@rubytech/create-realagent-code 0.1.579 → 0.1.580

package/payload/platform/plugins/admin/hooks/fs-schema-guard.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# fs-schema-guard — PreToolUse Write/Edit/NotebookEdit path guard.
+# fs-schema-guard — PreToolUse Write/Edit/MultiEdit/NotebookEdit path guard.
 #
 # Enforces the seeded account-dir file schema (see <accountDir>/SCHEMA.md):
 #   - the target's first path segment must be in the allowed top-level set
@@ -61,7 +61,7 @@ except Exception:
 
 TOOL_NAME=$(field '' tool_name)
 case "$TOOL_NAME" in
-  Write|Edit) FILE_PATH=$(field tool_input file_path) ;;
+  Write|Edit|MultiEdit) FILE_PATH=$(field tool_input file_path) ;;
   NotebookEdit) FILE_PATH=$(field tool_input notebook_path) ;;
   *) exit 0 ;;
 esac

package/payload/platform/plugins/admin/hooks/quote-path-write-gate.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# quote-path-write-gate — PreToolUse gate on Write / Edit / MultiEdit.
+# quote-path-write-gate — PreToolUse gate on Write / Edit / MultiEdit / NotebookEdit.
 #
 # The client quote document has one owner, and that ownership is a capability:
 # the quote-render tool is granted to the quoter's card and to no other, so no
@@ -49,10 +49,13 @@ try:
     d = json.loads(os.environ["INPUT"])
 except Exception:
     sys.exit(0)
-if (d.get("tool_name", "") or "") not in ("Write", "Edit", "MultiEdit"):
+if (d.get("tool_name", "") or "") not in ("Write", "Edit", "MultiEdit", "NotebookEdit"):
     sys.exit(0)
 ti = d.get("tool_input", {}) or {}
-target = ti.get("file_path") or ti.get("path") or ""
+# A notebook edit carries notebook_path; every other write tool carries
+# file_path, and none of them carries notebook_path, so the last rung fires for
+# a NotebookEdit alone.
+target = ti.get("file_path") or ti.get("path") or ti.get("notebook_path") or ""
 if not target:
     sys.exit(0)
 norm = os.path.normpath(target)

package/payload/platform/plugins/admin/skills/whats-new/SKILL.md

@@ -9,6 +9,13 @@ Invoked by the admin agent directly.
 
 This is the platform's release timeline, newest first. Each entry shows the date it shipped and the version it shipped in, so you can tell the operator how current their install is. To compare, read the installed version from `capabilities-here` and match it against the versions below. Keep answers high level and in plain English; this is a summary, not a full commit log.
 
+## 2026-08-08 (0.1.580)
+
+- Telegram is now a first-class channel rather than a thin pass-through. Answers arrive formatted and stream as they are written instead of landing as one late block; the assistant can ask a question with buttons, send media, and issue an invoice; and the conversation pane has its own look instead of wearing WhatsApp's green.
+- The Telegram composer no longer accepts a file it cannot send, and the buttons under a message stop working once the message they belong to is gone, rather than lingering.
+- A visit shared by two workers now reaches the portal once and pays both. It was arriving twice, and a single sheet could only ever pay one of them.
+- A safeguard on where files may be written now actually inspects multi-file edits. Two checks were registered for them and neither read them, so a whole class of edit passed unexamined.
+
 ## 2026-08-08 (0.1.579)
 
 - What a public web visitor reads is checked again before they see it. The check that strips private paths had been removed from this door on the reasoning that the reader downstream would apply it; it was not being applied there either.

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-schema-shape.test.ts

@@ -79,6 +79,29 @@ describe('portal schema shape', () => {
     expect(SQL).toMatch(/UNIQUE\s*\(\s*accountId,\s*relPath,\s*generation\s*\)/)
   })
 
