@openclaw/whatsapp 2026.6.8 → 2026.6.9

package/dist/{monitor-Ggwn3FDi.js → monitor-C5_QBO1-.js}

@@ -1,18 +1,18 @@
 import { a as resolveWhatsAppAccount, s as resolveWhatsAppMediaMaxBytes } from "./accounts-DgViSyJx.js";
-import { t as isWhatsAppGroupJid } from "./normalize-target-bVWjgftN.js";
-import { a as normalizeWhatsAppOutboundPayload, c as prepareWhatsAppOutboundMedia, d as maybeResolveWhatsAppApprovalReaction, g as resolveWhatsAppReactionLevel, l as sendWhatsAppOutboundWithRetry, r as sendReactionWhatsApp, s as normalizeWhatsAppPayloadTextPreservingIndentation } from "./send-DSlVXKL_.js";
+import { a as normalizeWhatsAppOutboundPayload, c as prepareWhatsAppOutboundMedia, d as maybeResolveWhatsAppApprovalReaction, g as resolveWhatsAppReactionLevel, l as sendWhatsAppOutboundWithRetry, r as sendReactionWhatsApp, s as normalizeWhatsAppPayloadTextPreservingIndentation } from "./send-A9EqsNyz.js";
 import { n as getWhatsAppRuntime } from "./runtime-BfAdAEYT.js";
 import { n as getStatusCode, r as getRegisteredWhatsAppConnectionController, t as formatError } from "./session-errors-CbsoQqoy.js";
-import { d as markdownToWhatsApp, f as resolveJidToE164, l as isSelfChatMode, n as normalizeE164, t as convertMarkdownTables$1, u as jidToE164 } from "./text-runtime-Dk37KYHj.js";
-import { n as cacheInboundMessageMeta, r as lookupInboundMessageMeta, t as buildQuotedMessageOptions } from "./quoted-message-CveINB35.js";
-import { c as logoutWeb, g as readWebSelfId, o as getWebAuthAgeMs, r as WhatsAppAuthUnstableError, v as readWebSelfIdentityForDecision } from "./auth-store-e9VzLZ-S.js";
-import { a as getSelfIdentity, c as resolveComparableIdentity, i as getReplyContext, n as getMentionIdentities, o as getSenderIdentity, r as getPrimaryIdentityId, s as identitiesOverlap, t as getComparableIdentityValues } from "./identity-Bupuq9vF.js";
+import { a as resolveWhatsAppSocketTiming, i as resolveWhatsAppSocketOperationTimeoutMs, n as createWhatsAppSocketOperationTimeoutAdapter, o as withWhatsAppSocketOperationTimeout, r as isWhatsAppSocketOperationTimeoutError } from "./socket-timing-DvMNkIge.js";
+import { d as markdownToWhatsApp, f as resolveJidToE164, l as isSelfChatMode, n as normalizeE164, t as convertMarkdownTables$1, u as jidToE164 } from "./text-runtime-BBSmIBHN.js";
+import { n as cacheInboundMessageMeta, r as lookupInboundMessageMeta, t as buildQuotedMessageOptions } from "./quoted-message-DVOfpEja.js";
+import { g as readWebSelfId, o as getWebAuthAgeMs, r as WhatsAppAuthUnstableError, v as readWebSelfIdentityForDecision } from "./auth-store-RyuCPHE0.js";
+import { a as getSelfIdentity, c as resolveComparableIdentity, i as getReplyContext, n as getMentionIdentities, o as getSenderIdentity, r as getPrimaryIdentityId, s as identitiesOverlap, t as getComparableIdentityValues } from "./identity-Cm6bKAtk.js";
 import { n as resolveWhatsAppGroupsConfigPath } from "./group-config-path-BGyzT9Lg.js";
-import { i as resolveWhatsAppInboundPolicy, r as resolveWhatsAppCommandAuthorized, t as checkInboundAccessControl } from "./access-control-BKaMOvIk.js";
-import { _ as extractMediaPlaceholder, a as mayContainWhatsAppOutboundMention, b as hasInboundUserContent, c as DisconnectReason, d as normalizeMessageContent, f as resolveInboundMediaMimetype, g as extractLocationData, h as extractContextInfo, i as addWhatsAppOutboundMentionsToContent, l as downloadMediaMessage, m as extractContactContext, n as listWhatsAppSendResultMessageIds, o as resolveWhatsAppOutboundMentions, p as describeReplyContext, r as normalizeWhatsAppSendResult, s as addWhatsAppImagePreviewFields, t as createWebSendApi, u as isJidGroup, v as extractMentionedJids, y as extractText } from "./send-api-Cp9CUH5P.js";
-import { a as resolveWhatsAppSocketTiming, r as waitForWaConnection, t as createWaSocket } from "./session-BCKUPRkN.js";
+import { c as requireWhatsAppInboundAdmission, i as resolveWhatsAppInboundPolicy, l as resolveWhatsAppGroupConversationId, o as buildDeprecatedFlatWhatsAppInboundAdmission, r as resolveWhatsAppCommandAuthorized, s as requireAdmittedWhatsAppInboundMessage, t as checkInboundAccessControl } from "./access-control-BnFVCHHH.js";
+import { _ as extractLocationData, a as mayContainWhatsAppOutboundMention, b as extractText, c as DisconnectReason, d as normalizeMessageContent, f as resolveInboundMediaMimetype, g as extractExternalAdReplyContext, h as extractContextInfo, i as addWhatsAppOutboundMentionsToContent, l as downloadMediaMessage, m as extractContactContext, n as listWhatsAppSendResultMessageIds, o as resolveWhatsAppOutboundMentions, p as describeReplyContext, r as normalizeWhatsAppSendResult, s as addWhatsAppImagePreviewFields, t as createWebSendApi, u as isJidGroup, v as extractMediaPlaceholder, x as hasInboundUserContent, y as extractMentionedJids } from "./send-api-89SE5WKV.js";
+import { r as waitForWaConnection, t as createWaSocket } from "./session-BW8RcCcb.js";
 import { t as BufferJSON } from "./session.runtime-CyooSQvj.js";
-import { c as computeBackoff, d as resolveReconnectPolicy, f as sleepWithAbort, l as newConnectionId, n as WHATSAPP_WATCHDOG_TIMEOUT_ERROR, r as WhatsAppConnectionController, s as DEFAULT_RECONNECT_POLICY, u as resolveHeartbeatSeconds } from "./connection-controller-BWBoVQr4.js";
+import { c as computeBackoff, d as resolveReconnectPolicy, f as sleepWithAbort, l as newConnectionId, n as WHATSAPP_WATCHDOG_TIMEOUT_ERROR, r as WhatsAppConnectionController, s as DEFAULT_RECONNECT_POLICY, u as resolveHeartbeatSeconds } from "./connection-controller-BDuM0Kc7.js";
 import { resolveAccountEntry } from "openclaw/plugin-sdk/account-core";
 import { normalizeLowercaseStringOrEmpty, normalizeStringEntries, uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createChannelMessageReplyPipeline, createDurableInboundReceiveJournalFromQueue, createMessageReceiptFromOutboundResults, deliverInboundReplyWithMessageSendContext, resolveChannelMessageSourceReplyDeliveryMode } from "openclaw/plugin-sdk/channel-outbound";
@@ -23,11 +23,11 @@ import { getChildLogger } from "openclaw/plugin-sdk/logging-core";
 import { resolveMarkdownTableMode as resolveMarkdownTableMode$1 } from "openclaw/plugin-sdk/markdown-table-runtime";
 import { createSubsystemLogger, defaultRuntime, formatDurationPrecise, getChildLogger as getChildLogger$1, logVerbose, logVerbose as logVerbose$1, registerUnhandledRejectionHandler, shouldLogVerbose, shouldLogVerbose as shouldLogVerbose$1, warn } from "openclaw/plugin-sdk/runtime-env";
 import { getAgentScopedMediaLocalRoots } from "openclaw/plugin-sdk/media-runtime";
+import { asDateTimestampMs, parseStrictFiniteNumber, resolveExpiresAtMsFromDurationMs } from "openclaw/plugin-sdk/number-runtime";
 import { LocalMediaAccessError, getDefaultLocalRoots, loadWebMedia as loadWebMedia$1, loadWebMediaRaw, optimizeImageToJpeg, optimizeImageToPng } from "openclaw/plugin-sdk/web-media";
 import { chunkMarkdownTextWithMode } from "openclaw/plugin-sdk/reply-chunking";
 import { isReasoningReplyPayload, resolveSendableOutboundReplyParts, sendMediaWithLeadingCaption } from "openclaw/plugin-sdk/reply-payload";
 import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$1, DEFAULT_MAIN_KEY, buildAgentMainSessionKey, buildAgentSessionKey, buildGroupHistoryKey, deriveLastRoutePolicy, normalizeAccountId as normalizeAccountId$1, normalizeAgentId, resolveAgentRoute, resolveInboundLastRouteSessionKey, resolveThreadSessionKeys } from "openclaw/plugin-sdk/routing";
-import { asDateTimestampMs, parseStrictFiniteNumber, resolveExpiresAtMsFromDurationMs } from "openclaw/plugin-sdk/number-runtime";
 import { recordInboundSession } from "openclaw/plugin-sdk/conversation-runtime";
 import { loadSessionStore, resolveStorePath, updateLastRoute, updateSessionStore } from "openclaw/plugin-sdk/session-store-runtime";
 import { buildChannelInboundEventContext, filterChannelInboundQuoteContext, formatInboundEnvelope, formatInboundEnvelope as formatInboundEnvelope$1, formatLocationText, hasVisibleInboundReplyDispatch, resolveInboundSessionEnvelopeContext, runChannelInboundEvent, toInboundMediaFacts, toLocationContext } from "openclaw/plugin-sdk/channel-inbound";
@@ -110,7 +110,7 @@ function setMediaField(msg, key, value) {
 	if (value === void 0 && !msg.payload.media) return;
 	ensureMedia(msg)[key] = value;
 }
-function defineDeprecatedAliasAccessors(msg, descriptors) {
+function defineDeprecatedAccessors(msg, descriptors) {
 	Object.defineProperties(msg, Object.fromEntries(Object.entries(descriptors).map(([key, descriptor]) => [key, {
 		configurable: true,
 		enumerable: true,
@@ -119,8 +119,62 @@ function defineDeprecatedAliasAccessors(msg, descriptors) {
 	}])));
 	return msg;
 }
+function defineDeprecatedAliasAccessors(msg, descriptors) {
+	defineDeprecatedAccessors(msg, descriptors);
+	return msg;
+}
+function defineDeprecatedAdmissionTopLevelAccessors(msg) {
+	let fallbackConversationId = msg.conversationId || msg.from;
+	let fallbackAccountId = msg.accountId;
+	let fallbackAccessControlPassed = msg.accessControlPassed;
+	let fallbackChatType = msg.chatType;
+	const conversationId = () => msg.admission?.conversation.id ?? fallbackConversationId;
+	const setConversationId = (value) => {
+		const next = value;
+		fallbackConversationId = next;
+		if (msg.admission) {
+			msg.admission.conversation.id = next;
+			msg.admission.conversation.groupSessionId = resolveWhatsAppGroupConversationId(next);
+		}
+	};
+	return defineDeprecatedAccessors(msg, {
+		from: {
+			get: conversationId,
+			set: setConversationId
