diff --git a/s2s-client/index.html b/s2s-client/index.html
index 750e492..73777eb 100644
--- a/s2s-client/index.html
+++ b/s2s-client/index.html
@@ -13,12 +13,100 @@
       href="https://fonts.googleapis.com/css2?family=Geist+Mono:wght@400;500;600&family=Inter:wght@400;500;600;700;800&display=swap"
       rel="stylesheet"
     />
-    <link rel="stylesheet" href="style.css?v=202609041120" />
+    <!-- ═══════════════════════════════════════════════════════════════════
+         ANTI-FOUC VEIL (S2S_THEME flash fix)  —  MUST stay INLINE and
+         BEFORE the <link rel="stylesheet" href="style.css"> tag below.
+
+         Problem reported by user 2026-09-10:
+           "quando faccio refresh per un momento si vede il theme precedente
+            quello purple"
+
+         The earlier guard `html:not([data-theme]) [data-theme-only]` only
+         hid the two parallel widget branches, but the UNTHEMED DEFAULTS in
+         style.css (:root purple palette, body background #07080d, topbar
+         glass, #app deep-space colours, purple orb border gradients) were
+         still rendering for the ~1-2 frames between body paint commit and
+         fetchConfig() returning api/config.theme → setAttribute("data-theme").
+         The user saw a dark-purple flash before the white Vocero theme
+         applied — exactly the symptom described.
+
+         FIX (3 layers, fail-safe):
+           1. While html has NO data-theme attribute (pre-fetchConfig),
+              render <body> COMPLETELY INVISIBLE + background:white +
+              border:none (the two most visible paint leaks fixed first).
+              Display:none would block CSS transitions from being recorded;
+              visibility:hidden keeps layout but forbids painting entirely,
+              which is exactly what we want.
+           2. Safety timeout: if fetchConfig() fails to resolve (e.g.
+              static hosting / no server / offline) the veil auto-lifts
+              after 2500 ms so the user is NOT stuck on a blank page.
+           3. Immediately after root.setAttribute("data-theme", …) in
+              fetchConfig() we also add class="theme-ready" which the veil
+              additionally checks so the user sees a 1-frame lift, not a
+              delayed paint. The visibility guard is a double-OR so it
+              expires on EITHER signal.
+         ═══════════════════════════════════════════════════════════════════ -->
+    <style id="s2s-anti-fouc-veil">
+      html:not([data-theme]) body,
+      html:not(.theme-ready) body {
+        visibility: hidden !important;
+        background: #ffffff !important;
+        color: #0f172a !important;
+        opacity: 0 !important;
+        transition: none !important;
+        animation: none !important;
+      }
+      html:not([data-theme]),
+      html:not(.theme-ready) {
+        background: #ffffff !important;
+      }
+      /* Also kill the purple orb + any glass chrome during the veil window,
+         because even when <body> is visibility:hidden some browsers do a
+         first compositing pass that leaks a few pixels of background. */
+      html:not([data-theme]) #main-circle,
+      html:not([data-theme]) .orb-wrap,
+      html:not([data-theme]) .stage,
+      html:not([data-theme]) .topbar,
+      html:not([data-theme]) #app,
+      html:not(.theme-ready) #main-circle,
+      html:not(.theme-ready) .orb-wrap,
+      html:not(.theme-ready) .stage,
+      html:not(.theme-ready) .topbar,
+      html:not(.theme-ready) #app {
+        background: transparent !important;
+        background-image: none !important;
+        backdrop-filter: none !important;
+        -webkit-backdrop-filter: none !important;
+        box-shadow: none !important;
+        border: none !important;
+        color: transparent !important;
+      }
+    </style>
+    <script>
+      // Fail-safe veil lift: if fetchConfig() fails to reply (static hosting,
+      // offline, api/config 500) the user never sees <body> stuck invisible.
+      // setTimeout (not rAF) because we want a real wall-clock timeout.
+      window.__s2sVeilLiftTimeout = window.setTimeout(function () {
+        var r = document.documentElement;
+        if (!r.hasAttribute("data-theme")) r.setAttribute("data-theme", "dark");
+        r.classList.add("theme-ready");
+      }, 2500);
+      // Also try to clear the fail-safe as soon as DOMContentLoaded fires so
+      // we don't accidentally fire the lift AFTER a normal-config path.
+      document.addEventListener("DOMContentLoaded", function () {
+        var r = document.documentElement;
+        if (r.hasAttribute("data-theme") && !r.classList.contains("theme-ready")) {
+          r.classList.add("theme-ready");
+          if (window.__s2sVeilLiftTimeout) window.clearTimeout(window.__s2sVeilLiftTimeout);
+        }
+      });
+    </script>
+    <link rel="stylesheet" href="style.css?v=202609291430" />
     <script>
       document.addEventListener("DOMContentLoaded", () => {
         const l = document.querySelector('link[rel="stylesheet"]');
-        if (l && !l.href.includes("v=202609041120")) {
-          l.href = l.href.replace(/v=\d+/, "v=202609041120");
+        if (l && !l.href.includes("v=202609291430")) {
+          l.href = l.href.replace(/v=\d+/, "v=202609291430");
         }
       });
     </script>
@@ -39,19 +127,33 @@
     </div>
     <div id="app">
       <header class="topbar">
+        <!-- Hamburger (theme=white only): icon button 3 horizontal lines, sits left of brand cluster, top-left corner, square icon, dark text, no visible borders.
+             Mirrors the 3-line menu icon in the screenshot header. -->
+        <button id="menu-btn" class="icon-btn menu-btn" type="button" title="Menú" aria-label="Abrir menú" hidden data-theme-only="white">
+          <svg width="26" height="26" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round">
+            <line x1="3" y1="6"  x2="21" y2="6"/>
+            <line x1="3" y1="12" x2="21" y2="12"/>
+            <line x1="3" y1="18" x2="21" y2="18"/>
+          </svg>
+        </button>
         <div class="brand">
           <div class="ident">
             <div class="ident-head">
               <a class="ident-title">Vocero</a>
+              <!-- Subtitle shown below Vocero title (theme=white only) -->
+              <p class="ident-subtitle" hidden data-theme-only="white">Agente conversacional</p>
             </div>
-            <div id="ident-user-name" class="ident-user-name" hidden></div>
           </div>
         </div>
+        <!-- User avatar circle (theme=white only): grid item next to the brand, not
+             absolute-positioned → eliminates overlap with title/subtitle entirely.
+             Same element id so main.js syncVoceroHeaderUser() still fills the text. -->
+        <div id="ident-user-name" class="ident-user-name" hidden data-theme-only="white" aria-hidden="true">AV</div>
         <!-- Left sidebar (reports) toggle: always visible, pinned left side of the
              topbar control cluster. Clicking slides in the offcanvas sidebar on
              mobile; it's a no-op hover hint on desktop where sidebar is always
              shown. -->
-        <button id="reports-sidebar-toggle" class="icon-btn" title="Reports programados" aria-label="Abrir panel de reportes" aria-expanded="false" aria-controls="reports-sidebar" hidden data-reports-sidebar-toggle data-debug-only="true">
+        <button id="reports-sidebar-toggle" class="icon-btn" title="Reports programados" aria-label="Abrir panel de reportes" aria-expanded="false" aria-controls="reports-sidebar" hidden data-reports-sidebar-toggle data-debug-only="true" data-theme-only="dark">
           <svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M3 3h18v18H3z" fill="none"/><line x1="9" y1="3" x2="9" y2="21"/></svg>
           <span id="reports-sidebar-badge" class="chat-badge" aria-hidden="true"></span>
         </button>
@@ -74,8 +176,34 @@
         </div>
       </header>
 
+      <a class="feedback-link" href="https://tally.so/r/pb8LWq" target="_blank" rel="noopener noreferrer">Enviar feedback</a>
+
+      <!-- Theme=white only: Status card between topbar and stage
+           "Listo para conversar / Informes, análisis, datos y mucho más."
+           with light-blue chart icon and chevron-right arrow. -->
+      <div class="status-card" hidden data-theme-only="white" aria-label="Estado de la sesión">
+        <div class="status-card-icon" aria-hidden="true">
+          <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.4" stroke-linecap="round" stroke-linejoin="round">
+            <line x1="6"  y1="20" x2="6"  y2="12"/>
+            <line x1="11" y1="20" x2="11" y2="6"/>
+            <line x1="16" y1="20" x2="16" y2="15"/>
+            <line x1="21" y1="20" x2="21" y2="10"/>
+          </svg>
+        </div>
+        <div class="status-card-text">
+          <h2 class="status-card-title">Listo para conversar</h2>
+          <p class="status-card-sub">Informes, análisis, datos y mucho más.</p>
+        </div>
+        <button class="status-card-arrow icon-btn" type="button" aria-label="Ver más detalles" title="Detalles">
+          <svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.4" stroke-linecap="round" stroke-linejoin="round">
+            <polyline points="9 18 15 12 9 6"></polyline>
+          </svg>
+        </button>
+      </div>
+
       <main class="stage">
-        <div class="orb-wrap">
+        <!-- DARK THEME orb (purple gradient + purple icons): shown only on native dark theme, hidden in white -->
+        <div class="orb-wrap" data-theme-only="dark">
           <div id="mic-gate" class="mic-gate">
             <svg id="mic-gate-arc" class="mic-gate-arc" viewBox="0 0 100 100" aria-hidden="true">
               <path id="mga-track" class="mga-track" fill="none" />
@@ -134,6 +262,69 @@
           </button>
         </div>
 
+        <!-- WHITE THEME mic stage (replaces the purple orb)
+             - Blue mic circular button (116 px, deep blue, white mic)
+             - Two waveform banks left + right (audio-reactive CSS bars)
+             - "Escuchando..." status text
+             - "Detener" pill button below.
+             Mirrors the screenshot center UI exactly. -->
+        <div class="white-mic-stage" hidden data-theme-only="white" aria-label="Control de voz">
+          <!-- Waveform left side: 7 bars mirror right side, heights driven by JS vars -->
+          <div class="white-waveform white-waveform-left" aria-hidden="true">
+            <span class="w-bar wb-1" style="--bar-h: 0.4"></span>
+            <span class="w-bar wb-2" style="--bar-h: 0.65"></span>
+            <span class="w-bar wb-3" style="--bar-h: 0.9"></span>
+            <span class="w-bar wb-4" style="--bar-h: 1"></span>
+            <span class="w-bar wb-5" style="--bar-h: 0.7"></span>
+            <span class="w-bar wb-6" style="--bar-h: 0.55"></span>
+            <span class="w-bar wb-7" style="--bar-h: 0.3"></span>
+          </div>
+
+          <!-- Big circular mic button (theme=white). Click = start/stop voice session.
+               Forwards all its clicks to the real #main-circle so the entire WS
+               pipeline still works. -->
+          <button id="white-mic-circle"
+                  class="white-mic-circle state-idle"
+                  type="button"
+                  aria-label="Iniciar conversación de voz">
+            <span class="wmc-halo" aria-hidden="true"></span>
+            <span class="wmc-ring" aria-hidden="true"></span>
+            <span class="wmc-core" aria-hidden="true"></span>
+            <svg class="wmc-icon wmc-mic" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
+              <rect x="9" y="2" width="6" height="12" rx="3" fill="currentColor" stroke="none"/>
+              <path d="M5 10a7 7 0 0 0 14 0"/>
+              <line x1="12" y1="19" x2="12" y2="22"/>
+              <line x1="8" y1="22" x2="16" y2="22"/>
+            </svg>
+            <svg class="wmc-icon wmc-stop" viewBox="0 0 24 24" fill="currentColor" aria-hidden="true"><rect x="6" y="6" width="12" height="12" rx="2"/></svg>
+            <span class="wmc-icon wmc-spinner" aria-hidden="true"></span>
+          </button>
+
+          <!-- Waveform right side: 7 bars mirroring left -->
+          <div class="white-waveform white-waveform-right" aria-hidden="true">
+            <span class="w-bar wb-1" style="--bar-h: 0.3"></span>
+            <span class="w-bar wb-2" style="--bar-h: 0.55"></span>
+            <span class="w-bar wb-3" style="--bar-h: 0.7"></span>
+            <span class="w-bar wb-4" style="--bar-h: 1"></span>
+            <span class="w-bar wb-5" style="--bar-h: 0.9"></span>
+            <span class="w-bar wb-6" style="--bar-h: 0.65"></span>
+            <span class="w-bar wb-7" style="--bar-h: 0.4"></span>
+          </div>
+
+          <!-- Status caption below mic circle: "Escuchando...", "Pensando..." etc. -->
+          <p id="white-mic-caption" class="white-mic-caption" role="status">Escuchando…</p>
+
+          <!-- Secondary pill "Detener" (Stop) below caption, with dark stop-square icon. -->
+          <button id="white-stop-btn"
+                  class="white-stop-btn"
+                  type="button"
+                  aria-label="Detener"
+                  title="Detener sesión de voz">
+            <svg viewBox="0 0 24 24" fill="currentColor" aria-hidden="true"><rect x="6" y="6" width="12" height="12" rx="2"/></svg>
+            <span>Detener</span>
+          </button>
+        </div>
+
         <p id="circle-caption" class="circle-caption" role="status">Tap to start</p>
         <p id="circle-subcaption" class="circle-subcaption" hidden></p>
 
@@ -147,31 +338,90 @@
         </div>
       </main>
 
+      <!-- Theme=white only: Quick action pills below mic area
+           "Resumen" · "Consultar datos" · "Crear respuesta" each with icon -->
+      <div class="quick-actions" hidden data-theme-only="white" aria-label="Acciones rápidas">
+        <button class="quick-action-btn" type="button" data-action="resumen">
+          <svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
+            <path d="M14 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V8z"/>
+            <polyline points="14 2 14 8 20 8"/>
+            <line x1="8" y1="13" x2="16" y2="13"/>
+            <line x1="8" y1="17" x2="14" y2="17"/>
+          </svg>
+          <span>Resumen</span>
+        </button>
+        <button class="quick-action-btn" type="button" data-action="consultar-datos">
+          <svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
+            <line x1="6"  y1="20" x2="6"  y2="12"/>
+            <line x1="11" y1="20" x2="11" y2="6"/>
+            <line x1="16" y1="20" x2="16" y2="15"/>
+            <line x1="21" y1="20" x2="21" y2="10"/>
+          </svg>
+          <span>Consultar datos</span>
+        </button>
+        <button class="quick-action-btn" type="button" data-action="crear-respuesta">
+          <svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
+            <line x1="18" y1="2" x2="22" y2="6"/>
+            <path d="M7.5 20.5 19 9l-4-4L3.5 16.5 2 22z"/>
+          </svg>
+          <span>Crear respuesta</span>
+        </button>
+      </div>
+
       <!-- Chat di testo SEMPRE VISIBILE (fissa in basso, tra stage e footer).
            Nota: ora è un blocco diretto del flex-col #app, non più un overlay
            destro → non c'è più bisogno del bottone toggle in topbar. -->
-      <section id="chat-panel" class="chat-panel chat-panel-inline" aria-label="Chat de texto">
+      <div id="chat-panel" class="chat-panel chat-panel-inline" aria-label="Chat de texto">
         <div class="chat-panel-inner">
           <header class="chat-panel-header">
             <h3>Conversación</h3>
+            <div class="chat-header-actions" aria-label="Acciones de la conversación">
+              <!-- "En línea" status pill (green dot + text) — theme=white only.
+                   Mirrors the screenshot chat header top-right corner. -->
+              <span class="chat-status-pill" hidden data-theme-only="white" role="status" aria-live="polite">
+                <span class="chat-status-dot" aria-hidden="true"></span>
+                <span>En línea</span>
+              </span>
+              <button id="chat-export-btn" class="chat-export-btn icon-btn"
+                      type="button"
+                      aria-label="Descargar conversación"
+                      title="Descargar conversación (JSON + TXT)">
+                <svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.9" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
+                  <path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"/>
+                  <polyline points="7 10 12 15 17 10"/>
+                  <line x1="12" y1="15" x2="12" y2="3"/>
+                </svg>
+              </button>
+            </div>
           </header>
           <div id="chat-history" class="chat-history" role="log" aria-live="polite" aria-atomic="false"></div>
-          <!-- Text input row HIDDEN per user request 2026-09-04 (restore removing hidden tag below) -->
+          <!-- Text input row — HIDDEN in dark theme per user request 2026-09-04.
+               In white theme VISIBLE with a new design (clip button + rounded input + blue circular send),
+               which mirrors the screenshot footer input bar.
+               Restore the dark-theme input by removing the `hidden` attr + style below. -->
           <form id="chat-form" class="chat-form" autocomplete="off" spellcheck="false" hidden style="display:none!important">
+            <button id="chat-attach-btn" class="chat-attach-btn icon-btn" type="button" aria-label="Adjuntar archivo" title="Adjuntar">
+              <svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round">
+                <path d="M21.44 11.05l-9.19 9.19a6 6 0 0 1-8.49-8.49l9.19-9.19a4 4 0 0 1 5.66 5.66l-9.2 9.19a2 2 0 0 1-2.83-2.83l8.49-8.48"/>
+              </svg>
+            </button>
             <input id="chat-input"
               class="chat-input"
               type="text"
               name="message"
-              placeholder="Escribe aquí tu mensaje a Vocero…"
+              placeholder="Escribe un mensaje…"
               aria-label="Enviar mensaje de texto a Vocero"
               maxlength="500"
             />
-            <button id="chat-send" type="submit" class="chat-send-btn icon-btn" aria-label="Enviar mensaje">
-              <svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="22" y1="2" x2="11" y2="13"/><polygon points="22 2 15 22 11 13 2 9 22 2"/></svg>
+            <button id="chat-send" type="submit" class="chat-send-btn-round" aria-label="Enviar mensaje">
+              <svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                <line x1="22" y1="2" x2="11" y2="13"/>
+                <polygon points="22 2 15 22 11 13 2 9 22 2"/>
+              </svg>
             </button>
           </form>
         </div>
-      </section>
+      </div>
     </div>
 
     <!-- Ephemeral chat bubbles anchored to the top-right -->
@@ -188,7 +438,7 @@
     <!-- Left sidebar: reports programados.
          Desktop: fixed left, 320px, always visible (below topbar + above sticky footer).
          Mobile : off-canvas left overlay, toggled by #reports-sidebar-toggle button in topbar. -->
-    <aside id="reports-sidebar" class="reports-sidebar" aria-label="Reportes programados" hidden>
+    <aside id="reports-sidebar" class="reports-sidebar" aria-label="Reportes programados" hidden data-theme-only="dark">
       <div id="reports-sidebar-backdrop" class="reports-sidebar-backdrop" data-close-reports-sidebar></div>
       <div class="reports-sidebar-inner">
         <header class="reports-sidebar-header">
@@ -199,7 +449,7 @@
         </header>
         <!-- MOVED from inside .ident in the topbar — same #id so main.js syncVoceroHeaderUser()
              continues to work with zero JS changes to reports rendering logic. -->
-        <div id="reports-hint" class="reports-hint" hidden></div>
+        <div id="reports-hint" class="reports-hint" hidden data-theme-only="dark"></div>
         <!-- Debug-only: Spanish suggestions panel (gated behind ?debug=true).
              Shown as the bottom block inside the left sidebar. -->
         <div id="reports-suggestions" class="reports-suggestions" hidden data-debug-only="true"></div>
@@ -259,7 +509,7 @@
         </header>
 
         <div class="tab-panels">
-          <section class="tab-panel active" role="tabpanel">
+          <div class="tab-panel active" role="tabpanel">
             <label class="field" id="conn-field">
               <span id="conn-label">Speech-to-speech server URL</span>
               <input id="lb-url" type="text" autocomplete="off" spellcheck="false" placeholder="http://localhost:port" />
@@ -327,7 +577,7 @@
               </button>
               <small id="restart-hint">Connect first, then come back here to apply live changes.</small>
             </div>
-          </section>
+          </div>
         </div>
 
         <footer class="modal-footer">
@@ -456,16 +706,16 @@
         </button>
 
         <!-- Hero: big glass avatar circle + title + subtitle (email fallback). -->
-        <section class="user-profile-hero">
+        <div class="user-profile-hero">
           <div id="user-profile-avatar" class="user-profile-avatar" aria-hidden="true">AV</div>
           <h2 id="user-profile-title" class="user-profile-title"></h2>
           <p id="user-profile-subtitle" class="user-profile-subtitle"></p>
-        </section>
+        </div>
 
         <!-- Metadata: a 1-col definition-list-like grid. Empty rows are hidden
              automatically via JS when the field has no value, so we never show
              blank labels. -->
-        <section id="user-profile-metadata" class="user-profile-metadata" aria-label="Informazioni utente"></section>
+        <div id="user-profile-metadata" class="user-profile-metadata" aria-label="Informazioni utente"></div>
       </div>
     </dialog>
 
@@ -473,6 +723,6 @@
       <span class="app-footer-text">Azurian Vocero realtime ver.Beta 2.1</span>
     </footer>
 
-    <script type="module" src="main.js?v=202609041120"></script>
+    <script type="module" src="main.js?v=202609102207"></script>
   </body>
 </html>
diff --git a/s2s-client/main.js b/s2s-client/main.js
index 674f9b7..240d82d 100644
--- a/s2s-client/main.js
+++ b/s2s-client/main.js
@@ -26,7 +26,7 @@ import { Account } from "./ui/account.js?v=202609041120";
 // ESATTAMENTE quale versione di main.js è caricata nel browser.
 // Se NON vedi questa riga in Console = stai ancora usando il file CACHATO VECCHIO.
 console.info(
-  "%c🟢 VOCERO main.js loaded. version=2026-09-04 11:20 (FIX HEADER TRONCO: body safe-area-inset top/right/left 10px min + topbar padding-top 16 + margin-top safe. FIX SCROLL INSUFFICIENTE: chat-history padding-bottom 96→160px; chat-panel clamp 40-96→60-160; #app padding-bottom 56→120px+safe; footer safe-area bottom; step 4 retry +250ms (5 step tot); MAX_SAFE_INTEGER invece di 9M)",
+  "%c🟢 VOCERO main.js loaded. version=2026-09-24 23:12 (DEBUG FETCH WRAPPER+WS SEMPRE-ATTIVO; APIPILOT: demo flag=true + PREFETCH AUTOMATICO OGNI SESSIONE WS + PREFETCH DOPO LOGIN-BY-PHONE OK (refresh=true per invalidare cache server anonima); cache client per-utente; cambio phone = invalidate automatico; export chat; fix scroll).",
   "background:#1e293b;color:#86efac;font-weight:700;padding:4px 8px;border-radius:4px;"
 );
 console.info(
@@ -38,6 +38,218 @@ console.info(
 // eslint-disable-next-line no-debugger
 // debugger;  // ← scommenta per fermarti QUI all'avvio se DevTools è aperto
 
+// ---------------------------------------------------------------------------
+// 🔎 FETCH WRAPPER (SEMANTIC DEBUG LOG) — attivo SEMPRE (non solo in DEBUG)
+// Ogni chiamata `fetch` lato browser viene intercettata e loggata con:
+//   • URL risolto, metodo, dimensioni body + preview JSON
+//   • status HTTP (colorato verde/giallo/rosso a seconda della classe)
+//   • durata (performance.now), dimensione + preview risposta JSON
+// Tag semantici per filtrare veloce la Console:
+//   [FETCH:CONFIG]     [FETCH:REASONING]  [FETCH:SEARCH]
+//   [FETCH:PROFILE]    [FETCH:REPORTS]    [FETCH:APIPILOT]
+//   [FETCH:SESSION]    [FETCH:QUEUE]      [FETCH:ME]
+// ---------------------------------------------------------------------------
+(function _installFetchDebugTracer() {
+  const ORIGINAL_FETCH = window.fetch.bind(window);
+  // Classifica endpoint in tag leggibile (stesso ordine di @app route in server.py).
+  /** @param {string} url */
+  function _tagFor(url) {
+    try {
+      const path = url.startsWith("/") || url.startsWith("./") || url.startsWith("api/")
+        ? "/" + url.replace(/^\.?\//, "").replace(/^\//, "")
+        : new URL(url, window.location.href).pathname;
+      if (/\/api\/apipilot\/tools\/?$/i.test(path)) return "APIPILOT:TOOLS";
+      if (/\/api\/apipilot\/execute\/?$/i.test(path)) return "APIPILOT:EXEC";
+      if (/\/api\/config\/?$/i.test(path)) return "CONFIG";
+      if (/\/api\/reasoning\/?$/i.test(path)) return "REASONING";
+      if (/\/api\/search\/?$/i.test(path)) return "SEARCH";
+      if (/\/api\/user\/phone\/?($|\?)/i.test(path)) return "PROFILE";
+      if (/\/api\/user\/reports\/?($|\?)/i.test(path)) return "REPORTS";
+      if (/\/api\/session\/heartbeat\/?$/i.test(path)) return "SESSION:HEARTBEAT";
+      if (/\/api\/session\/end\/?$/i.test(path)) return "SESSION:END";
+      if (/\/api\/session\/?$/i.test(path)) return "SESSION:START";
+      if (/\/api\/queue\/end\/?$/i.test(path)) return "QUEUE:END";
+      if (/\/api\/queue\/[^/?]+\/?$/i.test(path)) return "QUEUE:POLL";
+      if (/\/api\/me\/?$/i.test(path)) return "ACCOUNT:ME";
+      return "FETCH";
+    } catch {
+      return "FETCH";
+    }
+  }
+  /** @param {RequestInfo | URL} input */
+  function _stringifyUrl(input) {
+    if (typeof input === "string") return input;
+    if (input instanceof URL) return input.href;
+    try {
+      // Request-like
+      return /** @type {{url:string}} */ (/** @type {unknown} */ (input)).url || String(input);
+    } catch {
+      return String(input);
+    }
+  }
+  /**
+   * @param {RequestInfo | URL} input
+   * @param {RequestInit | undefined} init
+   */
+  function _extractMethod(input, init) {
+    if (init && typeof init.method === "string") return init.method.toUpperCase();
+    try {
+      const r = /** @type {{method?:string}} */ (/** @type {unknown} */ (input));
+      if (r && typeof r.method === "string") return r.method.toUpperCase();
+    } catch { /* noop */ }
+    return "GET";
+  }
+  /**
+   * @param {RequestInfo | URL} input
+   * @param {RequestInit | undefined} init
+   * @returns {Promise<{ length: number; preview: string }>}
+   */
+  async function _extractBodyPreview(input, init) {
+    /** @type {BodyInit | null | undefined} */
+    let body = init ? init.body : undefined;
+    if (body === undefined || body === null) {
+      // tenta Request
+      try {
+        const r = /** @type {{body?:BodyInit|null}} */ (/** @type {unknown} */ (input));
+        if (r && r.body != null) body = r.body;
+      } catch { body = null; }
+    }
+    if (body == null) return { length: 0, preview: "(nessun body)" };
+    try {
+      if (typeof body === "string") {
+        const s = body;
+        try {
+          const j = JSON.parse(s);
+          const compact = JSON.stringify(j);
+          return { length: s.length, preview: "JSON: " + compact.slice(0, 240) };
+        } catch {
+          return { length: s.length, preview: "TEXT: " + s.slice(0, 240) };
+        }
+      }
+      if (body instanceof FormData) {
+        const pairs = [];
+        for (const [k, v] of body.entries()) pairs.push(`${k}=${String(v).slice(0, 48)}`);
+        return { length: pairs.length, preview: "FORM: " + pairs.join(" & ").slice(0, 240) };
+      }
+      if (body instanceof URLSearchParams) {
+        const s = body.toString();
+        return { length: s.length, preview: "QS: " + s.slice(0, 240) };
+      }
+      if (body instanceof Blob) return { length: body.size, preview: `BLOB (${body.type || "unknown"}) size=${body.size}` };
+      if (ArrayBuffer.isView(body)) return { length: body.byteLength, preview: `ArrayBufferView len=${body.byteLength}` };
+      if (body instanceof ArrayBuffer) return { length: body.byteLength, preview: `ArrayBuffer len=${body.byteLength}` };
+      return { length: 0, preview: "(body non serializzabile nel log)" };
+    } catch (err) {
+      return { length: -1, preview: `(err preview body: ${err})` };
+    }
+  }
+  /**
+   * @param {Response} response
+   * @returns {Promise<{ length: number; preview: string }>}
+   */
+  async function _extractResponsePreview(response) {
+    try {
+      const clone = response.clone();
+      const ct = (clone.headers.get("content-type") || "").toLowerCase();
+      const text = await clone.text();
+      if (/application\/json|application\/.*\+json/i.test(ct) || (text.trim().startsWith("{") || text.trim().startsWith("["))) {
+        try {
+          const j = JSON.parse(text);
+          const compact = JSON.stringify(j);
+          return { length: text.length, preview: "JSON: " + compact.slice(0, 260) };
+        } catch {
+          return { length: text.length, preview: "TEXT/HTML: " + text.slice(0, 260) };
+        }
+      }
+      return { length: text.length, preview: "TEXT: " + text.slice(0, 200) };
+    } catch (err) {
+      return { length: -1, preview: `(err clone response: ${err})` };
+    }
+  }
+  /** @param {number} status */
+  function _statusStyle(status) {
+    if (status >= 200 && status < 300) return "color:#16a34a;font-weight:700;";
+    if (status >= 300 && status < 400) return "color:#ca8a04;font-weight:700;";
+    if (status >= 400 && status < 500) return "color:#b45309;font-weight:700;";
+    return "color:#dc2626;font-weight:700;";
+  }
+  window.fetch = async function debugWrappedFetch(input, init) {
+    const t0 = performance.now();
+    const method = _extractMethod(input, init);
+    const rawUrl = _stringifyUrl(input);
+    const tag = _tagFor(rawUrl);
+    // Per richieste "heartbeat / end poll" (molto frequenti) logghiamo un
+    // singleton collapse per evitare spam: se `?quiet=true` o URL match → log
+    // a riga singola e non mostriamo preview.
+    const isPollish = /heartbeat|queue\/end|session\/end/i.test(tag) || (init && typeof init.keepalive === "boolean" && init.keepalive);
+    const reqPreview = isPollish ? null : await _extractBodyPreview(input, init);
+    if (!isPollish) {
+      const groupTitle = `%c→ [FETCH:${tag}] ${method} ${rawUrl}`;
+      const groupStyle = "color:#2563eb;font-weight:700;";
+      console.groupCollapsed(groupTitle, groupStyle);
+      console.log(`method=${method}  url=${rawUrl}`);
+      console.log(`bodyLen=${reqPreview?.length ?? 0}  preview=${reqPreview?.preview ?? "(poll/skip)"}`);
+      console.groupEnd();
+    } else {
+      console.debug(
+        `%c→ [FETCH:${tag}] ${method} ${rawUrl}`,
+        "color:#64748b;font-weight:600;"
+      );
+    }
+    /** @type {Response} */
+    let response;
+    try {
+      // @ts-ignore
+      response = await ORIGINAL_FETCH(input, init);
+    } catch (err) {
+      const dur = (performance.now() - t0).toFixed(1);
+      console.groupCollapsed(
+        `%c✗ [FETCH:${tag}] NETWORK_ERROR ${method} ${rawUrl}  (${dur} ms)`,
+        "background:#fee2e2;color:#b91c1c;font-weight:800;padding:2px 6px;border-radius:4px;"
+      );
+      console.error(err);
+      console.groupEnd();
+      throw err;
+    }
+    const dur = (performance.now() - t0).toFixed(1);
+    const resPreview = isPollish ? null : await _extractResponsePreview(response);
+    const statusStr = `${response.status} ${response.statusText}`.trim();
+    if (!isPollish) {
+      console.groupCollapsed(
+        `%c← [FETCH:${tag}] %c${statusStr}  %c${method} ${rawUrl}  (${dur} ms)`,
+        "color:#0f172a;font-weight:800;",
+        _statusStyle(response.status),
+        "color:#475569;font-weight:600;"
+      );
+      console.log(`HTTP status=${response.status}  statusText=${response.statusText || "-"}  durationMs=${dur}`);
+      const finalHeaders = [];
+      response.headers.forEach((v, k) => finalHeaders.push(`${k}: ${String(v).slice(0, 120)}`));
+      console.log(`Response headers (${finalHeaders.length}):`, finalHeaders);
+      if (resPreview) {
+        console.log(`responseLen=${resPreview.length}  preview=${resPreview.preview}`);
+      }
+      console.groupEnd();
+    } else {
+      const sClass = (() => {
+        if (response.ok) return "color:#15803d;";
+        if (response.status >= 500) return "color:#dc2626;";
+        return "color:#ca8a04;";
+      })();
+      console.debug(
+        `%c← [FETCH:${tag}] %c${response.status}  %c${method} ${rawUrl}  (${dur} ms)`,
+        "color:#475569;font-weight:600;",
+        sClass,
+        "color:#64748b;"
+      );
+    }
+    return response;
+  };
+  console.info(
+    "%c🔎 [FETCH-DEBUG] tracer installato. Ogni fetch è loggata con tag, method, url, status, durata e preview body.",
+    "background:#ecfeff;color:#0369a1;font-weight:700;padding:2px 6px;border-radius:4px;"
+  );
+})();
+
 // ---------------------------------------------------------------------------
 // 🛡️ GATE .topbar-right (about / tools / rag / chat / settings buttons,
 // vedi index.html L36-L56) — 3-layer safety:
@@ -630,6 +842,11 @@ let debugPrompt = false;
 // waiting for the user to say anything). Mirrors the server env
 // S2S_START_SESSION_MODE. Empty / anything else = manual (tap the start).
 let startSessionMode = "";
+// Theme: mirrors S2S_THEME env on the server. Supported values: "" (default
+// dark / purple theme), "white" (the light "Vocero app" mobile theme in the
+// screenshot: white bg, blue mic circle, chat bubbles with avatars, blue send
+// button). "dark" is an alias for "" (native dark theme — no overrides applied).
+let s2sTheme = "";
 
 // Custom RAG context entered by the user via the header "RAG" button dialog.
 // Treated exactly like voceroUserContextText / injectProfile context:
@@ -799,6 +1016,8 @@ function initialsForName(rawName) {
   const last = parts[parts.length - 1][0] ?? "";
   return (first + last).toUpperCase();
 }
+window._s2sExtractName = extractVoceroUserName;
+window._s2sInitialsFor = initialsForName;
 
