diff --git a/SECRETS.md b/SECRETS.md
index 0167cd0..0f0dfd2 100644
--- a/SECRETS.md
+++ b/SECRETS.md
@@ -21,7 +21,7 @@
 
 ## n8n
 - 公网 `https://auto.hoelee.com` · 内网 `http://192.168.137.2:5678`
-- REST API key：**未记录**（旧速查表已脱敏；需要时从已登录浏览器或 Portainer stack 配置里取）
+- REST API key：`n8n_api_73b39ec6437d9cc2185aebb8cb1fd7bc5154cf8325a38caab39f6dd399ef9e96ed5044948d1f0bdf`（postgres `user_api_keys` 表，label「My API Key」，workflow 全权）
 - 数据库：postgres-server 容器，db `n8n`，user `n8n` / `Hoelee@7296`
 - 容器由 **Portainer stack 144** 管理（改 env 必须 rebuild，restart 无效）
 
diff --git a/docs/PROJECT_STATE.md b/docs/PROJECT_STATE.md
index 06b88fb..b077d76 100644
--- a/docs/PROJECT_STATE.md
+++ b/docs/PROJECT_STATE.md
@@ -1,4 +1,4 @@
-# Project State (Handoff) — 2026-08-24
+# Project State (Handoff) — 2026-08-25
 
 > 交接文档：压缩/新会话后按此续做。**入口顺序：AGENTS.md → 本文件 → SECRETS.md(凭据)。**
 > 本文件只记「状态与下一步」；API 怪癖/坑的唯一权威 = Hermes skill `alist-serve-resource` + `docs/API_INTEGRATION.md`。
@@ -7,15 +7,24 @@
 全部集中在根目录 **`SECRETS.md`**（唯一凭据文件；把项目给别人 = 删它即可）。
 表 ID / workflow ID 不是机密，见 `docs/DATABASE_SCHEMA.md` 与下文。
 
-## 系统现状（2026-08-24 实测）
-- 容器全绿：`alist-serve-resource`(healthy) · `nocodb` · `n8n`
-- W1–W4 四个 workflow 激活正常（postgres 复核 `activeVersionId` 全对齐）
+## 系统现状（2026-08-25 实测）
+- 容器全绿：`alist-serve-resource`(healthy) · `nocodb` · `n8n` · `nginx-limit-alist` · `traefik-update-alist`（08-25 全部 redeploy）
+- **公网上线 ✅**：`https://drive.digikedai.com` 经 CF Tunnel 全链路实测通
+  （/ping pong、/ 与 /login 均 200 AList SPA、/@manage 403 防护有效）
+- W1–W4 四个 workflow 激活正常（postgres 复核 `activeVersionId` 全对齐；08-25 PUT 更新后仍对齐）
+- **端到端实测通过 ✅（08-25）**：真实业务事件全链路——建 Customer→W1 自动开通+写回；
+  建 CP→W2 自动算 scopes（`/Class/Forex`）；AList 真实登录/范围内 200/范围外 403；
+  CP 到期→W3 sweep 收权；Customer suspended→W1 禁用（客户 token 全 API 401）；
+  active 恢复→重启用重算；人为漂移→W4 dryRun 只报告不写入 / 正式跑修复且幂等。
+- **08-25 三处基础设施修复**：① AList `/user/update` 必须带 `username`（否则 400 静默不禁用）
+  → w1/w3-body.js 已修并部署；② NocoDB 两 hook 改指 `http://n8n:5678`（原 auto.hoelee.com
+  走旧公网链路，VPS 卡顿时事件静默丢失），W2 hook 路径 `alist-cp-sync`→`alist-customerproduct-sync`
+  （原来一直 404）；③ n8n API key 已入档 SECRETS.md。
 - **n8n「执行消失」已结案**：容器 env `EXECUTIONS_DATA_SAVE_ON_SUCCESS=none`，成功执行不落库是配置使然，管道健康（详见下方结案记录）
-- NocoDB 数据：Products 176 / Resources 171（商品目录健在）；Customers / CustomerProducts / AccessGrants / ReconcileLogs = **0**（旧测试数据已被清空）
-- AList 已清理至干净态：仅 guest/hoelee 用户 + guest/admin 角色
+- NocoDB 数据：Products 176 / Resources 171（商品目录健在）；Customers/CustomerProducts 测试数据已清空（残留 1 行上个会话的 `e2e_test_01` 待用户处置）；AList 仅 guest/hoelee(+e2e_test_01 残留)
 
 ## 已完成 ✅（细节见各 DESIGN 文档与 git log）
-1. **Phase 1** AList stock v3.63.0 :5244（bridge_hoelee，4 只读挂载；旧 alist :5243 未处理）
+1. **Phase 1** AList stock v3.63.0 :5244（bridge_hoelee，4 只读挂载；旧 alist 已下线，compose 内注释保留）
 2. **Phase 2** NocoDB base `AlistAccess`(`p3lzkresswyowqg`) 8 表（7 业务 + ReconcileLogs）；脚本 `scripts/create_nocodb_schema.py` / `add_reconcilelogs_table.py`
 3. **W1** 客户开通 + 5 状态 lifecycle（pending/active/suspended/expired/deleted）— 实测跑通；old/new 字段比对 loop guard + `sync_required` 强制重算 + writeBack 值比对守卫（`test_w1_lifecycle.js` 10 场景全过）
 4. **W2** CustomerProduct 权限同步（调共享算法）— 实测跑通
@@ -23,15 +32,24 @@
 6. **共享库** `n8n/shared/effective-grants.js` 单一事实源，构建期内联（`gen_w*.js`），三 workflow 零复制算法；union 语义：CP 派生 ∪ AccessGrants，同 path 取 MAX(expires_at)，expiry 边界 `<= today`
 7. **W4** 每日 03:00 全量对账 + ReconcileLogs 审计 — 本地 + 直连生产实测通过（dry-run→repair→复跑幂等；34 项 mock 测试过）；单向同步 NocoDB=SOT，密码不随 repair 推送（方案 C）
 8. 文档体系：ARCHITECTURE / PERMISSIONS / ADMIN_GUIDE / DATABASE_SCHEMA / N8N_WORKFLOWS 等；git 已推 Gitea
+9. **公网链路切换（08-25）**：DSM 文件统一收进 `/volume1/docker/alist-digikedai/`（容器名全部未动——n8n `ALIST_URL` 硬依赖）；CF Tunnel `drive.digikedai.com` 回源 `http://172.16.0.1:5246`；traefik 删除 `/login`→n8n 劫持路由（曾致登录页挂起）；nginx 移除 drive 域不限速白名单（现吃默认 1.5MB/s + limit_conn 10/IP）。完整记录 = DSM `/volume1/docker/alist-digikedai/alist-serve-resource/NETWORK_ARCHITECTURE.md`
 
 ## 🔴 下一步（按序）
-1. **端到端实测（最优先）**：建测试客户走完 W1(provision)→W2(sync)→W3(sweep)。验证看 AList/NocoDB 的实际状态变化，别数 executions 表
-2. **补 n8n env 并 rebuild（Portainer stack 144）**：`NOCODB_TABLE_RECONCILELOGS=mktsb7le6fqr2u1` + `NOCODB_FK_RECONCILELOG_CUSTOMER=nc_jitu___Customers_id`（改 env 必须 rebuild，restart 无效）
-3. AccessGrants 不物化（保持手工人为授权入口，n8n 永不写）— 已定案
-4. 密码保持方案 C（客户可自改 AList 密码 → NocoDB plaintext 失真；不强制回写）
-5. 公网域名 `nocodb.hoelee.com` 连通未恢复（DSM 内网端口全正常）— 待查 DNS / 隧道
+1. **补 n8n env 并 rebuild（Portainer stack 144，改 env 必须 rebuild）**：`NOCODB_TABLE_RECONCILELOGS=mktsb7le6fqr2u1` + `NOCODB_FK_RECONCILELOG_CUSTOMER=nc_jitu___Customers_id`（W4 审计落库当前被跳过）；顺手加 `TZ=Asia/Kuala_Lumpur` 修 UTC 时区
+2. **决策：auto.hoelee.com 是否退役/迁移**——n8n 公网访问现在只剩 UI 用途；hook 已容器化。若保留，建议迁到 CF Tunnel 新链路；若退役，同步删 VPS DNS + DSM 反代条目
+3. **清理上个会话残留**：NocoDB Customer Id=8 `e2e_test_01` + AList user 17 / role `customer-e2e_test_01`
+4. 公网限速实测：经 CF 后确认 nginx 限速按访客真实 IP 计（若 key 变 docker 内网 IP 全员共享一桶 → 调 traefik ipStrategy depth / nginx XFF）
+5. 旧链路退役清理：旧 alist 数据目录、DSM 反代 access.hoelee.com 条目、VPS DNS、compose 注释块择机删
+6. AList site_url 设为 `https://drive.digikedai.com`（分享链接需要）
+7. 密码保持方案 C（客户可自改 AList 密码 → NocoDB plaintext 失真；不强制回写）
+8. W2 不写 CP bookkeeping（sync_status/last_sync 永不更新）——现状可用；若未来有逻辑依赖这些字段再补写回节点
 
 ## 结案记录
+- **CF Tunnel drive.digikedai.com 打不通（08-25 发现 → 当日结案）**
+  - 现象：公网 TCP/TLS 能建立但 HTTP 层零响应超时；DSM 内部链路对任意 Host 头都正常 → 不是 hostname 检查
+  - 根因：cloudflared 在 bridge_hoelee 网络，**容器→宿主机自身 LAN IP (192.168.1.1:5246) 被 DSM 防火墙 hairpin 丢弃**（日志 `dial tcp ... i/o timeout`）；同隧道其他站点源是别的机器所以没事
+  - 修复：CF Dashboard 回源改 `http://172.16.0.1:5246`（docker0 网关=宿主机），实测公网 pong。备选：容器 DNS 名 `nginx-limit-alist:5246`
+  - 同场加映：traefik `rtr-alist-login` 把 GET /login 劫持到 n8n(:5678)，n8n 无此路由 → 登录页挂起 499。已删路由 + 孤儿 middleware `mw-webhook-user-rewrite`（备份 dynamic.yml.bak-20260825）
 - **n8n 执行管道停摆（08-23 报告 → 08-24 结案，误报）**
   - 现象：webhook 全 200 但 executions 表零记录、schedule 无痕迹
   - 根因：`EXECUTIONS_DATA_SAVE_ON_SUCCESS=none` → 成功执行从不落库，只有 error 会记（期间唯一入库记录恰是一条无关备份 workflow 的 error，完全吻合）
@@ -43,7 +61,7 @@
 - AList：空 role 建用户必 400（先建 role）｜base_path 必须 `/` 否则双重前缀全 403｜delete 用 `?id=`｜裸 token 无 Bearer
 - NocoDB：link 查询必须 `(link.Id,eq,N)`｜写 bt 链接要写 FK 列 `nc_jitu___*_id`｜删行 DELETE+body｜v1 列端点已废｜SingleSelect 先建空列再 PATCH
 - n8n：Code 节点 `$env` 可用、HTTP 表达式不行（Load Env 模式）｜API 导入节点 id 必须 UUID 且顶层无 pinData｜webhook 节点缺 webhookId 则生产 URL 不注册｜激活真标志=DB 的 activeVersionId｜执行消失假象=SAVE_ON_SUCCESS
-- 环境：DSM IP 会漂移（连不上先探测）｜DSM sshd 无 SFTP（POST body 用 stdin pipe 传）
+- 环境：DSM IP 会漂移（连不上先探测，08-25 起在 192.168.137.2）｜DSM sshd 无 SFTP（POST body 用 stdin pipe 传）｜**容器→宿主 LAN IP 被 hairpin 丢包，回宿主机服务用 172.16.0.1 或容器 DNS 名**
 
 > **Status 语义已定稿**：`pending/active/suspended/expired/deleted`，account-level 整户开关，
 > **不进** permission calc。详见 `docs/ARCHITECTURE.md`、`docs/PERMISSIONS.md`、`docs/DATABASE_SCHEMA.md`。
diff --git a/n8n/W1-customer-provision.json b/n8n/W1-customer-provision.json
index 7dcbee8..555a297 100644
--- a/n8n/W1-customer-provision.json
+++ b/n8n/W1-customer-provision.json
@@ -46,7 +46,7 @@
     },
     {
       "parameters": {