+		},
+		conversationId: {
+			get: conversationId,
+			set: setConversationId
+		},
+		accountId: {
+			get: () => msg.admission?.accountId ?? fallbackAccountId,
+			set: (value) => {
+				const next = value;
+				fallbackAccountId = next;
+				if (msg.admission) {
+					msg.admission.accountId = next;
+					msg.admission.account.accountId = next;
+				}
+			}
+		},
+		accessControlPassed: {
+			get: () => msg.admission ? msg.admission.ingress.decision === "allow" : fallbackAccessControlPassed,
+			set: (value) => {
+				fallbackAccessControlPassed = value;
+			}
+		},
+		chatType: {
+			get: () => msg.admission?.conversation.kind ?? fallbackChatType,
+			set: (value) => {
+				const next = value;
+				fallbackChatType = next;
+				if (msg.admission) msg.admission.conversation.kind = next;
+			}
+		}
+	});
+}
 function withDeprecatedWebInboundMessageFlatAliases(msg) {
-	return defineDeprecatedAliasAccessors(msg, {
+	return defineDeprecatedAliasAccessors(defineDeprecatedAdmissionTopLevelAccessors(msg), {
 		id: {
 			get: () => msg.event.id,
 			set: (value) => msg.event.id = value
@@ -284,6 +338,7 @@ function normalizeLegacyFlatWebInboundMessage(msg) {
 	} : void 0;
 	return withDeprecatedWebInboundMessageFlatAliases({
 		...msg,
+		admission: msg.admission ?? buildDeprecatedFlatWhatsAppInboundAdmission(msg),
 		event: {
 			id: msg.id,
 			timestamp: msg.timestamp,
@@ -571,6 +626,7 @@ function recordAcceptedInboundActivity(accountId) {
 	});
 }
 function isRetryableSendDisconnectError(err) {
+	if (isWhatsAppSocketOperationTimeoutError(err)) return false;
 	return /closed|reset|timed\s*out|disconnect|no active socket/i.test(formatError(err));
 }
 function shouldClearSocketRefAfterSendFailure(err) {
@@ -588,6 +644,7 @@ async function attachWebInboxToSocket(options) {
 	const shouldRetryDisconnect = () => options.shouldRetryDisconnect?.() === true;
 	const disconnectRetryPolicy = options.disconnectRetryPolicy ?? DEFAULT_RECONNECT_POLICY;
 	const sendRetryMaxAttempts = disconnectRetryPolicy.maxAttempts > 0 ? disconnectRetryPolicy.maxAttempts : DEFAULT_RECONNECT_POLICY.maxAttempts;
+	const sendOperationTimeoutMs = resolveWhatsAppSocketOperationTimeoutMs(options.socketTiming.defaultQueryTimeoutMs);
 	let onCloseResolve = null;
 	const onClose = new Promise((resolve) => {
 		onCloseResolve = resolve;
@@ -600,7 +657,7 @@ async function attachWebInboxToSocket(options) {
 	};
 	const presence = options.selfChatMode ? "unavailable" : "available";
 	try {
-		await sock.sendPresenceUpdate(presence);
+		await createWhatsAppSocketOperationTimeoutAdapter(sock, sendOperationTimeoutMs).sendPresenceUpdate(presence);
 		logWhatsAppVerbose(options.verbose, `Sent global '${presence}' presence on connect`);
 	} catch (err) {
 		logWhatsAppVerbose(options.verbose, `Failed to send '${presence}' presence on connect: ${String(err)}`);
@@ -623,11 +680,11 @@ async function attachWebInboxToSocket(options) {
 	const pendingDebounceKeys = /* @__PURE__ */ new Set();
 	const activeInboundFlushes = /* @__PURE__ */ new Set();
 	const buildInboundDebounceKey = (msg) => {
+		const admission = requireWhatsAppInboundAdmission(msg);
 		const sender = msg.platform.sender;
-		const senderKey = msg.chatType === "group" ? getPrimaryIdentityId(sender ?? null) ?? msg.platform.senderJid ?? msg.platform.senderE164 ?? msg.platform.senderName ?? msg.from : msg.from;
+		const senderKey = admission.conversation.kind === "group" ? getPrimaryIdentityId(sender ?? null) ?? msg.platform.senderJid ?? msg.platform.senderE164 ?? msg.platform.senderName ?? admission.sender.id : admission.conversation.id;
 		if (!senderKey) return null;
-		const conversationKey = msg.chatType === "group" ? msg.platform.chatJid : msg.from;
-		return `${msg.accountId}:${conversationKey}:${senderKey}`;
+		return `${admission.accountId}:${admission.conversation.id}:${senderKey}`;
 	};
 	const shouldDebounceInboundMessage = (msg) => options.shouldDebounce?.(msg) ?? true;
 	const orderDebouncedInboundEntries = (entries) => entries.toSorted((a, b) => {
@@ -723,12 +780,19 @@ async function attachWebInboxToSocket(options) {
 			messageId
 		});
 	};
+	const trackLateAcceptedSend = (jid, promise) => {
+		promise.then((result) => {
+			rememberOutboundMessage(jid, result);
+		}, () => {});
+	};
 	const sendTrackedMessage = async (jid, content, sendOptions) => {
 		let lastErr = /* @__PURE__ */ new Error(RECONNECT_IN_PROGRESS_ERROR);
 		for (let attempt = 1;; attempt++) {
 			const currentSock = getCurrentSock();
 			if (currentSock) try {
-				const result = sendOptions ? await currentSock.sendMessage(jid, content, sendOptions) : await currentSock.sendMessage(jid, content);
+				const result = await createWhatsAppSocketOperationTimeoutAdapter(currentSock, sendOperationTimeoutMs, { onSendMessageTimeout: ({ jid: timedOutJid, promise }) => {
+					trackLateAcceptedSend(timedOutJid, promise);
+				} }).sendMessage(jid, content, sendOptions);
 				rememberOutboundMessage(jid, result);
 				return result;
 			} catch (err) {
@@ -747,6 +811,14 @@ async function attachWebInboxToSocket(options) {
 			}
 		}
 	};
+	const sendApiSocketOperations = {
+		sendMessage: (jid, content, sendOptions) => sendTrackedMessage(jid, content, sendOptions),
+		sendPresenceUpdate: async (presenceLocal, jid) => {
+			const currentSock = getCurrentSock();
+			if (!currentSock) throw new Error(RECONNECT_IN_PROGRESS_ERROR);
+			return await createWhatsAppSocketOperationTimeoutAdapter(currentSock, sendOperationTimeoutMs).sendPresenceUpdate(presenceLocal, jid);
+		}
+	};
 	const summarizeGroupMeta = async (meta) => {
 		const participantEntries = await Promise.all(meta.participants?.map(async (p) => {
 			const mapped = await resolveInboundJid(p.id);
@@ -858,6 +930,7 @@ async function attachWebInboxToSocket(options) {
 			from,
 			selfE164: self.e164 ?? null,
 			senderE164,
+			senderJid: participantJid,
 			group,
 			pushName: msg.pushName ?? void 0,
 			isFromMe: Boolean(msg.key?.fromMe),
@@ -890,12 +963,12 @@ async function attachWebInboxToSocket(options) {
 		if (!target || options.sendReadReceipts === false) return;
 		const { id, remoteJid, participant } = target;
 		try {
-			await (getCurrentSock() ?? sock).readMessages([{
+			await withWhatsAppSocketOperationTimeout("readMessages", (getCurrentSock() ?? sock).readMessages([{
 				remoteJid,
 				id,
 				participant,
 				fromMe: false
-			}]);
+			}]), sendOperationTimeoutMs);
 			const suffix = participant ? ` (participant ${participant})` : "";
 			logWhatsAppVerbose(options.verbose, `Marked message ${id} as read for ${remoteJid}${suffix}`);
 		} catch (err) {
@@ -905,14 +978,7 @@ async function attachWebInboxToSocket(options) {
 	const maybeLogSkippedSelfChatReadReceipt = (inbound, target) => {
 		if (target?.id && inbound.access.isSelfChat && options.verbose) logWhatsAppVerbose(options.verbose, `Self-chat mode: skipping read receipt for ${target.id}`);
 	};
-	const maybeMarkReadReceiptAfterCompletedDelivery = async (inbound, target) => {
-		if (inbound.access.isSelfChat) {
-			maybeLogSkippedSelfChatReadReceipt(inbound, target);
-			return;
-		}
-		await maybeMarkInboundAsRead(target);
-	};
-	const maybeMarkReadReceiptForSkippedAppend = async (inbound, target) => {
+	const maybeMarkNonSelfChatReadReceipt = async (inbound, target) => {
 		if (inbound.access.isSelfChat) {
 			maybeLogSkippedSelfChatReadReceipt(inbound, target);
 			return;
@@ -943,7 +1009,7 @@ async function attachWebInboxToSocket(options) {
 		const readReceipt = stored?.metadata?.readReceipt ?? buildReadReceiptTarget(inbound);
 		const deliveryReadReceipt = inbound.access.isSelfChat ? void 0 : readReceipt;
 		if (!stored && shouldSkipStaleAppend(msg, upsertType)) {
-			await maybeMarkReadReceiptForSkippedAppend(inbound, readReceipt);
+			await maybeMarkNonSelfChatReadReceipt(inbound, readReceipt);
 			return;
 		}
 		let durableId = stored?.id ?? (inbound.id ? createWhatsAppDurableInboundMessageId({
@@ -957,7 +1023,7 @@ async function attachWebInboxToSocket(options) {
 				receivedAt: inbound.messageTimestampMs
 			});
 			if (accepted.kind === "completed") {
-				await maybeMarkReadReceiptAfterCompletedDelivery(inbound, accepted.record.metadata?.readReceipt ?? deliveryReadReceipt);
+				await maybeMarkNonSelfChatReadReceipt(inbound, accepted.record.metadata?.readReceipt ?? deliveryReadReceipt);
 				return;
 			}
 			if (accepted.kind === "pending" && accepted.record.attempts === 0) return;
@@ -970,7 +1036,7 @@ async function attachWebInboxToSocket(options) {
 		const enriched = await enrichInboundMessage(msg);
 		if (!enriched) {
 			await completeUndeliverableDurableInbound(durableId, durableMetadata);
-			await maybeMarkReadReceiptAfterCompletedDelivery(inbound, deliveryReadReceipt);
+			await maybeMarkNonSelfChatReadReceipt(inbound, deliveryReadReceipt);
 			return;
 		}
 		const dedupeKey = inbound.id ? `${options.accountId}:${inbound.remoteJid}:${inbound.id}` : "";
@@ -978,7 +1044,7 @@ async function attachWebInboxToSocket(options) {
 		if (dedupeClaim !== "claimed") {
 			if (dedupeClaim === "duplicate") {
 				await completeUndeliverableDurableInbound(durableId, durableMetadata);
-				await maybeMarkReadReceiptAfterCompletedDelivery(inbound, deliveryReadReceipt);
+				await maybeMarkNonSelfChatReadReceipt(inbound, deliveryReadReceipt);
 			}
 			return;
 		}
@@ -1001,6 +1067,7 @@ async function attachWebInboxToSocket(options) {
 		const location = extractLocationData(msg.message ?? void 0);
 		const locationText = location ? formatLocationText(location) : void 0;