+  it('keys a visits row on the attendance, so a shared visit is two rows', () => {
+    // Task 2512 made readVisitsForAccount return one row per attendance and left
+    // the table keyed on the visit, so the second worker's row failed the
+    // constraint, the insert threw, the generation was never flipped, and the
+    // account's published visits stopped refreshing. The key still rejects a TRUE
+    // duplicate — same visit, same worker, same generation — which is what stops
+    // a retried stage doubling a row.
+    expect(SQL).toMatch(/UNIQUE\s*\(\s*accountId,\s*visitId,\s*ownerId,\s*generation\s*\)/)
+    expect(SQL).not.toMatch(/UNIQUE\s*\(\s*accountId,\s*visitId,\s*generation\s*\)/)
+  })
+
+  it('gives a queued edit somewhere to say whose day it is', () => {
+    expect(tableBody('visit_status')).toMatch(/forOwnerId\s+TEXT\s+NOT NULL DEFAULT ''/)
+  })
+
+  it('documents the rebuild, because IF NOT EXISTS cannot widen a UNIQUE', () => {
+    // SQLite cannot drop the implicit index a UNIQUE clause creates, so an
+    // existing database needs the table rebuilt rather than altered. An
+    // undocumented rebuild is an operator watching a push fail with nothing
+    // telling them what to run.
+    expect(SQL).toContain('DROP TABLE visits;')
+  })
+
   it('documents the hand-run ALTER for every added column', () => {
     // IF NOT EXISTS adds no column to an existing table, so a portal deployed
     // before this needs each one by hand. An undocumented column is an operator

