@open-mercato/core 0.7.0 → 0.7.1-develop.7102.1.b41f7e3e51

package/src/modules/business_rules/lib/expression-evaluator.ts

@@ -1,7 +1,7 @@
 import type { ComparisonOperator, LogicalOperator } from '../data/validators'
 import { testLinearRegex } from '@open-mercato/shared/lib/regex/linear'
 import { getNestedValue, resolveSpecialValue } from './value-resolver'
-import { createLogger } from '@open-mercato/shared/lib/logger'
+import { createLogger, isLevelEnabled } from '@open-mercato/shared/lib/logger'
 
 const logger = createLogger('business_rules').child({ component: 'expression-evaluator' })
 
@@ -86,14 +86,14 @@ function evaluateSimpleCondition(
 
   const result = applyOperator(leftValue, condition.operator, rightValue)
 
-  logger.debug('Simple condition evaluated', {
-    field: condition.field,
-    operator: condition.operator,
-    expectedValue: rightValue,
-    actualValue: leftValue,
-    actualValueType: typeof leftValue,
-    passed: result,
-  })
+  if (isLevelEnabled('debug')) {
+    logger.debug('Simple condition evaluated', {
+      field: condition.field,
+      operator: condition.operator,
+      actualValueType: typeof leftValue,
+      passed: result,
+    })
+  }
 
   return result
 }

package/src/modules/business_rules/lib/rule-evaluator.ts

@@ -1,6 +1,6 @@
 import type { BusinessRule } from '../data/entities'
 import { evaluateExpression, type EvaluationContext, type ConditionExpression } from './expression-evaluator'
-import { createLogger } from '@open-mercato/shared/lib/logger'
+import { createLogger, isLevelEnabled } from '@open-mercato/shared/lib/logger'
 
 const logger = createLogger('business_rules').child({ component: 'rule-evaluator' })
 
@@ -105,14 +105,15 @@ export async function evaluateSingleRule(
 ): Promise<SingleRuleResult> {
   const startTime = Date.now()
 
-  logger.debug('Evaluating rule', {
-    ruleId: rule.ruleId,
-    ruleName: rule.ruleName,
-    ruleType: rule.ruleType,
-    entityType: rule.entityType,
-    eventType: rule.eventType,
-    conditions: rule.conditionExpression,
-  })
+  if (isLevelEnabled('debug')) {
+    logger.debug('Evaluating rule', {
+      ruleId: rule.ruleId,
+      ruleName: rule.ruleName,
+      ruleType: rule.ruleType,
+      entityType: rule.entityType,
+      eventType: rule.eventType,
+    })
+  }
 
   try {
     // Check if rule is enabled

package/src/modules/catalog/ai-agents.ts

@@ -407,7 +407,7 @@ const MERCHANDISING_PROMPT_SECTIONS: PromptSection[] = [
       '- Selection-first: if `pageContext.recordId` contains a non-empty comma-separated UUID list (or `pageContext.extra.selectedCount > 0`), the operator has selected rows in the grid and EXPECTS you to act on those first. Call catalog.list_selected_products with those IDs, present what you found, and THEN ask whether to expand to the full catalog or to a broader search. Do NOT silently fall back to catalog.search_products when a selection is present.',
       '- "list products" with no selection → call catalog.search_products with NO parameters (returns all active products, paginated; default limit=50, max=100).',
       '- User mentions a product name → call catalog.search_products with q=that name.',
-      '- If catalog.search_products returns more rows than the page (i.e. `total` > `limit + offset`), say so and offer to fetch the next page; do NOT raise `limit` above 100.',
+      '- If catalog.search_products fills the page (as many items as `limit`), more may follow: say so and offer to fetch the next page; do NOT raise `limit` above 100. When `totalIsCapped` is true, `total` is a floor — phrase it as "at least N", never as an exact count.',
       'Present results first, then offer refinement options. The user does NOT want to answer questions before seeing data.',
     ].join('\n'),
   },

