diff --git a/n8n/W2-customerproduct-sync.json b/n8n/W2-customerproduct-sync.json
index a1b4f5e..c700673 100644
--- a/n8n/W2-customerproduct-sync.json
+++ b/n8n/W2-customerproduct-sync.json
@@ -46,7 +46,7 @@
     },
     {
       "parameters": {
-        "jsCode": "// W2 core computation: effective desired grants + diff vs AList.\n// Uses this.helpers.httpRequest (n8n Code node) for all HTTP.\n// Config read via $env.\nconst NC = $env.NOCODB_URL;\nconst NC_TOKEN = $env.NOCODB_TOKEN;\nconst ALIST = $env.ALIST_URL;\nconst T_CUSTPROD = $env.NOCODB_TABLE_CUSTOMERPRODUCTS;\nconst T_PROD = $env.NOCODB_TABLE_PRODUCTS;\nconst T_CUST = $env.NOCODB_TABLE_CUSTOMERS;\nconst T_RES = $env.NOCODB_TABLE_RESOURCES;\nconst LNK_PROD_RES = $env.NOCODB_LINK_PROD_RESOURCES; // c4ko4x8kwi16swg\n\nasync function ncGet(path) {\n  return await this.helpers.httpRequest({\n    method: 'GET',\n    url: NC + path,\n    headers: { 'xc-token': NC_TOKEN },\n    json: true,\n  });\n}\nasync function alistReq(method, path, body, token) {\n  return await this.helpers.httpRequest({\n    method,\n    url: ALIST + path,\n    headers: token ? { Authorization: token } : {},\n    body,\n    json: true,\n  });\n}\nfunction linkId(v) {\n  if (v == null) return null;\n  if (typeof v === 'object' && !Array.isArray(v)) return v.Id ?? v.id ?? null;\n  if (Array.isArray(v)) return v[0]?.Id ?? v[0]?.id ?? null;\n  return v;\n}\n\nconst custProdId = $json.customerProductId;\n\n// 1. re-fetch the CP record\nconst cp = await ncGet(`/api/v2/tables/${T_CUSTPROD}/records/${custProdId}`);\nconst customerId = linkId(cp.customer);\nif (!customerId) throw new Error('CP has no customer link');\n\n// 2. load all active CPs for this customer\nconst cps = await ncGet(`/api/v2/tables/${T_CUSTPROD}/records?where=(customer,eq,${customerId})&limit=1000`);\nconst active = (cps.list || []).filter(r => {\n  if (r.status && r.status !== 'active') return false;\n  return true;\n});\n\n// 3. build resource path -> max expires_at\n//    NocoDB link API returns only {Id, name} for linked rows (no alist_path),\n//    so fetch all Resources once and index by Id to resolve alist_path.\nconst allRes = await ncGet(`/api/v2/tables/${T_RES}/records?limit=10000`);\nconst resById = {};\nfor (const r of (allRes.list || [])) resById[r.Id] = r;\n\nconst effective = {};\nfor (const c of active) {\n  const pid = linkId(c.product);\n  if (!pid) continue;\n  const resList = await ncGet(`/api/v2/tables/${T_PROD}/links/${LNK_PROD_RES}/records/${pid}`);\n  const exp = c.expires_at; // 'YYYY-MM-DD'\n  for (const res of (resList.list || [])) {\n    const rid = res.Id;\n    const full = resById[rid];\n    const path = full ? full.alist_path : null;\n    if (!path) continue;\n    const cur = effective[path];\n    if (!cur || !cur.expires || (exp && exp > cur.expires)) {\n      effective[path] = { expires: exp || null, permission: 0 };\n    }\n  }\n}\n\n// 4. admin login\nconst login = await alistReq('POST', '/api/auth/login', {\n  username: $env.ALIST_ADMIN_USERNAME,\n  password: $env.ALIST_ADMIN_PASSWORD,\n}, null);\nconst token = login?.data?.token;\nif (!token) throw new Error('AList login failed');\n\n// customer's role id\nconst cust = await ncGet(`/api/v2/tables/${T_CUST}/records/${customerId}`);\nconst roleId = cust.alist_role_id;\n\nlet currentScopes = [];\nif (roleId) {\n  const role = await alistReq('GET', `/api/admin/role/get?id=${roleId}`, null, token);\n  currentScopes = role?.data?.permission_scopes ?? [];\n}\n\nconst desiredPaths = Object.keys(effective);\nconst currentPaths = currentScopes.map(s => s.path);\nconst toAdd = desiredPaths.filter(p => !currentPaths.includes(p));\nconst toRemove = currentPaths.filter(p => !desiredPaths.includes(p));\n\nlet roleName = null, roleDesc = null;\nif (roleId) {\n  const role = await alistReq('GET', `/api/admin/role/get?id=${roleId}`, null, token);\n  roleName = role?.data?.name;\n  roleDesc = role?.data?.description;\n}\n\n// --- Loop guard ---\n// Re-fetch CP sync_status to detect echo (our own write-back firing this webhook again).\nconst cpSyncStatus = cp.sync_status;\nconst noChange = (toAdd.length === 0 && toRemove.length === 0);\nconst alreadySynced = (cpSyncStatus === 'synced');\n// skip if nothing changed AND already synced (echo) — avoids rewrite loop\nconst skipWriteBack = (noChange && alreadySynced);\n\nreturn {\n  json: {\n    customerId,\n    roleId,\n    roleName,\n    roleDesc,\n    token,\n    effective,\n    desiredPaths,\n    currentScopes,\n    diff: { toAdd, toRemove },\n    newScopes: desiredPaths.map(p => ({ path: p, permission: effective[p].permission })),\n    skipWriteBack,\n  },\n};\n"