 		const contactContext = extractContactContext(msg.message ?? void 0);
+		const externalAdReplyContext = extractExternalAdReplyContext(msg.message ?? void 0);
 		let body = extractText(msg.message ?? void 0);
 		if (locationText) body = [body, locationText].filter(Boolean).join("\n").trim();
 		if (!body) {
@@ -1028,6 +1095,7 @@ async function attachWebInboxToSocket(options) {
 			body,
 			location: location ?? void 0,
 			contactContext,
+			externalAdReplyContext,
 			replyContext,
 			mediaPath,
 			mediaType,
@@ -1037,10 +1105,9 @@ async function attachWebInboxToSocket(options) {
 	const enqueueInboundMessage = async (msg, inbound, enriched, durable) => {
 		const chatJid = inbound.remoteJid;
 		const sendComposing = async () => {
-			const currentSock = getCurrentSock();
-			if (!currentSock) return;
+			if (!getCurrentSock()) return;
 			try {
-				await currentSock.sendPresenceUpdate("composing", chatJid);
+				await sendApiSocketOperations.sendPresenceUpdate("composing", chatJid);
 			} catch (err) {
 				logWhatsAppVerbose(options.verbose, `Presence update failed: ${String(err)}`);
 			}
@@ -1075,7 +1142,19 @@ async function attachWebInboxToSocket(options) {
 			participants: inbound.groupParticipants,
 			mentions: groupMentions
 		} : void 0;
+		const untrustedStructuredContext = [...enriched.contactContext ? [{
+			label: "WhatsApp contact",
+			source: "whatsapp",
+			type: enriched.contactContext.kind,
+			payload: enriched.contactContext
+		}] : [], ...enriched.externalAdReplyContext ? [{
+			label: "WhatsApp external ad reply",
+			source: "whatsapp",
+			type: "external_ad_reply",
+			payload: enriched.externalAdReplyContext
+		}] : []];
 		const inboundMessage = withDeprecatedWebInboundMessageFlatAliases({
+			admission: inbound.access.admission,
 			event: {
 				id: inbound.id,
 				timestamp
@@ -1083,12 +1162,7 @@ async function attachWebInboxToSocket(options) {
 			payload: {
 				body: enriched.body,
 				location: enriched.location ?? void 0,
-				untrustedStructuredContext: enriched.contactContext ? [{
-					label: "WhatsApp contact",
-					source: "whatsapp",
-					type: enriched.contactContext.kind,
-					payload: enriched.contactContext
-				}] : void 0,
+				untrustedStructuredContext: untrustedStructuredContext.length > 0 ? untrustedStructuredContext : void 0,
 				media
 			},
 			platform: {
@@ -1112,11 +1186,6 @@ async function attachWebInboxToSocket(options) {
 				reply,
 				sendMedia
 			},
-			from: inbound.from,
-			conversationId: inbound.from,
-			accountId: inbound.access.resolvedAccountId,
-			accessControlPassed: true,
-			chatType: inbound.group ? "group" : "direct",
 			quote: enriched.replyContext ? {
 				context: enriched.replyContext,
 				id: enriched.replyContext.id,
@@ -1138,12 +1207,15 @@ async function attachWebInboxToSocket(options) {
 			inboundMessage.debounceKey = debounceKey;
 			if (inboundDebounceMs > 0 && shouldDebounceInboundMessage(inboundMessage)) pendingDebounceKeys.add(debounceKey);
 		}
-		if (inboundMessage.event.id) cacheInboundMessageMeta(inboundMessage.accountId, inboundMessage.platform.chatJid, inboundMessage.event.id, {
-			participant: inboundMessage.platform.senderJid,
-			participantE164: inboundMessage.chatType === "direct" ? inboundMessage.platform.senderE164 : void 0,
-			body: inboundMessage.payload.body,
-			fromMe: inboundMessage.platform.fromMe
-		});
+		if (inboundMessage.event.id) {
+			const admission = requireWhatsAppInboundAdmission(inboundMessage);
+			cacheInboundMessageMeta(admission.accountId, inboundMessage.platform.chatJid, inboundMessage.event.id, {
+				participant: inboundMessage.platform.senderJid,
+				participantE164: admission.conversation.kind === "direct" ? inboundMessage.platform.senderE164 : void 0,
+				body: inboundMessage.payload.body,
+				fromMe: inboundMessage.platform.fromMe
+			});
+		}
 		try {
 			Promise.resolve(debouncer.enqueue(inboundMessage)).catch((err) => {
 				inboundLogger.error({ error: String(err) }, "failed handling inbound web message");
@@ -1254,14 +1326,7 @@ async function attachWebInboxToSocket(options) {
 		}
 	})();
 	const sendApi = createWebSendApi({
-		sock: {
-			sendMessage: (jid, content, optionsLocal) => sendTrackedMessage(jid, content, optionsLocal),
-			sendPresenceUpdate: async (presenceLocal, jid) => {
-				const currentSock = getCurrentSock();
-				if (!currentSock) throw new Error(RECONNECT_IN_PROGRESS_ERROR);
-				return currentSock.sendPresenceUpdate(presenceLocal, jid);
-			}
-		},
+		sock: sendApiSocketOperations,
 		defaultAccountId: options.accountId,
 		resolveOutboundMentions: ({ jid, text }) => resolveOutboundMentionsForGroup(jid, text),
 		authDir: options.authDir
@@ -1296,7 +1361,7 @@ async function attachWebInboxToSocket(options) {
 	};
 }
 async function monitorWebInbox(options) {
-	const socketTiming = resolveWhatsAppSocketTiming(options.cfg);
+	const socketTiming = options.socketTiming ?? resolveWhatsAppSocketTiming(options.cfg);
 	const sock = await createWaSocket(false, options.verbose, {
 		authDir: options.authDir,
 		...socketTiming
@@ -1308,12 +1373,14 @@ async function monitorWebInbox(options) {
 		throw err;
 	}
 	const shouldDebounce = options.shouldDebounce;
+	const normalizeAdmittedWebInboundMessage = (msg) => requireAdmittedWhatsAppInboundMessage(normalizeWebInboundMessage(msg));
 	return attachWebInboxToSocket({
 		...options,
 		onMessage: async (msg) => {
-			await options.onMessage(normalizeWebInboundMessage(msg));
+			await options.onMessage(normalizeAdmittedWebInboundMessage(msg));
 		},
-		shouldDebounce: shouldDebounce ? (msg) => shouldDebounce(normalizeWebInboundMessage(msg)) : void 0,
+		shouldDebounce: shouldDebounce ? (msg) => shouldDebounce(normalizeAdmittedWebInboundMessage(msg)) : void 0,
+		socketTiming,
 		sock
 	});
 }
@@ -1340,7 +1407,7 @@ function resolveMentionTargets(msg, authDir) {
 function isBotMentionedFromTargets(msg, mentionCfg, targets) {
 	const clean = (text) => normalizeMentionText(text);
 	const explicitSelfChatOverride = typeof mentionCfg.isSelfChat === "boolean";
-	const isGroupConversation = isWhatsAppGroupJid(msg.from);
+	const isGroupConversation = requireWhatsAppInboundAdmission(msg).conversation.kind === "group";
 	const isSelfChat = explicitSelfChatOverride ? Boolean(mentionCfg.isSelfChat) : isSelfChatMode(targets.self.e164, mentionCfg.allowFrom) && !isGroupConversation;
 	const hasMentions = targets.normalizedMentions.length > 0;
 	if (hasMentions && !isSelfChat) {
@@ -1364,7 +1431,7 @@ function debugMention(msg, mentionCfg, authDir) {
 	return {
 		wasMentioned: isBotMentionedFromTargets(msg, mentionCfg, mentionTargets),
 		details: {
-			from: msg.from,
+			from: requireWhatsAppInboundAdmission(msg).conversation.id,
 			body: msg.payload.body,
 			bodyClean: normalizeMentionText(msg.payload.body),
 			mentionedJids: msg.group?.mentions?.jids ?? null,
@@ -1582,9 +1649,11 @@ async function resolveGroupActivationFor(params) {
 //#region extensions/whatsapp/src/auto-reply/monitor/ack-reaction.ts
 async function maybeSendAckReaction(params) {
 	if (!params.msg.event.id) return null;
+	const admission = requireWhatsAppInboundAdmission(params.msg);
+	const accountId = admission.accountId;
 	if (resolveWhatsAppReactionLevel({
 		cfg: params.cfg,
-		accountId: params.accountId
+		accountId
 	}).level === "off") return null;
 	const ackConfig = params.cfg.channels?.whatsapp?.ackReaction;
 	const emoji = resolveWhatsAppAckEmoji({
@@ -1594,18 +1663,19 @@ async function maybeSendAckReaction(params) {
 	});
 	const directEnabled = ackConfig?.direct ?? true;
 	const groupMode = ackConfig?.group ?? "mentions";
-	const conversationIdForCheck = params.msg.conversationId ?? params.msg.from;
-	const activation = params.msg.chatType === "group" ? await resolveGroupActivationFor({
+	const isGroup = admission.conversation.kind === "group";
+	const conversationIdForCheck = admission.conversation.id;
+	const activation = isGroup ? await resolveGroupActivationFor({
 		cfg: params.cfg,
-		accountId: params.accountId,
+		accountId,
 		agentId: params.agentId,
 		sessionKey: params.sessionKey,
 		conversationId: conversationIdForCheck
 	}) : null;
 	const shouldSendReaction = () => shouldAckReactionForWhatsApp({
 		emoji,
-		isDirect: params.msg.chatType === "direct",
-		isGroup: params.msg.chatType === "group",
+		isDirect: admission.conversation.kind === "direct",
+		isGroup,
 		directEnabled,
 		groupMode,
 		wasMentioned: params.msg.wasMentioned === true,
@@ -1622,7 +1692,7 @@ async function maybeSendAckReaction(params) {
 		verbose: params.verbose,
 		fromMe: false,
 		...sender.jid ? { participant: sender.jid } : {},
-		...params.accountId ? { accountId: params.accountId } : {},
+		accountId,
 		cfg: params.cfg
 	};
 	return createAckReactionHandle({
@@ -1642,12 +1712,13 @@ async function maybeSendAckReaction(params) {
 //#endregion
 //#region extensions/whatsapp/src/auto-reply/monitor/broadcast.ts
 function buildBroadcastRouteKeys(params) {
+	const admission = requireWhatsAppInboundAdmission(params.msg);
 	const sessionKey = buildAgentSessionKey({
 		agentId: params.agentId,
 		channel: "whatsapp",
 		accountId: params.route.accountId,
 		peer: {
-			kind: params.msg.chatType === "group" ? "group" : "direct",
+			kind: admission.conversation.kind,
 			id: params.peerId
 		},
 		dmScope: params.cfg.session?.dmScope,
@@ -1674,7 +1745,8 @@ async function maybeBroadcastMessage(params) {
 	whatsappInboundLog.info(`Broadcasting message to ${broadcastAgents.length} agents (${strategy})`);