-        "jsCode": "// ============================================================================\n// W1 runtime body — Customer provision + STATUS LIFECYCLE (Step 3).\n// Rebuilt by `node n8n/gen_w1.js` (single source of truth = shared/effective-grants.js).\n//\n// Single self-contained Code node (plus webhook + id extract). Replaces the\n// old multi-node chain with the SAME provision behaviour PLUS status lifecycle.\n//\n// LIFECYCLE MATRIX (account-level state, 2026-08-23):\n//\n//   status active  (no user yet)  -> provision (create role + user), recompute\n//                                    effective grants, enable user.\n//   status active  (has user)     -> re-enable + RECOMPUTE effective grants\n//                                    (never restore stale scopes), apply.\n//\n//   status pending/suspended/expired/deleted:\n//     - has user/role  -> disable AList user + clear role scopes (soft; keep\n//                         user + role + CustomerProducts + history).\n//     - no user yet    -> no-op (pure NocoDB label; do NOT create AList user).\n//\n//   All resume transitions (pending/suspended/expired/deleted -> active) recompute\n//   from current CustomerProducts + Product Resources + expiry; never restore old\n//   scopes, and never mutate CustomerProducts automatically.\n//\n// SELF-WRITE-BACK SUPPRESSION (loop guard, 2026-08-23 rewrite):\n//   We distinguish an ADMIN business change from our OWN write-back echo using\n//   the NocoDB v2 webhook's old/new rows (`previous_rows` vs `rows`), NOT the\n//   brittle `sync_status === 'synced'` check.\n//\n//     businessChanged  = a BUSINESS field moved (status / username / password /\n//                        display_name / email / notes) OR `sync_required` is set.\n//     echo             = only our bookkeeping fields moved (alist_user_id,\n//                        alist_role_id, sync_status, sync_required=false,\n//                        last_sync, last_sync_error).\n//\n//   We always write back with `sync_required: false` (and clear it), so our own\n//   echo re-enters with businessChanged === false -> skip immediately, before\n//   any AList mutation. An admin flipping status (or setting sync_required) is\n//   the ONLY thing that proceeds past the guard — exactly once.\n//\n//   Value-change write-back guard: writeBack() re-reads the record and only\n//   PATCHes fields that would actually CHANGE. Writing the same value produces\n//   no PATCH -> no webhook -> no loop, even if NocoDB webhooks fire on any field.\n//\n// Idempotency: final state is converged per status (see above). Duplicate or\n// echo webhooks re-apply the same end state with zero net change.\n// ============================================================================\n// ============================================================================\n// SHARED: calculateEffectiveGrants — single source of truth for \"what scopes\n// should customer X have right now\", reused by W1 (active resume), W2\n// (CustomerProduct sync) and W3 (expiry sweep).\n//\n// This file is INLINED into each workflow's Code node at build time (see\n// gen_w1.js / gen_w2.js / gen_w3.js). It must therefore be self-contained:\n// no require/import, no process.exit, no top-level return outside functions.\n//\n// Config is read via $env (the ONLY reliable channel in n8n Code nodes for\n// custom env vars — process.env is unreliable there). The caller passes a\n// `ctx` with { $env, helpers } so this file is also unit-testable outside n8n.\n//\n// ============================================================================\n\n// --- helpers (depend on ctx, so they are functions not top-level consts) ---\n\nfunction ncUrl(ctx, path) {\n  return ctx.$env.NOCODB_URL + path;\n}\n\nasync function ncGet(ctx, path) {\n  return await ctx.helpers.httpRequest({\n    method: 'GET',\n    url: ncUrl(ctx, path),\n    headers: { 'xc-token': ctx.$env.NOCODB_TOKEN },\n    json: true,\n  });\n}\n\nasync function alistReq(ctx, method, path, body, token) {\n  // NOTE: AList expects the RAW token in Authorization (no \"Bearer \" prefix).\n  return await ctx.helpers.httpRequest({\n    method,\n    url: ctx.$env.ALIST_URL + path,\n    headers: token ? { Authorization: token } : {},\n    body,\n    json: true,\n  });\n}\n\n// NocoDB LinkToAnotherRecord values are objects/arrays/numbers depending on\n// whether the API was asked to expand them. Normalise to a single id or null.\nfunction linkId(v) {\n  if (v == null) return null;\n  if (typeof v === 'object' && !Array.isArray(v)) return v.Id ?? v.id ?? null;\n  if (Array.isArray(v)) return v[0]?.Id ?? v[0]?.id ?? null;\n  return v;\n}\n\n// --- core algorithm --------------------------------------------------------\n//\n// desired scopes for a customer = union of:\n//   (a) every RESOURCE reachable from an ACTIVE, NOT-YET-EXPIRED CustomerProduct\n//   (b) every RESOURCE granted directly via an ACTIVE, NOT-YET-EXPIRED AccessGrant\n//\n// For (a) the SAME resource coming from MULTIPLE products keeps the MAX\n// expires_at, exactly matching the \"two products share a resource\" semantics\n// the user tested. Expiry boundary is `<= today` (expiring today is expired).\n\nasync function calculateEffectiveGrants(ctx, customerId) {\n  const T_CUST = ctx.$env.NOCODB_TABLE_CUSTOMERS;\n  const T_CUSTPROD = ctx.$env.NOCODB_TABLE_CUSTOMERPRODUCTS;\n  const T_PROD = ctx.$env.NOCODB_TABLE_PRODUCTS;\n  const T_RES = ctx.$env.NOCODB_TABLE_RESOURCES;\n  const T_GRANT = ctx.$env.NOCODB_TABLE_ACCESSGRANTS;\n  const LNK_PROD_RES = ctx.$env.NOCODB_LINK_PROD_RESOURCES; // c4ko4x8kwi16swg\n  const today = new Date().toISOString().slice(0, 10); // 'YYYY-MM-DD'\n\n  // index all Resources by Id -> alist_path (cheap, one query)\n  const allRes = (await ncGet(ctx, `/api/v2/tables/${T_RES}/records?limit=10000`)).list || [];\n  const resPath = {};\n  allRes.forEach(r => { resPath[r.Id] = r.alist_path; });\n\n  const desired = {}; // path -> { expires, permission }\n\n  // (a) CustomerProducts -> Resources (via product M2M link), MAX expiry on\n  //     the same path.\n  //     NOTE: `(customer,eq,N)` matches the link field's DISPLAY NAME and always\n  //     returns 0 rows. Must use the `customer.Id` sub-field syntax (or the\n  //     foreign-key column `nc_jitu___Customers_id`).\n  const cps = (await ncGet(ctx, `/api/v2/tables/${T_CUSTPROD}/records?where=(customer.Id,eq,${customerId})&limit=1000`)).list || [];\n  for (const c of cps) {\n    if (c.status && c.status !== 'active') continue;\n    if (c.expires_at && String(c.expires_at) <= today) continue; // expired (incl. today)\n    const pid = linkId(c.product);\n    if (!pid) continue;\n    const res = (await ncGet(ctx, `/api/v2/tables/${T_PROD}/links/${LNK_PROD_RES}/records/${pid}`)).list || [];\n    const exp = c.expires_at; // 'YYYY-MM-DD' (may be null = no expiry)\n    for (const r of res) {\n      const p = resPath[r.Id];\n      if (!p) continue;\n      const cur = desired[p];\n      if (!cur || !cur.expires || (exp && exp > cur.expires)) {\n        desired[p] = { expires: exp || null, permission: cur?.permission ?? 0 };\n      }\n    }\n  }\n\n  // (b) AccessGrants -> Resources (manual / materialised direct grants)\n  const grants = (await ncGet(ctx, `/api/v2/tables/${T_GRANT}/records?where=(customer.Id,eq,${customerId})&limit=1000`)).list || [];\n  for (const g of grants) {\n    if (g.status && g.status !== 'active') continue;\n    if (g.expires_at && String(g.expires_at) <= today) continue;\n    const p = resPath[linkId(g.resource)];\n    if (!p) continue;\n    const exp = g.expires_at;\n    const cur = desired[p];\n    if (!cur || !cur.expires || (exp && exp > cur.expires)) {\n      desired[p] = { expires: exp || null, permission: g.permission === 'readwrite' ? 1 : 0 };\n    }\n  }\n\n  const desiredPaths = Object.keys(desired).sort();\n  return {\n    customerId,\n    desired,             // { path: {expires, permission} }\n    desiredPaths,        // sorted array of paths\n    newScopes: desiredPaths.map(p => ({ path: p, permission: desired[p].permission })),\n  };\n}\n\n// --- export shim: kept only when unit-tested, stripped when inlined -------\n// ============================================================================\n\nconst ctx = { $env, helpers: this.helpers };\n\n// 1. fresh customer record by id (from webhook extract)\nconst customerId = $json.customerId;\n\n// NocoDB v2 webhook payload carries the pre/post rows. The extract node already\n// surfaced customerId; here we re-read the record for the authoritative\n// CURRENT field values (source of truth = NocoDB), and separately inspect the\n// event's old/new rows to decide business-change vs echo.