[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_164":165,"_166":167},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_89":-7,"_90":91,"_29":-7,"_92":-5,"_15":93,"_94":95,"_96":97,"_98":99,"_100":101,"_102":-5,"_103":-5,"_104":-5,"_105":38,"_106":107,"_108":49,"_109":-5,"_110":-5,"_111":112},"routes/_app.x.$handle.$name.branches",{"_11":12,"_13":14,"_15":16,"_17":18},"handle","bbuuuiiii","name","career-brain","project",{"_20":28,"_13":14,"_22":36,"_35":-5,"_37":38,"_39":40,"_41":40,"_42":-5,"_43":-5,"_44":45,"_46":47,"_48":49,"_50":-5,"_51":-5,"_52":53,"_54":55,"_56":-5,"_57":-5,"_58":-5,"_59":-5,"_60":61,"_62":61,"_63":64,"_65":64,"_66":64,"_67":61,"_68":61,"_69":70,"_71":72,"_73":74,"_75":38},"branches",[19],{"_20":21,"_22":23,"_24":25,"_13":26,"_27":28,"_29":30,"_31":-5,"_32":-5,"_33":34,"_35":-5},"id","3cc8dd51-8287-4a0e-891b-81f5e47b4051","createdAt",["D",1785714626606],"updatedAt",["D",1785759311333],"main","projectId","6e5f1eb7-cbdb-4e9d-96e0-a8f36d7aa0dc","version",53,"forkedBranchId","forkedBranchVersion","lockfileKey","1785759311410-esm.town_v_bbuuuiiii_career-brain@53-main","deletedAt",["D",1785714626601],"legacyEnvVars",false,"privacy","public","httpPrivacy","description","imageUrl","userId","4d3e2536-163e-4f12-9b6b-32f14a9ed176","pinnedFileId","ef96ee1e-8ecc-11f1-a5b8-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","019f3a8e-7e77-752f-bd44-7595c24bf3d4","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_88":84},"org",{"_11":12,"_81":82,"_83":84,"_44":45,"_85":86,"_87":38},"branch",{"_29":30,"_13":26,"_20":21,"_27":28,"_31":-5,"_32":-5,"_76":-5,"_77":-5,"_78":-5,"_79":14,"_80":12},"isOwned","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Brandon Bui","avatar","https://lh3.googleusercontent.com/a/ACg8ocLZmrHvE7ZTOx7re35Vq2Z1jYMFgXUAfJYkenA3HppsEwGzxAnviQ=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","path","","adoptOrgId",{"_20":28,"_13":14,"_22":160,"_35":-5,"_37":38,"_39":40,"_41":40,"_42":-5,"_43":-5,"_44":45,"_46":47,"_48":49,"_50":-5,"_51":-5,"_52":53,"_54":55,"_56":-5,"_57":-5,"_58":-5,"_59":-5,"_60":61,"_62":61,"_63":64,"_65":64,"_66":64,"_67":61,"_68":61,"_69":161,"_71":162,"_73":163,"_75":38},"tree",[151,152],"files",[151,152],"counts",{"_140":53,"_17":141,"_142":53,"_143":144,"_145":146},"contents",[113,114],"file","upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_20":131,"_13":132,"_117":133,"_118":-5,"_119":21,"_120":134,"_121":49,"_22":135,"_29":136,"_124":137,"_126":138,"_128":38,"_129":-5,"_90":139},{"_20":115,"_13":116,"_117":47,"_118":-5,"_119":21,"_120":30,"_121":49,"_22":122,"_29":123,"_124":125,"_126":127,"_128":38,"_129":-5,"_90":130},"42307c17-f451-44eb-9385-6c84b2f74643","main.tsx","fileId","parentId","branchId","branchVersion","latest",["D",1785759311333],47,"fileType","http","content","// career-brain — Val Town HTTP val The career-advisor system's files, living on a server instead of a\n// laptop, so any agent (ChatGPT in a plain Project via browsing, a Custom GPT Action, or anything else)\n// can read AND write them from anywhere.\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\nimport { email } from \"https://esm.town/v/std/email\";\n\nconst DOC_PREFIX = \"brain_doc_\";\nconst HIST_PREFIX = \"brain_hist_\";\nconst META_KEY = \"brain_meta\";\n// Request log lives in its OWN key. META_KEY already does unsynchronised read-modify-write and\n// holds the document index; a diagnostic must never be able to corrupt it.\nconst HITS_KEY = \"brain_hits\";\n// Ring-buffer size for the request log. It was 120 and that was actively harmful: a single deploy writes\n// ~26 entries, so routine maintenance evicted the very evidence the log existed to hold — and an empty\n// result reads exactly like \"nobody ever connected.\" A diagnostic that quietly discards its findings and\n// then reports absence is worse than having no diagnostic at all, which is the same disease as a stale\n// source that looks current. It cost a wrong accusation once.\nconst HITS_KEEP = 2000;\n// How old the request log's window must be before /log is allowed to say ChatGPT has NEVER connected. Zero\n// hits inside a two-hour-old buffer means \"nothing yet\", not \"never\" — the log only knows what happened\n// after it started recording. Saying NEVER off a young window produced a confident wrong conclusion twice\n// in one day, which is the same disease as a stale source that looks current: a diagnostic claiming more\n// than it measured.\nconst LOG_VERDICT_MIN_WINDOW_HOURS = 48;\nconst TOKEN_PLACEHOLDER = \"SET_AT_DEPLOY\";\n\n// Versions kept per doc. 5 × 71KB worst case is affordable; 50 would not be.\nconst KEEP_VERSIONS = 5;\n// An overwrite landing below this fraction of the current size is refused without ?force=1.\nconst SHRINK_FLOOR = 0.6;\n// Docs smaller than this are exempt from the shrink guard — nothing to lose.\nconst SHRINK_GUARD_MIN_BYTES = 2000;\n\n// How old each source may get before /fresh calls it STALE.\nconst STALENESS_BUDGET_HOURS: Record = {\n canvas: 26, // refreshed daily by the cron; 26h allows one missed run before alarming\n docs: 24 * 14, // a doc untouched for two weeks is suspect, not necessarily wrong\n backup: 24 * 8, // mailed weekly; 8 days allows one missed run before it reads as broken\n reachout: 30, // daily; 30h means ONE missed send is already visible in /fresh\n dashboard: 30, // pushed with the reach-out; a frozen dashboard must show up as STALE, not as calm\n drive: 26, // Drive and the val must agree daily; longer and the two brains have quietly diverged\n};\n\n// One home for the version string. /bootstrap and RUNTIME.md both publish it, and two copies of a\n// version number is how a payload starts claiming to be something it is not.\nconst POLICY_VERSION = \"2026-08-03.2\";\n\n// Freshness per source, straight from meta. Shared by /fresh and RUNTIME.md so the HTTP answer and\n// the Drive copy can never disagree about how current this system is.\nfunction freshnessReport(m: any) {\n return Object.entries(STALENESS_BUDGET_HOURS).map(([source, budget]) => {\n const last = source === \"docs\"\n ? Object.values(m.docs || {}).map((d: any) => d.written).sort().pop()\n : m[source]?.last_ok;\n const age = ageHours(last);\n // DIVERGED first: a sync that REFUSED a conflict left real disagreement, however recent. A\n // timestamp says when the sync last RAN, never that the two sides agree.\n const un = source === \"drive\" ? ((m.drive?.unresolved as string[]) ?? []) : [];\n return {\n source,\n last_ok: last ?? null,\n age_hours: age === null ? null : Math.round(age * 10) / 10,\n status: un.length ? \"DIVERGED\" : age === null ? \"NEVER_READ\" : age > budget ? \"STALE\" : \"fresh\",\n budget_hours: budget,\n diverged: un,\n };\n });\n}\n\nfunction token(): string {\n return Deno.env.get(\"BRAIN_TOKEN\") || TOKEN_PLACEHOLDER;\n}\n\nfunction authed(url: URL, req?: Request): boolean {\n const q = url.searchParams.get(\"t\");\n if (q && q === token()) return true;\n // ChatGPT Custom GPT Actions authenticate with a header, never a query string.\n const h = req?.headers.get(\"authorization\") || \"\";\n return h.replace(/^Bearer\\s+/i, \"\") === token() && h.length > 0;\n}\n\nfunction deny(): Response {\n return new Response(\"401 Unauthorized\", { status: 401 });\n}\n\nasync function meta(): Promise {\n try {\n return (await blob.getJSON(META_KEY)) ?? {};\n } catch {\n return {};\n }\n}\n\nasync function stamp(source: string, extra: Record = {}) {\n const m = await meta();\n m[source] = { last_ok: new Date().toISOString(), ...extra };\n await blob.setJSON(META_KEY, m);\n}\n\nfunction ageHours(iso: string | undefined): number | null {\n if (!iso) return null;\n return (Date.now() - new Date(iso).getTime()) / 36e5;\n}\n\nasync function readDoc(name: string): Promise {\n const body = await blob.getJSON(DOC_PREFIX + name).catch(() => null);\n return body == null ? null : String((body as any).text ?? \"\");\n}\n\n// Save `text` as `name`, pushing the previous text onto that doc's version history.\nasync function saveDoc(name: string, text: string, prev: string | null) {\n if (prev !== null) {\n const hist = ((await blob.getJSON(HIST_PREFIX + name).catch(() => null)) ?? []) as any[];\n hist.push({ ts: new Date().toISOString(), bytes: prev.length, text: prev });\n await blob.setJSON(HIST_PREFIX + name, hist.slice(-KEEP_VERSIONS));\n }\n await blob.setJSON(DOC_PREFIX + name, { text });\n const m = await meta();\n m.docs = m.docs || {};\n m.docs[name] = { bytes: text.length, written: new Date().toISOString() };\n await blob.setJSON(META_KEY, m);\n}\n\n// HARD SIZE CEILINGS — the cap that was only prose is now a wall. Two independent reasons, and they happen\n// to agree on the number: 1. PHYSICS. An agent rewrites STATE.md by putting the entire new file in a URL\n// query string. Measured, the request is ~6,774 characters when STATE.md is 5,599 bytes, against a\n// practical ~8,000-octet HTTP request-line limit. Past roughly 6,000 bytes the write starts failing — and\n// it fails as a truncated or rejected request, which is exactly the kind of silent loss this system exists\n// to prevent. 2. DESIGN.\nconst SIZE_CEILING: Record = {\n \"STATE.md\": 6000,\n \"DECISIONS.md\": 12000,\n};\n\nfunction ceilingGuard(name: string, next: string): Response | null {\n const cap = SIZE_CEILING[name];\n if (!cap || next.length <= cap) return null;\n return Response.json({\n error: `REFUSED — ${name} may not exceed ${cap} characters.`,\n submitted_bytes: next.length,\n over_by: next.length - cap,\n why: name === \"STATE.md\"\n ? \"Two reasons. A rewrite this size will not survive the URL that carries it, and this file \" +\n \"is capped on purpose so that current state cannot sprawl.\"\n : \"This file is read every session and is capped so it stays readable.\",\n what_to_do:\n \"Do not trim by deleting facts silently. Decide what is FINISHED or PARKED, move it to \" +\n \"JOURNAL/ (append) or to DECISIONS.md if it is a settled call, TELL BRANDON what you closed \" +\n \"and what the tradeoff is, then write the shorter file.\",\n }, { status: 413 });\n}\n\n// Returns a 409 Response if this overwrite would gut the doc, else null.