 	const agentIds = params.cfg.agents?.list?.map((agent) => normalizeAgentId(agent.id));
 	const hasKnownAgents = (agentIds?.length ?? 0) > 0;
-	const groupHistorySnapshot = params.msg.chatType === "group" ? params.groupHistories.get(params.groupHistoryKey) ?? [] : void 0;
+	const isGroupConversation = requireWhatsAppInboundAdmission(params.msg).conversation.kind === "group";
+	const groupHistorySnapshot = isGroupConversation ? params.groupHistories.get(params.groupHistoryKey) ?? [] : void 0;
 	const processForAgent = async (agentId) => {
 		const normalizedAgentId = normalizeAgentId(agentId);
 		if (hasKnownAgents && !agentIds?.includes(normalizedAgentId)) {
@@ -1693,7 +1765,7 @@ async function maybeBroadcastMessage(params) {
 			agentId: normalizedAgentId,
 			...routeKeys
 		};
-		const agentRoute = params.msg.chatType === "group" ? resolveWhatsAppGroupSessionRoute(baseAgentRoute) : baseAgentRoute;
+		const agentRoute = isGroupConversation ? resolveWhatsAppGroupSessionRoute(baseAgentRoute) : baseAgentRoute;
 		try {
 			const opts = {
 				groupHistory: groupHistorySnapshot,
@@ -1710,7 +1782,7 @@ async function maybeBroadcastMessage(params) {
 	};
 	if (strategy === "sequential") for (const agentId of broadcastAgents) await processForAgent(agentId);
 	else await Promise.allSettled(broadcastAgents.map(processForAgent));
-	if (params.msg.chatType === "group") params.groupHistories.set(params.groupHistoryKey, []);
+	if (isGroupConversation) params.groupHistories.set(params.groupHistoryKey, []);
 	return true;
 }
 //#endregion
@@ -1812,26 +1884,28 @@ function skipGroupMessageAndStoreHistory(params, verboseMessage, body) {
 async function applyGroupGating(params) {
 	const sender = getSenderIdentity(params.msg);
 	const self = getSelfIdentity(params.msg, params.authDir);
+	const admission = requireWhatsAppInboundAdmission(params.msg);
+	const conversationId = admission.conversation.id;
 	const inboundPolicy = resolveWhatsAppInboundPolicy({
 		cfg: params.cfg,
-		accountId: params.msg.accountId,
+		accountId: admission.accountId,
 		selfE164: self.e164 ?? null
 	});
-	const conversationGroupPolicy = inboundPolicy.resolveConversationGroupPolicy(params.conversationId);
+	const conversationGroupPolicy = inboundPolicy.resolveConversationGroupPolicy(conversationId);
 	if (conversationGroupPolicy.allowlistEnabled && !conversationGroupPolicy.allowed) {
 		const accountId = inboundPolicy.account.accountId;
-		if (shouldWarnForGroupDrop(`${accountId}:${params.conversationId}`)) {
+		if (shouldWarnForGroupDrop(`${accountId}:${conversationId}`)) {
 			const groupsPath = resolveWhatsAppGroupsConfigPath({
 				cfg: params.cfg,
 				accountId
 			});
 			params.replyLogger.warn({
-				conversationId: params.conversationId,
+				conversationId,
 				accountId,
 				groupsPath
-			}, `WhatsApp group ${params.conversationId} not in ${groupsPath} — inbound dropped. Add the group JID to ${groupsPath} (or add "*" there to admit all groups). Sender authorization still applies.`);
+			}, `WhatsApp group ${conversationId} not in ${groupsPath} — inbound dropped. Add the group JID to ${groupsPath} (or add "*" there to admit all groups). Sender authorization still applies.`);
 		}
-		params.logVerbose(`Dropping message from unregistered WhatsApp group ${params.conversationId}. Add the group JID to channels.whatsapp.groups, or add "*" there to admit all groups. Sender authorization still applies.`);
+		params.logVerbose(`Dropping message from unregistered WhatsApp group ${conversationId}. Add the group JID to channels.whatsapp.groups, or add "*" there to admit all groups. Sender authorization still applies.`);
 		return { shouldProcess: false };
 	}
 	noteGroupMember(params.groupMemberNames, params.groupHistoryKey, sender.e164 ?? void 0, sender.name ?? void 0);
@@ -1842,7 +1916,7 @@ async function applyGroupGating(params) {
 	const mentionConfig = {
 		...buildMentionConfig(params.cfg, params.agentId, {
 			provider: "whatsapp",
-			conversationId: params.conversationId,
+			conversationId,
 			providerPolicy: params.providerMentionPatterns
 		}),
 		allowFrom: inboundPolicy.configuredAllowFrom
@@ -1858,10 +1932,10 @@ async function applyGroupGating(params) {
 	const activationCommand = parseActivationCommand(commandBody);
 	const owner = isOwnerSender(baseMentionConfig, params.msg);
 	const shouldBypassMention = owner && hasControlCommand(commandBody, params.cfg);
-	if (activationCommand.hasCommand && !owner) return skipGroupMessageAndStoreHistory(params, `Ignoring /activation from non-owner in group ${params.conversationId}`);
+	if (activationCommand.hasCommand && !owner) return skipGroupMessageAndStoreHistory(params, `Ignoring /activation from non-owner in group ${conversationId}`);
 	const mentionDebug = debugMention(mentionMsg, mentionConfig, params.authDir);
 	params.replyLogger.debug({
-		conversationId: params.conversationId,
+		conversationId,
 		wasMentioned: mentionDebug.wasMentioned,
 		...mentionDebug.details
 	}, "group mention debug");
@@ -1871,7 +1945,7 @@ async function applyGroupGating(params) {
 		accountId: inboundPolicy.account.accountId,
 		agentId: params.agentId,
 		sessionKey: params.sessionKey,
-		conversationId: params.conversationId
+		conversationId
 	}) !== "always";
 	const replyContext = getReplyContext(params.msg, params.authDir);
 	const mentionDecision = resolveInboundMentionDecision({
@@ -1892,13 +1966,13 @@ async function applyGroupGating(params) {
 	params.msg.wasMentioned = effectiveWasMentioned;
 	if (!shouldBypassMention && requireMention && mentionDecision.shouldSkip) {
 		if (params.deferMissingMention === true) {
-			params.logVerbose(`Deferring group mention skip until audio preflight completes in ${params.conversationId}`);
+			params.logVerbose(`Deferring group mention skip until audio preflight completes in ${conversationId}`);
 			return {
 				shouldProcess: false,
 				needsMentionText: true
 			};
 		}
-		return skipGroupMessageAndStoreHistory(params, `Group message stored for context (no mention detected) in ${params.conversationId}: ${mentionMsg.payload.body}`, params.mentionText);
+		return skipGroupMessageAndStoreHistory(params, `Group message stored for context (no mention detected) in ${conversationId}: ${mentionMsg.payload.body}`, params.mentionText);
 	}
 	return { shouldProcess: true };
 }
@@ -1935,11 +2009,13 @@ function updateLastRouteInBackground(params) {
 //#endregion
 //#region extensions/whatsapp/src/auto-reply/monitor/peer.ts
 function resolvePeerId(msg) {
-	if (msg.chatType === "group") return msg.conversationId ?? msg.from;
+	const admission = requireWhatsAppInboundAdmission(msg);
+	if (admission.conversation.kind === "group") return admission.conversation.id;
 	const sender = getSenderIdentity(msg);
 	if (sender.e164) return normalizeE164(sender.e164) ?? sender.e164;
-	if (msg.from.includes("@")) return jidToE164(msg.from) ?? msg.from;
-	return normalizeE164(msg.from) ?? msg.from;
+	const conversationId = admission.conversation.id;
+	if (conversationId.includes("@")) return jidToE164(conversationId) ?? conversationId;
+	return normalizeE164(conversationId) ?? conversationId;
 }
 //#endregion
 //#region extensions/whatsapp/src/system-prompt.ts
@@ -2042,6 +2118,9 @@ function createWhatsAppReplyDeliveryReceipt(results) {
 }
 async function deliverWebReply(params) {
 	const { replyResult, msg, maxMediaBytes, textLimit, replyLogger, connectionId, skipLog } = params;
+	const admission = requireWhatsAppInboundAdmission(msg);
+	const conversationId = admission.conversation.id;
+	const isGroupConversation = admission.conversation.kind === "group";
 	const replyStarted = Date.now();
 	const sendResults = [];
 	const rememberSendResult = (result) => {
@@ -2055,7 +2134,7 @@ async function deliverWebReply(params) {
 		};
 	};
 	if (isReasoningReplyPayload(replyResult)) {
-		whatsappOutboundLog.debug(`Suppressed reasoning payload to ${msg.from}`);
+		whatsappOutboundLog.debug(`Suppressed reasoning payload to ${conversationId}`);
 		return finishDelivery();
 	}
 	const tableMode = params.tableMode ?? "code";
@@ -2065,12 +2144,12 @@ async function deliverWebReply(params) {
 	const mediaList = normalizedReply.mediaUrls ?? [];
 	const getQuote = () => {
 		if (!replyResult.replyToId) return;
-		const cached = lookupInboundMessageMeta(msg.accountId, msg.platform.chatJid, replyResult.replyToId);
+		const cached = lookupInboundMessageMeta(admission.accountId, msg.platform.chatJid, replyResult.replyToId);
 		return buildQuotedMessageOptions({
 			messageId: replyResult.replyToId,
 			remoteJid: msg.platform.chatJid,
 			fromMe: cached?.fromMe ?? false,
-			participant: cached?.participant ?? (msg.chatType === "group" ? msg.platform.senderJid : void 0),
+			participant: cached?.participant ?? (isGroupConversation ? msg.platform.senderJid : void 0),
 			messageText: cached?.body ?? ""
 		});
 	};
@@ -2080,7 +2159,7 @@ async function deliverWebReply(params) {
 				send: fn,
 				maxAttempts,
 				onRetry: ({ attempt, maxAttempts: retryMaxAttempts, backoffMs, errorText }) => {
-					logVerbose(`Retrying ${label} to ${msg.from} after failure (${attempt}/${retryMaxAttempts - 1}) in ${backoffMs}ms: ${errorText}`);
+					logVerbose(`Retrying ${label} to ${conversationId} after failure (${attempt}/${retryMaxAttempts - 1}) in ${backoffMs}ms: ${errorText}`);
 				}
 			});
 		} catch (error) {
@@ -2096,14 +2175,14 @@ async function deliverWebReply(params) {
 			rememberSendResult(await sendWithRetry(() => msg.platform.reply(chunk, quote), "text"));
