Productize scheduled success delivery, close WA pending, and clarify SQL scope grants.

Wrap successful scheduled jobs with a short WA header (+ attachment count), expire stale access pending and DM requesters on admin approve/deny, and add concrete next_steps for insufficient_scope:sql:query.

Co-authored-by: Cursor <cursoragent@cursor.com>

runtime/application/gateway/inbound_service.py

@@ -1052,8 +1052,12 @@ def process_inbound_payload(payload: dict[str, Any]) -> dict[str, Any]:
         )
         channel_is_wa_bind = str(inbound.channel or "").strip().lower() == "whatsapp"
         if info:
-            guide = _menu_text(channel=str(inbound.channel or ""))
-            reply = ("Bound successfully.\n\n" + guide) if channel_is_wa_bind else ("绑定成功。\n\n" + guide)
+            if channel_is_wa_bind:
+                from runtime.extensions.whatsapp.access_control import access_granted_guide_text
+
+                reply = access_granted_guide_text(lang="en")
+            else:
+                reply = "绑定成功。\n\n" + _menu_text(channel=str(inbound.channel or ""))
         else:
             reply = (
                 "Bind failed: invalid or already used code."

runtime/application/gateway/whatsapp_inbound_access.py

@@ -264,6 +264,30 @@ def _notify_requester_access_decision(
     )
 
 
+def notify_whatsapp_access_decision(
+    store: Any,
+    *,
+    tenant_id: str,
+    account_id: str,
+    lang: str = "en",
+    external_user_id: str,
+    phone: str = "",
+    pending_id: str = "",
+    approved: bool,
+) -> None:
+    """Public wrapper for admin/API approve paths to DM the requester."""
+    _notify_requester_access_decision(
+        store,
+        tenant_id=tenant_id,
+        account_id=account_id,
+        lang=lang,
+        external_user_id=external_user_id,
+        phone=phone,
+        pending_id=pending_id,
+        approved=approved,
+    )
+
+
 def _upsert_whatsapp_contact_profile(
     store: Any,
     *,