\nfunction shrinkGuard(name: string, prev: string | null, next: string, force: boolean): Response | null {\n if (force || prev === null) return null;\n if (prev.length < SHRINK_GUARD_MIN_BYTES) return null;\n if (next.length >= prev.length * SHRINK_FLOOR) return null;\n return Response.json({\n error: \"REFUSED — this would destroy most of the document.\",\n doc: name,\n current_bytes: prev.length,\n submitted_bytes: next.length,\n what_to_do:\n \"You almost certainly meant to ADD something, not replace the file. Use /append instead. \" +\n \"If you truly intend to replace the whole document, repeat the call with &force=1.\",\n }, { status: 409 });\n}\n\n// Collect every doc into one object. Shared by /export and the backup mail.\nasync function exportAll(): Promise> {\n const m = await meta();\n const out: Record = {};\n for (const n of Object.keys(m.docs || {})) out[n] = (await readDoc(n)) ?? \"\";\n return out;\n}\n\n// btoa() alone throws on anything outside Latin-1, and these docs are full of em-dashes, ✅ and ⏳. Encode\n// to UTF-8 bytes first, then base64 in chunks so a 350KB payload doesn't blow the stack.\nfunction b64utf8(s: string): string {\n const bytes = new TextEncoder().encode(s);\n let bin = \"\";\n const CHUNK = 0x8000;\n for (let i = 0; i < bytes.length; i += CHUNK) {\n bin += String.fromCharCode(...bytes.subarray(i, i + CHUNK));\n }\n return btoa(bin);\n}\n\n// Mail the whole system to the account owner as an attachment. This exists because of LESSONS.md: \"no\n// self-maintained tool has ever survived 7 days... he is only ever the USER of this system.\" A backup he\n// has to remember to run is not a backup. This one needs nothing from him, and it lands somewhere he\n// already looks every day.\nexport async function backupByEmail(reason: string): Promise<{ ok: boolean; bytes?: number; error?: string }> {\n try {\n const docs = await exportAll();\n const payload = JSON.stringify({ exported_at: new Date().toISOString(), docs }, null, 1);\n const names = Object.keys(docs).sort();\n const stamp = new Date().toISOString().slice(0, 10);\n await email({\n subject: `career-brain backup — ${stamp} (${names.length} docs, ${Math.round(payload.length / 1024)} KB)`,\n text: [\n `Automatic backup of the career-advisor system. Trigger: ${reason}.`,\n \"\",\n \"Keep this email. If Val Town ever loses the store, the attachment is the whole system:\",\n \"every doc, full text, restorable by re-running brain_deploy.py against it.\",\n \"\",\n \"Docs included:\",\n ...names.map((n) => ` ${n} (${docs[n].length.toLocaleString()} bytes)`),\n ].join(\"\\n\"),\n attachments: [{\n content: b64utf8(payload),\n filename: `career-brain-${stamp}.json`,\n type: \"application/json\",\n disposition: \"attachment\",\n }],\n });\n await stamp_backup(payload.length);\n return { ok: true, bytes: payload.length };\n } catch (e) {\n return { ok: false, error: String(e) };\n }\n}\n\nasync function stamp_backup(bytes: number) {\n const m = await meta();\n m.backup = { last_ok: new Date().toISOString(), bytes };\n await blob.setJSON(META_KEY, m);\n}\n\n// True when the last successful backup is older than a week (or never happened).\nexport async function backupIsDue(): Promise {\n const age = ageHours((await meta()).backup?.last_ok);\n return age === null || age > 24 * 7;\n}\n\n// THE REACH-OUT. This is the half of the system that does not wait to be opened. Everything else here\n// answers when spoken to. Brandon went 24 days without opening the system in July and NOTHING NOTICED — no\n// alert, no message, no escalation. A human reopening a chat is what restarted it. His own records say no\n// tool of his has ever survived seven days once he had to be the one showing up. So this fires on a\n// schedule that has no opinion about whether he has been around, and it gets LOUDER the longer he is\n// silent.\nexport async function dailyReachOut(force = false): Promise {\n const m = await meta();\n const sinceEmail = ageHours(m.reachout?.last_ok);\n if (!force && sinceEmail !== null && sinceEmail < 20) {\n return { skipped: \"already sent within 20h\", age_hours: Math.round(sinceEmail * 10) / 10 };\n }\n\n const state = (await readDoc(\"STATE.md\")) ?? \"\";\n const oneThing = (state.match(/## THE ONE THING[^\\n]*\\n([\\s\\S]*?)(?=\\n## )/) || [])[1]?.trim()\n ?? \"STATE.md is not on the server — the daily note cannot see your current focus.\";\n\n // A tap is the reset, so an ack always wins. With no ack the clock still runs — from the first\n // contact this system can prove it made. Both null means it has genuinely never reached him.\n const quietSince = m.ack?.last_ok ?? m.first_contact?.at;\n const quietH = ageHours(quietSince);\n const quietDays = quietH === null ? null : Math.floor(quietH / 24);\n const d = quietDays ?? 0;\n\n // The ladder. Silence escalates; only a tap resets it.\n const subject = quietDays === null\n ? \"Your career advisor is live — tap once to start the clock\"\n : d >= 14\n ? `🔴 ${d} days quiet. Nothing has moved.`\n : d >= 7\n ? `⚠️ ${d} days quiet — this is the week things usually die`\n : d >= 3\n ? `${d} days since you checked in`\n : \"Today\";\n\n const deadlines = ((await blob.getJSON(\"brain_deadlines\").catch(() => null)) ?? []) as any[];\n const today = new Date().toISOString().slice(0, 10);\n const soon = deadlines.filter((x: any) => {\n const day = String(x.due).slice(0, 10);\n return day >= today && day <= new Date(Date.now() + 7 * 864e5).toISOString().slice(0, 10);\n }).slice(0, 6);\n\n const ackUrl = `${Deno.env.get(\"BRAIN_PUBLIC_URL\") || \"\"}/ack?t=${token()}`;\n\n const body = [\n \"THE ONE THING\", \"\", oneThing, \"\",\n soon.length ? \"NEXT 7 DAYS\" : \"Nothing due in the next 7 days.\",\n ...soon.map((x: any) => ` ${String(x.due).slice(0, 10)} ${x.summary}`),\n \"\",\n quietDays !== null && d >= 7\n ? \"You have been quiet for a week. That is information about the trigger, not about you — if\\n\" +\n \"this note is landing at the wrong time or in the wrong place, it gets changed, not pushed harder.\\n\" +\n \"Coming back costs nothing and is never accounted for.\\n\"\n : \"\",\n \"─\".repeat(60),\n \"Tap to tell it you're here (this is the only thing that resets the counter):\",\n ackUrl,\n ].filter(Boolean).join(\"\\n\");\n\n // BOTH channels, every time. One channel is not redundancy, and the text is the one he reads.\n let mailed = false, mailErr: string | undefined;\n try {\n await email({ subject, text: body });\n mailed = true;\n } catch (e) {\n mailErr = String(e);\n }\n\n const smsText = [\n d >= 7 ? `${d} days quiet.` : d >= 3 ? `Day ${d}.` : \"\",\n oneThing.split(\"\\n\")[0].replace(/\\*\\*/g, \"\").slice(0, 150),\n soon.length ? `Next: ${String(soon[0].due).slice(5, 10)} ${String(soon[0].summary).slice(0, 40)}` : \"\",\n `Here? ${ackUrl}`,\n ].filter(Boolean).join(\" \");\n const sms = await sendSMS(smsText);\n\n const mm = await meta();\n // FIRST CONTACT — written once and never rewritten, because m.reachout.last_ok is the LATEST\n // send and is overwritten every day, so it can never answer \"how long has this been going on\".\n // Only a send that actually LANDED counts: if both channels blew up, he was not contacted, and\n // the next run must still treat itself as the first message rather than start a clock on a\n // delivery that never happened.\n if (!mm.first_contact?.at && (mailed || sms.ok)) {\n mm.first_contact = { at: new Date().toISOString() };\n }\n mm.reachout = {\n last_ok: (mailed || sms.ok) ? new Date().toISOString() : mm.reachout?.last_ok,\n subject, quiet_days: quietDays,\n email_ok: mailed, sms_ok: sms.ok, sms_via: sms.via, sms_error: sms.error, email_error: mailErr,\n };\n await blob.setJSON(META_KEY, mm);\n\n // Only a total blackout counts as failure — if either channel landed, he was reached.\n return {\n ok: mailed || sms.ok,\n subject, quiet_days: quietDays, deadlines: soon.length,\n email: mailed ? \"sent\" : `FAILED: ${mailErr}`,\n sms: sms.ok ? `sent via ${sms.via}` : `NOT SENT: ${sms.error}`,\n };\n}\n\n// TEXT MESSAGE — the channel he actually reads. Email is where things go to be ignored; a text lands on\n// the lock screen. Two paths, and the system uses whichever is configured, preferring the reliable one:\n// TWILIO_SID + TWILIO_TOKEN + TWILIO_FROM + SMS_TO -> real SMS, delivery receipts, reliable SMS_TO alone,\n// as a carrier gateway address -> free, no signup, works immediately (e.g.\nasync function sendSMS(body: string): Promise<{ ok: boolean; via?: string; error?: string }> {\n const to = Deno.env.get(\"SMS_TO\");\n if (!to) return { ok: false, error: \"SMS_TO not set — no text channel configured\" };\n const sid = Deno.env.get(\"TWILIO_SID\");\n const tok = Deno.env.get(\"TWILIO_TOKEN\");\n const from = Deno.env.get(\"TWILIO_FROM\");\n\n if (sid && tok && from) {\n try {\n const res = await fetch(`https://api.twilio.com/2010-04-01/Accounts/${sid}/Messages.json`, {\n method: \"POST\",\n headers: {\n \"Authorization\": \"Basic \" + btoa(`${sid}:${tok}`),\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: new URLSearchParams({ To: to, From: from, Body: body.slice(0, 1500) }),\n });\n if (!res.ok) return { ok: false, via: \"twilio\", error: `${res.status} ${await res.text()}` };\n return { ok: true, via: \"twilio\" };\n } catch (e) {\n return { ok: false, via: \"twilio\", error: String(e) };\n }\n }\n\n // Carrier gateway: an email that arrives as a text. Subject is omitted deliberately — most\n // gateways prepend it to the message body and it wastes the visible line.\n if (to.includes(\"@\")) {\n try {\n await email({ to, subject: \"\", text: body.slice(0, 300) });\n return { ok: true, via: \"carrier gateway\" };\n } catch (e) {\n return { ok: false, via: \"carrier gateway\", error: String(e) };\n }\n }\n return { ok: false, error: `SMS_TO is \"${to}\" — needs Twilio credentials, or a gateway address` };\n}\n\n// THE SECOND CHANNEL — a calendar feed his iPhone subscribes to once, forever. Email is one channel, and\n// one channel is not redundancy. This one is structurally different in the way that matters: once iOS has\n// subscribed and synced, the alarms live ON THE PHONE. Val Town can go down, the account can lapse, the\n// whole server can vanish — and the events already pulled still fire. No other layer here survives its own\n// infrastructure dying. It also needs nothing from him after the one-time subscribe: iOS re-pulls on its\n// own schedule.