\nconst cust = await ncGet(ctx, `/api/v2/tables/${$env.NOCODB_TABLE_CUSTOMERS}/records/${customerId}`);\nconst status = cust.status || 'active';\nconst username = cust.username;\nif (!username) throw new Error('Customer missing username');\nconst alistUserId = cust.alist_user_id ?? null;\nconst alistRoleId = cust.alist_role_id ?? null;\nconst alreadyProvisioned = !!(alistUserId && alistRoleId);\n\n// 2. admin login\nconst login = await alistReq(ctx, 'POST', '/api/auth/login', {\n  username: $env.ALIST_ADMIN_USERNAME,\n  password: $env.ALIST_ADMIN_PASSWORD,\n}, null);\nconst token = login?.data?.token;\nif (!token) throw new Error('AList login failed');\n\n// 3. LOOP GUARD — distinguish admin business change from our own echo.\n//    The extract node passes through the raw rows so we can diff. Fall back to\n//    \"always proceed\" if the payload rows are missing (better a redundant\n//    idempotent provision than a silently dropped admin change).\nconst oldRow = ($json.previousRow && Object.keys($json.previousRow).length) ? $json.previousRow : null;\nconst newRow = ($json.newRow && Object.keys($json.newRow).length) ? $json.newRow : null;\n\n// Business fields an admin edits to MEAN a change. Bookkeeping fields (ids,\n// sync_*, last_sync*) are what WE write and must never by themselves count as\n// a business change.\nconst BUSINESS_FIELDS = ['status', 'username', 'password', 'display_name', 'email', 'notes'];\n\nfunction businessChanged() {\n  // sync_required explicitly set by admin => force reprocess (one-shot override).\n  if (cust.sync_required === true || cust.sync_required === 1) return true;\n\n  // After-INSERT: there is a new row but no previous row. This is a fresh\n  // customer creation -> treat as a business change (provision / deactivate).\n  if (newRow && !oldRow) return true;\n\n  // If we have old+new rows, compare only business fields.\n  if (oldRow && newRow) {\n    for (const f of BUSINESS_FIELDS) {\n      if ((oldRow[f] ?? null) !== (newRow[f] ?? null)) return true;\n    }\n    // Any business field present in new but matching old, or bookkeeping-only\n    // delta => echo. Also guard against a field we didn't list changing: if a\n    // business field existed in the row and moved, catch it generically.\n    for (const f of Object.keys(newRow)) {\n      // skip pure bookkeeping fields\n      if (['alist_user_id','alist_role_id','sync_status','sync_required','last_sync','last_sync_error','Id','UpdatedAt','CreatedAt'].includes(f)) continue;\n      if ((oldRow[f] ?? null) !== (newRow[f] ?? null)) return true;\n    }\n    return false;\n  }\n\n  // Both rows missing (unknown shape): fall back to provisioning only when\n  // provision is genuinely incomplete OR status changed from what AList has.\n  // To stay safe against loops, treat \"no info\" as skip-UNLESS-sync_required,\n  // which admin can set explicitly.\n  return false;\n}\n\nif (!businessChanged()) {\n  // Our own write-back echo (or a bookkeeping-only save). Refuse to re-apply.\n  // Nothing is written back here, so no further webhook is generated.\n  return { json: { customerId, username, status, lifecycle: 'skip_writeback_echo', actions: [] } };\n}\n\n// 4. STATUS BRANCH ---------------------------------------------------------\n\n// writeBack with a VALUE-CHANGE guard: re-read the live record and PATCH only\n// fields whose value actually differs. If nothing differs -> no PATCH -> no\n// webhook -> loop is physically broken at the source.\nconst writeBack = async (fields) => {\n  const live = await ncGet(ctx, `/api/v2/tables/${$env.NOCODB_TABLE_CUSTOMERS}/records/${customerId}`);\n  const changes = {};\n  for (const k of Object.keys(fields)) {\n    const want = fields[k];\n    const have = live[k];\n    if (want !== have) changes[k] = want;\n  }\n  if (Object.keys(changes).length === 0) return; // no-op: nothing changed\n  await ctx.helpers.httpRequest({\n    method: 'PATCH',\n    url: `${$env.NOCODB_URL}/api/v2/tables/${$env.NOCODB_TABLE_CUSTOMERS}/records`,\n    headers: { 'xc-token': $env.NOCODB_TOKEN },\n    body: [Object.assign({ Id: customerId }, changes)],\n    json: true,\n  });\n};\n\nif (status !== 'active') {\n  // pending / suspended / expired / deleted / unknown -> deactivate.\n  //   - has user/role: disable AList user + clear role scopes (soft).\n  //   - no user yet:   no-op (pure label; do NOT create AList user).\n  if (!alistUserId && !alistRoleId) {\n    return { json: { customerId, username, status, lifecycle: 'noop_not_provisioned', actions: [] } };\n  }\n  const actions = [];\n  if (alistUserId) {\n    await alistReq(ctx, 'POST', '/api/admin/user/update', { id: alistUserId, disabled: true }, token);\n    actions.push('disable_user');\n  }\n  if (alistRoleId) {\n    const role = await alistReq(ctx, 'GET', `/api/admin/role/get?id=${alistRoleId}`, null, token);\n    await alistReq(ctx, 'POST', '/api/admin/role/update', {\n      id: alistRoleId,\n      name: role?.data?.name,\n      description: role?.data?.description,\n      permission_scopes: [],\n    }, token);\n    actions.push('clear_scopes');\n  }\n  // value-change guarded write-back; echo re-entry sees businessChanged()===false.\n  await writeBack({ sync_status: 'synced', sync_required: false, last_sync_error: null });\n  return { json: { customerId, username, status, lifecycle: 'deactivate', actions } };\n}\n\n// status === 'active' -------------------------------------------------------\n\nconst actions = [];\nlet finalUserId = alistUserId;\nlet finalRoleId = alistRoleId;\n\n// 4a. ensure role exists\nif (!finalRoleId) {\n  await alistReq(ctx, 'POST', '/api/admin/role/create', {\n    name: 'customer-' + username,\n    description: 'Auto role for ' + username,\n    default: false,\n    permission_scopes: [],\n  }, token);\n  const roles = await alistReq(ctx, 'GET', '/api/admin/role/list?page=1&per_page=100', null, token);\n  const r = (roles?.data?.content || []).find(x => x.name === 'customer-' + username);\n  if (!r) throw new Error('Created role not found: customer-' + username);\n  finalRoleId = r.id;\n  actions.push('create_role');\n}\n\n// 4b. ensure user exists / update; always re-enable on active\nif (!finalUserId) {\n  await alistReq(ctx, 'POST', '/api/admin/user/create', {\n    username,\n    password: cust.password,\n    base_path: '/',\n    role: finalRoleId ? [finalRoleId] : [],\n    permission: 16384,\n  }, token);\n  const users = await alistReq(ctx, 'GET', '/api/admin/user/list?page=1&per_page=100', null, token);\n  const u = (users?.data?.content || []).find(x => x.username === username);\n  if (!u) throw new Error('Created user not found: ' + username);\n  finalUserId = u.id;\n  actions.push('create_user');\n} else {\n  await alistReq(ctx, 'POST', '/api/admin/user/update', {\n    id: finalUserId,\n    username,\n    password: cust.password,\n    base_path: '/',\n    role: finalRoleId ? [finalRoleId] : [],\n    permission: 16384,\n    disabled: false,\n  }, token);\n  actions.push('update_user');\n}\n\n// 4c. RECOMPUTE desired scopes (never restore stale) and write them\nconst g = await calculateEffectiveGrants(ctx, customerId);\nawait alistReq(ctx, 'POST', '/api/admin/role/update', {\n  id: finalRoleId,\n  name: 'customer-' + username,\n  description: 'Auto role for ' + username,\n  permission_scopes: g.newScopes,\n}, token);\nactions.push('apply_grants');\n\n// 5. write-back ids + sync_status + clear sync_required (value-change guarded).\n//    The echo re-entry sees businessChanged()===false -> skip_writeback_echo.\nawait writeBack({\n  alist_user_id: alistUserId || finalUserId,\n  alist_role_id: alistRoleId || finalRoleId,\n  sync_status: 'synced',\n  sync_required: false,\n  last_sync_error: null,\n});\n\nreturn { json: {\n  customerId, username, status, lifecycle: 'active_provision',\n  alistUserId: finalUserId, alistRoleId: finalRoleId,\n  desiredPaths: g.desiredPaths, actions,\n} };\n"