 /* ─── User profile dialog (opened by clicking avatar in the header) ─── */
 /**
@@ -1293,8 +1512,53 @@ function effectiveReasoningInstructions() {
     instructions = instructions ? `${instructions} ${ragCtx}` : ragCtx;
     ragAppended = true;
   }
-  const key = `effInst:${injectProfile ? "T" : "F"}:${ctx ? "hasCtx" : "noCtx"}:${ragCtx ? "hasRag" : "noRag"}:${(base || "").length}`;
+  // ───────────────────────────────────────────────────────────────────────────
+  // 2026-09-25 INJECT API-PILOT HERAMIENTAS DINÁMICAS (PASADA 1).
+  // Formato IDENTICO a server.py Python: marker <<<APIPILOT_TOOLS_LIST_BEGIN>>>
+  // / ...lista name+description+requires_auth+required_parameters... / <<<END>>>.
+  // Il client ottiene la lista dal proxy GET api/apipilot/tools (cache 240 s
+  // per-utente in s2s-ws-client.js _apipilotClientCache) e la appende qui alle
+  // instructions STESSE (luogo #1 di massima priorità per l'LLM).
+  // Dedup: se le instructions già contengono il marker (già appese in una
+  // esecuzione precedente, oppure server Python ha già patchato il payload)
+  // → NON appendere nuovamente (no doppioni, no blob gigante).
+  let apipilotBlock = "";
+  let apipilotCount = 0;
+  let apipilotAppended = false;
+  try {
+    // @ts-ignore: esposto globalmente da s2s-ws-client.js (caricato prima di
+    // main.js in index.html). Valuta sicuro: typeof + early-skip.
+    const getter = typeof window !== "undefined" && window.__s2sGetApipilotPass1ContextInfo;
+    if (typeof getter === "function") {
+      const info = getter();
+      if (info && typeof info.block === "string" && typeof info.marker === "string") {
+        apipilotBlock = info.block;
+        apipilotCount = typeof info.count === "number" ? info.count : (apipilotBlock ? 1 : 0);
+        const already = typeof info.alreadyPresent === "function"
+          ? Boolean(info.alreadyPresent(instructions))
+          : (typeof instructions === "string" && instructions.includes(info.marker));
+        if (apipilotBlock.trim() && !already) {
+          instructions = instructions ? `${instructions}\n\n${apipilotBlock}` : apipilotBlock;
+          apipilotAppended = true;
+        }
+      }
+    }
+  } catch (_) {
+    /* never-fail: non bloccare il resto dell'istruzione prompt. */
+  }
+  const key = `effInst:${injectProfile ? "T" : "F"}:${ctx ? "hasCtx" : "noCtx"}:${ragCtx ? "hasRag" : "noRag"}:${apipilotAppended ? "apipilotY" : "apipilotN"}:${(base || "").length}`;
   _logOnce(key, () => {
+    if (apipilotAppended) {
+      console.info(
+        `[INJECT-APIPILOT] ✅ BROWSER effectiveReasoningInstructions APPENDED ApiPilot tools list PASS-1 inside LLM prompt. apipilotBlockLen=%d Ntools=%d baseLen=%d profileAppended=%s ragAppended=%s -> finalLen=%d`,
+        apipilotBlock.length, apipilotCount, (base || "").length, profileAppended, ragAppended, instructions.length,
+      );
+    } else if (apipilotBlock) {
+      console.info(
+        `[INJECT-APIPILOT] ⏭️  BROWSER effectiveReasoningInstructions: ApiPilot tools list PASS-1 already present (dedup marker BEGIN). No append needed. blockLen=%d Ntools=%d`,
+        apipilotBlock.length, apipilotCount,
+      );
+    }
     if (ragAppended) {
       console.info(
         `[CUSTOM-RAG] ✅ effectiveReasoningInstructions APPENDED custom RAG context inside LLM prompt. ragCtxLen=%d baseLen=%d profileAppended=%s -> finalLen=%d`,
@@ -1321,13 +1585,14 @@ function effectiveReasoningInstructions() {
     }
   });
   if (debugPrompt) {
-    const key2 = `debugEffInst:${instructions.length}:${ctx ? "hasCtx" : "noCtx"}:${ragCtx ? "hasRag" : "noRag"}`;
+    const key2 = `debugEffInst:${instructions.length}:${ctx ? "hasCtx" : "noCtx"}:${ragCtx ? "hasRag" : "noRag"}:${apipilotAppended ? "apipilotY" : "apipilotN"}:${apipilotBlock.length}`;
     _logOnce(key2, () => {
       console.info(
-        `[DEBUG-PROMPT][BROWSER effectiveReasoningInstructions] FULL TEXT len=%d profile=%s rag=%s:\n%s\n`,
+        `[DEBUG-PROMPT][BROWSER effectiveReasoningInstructions] FULL TEXT len=%d profile=%s rag=%s apipilot=%s:\n%s\n`,
         instructions.length,
         ctx ? `${ctx.length}c` : "none",
         ragCtx ? `${ragCtx.length}c` : "none",
+        apipilotBlock ? `${apipilotCount}tools/${apipilotBlock.length}c` : "none",
         instructions,
       );
       if (ctx) {
@@ -2196,6 +2461,53 @@ async function fetchVoceroUserProfile() {
         Object.keys(voceroUserProfile).join(","),
         extractVoceroUserName(voceroUserProfile) || "(none)",
       );
+      // ── 🚀 PREFETCH ApiPilot IMMEDIATAMENTE DOPO LOGIN-BY-PHONE RIUSCITO
+      // Forza refresh=true per bypassare la cache SERVER lato proxy S2S (TTL 300s)
+      // perché adesso abbiamo un profilo utente autenticato (non più anonimo).
+      // In questo modo vediamo la riga [apipilot] list_tools.start user=(non-anon)
+      // nel backend AquaPortal OGNI VOLTA che c'è un login phone riuscito.
+      try {
+        if (window.__s2sApipilot) {
+          const t0 = performance.now();
+          console.info(
+            "%c🔧 [APIPILOT-CLIENT] post-login phone → FORZO refresh api/apipilot/tools (bypass cache S2S 300s perché utente appena autenticato)",
+            "background:#ede9fe;color:#5b21b6;font-weight:700;padding:2px 6px;border-radius:4px;"
+          );
+          const demoToken = typeof window.__s2sDemoSessionToken === "string" ? window.__s2sDemoSessionToken : "";
+          const headers = {};
+          if (demoToken) headers["x-demo-session"] = demoToken;
+          fetch(`api/apipilot/tools?include_unauthorized=true&refresh=true&phone=${encodeURIComponent(voceroUserPhoneNumber.slice(0, 8))}`, {
+            method: "GET",
+            cache: "no-store",
+            headers,
+          }).then(async (r) => {
+            const dt = Math.round(performance.now() - t0);
+            if (!r.ok) throw new Error(`HTTP ${r.status}`);
+            const j = await r.json().catch(() => ({}));
+            const ok = j && j.success && j.data;
+            if (!ok) throw new Error(`envelope non corretto success=${Boolean(j && j.success)}`);
+            const tools = Array.isArray(j.data.tools) ? j.data.tools : [];
+            const count = typeof j.data.count === "number" ? j.data.count : tools.length;
+            const names = tools.slice(0, 6).map((t) => (typeof t.name === "string" ? t.name : "?")).join(", ");
+            // Invalida cache client WS per ogni sessione futura (in modo che
+            // al prossimo connect() venga fatto un refresh per ri-confermare).
+            try {
+              // @ts-ignore
+              if (typeof window.__s2sInvalidateApipilotCache === "function") window.__s2sInvalidateApipilotCache();
+            } catch (_) { /* noop */ }
+            console.info(
+              `%c🔧 [APIPILOT-CLIENT] post-login OK (dt=${dt}ms): N=${count} strumenti [primi 6: ${names || "(nessuno)"}]`,
+              "background:#ecfdf5;color:#047857;font-weight:700;padding:2px 6px;border-radius:4px;"
+            );
+          }).catch((err) => {
+            const dt = Math.round(performance.now() - t0);
+            console.warn(
+              `%c🔧 [APIPILOT-CLIENT] post-login FAIL (dt=${dt}ms): ${String(err instanceof Error ? err.message : err)} → controlla [APIPILOT-DISCOVERY] nel log server S2S`,
+              "background:#fffbeb;color:#92400e;font-weight:700;padding:2px 6px;border-radius:4px;"
+            );
+          });
+        }
+      } catch (_) { /* fire-and-forget silently swallow */ }
     } else {
       console.info(
         `[INJECT-PROFILE] ⏭️  BROWSER fetchVoceroUserProfile HTTP 200 but empty/non-object JSON. profileIsNull=%s keys=none`,
@@ -2306,10 +2618,49 @@ async function fetchConfig() {
       pinnedPrompt = (json.primaryPrompt || "").trim();
       injectProfile = !!json.injectProfile;
       debugPrompt = !!json.debugPrompt;
+      // Feature flag: ApiPilot AquaPortal bridge attivo sul server.
+      // Se true = S2S_APIPILOT_TOOLS_URL è valorizzato lato backend e
+      // gli endpoint proxy /api/apipilot/tools e /api/apipilot/execute
+      // sono disponibili per il frontend.
+      const apipilotEnabled = !!json.apipilot;
+      if (typeof window.__s2sApipilot === "undefined") {
+        try { Object.defineProperty(window, "__s2sApipilot", { value: false, writable: true, configurable: true }); }
+        catch (_) { /* noop */ }
+      }
+      window.__s2sApipilot = apipilotEnabled;
       // Bootstrap-start mode: empty on generic deploys (tap to start).
       startSessionMode = typeof json.startSessionMode === "string"
         ? json.startSessionMode.trim().toUpperCase()
         : "";
+      // Theme: "" / "dark" → native dark theme (purple orb). "white" → light
+      // Vocero app mobile theme (white bg, blue mic, chat bubbles w/ avatars).
+      const rawTheme = typeof json.theme === "string" ? json.theme.trim().toLowerCase() : "";
+      const resolvedTheme = rawTheme === "white" ? "white" : "dark";
+      s2sTheme = resolvedTheme === "white" ? "white" : "";
+      const root = document.documentElement;
+      // NOTE: always set the attribute explicitly (never remove it) so the
+      // anti-FOUC guard `html:not([data-theme]) [data-theme-only]` expires
+      // as soon as the config round-trip completes (before it, both white &
+      // dark parallel UI blocks are kept invisible → no flash of purple orb
+      // fading into blue mic on S2S_THEME=white deploys).
+      root.setAttribute("data-theme", resolvedTheme);
+      // ── Anti-FOUC veil LIFT (user fix 2026-09-10 purple flash on refresh)
+      // The inline <style id="s2s-anti-fouc-veil"> in <head> keeps <body>
+      // completely unpainted until BOTH:
+      //   a) data-theme attribute exists on <html>   ← line ↑ above
+      //   b) class="theme-ready" exists on <html>    ← line ↓ below
+      // Two-signal guard avoids 1-frame paint leaks where some browsers
+      // (WebKit especially) commit the attribute mutation a few microtasks
+      // before the style cascade re-evaluates against it. Also clear the
+      // 2500ms fail-safe timeout so it doesn't fire 2.4s later for no
+      // reason on a perfectly healthy config round-trip.
+      try {
+        root.classList.add("theme-ready");
+        if (typeof window.__s2sVeilLiftTimeout === "number") {
+          window.clearTimeout(window.__s2sVeilLiftTimeout);
+          window.__s2sVeilLiftTimeout = null;
+        }
+      } catch (_) { /* classList.add on unknown element — defensive only */ }
       // #region debug-point B:config-loaded
       reportDebug("B", "main.js:fetchConfig", "loaded config from api/config", {
         reasoningType,
@@ -2317,8 +2668,46 @@ async function fetchConfig() {
         injectProfile,
         debugPrompt,
         startSessionMode,
+        theme: s2sTheme || "dark",
+        apipilotEnabled,
       });
       // #endregion
+      // ── Demo call ApiPilot (fire-and-forget, solo se flag=true sul server)
+      // Serve ESCLUSIVAMENTE per attivare il tracer fetch lato browser e
+      // mostrare in console la riga [FETCH:APIPILOT:TOOLS] con preview
+      // status, durata e lista strumenti. Proxy server-side verso
+      // S2S_APIPILOT_TOOLS_URL/tools.
+      if (apipilotEnabled) {
+        try {
+          const demoUrl = "api/apipilot/tools?include_unauthorized=true";
+          console.info(
+            "%c🔧 [APIPILOT-CLIENT] flag=true → DEMO CALL %s (tracer sempre-attivo logga [FETCH:APIPILOT:TOOLS] sotto)",
+            "background:#e0e7ff;color:#3730a3;font-weight:700;padding:2px 6px;border-radius:4px;",
+            demoUrl
+          );
+          fetch(demoUrl, { method: "GET", cache: "no-store" })
+            .then(async (r) => {
+              if (!r.ok) throw new Error(`HTTP ${r.status}`);
+              const j = await r.json().catch(() => ({}));
+              const tools = (j && j.data && Array.isArray(j.data.tools)) ? j.data.tools : [];
+              const count = (j && j.data && typeof j.data.count === "number") ? j.data.count : tools.length;
+              const names = tools.slice(0, 5).map((t) => (typeof t.name === "string" ? t.name : "?")).join(", ");
+              console.info(
+                "%c🔧 [APIPILOT-CLIENT] demo OK: %s strumenti  [primi 5: %s]   usa POST api/apipilot/execute {name,arguments} per eseguire",
+                "background:#ecfdf5;color:#047857;font-weight:700;padding:2px 6px;border-radius:4px;",
+                count,
+                names || "(nessuno)"
+              );
+            })
+            .catch((err) => {
+              console.warn(
+                "%c🔧 [APIPILOT-CLIENT] demo FAIL: %s. Lato server logga [APIPILOT-DISCOVERY] per diagnosticare",
+                "background:#fffbeb;color:#92400e;font-weight:700;padding:2px 6px;border-radius:4px;",
+                String(err)
+              );
+            });
+        } catch (_) { /* fire-and-forget: silently swallow */ }
+      }
       // The conversation-time limiter rides on the LB being present.
       limiterOn = lbMode;
     }
@@ -2326,11 +2715,221 @@ async function fetchConfig() {
   } catch {
     // Config endpoint unreachable (e.g. static hosting): keep direct entry.
   }
+  // ── Anti-FOUC veil LIFT (catch-all): also lift when fetchConfig took a
+  //    non-OK / exception path so the user is never left on an invisible
+  //    <body> if the api/config response was malformed or 500'd. Only runs
+  //    the first time (theme-ready is idempotent). Also clears the fail-safe
+  //    timeout (if still set) the same way the happy-path did above.
+  try {
+    const root = document.documentElement;
+    if (!root.hasAttribute("data-theme")) root.setAttribute("data-theme", "dark");
+    if (!root.classList.contains("theme-ready")) root.classList.add("theme-ready");
+    if (typeof window.__s2sVeilLiftTimeout === "number") {
+      window.clearTimeout(window.__s2sVeilLiftTimeout);
+      window.__s2sVeilLiftTimeout = null;
+    }
+  } catch (_) { /* defensive no-op */ }
   if (DEBUG) console.debug(`[ui] config: allowDirect=${allowDirect} lbMode=${lbMode}`);
   // Login chip + remaining-budget (no-op / hidden when the limiter is off).
   void account.refresh();
   syncToolsUi();
   syncConnectionUi();
+  // Apply theme runtime: show/hide theme-only elements, wire up white-mic
+  // button forwarders, unhide chat-form in white theme, etc. Must run after
+  // `s2sTheme` is set and the data-theme attr has been applied to html.
+  _applyThemeRuntime();
+}
+
+/**
+ * Spanish (Castilian) label map for the "Escuchando..." status caption below
+ * the white-theme blue mic circle. Mirrors every client state.
+ */
+const WHITE_STATUS_LABELS = Object.freeze({
+  idle:       "Toca para empezar",
+  connecting: "Conectando…",
+  queued:     "En cola…",
+  "your-turn":"Escuchando…",
+  processing: "Pensando…",
+  "ai-speaking":"Hablando…",
+  error:      "Algo salió mal",
+  stopped:    "Detenido",
+});
+
+let _themeRuntimeInitialized = false;
+
+/**
+ * Apply runtime wiring for the current theme:
+ *   1. Flip [hidden] on every [data-theme-only="white" / "dark"] element in
+ *      the document so the correct parallel UI is shown.
+ *   2. Remove the hardcoded `hidden + display:none !important` on #chat-form
+ *      in white theme (we want the text input + send button visible, just
+ *      like the screenshot input bar).
+ *   3. Click forwarders: #white-mic-circle → real #main-circle,
+ *      #white-stop-btn → real #stop-btn.
+ *   4. MutationObserver on #main-circle `.className` to mirror every
+ *      `state-*` class live to #white-mic-circle so it swaps its visuals
+ *      (mic icon / stop icon / spinner) exactly in sync with the orb.
+ *   5. Wrap `setCaption()` so the Spanish label `#white-mic-caption` gets
+ *      updated at the same time as the default orb caption.
+ *   6. Quick action button listeners: populate chat-input / or send via
+ *      client.sendUserText() when a session is live.
+ * Called by fetchConfig() AFTER s2sTheme and <html data-theme> are set.
+ * Re-runs safely on every config fetch (guard `_themeRuntimeInitialized` for
+ * the one-shot observer / listeners).
+ */
+function _applyThemeRuntime() {
+  const isWhite = s2sTheme === "white";
+
+  // 1. Toggle visibility of every element tagged data-theme-only.
+  //    Elements with `hidden` and `[data-theme-only="white"]` should be
+  //    UN-hidden when theme === white; `hidden + dark-only` → UN-hidden when
+  //    theme !== white (native dark). Any element not tagged is unchanged.
+  const onlyWhite = document.querySelectorAll("[data-theme-only=\"white\"]");
+  onlyWhite.forEach(el => {
+    if (isWhite) {
+      el.removeAttribute("hidden");
+      if (el.style && el.style.display === "none") el.style.display = "";
+    } else {
+      el.setAttribute("hidden", "");
+    }
+  });
+  const onlyDark = document.querySelectorAll("[data-theme-only=\"dark\"]");
+  onlyDark.forEach(el => {
+    if (isWhite) {
+      el.setAttribute("hidden", "");
+    } else {
+      el.removeAttribute("hidden");
+      if (el.style && el.style.display === "none") el.style.display = "";
+    }
+  });
+
+  // 2. Chat form input: in WHITE theme, we need the text input visible to
+  //    match the screenshot. The HTML ships with `hidden` + inline
+  //    `display:none !important` because the original dark theme hid it
+  //    (per user request 2026-09-04). Clear both here, restore when leaving.
+  const chatForm = document.getElementById("chat-form");
+  if (chatForm) {
+    if (isWhite) {
+      chatForm.removeAttribute("hidden");
+      chatForm.style.removeProperty("display");
+    } else if (!chatForm.hasAttribute("hidden")) {
+      // Reapply original dark-theme defaults (preserve existing user edit).
+      chatForm.setAttribute("hidden", "");
+      chatForm.style.setProperty("display", "none", "important");
+    }
+  }
+
+  // One-shot wiring (never re-add listeners/observer on subsequent calls).
+  if (_themeRuntimeInitialized) return;
+  _themeRuntimeInitialized = true;
+
+  // 3a. Click forwarder: white mic circle → the real start/stop orb handler.
+  const whiteMic = document.getElementById("white-mic-circle");
+  const realCircle = document.getElementById("main-circle");
+  if (whiteMic && realCircle) {
+    whiteMic.addEventListener("click", (ev) => {
+      ev.preventDefault();
+      ev.stopPropagation();
+      realCircle.dispatchEvent(new MouseEvent("click", { bubbles: true, cancelable: true }));
+    });
+  }
+
+  // 3b. Click forwarder: white "Detener" pill → hidden real stop side-btn.
+  const whiteStop = document.getElementById("white-stop-btn");
+  const realStop = document.getElementById("stop-btn");
+  if (whiteStop && realStop) {
+    whiteStop.addEventListener("click", (ev) => {
+      ev.preventDefault();
+      ev.stopPropagation();
+      realStop.dispatchEvent(new MouseEvent("click", { bubbles: true, cancelable: true }));
+    });
+  }
+
+  // 4. Live sync of #main-circle className → #white-mic-circle className
+  //    (states: .state-idle, .state-connecting, .state-your-turn, .state-processing,
+  //     .state-ai-speaking, .state-error, .state-queued). White-mic styles
+  //     use these same state-* classes (CSS prefixes with .white-mic-circle.state-*)
+  //    so we simply shadow every class on the orb button to the new button.
+  if (whiteMic && realCircle && typeof MutationObserver !== "undefined") {
+    const syncStateClasses = () => {
+      // Keep the base class + data-theme-only marker but clear/re-add the rest.
+      const tokens = Array.from(realCircle.classList);
+      for (const cl of Array.from(whiteMic.classList)) {
+        if (cl.startsWith("state-")) whiteMic.classList.remove(cl);
+      }
+      for (const cl of tokens) {
+        if (cl.startsWith("state-")) whiteMic.classList.add(cl);
+      }
+      // Also show/hide the white stop pill in sync with the real stop-btn
+      // (which is shown when connected).
+      if (whiteStop) {
+        const visible = !realStop.hasAttribute("aria-hidden") || realStop.getAttribute("aria-hidden") === "false";
+        if (visible) {
+          whiteStop.style.removeProperty("display");
+          whiteStop.removeAttribute("hidden");
+        } else {
+          whiteStop.setAttribute("hidden", "");
+        }
+      }
+    };
+    syncStateClasses();
+    const obs = new MutationObserver(() => syncStateClasses());
+    obs.observe(realCircle, { attributes: true, attributeFilter: ["class", "aria-hidden"] });
+    if (realStop) obs.observe(realStop,  { attributes: true, attributeFilter: ["aria-hidden", "class"] });
+
+    // 5. Set the initial Spanish caption for theme=white + wrap setCaption()
+    //    so any future setCaption() call also updates the Spanish label.
+    const capWhite = document.getElementById("white-mic-caption");
+    if (capWhite) {
+      capWhite.textContent = WHITE_STATUS_LABELS[currentState] || WHITE_STATUS_LABELS.idle;
+      const origSetCaption = setCaption;
+      // Re-assign the global (window / module scope var holds function ref) so
+      // each caller of setCaption(text, kind) now also drives the Spanish label.
+      // We intentionally DON'T replace the signature — old code keeps working.
+      (function (prev) {
+        window.setCaption = function (text, kind) {
+          prev(text, kind);
+          // When in white theme we prefer the Spanish state-based label from
+          // WHITE_STATUS_LABELS whenever possible, falling back to raw text.
+          if (s2sTheme === "white" && capWhite) {
+            const fromState = WHITE_STATUS_LABELS[currentState];
+            capWhite.textContent = fromState || text || WHITE_STATUS_LABELS.idle;
+            const muted = kind === "muted";
+            capWhite.classList.toggle("muted", !!muted);
+            capWhite.classList.toggle("error", kind === "error");
+          }
+        };
+      })(origSetCaption);
+    }
+  }
+
+  // 6. Quick action buttons: clicking "Resumen" / "Consultar datos" /
+  //    "Crear respuesta" populates the text input or — if a realtime
+  //    session is live — sends it as user text straight away.
+  document.querySelectorAll(".quick-action-btn").forEach(btn => {
+    btn.addEventListener("click", () => {
+      const action = btn.getAttribute("data-action") || "";
+      const prompts = {
+        "resumen":          "haz un resumen ejecutivo del último informe programado",
+        "consultar-datos":  "consulto los datos más recientes del dashboard, dame las cifras clave",
+        "crear-respuesta":  "redacta un borrador de respuesta profesional con tono ejecutivo",
+      };
+      const text = prompts[action] || "";
+      if (!text) return;
+      if (client && typeof client.sendUserText === "function") {
+        // Live session: send directly as if the user typed + pressed enter.
+        client.sendUserText(text);
+      } else {
+        // No session: prefill the text input so they can send manually later.
+        const inp = document.getElementById("chat-input");
+        if (inp) {
+          inp.value = text;
+          inp.dispatchEvent(new Event("input", { bubbles: true }));
+          inp.focus({ preventScroll: false });
+        }
+      }
+    });
+  });
 }
 
 /**
diff --git a/s2s-client/server.py b/s2s-client/server.py
index 8e4ca15..410830e 100644
--- a/s2s-client/server.py
+++ b/s2s-client/server.py
@@ -39,9 +39,11 @@ instead of a grant; the browser polls /api/queue/{id} until it reaches the front
 and a slot frees. Waiting reserves nothing — the daily budget is only reserved at
 the moment a slot is actually claimed (a grant), never while queued.
 """
+from __future__ import annotations
 