\nfunction icsFeed(state: string, deadlines: any[]): string {\n const pad = (n: number) => String(n).padStart(2, \"0\");\n const stamp = (d: Date) =>\n `${d.getUTCFullYear()}${pad(d.getUTCMonth() + 1)}${pad(d.getUTCDate())}T${pad(d.getUTCHours())}${\n pad(d.getUTCMinutes())\n }00Z`;\n const esc = (s: string) => s.replace(/([,;\\\\])/g, \"\\\\$1\").replace(/\\n/g, \"\\\\n\");\n const now = new Date();\n const today = now.toISOString().slice(0, 10);\n\n // The current focus, as a title he sees without opening anything.\n const oneThing = (state.match(/## THE ONE THING[^\\n]*\\n([^\\n]*\\n[^\\n]*)/) || [])[1]\n ?.replace(/\\*\\*/g, \"\").replace(/\\s+/g, \" \").trim().slice(0, 110) ?? \"Open the advisor\";\n\n const out: string[] = [\n \"BEGIN:VCALENDAR\", \"VERSION:2.0\", \"PRODID:-//career-brain//EN\",\n \"CALSCALE:GREGORIAN\", \"METHOD:PUBLISH\",\n \"X-WR-CALNAME:Career advisor\",\n \"X-WR-CALDESC:Deadlines and the daily check-in. Updates itself.\",\n \"X-PUBLISHED-TTL:PT1H\", \"REFRESH-INTERVAL;VALUE=DURATION:PT1H\",\n ];\n\n // Daily 9:30am check-in — the layer his own notes call the one that survives app sign-outs.\n out.push(\n \"BEGIN:VEVENT\",\n \"UID:career-brain-daily-checkin@val.town\",\n `DTSTAMP:${stamp(now)}`,\n \"RRULE:FREQ=DAILY\",\n `DTSTART;TZID=America/New_York:${today.replace(/-/g, \"\")}T093000`,\n \"DURATION:PT2M\",\n `SUMMARY:${esc(\"2 min: \" + oneThing)}`,\n `DESCRIPTION:${esc(\"Two minutes is the whole ask. Doing only the first physical step counts as a return, not a failure.\")}`,\n \"BEGIN:VALARM\", \"ACTION:DISPLAY\", \"TRIGGER:PT0M\",\n `DESCRIPTION:${esc(oneThing)}`, \"END:VALARM\",\n \"END:VEVENT\",\n );\n\n for (const d of deadlines) {\n const day = String(d.due).slice(0, 10);\n if (day < today) continue;\n const ymd = day.replace(/-/g, \"\");\n out.push(\n \"BEGIN:VEVENT\",\n `UID:career-brain-${ymd}-${esc(String(d.summary)).slice(0, 40).replace(/[^a-zA-Z0-9]/g, \"\")}@val.town`,\n `DTSTAMP:${stamp(now)}`,\n `DTSTART;VALUE=DATE:${ymd}`,\n `SUMMARY:${esc(String(d.summary))}`,\n `DESCRIPTION:${esc(String(d.course || \"\"))}`,\n // Two alarms: the day before, and the morning of. A single alarm is a single point of failure.\n \"BEGIN:VALARM\", \"ACTION:DISPLAY\", \"TRIGGER:-P1D\",\n `DESCRIPTION:${esc(\"Tomorrow: \" + d.summary)}`, \"END:VALARM\",\n \"BEGIN:VALARM\", \"ACTION:DISPLAY\", \"TRIGGER:-PT9H\",\n `DESCRIPTION:${esc(\"Today: \" + d.summary)}`, \"END:VALARM\",\n \"END:VEVENT\",\n );\n }\n out.push(\"END:VCALENDAR\");\n return out.join(\"\\r\\n\") + \"\\r\\n\";\n}\n\n// KEEP THE PHONE DASHBOARD LIVE, WITH NOTHING FOR ANYONE TO RUN. The dashboard's state had exactly one\n// writer: a Claude session on the Mac running `dashboard_sync.py push`. That writer stops existing on\n// 2026-08-04, after which the page would have frozen on whatever it last held and gone on displaying it as\n// current — a stale surface that looks alive, which is the failure this whole system is built around.\n// Making it prettier would not have changed that. So the flow inverts. ChatGPT edits STATE.md; this\n// derives the dashboard's live fields from that same file and pushes them to the dashboard val on every\n// scheduled run.\nexport async function pushDashboard(): Promise {\n const url = Deno.env.get(\"DASH_URL\");\n const tok = Deno.env.get(\"DASH_TOKEN\");\n if (!url || !tok) return { skipped: \"DASH_URL/DASH_TOKEN not set\" };\n\n const state = await readDoc(\"STATE.md\");\n if (!state || state.length < 200) {\n // Never push a shape derived from a missing or truncated source. A blank dashboard would read\n // as \"nothing to do today,\" which is a lie with consequences.\n return { ok: false, error: \"STATE.md missing or too short — refusing to push\" };\n }\n\n const section = (h: string) =>\n (state.match(new RegExp(`## ${h}[^\\\\n]*\\\\n([\\\\s\\\\S]*?)(?=\\\\n## |$)`)) || [])[1]?.trim() ?? \"\";\n const clean = (s: string) => s.replace(/\\*\\*/g, \"\").replace(/\\s+/g, \" \").trim();\n\n const oneRaw = section(\"THE ONE THING[^\\\\n]*\");\n const oneLines = oneRaw.split(\"\\n\").filter((l) => l.trim());\n const title = clean(oneLines.slice(0, 2).join(\" \")).slice(0, 200);\n const ignition = clean(oneLines.find((l) => /ignition/i.test(l)) ?? \"\");\n\n // Commitments come from the markdown table: | what | ignition step | since |\n const commitments = section(\"OPEN COMMITMENTS\").split(\"\\n\")\n .filter((l) => l.startsWith(\"|\") && !/^\\|\\s*-+/.test(l) && !/\\| *What *\\|/i.test(l))\n .map((l) => l.split(\"|\").map((c) => c.trim()).filter(Boolean))\n .filter((c) => c.length >= 2)\n .map((c, i) => ({\n id: `state-${i}`,\n label: clean(c[0]) + (c[1] ? ` — first step: ${clean(c[1])}` : \"\"),\n due: c[2] && /\\d{4}-\\d{2}-\\d{2}/.test(c[2]) ? c[2] : \"\",\n done: false,\n }));\n\n const deadlines = ((await blob.getJSON(\"brain_deadlines\").catch(() => null)) ?? []) as any[];\n const today = new Intl.DateTimeFormat(\"en-CA\", { timeZone: \"America/New_York\" }).format(new Date());\n const countdowns = deadlines\n .filter((x: any) => String(x.due).slice(0, 10) >= today)\n .slice(0, 3)\n .map((x: any) => ({ label: String(x.summary).slice(0, 70), date: String(x.due).slice(0, 10) }));\n\n try {\n const cur = await fetch(`${url.replace(/\\/$/, \"\")}/state?t=${tok}`).then((r) => r.json());\n const merged = {\n ...cur, // everything this function does not understand survives untouched\n one_thing: { ...(cur.one_thing ?? {}), id: \"state-md\", title, detail: ignition, done: false },\n ...(commitments.length ? { commitments } : {}),\n ...(countdowns.length ? { countdowns } : {}),\n synced: new Date().toISOString(),\n updated_by: \"career-brain (auto, from STATE.md)\",\n };\n const res = await fetch(`${url.replace(/\\/$/, \"\")}/replace?t=${tok}`, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify(merged),\n });\n if (!res.ok) return { ok: false, error: `dashboard returned ${res.status}` };\n await stamp(\"dashboard\", { commitments: commitments.length, countdowns: countdowns.length });\n return { ok: true, one_thing: title.slice(0, 70), commitments: commitments.length, countdowns: countdowns.length };\n } catch (e) {\n return { ok: false, error: String(e) };\n }\n}\n\n// ═══ GOOGLE DRIVE ⇄ VAL — ONE BRAIN, TWO DOORS ═══ ChatGPT writes to Drive. The dashboard, the calendar\n// and the daily message read from the val. Without this they are two brains that agree until they don't,\n// and the first disagreement is a confident wrong answer to whoever reads the losing copy. This makes them\n// the same brain.\nconst DRIVE_API = \"https://www.googleapis.com/drive/v3\";\n\n// RETIRED — documents deliberately removed from the system, never to be pulled back. Without this,\n// deletion does not work in either direction: remove a file from the val and the next sync sees Drive\n// holding something the val lacks and helpfully restores it. A service account with Editor rights also\n// cannot delete files Brandon owns, so junk he created through ChatGPT can never be removed from Drive by\n// this code at all — it can only be ignored. So retiring a document is a decision recorded here, not an\n// act of deletion.\nconst RETIRED = new Set([\n \"_CANARY_SERVER_ONLY.md\", // test artifact from proving ChatGPT actually reached the server\n \"FABLE_SYSTEM_V2_DRAFT.md\", // superseded draft from the Fable era\n \"FABLE_LAST_SESSION_PROMPT.md\", // Fable era, retired with that model\n \"DASHBOARD_REDESIGN_FABLE_PROMPT.md\", // superseded by prompts/dashboard_redesign_build_2026_08_02.md\n \"resume_build_notes_2026_08.md\", // deleted by Brandon 2026-08-03; the resume PDF is the artifact,\n // the live parts were already migrated (four blockers -> STATE.md, the Crisis Text Line ruling\n // -> DECISIONS.md), and the rest was rationale he does not want kept\n]);\n\nfunction b64url(bytes: Uint8Array): string {\n let s = \"\";\n for (const b of bytes) s += String.fromCharCode(b);\n return btoa(s).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\n// Mint a short-lived Google access token by signing a JWT with the service-account key.\nasync function driveToken(): Promise {\n const raw = Deno.env.get(\"GOOGLE_SA_KEY\");\n if (!raw) return null;\n try {\n const sa = JSON.parse(raw);\n const now = Math.floor(Date.now() / 1000);\n const header = b64url(new TextEncoder().encode(JSON.stringify({ alg: \"RS256\", typ: \"JWT\" })));\n const claim = b64url(new TextEncoder().encode(JSON.stringify({\n iss: sa.client_email,\n scope: \"https://www.googleapis.com/auth/drive\",\n aud: \"https://oauth2.googleapis.com/token\",\n exp: now + 3600,\n iat: now,\n })));\n const pem = sa.private_key.replace(/-----[A-Z ]+-----/g, \"\").replace(/\\s/g, \"\");\n const der = Uint8Array.from(atob(pem), (c) => c.charCodeAt(0));\n const key = await crypto.subtle.importKey(\n \"pkcs8\", der, { name: \"RSASSA-PKCS1-v1_5\", hash: \"SHA-256\" }, false, [\"sign\"],\n );\n const sig = new Uint8Array(await crypto.subtle.sign(\n \"RSASSA-PKCS1-v1_5\", key, new TextEncoder().encode(`${header}.${claim}`),\n ));\n const res = await fetch(\"https://oauth2.googleapis.com/token\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body: new URLSearchParams({\n grant_type: \"urn:ietf:params:oauth:grant-type:jwt-bearer\",\n assertion: `${header}.${claim}.${b64url(sig)}`,\n }),\n });\n if (!res.ok) return null;\n return (await res.json()).access_token ?? null;\n } catch {\n return null;\n }\n}\n\n// Every file in the shared folder: id, name, and when Drive last saw it change.