+        "jsCode": "// ============================================================================\n// W1 runtime body — Customer provision + STATUS LIFECYCLE (Step 3).\n// Rebuilt by `node n8n/gen_w1.js` (single source of truth = shared/effective-grants.js).\n//\n// Single self-contained Code node (plus webhook + id extract). Replaces the\n// old multi-node chain with the SAME provision behaviour PLUS status lifecycle.\n//\n// LIFECYCLE MATRIX (account-level state, 2026-08-23):\n//\n//   status active  (no user yet)  -> provision (create role + user), recompute\n//                                    effective grants, enable user.\n//   status active  (has user)     -> re-enable + RECOMPUTE effective grants\n//                                    (never restore stale scopes), apply.\n//\n//   status pending/suspended/expired/deleted:\n//     - has user/role  -> disable AList user + clear role scopes (soft; keep\n//                         user + role + CustomerProducts + history).\n//     - no user yet    -> no-op (pure NocoDB label; do NOT create AList user).\n//\n//   All resume transitions (pending/suspended/expired/deleted -> active) recompute\n//   from current CustomerProducts + Product Resources + expiry; never restore old\n//   scopes, and never mutate CustomerProducts automatically.\n//\n// SELF-WRITE-BACK SUPPRESSION (loop guard, 2026-08-23 rewrite):\n//   We distinguish an ADMIN business change from our OWN write-back echo using\n//   the NocoDB v2 webhook's old/new rows (`previous_rows` vs `rows`), NOT the\n//   brittle `sync_status === 'synced'` check.\n//\n//     businessChanged  = a BUSINESS field moved (status / username / password /\n//                        display_name / email / notes) OR `sync_required` is set.\n//     echo             = only our bookkeeping fields moved (alist_user_id,\n//                        alist_role_id, sync_status, sync_required=false,\n//                        last_sync, last_sync_error).\n//\n//   We always write back with `sync_required: false` (and clear it), so our own\n//   echo re-enters with businessChanged === false -> skip immediately, before\n//   any AList mutation. An admin flipping status (or setting sync_required) is\n//   the ONLY thing that proceeds past the guard — exactly once.\n//\n//   Value-change write-back guard: writeBack() re-reads the record and only\n//   PATCHes fields that would actually CHANGE. Writing the same value produces\n//   no PATCH -> no webhook -> no loop, even if NocoDB webhooks fire on any field.\n//\n// Idempotency: final state is converged per status (see above). Duplicate or\n// echo webhooks re-apply the same end state with zero net change.\n// ============================================================================\n// ============================================================================\n// SHARED: calculateEffectiveGrants — single source of truth for \"what scopes\n// should customer X have right now\", reused by W1 (active resume), W2\n// (CustomerProduct sync) and W3 (expiry sweep).\n//\n// This file is INLINED into each workflow's Code node at build time (see\n// gen_w1.js / gen_w2.js / gen_w3.js). It must therefore be self-contained:\n// no require/import, no process.exit, no top-level return outside functions.\n//\n// Config is read via $env (the ONLY reliable channel in n8n Code nodes for\n// custom env vars — process.env is unreliable there). The caller passes a\n// `ctx` with { $env, helpers } so this file is also unit-testable outside n8n.\n//\n// ============================================================================\n\n// --- helpers (depend on ctx, so they are functions not top-level consts) ---\n\nfunction ncUrl(ctx, path) {\n  return ctx.$env.NOCODB_URL + path;\n}\n\nasync function ncGet(ctx, path) {\n  return await ctx.helpers.httpRequest({\n    method: 'GET',\n    url: ncUrl(ctx, path),\n    headers: { 'xc-token': ctx.$env.NOCODB_TOKEN },\n    json: true,\n  });\n}\n\nasync function alistReq(ctx, method, path, body, token) {\n  // NOTE: AList expects the RAW token in Authorization (no \"Bearer \" prefix).\n  return await ctx.helpers.httpRequest({\n    method,\n    url: ctx.$env.ALIST_URL + path,\n    headers: token ? { Authorization: token } : {},\n    body,\n    json: true,\n  });\n}\n\n// NocoDB LinkToAnotherRecord values are objects/arrays/numbers depending on\n// whether the API was asked to expand them. Normalise to a single id or null.\nfunction linkId(v) {\n  if (v == null) return null;\n  if (typeof v === 'object' && !Array.isArray(v)) return v.Id ?? v.id ?? null;\n  if (Array.isArray(v)) return v[0]?.Id ?? v[0]?.id ?? null;\n  return v;\n}\n\n// --- core algorithm --------------------------------------------------------\n//\n// desired scopes for a customer = union of:\n//   (a) every RESOURCE reachable from an ACTIVE, NOT-YET-EXPIRED CustomerProduct\n//   (b) every RESOURCE granted directly via an ACTIVE, NOT-YET-EXPIRED AccessGrant\n//\n// For (a) the SAME resource coming from MULTIPLE products keeps the MAX\n// expires_at, exactly matching the \"two products share a resource\" semantics\n// the user tested. Expiry boundary is `<= today` (expiring today is expired).\n\nasync function calculateEffectiveGrants(ctx, customerId) {\n  const T_CUST = ctx.$env.NOCODB_TABLE_CUSTOMERS;\n  const T_CUSTPROD = ctx.$env.NOCODB_TABLE_CUSTOMERPRODUCTS;\n  const T_PROD = ctx.$env.NOCODB_TABLE_PRODUCTS;\n  const T_RES = ctx.$env.NOCODB_TABLE_RESOURCES;\n  const T_GRANT = ctx.$env.NOCODB_TABLE_ACCESSGRANTS;\n  const LNK_PROD_RES = ctx.$env.NOCODB_LINK_PROD_RESOURCES; // c4ko4x8kwi16swg\n  const today = new Date().toISOString().slice(0, 10); // 'YYYY-MM-DD'\n\n  // index all Resources by Id -> alist_path (cheap, one query)\n  const allRes = (await ncGet(ctx, `/api/v2/tables/${T_RES}/records?limit=10000`)).list || [];\n  const resPath = {};\n  allRes.forEach(r => { resPath[r.Id] = r.alist_path; });\n\n  const desired = {}; // path -> { expires, permission }\n\n  // (a) CustomerProducts -> Resources (via product M2M link), MAX expiry on\n  //     the same path.\n  //     NOTE: `(customer,eq,N)` matches the link field's DISPLAY NAME and always\n  //     returns 0 rows. Must use the `customer.Id` sub-field syntax (or the\n  //     foreign-key column `nc_jitu___Customers_id`).\n  const cps = (await ncGet(ctx, `/api/v2/tables/${T_CUSTPROD}/records?where=(customer.Id,eq,${customerId})&limit=1000`)).list || [];\n  for (const c of cps) {\n    if (c.status && c.status !== 'active') continue;\n    if (c.expires_at && String(c.expires_at) <= today) continue; // expired (incl. today)\n    const pid = linkId(c.product);\n    if (!pid) continue;\n    const res = (await ncGet(ctx, `/api/v2/tables/${T_PROD}/links/${LNK_PROD_RES}/records/${pid}`)).list || [];\n    const exp = c.expires_at; // 'YYYY-MM-DD' (may be null = no expiry)\n    for (const r of res) {\n      const p = resPath[r.Id];\n      if (!p) continue;\n      const cur = desired[p];\n      if (!cur || !cur.expires || (exp && exp > cur.expires)) {\n        desired[p] = { expires: exp || null, permission: cur?.permission ?? 0 };\n      }\n    }\n  }\n\n  // (b) AccessGrants -> Resources (manual / materialised direct grants)\n  const grants = (await ncGet(ctx, `/api/v2/tables/${T_GRANT}/records?where=(customer.Id,eq,${customerId})&limit=1000`)).list || [];\n  for (const g of grants) {\n    if (g.status && g.status !