 import asyncio
 from datetime import datetime, timezone
+import datetime as _dt_module
 import json
 import logging
 import os
@@ -123,6 +125,19 @@ S2S_INJECT_PROFILE = (
 # and expects JSON back (optionally wrapped as {"result": <value>}). Empty
 # string means the feature is off (no network call, nothing injected).
 S2S_LATEST_SUMMARY = (os.environ.get("S2S_LATEST_SUMMARY", "") or "").strip()
+# Static / hardcoded latest-summary text. When set (non-empty string), it takes
+# PRIORITY over S2S_LATEST_SUMMARY: the proxy SKIPS the HTTP fetch entirely and
+# injects this raw plain-text value directly into the prompt as the latest
+# conversation summary. Designed for cases where the operator wants a clean,
+# essential, pre-cleaned summary snippet without depending on an upstream API.
+# Bypasses all HTTP logic (no login-by-phone bearer forwarding, no timeout, no
+# JSON unwrapping) — the string is passed as-is to _resolve_latest_summary_context
+# (which still applies the 1600-char cap + the LATEST_SUMMARY_HINT wrapper).
+S2S_LATEST_SUMMARY_TEXT = (os.environ.get("S2S_LATEST_SUMMARY_TEXT", "") or "").strip()
+if S2S_LATEST_SUMMARY_TEXT:
+    # Interpret \n escape sequences so multi-line summaries can be written as a
+    # single env line (matches S2S_PRIMARY_PROMPT convention above).
+    S2S_LATEST_SUMMARY_TEXT = S2S_LATEST_SUMMARY_TEXT.replace("\\n", "\n")
 # Optional: login-by-phone endpoint. When set (and S2S_INJECT_PROFILE=true and
 # phoneNumber is available), before fetching user profile / latest summary the proxy
 # first performs a POST S2S_LOGIN_BY_PHONE with {"phoneNumber": "..."} JSON body,
@@ -135,6 +150,67 @@ S2S_LOGIN_BY_PHONE = (os.environ.get("S2S_LOGIN_BY_PHONE", "") or "").strip().rs
 # and injects the compiled block into the LLM instructions / user_context between
 # the caller profile block and the latest conversation summary block.
 S2S_REPORT_LIST = (os.environ.get("S2S_REPORT_LIST", "") or "").strip().rstrip("/")
+# Feature flag: when "true" (case-insensitive) => actually injects the REPORT LIST
+# contents (podcastScript) into the LLM instructions / context.  When "false" (DEFAULT)
+# the proxy NEVER injects scheduled reports into the prompt — not even the TOC — and
+# skips the upstream S2S_REPORT_LIST network call entirely, fixing the user issue:
+#   "Attualmente stai iniettando TUTTI i reports con tutto il loro podcastScript integrale."
+#
+# Historical note (2026-09-11): before this flag existed, if S2S_INJECT_PROFILE=true AND
+# S2S_REPORT_LIST was set the server eagerly fetched every scheduled report for the
+# caller, serialized all their full podcastScript fields into a single block (capped at
+# 12000 chars) and appended it to every LLM turn. That was a huge prompt-bloat injection
+# the user explicitly flagged as unwanted. The safe default is therefore DISABLED: to
+# restore mass-report-injection, operators must opt in with S2S_INJECT_REPORTS=true.
+S2S_INJECT_REPORTS = (
+    (os.environ.get("S2S_INJECT_REPORTS", "") or "").strip().lower()
+    in {"1", "true", "yes", "on"}
+)
+# Max number of scheduled reports to surface in the QUICK-HINT line block (the TOC of
+# label + date shown before the serialized JSON entries). Also applied as a hard cap to
+# the final filtered+serialized entries list — so the wrapped prompt block never carries
+# content for more than N reports, even when the upstream API returns 20+. Configurable
+# from .env; value is integer-parsed and clamped to [1, 50] (invalid values fall back to
+# the default = 5, which is the user's requested "max 3-5" default range). User request
+# 2026-09-11: "riduci il quick hint report max 3-5 configurabile da .env".
+try:
+    _S2S_REPORTS_QUICK_HINT_MAX_RAW = int((os.environ.get("S2S_REPORTS_QUICK_HINT_MAX", "") or "5").strip())
+except Exception:
+    _S2S_REPORTS_QUICK_HINT_MAX_RAW = 5
+S2S_REPORTS_QUICK_HINT_MAX = max(1, min(50, _S2S_REPORTS_QUICK_HINT_MAX_RAW))
+del _S2S_REPORTS_QUICK_HINT_MAX_RAW
+# Feature flag: when "true" → prepend a TODAY date + anti-hallucination guard to
+# every LLM prompt and session instructions. Fixes user bug 3 2026-09-11:
+#   "Qwen2.5 training cutoff ~2024 metà, vede report 2026 e impazzisce meta-commenti in cinese:
+#    'L'ora mondiale oggi è 2023, perché report nel 2026?'"
+# Default = ON (safe even when empty/unset). Explicit S2S_INJECT_TODAY="false" to disable.
+# Injected text contains:
+#   • real "La data di OGGI è: YYYY-MM-DD (ISO, server local date)
+#   • "Report con date precedenti = archivio storico → non commentare date future
+#   • Rule anti-meta-commenti: NIENTE commenti interni / prompt introspection
+#   • Rule anti-thinking-leak (GPTQ Int4 quantized): "sólo lo que dice Vocero en voz alta"
+#   • Rule RAG report: "para contenido de reportes usa RAG, no inventes con el resumen"
+S2S_INJECT_TODAY = not (
+    (os.environ.get("S2S_INJECT_TODAY", "") or "").strip().lower()
+    in {"0", "false", "no", "off"}
+)
+# Feature flag: S2S_REPORTS_INJECT_MODE controls what the server sends into the LLM
+# prompt for scheduled reports. Values (case-insensitive, default="minimal"):
+#   • "minimal"  → ONLY last N = S2S_REPORTS_QUICK_HINT_MAX items as a pure
+#                   TOC (label + date ONLY). NO podcastScript is ever exposed. This
+#                   the user's "Mantieni i report? Allora solo sommario MINIMO"
+#                   fix. Token budget: ~50 tokens instead of ~3200.
+#   • "full"     → legacy behaviour: full JSON array with podcastScript
+#                   (still capped to S2S_REPORTS_QUICK_HINT_MAX items). Used to be
+#                   the default before 2026-09-11; kept only for explicit opt-in
+#                   because of the user explicitly flagged the massive script injection
+#                   as unwanted on this session.
+#   • "off" / "none" → no reports injection at all (same as S2S_INJECT_REPORTS=false)
+#                     even when S2S_INJECT_REPORTS=true.  Use this to keep the HTTP
+#                     fetch running while keeping the prompt clean, or as a redundant kill.
+S2S_REPORTS_INJECT_MODE = (os.environ.get("S2S_REPORTS_INJECT_MODE", "") or "").strip().lower()
+if S2S_REPORTS_INJECT_MODE not in {"minimal", "full", "off", "none"}:
+    S2S_REPORTS_INJECT_MODE = "minimal"
 # Feature flag: when "true" the proxy logs the FULL PROMPT TEXT (not just
 # lengths) going to the upstream LLM/realtime backends. Includes:
 #   - WS session.update session.instructions (before/after patch)
@@ -148,12 +224,1267 @@ S2S_DEBUG_PROMPT = (
     in {"1", "true", "yes", "on"}
 )
 S2S_START_SESSION_MODE = (os.environ.get("S2S_START_SESSION_MODE", "") or "").strip().upper()
+S2S_THEME = (os.environ.get("S2S_THEME", "") or "").strip().lower()
+if S2S_THEME and S2S_THEME not in {"white", "dark"}:
+    S2S_THEME = ""
 S2S_REASONING_TYPE = _normalize_reasoning_type(os.environ.get("S2S_REASONING_TYPE", "PROXY"))
 OPENAI_API_KEY = os.environ.get("OPENAI_API_KEY", "").strip()
 OPENAI_BASE_URL = os.environ.get("OPENAI_BASE_URL", "https://api.openai.com/v1").strip().rstrip("/")
 OPENAI_REASONING_MODEL = os.environ.get("OPENAI_REASONING_MODEL", "gpt-4.1-mini").strip()
 OPENAI_ORGANIZATION = os.environ.get("OPENAI_ORGANIZATION", "").strip()
 OPENAI_PROJECT = os.environ.get("OPENAI_PROJECT", "").strip()
+# ──────────────────────────────────────────────────────────────────────────────
+# APIPILOT — Backend AquaPortal dynamic-tool bridge (GUIDA_APIPILOT_CLIENTE.md)
+# ──────────────────────────────────────────────────────────────────────────────
+# URL base per il discovery e l'esecuzione dei tool dinamici ApiPilot. Quando
+# valorizzata, il proxy effettua GET <url>/tools con include_unauthorized=true
+# (§2.1 della guida) per ottenere la lista tool e POST <url>/execute per
+# invocarne uno (§2.2). Può finire o meno con "/": il proxy normalizza
+# sempre con rstrip("/") sotto.
+#
+# ES.: S2S_APIPILOT_TOOLS_URL=https://aquachile.azurianlab.com/api/v1/apipilot
+S2S_APIPILOT_TOOLS_URL = os.environ.get("S2S_APIPILOT_TOOLS_URL", "").strip().rstrip("/")
+# Override ESPLICITO per l'URL di execute (§2.2 GUIDA_APIPILOT_CLIENTE.md).
+# Se valorizzato, ha la precedenza su S2S_APIPILOT_TOOLS_URL per le chiamate POST execute.
+# Normalizza togliendo "/" alla fine; il proxy appenderebbe "/execute" SOLO se la URL
+# non termina già con "/execute".
+# ES.1 (base): S2S_APIPILOT_TOOLS_EXECUTE_URL=https://aquachile.azurianlab.com/api/v1/apipilot
+#         → POST https://aquachile.azurianlab.com/api/v1/apipilot/execute
+# ES.2 (utente .env:45): S2S_APIPILOT_TOOLS_EXECUTE_URL=https://aquachile.azurianlab.com/api/v1/apipilot/tools
+#         → POST https://aquachile.azurianlab.com/api/v1/apipilot/tools/execute
+S2S_APIPILOT_TOOLS_EXECUTE_URL = os.environ.get("S2S_APIPILOT_TOOLS_EXECUTE_URL", "").strip().rstrip("/")
+# Bearer token fisso (opzionale) usato SOLO se il chiamante NON fornisce un
+# token di sessione (Authorization / x-demo-session). Utile in ambienti di
+# pre-produzione con token di servizio hardcoded.
+S2S_APIPILOT_SERVICE_TOKEN = os.environ.get("S2S_APIPILOT_SERVICE_TOKEN", "").strip()
+# 2026-09-25 SUPER API KEY (BYPASS AUTENTICAZIONE AQUAPORTAL TEMPORANEO).
+#    Se valorizzata: 3 forme contemporaneamente in headers per max compatibilità:
+#      1) X-API-Key: <key>
+#      2) Authorization: Bearer <key>
+#      3) x-demo-session: <key>
+#    Ha MAXIMA priorità e disabilita completamente login_by_phone (non serve).
+#    Basta vuotare la stringa per tornare al login standard.
+S2S_APIPILOT_API_KEY = os.environ.get("S2S_APIPILOT_API_KEY", "").strip().strip("\"'")
+# TTL della cache di discovery tools (in secondi). La guida dice "max ogni 5
+# minuti se tieni cache lato client"; lato server usiamo lo stesso valore per
+# default: 300 secondi = 5 minuti.
+try:
+    _APIPILOT_TTL_RAW = int((os.environ.get("S2S_APIPILOT_TTL_SEC", "") or "300").strip())
+except Exception:
+    _APIPILOT_TTL_RAW = 300
+APIPILOT_CACHE_TTL_SEC = max(15, min(3600, _APIPILOT_TTL_RAW))
+del _APIPILOT_TTL_RAW
+# Timeout HTTP per chiamate ApiPilot (discovery + execute), in secondi.
+try:
+    _APIPILOT_TO_RAW = float((os.environ.get("S2S_APIPILOT_TIMEOUT_SEC", "") or "15.0").strip())
+except Exception:
+    _APIPILOT_TO_RAW = 15.0
+APIPILOT_HTTP_TIMEOUT = max(1.0, min(120.0, _APIPILOT_TO_RAW))
+del _APIPILOT_TO_RAW
+
+# Cache in-process + lock asyncrona (uno solo refresha, gli altri leggono la
+# entry stantia). Struttura `_APIPILOT_CACHE[auth_fingerprint] = (fetched_at_monotonic, tools_list)`.
+_APIPILOT_CACHE: dict[str, tuple[float, list[dict]]] = {}
+_APIPILOT_CACHE_LOCK = asyncio.Lock()
+
+# Helper tempo monotonic per misure duration senza drift NTP.
+import time as _time_mod_gbl
+_monotonic_now: callable = _time_mod_gbl.monotonic
+del _time_mod_gbl
+
+
+def _apipilot_auth_fingerprint(auth_header: str | None, demo_session: str | None) -> str:
+    """Return a short string used as cache key scoped to the caller identity.
+
+    We don't want to share cached tool-lists across users with different auth
+    tokens (requires_auth flags can be token-dependent via /tools?include_unauthorized=true
+    because the back-end may still attach per-role metadata)."""
+    parts: list[str] = []
+    if auth_header:
+        # Don't cache the raw bearer. SHA-256 truncated 12 chars = safe fingerprint.
+        import hashlib
+        parts.append("h:" + hashlib.sha256(auth_header.encode("utf-8")).hexdigest()[:12])
+    if demo_session:
+        parts.append("d:" + demo_session)
+    return "|".join(parts) if parts else "anon"
+
+
+def _apipilot_parse_authorization(request: Request | None) -> tuple[str | None, str | None]:
+    """Extract (Authorization header value, x-demo-session header value) from a FastAPI request.
+
+    Returns a tuple of two optional strings. Both are forwarded to the upstream
+    ApiPilot backend verbatim when non-empty (see GUIDA_APIPILOT_CLIENTE.md §2.1 note).
+    """
+    if request is None:
+        return None, None
+    auth = None
+    demo = None
+    try:
+        raw_auth = request.headers.get("authorization") or request.headers.get("Authorization")
+        if isinstance(raw_auth, str) and raw_auth.strip():
+            auth = raw_auth.strip()
+        raw_demo = request.headers.get("x-demo-session") or request.headers.get("X-Demo-Session")
+        if isinstance(raw_demo, str) and raw_demo.strip():
+            demo = raw_demo.strip()
+    except Exception:
+        pass
+    return auth, demo
+
+
+def _apipilot_resolve_execute_url() -> str:
+    """Resolve the final POST URL for ApiPilot tool execution.
+
+    Priorità (§2.2 + override esplicito utente .env riga 45):
+      1. S2S_APIPILOT_TOOLS_EXECUTE_URL se valorizzato: se NON termina con
+         "/execute", appendiamo "/execute".
+      2. Fallback S2S_APIPILOT_TOOLS_URL + "/execute".
+    La funzione non può mai restituire stringa vuota: se nessuna è configurata
+    è responsabilità del caller (tipicamente _apipilot_execute_tool) tornare
+    envelope errore APIPILOT_NOT_CONFIGURED prima di arrivare qui.
+    """
+    base = S2S_APIPILOT_TOOLS_EXECUTE_URL or S2S_APIPILOT_TOOLS_URL
+    base = base.strip().rstrip("/")
+    if not base:
+        return ""
+    if base.lower().endswith("/execute"):
+        return base
+    return f"{base}/execute"
+
+
+def _apipilot_strip_tool_for_llm(tool_def: dict) -> dict:
+    """Return a tool definition that is safe for LLM function-calling providers.
+
+    §4 della guida:
+      "NON mandare direttamente l'output grezzo di /tools al modello, perché
+       contiene il campo requires_auth che non fa parte dello standard
+       function-calling e alcuni provider lo rifiutano."
+    Questa funzione è l'esatto complemento di quella regola: prende un
+    `ToolDefinition` nativo e restituisce la proiezione OpenAI-compatibile
+    `{type: "function", function: {name, description, parameters}}`.
+    """
+    if not isinstance(tool_def, dict):
+        return {}
+    name = tool_def.get("name") if isinstance(tool_def.get("name"), str) else ""
+    description = tool_def.get("description") if isinstance(tool_def.get("description"), str) else ""
+    parameters = tool_def.get("parameters")
+    if not isinstance(parameters, dict):
+        parameters = {"type": "object", "properties": {}, "required": []}
+    out: dict = {
+        "type": "function",
+        "function": {
+            "name": name,
+            "description": description,
+            "parameters": parameters,
+        },
+    }
+    return out
+
+
+async def _apipilot_fetch_tools(
+    *,
+    auth_header: str | None,
+    demo_session: str | None,
+    include_unauthorized: bool = True,
+    force_refresh: bool = False,
+    refresh: bool | None = None,
+) -> list[dict]:
+    """Fetch ApiPilot tool definitions with a short in-process TTL cache.
+
+    Implements §2.1 (GET /tools?include_unauthorized=true). The cache key is
+    scoped by caller auth fingerprint (see `_apipilot_auth_fingerprint`) so
+    per-token variations in `requires_auth` or list length don't leak between
+    identities.
+
+    Returns a list of tool definitions (parsed JSON, may be empty). Raises
+    `HTTPException` only when `S2S_APIPILOT_TOOLS_URL` is set but the backend
+    replied with a non-2xx / non-JSON response. When env is empty → returns
+    `[]` silently (passthrough).
+    """
+    # 2026-09-25 ALIAS BACKWARD: parametro `refresh` usato in WS connect L4632
+    #    (nome sbagliato) — se presente, usa force_refresh corrispondente.
+    if refresh is not None:
+        force_refresh = bool(refresh) or bool(force_refresh)
+    if not S2S_APIPILOT_TOOLS_URL:
+        return []
+    import time as _time_mod
+    # 2026-09-25 FIX FINGERPRINT CONSISTENCY: PRIMA determiniamo auth/demo EFFETTIVI
+    #    (SUPER API KEY PRIORITÀ MASSIMA), POI calcoliamo fp cache.
+    #    Altrimenti fp = anon-ws... ma headers reali = APIKEY → chiave cache sbagliata
+    #    e sessione demo session non matcha (Aquachile user_type=null → 403).
+    if S2S_APIPILOT_API_KEY:
+        final_auth = "BYPASS-API-KEY"
+        _demo_used = S2S_APIPILOT_API_KEY
+        _effective_auth_for_fp = f"Bearer {S2S_APIPILOT_API_KEY}"
+        _effective_demo_for_fp = S2S_APIPILOT_API_KEY
+    else:
+        final_auth = auth_header or (f"Bearer {S2S_APIPILOT_SERVICE_TOKEN}" if S2S_APIPILOT_SERVICE_TOKEN else None)
+        _demo_used = demo_session
+        _effective_auth_for_fp = final_auth if isinstance(final_auth, str) and final_auth.strip() else (auth_header or "")
+        _effective_demo_for_fp = _demo_used if isinstance(_demo_used, str) and _demo_used.strip() else ""
+    fp = _apipilot_auth_fingerprint(_effective_auth_for_fp, _effective_demo_for_fp)
+    now = _time_mod.monotonic()
+    cached = _APIPILOT_CACHE.get(fp)
+    if (not force_refresh) and cached and (now - cached[0]) < APIPILOT_CACHE_TTL_SEC:
+        logger.debug(
+            "[APIPILOT-DISCOVERY] cache HIT ttl=%.1fs fp=%s tools=%d",
+            APIPILOT_CACHE_TTL_SEC - (now - cached[0]), fp, len(cached[1]),
+        )
+        return cached[1]
+    # Prefer to serve stale (if any) rather than block many callers.
+    stale_tools = cached[1] if cached else None
+    async with _APIPILOT_CACHE_LOCK:
+        # Double-check after acquiring lock (another coroutine may have refreshed).
+        now2 = _time_mod.monotonic()
+        recheck = _APIPILOT_CACHE.get(fp)
+        if (not force_refresh) and recheck and (now2 - recheck[0]) < APIPILOT_CACHE_TTL_SEC:
+            return recheck[1]
+        url = f"{S2S_APIPILOT_TOOLS_URL}/tools"
+        params = {"include_unauthorized": "true" if include_unauthorized else "false"}
+        headers = {"accept": "application/json"}
+        # 2026-09-25 SUPER API KEY: MAX PRIORITY. Se valorizzata → disabilita tutti gli altri auth
+        #    e mette TUTTE e 3 le forme contemporaneamente per max compatibilità.
+        if S2S_APIPILOT_API_KEY:
+            headers["X-API-Key"] = S2S_APIPILOT_API_KEY
+            headers["Authorization"] = f"Bearer {S2S_APIPILOT_API_KEY}"
+            headers["x-demo-session"] = S2S_APIPILOT_API_KEY
+        else:
+            if final_auth:
+                headers["Authorization"] = final_auth
+            if _demo_used:
+                headers["x-demo-session"] = _demo_used
+        logger.info(
+            "[APIPILOT-DISCOVERY] → GET %s?include_unauthorized=%s fp=%s auth=%s demo=%s",
+            url, params["include_unauthorized"], fp,
+            ("APIKEY" if S2S_APIPILOT_API_KEY else ("Y" if final_auth else "-")),
+            ("APIKEY" if S2S_APIPILOT_API_KEY else ("Y" if _demo_used else "-")),
+        )
+        try:
+            async with httpx.AsyncClient(timeout=APIPILOT_HTTP_TIMEOUT, follow_redirects=True) as http:
+                resp = await http.get(url, params=params, headers=headers)
+        except Exception as exc:
+            logger.error("[APIPILOT-DISCOVERY] ✗ network error: %s", exc)
+            if stale_tools is not None:
+                logger.warning("[APIPILOT-DISCOVERY] using STALE cached fallback tools=%d", len(stale_tools))
+                return stale_tools
+            raise HTTPException(
+                status_code=502,
+                detail={"code": "APIPILOT_NETWORK_ERROR", "message": f"Error al contactar ApiPilot tools backend: {exc}"},
+            )
+        if resp.status_code >= 300:
+            logger.error("[APIPILOT-DISCOVERY] ✗ backend HTTP %s body=%s", resp.status_code, resp.text[:400])
+            if stale_tools is not None:
+                logger.warning("[APIPILOT-DISCOVERY] using STALE cached fallback tools=%d", len(stale_tools))
+                return stale_tools
+            raise HTTPException(
+                status_code=502,
+                detail={
+                    "code": "APIPILOT_BAD_UPSTREAM",
+                    "message": f"Backend ApiPilot tools devolvió HTTP {resp.status_code}",
+                    "status_code": resp.status_code,
+                },
+            )
+        try:
+            payload = resp.json()
+        except Exception:
+            logger.error("[APIPILOT-DISCOVERY] ✗ risposta non JSON: %s", resp.text[:500])
+            if stale_tools is not None:
+                return stale_tools
+            raise HTTPException(
+                status_code=502,
+                detail={"code": "APIPILOT_BAD_JSON", "message": "La risposta di ApiPilot tools non è JSON valido."},
+            )
+        # Backend might return: list OR {"result": [...]} OR {"tools": [...]} OR
+        # {"data": {"tools": [...]}}. Unwrap generic wrapper-style payloads.
+        tools: list[dict] = []
+        if isinstance(payload, list):
+            tools = [t for t in payload if isinstance(t, dict)]
+        elif isinstance(payload, dict):
+            for key in ("tools", "result", "data"):
+                cand = payload.get(key)
+                if isinstance(cand, list):
+                    tools = [t for t in cand if isinstance(t, dict)]
+                    break
+                if isinstance(cand, dict):
+                    sub = cand.get("tools") if isinstance(cand.get("tools"), list) else cand.get("result")
+                    if isinstance(sub, list):
+                        tools = [t for t in sub if isinstance(t, dict)]
+                        break
+        # Validate minimal ToolDefinition contract §2.1: name + description + parameters.
+        sanitized: list[dict] = []
+        for raw in tools:
+            name = raw.get("name")
+            if not isinstance(name, str) or not name.strip():
+                continue
+            description = raw.get("description") if isinstance(raw.get("description"), str) else ""
+            parameters = raw.get("parameters")
+            if not isinstance(parameters, dict):
+                parameters = {"type": "object", "properties": {}, "required": []}
+            requires_auth = raw.get("requires_auth", False)
+            if not isinstance(requires_auth, bool):
+                # Some backends return 0/1; normalize to bool. Guard per regola.
+                try:
+                    requires_auth = bool(int(requires_auth))
+                except Exception:
+                    requires_auth = False
+            tool_def = {
+                "name": name.strip(),
+                "description": description,
+                "parameters": parameters,
+                "requires_auth": requires_auth,
+            }
+            sanitized.append(tool_def)
+        _APIPILOT_CACHE[fp] = (now2, sanitized)
+        logger.info(
+            "[APIPILOT-DISCOVERY] ← OK tools=%s fp=%s status=%s upstreamFmt=%s cachedTools=%d",
+            len(sanitized), fp, resp.status_code,
+            "list" if isinstance(payload, list) else "object",
+            len(sanitized),
+        )
+        if S2S_DEBUG_PROMPT and sanitized:
+            logger.debug(
+                "[APIPILOT-DISCOVERY] raw first tool preview: %s",
+                json.dumps(sanitized[0], ensure_ascii=False)[:400],
+            )
+        return sanitized
+
+
+def _apipilot_validate_arguments(arguments: dict | None, tool_def: dict) -> tuple[dict, list[str]]:
+    """Validate / execute arguments strictly against the tool's JSON-Schema parameters.
+
+    Implements §2.2 PRE-CHECK #3:
+      • rimuove TUTTE le chiavi extra non in parameters.properties — MA SOLO SE
+        parameters.properties è un dict NON VUOTO.
+      • Caso speciale 2026-09-25 (OSSERVATO AquaPortal):
+        tool.get_user_briefing ha parameters.properties={} e required=[].
+        Significa "nessuno schema esplicito dichiarato / args flessibili"
+        (phone viene preso internamente al backend dal token). In questo caso
+        NON facciamo stripping di chiavi (altrimenti rimuoveremmo phone
+        indispensabile per la business logic).
+      • valorizza required (restituisce errori se mancanti)
+      • NON inventare parametri → non vengono aggiunte chiavi.
+
+    Returns `(filtered_args, list_of_validation_errors_in_spagnolo)`.
+    If the returned errors list is non-empty, MUST block the execution (see
+    the `_apipilot_execute_tool` caller).
+    """
+    errors: list[str] = []
+    schema = tool_def.get("parameters") if isinstance(tool_def.get("parameters"), dict) else {}
+    properties = schema.get("properties") if isinstance(schema.get("properties"), dict) else {}
+    required = schema.get("required") if isinstance(schema.get("required"), list) else []
+    required = [x for x in required if isinstance(x, str)]
+    args = arguments if isinstance(arguments, dict) else {}
+
+    # ── 2026-09-25 FLESSIBILITÀ SCHEMA VUOTO: se parameters non ha properties
+    #    dichiarate esplicitamente (dict vuoto) → pass-through TUTTI gli args,
+    #    nessuno stripping. Utile per AquaPortal tool tipo get_user_briefing.
+    schema_is_open: bool = (not isinstance(properties, dict)) or len(properties) == 0
+    requires_auth_flag = bool(tool_def.get("requires_auth"))
+    # 2026-09-25 TOOL AUTH-ONLY: requires_auth=true + parameters.properties vuoto
+    #    + required=[] + description contiene "Requires a valid session token"
+    #    → AquaPortal ricava TUTTI i dati utente dal bearer JWT del token.
+    #    In questo caso passiamo arguments={} (nessun parametro) per evitare
+    #    conflitti (es. phone argomento vs phone utente token) → 403.
+    auth_only_tool = False
+    if schema_is_open and requires_auth_flag and len(required) == 0:
+        _d = tool_def.get("description") if isinstance(tool_def.get("description"), str) else ""
+        if (not _d) or "valid session token" in _d.lower() or "authenticated" in _d.lower():
+            auth_only_tool = True
+    if auth_only_tool:
+        cleaned = {}
+        logger.info(
+            "[APIPILOT-VALIDATE] tool=%s richiede SOLO sessione auth (nessun parametro) → arguments forzati {} (evitiamo conflitto phone-args vs user-token)",
+            tool_def.get("name") or "?",
+        )
+    elif schema_is_open:
+        cleaned = dict(args)
+        logger.info(
+            "[APIPILOT-VALIDATE] tool=%s schema aperto (parameters.properties vuoto) → pass-through tutti gli args N=%d keys=%s",
+            tool_def.get("name") or "?",
+            len(cleaned),
+            sorted(list(cleaned.keys())),
+        )
+    else:
+        cleaned: dict = {}
+        for key in args.keys():
+            if key in properties:
+                cleaned[key] = args[key]
+            else:
+                logger.warning(
+                    "[APIPILOT-VALIDATE] tool=%s removing unknown arg=%s",
+                    tool_def.get("name") or "?", key,
+                )
+    # Required check: abilitato SOLO se lo schema NON è open (altrimenti
+    # required=[] è vacuo e non ha senso).
+    if (not schema_is_open):
+        for req in required:
+            if req not in cleaned:
+                errors.append(f"Falta el parámetro requerido: {req}")
+    return cleaned, errors
+
+
+# ---------------------------------------------------------------------------
+# APIPILOT — Integrazione nel motore di reasoning (2 passate)
+# ---------------------------------------------------------------------------
+# Marker dedup/inizio/fine usati da _classify_context_block per evitare
+# doppie injection dello stesso blocco (se client già lo invia o se dedup layer 2
+# lo trova già nel base_instructions originale).
+APIPILOT_PASS1_LIST_MARKER = "<<<APIPILOT_TOOLS_LIST_BEGIN>>>"
+APIPILOT_PASS2_RESULT_MARKER = "<<<APIPILOT_RESULT:"
+
+# Regola:
+#   PASSATA 1: iniettiamo lista {name,description,required,parameters} + regole
+#             marker nel prompt. AI deve decidere se matcha description e
+#             emettere <<<APIPILOT_CALL:NAME=nome_tool,ARGUMENTS={...}>>>.
+#   PASSATA 2: marker catturato → esegui S2S_APIPILOT_TOOLS_EXECUTE_URL via
+#              helper → prendi body text risultato → inietta nel prompt e
+#              chiedi all'AI di rielaborarlo in linguaggio naturale per
+#              raccontarlo all'utente via voce.
+# ---------------------------------------------------------------------------
+
+_APIPILOT_CALL_MARKER_RE = re.compile(
+    r"[<]{1,3}\s*APIPILOT_CALL:NAME=([A-Za-z0-9_.-]+),ARGUMENTS=(.*?)[>]{1,3}",
+    re.IGNORECASE | re.DOTALL,
+)
+# 2026-09-25: marker INVERTITO caso osservato (LLM sbaglia sintassi):
+#   >>>APIPILOT_CALL:NAME=tool,ARGUMENTS=json<<<
+_APIPILOT_CALL_MARKER_INVERTED_RE = re.compile(
+    r"[>]{1,3}\s*APIPILOT_CALL:NAME=([A-Za-z0-9_.-]+),ARGUMENTS=(.*?)[<]{1,3}",
+    re.IGNORECASE | re.DOTALL,
+)
+
+
+def _apipilot_parse_call_marker(answer_text: str, *, defaults: dict | None = None) -> tuple[str | None, dict | None]:
+    """Parse the mandatory CALL marker emitted by the LLM in passata 1.
+
+    Returns (tool_name, arguments_dict) oppure (None, None) se nessun marker.
+
+    Gestisce:
+      (1) ARGUMENTS={"key":"val"} JSON valido (formato corretto)
+      (2) ARGUMENTS={} vuoto corretto
+      (3) ARGUMENTS=  vuoto SENZA graffe (OSSERVATO oggi su WS realtime)
+      (4) args_raw tipo key=val,key2=val2 string semplice (fallback manual parse)
+      (5) FASE 2: dopo il parse, applica un dict di defaults (es. phone, episode_id)
+          riempiendo parametri required MANCANTI in args (se non sono presenti).
+    """
+    if not isinstance(answer_text, str) or not answer_text.strip():
+        logger.info("[APIPILOT-CALL-NAME] USE=PARSE_EMPTY_INPUT name=None markerFound=N")
+        return None, None
+    m = _APIPILOT_CALL_MARKER_RE.search(answer_text.strip())
+    inverted = False
+    if not m:
+        m = _APIPILOT_CALL_MARKER_INVERTED_RE.search(answer_text.strip())
+        inverted = bool(m)
+    if not m:
+        logger.info("[APIPILOT-CALL-NAME] USE=PARSE_NO_MATCH name=None markerFound=N textHead=%r", answer_text.strip()[:80])
+        return None, None
+    name_raw = m.group(1).strip()
+    args_raw = (m.group(2) if m.lastindex and m.lastindex >= 2 and isinstance(m.group(2), str) else "").strip()
+    if not name_raw:
+        logger.info("[APIPILOT-CALL-NAME] USE=PARSE_EMPTY_NAME name=None markerFound=Y argsRawHead=%r inverted=%s", args_raw[:60], ("Y" if inverted else "N"))
+        return None, None
+    logger.info("[APIPILOT-CALL-NAME] USE=PARSE_MARKER_OK name=%r argsRawLen=%d markerFound=Y inverted=%s", name_raw, len(args_raw), ("Y" if inverted else "N"))
+    args: dict = {}
+    # ── Parse args_raw a dict (varianti tollerate) ────────────────────────────
+    if args_raw == "" or args_raw in {"{}", "null", "None"}:
+        args = {}
+    else:
+        # Tenta 1: JSON standard (graffe incluse o NO)
+        _candidate = args_raw
+        try:
+            args = json.loads(_candidate)
+        except Exception:
+            try:
+                # Tenta 2: mancano graffe esterne, aggiungiamo { } attorno
+                args = json.loads("{" + _candidate + "}")
+            except Exception:
+                try:
+                    # Tenta 3: virgolette singole invece che doppie
+                    args = json.loads(_candidate.replace("'", '"'))
+                except Exception:
+                    try:
+                        # Tenta 4: { } + virgolette singole
+                        args = json.loads("{" + _candidate.replace("'", '"') + "}")
+                    except Exception:
+                        # Fallback 5 manuale: separatore = e virgole.
+                        # Es. args_raw="phone=+56,name=Mario" → dict
+                        args = {}
+                        for piece in args_raw.split(","):
+                            kv = piece.strip()
+                            if not kv or "=" not in kv:
+                                continue
+                            k, v = kv.split("=", 1)
+                            k = k.strip().strip('"').strip("'")
+                            v = v.strip().strip('"').strip("'")
+                            if k:
+                                args[k] = v
+    if not isinstance(args, dict):
+        args = {}
+    # ── FASE 2: auto-fill defaults (phone, etc.) per parametri mancanti ──────
+    if isinstance(defaults, dict) and defaults:
+        for dk, dv in defaults.items():
+            if dk not in args or args[dk] in (None, "", []):
+                if dv not in (None, "", []):
+                    args[dk] = dv
+    logger.info("[APIPILOT-CALL-NAME] USE=PARSE_RETURN_FINAL name=%r finalArgsKeys=%s defaultsApplied=%s", name_raw, sorted(list(args.keys())), ("Y" if isinstance(defaults, dict) and defaults else "N"))
+    return name_raw, args
+
+
+def _resolve_apipilot_reasoning_context_block(
+    tools_list: list[dict] | None,
+    *,
+    call_result: dict | None = None,
+    context_defaults: dict | None = None,
+) -> str:
+    """Build the ApiPilot context block for the reasoning prompt.
+
+    Quando call_result=None → PASSATA 1: emetti la lista strumenti + la regola
+    sintattica del marker che l'AI deve emettere quando description matcha.
+
+    Quando call_result={'name':str, 'text':str, 'error':bool} → PASSATA 2:
+    inietta il risultato testuale ottenuto da execute e chiedi all'AI di
+    rielaborarlo per l'utente finale (voce / testo).
+
+    Parametro NUOVO 2026-09-25 context_defaults (dict opzionale):
+      per PASSATA 1 se non-None aggiunge una sezione "VALORES POR DEFECTO
+      CONOCIDOS" per dire all'AI "quando lo strumento richiede 'phone' usa
+      esattamente questo valore già disponibile (non inventarlo)."
+      Tipicamente contiene {"phone": "+56..."} da inject_phone del caller.
+    """
+    # ── PASSATA 2: Risultato strumento già iniettato ─────────────────────────
+    if isinstance(call_result, dict) and call_result.get("name"):
+        name = call_result.get("name") or "?"
+        text = (call_result.get("text") if isinstance(call_result.get("text"), str) else "") or ""
+        is_err = bool(call_result.get("error"))
+        status_label = "ERROR" if is_err else "OK"
+        title = f"<<<APIPILOT_RESULT:STATUS={status_label},NAME={name}>>>"
+        trailer = (
+            "Ahora debes reinterpretar EL TEXTO RESULTADO (arriba) en lenguaje natural claro "
+            "y conciso, exclusivamente en el idioma del usuario (language field). "
+            "No menciones la herramienta internamente ni detalles técnicos. "
+            "Responde SOLAMENTE con el contenido final que le quieres transmitir al usuario."
+        )
+        return (
+            f"{APIPILOT_PASS2_RESULT_MARKER}PASS2>>>\n"
+            "### Resultado de la herramienta ApiPilot invocada\n"
+            f"{title}\n"
+            f"\n```tool-output\n"
+            f"{text.rstrip() if text.strip() else '(salida vacía)'}\n"
+            f"```\n\n"
+            f"{trailer}\n"
+        )
+    # ── PASSATA 1: Lista strumenti disponibili + regola marker ───────────────
+    tools = tools_list if isinstance(tools_list, list) else []
+    # Cap: max 100 strumenti (anche se la guida ne dichiara max 50 in demo)
+    tools_cap = tools[:100]
+    if not tools_cap:
+        return ""
+    entries: list[str] = []
+    for t in tools_cap:
+        if not isinstance(t, dict):
+            continue
+        name = t.get("name") if isinstance(t.get("name"), str) else ""
+        if not name:
+            continue
+        desc = t.get("description") if isinstance(t.get("description"), str) else ""
+        params = t.get("parameters") if isinstance(t.get("parameters"), dict) else None
+        requires_auth = bool(t.get("requires_auth"))
+        required_fields: list[str] = []
+        if isinstance(params, dict) and isinstance(params.get("required"), list):
+            required_fields = [str(x) for x in params.get("required") if isinstance(x, str)]
+        # Truncate description a ~500 chars per evitare injection enorme di token
+        desc_cut = desc[:500].rstrip()
+        if len(desc) > 500:
+            desc_cut += "…"
+        snippet = f"- name: {name}\n  requires_auth: {('true' if requires_auth else 'false')}"
+        if required_fields:
+            snippet += f"\n  required_parameters: [{', '.join(required_fields[:40])}]"
+        if desc_cut:
+            snippet += f"\n  description: {desc_cut}"
+        entries.append(snippet)
+    if not entries:
+        return ""
+    rule = (
+        f"{APIPILOT_PASS1_LIST_MARKER}\n"
+        "### Herramientas dinámicas disponibles (ApiPilot AquaPortal)\n"
+        "\n"
+        "Cada herramienta tiene un campo `name` (identificador único, NO lo modifiques, "
+        "NO camelCase, NO traducir) y un campo `description` que describe el caso de uso.\n"
+        "\n"
+        "REGLAS EJECUCIÓN OBLIGATORIAS:\n"
+        "1. Si la petición DEL USUARIO (transcript) coincide claramente con la `description` "
+        "de EXACTAMENTE una (1) herramienta de la lista inferior → DEBES emitir EXCLUSIVAMENTE "
+        "una sola riga como PRIMERA línea de TU RESPUESTA, con este formato sintattico:\n"
+        "   <<<APIPILOT_CALL:NAME=nome_herramienta,ARGUMENTS={\"parametro1\":\"valor1\",\"parametro2\":\"valor2\"}>>>\n"
+        "2. La parte ARGUMENTS={…} DEBE ser JSON válido (virgolette doppie, virgole, senza "
+        "commenti). Includi SOLAMENTE i campi elencati in `required_parameters:` (se ci sono).\n"
+        "3. Subito DOPO la riga marker NON aggiungere altro testo (niente spiegazioni, "
+        "niente anticipazioni). Il motore eseguirà lo strumento e ti risomministrerà il "
+        "risultato in una seconda chiamata.\n"
+        "4. Se NESSUNA `description` corrisponde, NON emettere marker e rispondi normalmente.\n"
+        "5. Se più di una descrizione corrisponde, scegli la più specifica e usa il marker.\n"
+        "6. 🔴 MODO RISPOSTA ESCLUSIVO (priorità MASSIMA, non negoziabile): quando decidi di usare il "
+        "marker CALL, la TUA RISPOSTA INTERA DEVE ESSERE ESCLUSIVAMENTE LA RIGA DEL MARKER. "
+        "NON scrivere NIENTE PRIMA (niente 'Claro que sí', niente 'Voy a revisar', niente "
+        "'Voy a generar tu briefing', nessun saluto, nessuna frase transitoria). "
+        "NON scrivere NIENTE DOPO (nessun commento, nessuna anticipazione, nessuna spiegazione). "
+        "Una sola riga, esattamente il marker. Se scrivi altro testo oltre al marker il motore "
+        "non lo riconosce e non esegue alcuna herramienta.\n"
+        "8. Ejemplos SBAGLIATI (NON fare MAI):\n"
+        "   'Claro que sí, ahora ejecuto'\n"
+        "   'Voy a generar tu briefing ejecutivo personal.'\n"
+        "   'Claro que sí.\\n<<<APIPILOT_CALL:...>>>'\n"
+        "   '<<<APIPILOT_CALL:...>>>\\nAhora proceso el resultado.'\n"
+        "9. 🔴 REGLAS TTS ANTI-LEAK (NON negoziabili, priorità MASSIMA sul audio):\n"
+        "   Il marcador <<<APIPILOT_CALL:...>>> È UN SEGNALE INTERNO DI SISTEMA e NON DEVE MAI\n"
+        "   essere pronunciato / letto / sintetizzato dall' audio TTS. Quando emetti il marcador:\n"
+        "   - Il canale RAGIONAMENTO INTERNO (text/transcript) DEVE contenere la riga esatta del marcador.\n"
+        "   - Il canale AUDIO TTS FINALE che ascolta l'utente DEVE contenere SOLAMENTE il placeholder:\n"
+        "     \"Voy a consultar tus datos, un momento por favor.\"\n"
+        "   - NESSUNA delle parole seguenti deve MAI comparire nel TTS audio finale pronunciato:\n"
+        "     APIPILOT, CALL, ARGUMENTS, tool, herramienta, ejecutar, funzione, funzione chiamata,\n"
+        "     marcador, marker. (Nemmeno come spiegazione o descrizione della chiamata.)\n"
+        "\n"
+    )
+    # ── 2026-09-25 SECCIÓN NUEVA: VALORES POR DEFECTO CONOCIDOS ─────────────────
+    # I valori che GIA' ABBIAMO da URL o profilo (es. phoneNumber della sessione
+    # corrente) sono iniettati QUI così che quando l'AI decide di chiamare lo
+    # strumento inserisce esattamente i parametri senza lasciarli vuoti.
+    if isinstance(context_defaults, dict) and context_defaults:
+        defaults_lines = []
+        for dk, dv in context_defaults.items():
+            if dv in (None, "", []):
+                continue
+            if isinstance(dv, (dict, list)):
+                try:
+                    dv_repr = json.dumps(dv, ensure_ascii=False)
+                except Exception:
+                    dv_repr = str(dv)
+            else:
+                dv_repr = str(dv)
+            defaults_lines.append(f"- {dk} = \"{dv_repr}\"")
+        if defaults_lines:
+            rule += (
+                "VALORES POR DEFECTO CONOCIDOS (usa estos valores textualmente "
+                "en el ARGUMENTS={…} cuando la herramienta correspondiente tenga "
+                "estos nombres en required_parameters; no los inventes, no los "
+                "traduzcas, no los normalices):\n"
+                f"{chr(10).join(defaults_lines)}\n"
+                "\n"
+            )
+    rule += (
+        "Lista herramientas (name / description):\n"
+        f"{chr(10).join(entries)}\n"
+        "<<<APIPILOT_TOOLS_LIST_END>>>"
+    )
+    return rule
+
+
+def _sanitize_pass2_internal_context(text: str) -> str:
+    """Sanitize LEGGERA per blocco PASS-2 iniettato ALL'AI upstream (NON all'utente).
+
+    NON USIAMO _sanitize_text_strip_apipilot_markers perché quella cancella
+    l'intero wrapper <<<APIPILOT_RESULT:PASS2>>> tramite BLOCCO 1 FULL STRIP —
+    quello wrapper serve ALL'AI per riconoscere che sono dati della chiamata.
+
+    Qui facciamo SOLO:
+      - BLOCCO 3 PATH leak filesystem (.trae-server / workspaceStorage / paths)
+      - BLOCCO 4 FRAGMENT marker parole singole leak
+      - TIER 6 phone contextual leak (solo se riga contiene marker)
+    """
+    if not isinstance(text, str) or not text.strip():
+        return text
+    # ── BLOCCO 3 (path leaks Unix/Windows/TRAE token) ────────────────────
+    # (pattern identico a _sanitize_text_strip_apipilot_markers Blocco3)
+    import re as _re_pass2
+    text = _re_pass2.sub(r"(?i)(?:/[A-Za-z0-9_.\-@~]+){2,}/(?:\.trae[^\s\"']*|workspaceStorage[^\s\"']*|User[^\s\"']*|home[^\s\"']*)", " ", text)
+    text = _re_pass2.sub(r"(?i)(?:[A-Z]:)?[\\/](?:Users|home|root|tmp|var|mnt|opt|srv)[\\/][^\s\"']{5,}", " ", text)
+    text = _re_pass2.sub(r"(?i)(?:\.trae-server|\.trae[^\s\"']{0,40}|workspaceStorage[0-9a-f]+)", " ", text)
+    text = _re_pass2.sub(r"\s{2,}", " ", text)
+    # ── BLOCCO 4 FRAGMENT marker leak tier-4 ─────────────────────────────
+    tier4_out_parts: list[str] = []
+    for _line in text.splitlines(keepends=True):
+        _orig = _line
+        _low = _line.lower()
+        if (
+            "apipilot" in _low
+            and (
+                ("call" in _low and "name=" in _low)
+                or ("arguments=" in _low)
+                or ("result" in _low and "pass" in _low)
+            )
+        ):
+            if "<<<" in _line or ">>>" in _line:
+                _line = _re_pass2.sub(
+                    r"[<]{1,3}\s*APIPILOT_(?:CALL|RESULT)[^<>\n]{0,500}[>]{1,3}",
+                    " ", _line, flags=_re_pass2.IGNORECASE,
+                )
+            if "apipilot" in _line.lower():
+                _line = _re_pass2.sub(
+                    r"(?i)\bAPIPILOT(?:_CALL|_RESULT)?\b",
+                    " ", _line,
+                )
+                _line = _re_pass2.sub(
+                    r"(?i)\b(?:NAME|ARGUMENTS|STATUS|REV|PASS2)\s*[:=]",
+                    " ", _line,
+                )
+        tier4_out_parts.append(_line if _line.strip() else _orig)
+    text = "".join(tier4_out_parts)
+    text = _re_pass2.sub(r"\s{2,}", " ", text)
+    return text.strip() if isinstance(text, str) else text
+
+
+def _sanitize_text_strip_apipilot_markers(
+    text: str,
+    *,
+    placeholder: str | None = None,
+) -> str:
+    """Rimuovi TUTTI i marker interni di ApiPilot (PASS-1 CALL e PASS-2 RESULT)
+    dal testo che arriva all'utente finale (UI chat + audio TTS + conversation
+    item visualizzazione).
+
+    Regole stripping:
+      - MARKER CALL <<<APIPILOT_CALL:...>>> → placeholder spagnolo
+        (se l'AI emette il marker e viene mandato alla TTS per sbaglio, lo
+        mascheriamo con messaggio UI coerente).
+      - MARKER PASS-2 <<<APIPILOT_RESULT:...>>> + <<<APIPILOT_RESULT:PASS2>>>
+        + wrapper "### Resultado de la herramienta ApiPilot..."
+        + blocco ```tool-output ... ``` + re-instruction trailer finale
+        → RIMOSSI SILENZIOSAMENTE (nessun placeholder: sono segnali server
+          interni per la PASS-2 di reasoning; NON devono mai arrivare a
+          TTS/UI. Se l'AI per sbaglio li ripete nella risposta finale,
+          li cancelliamo senza lasciare traccia).
+
+    Parametri:
+      - text: la stringa da sanificare
+      - placeholder: None = default spagnolo "Voy a consultar tus datos, un momento por favor."
+        (lingua coerente con la lingua UI e vocale target)
+    """
+    if not isinstance(text, str) or not text:
+        return text
+    if placeholder is None:
+        placeholder = "Voy a consultar tus datos, un momento por favor."
+
+    # ================================================================
+    # BLOCCO 1: PASS-2 RESULT markers + wrapper (RIMOZIONE SILENZIOSA)
+    # Questi NON devono MAI finire in TTS/UI.
+    # ================================================================
+    # (1a) Blocco intero PASS-2 wrapper (order matters: blocco largo PRIMA)
+    #      Pattern: riga PASS2>>> marker + titolo MD + RESULT STATUS marker +
+    #               block ```tool-output ... ``` (multilinea DOTALL) + trailer.
+    pass2_full_block_pattern = re.compile(
+        r"[ \t]*(?:\r?\n|\r)?[ \t]*"
+        r"<<<APIPILOT_RESULT:PASS2>>>[ \t]*(?:\r?\n|\r)+"
+        r"###[ \t]+Resultado de la herramienta ApiPilot invocada[ \t]*(?:\r?\n|\r)+"
+        r"<<<APIPILOT_RESULT:STATUS=[A-Za-z_]+,NAME=[A-Za-z0-9_.-]+>>>[ \t]*(?:\r?\n|\r)*"
+        r"(?:\r?\n|\r)?"
+        r"```tool-output[ \t]*(?:\r?\n|\r)?"
+        r"(?P<tool_body>.*?)"
+        r"(?:\r?\n|\r)?```[ \t]*(?:\r?\n|\r){0,3}"
+        r"(?:"
+        r"Ahora debes reinterpretar EL TEXTO RESULTADO[\s\S]{0,1200}?"
+        r"(?:\r?\n|\r){0,2}"
+        r")?"
+        r"[ \t]*",
+        re.IGNORECASE | re.DOTALL,
+    )
+    text = pass2_full_block_pattern.sub("", text)
+
+    # (1b) Marker PASS2 standalone (se il wrapper non è completo o frammentato)
+    pass2_marker_pattern = re.compile(
+        r"[ \t]*(?:\r?\n|\r)?[ \t]*<<<APIPILOT_RESULT(?::PASS2|:STATUS=[A-Za-z_]+,NAME=[A-Za-z0-9_.-]+)?>>>[ \t]*(?:\r?\n|\r)?[ \t]*",
+        re.IGNORECASE,
+    )
+    text = pass2_marker_pattern.sub("", text)
+
+    # (1c) Titolo MD "### Resultado de la herramienta ApiPilot invocada"
+    #      residuo (se marker già stato rimosso prima)
+    pass2_title_pattern = re.compile(
+        r"[ \t]*(?:\r?\n|\r)?[ \t]*###[ \t]+Resultado de la herramienta ApiPilot invocada[ \t]*(?:\r?\n|\r)?[ \t]*",
+        re.IGNORECASE,
+    )
+    text = pass2_title_pattern.sub("", text)
+
+    # (1d) Blocco ```tool-output``` residuo standalone (senza wrapper PASS2)
+    pass2_codeblock_pattern = re.compile(
+        r"```tool-output[ \t]*(?:\r?\n|\r)?.*?(?:\r?\n|\r)?```",
+        re.IGNORECASE | re.DOTALL,
+    )
+    text = pass2_codeblock_pattern.sub("", text)
+
+    # (1e) Trailer instruction residuo standalone "Ahora debes reinterpretar..."
+    #      (intero o frammenti parziali che non hanno preso il pattern largo)
+    pass2_trailer_pattern = re.compile(
+        r"Ahora debes reinterpretar EL TEXTO RESULTADO[\s\S]{0,1200}?contenido final que le quieres transmitir al usuario\.",
+        re.IGNORECASE | re.DOTALL,
+    )
+    text = pass2_trailer_pattern.sub("", text)
+    # (1e-bis) Safety più largo: "Ahora debes reinterpretar" → qualsiasi cosa
+    # fino a fine frase "al usuario." (anche troncata nel mezzo) — questo
+    # gestisce i casi edge dove il pattern DOTALL non ha chiuso.
+    pass2_trailer_fallback = re.compile(
+        r"Ahora debes reinterpretar[\s\S]{0,1500}?(?:al usuario\.|$)",
+        re.IGNORECASE | re.DOTALL,
+    )
+    text = pass2_trailer_fallback.sub("", text)
+    # (1e-tris) Safety ancora più largo: frammento trailer tipo
+    # "en lenguaje natural claro y conciso ... contenido final al usuario"
+    # (casi in cui Ahora debes... è stato consumato fuori e rimane residuo).
+    pass2_trailer_broad = re.compile(
+        r"en lenguaje natural[\s\S]{0,800}?contenido final que le quieres transmitir al usuario\.?",
+        re.IGNORECASE | re.DOTALL,
+    )
+    text = pass2_trailer_broad.sub("", text)
+
+    # ================================================================
+    # BLOCCO 2: PASS-1 CALL marker (placeholder spagnolo, come oggi)
+    # ================================================================
+    marker_full_pattern = re.compile(
+        r"<<<APIPILOT_CALL:NAME=[A-Za-z0-9_.-]+,ARGUMENTS=.*?>>>",
+        re.IGNORECASE | re.DOTALL,
+    )
+    line_wrapped_pattern = re.compile(
+        r"[ \t]*(?:\r?\n|\r)?[ \t]*<<<APIPILOT_CALL:NAME=[A-Za-z0-9_.-]+,ARGUMENTS=.*?>>>[ \t]*(?:\r?\n|\r)?[ \t]*",
+        re.IGNORECASE | re.DOTALL,
+    )
+
+    def _replacement_full(_m: re.Match) -> str:
+        """Se l'intera riga è solo il marker → placeholder. Se inline → placeholder circondato da spazi."""
+        return placeholder
+
+    text = line_wrapped_pattern.sub(_replacement_full, text)
+    text = marker_full_pattern.sub(_replacement_full, text)
+
+    # Safety extra: marker troncato CALL tipo <<<APIPILOT_CALL:NAME=tool,ARGS… (incompleto)
+    trunc_call_pattern = re.compile(
+        r"<<<APIPILOT_CALL(?::NAME=[A-Za-z0-9_.-]+,?[^>\n]{0,500}?)?>>*",
+        re.IGNORECASE,
+    )
+    text = trunc_call_pattern.sub(_replacement_full, text)
+
+    # Safety extra: marker troncato RESULT tipo <<<APIPILOT_RESULT:... incompleto
+    #   OSS: rendiamo i caratteri `>` FINALI opzionali (+ opzionali `>` dopo)
+    #   così gestisce anche casi TTS audio troncato a metà stringa
+    #   (es. "<<<APIPILOT_RESULT:STATUS=OK,NAM" che non ha chiusura >>>)
+    trunc_result_pattern = re.compile(
+        r"<<<APIPILOT_RESULT(?::[A-Za-z0-9_=,:.\- ]{0,800}?)?>?>?>?",
+        re.IGNORECASE,
+    )
+    text = trunc_result_pattern.sub("", text)
+    # (Safety più largo: se rimane frammento APIPILOT_RESULT senza <<<
+    #  per casi TTS/sanitize frammentati, cancelliamo anche quello
+    #  MA SOLO se non è contenuto in testo normale - regex su "APIPILOT_RESULT"
+    #  sarebbe troppo aggressivo → solo con prefisso "<" o "<<<" residuo)
+    trunc_result_residual = re.compile(
+        r"<{0,3}APIPILOT_RESULT(?::[^\s<]{0,800})?<{0,3}",
+        re.IGNORECASE,
+    )
+    text = trunc_result_residual.sub("", text)
+
+    # Collapse final whitespace (non vogliamo spazi multipli / newline vuoti
+    # lasciati dalla rimozione di blocchi PASS-2)
+    text = re.sub(r"[ \t]{2,}", " ", text)
+    text = re.sub(r"\n{3,}", "\n\n", text)
+    # Safety cleanup: frammenti residuali super-comuni del trailer PASS-2
+    # tipo "(arriba)" o parentesi vuote (non hanno senso pronunciati da TTS)
+    text = re.sub(r"\s*\(arriba\)\s*", " ", text, flags=re.IGNORECASE)
+    text = re.sub(r"\(\s*\)", "", text)
+    # ================================================================
+    # BLOCCO 3: SANITIZZAZIONE PATH FILE SYSTEM (hallucination / leak TTS)
+    #   Qualsiasi path assoluto misto o Windows/Unix contenente /home,
+    #   \Users, .trae-server, workspaceStorage, .txt locale, unità C:\
+    #   NON deve MAI arrivare alla TTS (sono leak host).
+    #   Strategia: matcha path lungo 20+ chars con almeno 3 separatori.
+    # ================================================================
+    # (3a) Path Unix-like assoluti: /home/... /tmp/... /var/... /root/... /opt/...
+    #      + qualsiasi path con >2 slash consecutivi tipo .../xyz/abc/def.ext
+    unix_path_pattern = re.compile(
+        r"\b(?:/(?:home|tmp|var|root|opt|mnt|media|srv|proc|sys|etc|usr|Users|trae)[/\w@.+\-:#$%^&()[\]{}!~=,]*){2,}[A-Za-z0-9_./\-+@#$%^&()[\]{}!~=,:]*\.(?:txt|md|log|json|csv|pdf|doc|docx|py|js|ts|html|css|sh|yaml|yml|env|conf|cfg|ini|mp3|wav|ogg|png|jpg|jpeg|gif)\b"
+        r"|"
+        # Fallback larghissimo: qualsiasi path ASSOLUTO Unix (inizia con / + cartella nota)
+        # con len>=20 chars, anche senza estensione — evitiamo falsi positivi tipo "/api/v1"
+        # ma catturiamo /home/duxiter/..., /tmp/prova, /var/log/... etc.
+        r"(?:^|\s+|\(|[,.;:!?])(/(?:home|tmp|var|root|opt|mnt|media|srv|proc|sys|etc|usr|Users|trae)[/A-Za-z0-9_\-+@#$%^&()[\]{}!~=,.]{10,})(?=$|\s|\)|[,.;:!?])",
+        re.IGNORECASE,
+    )
+    text = unix_path_pattern.sub("", text)
+    # (3b) Path Windows-like con backslash singoli o doppi: \Users\...  C:\...
+    #      e misti come /home\duxiter\.trae-server\... (hallucination mix)
+    win_path_pattern = re.compile(
+        r"(?:^|\s|\(|[,.;:])"
+        r"([A-Za-z]:[\\/]"
+        r"|(?:[\\/]{1,2}(?:home|Users|Windows|Program|Program\sFiles|ProgramData|Users|trae|AppData)[\\/])"
+        r"|(?:[\\/]{1,2}\.(?:trae|trae-server|vscode|config|cache)[\\/])"
+        r")"
+        r"[A-Za-z0-9_@.+\-:#$%^&()[\]{}!~=,\\/\s]{10,}"
+        r"(?:\.(?:txt|md|log|json|csv|pdf|doc|docx|py|js|ts|html|css|sh|yaml|yml|env|conf|cfg|ini|mp3|wav|ogg|png|jpg|jpeg|gif))?"
+        r"(?=$|\s|\)|[,.;:!?])",
+        re.IGNORECASE,
+    )
+    text = win_path_pattern.sub("", text)
+    # (3c) Hallucination folder markers specifici di TRAE (se arrivano frammenti
+    #      senza path completo, rimuoviamo anche i token chiave)
+    trae_leak_tokens = re.compile(
+        r"\b(?:workspaceStorage|long-text|\.trae-server|\.trae|ckg_server|ai-agent)\b[^\s()'\"`,.]{0,80}",
+        re.IGNORECASE,
+    )
+    text = trae_leak_tokens.sub("", text)
+    # (3d) Safety: qualsiasi token lungo > 80 chars che contenga BOTH (/) e (\)
+    #      o più di 5 slash/backslash ravvicinati → 100% path leak → rimuovi
+    mixed_path_pattern = re.compile(
+        r"(?=\S{0,200})"
+        r"(?=\S*(?:[/\\].*){5,})"
+        r"(?:\S{10,})",
+        re.IGNORECASE,
+    )
+    def _mixed_safe(m):
+        s = m.group(0)
+        has_slash = "/" in s
+        has_back = "\\" in s
+        if (has_slash and has_back) or s.count("/") + s.count("\\") >= 6:
+            return ""
+        return s
+    text = mixed_path_pattern.sub(_mixed_safe, text)
+    # ================================================================
+    # BLOCCO 4: SANITIZZAZIONE FRAGMENT-BASED APIPILOT CALL (anti-TTS leak)
+    #   Quando il pipeline upstream (start_pipeline_rag / Qwen3-TTS)
+    #   normalizza il marker RIMUOVENDO <<< >>>, il TTS pronuncia letteralmente:
+    #   "APIPILOT CALL name get_user_briefing arguments phone +56912345678"
+    #   Questi pattern NON sono più catturati dai marker <<<...>>> del Blocco 2.
+    #   Quindi catturiamo FRAMMENTI con regole di contesto, 5 tier fallback.
+    # ================================================================
+    # Tier 1 - Forma normalizzata completa (senza graffe):
+    #   APIPILOT CALL name <toolname> arguments <qualsiasi cosa fino a end-frases>
+    call_normalized_full = re.compile(
+        r"(?:^|\s+|\(|[,.;:!?\"\'])\s*"
+        r"(?:"
+        r"APIPILOT[\s_\-]+CALL\s+(?:marker\s+)?(?:de\s+)?(?:señal\s+)?(?:herramienta\s+)?(?:funci[oó]n\s+)?"
+        r"|marcador\s+APIPILOT(?:\s+CALL)?\s*"
+        r"|señal\s+de\s+llamada\s+APIPILOT\s*"
+        r"|llamada\s+(?:a\s+)?(?:la\s+)?(?:herramienta|funci[oó]n)\s+APIPILOT\s*"
+        r")"
+        r"(?:\s*(?:con\s+)?(?:identificador|ID|name|nombre)\s*[:=]?\s*[A-Za-z0-9_.-]+)?"
+        r"(?:\s*(?:y\s+)?(?:con\s+)?(?:argumentos|ARGUMENTS|params|par[áa]metros)\s*[:=]?\s*(?:\{[^{}]{0,800}\}|[\"'][^\"']{0,200}[\"']|[^\s.!,?;]{3,100}(?:\s*[,:]\s*[^\s.!,?;]{3,100})*\s*)?)?"
+        r"(?:\s*(?:phone|tel[ée]fono|correo|email)\s*[:=]?\s*[+0-9A-Za-z._@\-]{6,50})?"
+        r"(?=$|\s+|\)|[,.;:!?\"\'])",
+        re.IGNORECASE,
+    )
+    text = call_normalized_full.sub(placeholder, text)
+    # Tier 2 - Forme abbreviate (qualsiasi contesto con token APIPILOT_CALL o APIPILOT + CALL vicini)
+    apipilot_call_token = re.compile(
+        r"(?:^|\s|\(|[,.;:!?\"\'])\s*"
+        r"APIPILOT(?:[\s_\-]+CALL|_CALL|\s+llamada|\s+marker)"
+        r"(?:[^.!,?;\n]{0,600})?"
+        r"(?=$|\s|\)|[,.;:!?\"\'])",
+        re.IGNORECASE,
+    )
+    text = apipilot_call_token.sub(placeholder, text)
+    # Tier 3 - Singoli token di servizio che non devono MAI comparire soli in
+    #   output assistant (se lo fanno → 99% leak marker normalizzato):
+    #   ARGUMENTS=... o APIPILOT solitario in contesto "call / name / argument"
+    service_token_context = re.compile(
+        r"(?:"
+        r"ARGUMENTS\s*[:=]\s*(?:\{[^{}]{0,800}\}|[^\s,.;!?]{3,100})"
+        r"|\barguments\s+(?:de\s+)?(?:la\s+)?(?:llamada|herramienta|funci[oó]n)\b[^\n.]{0,200}"
+        r")",
+        re.IGNORECASE,
+    )
+    text = service_token_context.sub("", text)
+    # Tier 4 - Safety catch-all: se dopo i blocchi 1/2/3/4 rimane la
+    #   sequenza "APIPILOT" (non APIClient o simili) in un contesto che ha
+    #   "name", "arguments", "tool", "herramienta", "phone", "+56" o "+44"
+    #   nella stessa frase → rimuoviamo l'intera frase.
+    def _apipilot_frase(m):
+        frase = m.group(0)
+        lowered = frase.lower()
+        # Se già contiene il placeholder spagnolo di sanitize CALL → Tier1/2/5
+        # hanno già sostituito il marker. Non cancellare la frase intera
+        # (altrimenti perdiamo testo naturale "prima/dopo" attorno).
+        if "voy a consultar tus datos" in lowered:
+            return frase
+        ctx_kw = ("name", "argument", "arg", "herramienta", "tool",
+                  "funci", "phone", "tel", "+56", "+44", "marker",
+                  "call", "llamada", "señal", "marcador")
+        if any(k in lowered for k in ctx_kw) and "apipilot" in lowered:
+            return ""
+        return frase
+    catchall_frase = re.compile(
+        r"[^.?!;\n]{0,600}APIPILOT[^.?!;\n]{0,600}[.?!;\n]{0,1}",
+        re.IGNORECASE,
+    )
+    text = catchall_frase.sub(_apipilot_frase, text)
+    # Tier 5 - Safety ultimo: se rimane "APIPILOT CALL" o "APIPILOT_CALL"
+    #   anche senza contesto → placeholder (non si pronuncia mai)
+    final_apipilot_leak = re.compile(
+        r"\bAPIPILOT[\s_\-]+CALL\b|\bAPIPILOT_CALL\b",
+        re.IGNORECASE,
+    )
+    text = final_apipilot_leak.sub(placeholder, text)
+    # Tier 6 - Phone blacklist safety (placeholder fake e/o phone reale leaks):
+    #   Quando APIPILOT CALL viene catturato ma la parte "phone" e'
+    #   residua, rimuoviamo i numeri di telefono finti/placeholder che
+    #   NON devono mai comparire in TTS (sono interni al motore).
+    #   N.B. Le regex matchano SIA forma compatta (+56912345678) SIA spaziata
+    #   (+56 9 1 2 3 4 5 6 7 8) per tolleranza alla normalizzazione TTS.
+    fake_phone_pattern = re.compile(
+        r"("
+        # Forme COMPATTE (nessuno spazio):
+        r"\+56912345678"
+        r"|\+1234567890"
+        r"|\+447432477433"
+        r"|56912345678"
+        r"|1234567890"
+        r"|447432477433"
+        # Forme SPAZIATE / CON SEGNI:
+        r"|\+?\s*56\s*[\s\-()]?9\s*[\s\-()]?1\s*[\s\-()]?2\s*[\s\-()]?3\s*[\s\-()]?4\s*[\s\-()]?5\s*[\s\-()]?6\s*[\s\-()]?7\s*[\s\-()]?8"
+        r"|\+?\s*1\s*[\s\-()]?2\s*[\s\-()]?3\s*[\s\-()]?4\s*[\s\-()]?5\s*[\s\-()]?6\s*[\s\-()]?7\s*[\s\-()]?8\s*[\s\-()]?9\s*[\s\-()]?0"
+        r"|\+?\s*44\s*[\s\-()]?7\s*[\s\-()]?4\s*[\s\-()]?3\s*[\s\-()]?2\s*[\s\-()]?4\s*[\s\-()]?7\s*[\s\-()]?7\s*[\s\-()]?4\s*[\s\-()]?3\s*[\s\-()]?3"
+        # Forme GENERICHE con etichetta (phone/teléfono):
+        r"|phone\s*[:=]\s*[+()\-\s]*[0-9][+()\-\s0-9]{6,}"
+        r"|tel(?:éfono|efono)?\s*[:=]\s*[+()\-\s]*[0-9][+()\-\s0-9]{6,}"
+        r")",
+        re.IGNORECASE,
+    )
+    # Applichiamo lo strip SOLO se nella frase (stessa riga / stessa frase)
+    # e' presente "APIPILOT", "CALL", "ARGUMENTS", "marker", "herramienta",
+    # "función", "ejecutar", "llamada", "marcador", "señal"
+    # OPPURE se c'e' il placeholder spagnolo (Voy a consultar tus datos...)
+    # perche' vuol dire che abbiamo appena sostituito un marker CALL in
+    # questa stessa frase, quindi il phone residuo appartiene a quel contesto.
+    lines = text.splitlines(keepends=True)
+    _phone_ctx = ("apipilot", "call", "arguments", "marker", "herramienta",
+                  "funcion", "función", "ejecutar", "llamada", "marcador",
+                  "señal", "voy a consultar tus datos")
+    def _phone_line_safe(line: str) -> str:
+        lowered = line.lower()
+        has_ctx = any(c in lowered for c in _phone_ctx)
+        if has_ctx:
+            # Remove phone numbers in this line (strip also surrounding space)
+            return fake_phone_pattern.sub(" ", line)
+        return line
+    text = "".join(_phone_line_safe(l) for l in lines)
+    # Collapse whitespace finale (dopo strip di marker/path si creano buchi)
+    text = re.sub(r"[ \t]{2,}", " ", text)
+    text = re.sub(r"\n{3,}", "\n\n", text)
+    return text.strip()
+
+
+async def _apipilot_execute_tool(
+    *,
+    auth_header: str | None,
+    demo_session: str | None,
+    name: str,
+    arguments: dict | None,
+) -> dict:
+    """Run a single ApiPilot tool via POST /execute.
+
+    Implements the full PRE-CHECK flow (§2.2) BEFORE sending the HTTP
+    request:
+      1. Fresh tool discovery (<= TTL cache, force_refresh=True se tool non trovato)
+      2. requires_auth check: blocco con HTTP 401 se true ma nessun token
+      3. Strict JSON-Schema validation: filtra params extra, controlla required
+
+    Il payload di ritorno è SEMPRE la busta standard `{success, data, error}`
+    della guida §2.2. In caso di errori PRE-CHECK (network discovery,
+    requires_auth, validazione arg) la busta ha `success=false` e
+    `error.{code,message,status_code}` popolati.
+    """
+    name_clean = (name or "").strip() if isinstance(name, str) else ""
+    logger.info("[APIPILOT-CALL-NAME] USE=EXECUTE_ENTRYPOINT name=%r argsKeys=%s authHead=%.20s demo=%.20s", name_clean, sorted(list((arguments or {}).keys())) if isinstance(arguments, dict) else [], str(auth_header or "")[:20], str(demo_session or "")[:20])
+    if not S2S_APIPILOT_TOOLS_URL:
+        return {
+            "success": False,
+            "data": None,
+            "error": {
+                "code": "APIPILOT_NOT_CONFIGURED",
+                "message": "ApiPilot no está configurado en este despliegue (S2S_APIPILOT_TOOLS_URL no establecido).",
+                "status_code": 501,
+                "raw": None,
+            },
+        }
+    if not name_clean:
+        return {
+            "success": False,
+            "data": None,
+            "error": {"code": "TOOL_NAME_REQUIRED", "message": "Falta el campo obligatorio: name (nombre de la herramienta).", "status_code": 400, "raw": None},
+        }
+    tools = await _apipilot_fetch_tools(auth_header=auth_header, demo_session=demo_session, force_refresh=False)
+    tool_def = next((t for t in tools if t.get("name") == name_clean), None)
+    if tool_def is None:
+        # Tool sconosciuto: forza refresh discovery e riprova (max 1).
+        logger.info("[APIPILOT-EXEC] tool=%s non found → forced re-discovery", name_clean)
+        tools = await _apipilot_fetch_tools(auth_header=auth_header, demo_session=demo_session, force_refresh=True)
+        tool_def = next((t for t in tools if t.get("name") == name_clean), None)
+    if tool_def is None:
+        return {
+            "success": False,
+            "data": None,
+            "error": {
+                "code": "TOOL_NOT_FOUND",
+                "message": (
+                    f"Herramienta «{name_clean}» no encontrada en el catálogo ApiPilot. "
+                    "Actualice la lista de herramientas y vuelva a intentarlo."
+                ),
+                "status_code": 404,
+                "raw": None,
+            },
+        }
+    # ── PRE-CHECK 2: requires_auth ────────────────────────────────────────────
+    requires_auth = bool(tool_def.get("requires_auth"))
+    has_token = bool(auth_header) or bool(demo_session) or bool(S2S_APIPILOT_SERVICE_TOKEN)
+    if requires_auth and not has_token:
+        logger.warning("[APIPILOT-EXEC] tool=%s requires_auth=true bloccato (nessun token)", name_clean)
+        return {
+            "success": False,
+            "data": None,
+            "error": {
+                "code": "AUTH_REQUIRED",
+                "message": (
+                    f"La herramienta «{name_clean}» requiere autenticación. "
+                    "Inicie sesión o proporcione un token para continuar."
+                ),
+                "status_code": 401,
+                "raw": None,
+            },
+        }
+    # ── PRE-CHECK 3: validazione argomenti strict JSON-Schema ─────────────────
+    cleaned_args, errors = _apipilot_validate_arguments(arguments, tool_def)
+    if errors:
+        return {
+            "success": False,
+            "data": None,
+            "error": {
+                "code": "INVALID_ARGUMENTS",
+                "message": " / ".join(errors),
+                "status_code": 400,
+                "raw": {"removed": sorted(list(set(arguments) - set(cleaned_args))) if isinstance(arguments, dict) else []},
+            },
+        }
+    # ── HTTP: POST /execute ───────────────────────────────────────────────────
+    url = _apipilot_resolve_execute_url()
+    if not url:
+        return {
+            "success": False,
+            "data": None,
+            "error": {
+                "code": "APIPILOT_NOT_CONFIGURED",
+                "message": "ApiPilot no está configurado en este despliegue (S2S_APIPILOT_TOOLS_URL e S2S_APIPILOT_TOOLS_EXECUTE_URL entrambe vuote).",
+                "status_code": 501,
+                "raw": None,
+            },
+        }
+    headers = {"Content-Type": "application/json", "accept": "application/json,text/plain,*/*"}
+    # 2026-09-25 SUPER API KEY (PRIORITÀ ASSOLUTA 🔴): bypass autenticazione AquaPortal.
+    #    Tutti e 3 le forme contemporaneamente per max compatibilità:
+    #      - X-API-Key: <key>
+    #      - Authorization: Bearer <key>
+    #      - x-demo-session: <key>
+    #    Qualsiasi altro auth (service token, login_by_phone) viene completamente
+    #    ignorato quando la API KEY è valorizzata.
+    if S2S_APIPILOT_API_KEY:
+        headers["X-API-Key"] = S2S_APIPILOT_API_KEY
+        headers["Authorization"] = f"Bearer {S2S_APIPILOT_API_KEY}"
+        headers["x-demo-session"] = S2S_APIPILOT_API_KEY
+        final_auth = f"Bearer {S2S_APIPILOT_API_KEY}"
+    else:
+        # 2026-09-25 Priorità auth: 1) S2S_APIPILOT_SERVICE_TOKEN (override max .env),
+        #    2) auth_header (Bearer AquaPortal da _login_by_phone, da WS connect DISCOVERY
+        #    o fallback PASS-2 login), 3) nessun auth.
+        if S2S_APIPILOT_SERVICE_TOKEN:
+            _svc = S2S_APIPILOT_SERVICE_TOKEN.strip()
+            final_auth = (f"Bearer {_svc}" if (not _svc.lower().startswith("bearer ")) else _svc) if _svc else None
+        else:
+            final_auth = auth_header if isinstance(auth_header, str) and auth_header.strip() else None
+        if final_auth:
+            headers["Authorization"] = final_auth
+        if demo_session:
+            headers["x-demo-session"] = demo_session
+    payload = {"name": name_clean, "arguments": cleaned_args}
+    removed = sorted(list(set(arguments) - set(cleaned_args))) if isinstance(arguments, dict) else []
+    logger.info(
+        "[APIPILOT-EXEC] → POST %s name=%s argsKeys=%s removedKeys=%s auth=%s demo=%s",
+        url, name_clean, sorted(cleaned_args.keys()), removed,
+        ("APIKEY" if S2S_APIPILOT_API_KEY else ("Y" if final_auth else "-")),
+        ("APIKEY" if S2S_APIPILOT_API_KEY else ("Y" if demo_session else "-")),
+    )
+    try:
+        async with httpx.AsyncClient(timeout=APIPILOT_HTTP_TIMEOUT, follow_redirects=True) as http:
+            resp = await http.post(url, json=payload, headers=headers)
+    except Exception as exc:
+        logger.error("[APIPILOT-EXEC] ✗ network error: %s", exc)
+        return {
+            "success": False,
+            "data": None,
+            "error": {"code": "EXECUTION_ERROR", "message": f"Error de red al ejecutar «{name_clean}»: {exc}", "status_code": 502, "raw": None},
+        }
+    # Tentativo di deserializzare come busta standard. Se il backend risponde
+    # 5xx o body non-JSON, costruisce una envelope errore coerente.
+    raw_text = resp.text
+    # 2026-09-25 Diagnostica Dettagliata ALWAYS-ON se http >= 400 (401/403/404/5xx)
+    #    Log: payload request (name + arguments RAW completo demo session NON mascherato
+    #    response http status code, raw response body full (max 2000 chars).
+    if resp.status_code >= 400:
+        try:
+            payload_dump = __import__("json").dumps(payload, ensure_ascii=False)
+        except Exception:  # noqa: BLE001
+            payload_dump = str(payload)
+        logger.warning(
+            "[APIPILOT-EXEC][DIAGNOSTIC 4xx] HTTP=%d url=%s name=%s demoSession=%.60s AUTH=%s requestPAYLOAD=%s |RAW RESPONSE BODY (max 1800 chars)=|%s|",
+            resp.status_code,
+            url,
+            name_clean,
+            (demo_session if isinstance(demo_session, str) else "?"),
+            ("YES len="+str(len(final_auth)) if isinstance(final_auth, str) and final_auth.strip() else "-"),
+            payload_dump,
+            (raw_text or "")[:1800],
+        )
+    try:
+        parsed = resp.json()
+    except Exception:
+        logger.error("[APIPILOT-EXEC] ✗ non-JSON body HTTP %s: %s", resp.status_code, raw_text[:500])
+        return {
+            "success": False,
+            "data": None,
+            "error": {
+                "code": "EXECUTION_ERROR",
+                "message": f"La respuesta de ejecución «{name_clean}» no es JSON válido (HTTP {resp.status_code}).",
+                "status_code": resp.status_code,
+                "raw": raw_text[:2000] if raw_text else None,
+            },
+        }
+    # Caso: envelope standard `{success,data,error}` — ritorno as-is.
+    if isinstance(parsed, dict) and "success" in parsed and isinstance(parsed.get("success"), bool):
+        envelope_ok = parsed["success"] and parsed.get("error") in (None, {})
+        logger.info(
+            "[APIPILOT-EXEC] ← %s name=%s success=%s http=%s dataKeys=%s",
+            "OK" if envelope_ok else "FAIL", name_clean, bool(parsed.get("success")), resp.status_code,
+            sorted(list(parsed.get("data").keys())) if isinstance(parsed.get("data"), dict) else "-",
+        )
+        if (not envelope_ok) and isinstance(parsed.get("error"), dict):
+            err = parsed["error"]
+            logger.warning(
+                "[APIPILOT-EXEC] ERROR: code=%s status=%s msg=%s",
+                err.get("code"), err.get("status_code"),
+                (str(err.get("message"))[:200] if err.get("message") is not None else "-"),
+            )
+        return parsed
+    # Caso: backend ha restituito data pura (senza envelope). Wrappa come
+    # success=true (§2.2 della guida: envelope obbligatorio — se non lo
+    # rispetta noi normalizziamo lato proxy per stabilità downstream).
+    logger.warning("[APIPILOT-EXEC] backend non ha restituito envelope standard → wrap manuale http=%s", resp.status_code)
+    return {
+        "success": 200 <= resp.status_code < 300,
+        "data": parsed if (200 <= resp.status_code < 300) else None,
+        "error": None if (200 <= resp.status_code < 300) else {
+            "code": "EXECUTION_ERROR",
+            "message": (
+                f"Ejecución «{name_clean}» devolvió HTTP {resp.status_code} sin envelope estándar."
+            ),
+            "status_code": resp.status_code,
+            "raw": (raw_text[:2000] if raw_text else None),
+        },
+    }
+
+
 # Node-RED reasoning engine endpoint (modalità NODE_RED).
 # Es.: http://localhost:1881  oppure  http://s2s-reasoning:1880  (rete docker)
 NODE_RED_REASONING_URL = os.environ.get("S2S_REASONING_NODE_RED_URL", "").strip().rstrip("/")
@@ -193,8 +1524,22 @@ app = FastAPI(title="s2s-demo")
 # Sign-in only matters when we're metering (prod Space), so gate it on that.
 AUTH_ENABLED = LIMITER_ENABLED and auth.attach(app)
 