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-visit-status-write.test.ts

@@ -72,11 +72,37 @@ function db(
           const owner = bound[1] as string
           let admitted = rows.filter((r) => r.accountId === acct && r.visitId === visitId)
           if (sql.includes('AND v.ownerId = ?')) admitted = admitted.filter((r) => r.ownerId === owner)
-          if (admitted.length) inserted.push(bound)
-          return { meta: { changes: admitted.length } }
+          // The grouping is honoured, not ignored (Task 2551). A shared visit
+          // admits one row per attendance, and a fake that reported both would
+          // pass a statement with no GROUP BY at all — the same defect shape as
+          // a fake that always reported one change passing a handler with no
+          // gate.
+          const changes = sql.includes('GROUP BY v.visitId')
+            ? new Set(admitted.map((r) => r.visitId)).size
+            : admitted.length
+          if (changes) inserted.push(bound)
+          return { meta: { changes } }
         },
         async all<T>() {
-          return { results: [] as T[] }
+          // The Task 2511 pre-read became an .all() with Task 2551, because the
+          // visits table is keyed on the attendance and the ROW COUNT is what
+          // says whether this visit is shared. It applies THE SAME TWO FILTERS
+          // the insert does, so a test that deletes the scope branch in the
+          // endpoint sees this stop matching too.
+          if (!sql.includes('FROM visits')) return { results: [] as T[] }
+          const acct = bound[0] as string
+          const visitId = bound[bound.length - 1] as string
+          let admitted = rows.filter((r) => r.accountId === acct && r.visitId === visitId)
+          if (sql.includes('AND v.ownerId = ?')) {
+            admitted = admitted.filter((r) => r.ownerId === (bound[1] as string))
+          }
+          return {
+            results: admitted.map((r) => ({
+              status: r.status ?? '',
+              transitions:
+                typeof transitions === 'string' ? transitions : JSON.stringify(transitions),
+            })) as unknown as T[],
+          }
         },
       }
       return stmt
@@ -603,3 +629,149 @@ describe('a move and a labour claim are separate edits (Task 2511)', () => {
     expect(lines.join('\n')).toContain('v1')
   })
 })
+
+/** ROWS, plus one visit two workers attend (Task 2551). Its own fixture, so the
+ *  gate tests above keep counting what they were written to count. */
+const SHARED_ROWS: Row[] = [
+  ...ROWS,
+  { accountId: 'acc-a', ownerId: 'alice', visitId: 'v5', status: 'booked' },
+  { accountId: 'acc-a', ownerId: 'bob', visitId: 'v5', status: 'booked' },
+]
+
+describe('whose day a queued edit claims (Task 2551)', () => {
+  const sheet = (visitId: string, over: Record<string, unknown> = {}) => ({
+    visitId,
+    status: 'done',
+    dayHundredths: 100,
+    workDate: '2026-08-06',
+    ...over,
+  })
+
+  /**
+   * The `forOwnerId` bind, by position.
+   *
+   * Read positionally and NOT with `toContain`: at own scope the session owner
+   * is bound twice already — once as the row's `ownerId` and once in the WHERE —
+   * so a containment assertion passes whether or not `forOwnerId` carries
+   * anything at all. The SELECT literals run accountId, ownerId, status,
+   * statusAt, dayHundredths, workDate, workNote, assignedOwnerId, startDate,
+   * forOwnerId, which puts it at index 9 at either scope.
+   */
+  const forOwner = (bound: unknown[]) => bound[9]
+
+  it('stamps forOwnerId from the session for an own-scoped worker', async () => {
+    // The body carries no authority here, the same rule ownerId already follows:
+    // the session already decided who is writing.
+    const { database, inserted } = db(SHARED_ROWS, person('alice', 'own'), DECLARED)
+    const h = await processVisitStatus(
+      sheet('v5', { forOwnerId: 'bob' }),
+      'sess',
+      env(database),
+      () => {},
+      1,
+    )
+    expect(h.status).toBe(200)
+    expect(forOwner(inserted[0])).toBe('alice')
+    expect(inserted[0]).not.toContain('bob')
+  })
+
+  it('takes forOwnerId from the body for an account-scoped person', async () => {
+    // An office person filing a worker's sheet in is not the worker being paid,
+    // so theirs cannot come from the session.
+    const { database, inserted } = db(SHARED_ROWS, person('marie', 'account'), DECLARED)
+    const h = await processVisitStatus(
+      sheet('v5', { forOwnerId: 'bob' }),
+      'sess',
+      env(database),
+      () => {},
+      1,
+    )
+    expect(h.status).toBe(200)
+    expect(forOwner(inserted[0])).toBe('bob')
+  })
+
+  it('refuses a day claim on a shared visit that names nobody', async () => {
+    // Queuing it would pay the wrong worker or pay both. Refused at the door
+    // rather than left to the pull, which runs sixty seconds later with no
+    // screen to refuse to.
+    const { database, inserted } = db(SHARED_ROWS, person('marie', 'account'), DECLARED)
+    const h = await processVisitStatus(sheet('v5'), 'sess', env(database), () => {}, 1)
+    expect(h.status).toBe(400)
+    expect(h.payload).toMatchObject({ ok: false })
+    expect(inserted).toHaveLength(0)
+  })
+
+  it('leaves a single-worker day claim naming nobody exactly as it was', async () => {
+    const { database, inserted } = db(SHARED_ROWS, person('marie', 'account'), DECLARED)
+    const h = await processVisitStatus(sheet('v1'), 'sess', env(database), () => {}, 1)
+    expect(h.status).toBe(200)
+    expect(inserted).toHaveLength(1)
+  })
+
+  it('queues ONE row for a status edit on a shared visit, not one per attendance', async () => {
+    const { database } = db(SHARED_ROWS, person('marie', 'account'), DECLARED)
+    const h = await processVisitStatus(
+      { visitId: 'v5', status: 'on-site' },
+      'sess',
+      env(database),
+      () => {},
+      1,
+    )
+    expect(h.payload).toMatchObject({ ok: true, queued: 1 })
+  })
+
+  it('refuses a forOwnerId longer than the cap rather than truncating it', async () => {
+    // The value reaches :Engineer.portalOwnerId as a match value through the
+    // pull. A truncated id matches a different person, or nobody, silently, and
+    // the person who filed the sheet is never told.
+    const { database, inserted } = db(SHARED_ROWS, person('marie', 'account'), DECLARED)
+    const h = await processVisitStatus(
+      sheet('v5', { forOwnerId: 'b'.repeat(MAX_OWNER_ID_LENGTH + 1) }),
+      'sess',
+      env(database),
+      () => {},
+      1,
+    )
+    expect(h.status).toBe(400)
+    expect(inserted).toHaveLength(0)
+  })
+
+  it('leaves an edit that claims no day carrying no worker', async () => {
+    // The field means whose DAY this edit claims, so an edit claiming none has
+    // no worker to be for. Stamping one anyway would report forWorker=true at
+    // the pull for a status change, and emit an op=applied field=forOwnerId line
+    // per edit on the commonest path in the exchange.
+    const { database, inserted } = db(SHARED_ROWS, person('alice', 'own'), DECLARED)
+    const h = await processVisitStatus(
+      { visitId: 'v5', status: 'on-site' },
+      'sess',
+      env(database),
+      () => {},
+      1,
+    )
+    expect(h.status).toBe(200)
+    // `ownerId` is still stamped from the session. `forOwnerId` is the empty one.
+    expect(forOwner(inserted[0])).toBe('')
+    expect(inserted[0][1]).toBe('alice')
+  })
+
+  it('groups the insert SELECT so one edit is one row', async () => {
+    let seen = ''
+    const spy = {
+      prepare(sql: string) {
+        if (sql.startsWith('INSERT INTO visit_status')) seen = sql
+        return {
+          bind: () => ({
+            first: async () => person('marie', 'account'),
+            all: async () => ({
+              results: [{ status: 'booked', transitions: '[["booked","done"]]' }],
+            }),
+            run: async () => ({ meta: { changes: 1 } }),
+          }),
+        }
+      },
+    } as unknown as D1Database
+    await processVisitStatus({ visitId: 'v1', status: 'done' }, 'sess', env(spy), () => {}, 1)
+    expect(seen).toContain('GROUP BY v.visitId')
+  })
+})