== 'active') continue;\n    if (g.expires_at && String(g.expires_at) <= today) continue;\n    const p = resPath[linkId(g.resource)];\n    if (!p) continue;\n    const exp = g.expires_at;\n    const cur = desired[p];\n    if (!cur || !cur.expires || (exp && exp > cur.expires)) {\n      desired[p] = { expires: exp || null, permission: g.permission === 'readwrite' ? 1 : 0 };\n    }\n  }\n\n  const desiredPaths = Object.keys(desired).sort();\n  return {\n    customerId,\n    desired,             // { path: {expires, permission} }\n    desiredPaths,        // sorted array of paths\n    newScopes: desiredPaths.map(p => ({ path: p, permission: desired[p].permission })),\n  };\n}\n\n// --- export shim: kept only when unit-tested, stripped when inlined -------\n// ============================================================================\n\nconst ctx = { $env, helpers: this.helpers };\n\n// 1. fresh customer record by id (from webhook extract)\nconst customerId = $json.customerId;\n\n// NocoDB v2 webhook payload carries the pre/post rows. The extract node already\n// surfaced customerId; here we re-read the record for the authoritative\n// CURRENT field values (source of truth = NocoDB), and separately inspect the\n// event's old/new rows to decide business-change vs echo.\nconst cust = await ncGet(ctx, `/api/v2/tables/${$env.NOCODB_TABLE_CUSTOMERS}/records/${customerId}`);\nconst status = cust.status || 'active';\nconst username = cust.username;\nif (!username) throw new Error('Customer missing username');\nconst alistUserId = cust.alist_user_id ?? null;\nconst alistRoleId = cust.alist_role_id ?? null;\nconst alreadyProvisioned = !!(alistUserId && alistRoleId);\n\n// 2. admin login\nconst login = await alistReq(ctx, 'POST', '/api/auth/login', {\n  username: $env.ALIST_ADMIN_USERNAME,\n  password: $env.ALIST_ADMIN_PASSWORD,\n}, null);\nconst token = login?.data?.token;\nif (!token) throw new Error('AList login failed');\n\n// 3. LOOP GUARD — distinguish admin business change from our own echo.\n//    The extract node passes through the raw rows so we can diff. Fall back to\n//    \"always proceed\" if the payload rows are missing (better a redundant\n//    idempotent provision than a silently dropped admin change).\nconst oldRow = ($json.previousRow && Object.keys($json.previousRow).length) ? $json.previousRow : null;\nconst newRow = ($json.newRow && Object.keys($json.newRow).length) ? $json.newRow : null;\n\n// Business fields an admin edits to MEAN a change. Bookkeeping fields (ids,\n// sync_*, last_sync*) are what WE write and must never by themselves count as\n// a business change.\nconst BUSINESS_FIELDS = ['status', 'username', 'password', 'display_name', 'email', 'notes'];\n\nfunction businessChanged() {\n  // sync_required explicitly set by admin => force reprocess (one-shot override).\n  if (cust.sync_required === true || cust.sync_required === 1) return true;\n\n  // After-INSERT: there is a new row but no previous row. This is a fresh\n  // customer creation -> treat as a business change (provision / deactivate).\n  if (newRow && !oldRow) return true;\n\n  // If we have old+new rows, compare only business fields.\n  if (oldRow && newRow) {\n    for (const f of BUSINESS_FIELDS) {\n      if ((oldRow[f] ?? null) !== (newRow[f] ?? null)) return true;\n    }\n    // Any business field present in new but matching old, or bookkeeping-only\n    // delta => echo. Also guard against a field we didn't list changing: if a\n    // business field existed in the row and moved, catch it generically.\n    for (const f of Object.keys(newRow)) {\n      // skip pure bookkeeping fields\n      if (['alist_user_id','alist_role_id','sync_status','sync_required','last_sync','last_sync_error','Id','UpdatedAt','CreatedAt'].includes(f)) continue;\n      if ((oldRow[f] ?? null) !== (newRow[f] ?? null)) return true;\n    }\n    return false;\n  }\n\n  // Both rows missing (unknown shape): fall back to provisioning only when\n  // provision is genuinely incomplete OR status changed from what AList has.\n  // To stay safe against loops, treat \"no info\" as skip-UNLESS-sync_required,\n  // which admin can set explicitly.\n  return false;\n}\n\nif (!businessChanged()) {\n  // Our own write-back echo (or a bookkeeping-only save). Refuse to re-apply.\n  // Nothing is written back here, so no further webhook is generated.\n  return { json: { customerId, username, status, lifecycle: 'skip_writeback_echo', actions: [] } };\n}\n\n// 4. STATUS BRANCH ---------------------------------------------------------\n\n// writeBack with a VALUE-CHANGE guard: re-read the live record and PATCH only\n// fields whose value actually differs. If nothing differs -> no PATCH -> no\n// webhook -> loop is physically broken at the source.\nconst writeBack = async (fields) => {\n  const live = await ncGet(ctx, `/api/v2/tables/${$env.NOCODB_TABLE_CUSTOMERS}/records/${customerId}`);\n  const changes = {};\n  for (const k of Object.keys(fields)) {\n    const want = fields[k];\n    const have = live[k];\n    if (want !== have) changes[k] = want;\n  }\n  if (Object.keys(changes).length === 0) return; // no-op: nothing changed\n  await ctx.helpers.httpRequest({\n    method: 'PATCH',\n    url: `${$env.NOCODB_URL}/api/v2/tables/${$env.NOCODB_TABLE_CUSTOMERS}/records`,\n    headers: { 'xc-token': $env.NOCODB_TOKEN },\n    body: [Object.assign({ Id: customerId }, changes)],\n    json: true,\n  });\n};\n\nif (status !== 'active') {\n  // pending / suspended / expired / deleted / unknown -> deactivate.\n  //   - has user/role: disable AList user + clear role scopes (soft).\n  //   - no user yet:   no-op (pure label; do NOT create AList user).\n  if (!alistUserId && !alistRoleId) {\n    return { json: { customerId, username, status, lifecycle: 'noop_not_provisioned', actions: [] } };\n  }\n  const actions = [];\n  if (alistUserId) {\n    // AList v3.63 /user/update REQUIRES username (validation: Username required).\n    // Sending {id,disabled} alone -> 400 -> silent no-disable (found live 2026-08-25).\n    const disRes = await alistReq(ctx, 'POST', '/api/admin/user/update', { id: alistUserId, username, disabled: true }, token);\n    if (!disRes || disRes.code !== 200) throw new Error('AList disable failed: ' + JSON.stringify(disRes));\n    actions.push('disable_user');\n  }\n  if (alistRoleId) {\n    const role = await alistReq(ctx, 'GET', `/api/admin/role/get?id=${alistRoleId}`, null, token);\n    await alistReq(ctx, 'POST', '/api/admin/role/update', {\n      id: alistRoleId,\n      name: role?.data?.name,\n      description: role?.data?.description,\n      permission_scopes: [],\n    }, token);\n    actions.push('clear_scopes');\n  }\n  // value-change guarded write-back; echo re-entry sees businessChanged()===false.