+# Calcolo dell'URL execute risolto (serve per STARTUP banner e _apipilot_resolve_execute_url).
+# Nota: la funzione formale _apipilot_resolve_execute_url è definita più avanti (dopo
+# _apipilot_parse_authorization) e usa la stessa identica logica; la ripetiamo qui
+# perché il banner STARTUP viene stampato PRIMA della funzione.
+def _resolve_exec_url_for_startup_banner():
+    base = (S2S_APIPILOT_TOOLS_EXECUTE_URL or S2S_APIPILOT_TOOLS_URL).strip().rstrip("/")
+    if not base:
+        return ""
+    if base.lower().endswith("/execute"):
+        return base
+    return f"{base}/execute"
+_STARTUP_APIPILOT_EXEC_URL = _resolve_exec_url_for_startup_banner()
+del _resolve_exec_url_for_startup_banner
+
 logger.info(
-    "[STARTUP] Other externals — reasoning=%s nodeRed=%s serper=%s lb=%s s2sProxy=%s s2sDirect=%s userAuth=%s reportsApi=%s summaryApi=%s loginApi=%s injectProfile=%s debugPrompt=%s startSessionMode=%s auth=%s",
+    "[STARTUP] Other externals — reasoning=%s nodeRed=%s serper=%s lb=%s s2sProxy=%s s2sDirect=%s userAuth=%s reportsApi=%s injectReports=%s reportsHintMax=%d reportsInjectMode=%s injectToday=%s summaryApi=%s summaryText=%s loginApi=%s injectProfile=%s debugPrompt=%s startSessionMode=%s theme=%s auth=%s apipilotToolsUrl=%s apipilotExecuteUrlOverride=%s apipilotServiceToken=%s apipilotTtl=%ds apipilotTimeout=%.1fs apipilotReasoningPass2=%s apipilotApiKeyBypass=%s",
     S2S_REASONING_TYPE,
     NODE_RED_REASONING_URL or "-",
     bool(SERPER_KEY),
@@ -203,13 +1548,27 @@ logger.info(
     bool(SPEECH_TO_SPEECH_URL),
     bool(VOCERO_USER_PHONE_AUTH_URL),
     bool(S2S_REPORT_LIST),
+    S2S_INJECT_REPORTS,
+    S2S_REPORTS_QUICK_HINT_MAX,
+    S2S_REPORTS_INJECT_MODE,
+    S2S_INJECT_TODAY,
     bool(S2S_LATEST_SUMMARY),
+    bool(S2S_LATEST_SUMMARY_TEXT),
     bool(S2S_LOGIN_BY_PHONE),
     S2S_INJECT_PROFILE,
     S2S_DEBUG_PROMPT,
     S2S_START_SESSION_MODE or "-",
+    S2S_THEME or "-",
     AUTH_ENABLED,
+    S2S_APIPILOT_TOOLS_URL or "-",
+    (S2S_APIPILOT_TOOLS_EXECUTE_URL + f"(risolto:{_STARTUP_APIPILOT_EXEC_URL})") if S2S_APIPILOT_TOOLS_EXECUTE_URL else "-",
+    "Y" if bool(S2S_APIPILOT_SERVICE_TOKEN) else "-",
+    APIPILOT_CACHE_TTL_SEC,
+    APIPILOT_HTTP_TIMEOUT,
+    "Y" if (bool(S2S_APIPILOT_TOOLS_URL) or bool(S2S_APIPILOT_TOOLS_EXECUTE_URL)) else "-",
+    ("YES head=" + (S2S_APIPILOT_API_KEY[:6] + "..." if len(S2S_APIPILOT_API_KEY) > 6 else S2S_APIPILOT_API_KEY) + " (3 FORME!)") if S2S_APIPILOT_API_KEY else "-",
 )
+del _STARTUP_APIPILOT_EXEC_URL
 logger.debug(
     "[STARTUP] Runtime config — SPACE_ID=%s LIMITER_ENABLED=%s MAX_RESULTS=%d",
     bool(SPACE_ID), LIMITER_ENABLED, MAX_RESULTS,
@@ -421,6 +1780,9 @@ VOCERO_USER_CONTEXT_HINT = (
 REPORTS_LIST_HINT = (
     " Scheduled reports / podcast scripts available for this caller before the current session. "
     "Each entry is a scheduled report; use the podcastScript contents as trusted reference material when the user asks about scheduled topics, reports, or prior content."
+    " NOTE (2026-09-11 user request 'Elimina l'iniezione massiva di tutti i report schedulati'): "
+    "S2S_INJECT_REPORTS defaults to FALSE. When FALSE the injection below NEVER happens. "
+    "Operators must explicitly set S2S_INJECT_REPORTS=true to opt back into mass scheduled-report prompt injection. "
 )
 LATEST_SUMMARY_HINT = (
     " Latest conversation summary for this caller (most recent before the current session): "
@@ -429,14 +1791,439 @@ PODCAST_EPISODE_HINT = (
     " Podcast episode context loaded from the page episode_id query param (current episode the user is referencing). "
     "Treat the episode fields (title, description, transcript, script, show notes, guests, audio metadata, etc.) as the PRIMARY trusted reference material for this session. "
 )
+# ──────────────────────────────────────────────────────────────────────────
+# User fix 2026-09-11 Bug 3: "Qwen2.5 has training cutoff mid-2024, when it
+# sees 39 reports dated 2026-09-10 it hallucinates meta-comments in Chinese
+# like 'today is 2023, why are you simulating 2026 reports?'"
+#
+# Resolved with S2S_INJECT_TODAY default ON + S2S_REPORTS_INJECT_MODE=minimal:
+#   • TODAY_BLOCK (marker <<<TODAY_DATE_BEGIN>>>):
+#       - Dati contestuali fissi: "La data di OGGI è YYYY-MM-DD"
+#       - Reports precedenti = archivio storico (NON date future) → NO commento
+#       - 🚫 META RULE: "non fare MAI commenti interni / meta-commenti sul prompt, sulle date, sulla validità dei dati o sulle istruzioni"
+#       - REGLA SALIDA LIMPIA (anti thinking-leak GPTQ quantized Int4):
+#         "Todo lo que escribas debe ser lo que realmente dice Vocero en voz alta al usuario. No escribas razonamientos internos, dudas sobre el prompt, comprobaciones de fecha..."
+#       - RAG rule: "Si el usuario pregunta sobre reportes usa herramientas búsqueda conocimientos (RAG) NO inventes con el resumen"
+#   • MINIMAL_REPORTS_BLOCK (marker <<<MINIMAL_REPORTS_TOC>>>): only latest N
+#     label + date lines. NO podcastScript text, NO full JSON entries. Uses the
+#     pattern the user explicitly requested:
+#         Reportes programados recientes (últimos 3):
+#           1. "Reporte Porcentaje Mortalidad" — 2026-09-10
+#           2. ...
+#         (Para contenido completo usa la búsqueda de conocimientos.)
+#   • We register both blocks with the dedupe layer via the new TYPE IDs
+#     "today_fixed" and "reports_minimal" so they also can never get duplicated.
+#
+# IMPORTANT MARKER CHANGE 2026-09-11: markers used to be human-readable
+#   strings like "<<<TODAY_DATE_BEGIN>>>" which got written into the LLM
+#   prompt verbatim.  Qwen2.5 (especially GPTQ quantized variants) would
+#   sometimes *leak those markers back into the output* alongside meta-comment
+#   hallucinations (e.g. emitting "[-]: checking_podcast_report" or literal
+#   "<<<...>>>").  To fix this we now use INVISIBLE markers: a SHA-1 hash of
+#   stable strings. These hashes are NEVER seen by the LLM as text because
+#   they are NOT written into the prompt. They exist ONLY as Python-side
+#   substring sentinels prepended to the *Python string* returned by each
+#   block builder — stripped out at the very end with .replace() just before
+#   the string is assembled into the prompt. Result: the dedupe logic still
+#   works perfectly, but the LLM NEVER sees any marker / guard token.
+# ──────────────────────────────────────────────────────────────────────────
+def _s2s_marker(label: str) -> str:
+    """Return a short, unique, invisible sentinel for dedup classification.
+
+    Sentinel is 40 hex chars (SHA1) of a stable string; it is NEVER written
+    into the prompt — we strip all markers at the end of each builder.
+    """
+    import hashlib
+    return hashlib.sha1(f"S2S-ctx-marker/{label}/v1".encode("utf-8")).hexdigest()
 