package/src/modules/catalog/ai-tools/merchandising-pack.ts

@@ -97,7 +97,7 @@ function resolveSearchService(ctx: CatalogToolContext): SearchServiceLike | null
 const searchProductsInput = z
   .object({
     q: z.string().trim().optional().describe('Optional fulltext query (title / subtitle / sku / handle). Omit or leave empty (or do NOT pass it at all) to list all products. NEVER use "*", "**", or "%" — they are not wildcards and will be discarded.'),
-    limit: z.number().int().min(1).max(100).optional().describe('Page size. Default 50, hard maximum 100. Results are paginated: when `total` exceeds `limit + offset`, call again with the next `offset` instead of asking for more than 100 rows.'),
+    limit: z.number().int().min(1).max(100).optional().describe('Page size. Default 50, hard maximum 100. Results are paginated: keep calling with the next `offset` until a page returns fewer than `limit` items, instead of asking for more than 100 rows. Do not treat `offset >= total` as the end — `total` is a floor when `totalIsCapped` is true.'),
     offset: z.number().int().min(0).optional().describe('Rows to skip for pagination (default 0). Combine with `limit` to fetch subsequent pages — for example offset=100, limit=100 fetches rows 101..200.'),
     categoryId: z.string().optional().describe('Restrict to products assigned to this catalog category UUID. Only use a category ID returned by a previous tool call — do NOT guess. Empty string is treated the same as omitting the field.'),
     priceMin: z.number().optional().describe('Lower-bound (inclusive) on the gross unit price. OMIT this field when you do not want a lower bound — do NOT pass 0 as "no minimum", because 0 is a real bound that combined with priceMax=0 will return only free products.'),
@@ -266,7 +266,7 @@ const searchProductsTool: CatalogAiToolDefinition = {
   displayName: 'Search products',
   description:
     'Hybrid search + filter across tenant products. When `q` is non-empty, routes through the search service (tenant + organization scoped) then hydrates tenant-scoped product summaries; when `q` is empty or omitted, runs the catalog query engine with the supplied filters and returns ALL products. ' +
-    'Pagination: response shape is `{ items, total, limit, offset, source }`. Hard cap is 100 rows per call (`limit` max=100, default=50); if `total` exceeds `limit + offset`, call again with the next `offset` rather than asking for >100. ' +
+    'Pagination: response shape is `{ items, total, totalIsCapped, limit, offset, source }`. Hard cap is 100 rows per call (`limit` max=100, default=50); keep calling with the next `offset` until a page returns fewer than `limit` items, rather than asking for >100. When `totalIsCapped` is true, `total` is a floor — render it as "at least N" and never treat `offset >= total` as exhaustion. ' +
     'Empty / sentinel inputs: pass an empty `q` (or omit it) to list all products. NEVER pass `0` for `priceMin`/`priceMax` to mean "no bound" — `0` is a real numeric bound (priceMin=0 + priceMax=0 returns only free products). To remove a bound, OMIT the field. Empty string `categoryId` and empty `tags` arrays are ignored. ' +
     '`source` in the output indicates which path executed (`search_service` vs `query_engine`).',
   inputSchema: searchProductsInput,

package/src/modules/catalog/backend/catalog/products/MerchandisingAssistantSheet.tsx

@@ -73,6 +73,8 @@ export interface MerchandisingPageContext {
   extra: {
     filter: MerchandisingPageContextFilter
     totalMatching: number
+    /** `totalMatching` is a floor, not an exact count (server-capped list count). */
+    totalMatchingIsCapped?: boolean
     selectedCount: number
   }
 }
@@ -181,7 +183,7 @@ function useContextItems(pageContext: MerchandisingPageContext): AiChatContextIt
   const t = useT()
   return React.useMemo(() => {
     const items: AiChatContextItem[] = []
-    const { selectedCount, totalMatching, filter } = pageContext.extra
+    const { selectedCount, totalMatching, totalMatchingIsCapped, filter } = pageContext.extra
     if (selectedCount > 0) {
       items.push({
         label: t(
@@ -191,10 +193,15 @@ function useContextItems(pageContext: MerchandisingPageContext): AiChatContextIt
       })
     } else if (totalMatching > 0) {
       items.push({
-        label: t(
-          'catalog.merchandising_assistant.context.matchingProducts',
-          '{count} products in view',
-        ).replace('{count}', String(totalMatching)),
+        label: totalMatchingIsCapped
+          ? t(
+              'catalog.merchandising_assistant.context.matchingProductsCapped',
+              '{count}+ products in view',
+            ).replace('{count}', String(totalMatching))
+          : t(
+              'catalog.merchandising_assistant.context.matchingProducts',
+              '{count} products in view',
+            ).replace('{count}', String(totalMatching)),
       })
     }
     if (filter.categoryId) {