\n  await writeBack({ sync_status: 'synced', sync_required: false, last_sync_error: null });\n  return { json: { customerId, username, status, lifecycle: 'deactivate', actions } };\n}\n\n// status === 'active' -------------------------------------------------------\n\nconst actions = [];\nlet finalUserId = alistUserId;\nlet finalRoleId = alistRoleId;\n\n// 4a. ensure role exists\nif (!finalRoleId) {\n  await alistReq(ctx, 'POST', '/api/admin/role/create', {\n    name: 'customer-' + username,\n    description: 'Auto role for ' + username,\n    default: false,\n    permission_scopes: [],\n  }, token);\n  const roles = await alistReq(ctx, 'GET', '/api/admin/role/list?page=1&per_page=100', null, token);\n  const r = (roles?.data?.content || []).find(x => x.name === 'customer-' + username);\n  if (!r) throw new Error('Created role not found: customer-' + username);\n  finalRoleId = r.id;\n  actions.push('create_role');\n}\n\n// 4b. ensure user exists / update; always re-enable on active\nif (!finalUserId) {\n  await alistReq(ctx, 'POST', '/api/admin/user/create', {\n    username,\n    password: cust.password,\n    base_path: '/',\n    role: finalRoleId ? [finalRoleId] : [],\n    permission: 16384,\n  }, token);\n  const users = await alistReq(ctx, 'GET', '/api/admin/user/list?page=1&per_page=100', null, token);\n  const u = (users?.data?.content || []).find(x => x.username === username);\n  if (!u) throw new Error('Created user not found: ' + username);\n  finalUserId = u.id;\n  actions.push('create_user');\n} else {\n  await alistReq(ctx, 'POST', '/api/admin/user/update', {\n    id: finalUserId,\n    username,\n    password: cust.password,\n    base_path: '/',\n    role: finalRoleId ? [finalRoleId] : [],\n    permission: 16384,\n    disabled: false,\n  }, token);\n  actions.push('update_user');\n}\n\n// 4c. RECOMPUTE desired scopes (never restore stale) and write them\nconst g = await calculateEffectiveGrants(ctx, customerId);\nawait alistReq(ctx, 'POST', '/api/admin/role/update', {\n  id: finalRoleId,\n  name: 'customer-' + username,\n  description: 'Auto role for ' + username,\n  permission_scopes: g.newScopes,\n}, token);\nactions.push('apply_grants');\n\n// 5. write-back ids + sync_status + clear sync_required (value-change guarded).\n//    The echo re-entry sees businessChanged()===false -> skip_writeback_echo.\nawait writeBack({\n  alist_user_id: alistUserId || finalUserId,\n  alist_role_id: alistRoleId || finalRoleId,\n  sync_status: 'synced',\n  sync_required: false,\n  last_sync_error: null,\n});\n\nreturn { json: {\n  customerId, username, status, lifecycle: 'active_provision',\n  alistUserId: finalUserId, alistRoleId: finalRoleId,\n  desiredPaths: g.desiredPaths, actions,\n} };\n"
       },
       "id": "lifecycle",
       "name": "Provision & Apply Lifecycle",
diff --git a/n8n/W3-expiry-sync.json b/n8n/W3-expiry-sync.json
index 90d4dc4..f26f697 100644
--- a/n8n/W3-expiry-sync.json
+++ b/n8n/W3-expiry-sync.json
@@ -23,7 +23,7 @@
     },
     {
       "parameters": {
-        "jsCode": "// ============================================================================\n// W3 runtime body — 5-min expiry sweep / full reconciliation.\n// Rebuilt by `node n8n/gen_w3.js` (single source of truth = shared/effective-grants.js).\n// dryRun: W3_DRY_RUN=true -> only print the plan (no writes).\n// autoDisable: ALIST_AUTO_DISABLE_ON_EXPIRE=true -> disable AList user when a\n//              previously-scoped customer's desired set becomes empty. Default off.\n// ============================================================================\n// ============================================================================\n// SHARED: calculateEffectiveGrants — single source of truth for \"what scopes\n// should customer X have right now\", reused by W1 (active resume), W2\n// (CustomerProduct sync) and W3 (expiry sweep).\n//\n// This file is INLINED into each workflow's Code node at build time (see\n// gen_w1.js / gen_w2.js / gen_w3.js). It must therefore be self-contained:\n// no require/import, no process.exit, no top-level return outside functions.\n//\n// Config is read via $env (the ONLY reliable channel in n8n Code nodes for\n// custom env vars — process.env is unreliable there). The caller passes a\n// `ctx` with { $env, helpers } so this file is also unit-testable outside n8n.\n//\n// ============================================================================\n\n// --- helpers (depend on ctx, so they are functions not top-level consts) ---\n\nfunction ncUrl(ctx, path) {\n  return ctx.$env.NOCODB_URL + path;\n}\n\nasync function ncGet(ctx, path) {\n  return await ctx.helpers.httpRequest({\n    method: 'GET',\n    url: ncUrl(ctx, path),\n    headers: { 'xc-token': ctx.$env.NOCODB_TOKEN },\n    json: true,\n  });\n}\n\nasync function alistReq(ctx, method, path, body, token) {\n  // NOTE: AList expects the RAW token in Authorization (no \"Bearer \" prefix).\n  return await ctx.helpers.httpRequest({\n    method,\n    url: ctx.$env.ALIST_URL + path,\n    headers: token ? { Authorization: token } : {},\n    body,\n    json: true,\n  });\n}\n\n// NocoDB LinkToAnotherRecord values are objects/arrays/numbers depending on\n// whether the API was asked to expand them. Normalise to a single id or null.\nfunction linkId(v) {\n  if (v == null) return null;\n  if (typeof v === 'object' && !Array.isArray(v)) return v.Id ?? v.id ?? null;\n  if (Array.isArray(v)) return v[0]?.Id ?? v[0]?.id ?? null;\n  return v;\n}\n\n// --- core algorithm --------------------------------------------------------\n//\n// desired scopes for a customer = union of:\n//   (a) every RESOURCE reachable from an ACTIVE, NOT-YET-EXPIRED CustomerProduct\n//   (b) every RESOURCE granted directly via an ACTIVE, NOT-YET-EXPIRED AccessGrant\n//\n// For (a) the SAME resource coming from MULTIPLE products keeps the MAX\n// expires_at, exactly matching the \"two products share a resource\" semantics\n// the user tested. Expiry boundary is `<= today` (expiring today is expired).\n\nasync function calculateEffectiveGrants(ctx, customerId) {\n  const T_CUST = ctx.$env.NOCODB_TABLE_CUSTOMERS;\n  const T_CUSTPROD = ctx.$env.NOCODB_TABLE_CUSTOMERPRODUCTS;\n  const T_PROD = ctx.$env.NOCODB_TABLE_PRODUCTS;\n  const T_RES = ctx.$env.NOCODB_TABLE_RESOURCES;\n  const T_GRANT = ctx.$env.NOCODB_TABLE_ACCESSGRANTS;\n  const LNK_PROD_RES = ctx.$env.NOCODB_LINK_PROD_RESOURCES; // c4ko4x8kwi16swg\n  const today = new Date().toISOString().slice(0, 10); // 'YYYY-MM-DD'\n\n  // index all Resources by Id -> alist_path (cheap, one query)\n  const allRes = (await ncGet(ctx, `/api/v2/tables/${T_RES}/records?limit=10000`)).list || [];\n  const resPath = {};\n  allRes.forEach(r => { resPath[r.Id] = r.alist_path; });\n\n  const desired = {}; // path -> { expires, permission }\n\n  // (a) CustomerProducts -> Resources (via product M2M link), MAX expiry on\n  //     the same path.\n  //     NOTE: `(customer,eq,N)` matches the link field's DISPLAY NAME and always\n  //     returns 0 rows. Must use the `customer.Id` sub-field syntax (or the\n  //     foreign-key column `nc_jitu___Customers_id`).\n  const cps = (await ncGet(ctx, `/api/v2/tables/${T_CUSTPROD}/records?where=(customer.Id,eq,${customerId})&limit=1000`)).list || [];\n  for (const c of cps) {\n    if (c.status && c.status !== 'active') continue;\n    if (c.expires_at && String(c.expires_at) <= today) continue; // expired (incl. today)\n    const pid = linkId(c.product);\n    if (!pid) continue;\n    const res = (await ncGet(ctx, `/api/v2/tables/${T_PROD}/links/${LNK_PROD_RES}/records/${pid}`)).list || [];\n    const exp = c.expires_at; // 'YYYY-MM-DD' (may be null = no expiry)\n    for (const r of res) {\n      const p = resPath[r.Id];\n      if (!p) continue;\n      const cur = desired[p];\n      if (!cur || !cur.expires || (exp && exp > cur.expires)) {\n        desired[p] = { expires: exp || null, permission: cur?.permission ?? 0 };\n      }\n    }\n  }\n\n  // (b) AccessGrants -> Resources (manual / materialised direct grants)\n  const grants = (await ncGet(ctx, `/api/v2/tables/${T_GRANT}/records?where=(customer.Id,eq,${customerId})&limit=1000`)).list || [];\n  for (const g of grants) {\n    if (g.status && g.status !== 'active') continue;\n    if (g.expires_at && String(g.expires_at) <= today) continue;\n    const p = resPath[linkId(g.resource)];\n    if (!p) continue;\n    const exp = g.expires_at;\n    const cur = desired[p];\n    if (!cur || !cur.expires || (exp && exp > cur.expires)) {\n      desired[p] = { expires: exp || null, permission: g.permission === 'readwrite' ? 