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-visits-scope.test.ts

@@ -129,6 +129,19 @@ const ROWS: Row[] = [
   { accountId: 'acc-b', ownerId: 'alice', visitId: 'v4' },
 ]
 
+/**
+ * ROWS, plus one visit two workers attend (Task 2551).
+ *
+ * Its own fixture rather than an extra pair of entries in ROWS: every assertion
+ * in the two describe blocks above counts the visits it admits, and widening the
+ * shared fixture would rewrite tests this task is not changing.
+ */
+const SHARED_ROWS: Row[] = [
+  ...ROWS,
+  { accountId: 'acc-a', ownerId: 'alice', visitId: 'v5' },
+  { accountId: 'acc-a', ownerId: 'bob', visitId: 'v5' },
+]
+
 const ids = (h: { payload: Record<string, unknown> }) =>
   (h.payload.visits as Row[]).map((v) => v.visitId).sort()
 
@@ -501,3 +514,91 @@ describe('the planner write half reads through the same gate (Task 2511)', () =>
     expect(candidateSelect!).not.toContain('v.ownerId = ?')
   })
 })
+
+describe('a visit two workers share (Task 2551)', () => {
+  it('is one card naming both workers at account scope', async () => {
+    const h = await processVisits(
+      'sess',
+      env(db(SHARED_ROWS, asPerson('marie', 'account'))),
+      () => {},
+      1,
+    )
+    const shared = (h.payload.visits as Array<{ visitId: string; owners: string[] }>).filter(
+      (v) => v.visitId === 'v5',
+    )
+    expect(shared).toHaveLength(1)
+    expect([...shared[0].owners].sort()).toEqual(['alice', 'bob'])
+  })
+
+  it('reaches BOTH workers own-scope days', async () => {
+    // The failure Task 2512 exists to end: a worker missing a job from their day
+    // sees nothing and has nothing to report but confusion.
+    for (const who of ['alice', 'bob']) {
+      const h = await processVisits('sess', env(db(SHARED_ROWS, asPerson(who, 'own'))), () => {}, 1)
+      expect(ids(h)).toContain('v5')
+    }
+  })
+
+  it('never names a colleague to an own-scoped person', async () => {
+    // The fold runs AFTER the SQL filter, so alice's copy of the shared card
+    // carries alice and nobody else. Folding first would hand her bob's id,
+    // which is the staff list the file drop deliberately withholds.
+    const h = await processVisits(
+      'sess',
+      env(db(SHARED_ROWS, asPerson('alice', 'own'))),
+      () => {},
+      1,
+    )
+    const shared = (h.payload.visits as Array<{ visitId: string; owners: string[] }>).find(
+      (v) => v.visitId === 'v5',
+    )
+    expect(shared!.owners).toEqual(['alice'])
+  })
+
+  it('keeps ownerId as the first of owners, so the planner still groups', async () => {
+    const h = await processVisits(
+      'sess',
+      env(db(SHARED_ROWS, asPerson('marie', 'account'))),
+      () => {},
+      1,
+    )
+    for (const v of h.payload.visits as Array<{ ownerId: string; owners: string[] }>) {
+      expect(v.ownerId).toBe(v.owners[0])
+    }
+  })
+
+  it('orders the read by ownerId, so the worker list does not vary between reads', async () => {
+    prepared.length = 0
+    await processVisits('sess', env(db(SHARED_ROWS, asPerson('marie', 'account'))), () => {}, 1)
+    const visitsSelect = prepared.find((s) => s.includes('FROM visits v'))
+    expect(visitsSelect!).toContain('v.ownerId ASC')
+  })
+
+  it('counts cards, not attendances, in the log', async () => {
+    const lines: string[] = []
+    await processVisits(
+      'sess',
+      env(db(SHARED_ROWS, asPerson('marie', 'account'))),
+      (l) => lines.push(l),
+      1,
+    )
+    // v1, v2, v3, v5 — four cards from five rows.
+    expect(lines.join('\n')).toContain('visits=4')
+  })
+
+  it('does not multiply a candidate by the attendances on its visit', async () => {
+    // A candidate exists only for a visit carrying NO attendance, and such a
+    // visit stages exactly one row, so the join on (visitId, generation) cannot
+    // fan out. Pinned rather than assumed: the join is what would silently
+    // double an offer if the push ever staged a candidate against a staffed
+    // visit.
+    const against = [{ ...CANDIDATES[0], visitId: 'v5' }]
+    const h = await processVisits(
+      'sess',
+      env(db(SHARED_ROWS, asPerson('marie', 'account'), ROSTER, META, against)),
+      () => {},
+      1,
+    )
+    expect(h.payload.candidates as unknown[]).toHaveLength(1)
+  })
+})

