fix(kanban): widen notifier pre-filter to secondary-profile platforms

[srojk34]

Summary

• Follow-up to the just-merged kanban profile-routing salvage (feat(kanban): route notifications via owning profile + wake creator agent #54872 / fix(kanban): route notifications via owning profile + wake creator agent (salvage #54872) #56531 / security(browser): re-check private-network guard after browser_back navigation #56526's sibling review pass), which fixed the delivery-side adapter lookup to route through the shared _authorization_adapter chokepoint (gateway/authz_mixin.py) so a secondary profile's subscription is never silently delivered by the default profile's bot.
• That fix left an earlier gate untouched: _kanban_notifier_watcher's _collect() pre-filters subscriptions by active_platforms, a set built only from self.adapters (the default/active profile). A subscription owned by a secondary profile on a platform the default profile never connected at all (e.g. profile beta has a live Discord adapter, but the default profile has no Discord adapter) is dropped by this pre-filter before claim_unseen_events_for_sub is ever called.
• Unlike the already-guarded disconnected-adapter path (which rewinds an already-claimed event so it retries next tick), an unclaimed event here has nothing to rewind — the subscription is skipped every tick, forever, as long as the default profile's adapter set doesn't change. This is a silent, permanent loss of the task's terminal notification and creator-wake, directly contradicting the stated purpose of routing notifications via the owning profile.
• Fix: widen active_platforms to the union of self.adapters and every platform present across self._profile_adapters.values(). This is intentionally a coarse pre-filter — the precise per-profile chokepoint (_authorization_adapter, which still forbids default-profile fallback) runs unchanged at delivery time a few lines below, with its existing rewind-on-None safety net for any sub that over-admits here but doesn't actually have a live adapter.

Test plan

• Added test_notifier_claims_platform_only_a_secondary_profile_owns to tests/gateway/test_kanban_notifier.py, reproducing the exact scenario (default profile has telegram only, secondary profile beta has a live discord adapter, sub is owned by beta on discord).
• Mutation-verified: reverting the kanban_watchers.py change makes the new test fail (assert 0 == 1, adapter never receives the notification); passes with the fix.
• Ran the full existing tests/gateway/test_kanban_notifier.py suite (8 tests, including test_notifier_owning_profile_adapter_no_default_fallback) — all pass, no regressions.
• Ran the broader tests/gateway/ -k kanban suite (22 passed, 2 skipped) — no regressions.

[teknium1]

Thanks for the focused follow-up. The premise is confirmed on current main: gateway/kanban_watchers.py:201-204 derives active_platforms only from the active/default self.adapters, and :264-270 skips a secondary-profile subscription before claim_unseen_events_for_sub can claim it. The proposed union is at the correct coarse-filter layer.

The delivery invariant remains intact: gateway/kanban_watchers.py:313-335 resolves through _authorization_adapter and rewinds a claim when the owning profile has no matching adapter. The new regression test exercises the missing default-Telegram/secondary-Discord case and asserts delivery through beta's adapter.

Automated hermes-sweeper review.

[teknium1]

Merged via PR #72241 — your commit was cherry-picked onto current main with your authorship preserved. The widened pre-filter stops secondary-profile events being silently lost (claimed, never rewound). Thanks!