 			if (!skipLog) {
 				const durationMs = Date.now() - chunkStarted;
-				whatsappOutboundLog.debug(`Sent chunk ${index + 1}/${totalChunks} to ${msg.from} (${durationMs.toFixed(0)}ms)`);
+				whatsappOutboundLog.debug(`Sent chunk ${index + 1}/${totalChunks} to ${conversationId} (${durationMs.toFixed(0)}ms)`);
 			}
 		}
 		const delivery = finishDelivery();
 		const logPayload = {
 			correlationId: msg.event.id ?? newConnectionId(),
 			connectionId: connectionId ?? null,
-			to: msg.from,
+			to: conversationId,
 			from: msg.platform.recipientJid,
 			text: elide(replyResult.text, 240),
 			mediaUrl: null,
@@ -2159,11 +2238,11 @@ async function deliverWebReply(params) {
 					mimetype: media.mimetype
 				}, quote), "media:document"));
 			}
-			whatsappOutboundLog.info(`Sent media reply to ${msg.from} (${(media.buffer.length / (1024 * 1024)).toFixed(2)}MB)`);
+			whatsappOutboundLog.info(`Sent media reply to ${conversationId} (${(media.buffer.length / (1024 * 1024)).toFixed(2)}MB)`);
 			replyLogger.info({
 				correlationId: msg.event.id ?? newConnectionId(),
 				connectionId: connectionId ?? null,
-				to: msg.from,
+				to: conversationId,
 				from: msg.platform.recipientJid,
 				text: caption ?? null,
 				mediaUrl,
@@ -2173,15 +2252,19 @@ async function deliverWebReply(params) {
 			}, "auto-reply sent (media)");
 		},
 		onError: async ({ error, mediaUrl, caption, isFirst }) => {
-			whatsappOutboundLog.error(`Failed sending web media to ${msg.from}: ${formatError(error)}`);
+			whatsappOutboundLog.error(`Failed sending web media to ${conversationId}: ${formatError(error)}`);
 			replyLogger.warn({
 				err: error,
 				mediaUrl
 			}, "failed to send web media reply");
-			if (!isFirst) return;
-			const fallbackText = [remainingText.shift() ?? caption ?? "", "⚠️ Media failed."].filter(Boolean).join("\n");
+			if (!isFirst) {
+				whatsappOutboundLog.warn(`Trailing media failed; sent warning to ${conversationId}`);
+				rememberSendResult(await sendWithRetry(() => msg.platform.reply("⚠️ Media unavailable.", getQuote()), "media:fallback-unavailable"));
+				return;
+			}
+			const fallbackText = [caption ?? "", "⚠️ Media failed."].filter(Boolean).join("\n");
 			if (!fallbackText) return;
-			whatsappOutboundLog.warn(`Media skipped; sent text-only to ${msg.from}`);
+			whatsappOutboundLog.warn(`Media skipped; sent text-only to ${conversationId}`);
 			rememberSendResult(await sendWithRetry(() => msg.platform.reply(fallbackText, getQuote()), "media:fallback-text"));
 		}
 	});
@@ -2218,7 +2301,7 @@ function resolveVisibleWhatsAppGroupHistory(params) {
 function resolveVisibleWhatsAppReplyContext(params) {
 	const replyTo = getReplyContext(params.msg, params.authDir);
 	if (!replyTo) return null;
-	const senderAllowed = params.msg.chatType !== "group" || params.groupPolicy !== "allowlist" ? true : isWhatsAppSupplementalSenderAllowed({
+	const senderAllowed = requireWhatsAppInboundAdmission(params.msg).conversation.kind !== "group" || params.groupPolicy !== "allowlist" ? true : isWhatsAppSupplementalSenderAllowed({
 		allowFrom: params.groupAllowFrom,
 		authDir: params.authDir,
 		sender: replyTo.sender
@@ -2251,14 +2334,15 @@ function markWhatsAppReplyDeliveryErrorVisibleAfterFlush(error, flushResult) {
 	return flushResult.delivered > 0 ? markWhatsAppVisibleDeliveryError(error) : error;
 }
 function logWhatsAppReplyDeliveryError(params) {
+	const admission = requireWhatsAppInboundAdmission(params.msg);
 	params.replyLogger.error({
 		err: normalizeErrForLog(params.err),
 		replyKind: params.info.kind,
 		correlationId: params.msg.event.id ?? null,
 		connectionId: params.connectionId,
-		conversationId: params.conversationId,
+		conversationId: admission.conversation.id,
 		chatId: params.msg.platform.chatJid ?? null,
-		to: params.msg.from ?? null,
+		to: admission.conversation.id,
 		from: params.msg.platform.recipientJid ?? null
 	}, "auto-reply delivery failed");
 }
@@ -2327,7 +2411,10 @@ function resolveWhatsAppResponsePrefix(params) {
 	return params.pipelineResponsePrefix ?? (configuredResponsePrefix === void 0 && params.isSelfChat ? resolveIdentityNamePrefix$1(params.cfg, params.agentId) : void 0);
 }
 async function buildWhatsAppInboundContext(params) {
-	const inboundHistory = params.msg.chatType === "group" ? buildInboundHistoryFromEntries({
+	const admission = requireWhatsAppInboundAdmission(params.msg);
+	const conversationId = admission.conversation.id;
+	const conversationKind = admission.conversation.kind;
+	const inboundHistory = conversationKind === "group" ? buildInboundHistoryFromEntries({
 		entries: (params.groupHistory ?? []).map((entry) => ({
 			sender: entry.sender,
 			body: entry.body,
@@ -2356,15 +2443,15 @@ async function buildWhatsAppInboundContext(params) {
 		media,
 		messageId: params.msg.event.id,
 		timestamp: params.msg.event.timestamp,
-		from: params.msg.from,
+		from: conversationId,
 		sender: {
 			id: params.sender.id ?? params.sender.e164,
 			name: params.sender.name
 		},
 		conversation: {
-			kind: params.msg.chatType,
-			id: params.conversationId,
-			label: params.msg.chatType === "group" ? params.conversationId : params.msg.from
+			kind: conversationKind,
+			id: conversationId,
+			label: conversationId
 		},
 		route: {
 			agentId: params.route.agentId,
@@ -2373,7 +2460,7 @@ async function buildWhatsAppInboundContext(params) {
 		},
 		reply: {
 			to: params.msg.platform.recipientJid,
-			originatingTo: params.msg.from
+			originatingTo: conversationId
 		},
 		message: {
 			body: params.combinedBody,
@@ -2384,7 +2471,7 @@ async function buildWhatsAppInboundContext(params) {
 		},
 		access: {
 			...params.msg.wasMentioned !== void 0 ? { mentions: {
-				canDetectMention: params.msg.chatType === "group",
+				canDetectMention: conversationKind === "group",
 				wasMentioned: params.msg.wasMentioned
 			} } : {},
 			commands: { authorized: params.commandAuthorized }
@@ -2434,10 +2521,12 @@ function normalizeCommandTurnFromContext(value) {
 	};
 }
 function resolveWhatsAppDmRouteTarget(params) {
-	if (params.msg.chatType === "group") return;
+	const admission = requireWhatsAppInboundAdmission(params.msg);
+	const conversationId = admission.conversation.id;
+	if (admission.conversation.kind === "group") return;
 	if (params.senderE164) return params.normalizeE164(params.senderE164) ?? void 0;
-	if (params.msg.from.includes("@")) return jidToE164(params.msg.from) ?? void 0;
-	return params.normalizeE164(params.msg.from) ?? void 0;
+	if (conversationId.includes("@")) return jidToE164(conversationId) ?? void 0;
+	return params.normalizeE164(conversationId) ?? void 0;
 }
 function updateWhatsAppMainLastRoute(params) {
 	const shouldUpdateMainLastRoute = !params.pinnedMainDmRecipient || params.pinnedMainDmRecipient === params.dmRouteTarget;
@@ -2462,6 +2551,9 @@ function updateWhatsAppMainLastRoute(params) {
 	if (params.dmRouteTarget && inboundLastRouteSessionKey === params.route.mainSessionKey && params.pinnedMainDmRecipient) logVerbose$1(`Skipping main-session last route update for ${params.dmRouteTarget} (pinned owner ${params.pinnedMainDmRecipient})`);
 }
 async function dispatchWhatsAppBufferedReply(params) {
+	const admission = requireWhatsAppInboundAdmission(params.msg);
+	const conversationId = admission.conversation.id;
+	const conversationKind = admission.conversation.kind;
 	const statusReactionController = params.statusReactionController ?? null;
 	const statusReactionTiming = {
 		...DEFAULT_TIMING,
@@ -2476,7 +2568,7 @@ async function dispatchWhatsAppBufferedReply(params) {
 		accountId: params.route.accountId
 	});
 	const mediaLocalRoots = getAgentScopedMediaLocalRoots(params.cfg, params.route.agentId);
-	const sourceReplyChatType = typeof params.context.ChatType === "string" ? params.context.ChatType : params.msg.chatType;
+	const sourceReplyChatType = typeof params.context.ChatType === "string" ? params.context.ChatType : conversationKind;
 	const sourceReplyCommandSource = params.context.CommandSource === "native" || params.context.CommandSource === "text" ? params.context.CommandSource : void 0;
 	const sourceReplyCommandTurn = normalizeCommandTurnFromContext(params.context.CommandTurn);
 	const sourceReplyCommandAuthorized = typeof params.context.CommandAuthorized === "boolean" ? params.context.CommandAuthorized : void 0;
@@ -2512,9 +2604,9 @@ async function dispatchWhatsAppBufferedReply(params) {
 			params.replyLogger.warn({
 				correlationId: params.msg.event.id ?? null,
 				connectionId: params.connectionId,
-				conversationId: params.conversationId,
+				conversationId,
 				chatId: params.msg.platform.chatJid,
-				to: params.msg.from,
+				to: conversationId,
 				from: params.msg.platform.recipientJid,
 				replyKind: info.kind
 			}, "auto-reply was not accepted by WhatsApp provider");
@@ -2527,7 +2619,7 @@ async function dispatchWhatsAppBufferedReply(params) {
 			combinedBodySessionKey: params.route.sessionKey,
 			logVerboseMessage: shouldLog
 		});
-		const fromDisplay = params.msg.chatType === "group" ? params.conversationId : params.msg.from ?? "unknown";
+		const fromDisplay = conversationId;
 		if (shouldLogVerbose$1()) logVerbose$1(`Reply body: ${normalizedDeliveryPayload.text != null ? reply.text : "<media>"}${reply.hasMedia ? " (media)" : ""} -> ${fromDisplay}`);
 		return whatsAppReplyDeliveryVisibility(true);
 	};
@@ -2569,7 +2661,7 @@ async function dispatchWhatsAppBufferedReply(params) {
 							ctxPayload: params.context,
 							payload: normalizedDeliveryPayload,