\nasync function driveList(tok: string, folder: string): Promise {\n const q = encodeURIComponent(`'${folder}' in parents and trashed=false`);\n const res = await fetch(\n `${DRIVE_API}/files?q=${q}&fields=files(id,name,modifiedTime,mimeType)&pageSize=200`,\n { headers: { Authorization: `Bearer ${tok}` } },\n );\n if (!res.ok) return [];\n return (await res.json()).files ?? [];\n}\n\nasync function driveRead(tok: string, id: string): Promise {\n const res = await fetch(`${DRIVE_API}/files/${id}?alt=media`, {\n headers: { Authorization: `Bearer ${tok}` },\n });\n return res.ok ? await res.text() : null;\n}\n\nasync function driveWrite(tok: string, id: string | null, name: string, text: string, folder: string) {\n if (id) {\n return (await fetch(`https://www.googleapis.com/upload/drive/v3/files/${id}?uploadType=media`, {\n method: \"PATCH\",\n headers: { Authorization: `Bearer ${tok}`, \"Content-Type\": \"text/plain; charset=utf-8\" },\n body: text,\n })).ok;\n }\n const boundary = \"brainsync\";\n const body = `--${boundary}\\r\\nContent-Type: application/json; charset=UTF-8\\r\\n\\r\\n` +\n JSON.stringify({ name, parents: [folder] }) +\n `\\r\\n--${boundary}\\r\\nContent-Type: text/plain; charset=UTF-8\\r\\n\\r\\n${text}\\r\\n--${boundary}--`;\n return (await fetch(\"https://www.googleapis.com/upload/drive/v3/files?uploadType=multipart\", {\n method: \"POST\",\n headers: { Authorization: `Bearer ${tok}`, \"Content-Type\": `multipart/related; boundary=${boundary}` },\n body,\n })).ok;\n}\n\n// Record WHICH Drive version the val now holds, without dating it as a local edit. saveDoc() stamps\n// `written: now`, which is correct for something typed here and wrong for something RECEIVED. A pulled\n// file was instantly \"newer\" than the Drive file it had just been copied from, so the next run pushed it\n// straight back; that moved Drive's modifiedTime, so the run after that pulled it again.\nasync function stampFromDrive(name: string, driveModified: string) {\n const m = await meta();\n m.docs = m.docs || {};\n if (m.docs[name]) {\n m.docs[name] = { ...m.docs[name], written: driveModified, from_drive: driveModified };\n await blob.setJSON(META_KEY, m);\n }\n}\n\n// Reconcile both directions. Content decides whether to act; the newer timestamp decides which way.\nexport async function syncDrive(): Promise {\n const folder = Deno.env.get(\"DRIVE_FOLDER_ID\");\n const tok = await driveToken();\n if (!folder || !tok) {\n return { skipped: \"GOOGLE_SA_KEY / DRIVE_FOLDER_ID not set — Drive is NOT being synced\" };\n }\n const files = await driveList(tok, folder);\n const byName = new Map(files.map((f: any) => [f.name, f]));\n const m = await meta();\n const localDocs = m.docs || {};\n const pulled: string[] = [], pushed: string[] = [], created: string[] = [];\n const conflicts: any[] = [];\n const retired: string[] = [];\n const failed: string[] = [];\n const untouched: string[] = [];\n const unchanged: string[] = [];\n const unreadable: string[] = [];\n const undecidable: any[] = [];\n\n for (const [name, f] of byName) {\n // WHITELIST, NOT BLACKLIST. This skipped only Google-native formats, so a PDF sailed through:\n // it was read as UTF-8 text, every invalid byte replaced, and written back — silently\n // destroying his resume, transcript and transfer report minutes after they were uploaded, and\n // flipping their type to text/plain. Sizes grew ~70%, which is what mangled binary looks like.\n // This code only ever handles text, so it now touches ONLY what it can prove is text. Anything\n // else — PDFs, images, anything binary — is left strictly alone and reported, not guessed at.\n if (!/\\.(md|tsv|txt)$/i.test(name) || !String(f.mimeType).startsWith(\"text/\")) {\n untouched.push(name);\n continue;\n }\n if (RETIRED.has(name)) { retired.push(name); continue; }\n\n // RUNTIME.md is GENERATED, never authored, so the guards below are actively wrong for it.\n // Drive's copy is only ever an older render of this same file and always holds lines the new\n // one does not (its old timestamp, its old ages), which the unseen-line guard would read as a\n // real conflict on EVERY run — parking it in m.drive.unresolved forever and making the\n // freshness report this very file publishes claim DIVERGED permanently. Always push, never\n // pull, never conflict. Nothing human is ever lost, because nothing human is ever written here.\n if (name === RUNTIME_DOC) {\n const gen = await readDoc(name);\n if (gen) (await driveWrite(tok, f.id, name, gen, folder)) ? pushed.push(name) : failed.push(name);\n continue;\n }\n\n // CONTENT DECIDES WHETHER TO ACT. TIMESTAMPS ONLY DECIDE WHICH WAY.\n //\n // This used to compare clocks and nothing else, so it rewrote a file in whichever direction it\n // happened to be facing even when both sides already said exactly the same thing — and every\n // one of those pointless writes moved the very clock the next run reads. That is why it never\n // settled: 21 files pulled and 3 pushed, then one minute later the same 21 pushed and the same\n // 3 pulled. Reading both sides first costs one Drive read per text file and buys the only\n // property that matters here: when the two copies agree, NOTHING happens — no write, no\n // re-stamp, nothing counted — so a second sync with no edits in between is a true no-op.\n const theirs = await driveRead(tok, f.id);\n // A read that failed is not evidence about anything. Deciding from the timestamp alone with no\n // idea what Drive holds is precisely the move that overwrote a submitted job application, so an\n // unreadable file is skipped and NAMED rather than guessed at.\n if (theirs === null) { unreadable.push(name); continue; }\n const mine = await readDoc(name);\n if (mine !== null && mine === theirs) { unchanged.push(name); continue; }\n\n const driveTime = new Date(f.modifiedTime).getTime();\n const valTime = localDocs[name]?.written ? new Date(localDocs[name].written).getTime() : 0;\n if (driveTime > valTime + 2000) {\n if (!theirs.length) continue;\n // The unseen-content guard ran only on PUSH, so the val was protected and Drive was not —\n // and a 416-byte placeholder from Drive duly overwrote a 3,603-byte credentials file on the\n // val. Same rule, both directions: if this side holds lines the other has never had, that is\n // unmerged work and the pull is refused, not performed.\n if (mine) {\n const incoming = new Set(theirs.split(\"\\n\").map((l) => l.trim()).filter((l) => l.length > 12));\n const onlyHere = mine.split(\"\\n\").map((l) => l.trim())\n .filter((l) => l.length > 12 && !incoming.has(l));\n if (onlyHere.length) {\n conflicts.push({ name, val_only_lines: onlyHere.length, sample: onlyHere.slice(0, 3) });\n continue;\n }\n }\n await saveDoc(name, theirs, mine);\n // A pull is not finished until the val stops claiming it wrote this itself. Without this the\n // next run pushes it straight back and the ping-pong starts again — see stampFromDrive.\n await stampFromDrive(name, f.modifiedTime);\n pulled.push(name);\n } else if (valTime > driveTime + 2000) {\n const text = mine;\n if (!text) continue;\n // NEVER OVERWRITE CONTENT YOU HAVE NEVER SEEN.\n //\n // Timestamps alone caused real data loss on the first run: a deploy touched all 23 documents,\n // which made the val \"newer\" than Drive everywhere, so the sync pushed over four files that\n // ChatGPT had edited an hour earlier — including a submitted job application and its\n // follow-up deadline. Recovered only because Google keeps revisions.\n //\n // A newer timestamp does not mean a superset. Before pushing, read what Drive actually holds:\n // if it contains lines this side has never had, those are somebody's unmerged edits and the\n // push is refused. Losing a day of freshness is recoverable; deleting the record of a job\n // application he applied for is not.\n if (theirs) {\n const ours = new Set(text.split(\"\\n\").map((l) => l.trim()).filter((l) => l.length > 12));\n const driveOnly = theirs.split(\"\\n\").map((l) => l.trim())\n .filter((l) => l.length > 12 && !ours.has(l));\n if (driveOnly.length) {\n conflicts.push({ name, drive_only_lines: driveOnly.length, sample: driveOnly.slice(0, 3) });\n continue;\n }\n }\n await driveWrite(tok, f.id, name, text, folder);\n pushed.push(name);\n } else {\n // The two copies differ and the two clocks are within two seconds of each other, so nothing\n // here can honestly say which side holds the edit. Say so and touch neither: guessing costs\n // whichever side guessed wrong, and that is the loss this whole function is built to avoid.\n undecidable.push({\n name, val_written: localDocs[name]?.written ?? null, drive_modified: f.modifiedTime,\n });\n }\n }\n\n for (const name of Object.keys(localDocs)) {\n if (byName.has(name) || name.startsWith(\"code/\") || RETIRED.has(name)) continue;\n const text = await readDoc(name);\n // Creation can fail even when updates succeed: a service account has ZERO storage quota, so it\n // may modify files Brandon owns but cannot bring new ones into existence. This reported success\n // regardless of the result for hours — the same \"said it was done\" failure the system exists to\n // catch, committed by the code meant to catch it.\n if (text) {\n (await driveWrite(tok, null, name, text, folder)) ? created.push(name) : failed.push(name);\n }\n }\n\n await stamp(\"drive\", {\n pulled: pulled.length, pushed: pushed.length, created: created.length,\n conflicts: conflicts.length,\n // NAMED: an ATTEMPT is not agreement; \"fresh\" from a timestamp alone was a lie.\n unresolved: [...conflicts.map((c) => c.name), ...failed, ...unreadable],\n // Broken out of `unresolved` because the two are NOT the same problem: a conflict means both\n // sides hold real edits and a human must merge, while this means the file never reached Drive\n // at all. Telling a coach to hand-merge a file that does not exist there wastes its time.\n not_on_drive: failed,\n });\n // Refresh the val's copy AFTER the drive stamp above, so the freshness table it publishes\n // describes the run that just finished rather than the one before it.\n await writeRuntimeDoc();\n return {\n ok: true, pulled, pushed, created, drive_files: files.length,\n // Byte-identical on both sides, so deliberately not touched and deliberately not counted above.\n // An empty pulled/pushed with a full list here is the sync WORKING, not the sync failing.\n unchanged,\n ignored_retired: retired,\n untouched_binary: untouched, // present in Drive, deliberately never read or written by the sync\n // Drive would not hand over the file, so this run knows nothing about it and changed nothing.\n unreadable_on_drive: unreadable,\n // Both sides differ but their clocks are effectively tied — nobody can tell which is the edit.\n undecidable,\n undecidable_note: undecidable.length\n ? \"Both copies differ and their timestamps are within two seconds, so the direction cannot be \" +\n \"known. Nothing was written. Edit whichever side is right and sync again.\"\n : null,\n\n failed_to_write: failed,\n write_failure_note: failed.length\n ? \"These did NOT reach Drive. A service account has no storage quota, so it can update files \" +\n \"Brandon owns but cannot create new ones. He must create the file in Drive once (any \" +\n \"content); after that this can keep it updated forever.