package/src/modules/catalog/components/categories/CategoriesDataTable.tsx

@@ -39,6 +39,7 @@ type CategoriesResponse = {
   page: number
   pageSize: number
   totalPages: number
+  totalIsCapped?: boolean
 }
 
 const PAGE_SIZE = 50
@@ -114,6 +115,7 @@ export default function CategoriesDataTable() {
   const rows = data?.items ?? []
   const total = data?.total ?? 0
   const totalPages = data?.totalPages ?? 0
+  const totalIsCapped = data?.totalIsCapped === true
 
   const columns = React.useMemo<ColumnDef<CategoryRow>[]>(() => [
     {
@@ -249,6 +251,7 @@ export default function CategoriesDataTable() {
           pageSize: PAGE_SIZE,
           total,
           totalPages,
+          totalIsCapped,
           onPageChange: setPage,
         }}
         isLoading={isLoading}

package/src/modules/catalog/components/products/ProductsDataTable.tsx

@@ -86,6 +86,7 @@ type ProductsResponse = {
   items?: ProductRow[]
   total?: number
   totalPages?: number
+  totalIsCapped?: boolean
 }
 
 const PAGE_SIZE = 25
@@ -177,6 +178,7 @@ export default function ProductsDataTable({
   const [page, setPage] = React.useState(1)
   const [total, setTotal] = React.useState(0)
   const [totalPages, setTotalPages] = React.useState(1)
+  const [totalIsCapped, setTotalIsCapped] = React.useState(false)
   const [cacheStatus, setCacheStatus] = React.useState<'hit' | 'miss' | null>(null)
   const [sorting, setSorting] = React.useState<SortingState>([{ id: 'title', desc: false }])
   const [search, setSearch] = React.useState('')
@@ -598,6 +600,7 @@ export default function ProductsDataTable({
         setRows(normalized)
         setTotal(typeof payload.total === 'number' ? payload.total : normalized.length)
         setTotalPages(typeof payload.totalPages === 'number' ? payload.totalPages : 1)
+        setTotalIsCapped(payload.totalIsCapped === true)
       } catch (error) {
         if (!cancelled) {
           setCacheStatus(null)
@@ -712,12 +715,16 @@ export default function ProductsDataTable({
           // dependency on the host page.
           total,
           totalMatching: total,
+          // `total` is a floor when the server capped the count, so the
+          // merchandising widget must not present it as an exact match count.
+          totalIsCapped,
         }}
         pagination={{
           page,
           pageSize: PAGE_SIZE,
           total,
           totalPages,
+          totalIsCapped,
           onPageChange: setPage,
           cacheStatus,
         }}

package/src/modules/catalog/i18n/de.json

@@ -90,6 +90,7 @@
   "catalog.merchandising_assistant.agents.merchandising.label": "Merchandising-Assistent",
   "catalog.merchandising_assistant.context.filteredByCategory": "Filtered by category",
   "catalog.merchandising_assistant.context.matchingProducts": "{count} Produkte in der Ansicht",
+  "catalog.merchandising_assistant.context.matchingProductsCapped": "{count}+ Produkte in der Ansicht",
   "catalog.merchandising_assistant.context.selectedProducts": "{count} Produkte ausgewählt",
   "catalog.merchandising_assistant.context.tags": "{count} tags",
   "catalog.merchandising_assistant.dock.subtitle": "Catalog",

package/src/modules/catalog/i18n/en.json

@@ -90,6 +90,7 @@
   "catalog.merchandising_assistant.agents.merchandising.label": "Merchandising Assistant",
   "catalog.merchandising_assistant.context.filteredByCategory": "Filtered by category",
   "catalog.merchandising_assistant.context.matchingProducts": "{count} products in view",
+  "catalog.merchandising_assistant.context.matchingProductsCapped": "{count}+ products in view",
   "catalog.merchandising_assistant.context.selectedProducts": "{count} products selected",
   "catalog.merchandising_assistant.context.tags": "{count} tags",
   "catalog.merchandising_assistant.dock.subtitle": "Catalog",

package/src/modules/catalog/i18n/es.json

@@ -90,6 +90,7 @@
   "catalog.merchandising_assistant.agents.merchandising.label": "Asistente de Merchandising",
   "catalog.merchandising_assistant.context.filteredByCategory": "Filtered by category",
   "catalog.merchandising_assistant.context.matchingProducts": "{count} productos en la vista",
+  "catalog.merchandising_assistant.context.matchingProductsCapped": "{count}+ productos en la vista",
   "catalog.merchandising_assistant.context.selectedProducts": "{count} productos seleccionados",
   "catalog.merchandising_assistant.context.tags": "{count} tags",
   "catalog.merchandising_assistant.dock.subtitle": "Catalog",