 							info,
-							to: params.msg.from,
+							to: conversationId,
 							formatting: {
 								textLimit,
 								tableMode,
@@ -2639,14 +2731,13 @@ async function dispatchWhatsAppBufferedReply(params) {
 					err,
 					info,
 					connectionId: params.connectionId,
-					conversationId: params.conversationId,
 					msg: params.msg,
 					replyLogger: params.replyLogger
 				});
 			}
 		},
 		replyOptions: {
-			suppressTyping: sourceRepliesAreToolOnly && params.msg.chatType === "group" && !params.msg.wasMentioned,
+			suppressTyping: sourceRepliesAreToolOnly && conversationKind === "group" && !params.msg.wasMentioned,
 			disableBlockStreaming,
 			...sourceReplyDeliveryMode ? { sourceReplyDeliveryMode } : {},
 			onModelSelected: params.onModelSelected,
@@ -2737,16 +2828,19 @@ function buildInboundLine(params) {
 		configured: cfg.channels?.whatsapp?.messagePrefix,
 		hasAllowFrom: (cfg.channels?.whatsapp?.allowFrom?.length ?? 0) > 0
 	});
+	const admission = requireWhatsAppInboundAdmission(msg);
+	const conversationId = admission.conversation.id;
+	const conversationKind = admission.conversation.kind;
 	const prefixStr = messagePrefix ? `${messagePrefix} ` : "";
 	const replyContext = params.visibleReplyTo === void 0 ? formatReplyContext(msg) : formatReplyTarget(params.visibleReplyTo);
 	const baseLine = `${prefixStr}${msg.payload.body}${replyContext ? `\n\n${replyContext}` : ""}`;
 	const sender = getSenderIdentity(msg);
 	return formatInboundEnvelope({
 		channel: "WhatsApp",
-		from: msg.chatType === "group" ? msg.from : msg.from?.replace(/^whatsapp:/, ""),
+		from: conversationKind === "group" ? conversationId : conversationId.replace(/^whatsapp:/, ""),
 		timestamp: msg.event.timestamp,
 		body: baseLine,
-		chatType: msg.chatType,
+		chatType: conversationKind,
 		sender: {
 			name: sender.name ?? void 0,
 			e164: sender.e164 ?? void 0,
@@ -2763,9 +2857,11 @@ async function createWhatsAppStatusReactionController(params) {
 	if (!params.msg.event.id) return null;
 	const statusReactionsConfig = params.cfg.messages?.statusReactions;
 	if (statusReactionsConfig?.enabled !== true) return null;
+	const admission = requireWhatsAppInboundAdmission(params.msg);
+	const accountId = admission.accountId;
 	if (resolveWhatsAppReactionLevel({
 		cfg: params.cfg,
-		accountId: params.accountId
+		accountId
 	}).level === "off") return null;
 	const ackConfig = params.cfg.channels?.whatsapp?.ackReaction;
 	const ackEmoji = resolveWhatsAppAckEmoji({
@@ -2776,18 +2872,19 @@ async function createWhatsAppStatusReactionController(params) {
 	if (!ackEmoji) return null;
 	const directEnabled = ackConfig?.direct ?? true;
 	const groupMode = ackConfig?.group ?? "mentions";
-	const conversationIdForCheck = params.msg.conversationId ?? params.msg.from;
-	const activation = params.msg.chatType === "group" ? await resolveGroupActivationFor({
+	const isGroup = admission.conversation.kind === "group";
+	const conversationIdForCheck = admission.conversation.id;
+	const activation = isGroup ? await resolveGroupActivationFor({
 		cfg: params.cfg,
-		accountId: params.accountId,
+		accountId,
 		agentId: params.agentId,
 		sessionKey: params.sessionKey,
 		conversationId: conversationIdForCheck
 	}) : null;
 	if (!shouldAckReactionForWhatsApp({
 		emoji: ackEmoji,
-		isDirect: params.msg.chatType === "direct",
-		isGroup: params.msg.chatType === "group",
+		isDirect: admission.conversation.kind === "direct",
+		isGroup,
 		directEnabled,
 		groupMode,
 		wasMentioned: params.msg.wasMentioned === true,
@@ -2798,7 +2895,7 @@ async function createWhatsAppStatusReactionController(params) {
 		verbose: params.verbose,
 		fromMe: false,
 		...sender.jid ? { participant: sender.jid } : {},
-		...params.accountId ? { accountId: params.accountId } : {},
+		accountId,
 		cfg: params.cfg
 	};
 	const chatId = params.msg.platform.chatJid;
@@ -2862,11 +2959,14 @@ function resolvePinnedMainDmRecipient(params) {
 	});
 }
 async function processMessage(params) {
-	const conversationId = params.msg.conversationId ?? params.msg.from;
+	const admission = requireWhatsAppInboundAdmission(params.msg);
+	if (admission.ingress.admission !== "dispatch" && admission.ingress.admission !== "observe") return false;
+	const conversationId = admission.conversation.id;
+	const conversationKind = admission.conversation.kind;
 	const self = getSelfIdentity(params.msg);
 	const inboundPolicy = resolveWhatsAppInboundPolicy({
 		cfg: params.cfg,
-		accountId: params.route.accountId ?? params.msg.accountId,
+		accountId: params.route.accountId ?? admission.accountId,
 		selfE164: self.e164 ?? null
 	});
 	const account = inboundPolicy.account;
@@ -2888,7 +2988,7 @@ async function processMessage(params) {
 			ctx: {
 				MediaPaths: [params.msg.payload.media?.path],
 				MediaTypes: params.msg.payload.media?.type ? [params.msg.payload.media?.type] : void 0,
-				From: params.msg.from,
+				From: conversationId,
 				To: params.msg.platform.recipientJid,
 				Provider: "whatsapp",
 				Surface: "whatsapp",
@@ -2924,14 +3024,14 @@ async function processMessage(params) {
 		visibleReplyTo
 	});
 	let shouldClearGroupHistory = false;
-	const visibleGroupHistory = params.msg.chatType === "group" ? resolveVisibleWhatsAppGroupHistory({
+	const visibleGroupHistory = conversationKind === "group" ? resolveVisibleWhatsAppGroupHistory({
 		history: params.groupHistory ?? params.groupHistories.get(params.groupHistoryKey) ?? [],
 		mode: contextVisibilityMode,
 		groupPolicy: inboundPolicy.groupPolicy,
 		groupAllowFrom: inboundPolicy.groupAllowFrom,
 		authDir: account.authDir
 	}) : void 0;
-	if (params.msg.chatType === "group") {
+	if (conversationKind === "group") {
 		const history = visibleGroupHistory ?? [];
 		if (history.length > 0) combinedBody = buildHistoryContextFromEntries({
 			entries: history.map((m) => ({
@@ -2969,9 +3069,7 @@ async function processMessage(params) {
 		msg: params.msg,
 		agentId: params.route.agentId,
 		sessionKey: params.route.sessionKey,
-		conversationId,
-		verbose: params.verbose,
-		accountId: account.accountId
+		verbose: params.verbose
 	}) : null);
 	if (statusReactionController && !params.statusReactionController) statusReactionController.setQueued();
 	let ackReaction = params.ackReaction ?? null;
@@ -2980,9 +3078,7 @@ async function processMessage(params) {
 		msg: params.msg,
 		agentId: params.route.agentId,
 		sessionKey: params.route.sessionKey,
-		conversationId,
 		verbose: params.verbose,
-		accountId: account.accountId,
 		info: params.replyLogger.info.bind(params.replyLogger),
 		warn: params.replyLogger.warn.bind(params.replyLogger)
 	});
@@ -2990,15 +3086,15 @@ async function processMessage(params) {
 	params.replyLogger.info({
 		connectionId: params.connectionId,
 		correlationId,
-		from: params.msg.chatType === "group" ? conversationId : params.msg.from,
+		from: conversationId,
 		to: params.msg.platform.recipientJid,
 		body: elide(combinedBody, 240),
 		mediaType: params.msg.payload.media?.type ?? null,
 		mediaPath: params.msg.payload.media?.path ?? null
 	}, "inbound web message");
-	const fromDisplay = params.msg.chatType === "group" ? conversationId : params.msg.from;
+	const fromDisplay = conversationId;
 	const kindLabel = params.msg.payload.media?.type ? `, ${params.msg.payload.media?.type}` : "";
-	whatsappInboundLog.info(`Inbound message ${fromDisplay} -> ${params.msg.platform.recipientJid} (${params.msg.chatType}${kindLabel}, ${combinedBody.length} chars)`);
+	whatsappInboundLog.info(`Inbound message ${fromDisplay} -> ${params.msg.platform.recipientJid} (${conversationKind}${kindLabel}, ${combinedBody.length} chars)`);
 	if (shouldLogVerbose$1()) whatsappInboundLog.debug(`Inbound body: ${elide(combinedBody, 400)}`);
 	const sender = getSenderIdentity(params.msg);
 	const dmRouteTarget = resolveWhatsAppDmRouteTarget({
@@ -3033,16 +3129,16 @@ async function processMessage(params) {
 	const responsePrefix = resolveWhatsAppResponsePrefix({
 		cfg: params.cfg,
 		agentId: params.route.agentId,
-		isSelfChat: params.msg.chatType !== "group" && inboundPolicy.isSelfChat,
+		isSelfChat: conversationKind !== "group" && inboundPolicy.isSelfChat,
 		pipelineResponsePrefix: replyPipeline.responsePrefix
 	});
 	const replyThreading = resolveBatchedReplyThreadingPolicy(account.replyToMode ?? "off", params.msg.event.isBatched === true);
-	const conversationSystemPrompt = params.msg.chatType === "group" ? resolveWhatsAppGroupSystemPrompt({
+	const conversationSystemPrompt = conversationKind === "group" ? resolveWhatsAppGroupSystemPrompt({
 		accountConfig: account,
 		groupId: conversationId
 	}) : resolveWhatsAppDirectSystemPrompt({
 		accountConfig: account,
-		peerId: dmRouteTarget ?? params.msg.from
+		peerId: dmRouteTarget ?? conversationId
 	});
 	const ctxPayload = await buildWhatsAppInboundContext({
 		bodyForAgent: msgForAgent.payload.body,
@@ -3050,7 +3146,6 @@ async function processMessage(params) {
 		commandBody: params.msg.payload.body,
 		commandAuthorized,
 		commandTurn,
-		conversationId,
 		groupHistory: visibleGroupHistory,
 		groupMemberRoster: params.groupMemberNames.get(params.groupHistoryKey),
 		groupSystemPrompt: conversationSystemPrompt,
@@ -3101,6 +3196,26 @@ async function processMessage(params) {
 				textForCommands: ctxPayload.CommandBody,
 				raw: params.msg
 			}),
+			preflight: () => {
+				const reason = admission.ingress.reasonCode;
+				if (admission.ingress.admission === "dispatch") return { admission: {
+					kind: "dispatch",