\"\n : null,\n conflicts,\n // A conflict is not an error to be cleared — it means both sides hold real edits and a human\n // or an agent must merge them. Saying so loudly is the whole point.\n conflict_note: conflicts.length\n ? \"REFUSED TO OVERWRITE: Drive holds lines the val does not. Merge them, then sync again. \" +\n \"Nothing was lost.\"\n : null,\n };\n}\n\n// Canvas publishes a plain .ics feed. Parse out future-dated events; no dependencies.\nexport async function refreshCanvas(): Promise<{ count: number; error?: string }> {\n const feed = Deno.env.get(\"CANVAS_ICS_URL\");\n if (!feed) return { count: 0, error: \"CANVAS_ICS_URL not set\" };\n try {\n const res = await fetch(feed);\n if (!res.ok) return { count: 0, error: `feed returned ${res.status}` };\n const text = (await res.text()).replace(/\\r\\n[ \\t]/g, \"\"); // unfold RFC-5545 wrapped lines\n const items: any[] = [];\n for (const block of text.split(\"BEGIN:VEVENT\").slice(1)) {\n const get = (k: string) => (block.match(new RegExp(`\\\\n${k}[^:]*:(.*)`)) || [])[1]?.trim();\n const raw = get(\"DTSTART\") || get(\"DTEND\");\n const summary = get(\"SUMMARY\");\n if (!raw || !summary) continue;\n const day = `${raw.slice(0, 4)}-${raw.slice(4, 6)}-${raw.slice(6, 8)}`;\n const timed = raw.length >= 15;\n items.push({\n summary,\n due: timed ? `${day}T${raw.slice(9, 11)}:${raw.slice(11, 13)}:00Z` : day,\n all_day: !timed, // treat as 11:59pm LOCAL; do not convert, do not invent an offset\n course: get(\"DESCRIPTION\")?.slice(0, 120) || \"\",\n });\n }\n items.sort((a, b) => a.due.localeCompare(b.due));\n await blob.setJSON(\"brain_deadlines\", items);\n await stamp(\"canvas\", { count: items.length });\n return { count: items.length };\n } catch (e) {\n return { count: 0, error: String(e) };\n }\n}\n\n// The single call a fresh chat makes. Everything it needs to stop being a stranger: the operating order,\n// what is stale, what is due, and the exact URLs for the rest.\n// THE CAPABILITY REGISTER — what is PROVEN, and by what evidence; never what was intended. Brandon's\n// Project contract forbids substituting specified for built, built for tested, and deployed for\n// working, and this register is how a coach obeys that without guessing. Shared by /bootstrap and\n// RUNTIME.md: the bootstrap answer is cached by OpenAI's fetcher and the Drive copy is not, so both\n// must come from one place or they drift apart while each still looks official.\nfunction capabilityRegister(m2: any) {\n const unmerged = ((m2.drive?.unresolved as string[]) ?? []);\n const capAge = (k: string) => {\n const a = ageHours(m2[k]?.last_ok);\n return a === null ? \"never\" : `${Math.round(a * 10) / 10}h ago`;\n };\n return {\n read_documents: { status: \"WORKING\", evidence: \"ChatGPT fetched /export and created 26 Drive files from it\" },\n write_documents_drive: { status: \"WORKING\", evidence: \"ChatGPT recorded The Gables application into 4 files via Drive\" },\n write_documents_val: {\n status: \"NOT NEEDED\",\n note: \"ChatGPT writes to Drive; the sync carries it here. It never has to touch this server. \" +\n \"GET /write and /append still exist as a fallback if Drive or the connector is ever \" +\n \"unavailable, but no coach should use them in normal operation.\",\n },\n drive_val_sync: {\n status: unmerged.length ? \"DIVERGED\" : \"WORKING\",\n last_ok: capAge(\"drive\"),\n note: unmerged.length\n ? `UNMERGED, do NOT treat as current: ${unmerged.join(\", \")}. Merge by hand, never clear.`\n : \"both directions; refuses to overwrite unseen lines; text only, binaries untouched\",\n },\n phone_dashboard: { status: \"WORKING\", last_ok: capAge(\"dashboard\"), note: \"derived from STATE.md; editing STATE.md updates it\" },\n canvas_deadlines: { status: \"WORKING\", last_ok: capAge(\"canvas\") },\n daily_reachout_email: { status: \"WORKING\", last_ok: capAge(\"reachout\"), note: \"escalates with days quiet; one tap resets\" },\n reachout_sms: { status: \"NOT BUILT\", note: \"Val Town free tier refuses to send to any address but the owner's. Needs Twilio credentials.\" },\n truncation_sentinel: {\n status: \"VESTIGIAL\",\n note: \"Every /doc read ends with an END sentinel so a partial fetch is detectable. It was \" +\n \"built when ChatGPT read documents through a scrolling browser viewport. It now reads \" +\n \"Drive natively, so there is nothing partial to detect. Harmless; no longer load-bearing.\",\n },\n calendar_feed: { status: \"BUILT, SUBSCRIPTION UNVERIFIED\", note: \"/calendar.ics serves; whether his iPhone has subscribed has never been confirmed. It is also the traffic heartbeat.\" },\n scheduled_job: { status: \"UNVERIFIED\", note: \"Val Town exposes no schedule or execution history. Every trigger observed so far came from a manual call or a request. Do not assume it fires.\" },\n mailbox_sweep_backend: {\n status: \"NOT NEEDED\",\n note: \"This server has no mail integration and should not have one — ChatGPT reads Gmail and \" +\n \"Outlook directly through its own connectors. A backend copy would be a second, worse \" +\n \"version of a capability the coach already holds.\",\n where_sweep_state_lives: \"In the brain, as a record, not as an integration. After a sweep, \" +\n \"append to LEDGER.tsv: DATEsweepgmail|outlookwhat was found or 'nothing'\" +\n \"newest message date seen. The newest-message date is the important field: it is the \" +\n \"only way to tell an empty inbox from an unreachable one. On 2026-08-02 a sweep reported \" +\n \"'no candidates' while reading a 24-day-old snapshot, and nothing caught it.\",\n rule: \"An interactive search is not an autonomous sweep. Record what you actually read, \" +\n \"including the newest message date, and never report an unreachable mailbox as a quiet one.\",\n },\n backup: { status: \"WORKING\", last_ok: capAge(\"backup\"), note: \"weekly, emailed with every document and all source. Restore has never been drilled.\" },\n model_certification: { status: \"NEVER RUN\", note: \"tests/scenarios.md was last run 2026-07-06 on Sonnet. Nothing has been run against GPT-5.\" },\n };\n}\n\nasync function bootstrap(base: string, tok: string): Promise {\n const m = await meta();\n const docs = m.docs || {};\n const u = (p: string) => `${base}${p}${p.includes(\"?\") ? \"&\" : \"?\"}t=${tok}`;\n const canvasAge = ageHours(m.canvas?.last_ok);\n const deadlines = ((await blob.getJSON(\"brain_deadlines\").catch(() => null)) ?? []) as any[];\n // Brandon's day, not the server's. toISOString() is UTC and crosses midnight five hours early\n // in New York, which would silently advance the date and drop today's deadlines every evening.\n const now = new Intl.DateTimeFormat(\"en-CA\", { timeZone: \"America/New_York\" }).format(new Date());\n\n const m2 = await meta();\n\n return Response.json({\n policy_version: POLICY_VERSION,\n capabilities: capabilityRegister(m2),\n read_this_first: [\n \"You are Brandon Bui's career advisor. He is pre-CAA, has inattentive ADHD and autism, and\",\n \"does NOT read these files — they exist so you are aligned with what is true right now.\",\n \"READ THESE THREE, IN THIS ORDER, BEFORE ANY SUBSTANTIVE COACHING — about 16KB total:\",\n \"1) STATE.md — what needs ATTENTION now: the one thing, the #1 risk, open commitments with\",\n \"their first physical step, the numbers, the next deadlines.\",\n \"2) DECISIONS.md — what is ALREADY SETTLED. Read it before you open your mouth. Raising\",\n \"something marked RELITIGATE: NO is not thoroughness, it is the system failing to remember.\",\n \"3) PROFILE.md — WHO HE IS. Capable but afraid he isn't; that fear is the engine. Initiation\",\n \"is his #1 failure point. Read it or the tone law below is just an arbitrary instruction.\",\n \"4) LESSONS.md — what actually works on him.\",\n \"Load nothing else unless its trigger fires — see read_when_you_need_it. BRANDON_CONTEXT.md is the\",\n \"FULL profile and is there when you need it; it is large, not obsolete. CLAUDE.md and TRACKER.md\",\n \"ARE superseded: reading them gives you stale, contradictory state and burns your context.\",\n \"RECORDING: STATE.md and DECISIONS.md are REWRITTEN in full, never appended to — they are read\",\n \"every session and must never hold two answers to the same question. Events and hours are\",\n \"appended to LEDGER.tsv. Narrative goes in JOURNAL/. Record in the SAME TURN, or it is lost.\",\n \"EDITING STATE.md IS UPDATING HIS PHONE DASHBOARD — it renders from that file automatically.\",\n \"WHERE THIS LIVES: the real files are in his Google Drive folder 'career-advisor'. This server\",\n \"keeps a synced copy so it can read them instantly and do what Drive cannot — reach out to him,\",\n \"serve his calendar, feed his dashboard. Both sides are reconciled automatically before anything\",\n \"is read, so whichever you use, you are seeing what was written last. If a sync reports a\",\n \"CONFLICT it means both sides hold real edits: merge them by hand, never clear it.\",\n \"Never inflate him. Never send email, only draft. Say when a source is stale or unreachable.\",\n \"Every commitment carries a first physical step of two minutes or less.\",\n \"OWNERSHIP OF TRUTH — every fact has exactly ONE home:\",\n \"STATE.md owns current ATTENTION, NOT every current fact: the one thing, major risks, urgent\",\n \"deadlines, unresolved obligations. It may hold a short pointer to a domain fact while that\",\n \"fact needs attention. DOMAIN FILES OWN DOMAIN STATE — PIPELINE.md job and application status,\",\n \"CONTACTS.md where each relationship stands, PROGRAMS.md requirements and verified admissions\",\n \"facts, REFERENCE.md the stable schedule and plan shape, each other file its own subject.\",\n \"DECISIONS.md owns settled choices. LEDGER.tsv owns immutable event history. PIPELINE.md\",\n \"carrying a live job status is CORRECT: update it THERE, never copy it into STATE.md. WHEN TWO\",\n \"FILES DISAGREE, THE OWNER OF THAT FACT WINS — not automatically STATE.md. Say the discrepancy\",\n \"out loud, then FIX THE NON-OWNER the same turn. Never average two answers; never pick one\",\n \"quietly.\",\n \"TONE LAW: demanding and no-excuses about ACTION; warm and steady about the FEAR underneath.