package/src/modules/catalog/i18n/ko.json

@@ -90,6 +90,7 @@
   "catalog.merchandising_assistant.agents.merchandising.label": "머천다이징 어시스턴트",
   "catalog.merchandising_assistant.context.filteredByCategory": "카테고리로 필터링됨",
   "catalog.merchandising_assistant.context.matchingProducts": "{count} 제품 보기",
+  "catalog.merchandising_assistant.context.matchingProductsCapped": "조회 중 {count}+개 제품",
   "catalog.merchandising_assistant.context.selectedProducts": "{count} 제품 선택됨",
   "catalog.merchandising_assistant.context.tags": "태그 {count}개",
   "catalog.merchandising_assistant.dock.subtitle": "카탈로그",

package/src/modules/catalog/i18n/pl.json

@@ -90,6 +90,7 @@
   "catalog.merchandising_assistant.agents.merchandising.label": "Asystent merchandisingu",
   "catalog.merchandising_assistant.context.filteredByCategory": "Filtrowane po kategorii",
   "catalog.merchandising_assistant.context.matchingProducts": "{count} produktów w widoku",
+  "catalog.merchandising_assistant.context.matchingProductsCapped": "{count}+ produktów w widoku",
   "catalog.merchandising_assistant.context.selectedProducts": "Wybrano {count} produktów",
   "catalog.merchandising_assistant.context.tags": "Tagi: {count}",
   "catalog.merchandising_assistant.dock.subtitle": "Katalog",

package/src/modules/catalog/widgets/injection/merchandising-assistant-trigger/widget.client.tsx

@@ -31,6 +31,8 @@ interface HostInjectionContext {
   scopeVersion?: unknown
   total?: number | string
   totalMatching?: number | string
+  /** `totalMatching` is a floor, not an exact count (server-capped list count). */
+  totalIsCapped?: boolean
   /** Selected row IDs from DataTable (auto-enriched when bulk actions are present). */
   selectedRowIds?: string[]
   selectedCount?: number
@@ -83,6 +85,7 @@ export function computeCatalogMerchandisingPageContext(
   context: HostInjectionContext | undefined,
 ): MerchandisingPageContext {
   const totalMatching = readNumber(context?.totalMatching ?? context?.total)
+  const totalMatchingIsCapped = context?.totalIsCapped === true
   const selectedRowIds = Array.isArray(context?.selectedRowIds) ? context.selectedRowIds : []
   const selectedCount = selectedRowIds.length > 0 ? selectedRowIds.length : readNumber(context?.selectedCount)
   return {
@@ -93,6 +96,7 @@ export function computeCatalogMerchandisingPageContext(
     extra: {
       filter: normalizeFilters(context),
       totalMatching,
+      totalMatchingIsCapped,
       selectedCount,
     },
   }

package/src/modules/communication_channels/api/post/channels/[id]/test-send/route.ts

@@ -13,6 +13,10 @@ import {
   channelOrgScopeWhere,
 } from '../../../../../lib/access-control'
 import { refreshCredentialsIfNeeded } from '../../../../../lib/credential-refresh'
+import {
+  MAX_OUTBOUND_RECIPIENT_LENGTH,
+  validateOutboundRecipient,
+} from '../../../../../lib/outbound-recipient'
 import { validateRouteMutationGuard } from '../../../../../lib/route-mutation-guard'
 
 type RbacServiceLike = {
@@ -33,8 +37,15 @@ export const metadata = {
   },
 }
 
+// `to` is deliberately NOT typed as an email here. The recipient shape depends
+// on the provider (an email address for Gmail/IMAP, a channel snowflake for
+// Discord), and the adapter is only known once the channel is loaded — so the
+// schema accepts any non-empty single-line string and `validateOutboundRecipient`
+// applies the provider-appropriate rules below, defaulting to email. The CR/LF
+// rejection stays at the schema level so a header-injection attempt is refused
+// before the request reaches the channel lookup or the mutation guard.
 const bodySchema = z.object({
-  to: z.string().email(),
+  to: z.string().min(1).max(MAX_OUTBOUND_RECIPIENT_LENGTH).regex(/^[^\r\n]*$/),
   subject: z.string().min(1).max(500).optional(),
   body: z.string().max(50_000).optional(),
 })
@@ -170,6 +181,11 @@ export async function POST(req: Request, context: RouteContext): Promise<Respons
     )
   }
 