+					reason
+				} };
+				if (admission.ingress.admission === "observe") return { admission: {
+					kind: "observeOnly",
+					reason
+				} };
+				if (admission.ingress.admission === "skip") return { admission: {
+					kind: "handled",
+					reason
+				} };
+				return { admission: {
+					kind: "drop",
+					reason,
+					recordHistory: false
+				} };
+			},
 			resolveTurn: () => ({
 				channel: "whatsapp",
 				accountId: params.route.accountId,
@@ -3124,7 +3239,6 @@ async function processMessage(params) {
 					cfg: params.cfg,
 					connectionId: params.connectionId,
 					context: ctxPayload,
-					conversationId,
 					deliverReply: deliverWebReply,
 					groupHistories: params.groupHistories,
 					groupHistoryKey: params.groupHistoryKey,
@@ -3164,11 +3278,12 @@ async function processMessage(params) {
 //#endregion
 //#region extensions/whatsapp/src/auto-reply/monitor/on-message.ts
 function createWebOnMessageHandler(params) {
+	const hasExplicitlyPassedInboundAccess = (msg) => msg.admission ? msg.admission.ingress.decision === "allow" : msg.accessControlPassed === true;
 	const withDirectSenderPeer = (msg, peerId) => {
-		if (msg.chatType === "group" || msg.platform.sender?.e164 || msg.platform.senderE164 || !peerId.startsWith("+")) return msg;
+		if (requireWhatsAppInboundAdmission(msg).conversation.kind === "group" || msg.platform.sender?.e164 || msg.platform.senderE164 || !peerId.startsWith("+")) return msg;
 		const normalized = normalizeE164(peerId);
 		if (!normalized) return msg;
-		return withDeprecatedWebInboundMessageFlatAliases({
+		return requireAdmittedWhatsAppInboundMessage(withDeprecatedWebInboundMessageFlatAliases({
 			...msg,
 			platform: {
 				...msg.platform,
@@ -3178,7 +3293,7 @@ function createWebOnMessageHandler(params) {
 				},
 				senderE164: normalized
 			}
-		});
+		}));
 	};
 	const processForRoute = async (cfg, msg, route, groupHistoryKey, opts) => {
 		const processParams = {
@@ -3208,28 +3323,32 @@ function createWebOnMessageHandler(params) {
 		return processMessage(processParams);
 	};
 	return async (rawMsg) => {
-		const normalizedMsg = normalizeWebInboundMessage(rawMsg);
+		const canRunDirectEarlyAudioPreflight = hasExplicitlyPassedInboundAccess(rawMsg);
+		const normalizedMsg = requireAdmittedWhatsAppInboundMessage(normalizeWebInboundMessage(rawMsg));
 		const cfg = params.loadConfig?.() ?? params.cfg;
 		const peerId = resolvePeerId(normalizedMsg);
 		const msg = withDirectSenderPeer(normalizedMsg, peerId);
-		const conversationId = msg.conversationId ?? msg.from;
+		const admission = requireWhatsAppInboundAdmission(msg);
+		if (admission.ingress.admission !== "dispatch" && admission.ingress.admission !== "observe") return;
+		const conversationId = admission.conversation.id;
+		const conversationKind = admission.conversation.kind;
 		const baseRoute = resolveAgentRoute({
 			cfg,
 			channel: "whatsapp",
-			accountId: msg.accountId,
+			accountId: admission.accountId,
 			peer: {
-				kind: msg.chatType === "group" ? "group" : "direct",
+				kind: conversationKind,
 				id: peerId
 			}
 		});
-		const baseConversationRoute = msg.chatType === "group" ? resolveWhatsAppGroupSessionRoute(baseRoute) : baseRoute;
-		const routeAccountId = baseConversationRoute.accountId ?? msg.accountId ?? params.account.accountId ?? "default";
+		const baseConversationRoute = conversationKind === "group" ? resolveWhatsAppGroupSessionRoute(baseRoute) : baseRoute;
+		const routeAccountId = baseConversationRoute.accountId ?? admission.accountId;
 		const account = resolveWhatsAppAccount({
 			cfg,
 			accountId: routeAccountId
 		});
 		const baseMentionConfig = buildMentionConfig(cfg);
-		if (msg.from === msg.platform.recipientJid) logVerbose(`📱 Same-phone mode detected (from === to: ${msg.from})`);
+		if (conversationId === msg.platform.recipientJid) logVerbose(`📱 Same-phone mode detected (from === to: ${conversationId})`);
 		if (params.echoTracker.has(msg.payload.body)) {
 			logVerbose("Skipping auto-reply: detected echo (message matches recently sent text)");
 			params.echoTracker.forget(msg.payload.body);
@@ -3243,7 +3362,7 @@ function createWebOnMessageHandler(params) {
 			conversationId: peerId
 		});
 		const route = configuredRoute.route;
-		const groupHistoryKey = msg.chatType === "group" ? buildGroupHistoryKey({
+		const groupHistoryKey = conversationKind === "group" ? buildGroupHistoryKey({
 			channel: "whatsapp",
 			accountId: route.accountId,
 			peerKind: "group",
@@ -3251,7 +3370,7 @@ function createWebOnMessageHandler(params) {
 		}) : route.sessionKey;
 		let preflightAudioTranscript;
 		const hasAudioBody = msg.payload.media?.type?.startsWith("audio/") === true && msg.payload.body === "<media:audio>";
-		const canRunEarlyAudioPreflight = msg.chatType === "group" || msg.accessControlPassed === true;
+		const canRunEarlyAudioPreflight = conversationKind === "group" || canRunDirectEarlyAudioPreflight;
 		let ackAlreadySent = false;
 		let ackReaction = null;
 		let statusReactionController = null;
@@ -3259,13 +3378,37 @@ function createWebOnMessageHandler(params) {
 		const clearPreDispatchReaction = async () => {
 			try {
 				if (statusReactionController) {
-					statusReactionController.cancelPending();
-					await statusReactionController.clear();
+					const controller = statusReactionController;
+					statusReactionController = null;
+					controller.cancelPending();
+					await controller.clear();
 					return;
 				}
 				if (ackReaction && await ackReaction.ackReactionPromise) await ackReaction.remove();
 			} catch (err) {
-				params.replyLogger.warn({ error: String(err) }, "whatsapp: failed to clear pre-dispatch reaction after configured ACP readiness failure");
+				params.replyLogger.warn({ error: String(err) }, "whatsapp: failed to clear pre-dispatch reaction after pre-dispatch rejection");
+			}
+		};
+		const transcribeAudioOnce = async () => {
+			if (preflightAudioTranscript !== void 0 || !hasAudioBody || !msg.payload.media?.path) return;
+			try {
+				const { transcribeFirstAudio } = await import("./audio-preflight.runtime-C_glQhZY.js");
+				preflightAudioTranscript = await transcribeFirstAudio({
+					ctx: {
+						MediaPaths: [msg.payload.media?.path],
+						MediaTypes: msg.payload.media?.type ? [msg.payload.media?.type] : void 0,
+						From: conversationId,
+						To: msg.platform.recipientJid,
+						Provider: "whatsapp",
+						Surface: "whatsapp",
+						OriginatingChannel: "whatsapp",
+						OriginatingTo: conversationId,
+						AccountId: route.accountId
+					},
+					cfg
+				}) ?? null;
+			} catch {
+				preflightAudioTranscript = null;
 			}
 		};
 		const runAudioPreflightOnce = async () => {
@@ -3276,9 +3419,7 @@ function createWebOnMessageHandler(params) {
 					msg,
 					agentId: route.agentId,
 					sessionKey: route.sessionKey,
-					conversationId,
-					verbose: params.verbose,
-					accountId: route.accountId
+					verbose: params.verbose
 				});
 				if (statusReactionController) await statusReactionController.setQueued();
 			} else {
@@ -3287,42 +3428,22 @@ function createWebOnMessageHandler(params) {
 					msg,
 					agentId: route.agentId,
 					sessionKey: route.sessionKey,
-					conversationId,
 					verbose: params.verbose,
-					accountId: route.accountId,
 					info: params.replyLogger.info.bind(params.replyLogger),
 					warn: params.replyLogger.warn.bind(params.replyLogger)
 				});
 				ackAlreadySent = ackReaction !== null;
 			}
-			try {
-				const { transcribeFirstAudio } = await import("./audio-preflight.runtime-C_glQhZY.js");
-				preflightAudioTranscript = await transcribeFirstAudio({
-					ctx: {
-						MediaPaths: [msg.payload.media?.path],
-						MediaTypes: msg.payload.media?.type ? [msg.payload.media?.type] : void 0,
-						From: msg.from,
-						To: msg.platform.recipientJid,
-						Provider: "whatsapp",
-						Surface: "whatsapp",
-						OriginatingChannel: "whatsapp",
-						OriginatingTo: conversationId,
-						AccountId: route.accountId
-					},
-					cfg
-				}) ?? null;
-			} catch {
-				preflightAudioTranscript = null;
-			}
+			await transcribeAudioOnce();
 		};
-		if (msg.chatType === "group") {
+		if (conversationKind === "group") {
 			const sender = getSenderIdentity(msg);
 			const metaCtx = {
-				From: msg.from,
+				From: conversationId,
 				To: msg.platform.recipientJid,
 				SessionKey: route.sessionKey,
 				AccountId: route.accountId,
-				ChatType: msg.chatType,
+				ChatType: conversationKind,
 				ConversationLabel: conversationId,
 				GroupSubject: msg.group?.subject,
 				SenderName: sender.name ?? void 0,
@@ -3344,13 +3465,11 @@ function createWebOnMessageHandler(params) {
 				ctx: metaCtx,
 				warn: params.replyLogger.warn.bind(params.replyLogger)
 			});
-			if (configuredRoute.bindingResolution) recordAcceptedConfiguredGroupRoute = recordGroupRoute;
-			else recordGroupRoute();
+			recordAcceptedConfiguredGroupRoute = recordGroupRoute;
 			let gating = await applyGroupGating({
 				cfg,
 				msg,
 				deferMissingMention: hasAudioBody && Boolean(msg.payload.media?.path),
-				conversationId,
 				groupHistoryKey,
 				agentId: route.agentId,
 				sessionKey: route.sessionKey,
@@ -3370,7 +3489,6 @@ function createWebOnMessageHandler(params) {
 					cfg,
 					msg,
 					...typeof preflightAudioTranscript === "string" ? { mentionText: preflightAudioTranscript } : {},
-					conversationId,
 					groupHistoryKey,
 					agentId: route.agentId,
 					sessionKey: route.sessionKey,