\",\n \"Shame increases avoidance — never harshness that shames, never softening of the facts. When\",\n \"he is avoiding, escalate in this order: name it plainly, shrink the step, do it together live\",\n \"this session, then stop pushing the task and work the fear under it. BOTH drifts are failures:\",\n \"softening into pleasant check-ins is collusion with avoidance, and demanding forward motion in\",\n \"a genuinely underwater week is damage.\",\n \"BEFORE ANY CONFRONTATION, ask outright: is this a can't-week or a won't-week? — and BELIEVE\",\n \"the answer. Exams, illness, family, work crush, or anything he names as drowning him means\",\n \"underwater: confrontation is FORBIDDEN, switch to the smallest real win. The moment he names\",\n \"any blocker, confrontation ends and you work the blocker. Be uncomfortable about the\",\n \"BEHAVIOUR, never about his worth.\",\n \"MEDICAL BOUNDARY: you are a coach, not a clinician. Never recommend or steer a medication,\",\n \"never second-guess his prescriber. Help him get his own history in front of them, and wrap any\",\n \"slow-feedback treatment in short-loop visible markers. If anything sounds darker than task\",\n \"anxiety, name it plainly and point at real professional help.\",\n \"LATE NIGHT: after about midnight, no new tasks — the map exists, everything on it has a date,\",\n \"sleep is the move.\",\n ].join(\" \"),\n today: now,\n // Far from your clock = CACHED payload. Say so.\n generated_at: new Date().toISOString(),\n read_order: [\"STATE.md\", \"DECISIONS.md\", \"PROFILE.md\", \"LESSONS.md\"],\n read_only_if_needed: [\"AGENTS.md\", \"ENGINES.md\", \"CONTACTS.md\", \"PIPELINE.md\", \"REFERENCE.md\"],\n // BRANDON_CONTEXT.md is NOT superseded — it is the full profile and the academic record, and\n // nothing replaced it. It is simply too large for every session. PROFILE.md carries its durable\n // core; this is where you go for the rest.\n read_when_you_need_it: {\n \"BRANDON_CONTEXT.md\": \"the full profile: academic record, program requirements, his own words\",\n \"AGENTS.md\": \"how the system works\",\n \"CONTACTS.md\": \"anything involving a person\",\n \"PIPELINE.md\": \"the job hunt\",\n \"REFERENCE.md\": \"schedule, plan shape, costs\",\n \"ENGINES.md\": \"what capabilities exist and how to change one\",\n },\n superseded_do_not_read: {\n \"CLAUDE.md\": \"the old operating prompt — 43% of it names tools and models that no longer exist\",\n \"TRACKER.md\": \"74KB predecessor, self-contradictory; kept only as an archive\",\n },\n doc_urls: Object.fromEntries(\n Object.keys(docs).sort().map((n) => [n, u(`/doc?name=${encodeURIComponent(n)}`)]),\n ),\n how_to_record: {\n log_an_event: `${u(\"/append?name=LEDGER.tsv&text=DATE%09kind%09subject%09value%09source\")}`,\n rewrite_state: `${u(\"/write?name=STATE.md&text=THE+WHOLE+NEW+FILE\")}`,\n rewrite_decisions: `${u(\"/write?name=DECISIONS.md&text=THE+WHOLE+NEW+FILE\")}`,\n journal_this_month: `${u(`/append?name=${new Date().toISOString().slice(0, 7)}.md&text=YOUR+ENTRY`)}`,\n if_refused_409: \"You submitted far less than the file currently holds. That is almost always a \" +\n \"mistake. Re-read the doc, produce the COMPLETE new version, and only add &force=1 if you \" +\n \"genuinely intend to replace the whole thing.\",\n note: \"STATE.md and DECISIONS.md are REWRITTEN whole. Only LEDGER.tsv and JOURNAL/ are appended to.\",\n },\n freshness: {\n canvas_age_hours: canvasAge === null ? null : Math.round(canvasAge * 10) / 10,\n canvas_status: canvasAge === null\n ? \"NEVER_READ\"\n : canvasAge > STALENESS_BUDGET_HOURS.canvas\n ? \"STALE\"\n : \"fresh\",\n warning: canvasAge !== null && canvasAge > STALENESS_BUDGET_HOURS.canvas\n ? \"Canvas is STALE. Do not report deadlines as current or the list as empty. Say it is stale.\"\n : null,\n full_report_url: u(\"/fresh\"),\n },\n upcoming_deadlines: deadlines.filter((d: any) => String(d.due).slice(0, 10) >= now).slice(0, 12),\n // ChatGPT's web reader cached this and served a pre-fix payload for an hour, with no way to\n // bust it. A runtime contract that can be cached is not a runtime contract.\n }, { headers: { \"cache-control\": \"no-store, max-age=0\" } });\n}\n\n// Record every hit in a ring buffer, in its OWN blob key — never brain_meta, which the doc index lives in\n// and which is already doing unsynchronised read-modify-write. This exists to settle the one assumption\n// the whole design rests on: that ChatGPT will actually fetch these URLs, and will actually issue the\n// state-changing GET that records a note. Every failure here is SILENT — a model that says \"recorded it\"\n// and didn't looks identical to one that did. Only the server knows the difference, and for a system whose\n// entire job is being the memory, that is the only distinction that matters. Read it at /log.\nasync function note_hit(req: Request, url: URL, viaHeader: boolean, authNote?: string) {\n try {\n const hits = ((await blob.getJSON(HITS_KEY).catch(() => null)) ?? []) as any[];\n hits.push({\n ts: new Date().toISOString(),\n method: req.method,\n path: url.pathname,\n q: url.searchParams.get(\"name\") || url.searchParams.get(\"text\")?.slice(0, 60) || \"\",\n auth: authNote ?? (viaHeader ? \"header (Action)\" : \"query (browsing)\"),\n ua: (req.headers.get(\"user-agent\") || \"\").slice(0, 120),\n });\n await blob.setJSON(HITS_KEY, hits.slice(-HITS_KEEP));\n } catch { /* diagnostics must never break a real request */ }\n}\n\n// ═══ RUNTIME.md — THE RUNTIME PUBLISHING ITSELF AS A DOCUMENT ═══\n// Why a FILE and not just /bootstrap: ChatGPT reads Drive through a connector, and OpenAI's fetcher\n// caches /bootstrap with no reliable way to bust it — it served an hour-old payload repeatedly.\n// Drive reads are not cached, so anything the coach must see RELIABLY has to arrive as a document.\n// This is an ordinary doc, so the sync that already exists carries it there.\nconst RUNTIME_DOC = \"RUNTIME.md\";\n\nexport async function writeRuntimeDoc(): Promise {\n try {\n const m = await meta();\n const gen = new Date().toISOString();\n const today = new Intl.DateTimeFormat(\"en-CA\", { timeZone: \"America/New_York\" }).format(new Date());\n const fr = freshnessReport(m);\n const dl = ((await blob.getJSON(\"brain_deadlines\").catch(() => null)) ?? []) as any[];\n const due = dl.filter((d: any) => String(d.due).slice(0, 10) >= today).slice(0, 12);\n const div = fr.filter((r) => r.diverged.length).flatMap((r) => r.diverged);\n // Split the one \"unresolved\" list into the two different problems it actually holds.\n const nod = ((m.drive?.not_on_drive as string[]) ?? []).filter((n) => div.includes(n));\n const merge = div.filter((n) => !nod.includes(n));\n\n const text = [\n \"# RUNTIME.md — GENERATED BY THE SERVER, DO NOT EDIT\",\n \"\",\n `Written by the career-brain val itself at **${gen}** (his date, America/New_York: **${today}**).`,\n \"Nothing here is typed by a human; every edit is overwritten on the next run.\",\n \"\",\n \"**IF THAT TIMESTAMP IS MORE THAN ~26 HOURS OLD THE RUNTIME IS NOT REPORTING.** Say so plainly\",\n \"rather than treating anything below as current — a stale copy of this file looks exactly like a\",\n \"healthy one, which is why it carries its own generation time.\",\n \"\",\n `policy_version: **${POLICY_VERSION}**`,\n \"\",\n \"## Freshness by source\",\n \"\",\n \"| source | age (h) | budget (h) | status |\",\n \"|---|---|---|---|\",\n ...fr.map((r) =>\n `| ${r.source} | ${r.age_hours ?? \"never read\"} | ${r.budget_hours} | ${r.status}${\n r.diverged.length ? ` — ${r.diverged.join(\", \")}` : \"\"\n } |`),\n \"\",\n merge.length\n ? `**DIVERGED — both sides hold real edits to these and they were NOT merged: ${merge.join(\", \")}.** ` +\n \"Treat neither copy as current, never clear the conflict, merge them by hand.\"\n : \"No unmerged val/Drive conflict recorded.\",\n \"\",\n nod.length\n ? `**NOT ON DRIVE — these live on the val but could not be created in Drive: ${nod.join(\", \")}.** ` +\n \"The service account has zero storage quota, so it can update files Brandon owns but cannot \" +\n \"create new ones. Brandon must create each one in the Drive folder once, empty; after that \" +\n \"they maintain themselves. Until then the coach cannot see them in Drive at all.\"\n : \"Every val document exists in Drive.\",\n \"\",\n \"## Capability register (statuses verbatim)\",\n \"\",\n ...Object.entries(capabilityRegister(m)).map(([k, v]: any) =>\n `- **${k}** — ${v.status}${v.last_ok ? ` (last ok ${v.last_ok})` : \"\"}`),\n \"\",\n \"## Deadline watcher\",\n \"\",\n \"**NOT BUILT.** No page is being watched. The 2027–28 CASAA cycle dates and every program\",\n \"deadline in PROGRAMS.md are still unwatched, so nothing here will tell you when one is\",\n \"published or changed — check them yourself and never treat a PROGRAMS.md date as current.\",\n \"\",\n `## Next deadlines from Canvas (${due.length})`,\n \"\",\n ...(due.length\n ? due.map((d: any) => `- ${String(d.due).slice(0, 10)} — ${d.summary}`)\n : [\"- none recorded. If the canvas row above is STALE or NEVER_READ, this is not evidence of a quiet week.\"]),\n \"\",\n ].join(\"\\n\");\n\n await saveDoc(RUNTIME_DOC, text, await readDoc(RUNTIME_DOC));\n } catch { /* the runtime's self-report must never break the run it describes */ }\n}\n\n// SECOND, INDEPENDENT TRIGGER — the system drives itself off its own traffic. The scheduled job is a\n// single point of failure that cannot be inspected: Val Town's API exposes no schedule, no execution\n// history, and no way to confirm the interval is even set. Every freshness timestamp on this val so far\n// came from a manual call. So \"it runs without him\" rested entirely on a scheduler nobody had ever seen\n// fire. This makes any incoming request able to do the day's work if it is overdue. The point is what\n// generates that traffic: his iPhone subscribes to /calendar.ics once, and iOS re-fetches it on its own\n// forever.\nasync function runDueWork(trigger: string): Promise {\n try {\n const m = await meta();\n const age = ageHours(m.reachout?.last_ok);\n if (age !== null && age < 20) return; // nothing due; costs one blob read\n // BEFORE syncDrive, deliberately. syncDrive pushes documents as it finds them, so a RUNTIME.md\n // written after it would sit on the val for a full day and reach Drive already ~24h old — old\n // enough to trip its own \"the runtime is not reporting\" rule while the runtime was fine.