+  const recipientCheck = validateOutboundRecipient(body.to, adapter.capabilities)
+  if (!recipientCheck.ok) {
+    return NextResponse.json({ error: recipientCheck.error }, { status: 422 })
+  }
+
   // Resolve credentials + optionally refresh.
   let credentials: Record<string, unknown> = {}
   let credentialsService: CredentialsServiceLike | null = null

package/src/modules/communication_channels/api/post/test-seed/route.ts

@@ -20,10 +20,16 @@ import {
 } from '../../../commands/connect-credential-channel'
 import { emitCommunicationChannelsEvent } from '../../../events'
 import {
+  TEST_SEED_CHAT_PROVIDER_KEY,
   TEST_SEED_PROVIDER_KEY,
   ensureTestSeedAdapterRegistered,
   isTestChannelSeedingEnabled,
 } from '../../../lib/test-seed'
+import {
+  COMMUNICATION_CHANNELS_INGEST_INBOUND_COMMAND_ID,
+  type IngestInboundMessageInput,
+  type IngestInboundMessageResult,
+} from '../../../commands/ingest-inbound-message'
 
 /**
  * TEST-ONLY channel seeding endpoint.
@@ -32,15 +38,22 @@ import {
  * production default) every request returns 404, so this route is invisible and
  * inert in production. See `lib/test-seed.ts` for the full rationale.
  *
- * Two actions, both scoped to the caller's tenant/org:
- *   - `connect-channel`: connect a network-free `__test_seed__` channel owned by
- *     the caller (delegates to the real connect-credential command so the channel
- *     persists credentials + lands in `status='connected'`). Enables the outbound
- *     compose → deliver → `.sent` chain to complete in CI.
+ * Three actions, all scoped to the caller's tenant/org:
+ *   - `connect-channel`: connect a network-free stub channel owned by the caller
+ *     (delegates to the real connect-credential command so the channel persists
+ *     credentials + lands in `status='connected'`). Enables the outbound
+ *     compose → deliver → `.sent` chain to complete in CI. `providerFlavor: 'chat'`
+ *     connects the non-email stub instead, for tests about sender identity.
+ *   - `ingest-inbound`: run the REAL `ingest_inbound_message` command over an
+ *     adapter-normalized chat frame, so the platform compose path — and every
+ *     validation rule on it — actually executes. Use this for anything that
+ *     claims inbound works.
  *   - `emit-inbound`: insert an inbound `MessageChannelLink` (+ a `messages.message`
  *     row for threading) and emit `communication_channels.message.received` so the
  *     customers link-channel-message subscriber runs against real Postgres. Enables
- *     the inbound auto-link tests (TC-CRM-EMAIL-002..005).
+ *     the inbound auto-link tests (TC-CRM-EMAIL-002..005). NOTE: this action
+ *     deliberately bypasses `messages.messages.compose` — it can never prove that
+ *     the hub accepts a message, only that downstream subscribers fire.
  */
 type RbacServiceLike = {
   loadAcl: (
@@ -68,6 +81,35 @@ const connectChannelSchema = z.object({
   action: z.literal('connect-channel'),
   displayName: z.string().min(1).max(255).optional(),
   externalIdentifier: z.string().min(1).max(255).optional(),
+  /**
+   * Which stub provider to connect. `email` (default) keeps the historical
+   * email-shaped channel; `chat` connects a channel whose senders have no
+   * address, so a test can exercise the hub's non-email identity contract
+   * without inventing one (#4975).
+   */
+  providerFlavor: z.enum(['email', 'chat']).optional(),
+})
+
+/**
+ * Drive the REAL `ingest_inbound_message` command with a chat-shaped frame.
+ *
+ * `emit-inbound` below deliberately bypasses the platform compose path (it
+ * inserts the `messages` row with raw SQL) because it only ever needed a
+ * landing zone for the CRM-link subscribers. That bypass is why an inbound test
+ * could pass while `composeMessageSchema` rejected every real message (#4975).
+ * This action takes the opposite approach: it hands the frame to the adapter and
+ * the ingest command and asserts nothing on the way, so whatever the hub's
+ * contract really is, the test feels it.
+ */
+const ingestInboundSchema = z.object({
+  action: z.literal('ingest-inbound'),
+  channelId: z.string().uuid(),
+  /** Opaque sender handle — a Discord snowflake, a Slack member id, etc. */
+  senderIdentifier: z.string().min(1).max(255),
+  senderDisplayName: z.string().max(255).optional(),
+  body: z.string().max(50_000).optional(),
+  externalMessageId: z.string().min(1).max(255),
+  externalConversationId: z.string().min(1).max(255),
 })
 