 
-def _resolve_user_context_text(phone_number: str, profile_obj: dict | None, loaded: bool = True) -> str:
+TODAY_BLOCK_MARKER        = _s2s_marker("today_fixed_block")
+MINIMAL_REPORTS_MARKER    = _s2s_marker("reports_minimal_toc")
+VOICE_RULES_HEAD_MARKER   = _s2s_marker("voice_rules_head_lock")
+REPORTS_FULL_MARKER       = _s2s_marker("reports_full_block")
+SUMMARY_FULL_MARKER       = _s2s_marker("summary_full_block")
+PROFILE_FULL_MARKER       = _s2s_marker("profile_full_block")
+EPISODE_FULL_MARKER       = _s2s_marker("episode_full_block")
+ALL_S2S_INTERNAL_MARKERS: tuple = (
+    TODAY_BLOCK_MARKER,
+    MINIMAL_REPORTS_MARKER,
+    VOICE_RULES_HEAD_MARKER,
+    REPORTS_FULL_MARKER,
+    SUMMARY_FULL_MARKER,
+    PROFILE_FULL_MARKER,
+    EPISODE_FULL_MARKER,
+)
+
+
+def _strip_internal_markers(text) -> str:
+    """Strip every internal S2S dedup marker from the final prompt text.
+
+    Must be called right before a block is joined to the final instructions /
+    user_context so the LLM NEVER sees any of our sentinel strings. This is
+    the final guarantee that prevents marker leakage into spoken output.
+    """
+    s = str(text or "")
+    if not s:
+        return s
+    for m in ALL_S2S_INTERNAL_MARKERS:
+        if m and m in s:
+            s = s.replace(m, "")
+    return s.strip()
+
+
+def _extract_user_name_parts(profile) -> list[str]:
+    """Given a profile dict (possibly wrapped in {"user": ...} or {"result": ...})
+    return the list of non-empty first/last name parts in order (e.g.
+    ["Alessandro", "Valenti"]). Returns [] when profile has no name.
+
+    Used by:
+      • _build_voice_rules_head_lock_block — prompt rule #5 "Nombre exacto"
+      • _resolve_user_context_text       — profile NOTA dynamic anti-anglicization
+      • _sanitize_agent_output           — strato 7 terminal regex whole-word replace
+    """
+    if not profile or not isinstance(profile, dict):
+        return []
+    # Unwrap common container keys (server returns both shapes depending on
+    # the auth source path — direct /phone/ endpoint vs login proxy wrapper).
+    nested = profile
+    for wrapper in ("user", "result", "data"):
+        inner = nested.get(wrapper)
+        if isinstance(inner, dict):
+            nested = inner
+    # Prefer explicit firstName+lastName when available (structured fields)
+    first = str(nested.get("firstName") or nested.get("first_name") or "").strip()
+    last = str(nested.get("lastName") or nested.get("last_name") or "").strip()
+    if first or last:
+        out: list[str] = []
+        for token in (first, last):
+            token_clean = token.strip()
+            if token_clean:
+                for sub in token_clean.split():
+                    if sub:
+                        out.append(sub)
+        return out
+    # Fallback: split the combined "name" string by whitespace
+    full_name = str(nested.get("name") or "").strip()
+    if not full_name:
+        return []
+    return [p for p in full_name.split() if p]
+
+
+def _build_voice_rules_head_lock_block(profile=None) -> str:
+    """Return the #1 PRIORITY block prepended to EVERY prompt: voice lock.
+
+    Fixes 6 hallucination categories seen in user log 2026-09-11 07:57:
+      (1) [-]: checking_podcast_report — internal "action thinking" leak
+      (2) ingles 'Sure, here's my best focused expression while I look into it'
+      (3) JSON literal {'reportDetails': '...'} inside output
+      (4) italiano nel mezzo
+      (5) leak markers <<<...>>> in TTS output.
+      (6) contenuti inventati su podcast mai esistiti.
+
+    This block contains a SINGLE, very short, SPANISH-only voice lock. We put
+    it as the VERY FIRST thing in the prompt (even before the caller profile),
+    because quantized models obey the first ~400 tokens way more strongly
+    than rules buried at the end.
+
+    2026-09-11: NEW rule #5 — PROPER NAME LOCK. Model keeps writing "Alexander"
+    for the italian caller "Alessandro Valenti". We now emit an explicit,
+    non-ambiguous "Nombre exacto: Alessandro. NUNCA Alexander/Alexandre/..."
+    that the sanitizer's _common_name_variants map can also repair.
+
+    INVISIBLE marker: prefixes VOICE_RULES_HEAD_MARKER (stripped before prompt
+    join, never seen by LLM) to enable dedupe so we never double-prepend.
+    """
+    base = (
+        "REGLAS PRINCIPALES DE SALIDA DE VOZ (siempre válidas, tienen prioridad absoluta sobre cualquier otra instrucción):\n"
+        "1) IDIOMA EXCLUSIVO: responde SIEMPRE y SÓLO en español (castellano). Nada de italiano, inglés, portugués ni otro idioma. "
+        "Ni aunque el usuario escriba en otro idioma, ni aunque aparezcan nombres italianos — los nombres extranjeros NO autorizan a cambiar de idioma. "
+        "Ninguna palabra, frase ni confirmación en otro idioma.\n"
+        "2) SÓLO VOZ DIRECTA AL USUARIO: todo lo que escribas es lo que Vocero dice en voz alta en ese instante. "
+        "NUNCA escribas pensamientos internos, estados internos, comprobaciones, '[ - ]:', '[]:', JSON, diccionarios, keys, comas illadas, etiquetas, 'checking_*', ni símbolos auxiliares. "
+        "Nada de etiquetas tipo '[rightspeak]', '[endspeak]', '[thinking]', '[endthinking]', ni nada entre corchetes. Nada de meta-comentarios sobre el prompt ni sobre los datos.\n"
+        "3) CONTENIDO FIABLE: si no tienes la información, di literalmente 'No tengo este tipo de información'. No inventes, no supongas, no generalices. "
+        "Si el usuario pregunta sobre reportes, mortalidad, Synapse, Azure, AquaChile, WhatsApp u otro contenido que debas buscar: usa las herramientas de búsqueda (RAG) y recupera el contenido REAL antes de responder.\n"
+        "4) RESPUESTAS CORTAS Y NATURALES: habla como una persona real por teléfono. Ni listas, ni bullets, ni citas, ni bloques de texto largos. "
+        "Un par de frases cortas, luego pregunta si quiere más detalles.\n"
+    )
+    # --- Nombre propio lock (DINAMICO da nome profilo) ---
+    name_lines = ""
+    parts = _extract_user_name_parts(profile)
+    if parts:
+        full_name = " ".join(parts)
+        variants_all: list[str] = []
+        for part in parts:
+            vs = _common_name_variants(part)
+            for v in vs:
+                if v not in variants_all and v != part:
+                    variants_all.append(v)
+        cleaned_variants = variants_all[:8]
+        if cleaned_variants:
+            name_lines = (
+                "5) NOMBRE PROPIO (regla innegociable para esta sesión): "
+                f"el nombre exacto del usuario ESCRITO Y PRONUNCIADO TAL CUAL es: {full_name}. "
+                f"NUNCA lo adaptes, traduzcas ni normalices: "
+                + ", ".join(f'NUNCA "{v}"' for v in cleaned_variants)
+                + ". Sólo escribe y pronuncia el nombre exacto del perfil.\n"
+            )
+    body = base + name_lines
+    return VOICE_RULES_HEAD_MARKER + "\n" + body
+
+
+def _build_today_fixed_context_block(
+    today_override=None,
+) -> str:
+    """Return the TODAY + anti-hallucination guard block.
+
+    2026-09-11 rewrite:
+      • NOW 100% SPANISH (no italiano).  Root of the language leak: the earlier
+        block had italian 'Dati contestuali fissi...' which told Qwen that
+        mixing italian+spanish was OK inside the spanish voice assistant.
+      • Only 3 bullet sentences, nothing fancy, nothing that triggers meta.
+      • Invisible dedup marker TODAY_BLOCK_MARKER is prefixed and will be
+        stripped before prompt join → LLM never sees.
+    """
+    if not S2S_INJECT_TODAY:
+        return ""
+    today = today_override if today_override is not None else _dt_module.date.today()
+    iso_date = today.strftime("%Y-%m-%d")
+    es_weekday = [
+        "lunes","martes","miércoles","jueves","viernes","sábado","domingo",
+    ][today.weekday()]
+    body = (
+        f"Fecha de hoy (referencia innegociable): {iso_date} ({es_weekday}).\n"
+        f"Los reportes con fechas ANTERIORES a hoy son ARCHIVO HISTÓRICO, NO son fechas futuras. No comentes nada al respecto.\n"
+        "El punto '.' en números separa decimales; la coma ',' separa miles (formato internacional estándar en este sistema).\n"
+    )
+    return TODAY_BLOCK_MARKER + "\n" + body
+
+
+def _build_minimal_reports_toc_block(
+    filtered_sorted,
+    cap=None,
+) -> str:
+    """Return the user-requested MINIMAL scheduled-reports TOC block (NO script).
+
+    2026-09-11 rewrite:
+      • Marker <<<...>>> removed because it was leaking into output.  Now the
+        invisible internal sentinel MINIMAL_REPORTS_MARKER (stripped before
+        joining) is used for dedupe classification.
+      • Footer is now the strict RAG rule, not a soft note.
+    """
+    items = list(filtered_sorted or [])
+    if cap is None:
+        cap = max(1, int(S2S_REPORTS_QUICK_HINT_MAX or 3))
+    if len(items) > cap:
+        items = items[:cap]
+    if not items:
+        return ""
+    lines: list[str] = []
+    lines.append(
+        f"Reportes programados recientes (últimos {len(items)}):"
+    )
+    for idx, r in enumerate(items, start=1):
+        label = (str(r.get("sourceScheduleLabel") or "").strip()
+                 or "(sin título)")
+        raw_d = r.get("date")
+        date_str = ""
+        try:
+            if isinstance(raw_d, (int, float)) and not isinstance(raw_d, bool):
+                ts_sec = float(raw_d)
+                if ts_sec > 1e12:
+                    ts_sec = ts_sec / 1000.0
+                dt = _dt_module.datetime.fromtimestamp(ts_sec, tz=_dt_module.timezone.utc)
+                date_str = dt.strftime("%Y-%m-%d")
+            elif raw_d is not None:
+                s = str(raw_d).strip()
+                if "T" in s and len(s) >= 10:
+                    date_str = s[:10]
+                else:
+                    date_str = s
+        except Exception:
+            date_str = str(raw_d)[:10] if raw_d else ""
+        if date_str:
+            lines.append(f'  {idx}. "{label}" — {date_str}')
+        else:
+            lines.append(f'  {idx}. "{label}"')
+    lines.append(
+        "Para el contenido completo de cualquier reporte usa SIEMPRE las herramientas de búsqueda (RAG). No inventes detalles que no hayas recuperado."
+    )
+    return MINIMAL_REPORTS_MARKER + "\n" + "\n".join(lines) + "\n"
+
+# ──────────────────────────────────────────────────────────────────────────
+# User fix 2026-09-11 "Rimuovi il profilo chiamante DUPLICATO".
+# Each context block returned by the _resolve_* helpers above starts with a
+# unique, stable, documented HINT prefix (see VOCERO_USER_CONTEXT_HINT /
+# PODCAST_EPISODE_HINT / REPORTS_LIST_HINT / LATEST_SUMMARY_HINT). We use
+# these prefixes as logical "block type IDs" so a single context type is
+# NEVER appended twice to the same prompt / session.instructions / user_context
+# — even if two different call paths (phoneNumber fetch + identity /
+# client-side supplied user_context + server-side fetch) both carry the same
+# block type.
+#
+# Historical duplicate reported by the user:
+#     Caller profile resolved from the page phoneNumber: {name:"Alessandro.."}
+#     Caller profile resolved from the page phoneNumber: {name:"Alessandro.."}
+#                             ↑ IDENTICAL SECOND COPY ↑
+# The most likely cause is a client-side reasoning / profile fetch supplying
+# the profile as part of `req.user_context` (or two overlapping server
+# injection channels) while the server re-fetches it again for the
+# instructions augment. Instead of trying to hunt every single call site, we
+# add TWO dedupe layers below that are immune to future regressions:
+#
+#   1) _dedup_context_blocks_by_type([A, B, C, ...])  — given a list of
+#      candidate context strings, returns a new list where only the FIRST
+#      occurrence of each logical block TYPE (profile / episode / reports /
+#      summary) survives. All HINT prefixes are treated as block-type IDs.
+#      Used inside _augment_instructions_with_profile and the
+#      effective_user_context join list.
+#   2) _strip_already_injected_types_from_base(base_text, [candidates])   —
+#      before appending new candidates to an existing base prompt string,
+#      scan the base for each HINT prefix. If a prefix is already present
+#      somewhere inside base_text, that candidate is DROPPED (skipped).
+#      Catches the case where session.instructions was ALREADY patched on a
+#      previous session.update frame, or where the client sent us the
+#      profile already baked into req.instructions / req.user_context.
+#
+# Together these two layers guarantee: per prompt / per LLM call, each block
+# type appears AT MOST ONCE (zero or one).
+# ──────────────────────────────────────────────────────────────────────────
+_CONTEXT_DEDUPE_MARKERS: tuple = (
+    # (logical_type_id, unique_prefix_marker_in_text)
+    ("voice_rules_head", VOICE_RULES_HEAD_MARKER),  # NEW: 2026-09-11 #1 PRIORITY voice-language lock
+    ("episode", PODCAST_EPISODE_HINT.strip()),
+    ("profile", VOCERO_USER_CONTEXT_HINT.strip()),
+    ("reports_full", REPORTS_FULL_MARKER),
+    ("reports", "<<<REPORTS_LIST_BEGIN>>>"),        # legacy back-compat marker
+    ("summary", "<<<LATEST_SUMMARY_BEGIN>>>"),   # legacy back-compat marker
+    ("summary_full", SUMMARY_FULL_MARKER),
+    ("today_fixed", TODAY_BLOCK_MARKER),
+    ("reports_minimal", MINIMAL_REPORTS_MARKER),
+    ("apipilot_tools_list", APIPILOT_PASS1_LIST_MARKER),
+    ("apipilot_result", APIPILOT_PASS2_RESULT_MARKER),
+)
+
+
+def _classify_context_block(block: str) -> str | None:
+    """Return the logical type of block or None for unrecognised text.
+
+    Uses the HINT prefixes / block begin markers above. Uses substring
+    containment (not startswith) because the augmented prompt may carry the
+    markers after 1-2 leading spaces. Uses the STRIPPED version of each HINT
+    to avoid missing matches due to leading whitespace.
+    """
+    if not block:
+        return None
+    haystack = (block or "").strip()
+    if not haystack:
+        return None
+    for type_id, marker in _CONTEXT_DEDUPE_MARKERS:
+        if marker and marker in haystack:
+            return type_id
+    return None
+
+
+def _dedup_context_blocks_by_type(candidates: list[str]) -> list[str]:
+    """Keep only the FIRST occurrence of each logical block TYPE in order.
+
+    Drops duplicated block types silently and logs + returns a new list with
+    only the surviving blocks. Also drops empty / whitespace-only candidates
+    which would otherwise be a no-op append. This is layer 1 of the dedupe.
+    """
+    if not candidates:
+        return []
+    seen_types: set[str] = set()
+    out: list[str] = []
+    dropped_types: dict[str, int] = {}
+    for candidate in candidates:
+        c = (candidate or "").strip()
+        if not c:
+            continue
+        type_id = _classify_context_block(c)
+        if type_id is None:
+            # Unknown type (free-form text, plain user_context, ...) is NEVER
+            # deduped — we only dedupe the 4 well-known S2S injected block
+            # types so user-supplied arbitrary context is always preserved.
+            out.append(candidate)
+            continue
+        if type_id in seen_types:
+            dropped_types[type_id] = dropped_types.get(type_id, 0) + 1
+            continue
+        seen_types.add(type_id)
+        out.append(candidate)
+    if dropped_types and S2S_DEBUG_PROMPT:
+        # Log only when dedupe actually fired (avoids spamming). Use level
+        # DEBUG / info level so the admin can see "profile duplicate was
+        # dropped" when troubleshooting prompt size issues.
+        logger.info(
+            "[INJECT-DEDUPE] dropped duplicate injected block types=%s kept=%d candidates=%d",
+            ", ".join(f"{k}x{v}" for k, v in dropped_types.items()),
+            len(out),
+            len(candidates),
+        )
+    return out
+
+
+def _strip_already_injected_types_from_base(
+    base_text: str, candidates: list[str]
+) -> list[str]:
+    """Layer 2: for each candidate, check if its HINT prefix ALREADY appears
+    anywhere inside base_text (i.e. was injected by a previous patch / baked
+    into the instructions sent by the browser). If yes, drop that candidate
+    entirely (keep only candidates whose types are NOT already present in
+    base). Works even when base_text contains the profile twice — after this
+    filter we won't add a third copy; layer 1 handles any further duplicates
+    among the candidates themselves."""
+    b = (base_text or "")
+    if not b:
+        return list(candidates)
+    out: list[str] = []
+    dropped_base: list[str] = []
+    for candidate in candidates:
+        c = (candidate or "").strip()
+        if not c:
+            continue
+        type_id = _classify_context_block(c)
+        if type_id is None:
+            # Unknown context blocks → never dedupe, always append.
+            out.append(candidate)
+            continue
+        # Does base already contain ANY marker for this type? Use _ALL_
+        # markers for this type, not just the single canonical one, in case
+        # an older deploy used a different stringification (though prefix
+        # stability is guaranteed by the module-level constants here).
+        already = False
+        for marker_tid, marker in _CONTEXT_DEDUPE_MARKERS:
+            if marker_tid == type_id and marker and marker in b:
+                already = True
+                break
+        if already:
+            dropped_base.append(type_id)
+            continue
+        out.append(candidate)
+    if dropped_base and S2S_DEBUG_PROMPT:
+        logger.info(
+            "[INJECT-DEDUPE] dropped candidate block types already present in base instructions=%s baseLen=%d",
+            ", ".join(dropped_base),
+            len(b or ""),
+        )
+    return out
+
+
+def _resolve_user_context_text(phone_number, profile_obj, loaded: bool = True) -> str:
     """Given a phone+profile object -> the short context string appended to
     LLM system prompt / reasoning user_context when S2S_INJECT_PROFILE is on.
 
     Generic (deploy-agnostic): profile_obj is the JSON returned by
     VOCERO_USER_PHONE_AUTH_URL (optionally nested under {"result": ...}).
+
+    2026-09-11 anti-language-leak rule: names like "Alessandro Valenti" are
+    italian/luxemburgish names but our voice assistant is 100% castellano so
+    we append an EXPLICIT NOTE that the model sees alongside the caller info.
+
+    2026-09-11 anti-anglicization rule (Alexander → Alessandro): when the
+    profile contains a known given-name (e.g. Alessandro) we emit a DYNAMIC
+    list of forbidden anglicizations so the model cannot "normalize" it.
     """
     if not loaded or not profile_obj or not phone_number:
         return ""
@@ -446,15 +2233,55 @@ def _resolve_user_context_text(phone_number: str, profile_obj: dict | None, load
         serialized = str(profile_obj)
     if len(serialized) > 1600:
         serialized = serialized[:1600] + "..."
-    return f"{VOCERO_USER_CONTEXT_HINT}{serialized}. Use this as trusted caller context when relevant."
+
+    # ─── anti-anglicization dynamic note ─────────────────────────────────
+    parts = _extract_user_name_parts(profile_obj) or []
+    forbidden_lines: list[str] = []
+    for name_part in parts:
+        variants = _common_name_variants(name_part)
+        if variants:
+            # keep the first 6 variants max so the prompt stays tight
+            short = variants[:6]
+            quoted = ', '.join('"' + v + '"' for v in short)
+            forbidden_lines.append(
+                f"Para el nombre '{name_part}': NUNCA escribas ni pronuncies {quoted} ni versiones similares en inglés/francés/ruso. "
+                f"Sólo '{name_part}' tal cual está."
+            )
+    if forbidden_lines:
+        nombre_propio_note = (
+            "NOMBRE PROPIO (regla innegociable para esta sesión): "
+            + " ".join(forbidden_lines)
+            + " "
+        )
+    else:
+        # fallback to generic example so the rule's existence is still taught
+        nombre_propio_note = (
+            "NOMBRE PROPIO: nunca adaptes, traduzcas ni 'normalices' nombres propios "
+            "(ej. nunca pases 'Alessandro' a 'Alexander'). Escribe y pronuncia sólo el nombre exacto del perfil. "
+        )
+
+    # We build with invisible internal PROFILE_FULL_MARKER so dedup + strip
+    # works consistently with today/voice_rules_head blocks.
+    body = (
+        f"{VOCERO_USER_CONTEXT_HINT}{serialized}. Use this as trusted caller context when relevant. "
+        "NOTA IMPORTANTE (regla de idioma): aunque el usuario tenga nombre italiano (p. ej. 'Alessandro Valenti') "
+        "o nombre en cualquier otro idioma, SÓLO debes responderle en ESPAÑOL (castellano). "
+        "Los nombres extranjeros NO autorizan a cambiar de idioma. "
+        "Nunca escribas frases, palabras, preguntas ni confirmaciones en italiano, inglés ni ningún otro idioma. "
+        "Siempre habla como Vocero: voz española directa, sin prefijos, sin JSON, sin meta-comentarios. "
+        f"{nombre_propio_note}"
+    )
+    return PROFILE_FULL_MARKER + "\n" + body
 
 
-def _resolve_latest_summary_context(summary_value: str | dict | None) -> str:
+def _resolve_latest_summary_context(summary_value) -> str:
     """Normalize the payload returned by S2S_LATEST_SUMMARY endpoint into a
     single context string to be appended next to the profile block.
 
     Accepts plain string / object (dumped JSON) / None. Capped at 1600 chars.
-    Wrapped with LATEST_SUMMARY_BEGIN/END markers so log inspection is easy.
+    2026-09-11: uses INVISIBLE SUMMARY_FULL_MARKER (never seen by LLM) so the
+    dedupe layer can still classify it; human <<<...>>> markers removed to
+    stop leakage into output.
     Returns "" when no summary is available.
     """
     if summary_value is None:
@@ -471,42 +2298,43 @@ def _resolve_latest_summary_context(summary_value: str | dict | None) -> str:
         return ""
     if len(trimmed) > 1600:
         trimmed = trimmed[:1600] + "..."
-    return f"{LATEST_SUMMARY_HINT}<<<LATEST_SUMMARY_BEGIN>>>\n{trimmed}\n<<<LATEST_SUMMARY_END>>>. Use this as trusted history when the user references prior calls."
+    body = f"{LATEST_SUMMARY_HINT}\n{trimmed}\n. Use this as trusted history when the user references prior calls."
+    return SUMMARY_FULL_MARKER + "\n" + body
 
 
-def _resolve_episode_context(raw_value: object) -> str:
+def _resolve_episode_context(raw_value) -> str:
     """Normalize the podcast episode API response into a prompt block injected
     at the TOP of the contexts (most specific / current reference).
 
     Accepts a dict (or {"result": {...}} wrapped) with any arbitrary episode
     fields (title, description, transcript, script, showNotes, guests,
     publishedAt, audioUrl, duration, author, etc.). Capped at 24000 chars
-    (episodes can have long transcripts). Wrapped with
-    <<<PODCAST_EPISODE_BEGIN/END>>> markers.
+    (episodes can have long transcripts).
+    2026-09-11: uses INVISIBLE EPISODE_FULL_MARKER so dedupe still classifies
+    it without leaking <<<...>>> wrappers into TTS.
     Returns "" if empty / fetch failed / None.
     """
     if raw_value is None:
         return ""
-    episode_obj: object = raw_value
-    if isinstance(raw_value, dict) and isinstance(raw_value.get("result"), dict):
-        episode_obj = raw_value["result"]
-    if isinstance(episode_obj, dict) and len(episode_obj) == 0:
-        return ""
-    if isinstance(episode_obj, list) and len(episode_obj) == 0:
-        return ""
-    try:
-        serialized = json.dumps(episode_obj, ensure_ascii=False)
-    except Exception:
-        serialized = str(episode_obj)
+    if isinstance(raw_value, dict) and len(raw_value) == 1 and isinstance(raw_value.get("result"), (dict, list)):
+        raw_value = raw_value["result"]
+    if isinstance(raw_value, dict) or isinstance(raw_value, list):
+        try:
+            serialized = json.dumps(raw_value, ensure_ascii=False)
+        except Exception:
+            serialized = str(raw_value)
+    else:
+        serialized = str(raw_value)
     trimmed = serialized.strip()
     if not trimmed:
         return ""
     if len(trimmed) > 24000:
-        trimmed = trimmed[:24000] + "..."
-    return f"{PODCAST_EPISODE_HINT}<<<PODCAST_EPISODE_BEGIN>>>\n{trimmed}\n<<<PODCAST_EPISODE_END>>>. This is the episode the caller is currently interacting with — answer with reference to it first."
+        trimmed = trimmed[:24000] + "...(episode truncated)"
+    body = f"{PODCAST_EPISODE_HINT}\n{trimmed}\n. Treat as PRIMARY trusted reference for this session."
+    return EPISODE_FULL_MARKER + "\n" + body
 
 
-def _parse_date_key(value: object) -> tuple:
+def _parse_date_key(value) -> tuple:
     """Return a sortable tuple for an arbitrary date-like value.
 
     Sort order is DESC (newest first). Non-dates / empty sort to the end (lowest priority).
@@ -562,7 +2390,20 @@ def _resolve_reports_context(raw_value: object) -> str:
     Sorts by date DESC (newest first) via _parse_date_key. Capped at 12000 chars
     (podcastScript can be long). Wrapped with <<<REPORTS_LIST_BEGIN/END>>> markers.
     Returns "" if no valid items / empty list.
+
+    USER FIX 2026-09-11 "Elimina l'iniezione massiva di tutti i report schedulati":
+      • If the new env flag S2S_INJECT_REPORTS is FALSE (DEFAULT), this function
+        ALWAYS returns "" — NO scheduled reports of any kind are ever injected
+        into the LLM prompt, not even a TOC line with label+date. The function
+        returns the empty string at the very top before touching the input, so
+        we also skip JSON processing / sorting / serialization work.
+      • If S2S_INJECT_REPORTS=TRUE, behaviour is unchanged: full injection of
+        podcastScript text for every report, just as before.
     """
+    # ── MASS-INJECTION KILL SWITCH (user request) ────────────────────────
+    if not S2S_INJECT_REPORTS:
+        return ""
+    # ─────────────────────────────────────────────────────────────────────
     if raw_value is None:
         return ""
     items_list: list
@@ -625,6 +2466,53 @@ def _resolve_reports_context(raw_value: object) -> str:
         return ""
     # Sort by date DESC (newest first)
     filtered.sort(key=lambda r: _parse_date_key(r.get("date")))
+    # USER FIX 2026-09-11 "riduci il quick hint report max 3-5 configurabile da .env":
+    #   after sort by newest → keep ONLY the first S2S_REPORTS_QUICK_HINT_MAX reports.
+    #   Applies cap to BOTH the quick-hint TOC lines AND the serialized JSON entries,
+    #   so the final wrapped block stays small and contains no more than N scripts.
+    total_raw = len(filtered)
+    cap = max(1, int(S2S_REPORTS_QUICK_HINT_MAX or 5))
+    if total_raw > cap:
+        filtered = filtered[:cap]
+    truncated_note = ""
+    if total_raw > cap:
+        truncated_note = (
+            f"\n(Showing the {cap} newest scheduled reports of {total_raw} total "
+            f"returned upstream; older reports omitted. Set S2S_REPORTS_QUICK_HINT_MAX "
+            f"in .env to raise or lower this window.)\n"
+        )
+    # ──────────────────────────────────────────────────────────────────────
+    # USER FIX BUG 3 2026-09-11: Qwen2.5 cutoff mid-2024 hallucinates meta on 2026 dates.
+    # Route output through the new tri-state S2S_REPORTS_INJECT_MODE:
+    #   • "off"/"none"  → skip entirely (no reports block in prompt, 0 tokens).
+    #   • "minimal"     → ONLY last-N label + date TOC.  NO podcastScript text, no JSON entries,
+    #                     just the user-requested Reportes programados recientes block.
+    #                     ~50 tokens instead of ~3200.
+    #   • "full"        → legacy mode with hints + full JSON entries + podcastScript.
+    #                     Kept only for explicit opt-in because user explicitly asked
+    #                     to eliminate massive script injection.
+    mode = (S2S_REPORTS_INJECT_MODE or "minimal").lower()
+    if mode in {"off", "none"}:
+        if S2S_DEBUG_PROMPT:
+            logger.info(
+                "[INJECT-REPORTS] mode=%s → no scheduled reports injected into prompt (cap=%d totalRaw=%d)",
+                mode, cap, total_raw,
+            )
+        return ""
+    if mode == "minimal":
+        minimal_block = _build_minimal_reports_toc_block(filtered, cap=cap)
+        if S2S_DEBUG_PROMPT:
+            logger.info(
+                "[INJECT-REPORTS] mode=minimal blockLen=%d (no podcastScript injected) cap=%d totalRaw=%d",
+                len(minimal_block), cap, total_raw,
+            )
+        return minimal_block
+    # ───── mode == "full" — legacy behaviour (opt-in only) ───────────────
+    if S2S_DEBUG_PROMPT:
+        logger.info(
+            "[INJECT-REPORTS] mode=full (LEGACY, podcastScript included) cap=%d totalRaw=%d",
+            cap, total_raw,
+        )
     # Build a quick HINT LINE per report (label + date) so the LLM can see at a
     # glance which scheduled topics are available before diving into scripts.
     hint_lines = []
@@ -670,10 +2558,10 @@ def _resolve_reports_context(raw_value: object) -> str:
     hints_block = ""
     if hint_lines:
         hints_block = "\n".join(hint_lines) + "\n"
-    body = hints_block + "\n--- Full JSON entries ---\n" + "\n".join(entries_lines)
+    body = truncated_note + hints_block + "\n--- Full JSON entries ---\n" + "\n".join(entries_lines)
     wrapped = (
         f"{REPORTS_LIST_HINT}\n"
-        "Quick hints (available scheduled reports / podcasts by label):\n"
+        f"Quick hints (available scheduled reports / podcasts by label — cap {cap} newest):\n"
         f"{body}\n"
         f"<<<REPORTS_LIST_END>>>. Use these scheduled reports as trusted prior "
         "content relevant to the caller's company topics. Reference individual "
@@ -686,7 +2574,7 @@ def _resolve_reports_context(raw_value: object) -> str:
         budget = (
             12000
             - len(REPORTS_LIST_HINT)
-            - len("\nQuick hints (available scheduled reports / podcasts by label):\n")
+            - len(f"\nQuick hints (available scheduled reports / podcasts by label — cap {cap} newest):\n")
             - len("\n--- Full JSON entries ---\n")
             - len("\n<<<REPORTS_LIST_END>>>...truncated.")
             - 200  # reserve for wrap sentence
@@ -695,11 +2583,16 @@ def _resolve_reports_context(raw_value: object) -> str:
             body = body[:budget] + "..."
         wrapped = (
             f"{REPORTS_LIST_HINT}\n"
-            "Quick hints (available scheduled reports / podcasts by label):\n"
+            f"Quick hints (available scheduled reports / podcasts by label — cap {cap} newest):\n"
             f"{body}\n"
             f"<<<REPORTS_LIST_END>>>...truncated (cap 12000 chars). Use these "
             "scheduled reports as trusted prior content. Reference reports by label when relevant."
         )
+    if total_raw and total_raw > cap and len(truncated_note) and S2S_DEBUG_PROMPT:
+        logger.info(
+            "[INJECT-REPORTS] quick-hint+entries cap applied: kept=%d upstreamTotal=%d cap=%d",
+            len(filtered), total_raw, cap,
+        )
     return wrapped
 
 
@@ -710,7 +2603,22 @@ async def _fetch_reports_list(phone_number: str | None = None, auth_token: str |
     ?phoneNumber=<x> if a phone is provided. Accepts JSON (optional {"result": [...]}
     wrapper) and returns the list or unwrapped list. On any error logs and returns None
     (never fails the proxy / reasoning tunnel).
+
+    USER FIX 2026-09-11 "Elimina l'iniezione massiva di tutti i report schedulati":
+      • If S2S_INJECT_REPORTS is FALSE (DEFAULT) we short-circuit to None at the
+        very top — NO HTTP call is made to S2S_REPORT_LIST at all. The upstream
+        endpoint is never hit, not even for a "cheap empty list"; combined with
+        _resolve_reports_context → "" above, this guarantees ZERO scheduled-report
+        contents reach any LLM prompt anywhere (WS session instructions patch,
+        /api/reasoning user_context, NODE_RED instructions augment, quick reports
+        lookup response).
+      • S2S_INJECT_REPORTS=true restores prior behaviour (both the HTTP fetch AND
+        the full injection into every prompt path).
     """
+    # ── MASS-INJECTION KILL SWITCH (user request) ─────────────────────────
+    if not S2S_INJECT_REPORTS:
+        return None
+    # ───────────────────────────────────────────────────────────────────────
     if not S2S_REPORT_LIST:
         return None
     from urllib.parse import urlencode
@@ -844,6 +2752,14 @@ def _extract_login_token(login_payload: dict | None) -> str | None:
             nested = _extract_login_token(v)
             if nested:
                 return nested
+    # Third pass: list like [{"token": ...}] (uncommon but safe)
+    for k, v in login_payload.items():
+        if isinstance(v, list) and v:
+            for elem in v:
+                if isinstance(elem, dict):
+                    nested = _extract_login_token(elem)
+                    if nested:
+                        return nested
     return None
 
 
@@ -894,26 +2810,54 @@ async def _login_by_phone(phone_number: str) -> tuple[str | None, dict | None]:
         )
         return None, None
 
-    # Unwrap {"result": …} if present (common wrapper convention).
-    if isinstance(payload, dict) and isinstance(payload.get("result"), dict):
-        unwrapped = payload["result"]
-    else:
-        unwrapped = payload if isinstance(payload, dict) else None
+    # Unwrap {"result": …} OR {"data": …} if present (common wrapper conventions).
+    unwrapped: dict | None = None
+    if isinstance(payload, dict):
+        for _wrap_key in ("result", "data", "payload"):
+            if isinstance(payload.get(_wrap_key), dict):
+                unwrapped = payload[_wrap_key]
+                break
+        if unwrapped is None:
+            unwrapped = payload
     token = _extract_login_token(unwrapped) if isinstance(unwrapped, dict) else _extract_login_token(
         payload if isinstance(payload, dict) else None
     )
+    # 2026-09-25 Diagnostica SEMPRE-ATTIVA login token (anche senza S2S_DEBUG_PROMPT)
+    #    per verificare token length (JWT > 150 chars), anteprima primi 8 chars.
+    #    Chiavi response + unwrap usato.
+    _all_keys: list[str] = []
+    if isinstance(payload, dict):
+        _all_keys.extend(str(k) for k in payload.keys())
+    _unwrap_keys: list[str] = []
     if isinstance(unwrapped, dict):
-        logger.info(
-            "[INJECT-LOGIN] ✅ login response OK keys=%s token=%s",
-            ",".join(sorted(str(k) for k in unwrapped.keys())),
-            "present" if token else "missing",
-        )
-        if S2S_DEBUG_PROMPT:
-            logger.info(
-                "[DEBUG-LOGIN][response] FULL login payload (len=%d):\n%s\n",
-                len(json.dumps(unwrapped, ensure_ascii=False)),
-                json.dumps(unwrapped, ensure_ascii=False, indent=2),
-            )
+        _unwrap_keys.extend(str(k) for k in unwrapped.keys())
+    if isinstance(unwrapped, dict):
+        _t_preview = ""
+        _t_len = 0
+        if isinstance(token, str) and token.strip():
+            _t_len = len(token.strip())
+            if _t_len > 8:
+                _t_preview = token.strip()[:8] + "..."
+            else:
+                _t_preview = token.strip()
+        _fmt_note = ""
+        if _t_len >= 120:
+            _fmt_note = " [JWT-like]"
+        elif _t_len > 0:
+            _fmt_note = " [SHORT]"
+        _wrap_layer = "ROOT"
+        if isinstance(payload, dict):
+            for _wk in ("result", "data", "payload"):
+                if isinstance(payload.get(_wk), dict):
+                    _wrap_layer = "result/data/payload"
+                    break
+        _all_keys_s = ",".join(sorted(_all_keys)) if _all_keys else "-"
+        _unwrap_keys_s = ",".join(sorted(_unwrap_keys)) if _unwrap_keys else "-"
+        _t_info = "MISSING"
+        if _t_len:
+            _t_info = "YES len=" + str(_t_len) + " head=" + _t_preview
+        msg = "[INJECT-LOGIN] ✅ login OK: wrapLayer=%s topKeys=%s unwrappedKeys=%s token=%s%s" % (_wrap_layer, _all_keys_s, _unwrap_keys_s, _t_info, _fmt_note)
+        logger.info("%s", msg)
         return token, unwrapped
     # Fallback: non-dict payload (string/list/number) — still log it, but no token expected.
     logger.info(
@@ -936,7 +2880,25 @@ async def _fetch_latest_summary_for_phone(phone_number: str, auth_token: str | N
     wrapper) or plain text. Never fails the proxy / reasoning; returns None on
     any error and logs it. If `auth_token` is provided it is sent as
     Authorization: Bearer <auth_token>.
+
+    OVERRIDE (2026-09-23): when S2S_LATEST_SUMMARY_TEXT is set (non-empty) it
+    takes absolute priority over S2S_LATEST_SUMMARY. No HTTP call is made at all;
+    the raw plain-text value is returned directly. Designed for operators who want
+    a clean, pre-curated, essential summary snippet without any upstream API
+    dependency. Works even without a phone_number (static snippet).
     """
+    if S2S_LATEST_SUMMARY_TEXT:
+        override_len = len(S2S_LATEST_SUMMARY_TEXT)
+        logger.info(
+            "[INJECT-SUMMARY] S2S_LATEST_SUMMARY_TEXT OVERRIDE active (len=%d chars). Skipping HTTP fetch; injecting raw static plain-text summary directly.",
+            override_len,
+        )
+        if S2S_DEBUG_PROMPT:
+            logger.info(
+                "[INJECT-SUMMARY] [DEBUG-PROMPT] S2S_LATEST_SUMMARY_TEXT raw value (first 800 chars):\n%s",
+                S2S_LATEST_SUMMARY_TEXT[:800],
+            )
+        return S2S_LATEST_SUMMARY_TEXT
     if not S2S_LATEST_SUMMARY or not phone_number:
         return None
     from urllib.parse import urlencode
@@ -1136,62 +3098,130 @@ async def _fetch_user_profile_for_phone(phone_number: str, auth_token: str | Non
     return profile_obj
 
 
-def _augment_instructions_with_profile(base_instructions: str, user_context_text: str, reports_context_text: str | None = None, summary_context_text: str | None = None, episode_context_text: str | None = None) -> str:
-    """When S2S_INJECT_PROFILE is true: appends the episode + profile + (optional) reports list
-    + (optional) latest summary context strings to the LLM system/instructions prompt.
+def _augment_instructions_with_profile(base_instructions, user_context_text, reports_context_text=None, summary_context_text=None, episode_context_text=None, profile_obj=None) -> str:
+    """When S2S_INJECT_PROFILE is true: prepend TODAY fixed context block (Bug 3 fix)
+    then append the episode + profile + (optional) reports list + (optional) latest
+    summary context strings to the LLM system/instructions prompt.
 