package/payload/platform/plugins/cloudflare/skills/data-portal/schema.sql

@@ -289,6 +289,25 @@ CREATE TABLE IF NOT EXISTS directory_state (
 -- `checklistDone` against `checklistTotal` is the one pair read together: a
 -- count of ticked items with no total says nothing about whether the work is
 -- finished.
+--
+-- ONE ROW PER ATTENDANCE, NOT PER VISIT (Task 2551). `ownerId` is part of the
+-- key. Task 2512 made a visit two workers share representable and changed the
+-- push to return one row per attendance, and left this key on (accountId,
+-- visitId, generation): the second worker's row failed the constraint, the
+-- insert threw, the generation was never flipped, and the account's published
+-- visits stopped refreshing for as long as the shared visit existed. A TRUE
+-- duplicate — the same visit, the same worker, the same generation — is still
+-- rejected, which is what stops a retried stage doubling a row.
+--
+-- IF NOT EXISTS CANNOT APPLY THIS TO AN EXISTING DATABASE, and unlike the added
+-- columns above this one is not an ALTER: SQLite cannot drop the implicit index
+-- a UNIQUE clause creates, so the table is rebuilt. On a database that predates
+-- it, by hand:
+--   DROP TABLE visits;
+-- then re-apply this file. No copy is needed and none should be made: `visits`
+-- is a mirror of the graph rather than a source of truth, so the next push
+-- claims visits_state.currentGeneration + 1, writes the whole set, and flips.
+-- The cost is one listing showing nothing, for at most sixty seconds.
 CREATE TABLE IF NOT EXISTS visits (
   id             INTEGER PRIMARY KEY AUTOINCREMENT,
   accountId      TEXT NOT NULL,
@@ -305,7 +324,7 @@ CREATE TABLE IF NOT EXISTS visits (
   checklistTotal INTEGER NOT NULL DEFAULT 0,
   signatures     INTEGER NOT NULL DEFAULT 0,
   generation     INTEGER NOT NULL DEFAULT 0,
-  UNIQUE (accountId, visitId, generation)
+  UNIQUE (accountId, visitId, ownerId, generation)
 );
 
