* fix(whatsapp): app-side unmute, close silent intake paths, health visibility
- add POST /link/unmute and a Reactivate control on the Pausad state
- company resolution: transient query errors release the row for sweep
retry; genuine zero-options sends M19 instead of parking silently
- media from unlinked senders bypasses the hourly greeting throttle
(10 min burst window, daily cap kept)
- GET /link returns 7-day failed-delivery and parked-inbound counts;
sweep summary logs outboundFailed24h
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(documents): real HEIC/HEIF magic-byte validation, bilingual upload errors
- detect ISO-BMFF ftyp brands (heic/heix/heim/heis/hevc/hevx/hevm/hevs,
mif1/msf1) instead of exempting image/heic from validation; declared
heic/heif accepts either family member (iOS labels vary)
- new INBOX_UPLOAD_* structured error codes replace raw English strings
on the inbox upload and attach-document routes
- registry doc corrected to the real 10 MB cap
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat(inbox): staged upload with instant ack and deferred AI extraction
- web uploads insert the inbox item as status processing and respond
immediately; Bedrock extraction and supplier match run via after()
with a CAS flip to received (email and WhatsApp channels keep the
synchronous path)
- widen invoice_inbox_items.status CHECK to include processing
(migration 20260813180000, pg-real test included)
- crash-recovery sweep cron (*/2) flips stale processing rows;
bulk-book skips extraction_in_progress items
- workspace: processing chip, in-flight rows disable actions, realtime
flip, retry-extraction button for empty extractions
- picker accept list drops HEIC/HEIF so iOS transcodes library photos
to JPEG; server allowlists unchanged (supersedes 2026-08-01 HEIC
decision, see DECISIONS.md)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(migrations): bump inbox processing-status migration past main's latest
Main merged 20260813210000 while this PR was in flight; an inserted
version older than the latest applied aborts the prod db push at merge.
Renamed 20260813180000 to 20260813213000 and updated references.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* docs(decisions): log preview-tracker orphan repair after migration rename
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
PR4 of the WhatsApp intake track: turns the per-message PR3 pipeline into a
conversation. Media replies are burst-debounced into ONE combined ack (M4
single / M5 numbered list) sent by the single winner of the atomic
pending_ack claim; losers stay silent. Multi-company senders get the company
question (reply buttons <=3, list 4-10, numbered text >10) with an 8h
sliding pin ('byt' clears it); their receipts park as staged message rows
until the answer and then run through the normal intake path.
Clarifying questions are evaluated per receipt after extraction, max one per
receipt, priority unreadable > representation > partial, keyed on the
Phase-0 classification (legibility/documentKind/merchantCategory) with
heuristic fallbacks (compressed-chat-photo signal, extended meal regex).
Budgets: <=2 content questions per burst, <=6 per sender per Stockholm day;
over budget acks only and flags the item moved_to_app. Questions expire
after 48h (sweep, silent hand-off) and are asked exactly once.
Free-text answers route through the ONE new LLM call
(lib/interpret-answer.ts): Sonnet via Bedrock, max_tokens 600, no thinking,
forced tool call validated by Zod with hard caps, gated by
checkAgentRateLimit, reply framed as untrusted data. Any failure degrades to
storing the raw text as a note; exact 'nej' short-circuits without the LLM.
Answers land in invoice_inbox_items.channel_context
(representation/user_note/quality) with ChannelQuestionAsked/Answered
processing-history events. Late answers match by quoted wamid or the most
recent open question within 7 days.
New per-minute sweep cron (registry-gated physical route, 503
EXTENSION_DISABLED when off) re-claims stuck rows (max 3 attempts), rescues
crashed burst acks, expires questions and pins. One new migration
(20260802210000) adds whatsapp_messages.acked_at, the relational burst-
membership marker, with pg-real coverage for the single-winner claim.
Verified: full vitest suite (12270), pg-real against a migrated
supabase/postgres 15 (977), lint 0 errors, tsc at the 405 baseline,
check:guards green, crontabs regenerated. Mutation-checked the debounce
claim and the daily budget gate.
Co-authored-by: Jakob Wennberg <jakob.wennberg@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