 const emitInboundSchema = z.object({
@@ -103,7 +145,11 @@ const emitInboundSchema = z.object({
   createThreadMapping: z.boolean().optional(),
 })
 
-const bodySchema = z.discriminatedUnion('action', [connectChannelSchema, emitInboundSchema])
+const bodySchema = z.discriminatedUnion('action', [
+  connectChannelSchema,
+  ingestInboundSchema,
+  emitInboundSchema,
+])
 
 export async function POST(req: Request): Promise<Response> {
   // Fail-closed: invisible in production. Mirrors an unknown route (404) rather
@@ -139,13 +185,23 @@ export async function POST(req: Request): Promise<Response> {
   if (body.action === 'connect-channel') {
     const stamp = Date.now()
     const commandBus = container.resolve('commandBus') as CommandBus
+    const isChatFlavor = body.providerFlavor === 'chat'
+    // A chat channel is deliberately connected WITHOUT an email-ish credential
+    // key, so `connect-credential-channel` derives no `externalIdentifier` and
+    // the row is shaped exactly like a real Discord channel (identifier NULL —
+    // the condition #4977 describes). Inventing one here would recreate the
+    // fixture dishonesty that hid #4975.
+    const credentials = isChatFlavor
+      ? { handle: body.externalIdentifier ?? `test-seed-chat-${stamp}` }
+      : {
+          username: body.externalIdentifier ?? `test-seed-${stamp}@test-seed.local`,
+          fromAddress: body.externalIdentifier ?? `test-seed-${stamp}@test-seed.local`,
+        }
     const input: ConnectCredentialChannelInput = {
-      providerKey: TEST_SEED_PROVIDER_KEY,
-      displayName: body.displayName ?? `Test Seed Channel ${stamp}`,
-      credentials: {
-        username: body.externalIdentifier ?? `test-seed-${stamp}@test-seed.local`,
-        fromAddress: body.externalIdentifier ?? `test-seed-${stamp}@test-seed.local`,
-      },
+      providerKey: isChatFlavor ? TEST_SEED_CHAT_PROVIDER_KEY : TEST_SEED_PROVIDER_KEY,
+      displayName:
+        body.displayName ?? `Test Seed ${isChatFlavor ? 'Chat ' : ''}Channel ${stamp}`,
+      credentials,
       userId,
       scope: { tenantId, organizationId },
     }
@@ -174,9 +230,12 @@ export async function POST(req: Request): Promise<Response> {
     )
   }
 
-  // action === 'emit-inbound'
+  // action === 'ingest-inbound' | 'emit-inbound' — both address an existing channel.
   const em = (container.resolve('em') as EntityManager).fork()
-  const providerKey = body.providerKey ?? TEST_SEED_PROVIDER_KEY
+  // Only the `emit-inbound` branch stamps a caller-chosen provider key onto the
+  // rows it seeds; `ingest-inbound` takes the channel's own (see below).
+  const providerKey =
+    body.action === 'emit-inbound' ? body.providerKey ?? TEST_SEED_PROVIDER_KEY : TEST_SEED_PROVIDER_KEY
 
   // `channelId` is caller-supplied, so confirm it names a channel this tenant/org
   // actually owns before seeding rows that reference it. Mirrors the ownership
@@ -227,6 +286,85 @@ export async function POST(req: Request): Promise<Response> {
     )
   }
 