 CREATE INDEX IF NOT EXISTS visits_account ON visits (accountId);
@@ -371,6 +390,20 @@ CREATE TABLE IF NOT EXISTS visits_state (
 -- values lexically, so an offset-bearing or date-only value reads the wrong
 -- window and a real double-booking goes unreported. The door refuses any other
 -- shape rather than normalising one.
+--
+-- `forOwnerId` is WHOSE DAY this edit claims (Task 2551), and '' means it names
+-- nobody — the same absent-sentinel convention `ownerId` uses above. It exists
+-- because a visit two workers share names two attending engineers, and the
+-- pull's `size(es) = 1` gate turned one submitted sheet into nothing written at
+-- all rather than a full day paid to each of them. The door stamps it from the
+-- resolved session for an own-scoped person and reads it from the body for an
+-- account-scoped one filling a worker's sheet in.
+--
+-- IT IS NOT `ownerId` ABOVE. That column is who was signed in when the edit was
+-- made; an office person filing a worker's sheet is not the worker being paid.
+--
+-- On a database that predates the column, by hand:
+--   ALTER TABLE visit_status ADD COLUMN forOwnerId TEXT NOT NULL DEFAULT '';
 CREATE TABLE IF NOT EXISTS visit_status (
   id              INTEGER PRIMARY KEY AUTOINCREMENT,
   accountId       TEXT NOT NULL,
@@ -383,6 +416,7 @@ CREATE TABLE IF NOT EXISTS visit_status (
   workNote        TEXT NOT NULL DEFAULT '',
   assignedOwnerId TEXT NOT NULL DEFAULT '',
   startDate       TEXT NOT NULL DEFAULT '',
+  forOwnerId      TEXT NOT NULL DEFAULT '',
   claimed         INTEGER NOT NULL DEFAULT 0
 );
 

package/payload/platform/plugins/cloudflare/skills/data-portal/template/functions/api/visit-status.ts

@@ -166,6 +166,35 @@ export async function processVisitStatus(
 
   const scoped = session.recordScope === 'own'
 
+  /**
+   * WHOSE DAY this edit claims (Task 2551), and '' when it names nobody.
+   *
+   * Stamped from the resolved session for an own-scoped person and NEVER from
+   * the body — the same rule `ownerId` follows above, and for the same reason:
+   * the session already decided who is writing. An account-scoped person is
+   * filling a worker's sheet in, so theirs comes from the body; they are not the
+   * worker being paid.
+   *
+   * ONLY AN EDIT THAT CLAIMS A DAY CARRIES ONE. An edit claiming no day has no
+   * worker to be for, so stamping one would report `forWorker=true` at the pull
+   * for a status change and emit an `op=applied field=forOwnerId` line per edit
+   * on the commonest path in the exchange. The pull reads this field in the
+   * labour shape alone. A `forOwnerId` sent on an edit that claims no day is
+   * therefore IGNORED rather than refused, the same treatment a body-supplied
+   * `ownerId` already gets: it carries nothing here.
+   *
+   * Capped like `assignedOwnerId` and for the same reason: the value reaches
+   * `:Engineer.portalOwnerId` as a match value through the pull, and a truncated
+   * id matches a different person, or nobody, silently.
+   */
+  const named = scoped ? session.ownerId : typeof b.forOwnerId === 'string' ? b.forOwnerId : ''
+  const forOwnerId = dayHundredths > 0 ? named : ''
+  if (forOwnerId.length > MAX_OWNER_ID_LENGTH) {
+    log(`[data-portal] op=visit-status owner=${q(session.ownerId)} result=for-owner-too-long`)
+    log(`[data-portal] op=rejected visitId=${q(visitId)} reason=for-owner-too-long`)
+    return { status: 400, payload: { ok: false, error: 'forOwnerId too long' } }
+  }
+
   // The visit's CURRENT status and the account's declared moves, read under THE
   // SAME TWO FILTERS the insert applies (Task 2511).
   //
@@ -188,11 +217,19 @@ export async function processVisitStatus(
     (scoped ? ' AND v.ownerId = ?' : '') +
     ' AND v.visitId = ?'
   const currentStmt = env.DB.prepare(currentSql)
-  const current = await (
-    scoped
-      ? currentStmt.bind(env.PORTAL_ACCOUNT_ID, session.ownerId, visitId)
-      : currentStmt.bind(env.PORTAL_ACCOUNT_ID, visitId)
-  ).first<{ status: string; transitions: string }>()
+  // ALL, not first (Task 2551). `visits` is keyed on the attendance, so a visit
+  // two workers share is two rows here and THE COUNT is what says the visit is
+  // shared. Both rows carry the same `status` and the same `transitions`, both
+  // being per visit, so reading the first for those two values is still right.
+  const admitted =
+    (
+      await (
+        scoped
+          ? currentStmt.bind(env.PORTAL_ACCOUNT_ID, session.ownerId, visitId)
+          : currentStmt.bind(env.PORTAL_ACCOUNT_ID, visitId)
+      ).all<{ status: string; transitions: string }>()
+    ).results ?? []
+  const current = admitted[0] ?? null
 