\n // Writing it here means this same sync carries it up seconds later.\n await writeRuntimeDoc();\n await syncDrive(); // FIRST — everything below reads STATE.md, which Drive may have newer\n await refreshCanvas();\n const r = await dailyReachOut();\n await pushDashboard();\n const mm = await meta();\n mm.last_trigger = { at: new Date().toISOString(), by: trigger, result: r?.ok ?? false };\n await blob.setJSON(META_KEY, mm);\n } catch { /* a diagnostic backstop must never break the request it rode in on */ }\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n\n // Calendar clients cannot send auth headers, so the feed authenticates by the token already in\n // its subscribe URL. It is READ-ONLY and exposes only deadlines and the current focus line —\n // no profile, no history, no write route. Handled before the generic auth gate because iOS\n // re-fetches it unattended forever and must never be told 401.\n if (req.method === \"GET\" && url.pathname === \"/calendar.ics\") {\n if (url.searchParams.get(\"t\") !== token()) return deny();\n await runDueWork(\"calendar poll (iPhone)\");\n const state = (await readDoc(\"STATE.md\")) ?? \"\";\n const items = ((await blob.getJSON(\"brain_deadlines\").catch(() => null)) ?? []) as any[];\n return new Response(icsFeed(state, items), {\n headers: {\n \"content-type\": \"text/calendar; charset=utf-8\",\n \"cache-control\": \"no-cache\",\n },\n });\n }\n\n // Rejected attempts are logged too. Without this, \"nothing ever connected\" and \"something\n // connected and was turned away\" look identical from the log — and those are completely\n // different diagnoses. A client that tried and failed must not leave zero trace.\n if (!authed(url, req)) {\n await note_hit(req, url, false, \"REJECTED-401\");\n return deny();\n }\n const path = url.pathname;\n if (path !== \"/log\") {\n await note_hit(req, url, !url.searchParams.get(\"t\"));\n }\n\n if (path !== \"/log\" && path !== \"/selfcheck\") await runDueWork(`request ${path}`);\n\n if (req.method === \"GET\" && path === \"/sync\") {\n return Response.json(await syncDrive());\n }\n\n if (req.method === \"GET\" && path === \"/log\") {\n const hits = ((await blob.getJSON(HITS_KEY).catch(() => null)) ?? []) as any[];\n const chatgpt = hits.filter((x) => /openai|chatgpt|gptbot/i.test(x.ua || \"\"));\n const writes = hits.filter((x) => x.path === \"/append\" || x.path === \"/write\");\n // How much history this log actually has. Zero ChatGPT hits in a window that only opened this\n // morning is \"nothing yet\", not \"never\" — the verdict below is not allowed to confuse them.\n const windowH = ageHours(hits[0]?.ts);\n const windowAge = windowH === null\n ? \"the log is empty — no request of any kind has been recorded yet\"\n : `the window is only ${Math.round(windowH * 10) / 10}h old (since ${hits[0].ts})`;\n return Response.json({\n total: hits.length,\n // Stated so absence can never again be mistaken for proof. If the buffer is full, the log\n // covers only a window and older traffic HAS been discarded.\n window_start: hits[0]?.ts ?? null,\n buffer_full: hits.length >= HITS_KEEP,\n caveat: hits.length >= HITS_KEEP\n ? \"BUFFER SATURATED — older requests have been evicted. Absence of a hit is NOT evidence it never happened.\"\n : `Complete history since ${hits[0]?.ts ?? \"first request\"}.`,\n from_chatgpt: chatgpt.length,\n writes_attempted: writes.length,\n writes_from_chatgpt: writes.filter((x) => /openai|chatgpt|gptbot/i.test(x.ua || \"\")).length,\n verdict: chatgpt.length === 0\n ? (windowH === null || windowH < LOG_VERDICT_MIN_WINDOW_HOURS\n ? `TOO YOUNG TO CONCLUDE — no ChatGPT hit is recorded, but ${windowAge}, under the ` +\n `${LOG_VERDICT_MIN_WINDOW_HOURS}h this log needs before absence means anything. ` +\n \"This is NOT evidence that ChatGPT has never connected. Check again later.\"\n : \"ChatGPT has NEVER reached this server. Reading is not working.\")\n // Zero writes HERE is CORRECT: ChatGPT records by editing Drive, and the register marks\n // write_documents_val NOT NEEDED. The old verdict judged the system against a path it\n // does not use, and so called a healthy state broken.\n : \"ChatGPT reads here and RECORDS BY EDITING DRIVE — the designed path. Zero writes here is CORRECT; check /sync for arriving Drive edits.\",\n // Stats over EVERY hit, not a window. The previous version returned only the last 40 and\n // was read as if it were the whole history — that produced a confident, wrong conclusion.\n user_agents: Object.entries(\n hits.reduce((a: any, h: any) => {\n const k = (h.ua || \"(empty)\").slice(0, 90);\n a[k] = (a[k] || 0) + 1;\n return a;\n }, {}),\n ).sort((a: any, b: any) => b[1] - a[1]),\n export_hits: hits.filter((h: any) => h.path === \"/export\")\n .map((h: any) => ({ ts: h.ts, ua: h.ua, auth: h.auth })),\n recent: hits.slice(-40).reverse(),\n });\n }\n const p = url.searchParams;\n const force = p.get(\"force\") === \"1\";\n\n if (req.method === \"GET\" && (path === \"/bootstrap\" || path === \"/\")) {\n return bootstrap(url.origin, token());\n }\n\n if (req.method === \"GET\" && path === \"/docs\") {\n const m = await meta();\n const docs = m.docs || {};\n return Response.json({\n docs: Object.entries(docs).map(([name, d]: any) => ({\n name, bytes: d.bytes, written: d.written, age_hours: Math.round((ageHours(d.written) ?? 0) * 10) / 10,\n })),\n });\n }\n\n if (path === \"/doc\") {\n const name = p.get(\"name\");\n if (!name) return Response.json({ error: \"name required\" }, { status: 400 });\n\n if (req.method === \"GET\") {\n const text = await readDoc(name);\n if (text === null) return Response.json({ error: \"no such doc: \" + name }, { status: 404 });\n // TRUNCATION TRIPWIRE. ChatGPT's browsing tool is a scrolling VIEWPORT, not a download: it\n // reads one window of a page and decides for itself when it has seen enough. A 73KB file\n // routinely arrives PARTIAL, and the model then summarizes what it got as if it were the\n // whole thing — a wrong answer delivered confidently, which is this system's worst failure\n // mode. So every read ends with a sentinel naming the true byte count. A reader that cannot\n // see the sentinel did not receive the whole document and must say so instead of coaching.\n // Appended at serve time only — never stored, so file hashes and sync are unaffected.\n const bytes = new TextEncoder().encode(text).length;\n const sealed = `${text}\\n\\n` +\n `\\n`;\n return new Response(sealed, { headers: { \"content-type\": \"text/plain; charset=utf-8\" } });\n }\n\n if (req.method === \"PUT\" || req.method === \"POST\") {\n const text = await req.text();\n const prev = await readDoc(name);\n const tooBig = ceilingGuard(name, text);\n if (tooBig) return tooBig;\n const refused = shrinkGuard(name, prev, text, force);\n if (refused) return refused;\n await saveDoc(name, text, prev);\n return Response.json({ ok: true, name, bytes: text.length, previous_bytes: prev?.length ?? 0 });\n }\n }\n\n // GET-reachable overwrite, so a browsing-only surface can still edit. Same guard as PUT /doc.\n if (req.method === \"GET\" && path === \"/write\") {\n const name = p.get(\"name\");\n const text = p.get(\"text\");\n if (!name || text === null) return Response.json({ error: \"name and text required\" }, { status: 400 });\n const prev = await readDoc(name);\n const tooBig = ceilingGuard(name, text);\n if (tooBig) return tooBig;\n const refused = shrinkGuard(name, prev, text, force);\n if (refused) return refused;\n await saveDoc(name, text, prev);\n return Response.json({ ok: true, name, bytes: text.length, previous_bytes: prev?.length ?? 0 });\n }\n\n // Append accepts POST (body) or GET (?text=) — the GET form is what makes a plain ChatGPT\n // Project able to record, since its browsing tool cannot POST.\n if (path === \"/append\" && (req.method === \"POST\" || req.method === \"GET\")) {\n const name = p.get(\"name\");\n if (!name) return Response.json({ error: \"name required\" }, { status: 400 });\n const add = req.method === \"GET\" ? (p.get(\"text\") ?? \"\") : await req.text();\n if (!add.trim()) return Response.json({ error: \"empty body\" }, { status: 400 });\n const prev = await readDoc(name);\n if (prev === null) return Response.json({ error: \"no such doc: \" + name }, { status: 404 });\n const text = prev + \"\\n\" + add.trimEnd() + \"\\n\";\n await saveDoc(name, text, prev);\n return Response.json({ ok: true, name, appended: add.length, bytes: text.length });\n }\n\n if (req.method === \"GET\" && path === \"/versions\") {\n const name = p.get(\"name\");\n if (!name) return Response.json({ error: \"name required\" }, { status: 400 });\n const hist = ((await blob.getJSON(HIST_PREFIX + name).catch(() => null)) ?? []) as any[];\n const cur = await readDoc(name);\n return Response.json({\n name,\n current_bytes: cur?.length ?? 0,\n versions: hist.map((h) => ({ ts: h.ts, bytes: h.bytes })).reverse(),\n restore_url_pattern: `${url.origin}/restore?name=${encodeURIComponent(name)}&ts=&t=`,\n });\n }\n\n if (req.method === \"GET\" && path === \"/restore\") {\n const name = p.get(\"name\");\n const ts = p.get(\"ts\");\n if (!name || !ts) return Response.json({ error: \"name and ts required\" }, { status: 400 });\n const hist = ((await blob.getJSON(HIST_PREFIX + name).catch(() => null)) ?? []) as any[];\n const hit = hist.find((h) => h.ts === ts);\n if (!hit) {\n return Response.json({\n error: \"no such version\",\n available: hist.map((h) => h.ts),\n }, { status: 404 });\n }\n const prev = await readDoc(name);\n await saveDoc(name, String(hit.text), prev); // the bad version itself becomes restorable\n return Response.json({ ok: true, name, restored_to: ts, bytes: String(hit.text).length });\n }\n\n if (req.method === \"GET\" && path === \"/export\") {\n const docs = await exportAll();\n return Response.json({\n exported_at: new Date().toISOString(),\n count: Object.keys(docs).length,\n docs,\n });\n }\n\n // One tap from the daily email. The ONLY thing that resets the escalation ladder, which is why\n // silence can never be read as \"he's fine.\"\n if (req.method === \"GET\" && path === \"/ack\") {\n const mm = await meta();\n const prev = ageHours(mm.ack?.last_ok);\n mm.ack = { last_ok: new Date().toISOString() };\n await blob.setJSON(META_KEY, mm);\n return new Response(\n \"Got it — you're here.