+  if (body.action === 'ingest-inbound') {
+    // Everything below this point is the real path: the adapter normalizes the
+    // frame and `ingest_inbound_message` composes the platform message through
+    // `messages.messages.compose`. Nothing is short-circuited, so a hub contract
+    // the provider cannot satisfy surfaces here as a failure instead of hiding
+    // behind seeded rows (#4975).
+    // The channel's own provider key, never a hardcoded one: ingest does not
+    // check that `providerKey` matches the channel it names, so passing a
+    // different one would silently stamp the wrong provider onto the link.
+    const channelProviderKey = ownedChannel.providerKey
+    if (channelProviderKey !== TEST_SEED_CHAT_PROVIDER_KEY) {
+      return NextResponse.json(
+        {
+          error:
+            'ingest-inbound requires a channel connected with providerFlavor: "chat"; ' +
+            `channel ${body.channelId} is '${channelProviderKey}'`,
+        },
+        { status: 422 },
+      )
+    }
+
+    const commandBus = container.resolve('commandBus') as CommandBus
+    const adapterRegistry = container.resolve('channelAdapterRegistry') as {
+      get: (key: string) => { normalizeInbound: (raw: unknown) => Promise<unknown> } | undefined
+    }
+    const adapter = adapterRegistry.get(channelProviderKey)
+    if (!adapter) {
+      return NextResponse.json(
+        { error: '[internal] test-seed chat adapter is not registered' },
+        { status: 500 },
+      )
+    }
+
+    const normalized = await adapter.normalizeInbound({
+      raw: {
+        externalMessageId: body.externalMessageId,
+        externalConversationId: body.externalConversationId,
+        senderIdentifier: body.senderIdentifier,
+        senderDisplayName: body.senderDisplayName,
+        body: body.body ?? '',
+      },
+      eventType: 'message',
+      metadata: {},
+    })
+
+    const ingestInput = {
+      channelId: body.channelId,
+      providerKey: channelProviderKey,
+      channelType: ownedChannel.channelType,
+      scope: { tenantId, organizationId },
+      message: normalized,
+    } as IngestInboundMessageInput
+
+    const { result } = await commandBus.execute<
+      IngestInboundMessageInput,
+      IngestInboundMessageResult
+    >(COMMUNICATION_CHANNELS_INGEST_INBOUND_COMMAND_ID, {
+      input: ingestInput,
+      ctx: {
+        container,
+        auth: auth as never,
+        organizationScope: null,
+        selectedOrganizationId: organizationId,
+        organizationIds: organizationId ? [organizationId] : null,
+      },
+    })
+
+    return NextResponse.json(
+      {
+        status: result.status,
+        messageId: result.messageId ?? null,
+        conversationId: result.externalConversationId ?? null,
+        channelLinkId: result.channelLinkId ?? null,
+        channelType: ownedChannel.channelType,
+      },
+      { status: 201 },
+    )
+  }
+
   // A MessageChannelLink requires a non-null external_conversation_id (FK) and
   // message_id. Create a synthetic conversation + (optionally threaded) message
   // so the link is shaped like a real inbound row the subscriber can consume.
@@ -341,7 +479,8 @@ export const openApi = {
   tags: ['CommunicationChannels'],
   methods: {
     POST: {
-      summary: 'Test-only: seed a connected channel or emit an inbound message (env-gated)',
+      summary:
+        'Test-only: seed a connected channel, ingest a real inbound message, or emit a seeded inbound link (env-gated)',
       tags: ['CommunicationChannels'],
       responses: [
         { status: 201, description: 'Channel seeded / inbound message emitted' },

package/src/modules/communication_channels/backend/communication_channels/channels/page.tsx

@@ -24,6 +24,7 @@ type ChannelListResponse = {
   items?: ChannelRow[]
   total?: number
   totalPages?: number
+  totalIsCapped?: boolean
 }
 
 export default function ChannelsListPage() {
@@ -31,6 +32,7 @@ export default function ChannelsListPage() {
   const [rows, setRows] = React.useState<ChannelRow[]>([])
   const [total, setTotal] = React.useState(0)
   const [totalPages, setTotalPages] = React.useState(1)
+  const [totalIsCapped, setTotalIsCapped] = React.useState(false)
   const [page, setPage] = React.useState(1)
   const [isLoading, setIsLoading] = React.useState(true)
   const [errorMessage, setErrorMessage] = React.useState<string | null>(null)
@@ -72,6 +74,7 @@ export default function ChannelsListPage() {
         setRows(Array.isArray(data.items) ? data.items : [])
         setTotal(typeof data.total === 'number' ? data.total : 0)
         setTotalPages(typeof data.totalPages === 'number' ? data.totalPages : 1)
+        setTotalIsCapped(data.totalIsCapped === true)
       }
       setIsLoading(false)
     }
@@ -139,6 +142,7 @@ export default function ChannelsListPage() {
             pageSize,
             total,
             totalPages,
+            totalIsCapped,
             onPageChange: setPage,
           }}
         />