     Append order (most specific → most generic / chronologically newest → oldest):
-    1. episode_ctx                  (CURRENT podcast episode the user is interacting with)
-    2. base instructions            (primary prompt / user settings / default)
-    3. profile_ctx                  (caller identity block)
-    4. reports_ctx                  (scheduled reports / podcast scripts list, sorted by date DESC)
-    5. summary_ctx                  (latest conversation summary)
+    0. VOICE_RULES_HEAD_LOCK (absolute language lock + #1 priority)
+    1. TODAY_block (date of today + anti-hallucination date rules)
+    2. episode_ctx                  (CURRENT podcast episode the user is interacting with)
+    3. base instructions            (primary prompt / user settings / default)
+    4. profile_ctx                  (caller identity block)
+    5. reports_ctx                  (scheduled reports / podcast scripts list, sorted by date DESC)
+    6. summary_ctx                  (latest conversation summary)
     Preserves the existing instructions text.
+
+    USER FIX 2026-09-11 "Rimuovi il profilo chiamante DUPLICATO": adds TWO dedupe layers
+    so the same block type (profile / episode / reports / summary) NEVER appears twice
+    in the final augmented instructions, even if the caller passed it both in
+    base_instructions (e.g. client-supplied profile baked into req.instructions) AND in the
+    explicit profile_ctx parameter:
+      1) layer 2 — _strip_already_injected_types_from_base removes from parameters
+         if their marker already appears in base_instructions.
+      2) layer 1 — _dedup_context_blocks_by_type then removes any remaining
+         duplicates among the parameters themselves.
+
+    2026-09-11: NEW keyword profile_obj → forwarded to _build_voice_rules_head_lock_block
+    so the prompt lock can emit rule #5 "Nombre exacto: Alessandro Valenti. NUNCA
+    Alexander" for models that keep anglicizing proper names (Qwen2.5-GPTQ).
     """
     base = (base_instructions or "").strip()
+    # ─── USER FIX BUG 3: TODAY fixed block prepended (HEAD of prompt) ─────
+    voice_lock_block = _build_voice_rules_head_lock_block(profile=profile_obj)   # NEW #1 priority: absolute language+output lock
+    today_block = _build_today_fixed_context_block()         # #2: date guard (spanish-only rewrite)
     episode_ctx = (episode_context_text or "").strip()
     profile_ctx = (user_context_text or "").strip()
     reports_ctx = (reports_context_text or "").strip()
     summary_ctx = (summary_context_text or "").strip()
-    contexts = [c for c in [episode_ctx, profile_ctx, reports_ctx, summary_ctx] if c]
+    # raw_candidates is ORDERED by prompt-priority! voice_lock_block (#0) is
+    # inserted FIRST so it becomes position 0 of the final instructions and
+    # gets highest LLM attention, then today, then episode, etc.
+    raw_candidates = [voice_lock_block, today_block, episode_ctx, profile_ctx, reports_ctx, summary_ctx]
+    # Layer 2: strip candidates whose HINT is ALREADY in base instructions
+    # (e.g. client sent profile baked in, we won't re-add it).
+    candidates_against_base = _strip_already_injected_types_from_base(base, raw_candidates)
+    # Layer 1: dedupe among themselves (e.g. episode was both episode_ctx passed in the same raw_candidates twice via identity + raw).
+    contexts = _dedup_context_blocks_by_type(candidates_against_base)
     if not contexts:
         return base_instructions or ""
     augmented = base
     for ctx in contexts:
         augmented = (augmented + " " + ctx).strip() if augmented else ctx
+    # ─── 2026-09-11 MARKER LEAK GUARD: STRIP INTERNAL SENTINELS ──────────
+    # All invisible dedup markers are NOW stripped from the final prompt text
+    # before leaving this function → LLM NEVER sees ANY <<<X>>> / hash string.
+    augmented = _strip_internal_markers(augmented)
     changed = augmented != base
+    # Compute per-type lengths for log (based on what actually survived dedupe)
+    final_lock_len = sum(len(c) for c in contexts if _classify_context_block(c) == "voice_rules_head")
+    final_today_len = sum(len(c) for c in contexts if _classify_context_block(c) == "today_fixed")
+    final_ep_len = sum(len(c) for c in contexts if _classify_context_block(c) == "episode")
+    final_pf_len = sum(len(c) for c in contexts if _classify_context_block(c) == "profile")
+    final_rp_len = sum(len(c) for c in contexts if _classify_context_block(c) in {"reports", "reports_minimal", "reports_full"})
+    final_sm_len = sum(len(c) for c in contexts if _classify_context_block(c) in {"summary", "summary_full"})
     logger.info(
-        "[INJECT-PROFILE] ✏️ appended episode/profile/reports/summary to LLM instructions. "
-        "baseLen=%d episodeCtxLen=%d profileCtxLen=%d reportsCtxLen=%d summaryCtxLen=%d newLen=%d changed=%s",
-        len(base), len(episode_ctx), len(profile_ctx), len(reports_ctx), len(summary_ctx), len(augmented), changed,
+        "[INJECT-PROFILE] ✏️ prepended VOICE_LOCK + TODAY_block + appended episode/profile/reports/summary to LLM instructions. "
+        "baseLen=%d voiceLockLen=%d todayCtxLen=%d episodeCtxLen=%d profileCtxLen=%d reportsCtxLen=%d summaryCtxLen=%d newLen=%d changed=%s dedupedCandidates=%d",
+        len(base), final_lock_len, final_today_len, final_ep_len, final_pf_len, final_rp_len, final_sm_len, len(augmented), changed, len(contexts),
     )
-    if S2S_DEBUG_PROMPT and episode_ctx:
-        logger.info(
-            "[DEBUG-EPISODE][instructions augment] FULL podcast episode block (len=%d):\n%s\n",
-            len(episode_ctx), episode_ctx,
-        )
-    if S2S_DEBUG_PROMPT and reports_ctx:
-        logger.info(
-            "[DEBUG-REPORTS][instructions augment] FULL reports list block (len=%d):\n%s\n",
-            len(reports_ctx), reports_ctx,
-        )
-    if S2S_DEBUG_PROMPT and summary_ctx:
-        logger.info(
-            "[DEBUG-SUMMARY][instructions augment] FULL latest summary block (len=%d):\n%s\n",
-            len(summary_ctx), summary_ctx,
-        )
+    if S2S_DEBUG_PROMPT and final_lock_len:
+        for c in contexts:
+            if _classify_context_block(c) == "voice_rules_head":
+                logger.info(
+                    "[DEBUG-VOICELOCK][instructions augment] FULL voice lock block (len=%d):\n%s\n",
+                    len(c), _strip_internal_markers(c),
+                )
+    if S2S_DEBUG_PROMPT and final_today_len:
+        for c in contexts:
+            if _classify_context_block(c) == "today_fixed":
+                logger.info(
+                    "[DEBUG-TODAY][instructions augment] FULL today+anti-hallucination block (len=%d):\n%s\n",
+                    len(c), _strip_internal_markers(c),
+                )
+    if S2S_DEBUG_PROMPT and final_ep_len:
+        for c in contexts:
+            if _classify_context_block(c) == "episode":
+                logger.info(
+                    "[DEBUG-EPISODE][instructions augment] FULL podcast episode block (len=%d):\n%s\n",
+                    len(c), _strip_internal_markers(c),
+                )
+    if S2S_DEBUG_PROMPT and final_rp_len:
+        for c in contexts:
+            if _classify_context_block(c) in {"reports", "reports_minimal", "reports_full"}:
+                logger.info(
+                    "[DEBUG-REPORTS][instructions augment] FULL reports block (len=%d mode=%s):\n%s\n",
+                    len(c), _classify_context_block(c), _strip_internal_markers(c),
+                )
+    if S2S_DEBUG_PROMPT and final_sm_len:
+        for c in contexts:
+            if _classify_context_block(c) in {"summary", "summary_full"}:
+                logger.info(
+                    "[DEBUG-SUMMARY][instructions augment] FULL latest summary block (len=%d):\n%s\n",
+                    len(c), _strip_internal_markers(c),
+                )
     return augmented
 
 
-def _patch_client_session_update_with_profile(raw_text: str, user_context_text: str, reports_context_text: str | None = None, summary_context_text: str | None = None, episode_context_text: str | None = None) -> str:
+def _patch_client_session_update_with_profile(raw_text, user_context_text, reports_context_text=None, summary_context_text=None, episode_context_text=None, profile_obj=None, apipilot_context_text_pass1=None) -> str:
     """If raw_text is a client session.update JSON and S2S_INJECT_PROFILE is
     true, append episode_context_text + user_context_text + (optional) reports_context_text +
-    (optional) summary_context_text to session.instructions.
+    (optional) summary_context_text + (optional) apipilot_context_text_pass1 to session.instructions.
     Returns the modified JSON string, or the original string unchanged if:
       - it is not session.update JSON (the VAST majority of frames -> silent passthrough, NO LOG)
-      - episode_context_text AND user_context_text AND reports_context_text AND summary_context_text are all empty
-      - S2S_INJECT_PROFILE is False
+      - episode_context_text AND user_context_text AND reports_context_text AND summary_context_text AND apipilot_context_text_pass1 are all empty
+      - S2S_INJECT_PROFILE is False (but if we have apipilot_context_text_pass1 -> PATCH even if S2S_INJECT_PROFILE=false, tools injection is independent.)
       - parse fails
+
+    2026-09-11: NEW keyword profile_obj. Forwarded to
+    _augment_instructions_with_profile so the prompt lock can emit the proper-name
+    anti-anglicization rule for this caller (e.g. Alessandro never Alexander).
+
+    2026-09-25: NEW keyword apipilot_context_text_pass1. Injected IN ADDITION so WS
+    Realtime LLM sees the tools list match description / marker rules (same as the
+    /api/reasoning HTTP endpoint). Independent gate: even S2S_INJECT_PROFILE=false,
+    if apipilot_context_text_pass1 has content -> PATCH instructions.
     """
     # Step 1: only consider session.update frames. All other frame types
     # (response.create, conversation.item.*, audio_* etc.) pass through
@@ -1207,9 +3237,10 @@ def _patch_client_session_update_with_profile(raw_text: str, user_context_text:
     # From here on: we know this is a real session.update (typically emitted
     # just once or twice per realtime session). We can log safely — 1 line,
     # not 20 repeated lines.
-    if not S2S_INJECT_PROFILE:
+    has_apipilot_pass1 = bool((apipilot_context_text_pass1 or "").strip())
+    if not S2S_INJECT_PROFILE and not has_apipilot_pass1:
         logger.info(
-            "[INJECT-PROFILE] ⏭️  WS patch SKIPPED on session.update (S2S_INJECT_PROFILE=false). "
+            "[INJECT-PROFILE] ⏭️  WS patch SKIPPED on session.update (S2S_INJECT_PROFILE=false and no apipilot list pass1). "
             "WS stays pure passthrough."
         )
         return raw_text
@@ -1217,9 +3248,9 @@ def _patch_client_session_update_with_profile(raw_text: str, user_context_text:
     has_profile = bool((user_context_text or "").strip())
     has_reports = bool((reports_context_text or "").strip())
     has_summary = bool((summary_context_text or "").strip())
-    if not (has_episode or has_profile or has_reports or has_summary):
+    if not (has_episode or has_profile or has_reports or has_summary or has_apipilot_pass1):
         logger.info(
-            "[INJECT-PROFILE] ⏭️  WS patch SKIPPED on session.update (no episode, no profile context, no reports list, no latest summary). "
+            "[INJECT-PROFILE] ⏭️  WS patch SKIPPED on session.update (no episode, no profile context, no reports list, no latest summary, no apipilot tools list pass1). "
             "Probably phoneNumber/episode_id query param missing / fetch failed upstream / "
             "endpoints or S2S_LATEST_SUMMARY / S2S_REPORT_LIST returned empty result."
         )
@@ -1239,6 +3270,12 @@ def _patch_client_session_update_with_profile(raw_text: str, user_context_text:
             "[INJECT-REPORTS] profile missing, but REPORTS LIST block loaded. "
             "Will inject reports alone into session.update."
         )
+    if has_apipilot_pass1 and not has_profile and not has_episode and not has_reports and not has_summary:
+        logger.info(
+            "[INJECT-APIPILOT] profile/episode/reports/summary missing, but APIPILOT TOOLS list PASS-1 block loaded (%d chars). "
+            "Will inject tools list alone into session.update.",
+            len(apipilot_context_text_pass1) if isinstance(apipilot_context_text_pass1, str) else 0,
+        )
     top_session = payload.get("session")
     if not isinstance(top_session, dict):
         return raw_text
@@ -1248,17 +3285,35 @@ def _patch_client_session_update_with_profile(raw_text: str, user_context_text:
         else ""
     )
     augmented = _augment_instructions_with_profile(
-        current_instructions, user_context_text, reports_context_text, summary_context_text, episode_context_text
+        current_instructions, user_context_text, reports_context_text, summary_context_text, episode_context_text,
+        profile_obj=profile_obj,
     )
     if S2S_DEBUG_PROMPT:
         logger.info(
             "[DEBUG-PROMPT][WS session.update] BEFORE instructions (len=%d):\n%s\n",
             len(current_instructions), current_instructions,
         )
-    if augmented == current_instructions:
+    # Append apipilot PASS-1 (lista strumenti + regole marker) SE presente,
+    # DOPO profile/reports/episode/summary (struttura identica a /api/reasoning).
+    #
+    # 2026-09-25 FIX "client manda DUE session.update e il secondo SOVRASCRIVE instructions"
+    #   → dopo augment/profile controlliamo anche: le istruzioni CONTENGONO gia' il marker
+    #   <<<APIPILOT_TOOLS_LIST_BEGIN>>> ? SE NO e abbiamo injected_apipilot_pass1 → riappendiamo.
+    already_has_apipilot_pass1 = (
+        isinstance(current_instructions, str)
+        and APIPILOT_PASS1_LIST_MARKER in current_instructions
+    )
+    if has_apipilot_pass1 and not already_has_apipilot_pass1:
+        augmented = (
+            (augmented + "\n\n" if augmented.strip() else "")
+            + (apipilot_context_text_pass1 if isinstance(apipilot_context_text_pass1, str) else "")
+        )
+    # Ora gate "unchanged": SE augmented == current MA c'è differenza apipilot per il post-patch
+    # del client (sovrascrittura instructions senza marker) → NON skippare.
+    if augmented == current_instructions and not (has_apipilot_pass1 and not already_has_apipilot_pass1):
         logger.info(
             "[INJECT-PROFILE] ⏭️  WS patch SKIPPED on session.update (augmented == current; "
-            "episode/profile already injected or context empty)"
+            "episode/profile already injected or context empty or apipilot same)"
         )
         if S2S_DEBUG_PROMPT and augmented.strip():
             logger.info(
@@ -1269,11 +3324,14 @@ def _patch_client_session_update_with_profile(raw_text: str, user_context_text:
     top_session["instructions"] = augmented
     logger.info(
         "[INJECT-PROFILE] ✅ WS session.update PATCHED -> upstream instructions. "
-        "origLen=%d newLen=%d injectedLen=%d episode=%s profile=%s reports=%s summary=%s",
+        "origLen=%d newLen=%d injectedLen=%d episode=%s profile=%s reports=%s summary=%s apipilotPass1=%s(len=%d, wasAlreadyPresent=%s)",
         len(current_instructions),
         len(augmented),
         (len(augmented) - len(current_instructions)),
         has_episode, has_profile, has_reports, has_summary,
+        has_apipilot_pass1,
+        (len(apipilot_context_text_pass1) if isinstance(apipilot_context_text_pass1, str) else 0),
+        ("true" if already_has_apipilot_pass1 else "false"),
     )
     if S2S_DEBUG_PROMPT:
         logger.info(
@@ -1290,6 +3348,11 @@ def _patch_client_session_update_with_profile(raw_text: str, user_context_text:
             "[DEBUG-REPORTS][WS session.update] FULL reports list block (len=%d):\n%s\n",
             len(reports_context_text.strip()), reports_context_text.strip(),
         )
+    if S2S_DEBUG_PROMPT and isinstance(apipilot_context_text_pass1, str) and apipilot_context_text_pass1.strip():
+        logger.info(
+            "[DEBUG-APIPILOT][WS session.update] FULL ApiPilot tools list PASS-1 block (len=%d):\n%s\n",
+            len(apipilot_context_text_pass1.strip()), _strip_internal_markers(apipilot_context_text_pass1),
+        )
     # Also log the FINAL upstream instructions when S2S_DEBUG_PROMPT is on and
     # this is a session.update (so we see the EXACT text reaching the model even
     # when S2S_INJECT_PROFILE is off and no patch happened.)
@@ -1377,7 +3440,12 @@ async def config(request: Request):
     """Client bootstrap: whether web search is available, whether the deploy runs
     behind a load balancer (so the browser uses the /api/session proxy + limiter),
     whether HF sign-in is available, and whether the user may instead set a direct
-    s2s server URL. The LB address itself is intentionally NOT included."""
+    s2s server URL. The LB address itself is intentionally NOT included.
+
+    2026-09-24: new top-level `apipilot` flag. When True the deploy exposes the
+    new `/api/apipilot/tools` and `/api/apipilot/execute` proxy endpoints (see
+    GUIDA_APIPILOT_CLIENTE.md) that the browser may call directly instead of
+    hardcoding upstream tool URLs / names."""
     logger.debug("[INTERNAL] /api/config requested client=%s", request.client.host if request.client else "?")
     primary_prompt = S2S_PRIMARY_PROMPT
     out = {
@@ -1391,16 +3459,141 @@ async def config(request: Request):
         "injectProfile": S2S_INJECT_PROFILE,
         "debugPrompt": S2S_DEBUG_PROMPT,
         "startSessionMode": S2S_START_SESSION_MODE,
+        "theme": S2S_THEME,
+        "apipilot": bool(S2S_APIPILOT_TOOLS_URL),
     }
     logger.debug(
-        "[INTERNAL] /api/config returned promptLen=%d reasoning=%s startSessionMode=%s",
+        "[INTERNAL] /api/config returned promptLen=%d reasoning=%s startSessionMode=%s theme=%s apipilot=%s",
         len(primary_prompt),
         S2S_REASONING_TYPE,
         S2S_START_SESSION_MODE or "-",
+        S2S_THEME or "-",
+        out["apipilot"],
     )
     return out
 
 
+class ApipilotExecuteRequest(BaseModel):
+    """Body for the ApiPilot execute proxy endpoint. Mirrors §2.2 request shape."""
+    name: str
+    arguments: dict = {}
+
+
+@app.get("/api/apipilot/tools")
+async def apipilot_list_tools(
+    request: Request,
+    include_unauthorized: bool = True,
+    refresh: bool = False,
+):
+    """Public proxy for ApiPilot tool discovery (§2.1 della guida).
+
+    Forwards Authorization / x-demo-session headers from the caller to the
+    upstream backend verbatim and returns the list of `ToolDefinition` records
+    exactly as documented:
+
+        { "name": "...", "description": "...", "parameters": {...}, "requires_auth": true/false }
+
+    A short in-process TTL cache is applied (default 5 min, configurable via
+    S2S_APIPILOT_TTL_SEC). The client may force a refresh via `?refresh=true`
+    (e.g. after a user just logged in and previously saw only requires_auth tools)."""
+    if not S2S_APIPILOT_TOOLS_URL:
+        return JSONResponse(
+            status_code=501,
+            content={
+                "success": False,
+                "data": None,
+                "error": {
+                    "code": "APIPILOT_NOT_CONFIGURED",
+                    "message": "ApiPilot no está disponible en este despliegue (S2S_APIPILOT_TOOLS_URL no establecido).",
+                    "status_code": 501,
+                    "raw": None,
+                },
+            },
+        )
+    auth, demo = _apipilot_parse_authorization(request)
+    try:
+        tools = await _apipilot_fetch_tools(
+            auth_header=auth,
+            demo_session=demo,
+            include_unauthorized=bool(include_unauthorized),
+            force_refresh=bool(refresh),
+        )
+    except HTTPException as exc:
+        # Normalize to envelope-style payload so downstream code is uniform.
+        detail = exc.detail if isinstance(exc.detail, dict) else {
+            "code": "APIPILOT_ERROR",
+            "message": str(exc.detail) if exc.detail else "Error",
+            "status_code": exc.status_code,
+            "raw": None,
+        }
+        return JSONResponse(
+            status_code=exc.status_code,
+            content={"success": False, "data": None, "error": detail},
+        )
+    logger.info(
+        "[APIPILOT] /api/apipilot/tools OK tools=%d include_unauthorized=%s refresh=%s",
+        len(tools), bool(include_unauthorized), bool(refresh),
+    )
+    return {
+        "success": True,
+        "data": {
+            "count": len(tools),
+            "include_unauthorized": bool(include_unauthorized),
+            "tools": tools,
+        },
+        "error": None,
+    }
+
+
+@app.post("/api/apipilot/execute")
+async def apipilot_execute(request: Request, body: ApipilotExecuteRequest):
+    """Public proxy for ApiPilot /execute (§2.2 della guida).
+
+    Accepts `{name, arguments}`, runs the mandatory PRE-CHECK flow (fresh tool
+    discovery, `requires_auth` gate, strict JSON-Schema argument validation),
+    forwards the request to the upstream backend, and returns the envelope
+    `{success, data, error}`.
+
+    `error.message` è SEMPRE l'unico campo da mostrare all'utente finale; i
+    campi `error.code`, `error.status_code`, `error.raw` sono solo per audit
+    interno (vedi §2.2 "Comportamento UI consigliato sugli errori")."""
+    if not S2S_APIPILOT_TOOLS_URL:
+        return JSONResponse(
+            status_code=501,
+            content={
+                "success": False,
+                "data": None,
+                "error": {
+                    "code": "APIPILOT_NOT_CONFIGURED",
+                    "message": "ApiPilot no está disponible en este despliegue (S2S_APIPILOT_TOOLS_URL no establecido).",
+                    "status_code": 501,
+                    "raw": None,
+                },
+            },
+        )
+    auth, demo = _apipilot_parse_authorization(request)
+    logger.info("[APIPILOT-CALL-NAME] USE=API_ENDPOINT_EXECUTE name=%r argsKeys=%s authReceived=%s", (body.name or ""), sorted(list((body.arguments or {}).keys())) if isinstance(body.arguments, dict) else [], ("Y" if auth or demo else "none"))
+    envelope = await _apipilot_execute_tool(
+        auth_header=auth,
+        demo_session=demo,
+        name=body.name,
+        arguments=body.arguments if isinstance(body.arguments, dict) else {},
+    )
+    status_code = 200
+    if (not envelope.get("success")) and isinstance(envelope.get("error"), dict):
+        code = envelope["error"].get("status_code")
+        try:
+            code_int = int(code)
+            if 400 <= code_int < 599:
+                status_code = code_int
+        except Exception:
+            pass
+    logger.info(
+        "[APIPILOT] /api/apipilot/execute name=%s success=%s status=%s",
+        body.name, envelope.get("success"), status_code,
+    )
+    return JSONResponse(status_code=status_code, content=envelope)
+
 
 
 
@@ -1428,8 +3621,13 @@ async def reasoning(req: ReasoningRequest):
         )
     else:
         needs_phone_authed = bool(VOCERO_USER_PHONE_AUTH_URL.strip())
-        needs_reports = bool(S2S_REPORT_LIST.strip())
-        needs_summary = bool(S2S_LATEST_SUMMARY.strip())
+        # USER FIX 2026-09-11 "Elimina l'iniezione massiva di tutti i report schedulati":
+        #   treats S2S_REPORT_LIST as "need to fetch reports" ONLY when BOTH the URL is
+        #   configured AND the new opt-in S2S_INJECT_REPORTS flag is true. When
+        #   S2S_INJECT_REPORTS=false (default) needs_reports stays False here → we skip
+        #   the branch entirely, no HTTP call, no context string, no prompt bloat.
+        needs_reports = bool(S2S_REPORT_LIST.strip()) and S2S_INJECT_REPORTS
+        needs_summary = bool(S2S_LATEST_SUMMARY.strip()) or bool(S2S_LATEST_SUMMARY_TEXT)
         needs_login = bool(S2S_LOGIN_BY_PHONE.strip())
         can_inject = (
             needs_phone_authed or needs_reports or needs_summary or needs_login
@@ -1437,10 +3635,10 @@ async def reasoning(req: ReasoningRequest):
         )
         if (not needs_phone_authed) and (not needs_reports) and (not needs_summary) and (not needs_login) and (not episode_id):
             logger.info(
-                "[INJECT-PROFILE] ⏭️  REASONING: skipped (VOCERO_USER_PHONE_AUTH_URL, S2S_REPORT_LIST, S2S_LATEST_SUMMARY and S2S_LOGIN_BY_PHONE all empty, AND no episode_id in request). "
-                "Set at least one to enable login / fetch episode/profile/reports/summary for REASONING endpoint."
+                "[INJECT-PROFILE] ⏭️  REASONING: skipped (VOCERO_USER_PHONE_AUTH_URL, S2S_REPORT_LIST, S2S_LATEST_SUMMARY/S2S_LATEST_SUMMARY_TEXT and S2S_LOGIN_BY_PHONE all empty, AND no episode_id in request; OR S2S_INJECT_REPORTS is false so reports injection is globally disabled). "
+                "Set at least one AND set S2S_INJECT_REPORTS=true (if you want scheduled reports) to enable login / fetch episode/profile/reports/summary for REASONING endpoint."
             )
-        elif (not phone) and (not needs_reports) and (not episode_id):
+        elif (not phone) and (not needs_reports) and (not episode_id) and (not S2S_LATEST_SUMMARY_TEXT):
             logger.info(
                 "[INJECT-PROFILE] ⏭️  REASONING: skipped (phoneNumber missing from request body AND no episode_id). "
                 "Browser-side issue: check main.js passes voceroUserPhoneNumber and/or episode_id in JSON body. (Note: S2S_REPORT_LIST fetch works even without phone.)"
@@ -1516,24 +3714,80 @@ async def reasoning(req: ReasoningRequest):
             # ###################################################################
             # 2) Latest summary fetch (optional — only if env is configured)
             # ###################################################################
-            if needs_summary and phone:
+            if needs_summary and (phone or S2S_LATEST_SUMMARY_TEXT):
                 if S2S_DEBUG_PROMPT:
                     logger.info(
-                        "[INJECT-SUMMARY] starting REASONING fetch (reasoning summary... S2S_LATEST_SUMMARY configured; phoneLen=%d.",
-                        len(phone),
+                        "[INJECT-SUMMARY] starting REASONING fetch (reasoning summary... S2S_LATEST_SUMMARY=%s S2S_LATEST_SUMMARY_TEXT=%s phoneLen=%s.",
+                        bool(S2S_LATEST_SUMMARY),
+                        bool(S2S_LATEST_SUMMARY_TEXT),
+                        len(phone) if phone else "none",
                     )
                 latest_summary_raw = await _fetch_latest_summary_for_phone(phone, auth_token=login_token)
                 inject_summary_text = _resolve_latest_summary_context(latest_summary_raw)
                 if inject_summary_text.strip():
                     logger.info(
-                        "[INJECT-SUMMARY] ✅ REASONING: latest summary READY phoneLen=%d wrappedLen=%d -> augmenting instructions + user_context before sending upstream.",
-                        len(phone), len(inject_summary_text),
+                        "[INJECT-SUMMARY] ✅ REASONING: latest summary READY phoneLen=%s summaryTextOverride=%s wrappedLen=%d -> augmenting instructions + user_context before sending upstream.",
+                        len(phone) if phone else "none",
+                        bool(S2S_LATEST_SUMMARY_TEXT),
+                        len(inject_summary_text),
                     )
                 else:
                     logger.info(
                         "[INJECT-SUMMARY] ⏭️  REASONING: latest summary skipped (context empty / upstream returned empty summary / fetch failed.)"
                     )
+    # ── APIPILOT: carica strumenti dinamici PRIMA della costruzione context
+    # (gate globale: funziona sia con che senza S2S_INJECT_PROFILE)
+    needs_apipilot = bool(S2S_APIPILOT_TOOLS_URL) or bool(S2S_APIPILOT_TOOLS_EXECUTE_URL)
+    apipilot_tools_pass1: list[dict] = []
+    apipilot_auth_header: str | None = None
+    if isinstance(login_token, str) and login_token.strip():
+        tk = login_token.strip()
+        if tk.lower().startswith("bearer "):
+            apipilot_auth_header = tk
+        else:
+            apipilot_auth_header = f"Bearer {tk}"
+    # 2026-09-25 IMPORTANTE: S2S_LOGIN_BY_PHONE = aquachile.azurianlab.com AUTH PHONE LOGIN
+    #    → login_token È IL TOKEN JWT AQUAPORTAL VERO (non Vocero).
+    #    Lo usiamo SEMPRE per tool requires_auth=true (necessario per eseguire /execute).
+    #    S2S_APIPILOT_SERVICE_TOKEN se presente → OVERRIDE massima priorità.
+    if S2S_APIPILOT_SERVICE_TOKEN:
+        _svc = S2S_APIPILOT_SERVICE_TOKEN.strip()
+        if _svc:
+            apipilot_auth_header = (f"Bearer {_svc}" if not _svc.lower().startswith("bearer ") else _svc)
+    if needs_apipilot:
+        try:
+            apipilot_t0 = _monotonic_now()
+            apipilot_tools_pass1 = await _apipilot_fetch_tools(
+                auth_header=apipilot_auth_header,
+                demo_session=None,
+                force_refresh=False,
+            )
+            logger.info(
+                "[APIPILOT] REASONING PASS-1: lista strumenti pronta N=%d t=%dms auth=%s",
+                len(apipilot_tools_pass1),
+                int((_monotonic_now() - apipilot_t0) * 1000),
+                "Y" if apipilot_auth_header else "-",
+            )
+        except Exception as exc:
+            logger.warning("[APIPILOT] REASONING: fetch lista strumenti fallita, ignoro: %s", exc)
+            apipilot_tools_pass1 = []
+    inject_apipilot_text_pass1 = _resolve_apipilot_reasoning_context_block(
+        apipilot_tools_pass1, call_result=None,
+    )
+
     user_context_parts: list[str] = []
+    # ─── USER FIX BUG 3: TODAY fixed context block → PREPEND to user_context too
+    # (the same anti-hallucination block gets prefixed in the SYSTEM instructions
+    # path via _augment_instructions_with_profile; we also prepend here so the
+    # OPENAI/ANYSCALE messages[] array (where caller context is user_message[0])
+    # ALSO gets the same guard.)
+    # ─── USER FIX 2026-09-11 HALLUCINATION: voice_lock_block FIRST position
+    voice_lock_block = _build_voice_rules_head_lock_block(profile=profile_obj)
+    if voice_lock_block.strip():
+        user_context_parts.append(voice_lock_block)
+    today_block = _build_today_fixed_context_block()
+    if today_block.strip():
+        user_context_parts.append(today_block)
     if inject_episode_text:
         user_context_parts.append(inject_episode_text)
     if inject_profile_text:
@@ -1542,9 +3796,48 @@ async def reasoning(req: ReasoningRequest):
         user_context_parts.append(inject_reports_text)
     if inject_summary_text:
         user_context_parts.append(inject_summary_text)
+    if inject_apipilot_text_pass1:
+        user_context_parts.append(inject_apipilot_text_pass1)
     original_user_context = (req.user_context or "").strip()
     if original_user_context:
         user_context_parts.append(original_user_context)
+    user_context_parts = _dedup_context_blocks_by_type(user_context_parts)
+    if original_user_context:
+        server_injected_types_in_client_ctx: set = set()
+        for part in user_context_parts:
+            if original_user_context and (part or "").strip() == original_user_context:
+                continue
+            tid = _classify_context_block(part)
+            if tid is None:
+                continue
+            for marker_tid, marker in _CONTEXT_DEDUPE_MARKERS:
+                if marker_tid == tid and marker and marker in original_user_context:
+                    server_injected_types_in_client_ctx.add(tid)
+                    break
+        if server_injected_types_in_client_ctx:
+            new_parts: list[str] = []
+            for part in user_context_parts:
+                if (part or "").strip() == original_user_context:
+                    new_parts.append(part)
+                    continue
+                tid = _classify_context_block(part)
+                if tid in server_injected_types_in_client_ctx:
+                    continue
+                new_parts.append(part)
+            if S2S_DEBUG_PROMPT and new_parts != user_context_parts:
+                logger.info(
+                    "[INJECT-DEDUPE] dropped server-injected profile/episode/reports/summary because the same block type was already present in req.user_context client-side context=%s kept=%d",
+                    ", ".join(sorted(server_injected_types_in_client_ctx)),
+                    len(new_parts),
+                )
+            user_context_parts = new_parts
+    # ─── 2026-09-11 MARKER LEAK GUARD: strip invisible internal sentinels from EACH part.
+    stripped_parts: list[str] = []
+    for p in user_context_parts:
+        sp = _strip_internal_markers(p)
+        if sp:
+            stripped_parts.append(sp)
+    user_context_parts = stripped_parts
     effective_user_context = "\n\n".join(user_context_parts)
     if S2S_INJECT_PROFILE:
         any_injected = bool(inject_episode_text or inject_profile_text or inject_reports_text or inject_summary_text)
@@ -1559,26 +3852,71 @@ async def reasoning(req: ReasoningRequest):
                 len(original_user_context),
                 len(effective_user_context),
             )
+        if S2S_DEBUG_PROMPT and voice_lock_block.strip():
+            logger.info(
+                "[DEBUG-VOICELOCK][REASONING augment] FULL voice lock block (len=%d):\n%s\n",
+                len(voice_lock_block), _strip_internal_markers(voice_lock_block),
+            )
         if S2S_DEBUG_PROMPT and inject_episode_text.strip():
             logger.info(
                 "[DEBUG-EPISODE][REASONING augment] FULL podcast episode block (len=%d):\n%s\n",
-                len(inject_episode_text), inject_episode_text,
+                len(inject_episode_text), _strip_internal_markers(inject_episode_text),
+            )
+        if S2S_DEBUG_PROMPT and today_block.strip():
+            logger.info(
+                "[DEBUG-TODAY][REASONING augment] FULL today block (len=%d):\n%s\n",
+                len(today_block), _strip_internal_markers(today_block),
             )
         if S2S_DEBUG_PROMPT and inject_reports_text.strip():
             logger.info(
                 "[DEBUG-REPORTS][REASONING augment] FULL reports list block (len=%d):\n%s\n",
-                len(inject_reports_text), inject_reports_text,
+                len(inject_reports_text), _strip_internal_markers(inject_reports_text),
             )
         if S2S_DEBUG_PROMPT and inject_summary_text.strip():
             logger.info(
                 "[DEBUG-SUMMARY][REASONING augment] FULL latest summary block (len=%d):\n%s\n",
-                len(inject_summary_text), inject_summary_text,
+                len(inject_summary_text), _strip_internal_markers(inject_summary_text),
+            )
+        if S2S_DEBUG_PROMPT and inject_profile_text.strip():
+            logger.info(
+                "[DEBUG-PROFILE][REASONING augment] FULL profile block (len=%d):\n%s\n",
+                len(inject_profile_text), _strip_internal_markers(inject_profile_text),
+            )
+        if S2S_DEBUG_PROMPT and inject_apipilot_text_pass1.strip():
+            logger.info(
+                "[DEBUG-APIPILOT][REASONING augment] FULL ApiPilot tools list block (len=%d):\n%s\n",
+                len(inject_apipilot_text_pass1), _strip_internal_markers(inject_apipilot_text_pass1),
+            )
+        if needs_apipilot and inject_apipilot_text_pass1.strip():
+            logger.info(
+                "[INJECT-APIPILOT] REASONING PASS-1: inject lista strumenti (len=%d, Ntools=%d) IN instructions (oltre user_context).",
+                len(inject_apipilot_text_pass1), len(apipilot_tools_pass1),
             )
         effective_instructions = _augment_instructions_with_profile(
-            req.instructions or "", inject_profile_text, inject_reports_text, inject_summary_text, inject_episode_text
+            req.instructions or "", inject_profile_text, inject_reports_text, inject_summary_text, inject_episode_text,
+            profile_obj=profile_obj,
         )
+        if inject_apipilot_text_pass1.strip():
+            effective_instructions = (
+                (effective_instructions + "\n\n" if effective_instructions else "")
+                + inject_apipilot_text_pass1
+            )
     else:
         effective_instructions = (req.instructions or "").strip()
+        if inject_apipilot_text_pass1.strip():
+            logger.info(
+                "[INJECT-APIPILOT] REASONING PASS-1: inject lista strumenti (len=%d, Ntools=%d) IN instructions (inject_profile=false).",
+                len(inject_apipilot_text_pass1), len(apipilot_tools_pass1),
+            )
+            effective_instructions = (
+                (effective_instructions + "\n\n" if effective_instructions else "")
+                + inject_apipilot_text_pass1
+            )
+        if S2S_DEBUG_PROMPT and inject_apipilot_text_pass1.strip():
+            logger.info(
+                "[DEBUG-APIPILOT][REASONING augment] FULL ApiPilot tools list block (len=%d):\n%s\n",
+                len(inject_apipilot_text_pass1), _strip_internal_markers(inject_apipilot_text_pass1),
+            )
 
     # ────────────────────────────────────────────────────────────────────
     # Modalità A: NODE_RED — inoltra TUTTO il payload a Node-RED
@@ -1682,6 +4020,149 @@ async def reasoning(req: ReasoningRequest):
         if usage:
             out["usage"] = usage
         out.update({k: v for k, v in extra.items() if k != "debug" or logger.level <= logging.DEBUG})
+        # ── APIPILOT: cattura marker → esegui tool → SECONDA PASSATA reasoning
+        tool_name_p1, tool_args_p1 = _apipilot_parse_call_marker(answer_stripped)
+        if tool_name_p1:
+            logger.info("[APIPILOT-CALL-NAME] USE=NODE_RED_PASS2_TRIGGER name=%r argsKeys=%s", tool_name_p1, sorted(list((tool_args_p1 or {}).keys())))
+            logger.info(
+                "[APIPILOT] REASONING PASS-2 trigger NODE_RED marker name=%s args=%s",
+                tool_name_p1,
+                json.dumps(tool_args_p1 or {}, ensure_ascii=True)[:300],
+            )
+            logger.info("[APIPILOT-CALL-NAME] USE=NODE_RED_PASS2_EXEC_HELPER name=%r → forward a _apipilot_execute_tool", tool_name_p1)
+            tool_env_p1 = await _apipilot_execute_tool(
+                auth_header=apipilot_auth_header,
+                demo_session=None,
+                name=tool_name_p1,
+                arguments=tool_args_p1 or {},
+            )
+            is_tool_err = not bool(tool_env_p1.get("success"))
+            tool_data = tool_env_p1.get("data")
+            if isinstance(tool_data, str):
+                tool_text_p1 = tool_data
+            elif tool_data is None:
+                tool_text_p1 = ""
+            else:
+                try:
+                    tool_text_p1 = json.dumps(tool_data, ensure_ascii=False, indent=2)
+                except Exception:
+                    tool_text_p1 = str(tool_data)
+            if is_tool_err and isinstance(tool_env_p1.get("error"), dict):
+                err = tool_env_p1["error"]
+                err_head = f"[{err.get('code')}] {err.get('message')}"
+                tool_text_p1 = (err_head + ("\n" + tool_text_p1 if tool_text_p1.strip() else "")).strip()
+            inject_apipilot_text_pass2 = _resolve_apipilot_reasoning_context_block(
+                [],
+                call_result={
+                    "name": tool_name_p1,
+                    "text": tool_text_p1,
+                    "error": is_tool_err,
+                },
+            )
+            logger.info(
+                "[APIPILOT] REASONING PASS-2 execute name=%s success=%s httpResultLen=%d trigger seconda chiamata Node-RED",
+                tool_name_p1,
+                str(not is_tool_err).lower(),
+                len(tool_text_p1),
+            )
+            # Build user_context 2nd pass: mette risultato tool ALL'INIZIO (voce
+            # blocco oggi + regole vocali + profile ... ma SOSTITUISCE la lista
+            # strumenti di passata 1 con il risultato della exec).
+            user_ctx_parts_2: list[str] = []
+            if voice_lock_block.strip():
+                user_ctx_parts_2.append(voice_lock_block)
+            if today_block.strip():
+                user_ctx_parts_2.append(today_block)
+            if inject_episode_text:
+                user_ctx_parts_2.append(inject_episode_text)
+            if inject_profile_text:
+                user_ctx_parts_2.append(inject_profile_text)
+            if inject_reports_text:
+                user_ctx_parts_2.append(inject_reports_text)
+            if inject_summary_text:
+                user_ctx_parts_2.append(inject_summary_text)
+            if inject_apipilot_text_pass2:
+                user_ctx_parts_2.append(inject_apipilot_text_pass2)
+            if original_user_context:
+                user_ctx_parts_2.append(original_user_context)
+            user_ctx_parts_2 = _dedup_context_blocks_by_type(user_ctx_parts_2)
+            stripped_2: list[str] = []
+            for p in user_ctx_parts_2:
+                sp = _strip_internal_markers(p)
+                if sp:
+                    stripped_2.append(sp)
+            user_ctx_parts_2 = stripped_2
+            effective_user_ctx_2 = "\n\n".join(user_ctx_parts_2)
+            # Istruzioni per seconda passata: stesse augment, ma senza istruzioni
+            # marker (tanto il blocco risultato dice come si rielabora).
+            if S2S_INJECT_PROFILE:
+                eff_inst_2 = _augment_instructions_with_profile(
+                    req.instructions or "", inject_profile_text, inject_reports_text,
+                    inject_summary_text, inject_episode_text, profile_obj=profile_obj,
+                )
+            else:
+                eff_inst_2 = (req.instructions or "").strip()
+            if inject_apipilot_text_pass2.strip():
+                eff_inst_2 = (
+                    (eff_inst_2 + "\n\n" if eff_inst_2 else "")
+                    + inject_apipilot_text_pass2
+                )
+            upstream_body_2 = {
+                "transcript": transcript,
+                "instructions": eff_inst_2,
+                "language": (req.language or "").strip(),
+                "user_context": effective_user_ctx_2,
+            }
+            if S2S_DEBUG_PROMPT:
+                logger.info(
+                    "[DEBUG-PROMPT][REASONING → NODE_RED PASS-2] FULL upstream_body_2 JSON:\n%s\n",
+                    json.dumps(upstream_body_2, ensure_ascii=False, indent=2),
+                )
+            try:
+                async with httpx.AsyncClient(timeout=120.0) as http2:
+                    resp2 = await http2.post(
+                        f"{NODE_RED_REASONING_URL}/api/reasoning",
+                        json=upstream_body_2,
+                        headers={
+                            "Content-Type": "application/json",
+                            "X-S2S-Caller": "demo-server-pass2",
+                        },
+                    )
+            except httpx.RequestError as exc:
+                logger.warning("[EXT][NODE_RED PASS-2] unreachable: %r", exc)
+                raise HTTPException(status_code=502, detail="Node-RED reasoning engine is unreachable (pass 2).")
+            if resp2.status_code != 200:
+                logger.warning("[EXT][NODE_RED PASS-2] failed %s: %s", resp2.status_code, resp2.text[:500])
+                raise HTTPException(status_code=502, detail=f"Node-RED reasoning pass 2 failed (HTTP {resp2.status_code}).")
+            try:
+                payload2 = resp2.json()
+            except Exception:
+                logger.warning("[EXT][NODE_RED PASS-2] invalid JSON: %s", resp2.text[:500])
+                raise HTTPException(status_code=502, detail="Node-RED returned invalid JSON (pass 2).")
+            final_ans = payload2.get("answer") if isinstance(payload2, dict) else None
+            if not isinstance(final_ans, str):
+                # Fallback: primo messaggio + risultato raw
+                logger.warning("[EXT][NODE_RED PASS-2] answer invalido, fallback a risposta raw text")
+                final_ans = tool_text_p1 or answer_stripped
+            final_stripped = final_ans.strip()
+            # log_only SEMPRE False nella seconda passata (perché ha già la
+            # risposta definitiva da trasmettere al canale vocale).
+            out2: dict = {"answer": final_stripped}
+            usage2 = payload2.get("usage") if isinstance(payload2, dict) else None
+            if usage2:
+                out2["usage_pass2"] = usage2
+            out2["apipilot_invoked"] = {
+                "name": tool_name_p1,
+                "success": not is_tool_err,
+                "result_length": len(tool_text_p1),
+            }
+            logger.info(
+                "[Vocero REASONING] engine=NODE_RED PASS-2 transcript=%s finalAnswer=%s apipilot=%s",
+                transcript[:300], final_stripped[:500],
+                json.dumps(out2["apipilot_invoked"], ensure_ascii=True),
+            )
+            return JSONResponse(out2)
+        # Nessun marker → return passata 1 come design iniziale
         return JSONResponse(out)
 