   if (!current) {
     // The SAME single answer the insert gives below, and for the same reason:
@@ -207,6 +244,26 @@ export async function processVisitStatus(
     return { status: 404, payload: { ok: false, error: 'not found' } }
   }
 
+  // A DAY CLAIMED AGAINST A VISIT TWO WORKERS SHARE, NAMING NEITHER, IS REFUSED
+  // (Task 2551). Queuing it would pay the wrong worker or pay both, and the pull
+  // runs sixty seconds later with no screen to refuse to. An own-scoped person
+  // never reaches this: their read admits their own attendance and no other, and
+  // their `forOwnerId` is stamped from the session above.
+  //
+  // Only a LABOUR claim. A status edit on a shared visit is one edit about the
+  // visit, and the grouped insert below queues one row for it.
+  if (dayHundredths > 0 && admitted.length > 1 && forOwnerId === '') {
+    log(
+      `[data-portal] op=visit-status owner=${q(session.ownerId)} ` +
+        `scope=${session.recordScope} result=ambiguous-worker`,
+    )
+    log(`[data-portal] op=rejected visitId=${q(visitId)} reason=ambiguous-worker`)
+    return {
+      status: 400,
+      payload: { ok: false, error: 'a shared record needs forOwnerId to say whose day this is' },
+    }
+  }
+
   // A write whose status equals the current one is NOT A MOVE. `[from, to]`
   // declares a move, and no account declares a self-transition, so without this
   // a pure re-timing would be refused for failing to be a transition — and this
@@ -235,14 +292,20 @@ export async function processVisitStatus(
   }
 
   const sql =
-    `INSERT INTO visit_status (accountId, ownerId, status, statusAt, dayHundredths, workDate, workNote, assignedOwnerId, startDate, claimed, visitId)
-     SELECT ?, ?, ?, ?, ?, ?, ?, ?, ?, 0, v.visitId
+    `INSERT INTO visit_status (accountId, ownerId, status, statusAt, dayHundredths, workDate, workNote, assignedOwnerId, startDate, forOwnerId, claimed, visitId)
+     SELECT ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 0, v.visitId
        FROM visits v
        JOIN visits_state s
          ON s.accountId = v.accountId AND s.currentGeneration = v.generation
       WHERE v.accountId = ?` +
     (scoped ? ' AND v.ownerId = ?' : '') +
-    ' AND v.visitId = ?'
+    ' AND v.visitId = ?' +
+    // ONE EDIT IS ONE ROW (Task 2551). `visits` is keyed on the attendance, so
+    // without this an account-scoped edit on a shared visit would queue one row
+    // per worker and the pull would apply the same status once per attendance.
+    // THE WHERE IS UNTOUCHED, so the SELECT is still the gate; the grouping only
+    // collapses what that gate already admitted.
+    ' GROUP BY v.visitId'
   const statusAt = new Date(nowMs).toISOString()
   const stmt = env.DB.prepare(sql)
   const bound = scoped
@@ -256,6 +319,7 @@ export async function processVisitStatus(
         workNote,
         assignedOwnerId,
         startDate,
+        forOwnerId,
         env.PORTAL_ACCOUNT_ID,
         session.ownerId,
         visitId,
@@ -270,6 +334,7 @@ export async function processVisitStatus(
         workNote,
         assignedOwnerId,
         startDate,
+        forOwnerId,
         env.PORTAL_ACCOUNT_ID,
         visitId,
       )