package/src/modules/communication_channels/commands/ingest-inbound-message.ts

@@ -4,6 +4,7 @@ import type { EntityManager } from '@mikro-orm/postgresql'
 import type { CommandBus, CommandHandler, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
 import { registerCommand } from '@open-mercato/shared/lib/commands'
 import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { htmlToPlainText } from '@open-mercato/shared/lib/html/htmlToPlainText'
 import { emitCommunicationChannelsEvent } from '../events'
 import { resolveContact } from '../lib/contact-resolver'
 import type { ChannelAdapterRegistry } from '../lib/registry'
@@ -336,10 +337,41 @@ const ingestInboundMessageCommand: CommandHandler<IngestInboundMessageInput, Ing
     //     ExternalMessage.rawPayload if needed for forensic / forward use.
     //   - Some legitimate messages have no subject (notifications, bounce
     //     digests). Substitute a placeholder instead of failing ingest.
+    //   - HTML bodies land in the platform body as plain text rather than being
+    //     merely relabelled as `text`: `MarkdownContent` renders a `text` body
+    //     verbatim, so unconverted markup shows up as literal doctype, <style>
+    //     blocks and tags in the inbox preview and the detail body. The source
+    //     markup is untouched in `channelPayload.html`, which `data/enrichers.ts`
+    //     sanitizes into `_channelPayload.sanitizedHtml` for the channel-payload
+    //     renderer widget mounted at `detail:messages:message:body:after`.
+    //   - The plain-text alternative wins over conversion when the sender's
+    //     client supplied one (`multipart/alternative`), because that part is
+    //     what a human actually wrote; `html-to-text` output — inlined link
+    //     URLs, flattened tables, synthesized list markers — is the fallback for
+    //     HTML-only senders. `lib/email-mime.ts` preferred `bodyHtml` when
+    //     picking `body`, but preserved the text part at `channelPayload.text`.
     const MAX_COMPOSE_BODY = 50_000
+    // Bound the synchronous parse: inbound mail is untrusted and the 5MB body
+    // ceiling from `lib/email-capabilities.ts` would otherwise block the ingest
+    // worker on a single oversized document. This cap counts markup bytes while
+    // MAX_COMPOSE_BODY counts text characters, so it can bite first — an
+    // ordinary marketing template or a long quoted thread is easily over 512KB
+    // of markup and still well under 50k characters of text. It therefore
+    // carries the same truncation marker, rather than ending mid-sentence with
+    // nothing to tell the reader the rest exists.
+    const MAX_HTML_PARSE_INPUT = 512 * 1024
     const TRUNCATE_MARKER =
       '\n\n[…message truncated by Open Mercato — full body preserved in ExternalMessage.rawPayload]'
-    const rawBody = m.body ?? ''
+    const sourceBody = m.body ?? ''
+    const plainAlternative =
+      typeof m.channelPayload?.text === 'string' ? m.channelPayload.text.trim() : ''
+    const convertHtmlBody = () => {
+      const converted = htmlToPlainText(sourceBody.slice(0, MAX_HTML_PARSE_INPUT))
+      return sourceBody.length > MAX_HTML_PARSE_INPUT ? converted + TRUNCATE_MARKER : converted
+    }
+    const rawBody = m.bodyFormat === 'html'
+      ? (plainAlternative || convertHtmlBody())
+      : sourceBody
     const truncatedBody =
       rawBody.length > MAX_COMPOSE_BODY
         ? rawBody.slice(0, MAX_COMPOSE_BODY - TRUNCATE_MARKER.length) + TRUNCATE_MARKER
@@ -353,6 +385,11 @@ const ingestInboundMessageCommand: CommandHandler<IngestInboundMessageInput, Ing
       sourceEntityId: conversation.id,
       externalEmail: contactHint?.email ?? undefined,
       externalName: contactHint?.displayName ?? m.senderDisplayName,
+      // #4975: tells the hub which identity contract applies to this sender.
+      // Email-typed channels keep the mandatory `externalEmail`; providers whose
+      // senders have no address (Discord, Slack, SMS…) are validated without it.
+      // The messages validator fails closed on any type it does not recognize.
+      sourceChannelType: input.channelType,
       recipients: mapping?.assignedUserId
         ? [{ userId: mapping.assignedUserId, type: 'to' as const }]
         : [],