Excluded	${c.excluded}	${pct(c.excluded, d.total)}	Already customers, already on a path, flagged spam, or duplicates.

Diff · v1209