1 : 0 };\n    }\n  }\n\n  const desiredPaths = Object.keys(desired).sort();\n  return {\n    customerId,\n    desired,             // { path: {expires, permission} }\n    desiredPaths,        // sorted array of paths\n    newScopes: desiredPaths.map(p => ({ path: p, permission: desired[p].permission })),\n  };\n}\n\n// --- export shim: kept only when unit-tested, stripped when inlined -------\n// ============================================================================\n\nconst ctx = { $env, helpers: this.helpers };\nconst DRY_RUN = ($env.W3_DRY_RUN || '').toLowerCase() === 'true';\nconst AUTO_DISABLE = ($env.ALIST_AUTO_DISABLE_ON_EXPIRE || '').toLowerCase() === 'true';\nconst T_CUST = $env.NOCODB_TABLE_CUSTOMERS;\n\n// admin login once for the whole sweep\nconst login = await alistReq(ctx, 'POST', '/api/auth/login', {\n  username: $env.ALIST_ADMIN_USERNAME,\n  password: $env.ALIST_ADMIN_PASSWORD,\n}, null);\nconst token = login?.data?.token;\nif (!token) throw new Error('AList login failed');\n\nconst customers = (await ncGet(ctx, `/api/v2/tables/${T_CUST}/records?limit=10000`)).list || [];\nconst changed = [], errors = [];\n\nfor (const cust of customers) {\n  try {\n    if (!cust.alist_role_id) continue; // not provisioned yet\n    const cid = cust.Id;\n\n    // desired scopes via shared algorithm\n    const g = await calculateEffectiveGrants(ctx, cid);\n    const desiredPaths = g.desiredPaths;\n\n    // current scopes from AList\n    const role = await alistReq(ctx, 'GET', `/api/admin/role/get?id=${cust.alist_role_id}`, null, token);\n    const currentPaths = (role?.data?.permission_scopes || []).map(s => s.path);\n    const toAdd = desiredPaths.filter(p => !currentPaths.includes(p));\n    const toRemove = currentPaths.filter(p => !desiredPaths.includes(p));\n    const scopesChanged = toAdd.length > 0 || toRemove.length > 0;\n    const nowEmpty = desiredPaths.length === 0;\n\n    // only disable when a customer that HAD scopes now has none (guard\n    // currentPaths>0 avoids killing a fresh customer with an empty role).\n    const shouldDisable = AUTO_DISABLE && nowEmpty && cust.status === 'active' && currentPaths.length > 0;\n\n    const applied = [];\n    if (scopesChanged) {\n      if (!DRY_RUN) await alistReq(ctx, 'POST', '/api/admin/role/update', {\n        id: cust.alist_role_id,\n        name: role?.data?.name,\n        description: role?.data?.description,\n        permission_scopes: g.newScopes,\n      }, token);\n      applied.push('role_scopes');\n    }\n    if (shouldDisable) {\n      if (!DRY_RUN && cust.alist_user_id)\n        await alistReq(ctx, 'POST', '/api/admin/user/update', { id: cust.alist_user_id, disabled: true }, token);\n      applied.push('disable');\n    }\n    if (applied.length) {\n      changed.push({\n        customerId: cid, username: cust.username, roleId: cust.alist_role_id,\n        toAdd, toRemove, desiredPaths, applied,\n      });\n    }\n  } catch (e) {\n    errors.push({ customerId: cust.Id, username: cust.username, error: e.message });\n  }\n}\n\nreturn { json: {\n  dryRun: DRY_RUN, autoDisable: AUTO_DISABLE, at: new Date().toISOString(),\n  customersScanned: customers.length, customersChanged: changed.length,\n  changed, errors,\n} };\n"
+        "jsCode": "// ============================================================================\n// W3 runtime body — 5-min expiry sweep / full reconciliation.\n// Rebuilt by `node n8n/gen_w3.js` (single source of truth = shared/effective-grants.js).\n// dryRun: W3_DRY_RUN=true -> only print the plan (no writes).\n// autoDisable: ALIST_AUTO_DISABLE_ON_EXPIRE=true -> disable AList user when a\n//              previously-scoped customer's desired set becomes empty. Default off.\n// ============================================================================\n// ============================================================================\n// SHARED: calculateEffectiveGrants — single source of truth for \"what scopes\n// should customer X have right now\", reused by W1 (active resume), W2\n// (CustomerProduct sync) and W3 (expiry sweep).\n//\n// This file is INLINED into each workflow's Code node at build time (see\n// gen_w1.js / gen_w2.js / gen_w3.js). It must therefore be self-contained:\n// no require/import, no process.exit, no top-level return outside functions.\n//\n// Config is read via $env (the ONLY reliable channel in n8n Code nodes for\n// custom env vars — process.env is unreliable there). The caller passes a\n// `ctx` with { $env, helpers } so this file is also unit-testable outside n8n.\n//\n// ============================================================================\n\n// --- helpers (depend on ctx, so they are functions not top-level consts) ---\n\nfunction ncUrl(ctx, path) {\n  return ctx.$env.NOCODB_URL + path;\n}\n\nasync function ncGet(ctx, path) {\n  return await ctx.helpers.httpRequest({\n    method: 'GET',\n    url: ncUrl(ctx, path),\n    headers: { 'xc-token': ctx.$env.NOCODB_TOKEN },\n    json: true,\n  });\n}\n\nasync function alistReq(ctx, method, path, body, token) {\n  // NOTE: AList expects the RAW token in Authorization (no \"Bearer \" prefix).\n  return await ctx.helpers.httpRequest({\n    method,\n    url: ctx.$env.ALIST_URL + path,\n    headers: token ? { Authorization: token } : {},\n    body,\n    json: true,\n  });\n}\n\n// NocoDB LinkToAnotherRecord values are objects/arrays/numbers depending on\n// whether the API was asked to expand them. Normalise to a single id or null.\nfunction linkId(v) {\n  if (v == null) return null;\n  if (typeof v === 'object' && !Array.isArray(v)) return v.Id ?? v.id ?? null;\n  if (Array.isArray(v)) return v[0]?.Id ?? v[0]?.id ?? null;\n  return v;\n}\n\n// --- core algorithm --------------------------------------------------------\n//\n// desired scopes for a customer = union of:\n//   (a) every RESOURCE reachable from an ACTIVE, NOT-YET-EXPIRED CustomerProduct\n//   (b) every RESOURCE granted directly via an ACTIVE, NOT-YET-EXPIRED AccessGrant\n//\n// For (a) the SAME resource coming from MULTIPLE products keeps the MAX\n// expires_at, exactly matching the \"two products share a resource\" semantics\n// the user tested. Expiry boundary is `<= today` (expiring today is expired).\n\nasync function calculateEffectiveGrants(ctx, customerId) {\n  const T_CUST = ctx.$env.NOCODB_TABLE_CUSTOMERS;\n  const T_CUSTPROD = ctx.$env.NOCODB_TABLE_CUSTOMERPRODUCTS;\n  const T_PROD = ctx.$env.NOCODB_TABLE_PRODUCTS;\n  const T_RES = ctx.$env.NOCODB_TABLE_RESOURCES;\n  const T_GRANT = ctx.$env.NOCODB_TABLE_ACCESSGRANTS;\n  const LNK_PROD_RES = ctx.$env.NOCODB_LINK_PROD_RESOURCES; // c4ko4x8kwi16swg\n  const today = new Date().toISOString().slice(0, 10); // 'YYYY-MM-DD'\n\n  // index all Resources by Id -> alist_path (cheap, one query)\n  const allRes = (await ncGet(ctx, `/api/v2/tables/${T_RES}/records?limit=10000`)).list || [];\n  const resPath = {};\n  allRes.forEach(r => { resPath[r.Id] = r.alist_path; });\n\n  const desired = {}; // path -> { expires, permission }\n\n  // (a) CustomerProducts -> Resources (via product M2M link), MAX expiry on\n  //     the same path.\n  //     NOTE: `(customer,eq,N)` matches the link field's DISPLAY NAME and always\n  //     returns 0 rows. Must use the `customer.Id` sub-field syntax (or the\n  //     foreign-key column `nc_jitu___Customers_id`).\n  const cps = (await ncGet(ctx, `/api/v2/tables/${T_CUSTPROD}/records?where=(customer.Id,eq,${customerId})&limit=1000`)).list || [];\n  for (const c of cps) {\n    if (c.status && c.status !