     # ────────────────────────────────────────────────────────────────────
@@ -1695,6 +4176,8 @@ async def reasoning(req: ReasoningRequest):
         system_parts.append(instructions)
     if effective_user_context.strip():
         system_parts.append(f"User context:\n{effective_user_context.strip()}")
+    if inject_apipilot_text_pass1:
+        system_parts.append(inject_apipilot_text_pass1)
     if req.language.strip():
         system_parts.append(
             "Reply only with the final assistant answer text. "
@@ -1773,6 +4256,162 @@ async def reasoning(req: ReasoningRequest):
         logger.warning("OpenAI reasoning returned empty answer: %s", json.dumps(payload, ensure_ascii=True)[:800])
         raise HTTPException(status_code=502, detail="OpenAI reasoning returned no answer.")
     logger.info("[Vocero REASONING] engine=OPENAI transcript=%s answer=%s", transcript[:300], answer[:500])
+    # ── APIPILOT: cattura marker → esecuzione tool → SECONDA PASSATA OPENAI
+    tool_name_p1_oai, tool_args_p1_oai = _apipilot_parse_call_marker(answer)
+    if tool_name_p1_oai:
+        logger.info("[APIPILOT-CALL-NAME] USE=OPENAI_PASS2_TRIGGER name=%r argsKeys=%s", tool_name_p1_oai, sorted(list((tool_args_p1_oai or {}).keys())))
+        logger.info(
+            "[APIPILOT] REASONING PASS-2 trigger OPENAI marker name=%s args=%s",
+            tool_name_p1_oai,
+            json.dumps(tool_args_p1_oai or {}, ensure_ascii=True)[:300],
+        )
+        logger.info("[APIPILOT-CALL-NAME] USE=OPENAI_PASS2_EXEC_HELPER name=%r → forward a _apipilot_execute_tool", tool_name_p1_oai)
+        tool_env_oai_p1 = await _apipilot_execute_tool(
+            auth_header=apipilot_auth_header,
+            demo_session=None,
+            name=tool_name_p1_oai,
+            arguments=tool_args_p1_oai or {},
+        )
+        is_tool_err_oai = not bool(tool_env_oai_p1.get("success"))
+        tool_data_oai = tool_env_oai_p1.get("data")
+        if isinstance(tool_data_oai, str):
+            tool_text_oai = tool_data_oai
+        elif tool_data_oai is None:
+            tool_text_oai = ""
+        else:
+            try:
+                tool_text_oai = json.dumps(tool_data_oai, ensure_ascii=False, indent=2)
+            except Exception:
+                tool_text_oai = str(tool_data_oai)
+        if is_tool_err_oai and isinstance(tool_env_oai_p1.get("error"), dict):
+            err_oai = tool_env_oai_p1["error"]
+            err_oai_head = f"[{err_oai.get('code')}] {err_oai.get('message')}"
+            tool_text_oai = (err_oai_head + ("\n" + tool_text_oai if tool_text_oai.strip() else "")).strip()
+        inject_apipilot_pass2_oai = _resolve_apipilot_reasoning_context_block(
+            [],
+            call_result={
+                "name": tool_name_p1_oai,
+                "text": tool_text_oai,
+                "error": is_tool_err_oai,
+            },
+        )
+        logger.info(
+            "[APIPILOT] REASONING PASS-2 OPENAI execute name=%s success=%s resultLen=%d → seconda chiamata chat/completions",
+            tool_name_p1_oai,
+            str(not is_tool_err_oai).lower(),
+            len(tool_text_oai),
+        )
+        # Build pass2: stesso instructions + user_context ma SOSTITUISCO la
+        # lista strumenti (inject_apipilot_text_pass1) con il blocco risultato
+        # (inject_apipilot_pass2_oai). Riuso lo stesso parts pattern iniziale.
+        user_ctx_oai_2: list[str] = []
+        if voice_lock_block.strip():
+            user_ctx_oai_2.append(voice_lock_block)
+        if today_block.strip():
+            user_ctx_oai_2.append(today_block)
+        if inject_episode_text:
+            user_ctx_oai_2.append(inject_episode_text)
+        if inject_profile_text:
+            user_ctx_oai_2.append(inject_profile_text)
+        if inject_reports_text:
+            user_ctx_oai_2.append(inject_reports_text)
+        if inject_summary_text:
+            user_ctx_oai_2.append(inject_summary_text)
+        if inject_apipilot_pass2_oai:
+            user_ctx_oai_2.append(inject_apipilot_pass2_oai)
+        if original_user_context:
+            user_ctx_oai_2.append(original_user_context)
+        user_ctx_oai_2 = _dedup_context_blocks_by_type(user_ctx_oai_2)
+        stripped_oai_2: list[str] = []
+        for p in user_ctx_oai_2:
+            sp = _strip_internal_markers(p)
+            if sp:
+                stripped_oai_2.append(sp)
+        user_ctx_oai_2 = stripped_oai_2
+        eff_user_ctx_oai_2 = "\n\n".join(user_ctx_oai_2)
+        if S2S_INJECT_PROFILE:
+            eff_inst_oai_2 = _augment_instructions_with_profile(
+                req.instructions or "", inject_profile_text, inject_reports_text,
+                inject_summary_text, inject_episode_text, profile_obj=profile_obj,
+            )
+        else:
+            eff_inst_oai_2 = (req.instructions or "").strip()
+        sys_parts_oai_2: list[str] = []
+        instr_oai_2 = eff_inst_oai_2 or ((req.instructions or "").strip())
+        if instr_oai_2:
+            sys_parts_oai_2.append(instr_oai_2)
+        if eff_user_ctx_oai_2.strip():
+            sys_parts_oai_2.append(f"User context:\n{eff_user_ctx_oai_2.strip()}")
+        if inject_apipilot_pass2_oai:
+            sys_parts_oai_2.append(inject_apipilot_pass2_oai)
+        if req.language.strip():
+            sys_parts_oai_2.append(
+                "Reply only with the final assistant answer text. "
+                f"Keep the answer natural and concise in this language: {req.language.strip()}."
+            )
+        else:
+            sys_parts_oai_2.append(
+                "Reply only with the final assistant answer text. Keep the answer natural and concise."
+            )
+        system_msg_oai_2 = "\n\n".join(sys_parts_oai_2)
+        body_oai_2 = {
+            "model": OPENAI_REASONING_MODEL,
+            "messages": [
+                {"role": "system", "content": system_msg_oai_2},
+                {"role": "user", "content": transcript},
+            ],
+        }
+        if S2S_DEBUG_PROMPT:
+            logger.info(
+                "[DEBUG-PROMPT][REASONING → OPENAI PASS-2] FULL SYSTEM message (len=%d):\n%s\n",
+                len(system_msg_oai_2), system_msg_oai_2,
+            )
+        try:
+            async with httpx.AsyncClient(timeout=30.0) as http_oai2:
+                resp_oai_2 = await http_oai2.post(
+                    f"{OPENAI_BASE_URL}/chat/completions",
+                    headers=_openai_headers(),
+                    json=body_oai_2,
+                )
+        except httpx.RequestError as exc:
+            logger.warning("[EXT][OPENAI PASS-2] unreachable: %r", exc)
+            raise HTTPException(status_code=502, detail="OpenAI reasoning unreachable (pass 2).")
+        if resp_oai_2.status_code != 200:
+            logger.warning("[EXT][OPENAI PASS-2] failed %s: %s", resp_oai_2.status_code, resp_oai_2.text[:400])
+            raise HTTPException(status_code=502, detail=f"OpenAI reasoning pass 2 failed ({resp_oai_2.status_code}).")
+        try:
+            payload_oai_2 = resp_oai_2.json()
+        except Exception:
+            logger.warning("[EXT][OPENAI PASS-2] invalid JSON: %s", resp_oai_2.text[:400])
+            raise HTTPException(status_code=502, detail="OpenAI reasoning returned invalid JSON (pass 2).")
+        final_oai_ans = ""
+        choices_oai_2 = payload_oai_2.get("choices")
+        if isinstance(choices_oai_2, list) and choices_oai_2:
+            msg_oai_2 = choices_oai_2[0].get("message") if isinstance(choices_oai_2[0], dict) else None
+            if isinstance(msg_oai_2, dict):
+                content_oai_2 = msg_oai_2.get("content")
+                if isinstance(content_oai_2, str):
+                    final_oai_ans = content_oai_2.strip()
+        usage_oai_2 = payload_oai_2.get("usage")
+        if not final_oai_ans:
+            # Fallback: testo raw risposta strumento come ultima ratio
+            logger.warning("[EXT][OPENAI PASS-2] answer vuota, fallback testo raw risultato strumento")
+            final_oai_ans = (tool_text_oai or answer).strip()
+        final_out_oai: dict = {"answer": final_oai_ans}
+        if usage_oai_2:
+            final_out_oai["usage_pass2"] = usage_oai_2
+        final_out_oai["apipilot_invoked"] = {
+            "name": tool_name_p1_oai,
+            "success": not is_tool_err_oai,
+            "result_length": len(tool_text_oai),
+        }
+        logger.info(
+            "[Vocero REASONING] engine=OPENAI PASS-2 transcript=%s finalAnswer=%s apipilot=%s",
+            transcript[:300], final_oai_ans[:500],
+            json.dumps(final_out_oai["apipilot_invoked"], ensure_ascii=True),
+        )
+        return JSONResponse(final_out_oai)
+    # Nessun marker → risposta pass 1 originale
     return JSONResponse({"answer": answer})
 
 
@@ -1835,21 +4474,98 @@ async def realtime_proxy(ws: WebSocket):
     injected_profile_context = ""
     injected_reports_context = ""
     injected_summary_context = ""
+    injected_apipilot_pass1 = ""
+    apipilot_tools_pass1: list = []
     inject_phone = ""
     inject_episode_id = ""
+    client_query = {}
     login_token: str | None = None
     login_response_obj: dict | None = None
+    profile_obj: dict | None = None
+    needs_apipilot = bool(S2S_APIPILOT_TOOLS_URL) or bool(S2S_APIPILOT_TOOLS_EXECUTE_URL)
+    try:
+        client_query = dict(parse_qsl(ws.url.query, keep_blank_values=True))
+    except Exception:  # noqa: BLE001
+        client_query = {}
+
+    # ── 2026-09-25 EXTRACT QS + LOGIN PER APIPILOT SEMPRE (fuori gate S2S_INJECT_PROFILE) ──
+    # Perché needs_apipilot è INDIPENDENTE da S2S_INJECT_PROFILE (ApiPilot serve anche
+    # quando non si vuole inject del profilo).
+    # 1) phone + episode_id SEMPRE estratti da ?querystring se needs_apipilot=True
+    # 2) S2S_LOGIN_BY_PHONE bearer SEMPRE ottenuto per tools requires_auth=True (403 anon oggi)
+    # 3) profile_obj SEMPRE risolto se VOCERO_USER_PHONE_AUTH_URL + phone (per email defaults)
+    if needs_apipilot:
+        inject_phone = (client_query.get("phoneNumber") or "").strip() or inject_phone
+        inject_episode_id = (client_query.get("episode_id") or "").strip() or inject_episode_id
+        _needs_login_apipilot = bool(S2S_LOGIN_BY_PHONE.strip())
+        _needs_profile_apipilot = bool(VOCERO_USER_PHONE_AUTH_URL.strip())
+        # 2026-09-25 Diagnostica SEMPRE-ATTIVA WS connect STATO INIZIALE (prima di qualsiasi cosa)
+        #    così sappiamo sempre se inject_phone è arrivato, login_token quanto è lungo,
+        #    S2S_LOGIN_BY_PHONE è configurato, ecc. Serve a vedere perché user=(anon) in AquaPortal.
+        _s_init = {
+            "needs_apipilot": needs_apipilot,
+            "phoneLen": len(inject_phone or ""),
+            "phoneHead": (("+" + inject_phone.lstrip("+")[:3] + "...") if (inject_phone and len(inject_phone) > 6) else (inject_phone or "")),
+            "loginTokenLen": (len(login_token) if isinstance(login_token, str) and login_token.strip() else 0),
+            "loginByPhone": ("YES" if _needs_login_apipilot else "NO"),
+            "profileUrl": ("YES" if _needs_profile_apipilot else "NO"),
+            "S2S_INJECT_PROFILE": S2S_INJECT_PROFILE,
+        }
+        logger.info(
+            "[INJECT-APIPILOT][WS connect] STATO INIZIALE (sempre): " + ", ".join("%s=%s" % (k, v) for k, v in sorted(_s_init.items())),
+        )
+        # 2026-09-25 API KEY BYPASS ATTIVA → saltiamo completamente login_by_phone (non serve)
+        if not S2S_APIPILOT_API_KEY and _needs_login_apipilot and inject_phone and (not isinstance(login_token, str) or not login_token.strip() or (isinstance(login_token, str) and 0 < len(login_token.strip()) < 80)):
+            try:
+                login_token, _lresp = await _login_by_phone(inject_phone)
+                if isinstance(_lresp, dict) and _lresp:
+                    login_response_obj = _lresp
+                logger.info(
+                    "[INJECT-APIPILOT][WS connect] login_by_phone SEMPRE (per Apipilot execute requires_auth) phoneLen=%d token=%s",
+                    len(inject_phone or ""),
+                    ("YES len=%d" % len(login_token or "")) if isinstance(login_token, str) and login_token else "NONE (403!)",
+                )
+            except Exception as _exc_login:  # noqa: BLE001
+                logger.info(
+                    "[INJECT-APIPILOT][WS connect] login_by_phone failed (Apipilot user ANON, 403 probabile) phoneLen=%d err=%r",
+                    len(inject_phone or ""), _exc_login,
+                )
+        if _needs_profile_apipilot and inject_phone and (not isinstance(profile_obj, dict) or not profile_obj):
+            try:
+                profile_obj = await _fetch_user_profile_for_phone(inject_phone, auth_token=login_token)
+                logger.info(
+                    "[INJECT-APIPILOT][WS connect] profile fetch SEMPRE (per email defaults) phoneLen=%d profile=%s",
+                    len(inject_phone or ""),
+                    ("FOUND user=%s" % (((profile_obj or {}).get("user") or {}).get("name") or "?")) if isinstance(profile_obj, dict) else "NONE",
+                )
+            except Exception as _exc_p:  # noqa: BLE001
+                logger.info(
+                    "[INJECT-APIPILOT][WS connect] profile fetch failed phoneLen=%d err=%r",
+                    len(inject_phone or ""), _exc_p,
+                )
+
+    if not needs_apipilot:
+        logger.info(
+            "[INJECT-APIPILOT] ⏭️  WS connect: APIPILOT tools injection DISABLED (S2S_APIPILOT_TOOLS_URL='%s' S2S_APIPILOT_TOOLS_EXECUTE_URL='%s'). "
+            "Nessun fetch e nessun patch session.update per ApiPilot in questo tunnel.",
+            S2S_APIPILOT_TOOLS_URL,
+            S2S_APIPILOT_TOOLS_EXECUTE_URL,
+        )
     if not S2S_INJECT_PROFILE:
         logger.info(
             "[INJECT-PROFILE] ⏭️  WS connect: SKIPPED (S2S_INJECT_PROFILE=false). "
-            "No profile/episode fetch; tunnel stays pure passthrough."
+            "No profile/episode fetch; tunnel stays pure passthrough for injects EXCEPT apipilot."
         )
     else:
         needs_phone_authed = bool(VOCERO_USER_PHONE_AUTH_URL.strip())
-        needs_reports = bool(S2S_REPORT_LIST.strip())
-        needs_summary = bool(S2S_LATEST_SUMMARY.strip())
+        # USER FIX 2026-09-11 "Elimina l'iniezione massiva di tutti i report schedulati":
+        #   SAME gate as the REASONING endpoint above. "needs_reports" becomes True
+        #   only when BOTH the URL env is configured AND the new opt-in S2S_INJECT_REPORTS
+        #   flag is true. With the default (S2S_INJECT_REPORTS=false) this entire 1.5)
+        #   branch of the WS connect path is skipped — reports-list fetch never runs.
+        needs_reports = bool(S2S_REPORT_LIST.strip()) and S2S_INJECT_REPORTS
+        needs_summary = bool(S2S_LATEST_SUMMARY.strip()) or bool(S2S_LATEST_SUMMARY_TEXT)
         needs_login = bool(S2S_LOGIN_BY_PHONE.strip())
-        client_query = dict(parse_qsl(ws.url.query, keep_blank_values=True))
         inject_phone = (client_query.get("phoneNumber") or "").strip()
         inject_episode_id = (client_query.get("episode_id") or "").strip()
         can_inject = (
@@ -1858,14 +4574,15 @@ async def realtime_proxy(ws: WebSocket):
         )
         if not can_inject:
             logger.info(
-                "[INJECT-PROFILE] ⏭️  WS connect: SKIPPED (VOCERO_USER_PHONE_AUTH_URL, S2S_REPORT_LIST, S2S_LATEST_SUMMARY and S2S_LOGIN_BY_PHONE all empty, AND no episode_id in query). "
-                "Set at least one with S2S_INJECT_PROFILE=true to enable caller context / reports / login / episode."
+                "[INJECT-PROFILE] ⏭️  WS connect: SKIPPED (VOCERO_USER_PHONE_AUTH_URL, S2S_REPORT_LIST, S2S_LATEST_SUMMARY/S2S_LATEST_SUMMARY_TEXT and S2S_LOGIN_BY_PHONE all empty, AND no episode_id in query; OR S2S_INJECT_REPORTS is false so scheduled report injection is globally disabled). "
+                "Set at least one AND set S2S_INJECT_REPORTS=true (if you want scheduled reports) to enable caller context / reports / login / episode."
             )
-        elif (not inject_phone) and (not needs_reports) and (not inject_episode_id):
-            # reports list can be fetched without phone (generic list); episode can be fetched without phone
+        elif (not inject_phone) and (not needs_reports) and (not inject_episode_id) and (not S2S_LATEST_SUMMARY_TEXT):
+            # reports list can be fetched without phone (generic list); episode can be fetched without phone;
+            # S2S_LATEST_SUMMARY_TEXT also works without phone (static text override)
             logger.info(
-                "[INJECT-PROFILE] ⏭️  WS connect: SKIPPED (incoming WS query has NO ?phoneNumber= AND no ?episode_id=, AND S2S_REPORT_LIST not set). "
-                "Make sure the browser opens the WS with the phone or episode_id query param."
+                "[INJECT-PROFILE] ⏭️  WS connect: SKIPPED (incoming WS query has NO ?phoneNumber= AND no ?episode_id=, AND S2S_REPORT_LIST+S2S_INJECT_REPORTS not enabled). "
+                "Make sure the browser opens the WS with the phone or episode_id query param, or set S2S_INJECT_REPORTS=true if you want scheduled reports without phone."
             )
         else:
             # 0) Login-by-phone (optional — only if S2S_LOGIN_BY_PHONE env is set).
@@ -1928,29 +4645,141 @@ async def realtime_proxy(ws: WebSocket):
                         "[INJECT-REPORTS] ⏭️  WS connect: reports list skipped (context empty / upstream returned empty list / fetch failed)."
                     )
             # 2) Latest summary fetch (optional — only if env is set)
-            if needs_summary and inject_phone:
+            if needs_summary and (inject_phone or S2S_LATEST_SUMMARY_TEXT):
                 if S2S_DEBUG_PROMPT:
                     logger.info(
-                        "[INJECT-SUMMARY] WS connect: starting S2S_LATEST_SUMMARY fetch for phoneLen=%d...",
-                        len(inject_phone),
+                        "[INJECT-SUMMARY] WS connect: starting summary load (S2S_LATEST_SUMMARY=%s S2S_LATEST_SUMMARY_TEXT=%s phoneLen=%s)...",
+                        bool(S2S_LATEST_SUMMARY),
+                        bool(S2S_LATEST_SUMMARY_TEXT),
+                        len(inject_phone) if inject_phone else "none",
                     )
                 latest_summary_raw = await _fetch_latest_summary_for_phone(inject_phone, auth_token=login_token)
                 injected_summary_context = _resolve_latest_summary_context(latest_summary_raw)
                 if injected_summary_context.strip():
                     logger.info(
-                        "[INJECT-SUMMARY] ✅ WS connect: latest SUMMARY READY phoneLen=%d wrappedLen=%d -> will patch session.update frames in this tunnel.",
-                        len(inject_phone), len(injected_summary_context),
+                        "[INJECT-SUMMARY] ✅ WS connect: latest SUMMARY READY phoneLen=%s summaryTextOverride=%s wrappedLen=%d -> will patch session.update frames in this tunnel.",
+                        len(inject_phone) if inject_phone else "none",
+                        bool(S2S_LATEST_SUMMARY_TEXT),
+                        len(injected_summary_context),
                     )
                 else:
                     logger.info(
                         "[INJECT-SUMMARY] ⏭️  WS connect: latest summary skipped (context empty / upstream returned empty summary / fetch failed)."
                     )
+    # 3) ApiPilot tools list fetch (PASSATA-1) — INDIRIZZO FISSO ALL'AI-SERVER SIA IN S2S_INJECT_PROFILE=True che False.
+    #    Siamo indipendenti dal flag profilo perché l'utente ha chiesto che la lista arrivi
+    #    sempre, anche quando non c'è login/phone. Usa login_token se presente (stesso bearer di reasoning),
+    #    altrimenti usa "anon" fingerprint (stesso cache server-side reasoning).
+    if needs_apipilot:
+        apipilot_auth_header = (f"Bearer {login_token}" if isinstance(login_token, str) and login_token.strip() else None)
+        # 2026-09-25 IMPORTANTE: S2S_LOGIN_BY_PHONE = aquachile AUTH PHONE LOGIN
+        #    → login_token È IL TOKEN JWT AQUAPORTAL VERO. Lo usiamo per execute.
+        #    S2S_APIPILOT_SERVICE_TOKEN (se valorizzato in .env) → OVERRIDE massimo.
+        if S2S_APIPILOT_SERVICE_TOKEN:
+            _svc = S2S_APIPILOT_SERVICE_TOKEN.strip()
+            if _svc:
+                apipilot_auth_header = (f"Bearer {_svc}" if not _svc.lower().startswith("bearer ") else _svc)
+        demo_session_key = client_query.get("x-demo-session") if isinstance(client_query, dict) else None
+        if not demo_session_key:
+            demo_session_key = f"anon-ws-{client_ip}-{id(ws)}"
+        try:
+            # LOG SEMPRE-ATTIVO (non subordinato a S2S_DEBUG_PROMPT) — identico pattern reasoning pass1.
+            logger.info(
+                "[INJECT-APIPILOT] WS connect: fetching tools (auth=%s demoSession=%.40s...) upstream=%s...",
+                "yes" if apipilot_auth_header else "anon",
+                (demo_session_key[:40] if isinstance(demo_session_key, str) else "?"),
+                S2S_APIPILOT_TOOLS_URL or "<using override execute>",
+            )
+            if S2S_DEBUG_PROMPT:
+                logger.info(
+                    "[DEBUG-APIPILOT][WS connect] tools fetch detail toolsURL=%s executeURL=%s overrideExec=%s",
+                    S2S_APIPILOT_TOOLS_URL,
+                    S2S_APIPILOT_TOOLS_EXECUTE_URL,
+                    _apipilot_resolve_execute_url(),
+                )
+            _t0 = _monotonic_now()
+            apipilot_tools_pass1 = await _apipilot_fetch_tools(
+                auth_header=apipilot_auth_header,
+                demo_session=demo_session_key if isinstance(demo_session_key, str) else None,
+                refresh=False,
+            ) or []
+            _el = (_monotonic_now() - _t0)
+            # Build defaults dict per PASSATA-1 prompt: phone + episodeId se disponibili.
+            # Iniettati nella sezione "VALORES POR DEFECTO CONOCIDOS" così l'AI
+            # NON lascia arguments vuoto (BUG oggi: "ARGUMENTS=>>>").
+            _apipilot_defaults_p1: dict[str, str] = {}
+            if isinstance(inject_phone, str) and inject_phone.strip():
+                _apipilot_defaults_p1["phone"] = inject_phone.strip()
+            if isinstance(inject_episode_id, str) and inject_episode_id.strip():
+                _apipilot_defaults_p1["episode_id"] = inject_episode_id.strip()
+            # Anche login_by_phone se abbiamo profilo con email valida → email
+            if isinstance(profile_obj, dict) and profile_obj:
+                try:
+                    u = profile_obj.get("user") if isinstance(profile_obj.get("user"), dict) else None
+                    if isinstance(u, dict):
+                        email = u.get("email") if isinstance(u.get("email"), str) else ""
+                        if email.strip():
+                            _apipilot_defaults_p1["email"] = email.strip()
+                except Exception:  # noqa: BLE001
+                    pass
+            session_ctx_apipilot_defaults = dict(_apipilot_defaults_p1)
+            injected_apipilot_pass1 = _resolve_apipilot_reasoning_context_block(
+                tools=apipilot_tools_pass1, context_defaults=_apipilot_defaults_p1,
+            ) or ""
+            if injected_apipilot_pass1.strip():
+                logger.info(
+                    "[APIPILOT] REASONING PASS-1 (WS realtime): lista strumenti pronta N=%d t=%.0fms auth=%s defaults=%s",
+                    len(apipilot_tools_pass1), _el,
+                    "Y" if isinstance(apipilot_auth_header, str) else "anon",
+                    list(_apipilot_defaults_p1.keys()),
+                )
+                logger.info(
+                    "[INJECT-APIPILOT] ✅ WS connect: APIPILOT TOOLS list PASS-1 READY Ntools=%d wrappedLen=%d defaultsPhone=%s -> will patch session.update frames in this tunnel.",
+                    len(apipilot_tools_pass1), len(injected_apipilot_pass1),
+                    ("yes" if _apipilot_defaults_p1.get("phone") else "no"),
+                )
+            else:
+                logger.info(
+                    "[INJECT-APIPILOT] ⏭️  WS connect: apipilot fetch returned empty tools list; PASS-1 injection skipped for this tunnel.",
+                )
+        except Exception as exc:  # noqa: BLE001
+            logger.info(
+                "[INJECT-APIPILOT] ⛔ WS connect: apipilot tools fetch failed. Skipping PASS-1 injection for tunnel. err=%r",
+                exc,
+            )
+            injected_apipilot_pass1 = ""
+            apipilot_tools_pass1 = []
+            session_ctx_apipilot_defaults = {}
+        # 2026-09-25 Propagazione ESATTA demo_session_key + apipilot_auth_header USATI NELLA DISCOVERY
+        #    (stesso anon-ws-{client_ip}-{id(ws)}), perché AquaPortal lega la sessione utente
+        #    al valore x-demo-session della GET /tools. Se nella PASS-2 execute generiamo
+        #    un valore DIVERSO (ws-pass2-...) → vede user ANON → 403 "Tool non autorizzato".
+        _ws_apipilot_auth_for_execute = apipilot_auth_header
+        _ws_apipilot_demo_for_execute = demo_session_key if isinstance(demo_session_key, str) else None
+        # 2026-09-25 FIX CONSISTENZA API KEY: se S2S_APIPILOT_API_KEY è attivo, forza TUTTE le
+        #    variabili di propagazione all'identità bypass (stesso valore che abbiamo usato
+        #    nella fingerprint cache e negli headers HTTP effettivi della discovery).
+        #    Questo garantisce che anche nel raro caso in cui il PASS-2 fallback alla
+        #    propagation invece del nuovo blocco diretto, usi APIKEY identity e non anon-ws.
+        if S2S_APIPILOT_API_KEY:
+            _ws_apipilot_auth_for_execute = f"Bearer {S2S_APIPILOT_API_KEY}"
+            _ws_apipilot_demo_for_execute = S2S_APIPILOT_API_KEY
+    else:
+        # needs_apipilot=False (env non configurato): set defaults vuoto cmq
+        # per evitare che session_ctx["apipilot_defaults"] sia None.
+        session_ctx_apipilot_defaults = {}
+        injected_apipilot_pass1 = ""
+        apipilot_tools_pass1 = []
+        _ws_apipilot_auth_for_execute = None
+        _ws_apipilot_demo_for_execute = None
     logger.info(
-        "[INJECT-PROFILE] WS connect FINAL: injectEpisode=%s injectProfile=%s injectReports=%s injectSummary=%s login=%s episodeIdLen=%d phoneLen=%d episodeCtxLen=%d profileCtxLen=%d reportsCtxLen=%d summaryCtxLen=%d target=%s",
+        "[INJECT-PROFILE] WS connect FINAL: injectEpisode=%s injectProfile=%s injectReports=%s injectSummary=%s injectApipilotPass1=%s(Ntools=%d) login=%s episodeIdLen=%d phoneLen=%d episodeCtxLen=%d profileCtxLen=%d reportsCtxLen=%d summaryCtxLen=%d apipilotCtxLen=%d target=%s",
         bool(injected_episode_context),
         bool(injected_profile_context),
         bool(injected_reports_context),
         bool(injected_summary_context),
+        bool(injected_apipilot_pass1.strip()),
+        len(apipilot_tools_pass1),
         ("token-present" if login_token else "skipped"),
         len(inject_episode_id),
         len(inject_phone),
@@ -1958,6 +4787,7 @@ async def realtime_proxy(ws: WebSocket):
         len(injected_profile_context),
         len(injected_reports_context),
         len(injected_summary_context),
+        len(injected_apipilot_pass1),
         upstream_url,
     )
     if S2S_DEBUG_PROMPT and injected_episode_context.strip():
@@ -1990,10 +4820,43 @@ async def realtime_proxy(ws: WebSocket):
                 "injected_profile_context": injected_profile_context,
                 "injected_reports_context": injected_reports_context,
                 "injected_summary_context": injected_summary_context,
+                "injected_apipilot_pass1": injected_apipilot_pass1,
                 "inject_phone": inject_phone,
                 "inject_episode_id": inject_episode_id,
                 "login_token": login_token,
                 "login_response": login_response_obj,
+                # 2026-09-11 proper-name anglicization guard: keep the full
+                # upstream profile object so:
+                #   (a) _build_voice_rules_head_lock_block can emit rule #5
+                #       "Nombre exacto: Alessandro Valenti — NUNCA Alexander"
+                #   (b) strato 7 post-processing _sanitize_agent_output can
+                #       deterministically replace Alexander/Alexandre back to
+                #       Alessandro with word-boundary regex even when the
+                #       prompt lock fails on GPTQ.
+                "profile_obj": profile_obj,
+                "apipilot_tools_pass1": apipilot_tools_pass1,
+                # 2026-09-25 PASSATA-2 WS Realtime ApiPilot: accumulo transcript per response_id
+                # e flag anti-loop quando siamo in fase di inject di PASS-2 dopo l'execute.
+                "_ws_apipilot_asst_transcript_acc": {},       # response_id -> str full transcript
+                "_ws_apipilot_pass2_active": False,            # True mentre siamo dentro la 2a risposta (anti-loop marker infinito)
+                "_ws_apipilot_pass2_count": 0,                 # quante volte abbiamo eseguito il loop su questa sessione (cap max 3 safety)
+                # 2026-09-25 defaults parametri (phone/email/episode_id) riempiti in
+                #    PASS-1 builder e passati a _apipilot_parse_call_marker in PASS-2
+                #    se LLM lascia arguments vuoto.
+                "apipilot_defaults": (session_ctx_apipilot_defaults if needs_apipilot else {}),
+                # 2026-09-25 fallback phone per PASS-2 safety replace placeholder,
+                # usato anche se defaults è vuoto ma querystring aveva ?phoneNumber=.
+                "inject_phone": (inject_phone if isinstance(inject_phone, str) else ""),
+                # 2026-09-25 Bearer token per execute ApiPilot requires_auth=True (403 anon).
+                # Valorizzato con _login_by_phone se needs_apipilot + phone disponibile
+                # fuori da gate S2S_INJECT_PROFILE.
+                "login_token": (login_token if isinstance(login_token, str) else None),
+                # 2026-09-25 ESATTI auth_header + demo_session_key usati nella GET /tools
+                # DISCOVERY al momento della WS connect. PASS-2 execute usa ESATTAMENTE
+                # questi invece di crearne di nuovi (AquaPortal lega sessione x-demo-session
+                # alla chiamata /tools che ha restituito la lista strumenti autorizzati).
+                "apipilot_exec_auth": _ws_apipilot_auth_for_execute,
+                "apipilot_exec_demo": _ws_apipilot_demo_for_execute,
             }
             client_to_upstream = asyncio.create_task(
                 _client_to_upstream(ws, upstream, client_ip, session_ctx)
@@ -2116,7 +4979,30 @@ async def user_reports(phoneNumber: str | None = None):
               ...
           ]
         }
+
+    USER FIX 2026-09-11 "Elimina l'iniezione massiva di tutti i report schedulati":
+      • Even this BROWSER-FACING endpoint (/api/user/reports) now honours the new
+        S2S_INJECT_REPORTS default=False gate: when S2S_INJECT_REPORTS is not
+        explicitly true, we return a polite 403 + empty response — the endpoint
+        does NOT execute any upstream S2S_REPORT_LIST HTTP call, does NOT expose
+        any podcastScript bodies, and does NOT emit entries/hints. This avoids
+        a subtle loophole where the browser could still fetch scheduled reports
+        through /api/user/reports while the LLM prompt paths were gated.
     """
+    # ── MASS-INJECTION KILL SWITCH (user request) ─────────────────────────
+    if not S2S_INJECT_REPORTS:
+        return JSONResponse(
+            status_code=200,
+            content={
+                "count": 0,
+                "wrappedLen": 0,
+                "hints": [],
+                "entries": [],
+                "skipped": True,
+                "reason": "S2S_INJECT_REPORTS is disabled on this deploy; no scheduled reports exposed to UI or LLM.",
+            },
+        )
+    # ───────────────────────────────────────────────────────────────────────
     if not S2S_REPORT_LIST:
         raise HTTPException(
             status_code=503,
@@ -2183,6 +5069,20 @@ async def user_reports(phoneNumber: str | None = None):
         if cleaned:
             filtered.append(cleaned)
     filtered.sort(key=lambda r: _parse_date_key(r.get("date")))
+    # ── USER FIX 2026-09-11 "riduci il quick hint report max 3-5 configurabile da .env" ──
+    # Apply the SAME cap used by the LLM prompt resolver: after sort by newest,
+    # keep only first S2S_REPORTS_QUICK_HINT_MAX entries. This keeps counts between
+    # /api/user/reports UI JSON and the LLM prompt identical — avoids confusing
+    # mismatches where the UI shows 20 hints but the prompt only saw 5.
+    total_raw_ui = len(filtered)
+    cap_ui = max(1, int(S2S_REPORTS_QUICK_HINT_MAX or 5))
+    truncated_ui_note: str | None = None
+    if total_raw_ui > cap_ui:
+        filtered = filtered[:cap_ui]
+        truncated_ui_note = (
+            f"Showing newest {cap_ui} of {total_raw_ui} upstream reports. "
+            f"Adjust S2S_REPORTS_QUICK_HINT_MAX env to raise/lower the window."
+        )
     import datetime as _dt
     # Deduplicate by label for the UI JSON response only.
     # NOTE: the LLM prompt injection uses the full non-deduped list (different
@@ -2236,9 +5136,10 @@ async def user_reports(phoneNumber: str | None = None):
             hints_list.append(f"• Report #{idx}: '{label_piece}'")
         elif date_piece:
             hints_list.append(f"• Report #{idx}: (no label) — scheduled on {date_piece}")
-    return JSONResponse({
+    resp_body = {
         "count": len(entries_out),
-        "rawCount": len(filtered),
+        "rawCount": total_raw_ui,
+        "cap": cap_ui,
         "wrappedLen": len(ctx_str),
         "hints": hints_list,
         # Strip the long podcastScript from the summary JSON to keep the
@@ -2250,7 +5151,11 @@ async def user_reports(phoneNumber: str | None = None):
             }
             for r in entries_out
         ],
-    })
+    }
+    if truncated_ui_note is not None:
+        resp_body["truncated"] = True
+        resp_body["note"] = truncated_ui_note
+    return JSONResponse(resp_body)
 
 
 @app.get("/api/me")
@@ -2693,8 +5598,12 @@ async def _client_to_upstream(ws: WebSocket, upstream, client_ip: str, session_c
             ctx_profile_context = session_ctx.get("injected_profile_context") if isinstance(session_ctx, dict) else ""
             ctx_reports_context = session_ctx.get("injected_reports_context") if isinstance(session_ctx, dict) else ""
             ctx_summary_context = session_ctx.get("injected_summary_context") if isinstance(session_ctx, dict) else ""
+            ctx_apipilot_pass1 = session_ctx.get("injected_apipilot_pass1") if isinstance(session_ctx, dict) else ""
+            ctx_profile_obj = session_ctx.get("profile_obj") if isinstance(session_ctx, dict) else None
             forward_text = _patch_client_session_update_with_profile(
-                message["text"], ctx_profile_context or "", ctx_reports_context or "", ctx_summary_context or "", ctx_episode_context or ""
+                message["text"], ctx_profile_context or "", ctx_reports_context or "", ctx_summary_context or "", ctx_episode_context or "",
+                profile_obj=ctx_profile_obj,
+                apipilot_context_text_pass1=ctx_apipilot_pass1 or "",
             )
             await upstream.send(forward_text)
         elif message.get("bytes") is not None:
@@ -2713,9 +5622,351 @@ async def _client_to_upstream(ws: WebSocket, upstream, client_ip: str, session_c
             await upstream.send(message["bytes"])
 