\\n\\n\" +\n (prev === null ? \"Clock started.\" : `It had been ${Math.floor(prev / 24)} day(s).`) +\n \"\\n\\nNothing else needed. Close this.\",\n { headers: { \"content-type\": \"text/plain; charset=utf-8\" } },\n );\n }\n\n if (req.method === \"GET\" && path === \"/reachout\") {\n return Response.json(await dailyReachOut(p.get(\"force\") === \"1\"));\n }\n\n if (req.method === \"GET\" && path === \"/dashboard\") {\n return Response.json(await pushDashboard());\n }\n\n if (req.method === \"GET\" && path === \"/backup\") {\n return Response.json(await backupByEmail(\"manual /backup call\"));\n }\n\n // Junk accumulates (probe docs, test files) and every stray name shows up in /bootstrap's\n // doc list, where it wastes a model's attention. No way to clean it from a phone otherwise.\n if (req.method === \"GET\" && path === \"/delete\") {\n const name = p.get(\"name\");\n if (!name) return Response.json({ error: \"name required\" }, { status: 400 });\n const prev = await readDoc(name);\n if (prev === null) return Response.json({ error: \"no such doc: \" + name }, { status: 404 });\n const m = await meta();\n if (m.docs) delete m.docs[name];\n await blob.setJSON(META_KEY, m);\n await blob.delete(DOC_PREFIX + name).catch(() => {});\n // History survives deletion on purpose: a delete is recoverable, same as a bad overwrite.\n return Response.json({ ok: true, deleted: name, was_bytes: prev.length, history_kept: true });\n }\n\n // SELF-CHECK — does the entrypoint's own contract hold? Added because it was broken the moment it was\n // written: PROFILE.md was added to the mandatory read order and never added to the deploy list, so the\n // bootstrap confidently instructed every cold agent to read a document that returned 404. The agent\n // would have coached without the one file explaining who Brandon is, and nothing anywhere would have\n // said so. Pointing at a document is a promise. This verifies the promise instead of trusting it.\n if (req.method === \"GET\" && path === \"/selfcheck\") {\n const m = await meta();\n const docs = m.docs || {};\n const required = [\"STATE.md\", \"DECISIONS.md\", \"PROFILE.md\", \"LESSONS.md\"];\n const missing = required.filter((n) => !docs[n]);\n const onDemand = [\"BRANDON_CONTEXT.md\", \"AGENTS.md\", \"CONTACTS.md\", \"PIPELINE.md\", \"REFERENCE.md\", \"ENGINES.md\"];\n const missingOptional = onDemand.filter((n) => !docs[n]);\n const stateBytes = docs[\"STATE.md\"]?.bytes ?? 0;\n return Response.json({\n ok: missing.length === 0 && missingOptional.length === 0 && stateBytes > 0 && stateBytes <= 6000,\n mandatory_read_resolves: missing.length === 0,\n missing_mandatory: missing,\n missing_on_demand: missingOptional,\n state_bytes: stateBytes,\n state_within_ceiling: stateBytes > 0 && stateBytes <= 6000,\n verdict: missing.length\n ? `BROKEN — the bootstrap tells agents to read ${missing.join(\", \")}, which do not exist.`\n : missingOptional.length\n ? `Mandatory read is intact; these on-demand docs are missing: ${missingOptional.join(\", \")}.`\n : \"Every document the bootstrap names exists and STATE.md is within its ceiling.\",\n });\n }\n\n // CONTRADICTION SCAN — two files can be byte-perfect in sync and still say opposite things. Three such\n // drifts happened in one night (physics waitlist, a killed CNA decision, a settled ruling STATE.md\n // invited an agent to overturn), each from copying a fact into a second file instead of pointing at the\n // first. Every one was caught by Brandon asking. That is not a control. KNOWN DEFECT — DO NOT TRUST ITS\n // OUTPUT. It enforces the SUPERSEDED rule that only STATE.md DECISIONS.md may carry status, so\n // PIPELINE.md doing its job scores as a fault: 9 subjects, 39 hits, nearly all correct. Domain files DO\n // own domain state.\n if (req.method === \"GET\" && path === \"/contradictions\") {\n const SUBJECTS = [\n \"physics\", \"PHY2053\", \"CNA\", \"parasitology\", \"Medi-Gators\", \"BioLife\", \"KEDPLASMA\",\n \"Crisis Text Line\", \"The Gables\", \"GRE\", \"MDU4004\", \"Hospitaliteam\", \"shadowing\",\n ];\n const STATUS = /\\b(open|closed|waitlist|waitlisted|submitted|rejected|pending|secured|blocked|due|deadline|not secured|killed|resolved|skipped)\\b/i;\n const AUTHORITY = [\"STATE.md\", \"DECISIONS.md\"];\n const m = await meta();\n const names = Object.keys(m.docs || {}).filter((n) =>\n !n.startsWith(\"code/\") && !/^(CLAUDE|TRACKER|BRANDON_CONTEXT|RUNTIME)\\.md$/.test(n) && /\\.(md|tsv)$/i.test(n)\n );\n const texts: Record = {};\n for (const n of names) texts[n] = (await readDoc(n)) ?? \"\";\n\n const findings: any[] = [];\n for (const subj of SUBJECTS) {\n const claimants: string[] = [];\n for (const n of names) {\n for (const line of texts[n].split(\"\\n\")) {\n if (line.toLowerCase().includes(subj.toLowerCase()) && STATUS.test(line)) {\n claimants.push(n);\n break;\n }\n }\n }\n const outside = claimants.filter((n) => !AUTHORITY.includes(n));\n if (claimants.length > 1 && outside.length) {\n findings.push({ subject: subj, claimed_in: claimants, should_only_be_in: AUTHORITY, offenders: outside });\n }\n }\n return Response.json({\n checked: names.length,\n contradictions: findings.length,\n verdict: findings.length\n ? `${findings.length} subject(s) carry a live status outside STATE.md/DECISIONS.md. Each is a place two files can disagree.`\n : \"No tracked subject carries a live status outside STATE.md and DECISIONS.md.\",\n findings,\n });\n }\n\n if (req.method === \"GET\" && path === \"/fresh\") {\n const report = freshnessReport(await meta());\n const bad = report.filter((r) => r.status !== \"fresh\").map((r) => r.source);\n return Response.json({\n checked_at: new Date().toISOString(),\n // Which mechanism actually did the work. If this only ever says \"request ...\" then Val Town's\n // scheduler is not firing and the calendar poll is carrying the whole system.\n last_trigger: (await meta()).last_trigger ?? null,\n all_fresh: bad.length === 0,\n // Spelled out so a model reading this cannot mistake a blind read for a quiet one.\n warning: bad.length\n ? `DO NOT report these as up to date or empty: ${bad.join(\", \")}. Say the source is stale or unreachable.`\n : null,\n sources: report,\n });\n }\n\n if (req.method === \"GET\" && path === \"/deadlines\") {\n const m = await meta();\n const age = ageHours(m.canvas?.last_ok);\n const items = (await blob.getJSON(\"brain_deadlines\").catch(() => null)) ?? [];\n return Response.json({\n last_ok: m.canvas?.last_ok ?? null,\n age_hours: age === null ? null : Math.round(age * 10) / 10,\n status: age === null ? \"NEVER_READ\" : age > STALENESS_BUDGET_HOURS.canvas ? \"STALE\" : \"fresh\",\n items,\n });\n }\n\n if (req.method === \"POST\" && path === \"/refresh\") {\n return Response.json(await refreshCanvas());\n }\n\n return new Response(\"404\", { status: 404 });\n}\n","deleted","label",[116],"93c101d5-90f2-4300-aaf3-1325bb949d67","cron.tsx","04e91a12-8ecd-11f1-82da-1607ee4eb77e",32,["D",1785733798599],4,"interval","/**\n * career-brain — scheduled maintenance.\n *\n * This is the piece that makes the system self-updating: it runs on Val Town's schedule with no\n * laptop, no app open, and nothing for Brandon to maintain. It re-reads Canvas and re-stamps the\n * freshness clock, so /fresh can tell any agent the truth about how current the data is.\n *\n * It also owns the backup. The backup is deliberately NOT on its own schedule — this job just\n * asks \"has a week passed?\" every time it runs. That way the whole maintenance story is one\n * scheduled thing instead of two, and changing how often this fires can never silently strand\n * the backup. Per LESSONS.md, none of this may ever require Brandon to remember anything.\n */\nimport { backupByEmail, backupIsDue, dailyReachOut, pushDashboard, refreshCanvas, syncDrive } from \"./main.tsx\";\n\nexport default async function () {\n // Drive first, always. Everything after this reads STATE.md, and ChatGPT may have rewritten it\n // on his phone since the last run. Reading before syncing means acting on yesterday's brain.\n const drive = await syncDrive();\n console.log(`[career-brain] drive sync: ${JSON.stringify(drive)}`);\n\n const canvas = await refreshCanvas();\n console.log(`[career-brain] canvas refresh: ${JSON.stringify(canvas)}`);\n\n // The reach-out goes FIRST and is never conditional on anything above succeeding. If Canvas is\n // down, he still hears from the system; a silent day is the one outcome that is not allowed.\n const reach = await dailyReachOut();\n console.log(`[career-brain] reach-out: ${JSON.stringify(reach)}`);\n\n // Keep the phone dashboard fed from STATE.md. Its only previous writer was a Claude session on\n // the Mac, so without this it freezes on 2026-08-04 and keeps presenting that day as today.\n const dash = await pushDashboard();\n console.log(`[career-brain] dashboard: ${JSON.stringify(dash)}`);\n\n if (await backupIsDue()) {\n const backup = await backupByEmail(\"weekly automatic backup\");\n console.log(`[career-brain] backup: ${JSON.stringify(backup)}`);\n }\n}\n",[132],"pulls",1,"forks","envVars",{"_147":149,"_150":53},"connections",{"_147":53,"_148":53},"count","unfilledCount",7,"emptyCount",{"_20":131,"_13":132,"_117":133,"_118":-5,"_119":21,"_120":134,"_121":49,"_22":157,"_29":136,"_124":137,"_126":138,"_128":38,"_129":-5,"_154":158,"_90":159},{"_20":115,"_13":116,"_117":47,"_118":-5,"_119":21,"_120":30,"_121":49,"_22":153,"_29":123,"_124":125,"_126":127,"_128":38,"_129":-5,"_154":155,"_90":156},["D",1785759311333],"children",[],[116],["D",1785733798599],[],[132],["D",1785714626601],{"_11":12,"_88":84},{"_11":12,"_81":82,"_83":84,"_44":45,"_85":86,"_87":38},{"_29":30,"_13":26,"_20":21,"_27":28,"_31":-5,"_32":-5,"_76":-5,"_77":-5,"_78":-5,"_79":14,"_80":12},"ctx",{"_69":-5,"_110":197,"_198":199,"_200":201,"_202":38,"_203":38,"_204":38,"_205":49,"_206":-5,"_207":-7,"_208":-7,"_209":53,"_210":38,"_211":38,"_212":-5,"_213":38,"_214":38,"_215":38,"_216":-5},"ENV",{"_168":169,"_170":171,"_172":26,"_173":174,"_175":176,"_177":178,"_179":180,"_181":182,"_183":184,"_185":186,"_187":188,"_189":190,"_191":192,"_193":194,"_195":196},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","71c1b20804b3232a7e513be260cfffc1932a9e97","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Branches1

Branches
1