@@ -3385,7 +3503,10 @@ function createWebOnMessageHandler(params) {
 					replyLogger: params.replyLogger
 				});
 			}
-			if (!gating.shouldProcess) return;
+			if (!gating.shouldProcess) {
+				await clearPreDispatchReaction();
+				return;
+			}
 		}
 		if (configuredRoute.bindingResolution) {
 			const ensured = await ensureConfiguredBindingRouteReady({
@@ -3398,8 +3519,14 @@ function createWebOnMessageHandler(params) {
 				return;
 			}
 		}
-		recordAcceptedConfiguredGroupRoute?.();
+		if (recordAcceptedConfiguredGroupRoute && !configuredRoute.bindingResolution) {
+			recordAcceptedConfiguredGroupRoute();
+			recordAcceptedConfiguredGroupRoute = null;
+		}
 		await runAudioPreflightOnce();
+		const hasBroadcastTargets = !configuredRoute.bindingResolution && Array.isArray(cfg.broadcast?.[peerId]) && cfg.broadcast[peerId].length > 0;
+		if (hasBroadcastTargets && statusReactionController) await clearPreDispatchReaction();
+		if (hasBroadcastTargets && !canRunEarlyAudioPreflight) await transcribeAudioOnce();
 		if (!configuredRoute.bindingResolution && await maybeBroadcastMessage({
 			cfg,
 			msg,
@@ -3408,11 +3535,12 @@ function createWebOnMessageHandler(params) {
 			groupHistoryKey,
 			groupHistories: params.groupHistories,
 			...preflightAudioTranscript !== void 0 ? { preflightAudioTranscript } : {},
-			...ackAlreadySent && msg.chatType !== "group" ? { ackAlreadySent: true } : {},
-			...ackReaction && msg.chatType !== "group" ? { ackReaction } : {},
-			...statusReactionController && msg.chatType !== "group" ? { ackAlreadySent: true } : {},
+			...ackAlreadySent && conversationKind !== "group" ? { ackAlreadySent: true } : {},
+			...ackReaction && conversationKind !== "group" ? { ackReaction } : {},
+			...statusReactionController && conversationKind !== "group" ? { ackAlreadySent: true } : {},
 			processMessage: (m, r, k, opts) => processForRoute(cfg, m, r, k, opts)
 		})) return;
+		recordAcceptedConfiguredGroupRoute?.();
 		await processForRoute(cfg, msg, route, groupHistoryKey, {
 			...preflightAudioTranscript !== void 0 ? { preflightAudioTranscript } : {},
 			...ackAlreadySent ? { ackAlreadySent: true } : {},
@@ -3480,29 +3608,6 @@ function resolveExplicitWhatsAppDebounceOverride(params) {
 function isRetryableAuthUnstableError(error) {
 	return error instanceof WhatsAppAuthUnstableError || typeof error === "object" && error !== null && "code" in error && error.code === "whatsapp-auth-unstable";
 }
-async function clearTerminalWebAuthState(params) {
-	try {
-		const cleared = await logoutWeb({
-			authDir: params.account.authDir,
-			isLegacyAuthDir: params.account.isLegacyAuthDir,
-			runtime: params.runtime
-		});
-		params.log.warn({
-			accountId: params.account.accountId,
-			cleared,
-			healthState: params.healthState,
-			status: params.statusLabel
-		}, "web reconnect: cleared cached auth after terminal close");
-	} catch (error) {
-		params.log.warn({
-			accountId: params.account.accountId,
-			error: formatError(error),
-			healthState: params.healthState,
-			status: params.statusLabel
-		}, "web reconnect: failed clearing cached auth after terminal close");
-		params.runtime.error(`WhatsApp Web cleanup failed after terminal close (status ${params.statusLabel}). Run \`${formatCliCommand("openclaw channels logout --channel whatsapp")}\`, then relink with \`${formatCliCommand("openclaw channels login --channel whatsapp")}\`.`);
-	}
-}
 const DEFAULT_TRANSPORT_TIMEOUT_MS = 300 * 1e3;
 async function monitorWebChannel(verbose, listenerFactory = attachWebInboxToSocket, keepAlive = true, replyResolver, runtime = defaultRuntime, abortSignal, tuning = {}) {
 	const activeReplyResolver = replyResolver ?? (await loadReplyResolverRuntime()).getReplyFromConfig;
@@ -3519,8 +3624,6 @@ async function monitorWebChannel(verbose, listenerFactory = attachWebInboxToSock
 		module: "web-reconnect",
 		runId
 	});
-	const statusController = createWebChannelStatusController(tuning.statusSink);
-	statusController.emit();
 	const baseCfg = getRuntimeConfig$1();
 	const sourceCfg = getRuntimeConfigSourceSnapshot();
 	const { cfg, account } = resolveWebMonitorConfigSnapshot({
@@ -3571,6 +3674,8 @@ async function monitorWebChannel(verbose, listenerFactory = attachWebInboxToSock
 		sleep,
 		isNonRetryableStatus: isNonRetryableWebCloseStatus
 	});
+	const statusController = createWebChannelStatusController(tuning.statusSink);
+	statusController.emit();
 	try {
 		while (true) {
 			if (stopRequested()) break;
@@ -3621,6 +3726,7 @@ async function monitorWebChannel(verbose, listenerFactory = attachWebInboxToSock
 							mediaMaxMb: account.mediaMaxMb,
 							selfChatMode: account.selfChatMode,
 							sendReadReceipts: account.sendReadReceipts,
+							socketTiming,
 							debounceMs: inboundDebounceMs,
 							shouldDebounce,
 							socketRef: controller.socketRef,
@@ -3696,25 +3802,9 @@ async function monitorWebChannel(verbose, listenerFactory = attachWebInboxToSock
 							reconnectAttempts: setupDecision.reconnectAttempts,
 							maxAttempts: reconnectPolicy.maxAttempts
 						}, "web reconnect: setup status error; max attempts reached");
-						if (setupDecision.healthState === "logged-out") {
-							await clearTerminalWebAuthState({
-								account,
-								runtime,
-								statusLabel: setupDecision.normalized.statusLabel,
-								healthState: setupDecision.healthState,
-								log: reconnectLogger
-							});
-							runtime.error(`WhatsApp session logged out during setup. Run \`${formatCliCommand("openclaw channels login --channel whatsapp")}\` to relink.`);
-						} else if (setupDecision.healthState === "conflict") {
-							await clearTerminalWebAuthState({
-								account,
-								runtime,
-								statusLabel: setupDecision.normalized.statusLabel,
-								healthState: setupDecision.healthState,
-								log: reconnectLogger
-							});
-							runtime.error(`WhatsApp Web connection closed during setup (status ${setupDecision.normalized.statusLabel}: session conflict). Resolve conflicting WhatsApp Web sessions, then relink with \`${formatCliCommand("openclaw channels login --channel whatsapp")}\`. Stopping web monitoring.`);
-						} else runtime.error(`WhatsApp Web connection closed during setup (status ${setupDecision.normalized.statusLabel}) after ${setupDecision.reconnectAttempts}/${reconnectPolicy.maxAttempts} attempts. Relink with \`${formatCliCommand("openclaw channels login --channel whatsapp")}\` if the issue persists.`);
+						if (setupDecision.healthState === "logged-out") runtime.error(`WhatsApp session logged out during setup. Run \`${formatCliCommand("openclaw channels login --channel whatsapp")}\` to relink.`);
+						else if (setupDecision.healthState === "conflict") runtime.error(`WhatsApp Web connection closed during setup (status ${setupDecision.normalized.statusLabel}: session conflict). Resolve conflicting WhatsApp Web sessions, then restart the channel. To force a fresh QR, run \`${formatCliCommand("openclaw channels logout --channel whatsapp")}\` before \`${formatCliCommand("openclaw channels login --channel whatsapp")}\`. Stopping web monitoring.`);
+						else runtime.error(`WhatsApp Web connection closed during setup (status ${setupDecision.normalized.statusLabel}) after ${setupDecision.reconnectAttempts}/${reconnectPolicy.maxAttempts} attempts. Relink with \`${formatCliCommand("openclaw channels login --channel whatsapp")}\` if the issue persists.`);
 						await controller.shutdown();
 						break;
 					}
@@ -3874,29 +3964,14 @@ async function monitorWebChannel(verbose, listenerFactory = attachWebInboxToSock
 					reconnectAttempts: decision.reconnectAttempts,
 					healthState: decision.healthState
 				});
-				if (decision.healthState === "logged-out") {
-					await clearTerminalWebAuthState({
-						account,
-						runtime,
-						statusLabel: decision.normalized.statusLabel,
-						healthState: decision.healthState,
-						log: reconnectLogger
-					});
-					runtime.error(`WhatsApp session logged out. Run \`${formatCliCommand("openclaw channels login --channel whatsapp")}\` to relink.`);
-				} else if (decision.healthState === "conflict") {
-					await clearTerminalWebAuthState({
-						account,
-						runtime,
-						statusLabel: decision.normalized.statusLabel,
-						healthState: decision.healthState,
-						log: reconnectLogger
-					});
+				if (decision.healthState === "logged-out") runtime.error(`WhatsApp session logged out. Run \`${formatCliCommand("openclaw channels login --channel whatsapp")}\` to relink.`);
+				else if (decision.healthState === "conflict") {
 					reconnectLogger.warn({
 						connectionId: connection.connectionId,
 						status: decision.normalized.statusLabel,
 						error: decision.normalized.errorText
 					}, "web reconnect: non-retryable close status; stopping monitor");
-					runtime.error(`WhatsApp Web connection closed (status ${decision.normalized.statusLabel}: session conflict). Resolve conflicting WhatsApp Web sessions, then relink with \`${formatCliCommand("openclaw channels login --channel whatsapp")}\`. Stopping web monitoring.`);
+					runtime.error(`WhatsApp Web connection closed (status ${decision.normalized.statusLabel}: session conflict). Resolve conflicting WhatsApp Web sessions, then restart the channel. To force a fresh QR, run \`${formatCliCommand("openclaw channels logout --channel whatsapp")}\` before \`${formatCliCommand("openclaw channels login --channel whatsapp")}\`. Stopping web monitoring.`);
 				} else {
 					reconnectLogger.warn({
 						connectionId: connection.connectionId,