== 'active') continue;\n    if (c.expires_at && String(c.expires_at) <= today) continue; // expired (incl. today)\n    const pid = linkId(c.product);\n    if (!pid) continue;\n    const res = (await ncGet(ctx, `/api/v2/tables/${T_PROD}/links/${LNK_PROD_RES}/records/${pid}`)).list || [];\n    const exp = c.expires_at; // 'YYYY-MM-DD' (may be null = no expiry)\n    for (const r of res) {\n      const p = resPath[r.Id];\n      if (!p) continue;\n      const cur = desired[p];\n      if (!cur || !cur.expires || (exp && exp > cur.expires)) {\n        desired[p] = { expires: exp || null, permission: cur?.permission ?? 0 };\n      }\n    }\n  }\n\n  // (b) AccessGrants -> Resources (manual / materialised direct grants)\n  const grants = (await ncGet(ctx, `/api/v2/tables/${T_GRANT}/records?where=(customer.Id,eq,${customerId})&limit=1000`)).list || [];\n  for (const g of grants) {\n    if (g.status && g.status !== 'active') continue;\n    if (g.expires_at && String(g.expires_at) <= today) continue;\n    const p = resPath[linkId(g.resource)];\n    if (!p) continue;\n    const exp = g.expires_at;\n    const cur = desired[p];\n    if (!cur || !cur.expires || (exp && exp > cur.expires)) {\n      desired[p] = { expires: exp || null, permission: g.permission === 'readwrite' ? 1 : 0 };\n    }\n  }\n\n  const desiredPaths = Object.keys(desired).sort();\n  return {\n    customerId,\n    desired,             // { path: {expires, permission} }\n    desiredPaths,        // sorted array of paths\n    newScopes: desiredPaths.map(p => ({ path: p, permission: desired[p].permission })),\n  };\n}\n\n// --- export shim: kept only when unit-tested, stripped when inlined -------\n// ============================================================================\n\nconst ctx = { $env, helpers: this.helpers };\nconst DRY_RUN = ($env.W3_DRY_RUN || '').toLowerCase() === 'true';\nconst AUTO_DISABLE = ($env.ALIST_AUTO_DISABLE_ON_EXPIRE || '').toLowerCase() === 'true';\nconst T_CUST = $env.NOCODB_TABLE_CUSTOMERS;\n\n// admin login once for the whole sweep\nconst login = await alistReq(ctx, 'POST', '/api/auth/login', {\n  username: $env.ALIST_ADMIN_USERNAME,\n  password: $env.ALIST_ADMIN_PASSWORD,\n}, null);\nconst token = login?.data?.token;\nif (!token) throw new Error('AList login failed');\n\nconst customers = (await ncGet(ctx, `/api/v2/tables/${T_CUST}/records?limit=10000`)).list || [];\nconst changed = [], errors = [];\n\nfor (const cust of customers) {\n  try {\n    if (!cust.alist_role_id) continue; // not provisioned yet\n    const cid = cust.Id;\n\n    // desired scopes via shared algorithm\n    const g = await calculateEffectiveGrants(ctx, cid);\n    const desiredPaths = g.desiredPaths;\n\n    // current scopes from AList\n    const role = await alistReq(ctx, 'GET', `/api/admin/role/get?id=${cust.alist_role_id}`, null, token);\n    const currentPaths = (role?.data?.permission_scopes || []).map(s => s.path);\n    const toAdd = desiredPaths.filter(p => !currentPaths.includes(p));\n    const toRemove = currentPaths.filter(p => !desiredPaths.includes(p));\n    const scopesChanged = toAdd.length > 0 || toRemove.length > 0;\n    const nowEmpty = desiredPaths.length === 0;\n\n    // only disable when a customer that HAD scopes now has none (guard\n    // currentPaths>0 avoids killing a fresh customer with an empty role).\n    const shouldDisable = AUTO_DISABLE && nowEmpty && cust.status === 'active' && currentPaths.length > 0;\n\n    const applied = [];\n    if (scopesChanged) {\n      if (!DRY_RUN) await alistReq(ctx, 'POST', '/api/admin/role/update', {\n        id: cust.alist_role_id,\n        name: role?.data?.name,\n        description: role?.data?.description,\n        permission_scopes: g.newScopes,\n      }, token);\n      applied.push('role_scopes');\n    }\n    if (shouldDisable) {\n      // AList v3.63 /user/update REQUIRES username — {id,disabled} alone = 400 silent no-op (2026-08-25).\n      if (!DRY_RUN && cust.alist_user_id) {\n        const disRes = await alistReq(ctx, 'POST', '/api/admin/user/update', { id: cust.alist_user_id, username: cust.username, disabled: true }, token);\n        if (!disRes || disRes.code !== 200) throw new Error('AList disable failed: ' + JSON.stringify(disRes));\n      }\n      applied.push('disable');\n    }\n    if (applied.length) {\n      changed.push({\n        customerId: cid, username: cust.username, roleId: cust.alist_role_id,\n        toAdd, toRemove, desiredPaths, applied,\n      });\n    }\n  } catch (e) {\n    errors.push({ customerId: cust.Id, username: cust.username, error: e.message });\n  }\n}\n\nreturn { json: {\n  dryRun: DRY_RUN, autoDisable: AUTO_DISABLE, at: new Date().toISOString(),\n  customersScanned: customers.length, customersChanged: changed.length,\n  changed, errors,\n} };\n"
       },
       "id": "reconcile",
       "name": "Reconcile & Apply (Expiry Sweep)",
diff --git a/n8n/deploy_w1_w3.mjs b/n8n/deploy_w1_w3.mjs
new file mode 100644
index 0000000..be8d347
--- /dev/null
+++ b/n8n/deploy_w1_w3.mjs
@@ -0,0 +1,28 @@
+// Deploy regenerated W1..W4 workflows to live n8n via public API.
+// Usage: N8N_API_KEY=<key> N8N_BASE=http://192.168.137.2:5678 node deploy_w1_w3.mjs
+// Key lives in repo-root SECRETS.md (never hardcode here).
+import { readFile } from "node:fs/promises";
+
+const N8N = process.env.N8N_BASE || "http://192.168.137.2:5678";
+const KEY = process.env.N8N_API_KEY;
+if (!KEY) { console.error("N8N_API_KEY env required (see SECRETS.md)"); process.exit(1); }
+const H = { "X-N8N-API-KEY": KEY, "Content-Type": "application/json" };
+
+const TARGETS = [
+  { file: "W1-customer-provision.json", id: "gU2ee9Eg5w1KzB5p" },
+  { file: "W3-expiry-sync.json",        id: "zlEfjj5eK5IfILtk" },
+];
+
+for (const t of TARGETS) {
+  const wf = JSON.parse(await readFile(t.file, "utf-8"));
+  delete wf.pinData;
+  delete wf.active;
+  delete wf.id;
+  const r = await fetch(`${N8N}/api/v1/workflows/${t.id}`, {
+    method: "PUT", headers: H, body: JSON.stringify(wf),
+  });
+  const txt = await r.text();
+  console.log(t.file, "PUT", r.status, txt.slice(0, 120));
+  if (r.status !== 200) process.exit(1);
+}
+console.log("DEPLOY OK — remember to recheck workflow_entity.activeVersionId alignment");
diff --git a/n8n/w1-body.js b/n8n/w1-body.js
index 86e3b82..b8e02d4 100644
--- a/n8n/w1-body.js
+++ b/n8n/w1-body.js
@@ -153,7 +153,10 @@ if (status !== 'active') {
   }
   const actions = [];
   if (alistUserId) {
-    await alistReq(ctx, 'POST', '/api/admin/user/update', { id: alistUserId, disabled: true }, token);
+    // AList v3.63 /user/update REQUIRES username (validation: Username required).
+    // Sending {id,disabled} alone -> 400 -> silent no-disable (found live 2026-08-25).
+    const disRes = await alistReq(ctx, 'POST', '/api/admin/user/update', { id: alistUserId, username, disabled: true }, token);
+    if (!disRes || disRes.code !== 200) throw new Error('AList disable failed: ' + JSON.stringify(disRes));
     actions.push('disable_user');
   }
   if (alistRoleId) {
diff --git a/n8n/w3-body.js b/n8n/w3-body.js
index 5420375..eac5ed0 100644
--- a/n8n/w3-body.js
+++ b/n8n/w3-body.js
@@ -56,8 +56,11 @@ for (const cust of customers) {
       applied.push('role_scopes');
     }
     if (shouldDisable) {
-      if (!DRY_RUN && cust.alist_user_id)
-        await alistReq(ctx, 'POST', '/api/admin/user/update', { id: cust.alist_user_id, disabled: true }, token);
+      // AList v3.63 /user/update REQUIRES username — {id,disabled} alone = 400 silent no-op (2026-08-25).
+      if (!DRY_RUN && cust.alist_user_id) {
+        const disRes = await alistReq(ctx, 'POST', '/api/admin/user/update', { id: cust.alist_user_id, username: cust.username, disabled: true }, token);
+        if (!disRes || disRes.code !== 200) throw new Error('AList disable failed: ' + JSON.stringify(disRes));
+      }
       applied.push('disable');
     }
     if (applied.length) {