+        "jsCode": "// W2 core computation: effective desired grants + diff vs AList.\n// Uses this.helpers.httpRequest (n8n Code node) for all HTTP.\n// Config read via $env.\nconst NC = $env.NOCODB_URL;\nconst NC_TOKEN = $env.NOCODB_TOKEN;\nconst ALIST = $env.ALIST_URL;\nconst T_CUSTPROD = $env.NOCODB_TABLE_CUSTOMERPRODUCTS;\nconst T_PROD = $env.NOCODB_TABLE_PRODUCTS;\nconst T_CUST = $env.NOCODB_TABLE_CUSTOMERS;\nconst T_RES = $env.NOCODB_TABLE_RESOURCES;\nconst LNK_PROD_RES = $env.NOCODB_LINK_PROD_RESOURCES; // c4ko4x8kwi16swg\n\nasync function ncGet(path) {\n  return await this.helpers.httpRequest({\n    method: 'GET',\n    url: NC + path,\n    headers: { 'xc-token': NC_TOKEN },\n    json: true,\n  });\n}\nasync function alistReq(method, path, body, token) {\n  return await this.helpers.httpRequest({\n    method,\n    url: ALIST + path,\n    headers: token ? { Authorization: token } : {},\n    body,\n    json: true,\n  });\n}\nfunction linkId(v) {\n  if (v == null) return null;\n  if (typeof v === 'object' && !Array.isArray(v)) return v.Id ?? v.id ?? null;\n  if (Array.isArray(v)) return v[0]?.Id ?? v[0]?.id ?? null;\n  return v;\n}\n\nconst custProdId = $json.customerProductId;\n\n// 1. re-fetch the CP record\nconst cp = await ncGet(`/api/v2/tables/${T_CUSTPROD}/records/${custProdId}`);\nconst customerId = linkId(cp.customer);\nif (!customerId) throw new Error('CP has no customer link');\n\n// 2. load all active CPs for this customer\nconst cps = await ncGet(`/api/v2/tables/${T_CUSTPROD}/records?where=(customer.Id,eq,${customerId})&limit=1000`);\nconst active = (cps.list || []).filter(r => {\n  if (r.status && r.status !== 'active') return false;\n  return true;\n});\n\n// 3. build resource path -> max expires_at\n//    NocoDB link API returns only {Id, name} for linked rows (no alist_path),\n//    so fetch all Resources once and index by Id to resolve alist_path.\nconst allRes = await ncGet(`/api/v2/tables/${T_RES}/records?limit=10000`);\nconst resById = {};\nfor (const r of (allRes.list || [])) resById[r.Id] = r;\n\nconst effective = {};\nfor (const c of active) {\n  const pid = linkId(c.product);\n  if (!pid) continue;\n  const resList = await ncGet(`/api/v2/tables/${T_PROD}/links/${LNK_PROD_RES}/records/${pid}`);\n  const exp = c.expires_at; // 'YYYY-MM-DD'\n  for (const res of (resList.list || [])) {\n    const rid = res.Id;\n    const full = resById[rid];\n    const path = full ? full.alist_path : null;\n    if (!path) continue;\n    const cur = effective[path];\n    if (!cur || !cur.expires || (exp && exp > cur.expires)) {\n      effective[path] = { expires: exp || null, permission: 0 };\n    }\n  }\n}\n\n// 4. admin login\nconst login = await alistReq('POST', '/api/auth/login', {\n  username: $env.ALIST_ADMIN_USERNAME,\n  password: $env.ALIST_ADMIN_PASSWORD,\n}, null);\nconst token = login?.data?.token;\nif (!token) throw new Error('AList login failed');\n\n// customer's role id\nconst cust = await ncGet(`/api/v2/tables/${T_CUST}/records/${customerId}`);\nconst roleId = cust.alist_role_id;\n\nlet currentScopes = [];\nif (roleId) {\n  const role = await alistReq('GET', `/api/admin/role/get?id=${roleId}`, null, token);\n  currentScopes = role?.data?.permission_scopes ?? [];\n}\n\nconst desiredPaths = Object.keys(effective);\nconst currentPaths = currentScopes.map(s => s.path);\nconst toAdd = desiredPaths.filter(p => !currentPaths.includes(p));\nconst toRemove = currentPaths.filter(p => !desiredPaths.includes(p));\n\nlet roleName = null, roleDesc = null;\nif (roleId) {\n  const role = await alistReq('GET', `/api/admin/role/get?id=${roleId}`, null, token);\n  roleName = role?.data?.name;\n  roleDesc = role?.data?.description;\n}\n\n// --- Loop guard ---\n// Re-fetch CP sync_status to detect echo (our own write-back firing this webhook again).\nconst cpSyncStatus = cp.sync_status;\nconst noChange = (toAdd.length === 0 && toRemove.length === 0);\nconst alreadySynced = (cpSyncStatus === 'synced');\n// skip if nothing changed AND already synced (echo) — avoids rewrite loop\nconst skipWriteBack = (noChange && alreadySynced);\n\nreturn {\n  json: {\n    customerId,\n    roleId,\n    roleName,\n    roleDesc,\n    token,\n    effective,\n    desiredPaths,\n    currentScopes,\n    diff: { toAdd, toRemove },\n    newScopes: desiredPaths.map(p => ({ path: p, permission: effective[p].permission })),\n    skipWriteBack,\n  },\n};\n"
       },
       "id": "compute",
       "name": "Compute Effective Grants",