 
+# ──────────────────────────────────────────────────────────────────────────
+# 2026-09-11 POST-PROCESSING SANITIZZAZIONE OUTPUT AGENTE (server-side, strato 7)
+#
+# Qwen2.5 GPTQ quantizzato continua a sforare anche con 6 strati di prompt lock:
+#   • [rightspeak] ... [endspeak]   → marker bracket non richiesti
+#   • [-]: checking_*               → "pensieri interni"
+#   • {'reportDetails': '...'}      → JSON literal inline nel TTS
+#   • Alessandro → Alexander        → nome proper normalizzato all'inglese
+#
+# Nessun prompt è sufficiente al 100% con GPTQ.  Introduciamo uno strato 7
+# server-side di post-processing: TUTTO il testo in uscita dall'upstream
+# viene filtrato PRIMA di essere inoltrato al client e PRIMA del log.
+# ──────────────────────────────────────────────────────────────────────────
+def _extract_profile_for_session(session_ctx: dict) -> dict:
+    """Return the profile dict stored in session_ctx (phone auth result)."""
+    p = session_ctx.get("profile_obj") or session_ctx.get("user_profile") or {}
+    if isinstance(p, dict) and isinstance(p.get("user"), dict):
+        return p["user"]
+    if isinstance(p, dict):
+        return p
+    return {}
+
+
+def _common_name_variants(original_name: str) -> list[str]:
+    """For a user's first/last name, return known anglicized / adapted variants
+    that the model may produce (e.g. Alessandro → Alexander). Used by
+    sanitizer to replace variant → original.
+
+    Map is conservative (only common names we have observed in the wild so
+    far). Any new name can be added here without touching other code.
+    """
+    variants_map: dict[str, tuple[str, ...]] = {
+        # Western / Romance masculine first names — anglicized / cognates
+        "Alessandro": ("Alexander", "Alexandre", "Aleksander", "Alexsander",
+                       "Alessander", "Aleksandr", "Alexander", "Alejandro",
+                       "Alesandro", "Allessandro", "Alex"),
+        "Alessandra": ("Alexandra", "Aleksandra", "Alejandra", "Alex"),
+        "Valenti": ("Valentini", "Valentine", "Valentin", "Valente",
+                    "Valentín", "Valentí"),
+        "Giovanni": ("John", "Juan", "Giovani", "Gianni", "Joan", "Ivan"),
+        "Paolo": ("Paul", "Pablo", "Paulo", "Paul"),
+        "Marco": ("Marc", "Mark", "Marcos"),
+        "Luca": ("Lucas", "Luke", "Lukas"),
+        "Matteo": ("Matthew", "Matías", "Mateo", "Matt"),
+        "Francesco": ("Francis", "Francisco", "Francesc"),
+        "Leonardo": ("Leonard", "Leonhard"),
+        "Giuseppe": ("Joseph", "José", "Giuseppi", "Pepe"),
+        "Mario": ("Maryo", "Mari", "Marion"),
+        # Feminine
+        "Sofia": ("Sophia", "Sophie", "Sofía", "Sofie"),
+        "Giulia": ("Julia", "Juliana", "Julie", "Giuliana"),
+        "Anna": ("Ana", "Anne", "Hannah", "Ann"),
+    }
+    out: list[str] = []
+    if not original_name:
+        return out
+    o = original_name.strip()
+    if o in variants_map:
+        out.extend(variants_map[o])
+    # Also check case-insensitive match as safety net
+    lower_map = {k.lower(): v for k, v in variants_map.items()}
+    if o.lower() in lower_map:
+        for v in lower_map[o.lower()]:
+            if v not in out:
+                out.append(v)
+    return out
+
+
+def _sanitize_agent_output(text, session_ctx=None) -> str:
+    """Server-side FINAL filter applied to ALL assistant output text.
+
+    Guarantees (belt-and-suspenders over the 6 prompt layers):
+      1. No [...][xxx] bracket markers of any kind.
+      2. No inline { ... } JSON / dict literals.
+      3. No [-]: <internal action name>  pseudo-markers.
+      4. No name anglicization: Alessandro → restored to Alessandro.
+      5. Trim + collapse multiple spaces.
+    """
+    import re
+    s = str(text or "")
+    if not s:
+        return s
+    # (0) Remove "action line" pseudo-markers FIRST, BEFORE stripping all
+    #     other brackets, because the pattern uses the literal "[-]" prefix
+    #     which would get silently swallowed by step (1) otherwise.  Match:
+    #       [-]: checking_podcast_report       (bracket literal then colon)
+    #       []: action_name                    (empty bracket variant)
+    #       [ - ]  :   do_stuff                (spaces inside & around)
+    # Pattern is intentionally TIGHT: after the colon we only take up to 6
+    # underscore/hyphen words so we cannot accidentally eat the following
+    # real user speech (bug: greedy class with ,. and 200-char upper bound ate
+    # the entire "Claro, revisaré el reporte." clause on 2026-09-11).
+    s = re.sub(
+        r"\[[\s\-]{0,6}\]\s*:\s*[a-z0-9_\-]+(?:[ \t]+[a-z0-9_\-]+){0,5}",
+        " ",
+        s,
+    )
+    # Also catch dangling residual patterns if brackets got normalized to a
+    # single char already — handles cases where upstream writes the "colon"
+    # action marker without explicit brackets.
+    s = re.sub(r"(?<!\w):\s*checking_[A-Za-z0-9_\-]{1,120}", " ", s)
+    # (1) Remove ALL bracket-markers — [rightspeak], [endspeak], [thinking],
+    #     [anything_else01].  We also remove stray [ / ] that don't form a
+    #     complete pair (e.g. leftover "hello] there").
+    s = re.sub(r"\[[^\]\n]{0,80}\]", " ", s)
+    # (2) Remove inline dict / JSON literals.  Pattern: { ... }, possibly
+    #     split across a few \n (not greedy).  Conservative: matches balanced
+    #     pairs up to a reasonable length, otherwise fallback.
+    _max_iter = 5
+    for _ in range(_max_iter):
+        new_s = re.sub(r"\{[^{}]{0,1600}\}", " ", s)
+        if new_s == s:
+            break
+        s = new_s
+    # (3) Name anglicization.  Iterate profile name's known variants →
+    #     replace with original (case-insensitive match).
+    if session_ctx is not None and isinstance(session_ctx, dict):
+        profile = _extract_profile_for_session(session_ctx)
+        if profile:
+            full_name = str(profile.get("name") or "").strip()
+            if full_name:
+                # Split into parts and check each
+                parts = [p for p in re.split(r"[\s\-_]+", full_name) if p]
+                for part in parts:
+                    variants = _common_name_variants(part)
+                    orig_cap = part[0].upper() + part[1:] if part else part
+                    for variant in variants:
+                        # Case-insensitive global replace → original case
+                        s = re.sub(
+                            r"\b" + re.escape(variant) + r"\b",
+                            orig_cap,
+                            s,
+                            flags=re.IGNORECASE,
+                        )
+                # Also try full-name variants (combined)
+                combined = full_name.replace(" ", "")
+    # (5) Collapse whitespace.  Re-punctuation cleanup: avoid normalizing
+    #     legitimate terminal "?" / "!" into nothing; only collapse doubled
+    #     or space-separated punctuation that resulted from earlier deletes.
+    s = re.sub(r"[ \t\u00a0]+", " ", s)
+    s = re.sub(r"\n{3,}", "\n\n", s)
+    # Interior punctuation: normalize spaces, but keep the char itself.
+    # Example: "hello   ,   world" → "hello, world"
+    s = re.sub(r"\s+([,.;:])\s+", r"\1 ", s)
+    # Terminal / exclamation / interrogation: only fix spacing, never strip.
+    s = re.sub(r"\s+([!?])", r"\1", s)
+    s = re.sub(r"([!?])\s{2,}", r"\1 ", s)
+    # Strip leftover whitespace.  Do NOT strip the legitimate terminal
+    # punctuation chars ?, !, ., because they are part of the real speech.
+    # Only strip repeated trailing commas / semicolons that appear because
+    # we deleted bracket/JSON fragments that separated clauses.
+    s = s.strip()
+    # Strip 2+ identical terminal punctuation chars (e.g. "hello.." → "hello.")
+    s = re.sub(r"([,.;:!?])\1{1,}$", r"\1", s)
+    # Strip terminal comma / semicolon / colon that now dangle (clause joins)
+    # but preserve ., ?, !.
+    s = re.sub(r"[,;:]$", "", s).strip()
+    return s
+
+
+def _sanitize_realtime_event_raw(raw_message, session_ctx=None) -> tuple:
+    """If the raw upstream event contains assistant OUTPUT text, sanitize it
+    in-place and return (new_json_str, True) — otherwise return (raw, False).
+
+    Mirrors exactly the same traversal used by _realtime_event_summary so we
+    touch every field that would become summary["text"].
+    """
+    import json as _json
+    if not isinstance(raw_message, str) or not raw_message.strip():
+        return raw_message, False
+    try:
+        payload = _json.loads(raw_message)
+    except Exception:
+        return raw_message, False
+    if not isinstance(payload, dict):
+        return raw_message, False
+    event_type = payload.get("type")
+    if not isinstance(event_type, str):
+        return raw_message, False
+
+    changed = False
+
+    def _sanitize_value(v):
+        nonlocal changed
+        if isinstance(v, str) and v.strip():
+            cleaned = _sanitize_agent_output(v, session_ctx)
+            # 2026-09-25 STRATO 8: Rimuovi marker CALL intern ApiPilot
+            # prima che il testo arrivi al client (UI chat + TTS audio).
+            # L'accumulatore transcript per PASS-2 marker parser USA l'originale
+            # quindi non perdiamo l'abilità di triggerare execute.
+            cleaned = _sanitize_text_strip_apipilot_markers(cleaned)
+            if cleaned != v:
+                changed = True
+                return cleaned
+        return v
+
+    # --- Event dispatch (same shape as _realtime_event_summary) -------------
+    # --- 2026-09-25: ORA SANITIZZIAMO ANCHE TUTTI I DELTA STREAMING oltre ai .done ---
+    # Perche' Qwen3-TTS (start_pipeline_rag) legge internamente i delta PRIMA di
+    # generare l'audio binario. Se non sanitizziamo i delta → TTS pronuncia il marker.
+    if event_type in {"response.audio_transcript.done",
+                      "response.audio_transcript.delta"}:
+        if "transcript" in payload:
+            payload["transcript"] = _sanitize_value(payload["transcript"])
+        if "delta" in payload and isinstance(payload.get("delta"), str):
+            payload["delta"] = _sanitize_value(payload["delta"])
+        for container in ("item", "part", "content", "output", "audio"):
+            sub = payload.get(container)
+            if isinstance(sub, dict):
+                for key in ("transcript", "text", "delta"):
+                    if key in sub and isinstance(sub.get(key), str):
+                        sub[key] = _sanitize_value(sub[key])
+    elif event_type in {"response.output_audio_transcript.done",
+                        "response.output_audio_transcript.delta"}:
+        # Top-level keys
+        for key in ("transcript", "text", "output_text", "audio_text",
+                    "output_transcript", "final_transcript", "output_audio_text",
+                    "content", "message", "utterance", "delta"):
+            if key in payload and isinstance(payload.get(key), str):
+                payload[key] = _sanitize_value(payload[key])
+        # Sub-containers
+        for container in ("item", "part", "content", "output", "delta", "audio"):
+            sub = payload.get(container)
+            if isinstance(sub, dict):
+                for key in ("transcript", "text", "output_text", "delta"):
+                    if key in sub and isinstance(sub.get(key), str):
+                        sub[key] = _sanitize_value(sub[key])
+                # content[] array
+                if isinstance(sub.get("content"), list):
+                    for c in sub["content"]:
+                        if isinstance(c, dict):
+                            for k2 in ("transcript", "text", "delta"):
+                                if k2 in c and isinstance(c.get(k2), str):
+                                    c[k2] = _sanitize_value(c[k2])
+        if isinstance(payload.get("content"), list):
+            for c in payload["content"]:
+                if isinstance(c, dict):
+                    for k2 in ("transcript", "text", "delta"):
+                        if k2 in c and isinstance(c.get(k2), str):
+                            c[k2] = _sanitize_value(c[k2])
+    elif event_type in {"response.text.delta", "response.text.done",
+                        "response.output_text.delta", "response.output_text.done"}:
+        for key in ("text", "output_text", "delta", "final_text", "content"):
+            if key in payload and isinstance(payload.get(key), str):
+                payload[key] = _sanitize_value(payload[key])
+        for container in ("item", "part", "output", "content", "text"):
+            sub = payload.get(container)
+            if isinstance(sub, dict):
+                for key in ("text", "output_text", "delta"):
+                    if key in sub and isinstance(sub.get(key), str):
+                        sub[key] = _sanitize_value(sub[key])
+                if isinstance(sub.get("content"), list):
+                    for c in sub["content"]:
+                        if isinstance(c, dict):
+                            for k2 in ("text", "transcript", "delta"):
+                                if k2 in c and isinstance(c.get(k2), str):
+                                    c[k2] = _sanitize_value(c[k2])
+        if isinstance(payload.get("content"), list):
+            for c in payload["content"]:
+                if isinstance(c, dict):
+                    for k2 in ("text", "transcript", "delta"):
+                        if k2 in c and isinstance(c.get(k2), str):
+                            c[k2] = _sanitize_value(c[k2])
+    elif event_type == "response.content_part.done":
+        part = payload.get("part")
+        if isinstance(part, dict):
+            if "text" in part and isinstance(part.get("text"), str):
+                part["text"] = _sanitize_value(part["text"])
+            if "transcript" in part and isinstance(part.get("transcript"), str):
+                part["transcript"] = _sanitize_value(part["transcript"])
+    elif event_type == "response.content_part.added":
+        part = payload.get("part")
+        if isinstance(part, dict):
+            if "text" in part and isinstance(part.get("text"), str):
+                part["text"] = _sanitize_value(part["text"])
+            if "transcript" in part and isinstance(part.get("transcript"), str):
+                part["transcript"] = _sanitize_value(part["transcript"])
+    elif event_type in {"response.content_part.text.delta",
+                        "response.output_content.text.delta",
+                        "response.content.text.delta"}:
+        for key in ("text", "delta"):
+            if key in payload and isinstance(payload.get(key), str):
+                payload[key] = _sanitize_value(payload[key])
+    elif event_type in {"response.output_item.done",
+                        "response.output_item.added"}:
+        item = payload.get("item")
+        if isinstance(item, dict):
+            for c in (item.get("content") or []):
+                if isinstance(c, dict):
+                    if "text" in c and isinstance(c["text"], str):
+                        c["text"] = _sanitize_value(c["text"])
+                    if "transcript" in c and isinstance(c["transcript"], str):
+                        c["transcript"] = _sanitize_value(c["transcript"])
+    elif event_type == "conversation.item.created":
+        item = payload.get("item")
+        if isinstance(item, dict) and item.get("role") == "assistant":
+            for c in (item.get("content") or []):
+                if isinstance(c, dict):
+                    if c.get("type") in {"input_text", "text"} and isinstance(c.get("text"), str):
+                        c["text"] = _sanitize_value(c["text"])
+                    if c.get("type") == "transcript" and isinstance(c.get("transcript"), str):
+                        c["transcript"] = _sanitize_value(c["transcript"])
+
+    if not changed:
+        return raw_message, False
+    try:
+        new_raw = _json.dumps(payload, ensure_ascii=False)
+    except Exception:
+        return raw_message, False
+    return new_raw, True
+
+
 async def _upstream_to_client(ws: WebSocket, upstream, client_ip: str, session_ctx: dict) -> None:
     async for message in upstream:
         if isinstance(message, bytes):
+            # 2026-09-25 GATE AUDIO BYTES: se response_id corrente è stato marcato
+            # come "contiene marker CALL" → DROPPARE tutti i binari audio (Qwen3
+            # ha gia generato audio con marker pronuciato, non lo mandiamo al client).
+            # IMPORTANTE oggi: MATCH STRETTAMENTE per response_id CORRENTE. Nessun
+            # fallback "qualsiasi id" (troppo largo: droppava anche audio PASS-2 buono).
+            drop_now = False
+            matched_rid = ""
+            drop_ids = session_ctx.get("_ws_drop_audio_for_response_ids")
+            if isinstance(drop_ids, dict) and drop_ids:
+                rid_ctx = session_ctx.get("_ws_current_response_id")
+                if isinstance(rid_ctx, str) and rid_ctx and drop_ids.get(rid_ctx):
+                    drop_now = True
+                    matched_rid = rid_ctx
+                elif (not isinstance(rid_ctx, str) or not rid_ctx) and len(drop_ids) == 1:
+                    # Caso safety: nessun response_id corrente disponibile ma
+                    # abbiamo 1 solo entry nel dict (probabilmente quella risposta).
+                    only_rid = next(iter(drop_ids.keys()))
+                    if drop_ids.get(only_rid):
+                        drop_now = True
+                        matched_rid = only_rid
+            if drop_now:
+                logger.info("[APIPILOT-AUDIO-DROP] FRAME DROP bytes=%dB matchedResponse=%s (marker CALL in questa risposta → Qwen3 audio sporco SCARTATO)", len(message), (matched_rid or session_ctx.get("_ws_current_response_id") or "-"))
+                continue
+            else:
+                logger.debug(
+                    "[APIPILOT-AUDIO-ALLOW] FRAME PASS bytes=%dB responseCtx=%s dropIds=%s",
+                    len(message),
+                    (session_ctx.get("_ws_current_response_id") or "-"),
+                    (sorted(list(drop_ids.keys())) if isinstance(drop_ids, dict) else "none"),
+                )
             # #region debug-point B:upstream-bytes-forward
             await _report_server_debug(
                 "B",
@@ -2730,6 +5981,456 @@ async def _upstream_to_client(ws: WebSocket, upstream, client_ip: str, session_c
             # #endregion
             await ws.send_bytes(message)
         else:
+            # ── PRIMA DEL SANITIZE: estrai ORIGINALE per PASSATA-2 marker parser ──
+            #   (marker sarebbe cancellato da STRATO 7)
+            pre_sanitize_summary = _realtime_event_summary(message)
+            pre_event_type = pre_sanitize_summary.get("type") if isinstance(pre_sanitize_summary, dict) else None
+            pre_response_id: str | None = None
+            if isinstance(pre_sanitize_summary, dict):
+                if isinstance(pre_sanitize_summary.get("response_id"), str):
+                    pre_response_id = pre_sanitize_summary["response_id"]
+                elif isinstance(pre_sanitize_summary.get("id"), str):
+                    pre_response_id = pre_sanitize_summary["id"]
+                # 2026-09-25: memorizza response_id corrente per il gate bytes audio
+                if isinstance(pre_response_id, str) and pre_response_id:
+                    session_ctx["_ws_current_response_id"] = pre_response_id
+            # ── MARKER DETECTION PER EVENTO SINGOLO (non solo response.done) ──
+            # Se in QUALSIASI evento testo di questa risposta troviamo marker CALL
+            # → flag gate DROP bytes audio per questo response_id + sanitize anche i prossimi
+            if (
+                isinstance(pre_sanitize_summary, dict)
+                and isinstance(pre_event_type, str)
+                and pre_event_type not in {"response.done"}
+            ):
+                quick_text_parts: list[str] = []
+                for _k in ("text", "transcript", "output_text", "audio_text",
+                           "output_transcript", "final_transcript", "output_audio_text",
+                           "content", "message", "utterance", "delta", "_raw_preview"):
+                    _v = pre_sanitize_summary.get(_k)
+                    if isinstance(_v, str) and _v.strip():
+                        quick_text_parts.append(_v)
+                for _cname in ("item", "part", "output", "audio"):
+                    _sub = pre_sanitize_summary.get(_cname)
+                    if isinstance(_sub, dict):
+                        for _k2 in ("text", "transcript", "output_text"):
+                            _v2 = _sub.get(_k2)
+                            if isinstance(_v2, str) and _v2.strip():
+                                quick_text_parts.append(_v2)
+                quick_text = (" ".join(quick_text_parts)).strip()
+                if quick_text:
+                    _detected_name, _detected_args = _apipilot_parse_call_marker(quick_text)
+                    if isinstance(_detected_name, str) and _detected_name:
+                        drop_ids2 = session_ctx.get("_ws_drop_audio_for_response_ids")
+                        if not isinstance(drop_ids2, dict):
+                            drop_ids2 = {}
+                            session_ctx["_ws_drop_audio_for_response_ids"] = drop_ids2
+                        _flag_rid = (pre_response_id if isinstance(pre_response_id, str) and pre_response_id
+                                     else f"auto-{id(session_ctx)}")
+                        drop_ids2[_flag_rid] = True
+                        # cleanup vecchi id se > 10
+                        if len(drop_ids2) > 10:
+                            try:
+                                for _old_k in list(drop_ids2.keys())[:-10]:
+                                    drop_ids2.pop(_old_k, None)
+                            except Exception:
+                                pass
+                        logger.info("[APIPILOT-SANITIZE] marker CALL in event=%s response=%s name=%s → GATE AUDIO DROP attivo per questa risposta (Qwen3 generera' audio sporco, sarà scartato)", pre_event_type, _flag_rid, _detected_name)
+            # 1a) PASSATA-2 pre-sanitize transcript accumulatore TTS audio
+            if (
+                isinstance(pre_sanitize_summary, dict)
+                and isinstance(pre_event_type, str)
+                and pre_event_type in {"response.audio_transcript.done",
+                                        "response.output_audio_transcript.done"}
+            ):
+                pre_agent_text = (pre_sanitize_summary.get("text") if isinstance(pre_sanitize_summary.get("text"), str) else "").strip()
+                rid_key = (
+                    pre_response_id if isinstance(pre_response_id, str) and pre_response_id
+                    else f"auto-{id(session_ctx)}"
+                )
+                if rid_key and pre_agent_text:
+                    acc = session_ctx.get("_ws_apipilot_asst_transcript_acc")
+                    if not isinstance(acc, dict):
+                        acc = {}
+                        session_ctx["_ws_apipilot_asst_transcript_acc"] = acc
+                    prev = acc.get(rid_key, "")
+                    if prev:
+                        acc[rid_key] = f"{prev} {pre_agent_text}".strip()
+                    else:
+                        acc[rid_key] = pre_agent_text
+            # 1b) PASSATA-2 pre-sanitize accumulatore ANCHE da conversation.item.created (assistant)
+            #     LLM emette il marker anche nel messaggio di testo conversation (non solo TTS!)
+            elif (
+                isinstance(pre_sanitize_summary, dict)
+                and isinstance(pre_event_type, str)
+                and pre_event_type == "conversation.item.created"
+                and pre_sanitize_summary.get("role") == "assistant"
+            ):
+                pre_conv_text = (pre_sanitize_summary.get("text") if isinstance(pre_sanitize_summary.get("text"), str) else "").strip()
+                rid_key2 = (
+                    pre_response_id if isinstance(pre_response_id, str) and pre_response_id
+                    else f"auto-{id(session_ctx)}"
+                )
+                if rid_key2 and pre_conv_text:
+                    acc2 = session_ctx.get("_ws_apipilot_asst_transcript_acc")
+                    if not isinstance(acc2, dict):
+                        acc2 = {}
+                        session_ctx["_ws_apipilot_asst_transcript_acc"] = acc2
+                    prev2 = acc2.get(rid_key2, "")
+                    if prev2:
+                        acc2[rid_key2] = f"{prev2} {pre_conv_text}".strip()
+                    else:
+                        acc2[rid_key2] = pre_conv_text
+            # 2) PASSATA-2 pre-sanitize response.done trigger marker
+            if (
+                isinstance(pre_sanitize_summary, dict)
+                and isinstance(pre_event_type, str)
+                and pre_event_type == "response.done"
+            ):
+                rid_val: str = (
+                    pre_response_id if isinstance(pre_response_id, str)
+                    else (pre_sanitize_summary.get("id") if isinstance(pre_sanitize_summary.get("id"), str) else f"auto-{id(session_ctx)}")
+                )
+                full_text = ""
+                acc3 = session_ctx.get("_ws_apipilot_asst_transcript_acc")
+                if rid_val and isinstance(acc3, dict):
+                    full_text = (acc3.pop(rid_val, "") if isinstance(acc3, dict) else "") or ""
+                # Fallback: se response_id non matcha ma abbiamo un solo accumulo rimasto → usiamo
+                # quello (alcuni upstream generano response_id diversi tra eventi)
+                if (not isinstance(full_text, str) or not full_text.strip()) and isinstance(acc3, dict) and len(acc3) == 1:
+                    _only_key = next(iter(acc3.keys()))
+                    full_text = (acc3.pop(_only_key, "") if isinstance(acc3, dict) else "") or ""
+                marker_name, marker_args = None, None
+                if isinstance(full_text, str) and full_text.strip():
+                    _p1_defaults = session_ctx.get("apipilot_defaults") if isinstance(session_ctx.get("apipilot_defaults"), dict) else {}
+                    marker_name, marker_args = _apipilot_parse_call_marker(full_text, defaults=_p1_defaults)
+                    logger.info("[APIPILOT-CALL-NAME] USE=WS_RESPONSE_DONE_DETECTION markerFound=%s name=%r argsKeys=%s", ("Y" if isinstance(marker_name, str) and marker_name else "N"), (marker_name or ""), list((marker_args or {}).keys()))
+                    # ── LOG ALWAYS-ON diagnostico PASS-2 marker detection ────────
+                    try:
+                        _preview = full_text.replace("\n", " ")
+                        if len(_preview) > 500:
+                            _preview = _preview[:500] + "…"
+                    except Exception:
+                        _preview = str(full_text)[:500]
+                    logger.info(
+                        "[APIPILOT] REASONING PASS-2 (WS realtime): response.done DIAGNOSTIC fullLen=%d markerFound=%s markerName=%s argsKeys=%s defaultsAutoFill=%s acc3Remaining=%d fullTextPreview=%r",
+                        len(full_text or ""),
+                        ("Y" if isinstance(marker_name, str) and marker_name else "N"),
+                        (marker_name if isinstance(marker_name, str) and marker_name else ""),
+                        (list(marker_args.keys()) if isinstance(marker_args, dict) else []),
+                        (list(_p1_defaults.keys()) if isinstance(_p1_defaults, dict) and _p1_defaults else "none"),
+                        (len(acc3) if isinstance(acc3, dict) else -1),
+                        _preview,
+                    )
+                elif isinstance(full_text, str):
+                    logger.info(
+                        "[APIPILOT] REASONING PASS-2 (WS realtime): response.done DIAGNOSTIC fullLen=0 EMPTY markerFound=N response_id=%r acc3Remaining=%d",
+                        rid_val,
+                        (len(acc3) if isinstance(acc3, dict) else -1),
+                    )
+                else:
+                    logger.info(
+                        "[APIPILOT] REASONING PASS-2 (WS realtime): response.done DIAGNOSTIC fullText is not str type=%r acc3=%r",
+                        type(full_text).__name__,
+                        (list(acc3.keys()) if isinstance(acc3, dict) else "?"),
+                    )
+                needs_pass2 = (
+                    isinstance(marker_name, str) and bool(marker_name)
+                    and not bool(session_ctx.get("_ws_apipilot_pass2_active"))
+                    and (int(session_ctx.get("_ws_apipilot_pass2_count") or 0) < 3)
+                )
+                if needs_pass2:
+                    # 2026-09-25: PULIZIA GATE AUDIO DROP.
+                    # La risposta 1 (marker CALL) ha l'audio sporco (gate attivo DROP bytes).
+                    # PASS-2 e' la risposta 2 con dati veri dell'utente → audio buono,
+                    # quindi CANCELLIAMO il gate DROP per gli ID attivi.
+                    drop_ids_clean = session_ctx.get("_ws_drop_audio_for_response_ids")
+                    if isinstance(drop_ids_clean, dict) and drop_ids_clean:
+                        drop_ids_clean.clear()
+                        logger.info("[APIPILOT-AUDIO-DROP] PASS-2 start: pulisco gate audio drop → audio PASS-2 rielaborazione briefing verra' inoltrato normalmente")
+                    args = marker_args if isinstance(marker_args, dict) else {}
+                    # ── SAFETY: over-ride parametri con valori REALI da defaults ──────
+                    # 1) Se manca la chiave -> usiamo defaults.
+                    # 2) Se il valore di args è UN VALORE DI ESEMPIO fittizio del prompt
+                    #    (regola #7: "+56912345678", altri placeholder tipo "+56XXXXXX",
+                    #    "+1234567890", "+390000000000", stringa vuota, +56XXXX) →
+                    #    sostituiamo SEMPRE con defaults reale se disponibile.
+                    #    Questo evita bug oggi: AI usa "+56912345678" (esempio regola 7)
+                    #    invece di "+447432477433" (vero Alessandro).
+                    # 3) FALLBACK 2026-09-25: se defaults è vuoto ma c'è
+                    #    session_ctx["inject_phone"] da querystring → usiamo quello.
+                    _p1_defaults_use = session_ctx.get("apipilot_defaults") if isinstance(session_ctx.get("apipilot_defaults"), dict) else {}
+                    _fallback_inject_phone = session_ctx.get("inject_phone") if isinstance(session_ctx.get("inject_phone"), str) else ""
+                    # Placeholder noti che appaiono nel prompt come esempio.
+                    _FAKE_PHONE_PLACEHOLDERS: set[str] = {
+                        "+56912345678",    # nostro esempio regola 7
+                        "56912345678",     # variante senza +
+                        "+5612345678",
+                        "+1234567890",
+                        "+12345678",
+                        "+56XXXXXXX",
+                        "+56xxxxxxx",
+                        "",
+                    }
+                    def _is_phone_fake(v: str) -> bool:
+                        c = str(v or "").strip()
+                        if c in _FAKE_PHONE_PLACEHOLDERS:
+                            return True
+                        if len(c) < 7:
+                            return True
+                        if c.endswith("00000"):
+                            return True
+                        if "123456" in c or "xxxxxx" in c.lower() or "xxxx" in c.lower():
+                            return True
+                        if (c.startswith("+56") and len(c) <= 9):
+                            return True
+                        return False
+                    # Applichiamo defaults + fallback su TUTTE le chiavi disponibili
+                    if isinstance(_p1_defaults_use, dict) and _p1_defaults_use:
+                        for k, default_v in _p1_defaults_use.items():
+                            if default_v in (None, "", []):
+                                continue
+                            if k not in args or args[k] in (None, "", []):
+                                args[k] = default_v
+                            elif k == "phone" and isinstance(args.get("phone"), str):
+                                if _is_phone_fake(str(args.get("phone"))):
+                                    args[k] = default_v
+                    # Fallback phone diretto se è fake ma defaults non aveva chiave phone
+                    if (
+                        isinstance(args.get("phone"), str)
+                        and _is_phone_fake(str(args.get("phone")))
+                        and isinstance(_fallback_inject_phone, str)
+                        and _fallback_inject_phone.strip()
+                    ):
+                        args["phone"] = _fallback_inject_phone.strip()
+                    # Aggiorniamo _p1_defaults per i log dopo
+                    _p1_defaults = _p1_defaults_use
+                    session_ctx["_ws_apipilot_pass2_count"] = int(session_ctx.get("_ws_apipilot_pass2_count") or 0) + 1
+                    session_ctx["_ws_apipilot_pass2_active"] = True
+                    # 2026-09-25 PRIORITÀ auth e demo ESATTI della DISCOVERY (anon-ws-...)
+                    #    invece di crearne uno nuovo (ws-pass2-...) al volo.
+                    #    AquaPortal fa il binding tra strumenti autorizzati e la sessione
+                    #    x-demo-session che ha fatto GET /tools.
+                    _exec_auth = session_ctx.get("apipilot_exec_auth") if isinstance(session_ctx.get("apipilot_exec_auth"), str) else None
+                    _exec_demo = session_ctx.get("apipilot_exec_demo") if isinstance(session_ctx.get("apipilot_exec_demo"), str) else None
+                    # Fallback se per caso vuoti (safety backward-compat):
+                    if not isinstance(_exec_auth, str) or not _exec_auth.strip():
+                        login_tok = session_ctx.get("login_token")
+                        _exec_auth = f"Bearer {login_tok}" if isinstance(login_tok, str) and login_tok.strip() else None
+                    if not isinstance(_exec_demo, str) or not _exec_demo.strip():
+                        _exec_demo = f"ws-pass2-{client_ip}-{id(session_ctx)}"
+                    # 2026-09-25 🔴 SUPER API KEY (PRIORITÀ MASSIMA ASSOLUTA - anche sopra SERVICE_TOKEN):
+                    #    Se valorizzata S2S_APIPILOT_API_KEY → force Bearer + demo = APIKEY.
+                    #    Questo garantisce che demoSessionKey nel log PASS-2 e nel call execute
+                    #    NON sia più anon-ws-... ma aqua3465# (stessa identità discovery bypass).
+                    if S2S_APIPILOT_API_KEY:
+                        _exec_auth = f"Bearer {S2S_APIPILOT_API_KEY}"
+                        _exec_demo = S2S_APIPILOT_API_KEY
+                    # 2026-09-25 S2S_APIPILOT_SERVICE_TOKEN (se valorizzato) OVERRIDE (solo se NON c'è SUPER API KEY)
+                    elif S2S_APIPILOT_SERVICE_TOKEN:
+                        _svc = S2S_APIPILOT_SERVICE_TOKEN.strip()
+                        if _svc:
+                            _exec_auth = (f"Bearer {_svc}" if not _svc.lower().startswith("bearer ") else _svc)
+                    # 2026-09-25 FALLBACK AUTH FORZATO PASS-2 (SEM-PRE):
+                    #    Se tool richiede requires_auth=true E bearer non è un JWT valido
+                    #    (meno di 80 chars, tipico JWT > 150) oppure è vuoto → login_by_phone
+                    #    FORZATO con Alessandro phone, indipendentemente se è stato fatto
+                    #    prima o meno. Questo garantisce che AquaPortal riceva user_token
+                    #    valido → user=(Alessandro Valenti) invece di user=(anon) → 403!
+                    _phone_lfb = (
+                        session_ctx.get("inject_phone") if isinstance(session_ctx.get("inject_phone"), str)
+                        else ""
+                    ) or (inject_phone if isinstance(inject_phone, str) else "")
+                    _phone_lfb = _phone_lfb.strip() if isinstance(_phone_lfb, str) else ""
+                    _current_bearer_token = ""
+                    if isinstance(_exec_auth, str) and _exec_auth.lower().startswith("bearer "):
+                        _current_bearer_token = _exec_auth[len("bearer "):].strip()
+                    _is_jwt_like = bool(_current_bearer_token) and len(_current_bearer_token) >= 120 and _current_bearer_token.count(".") >= 2
+                    # Determina requires_auth true (default): lookup tools recenti da session ctx o apipilot_cache
+                    _tools_recent: list[dict] = (
+                        session_ctx.get("apipilot_tools_pass1")
+                        if isinstance(session_ctx.get("apipilot_tools_pass1"), list)
+                        else []
+                    )
+                    if not _tools_recent:
+                        try:
+                            _cached = _APIPILOT_CACHE.get("tools") if _APIPILOT_CACHE else None
+                            if isinstance(_cached, tuple) and _cached and isinstance(_cached[0], list):
+                                _tools_recent = _cached[0]
+                        except Exception:  # noqa: BLE001
+                            _tools_recent = []
+                    _mtool = next((t for t in _tools_recent if isinstance(t, dict) and t.get("name") == marker_name), None)
+                    _requires_auth = True if (_mtool is None) else bool(_mtool.get("requires_auth"))
+                    if (
+                        (not S2S_APIPILOT_API_KEY)
+                        and S2S_LOGIN_BY_PHONE
+                        and _phone_lfb
+                        and _requires_auth
+                        and (not _is_jwt_like)
+                    ):
+                        try:
+                            _l_tok, _l_obj = await _login_by_phone(_phone_lfb)
+                            if isinstance(_l_tok, str) and _l_tok.strip():
+                                _exec_auth = f"Bearer {_l_tok.strip()}"
+                                _tok_len = len(_l_tok.strip())
+                                _is_new_jwt = _tok_len >= 120 and _l_tok.strip().count(".") >= 2
+                                logger.info(
+                                    "[APIPILOT] REASONING PASS-2 (WS realtime): LOGIN FORZATO PASS-2 (tool requires_auth) phoneLen=%d token=%s%s",
+                                    len(_phone_lfb),
+                                    f"YES len={_tok_len}",
+                                    (" JWT?" if _is_new_jwt else (" SHORT?" if _tok_len < 80 else " OK")),
+                                )
+                            else:
+                                logger.info(
+                                    "[APIPILOT] REASONING PASS-2 (WS realtime): LOGIN FORZATO PASS-2 token EXTRACT FAILED phoneLen=%d (tool requires_auth → probabile 403)",
+                                    len(_phone_lfb),
+                                )
+                        except Exception as _lfb_exc:  # noqa: BLE001
+                            logger.info(
+                                "[APIPILOT] REASONING PASS-2 (WS realtime): LOGIN FORZATO PASS-2 fallito phoneLen=%d err=%r",
+                                len(_phone_lfb), _lfb_exc,
+                            )
+                    bearer = _exec_auth
+                    demo_key = _exec_demo
+                    try:
+                        logger.info("[APIPILOT-CALL-NAME] USE=WS_REALTIME_PASS2_TRIGGER name=%r argsKeys=%s argsPhone=%r", marker_name, list(args.keys()) if args else [], (args.get("phone") if isinstance(args.get("phone"), str) else ""))
+                        logger.info(
+                            "[APIPILOT] REASONING PASS-2 (WS realtime): trigger marker name=%s argsKeys=%s argsPhone=%s auth=%s defaultsAutoFill=%s demoSessionKey=%.40s",
+                            marker_name,
+                            list(args.keys()) if args else [],
+                            (args.get("phone") if isinstance(args.get("phone"), str) else ""),
+                            "Y" if bearer else "anon",
+                            list(_p1_defaults.keys()) if isinstance(_p1_defaults, dict) and _p1_defaults else "none",
+                            demo_key if isinstance(demo_key, str) else "?",
+                        )
+                        t0 = _monotonic_now()
+                        logger.info("[APIPILOT-CALL-NAME] USE=WS_REALTIME_PASS2_EXEC_HELPER name=%r → forward a _apipilot_execute_tool", marker_name)
+                        env_exec = _apipilot_execute_tool(
+                            auth_header=bearer,
+                            demo_session=demo_key,
+                            name=marker_name,
+                            arguments=args,
+                        )
+                        if hasattr(asyncio, "create_task"):
+                            envelope = await asyncio.wait_for(env_exec, timeout=60.0)
+                        else:
+                            envelope = await env_exec
+                        t1 = (_monotonic_now() - t0)
+                        ok = bool(isinstance(envelope, dict) and envelope.get("success"))
+                        data = envelope.get("data") if isinstance(envelope, dict) else None
+                        err_obj = envelope.get("error") if isinstance(envelope, dict) and isinstance(envelope.get("error"), dict) else None
+                        if isinstance(data, str):
+                            tool_text = data
+                        elif isinstance(data, (dict, list)):
+                            try:
+                                tool_text = json.dumps(data, indent=2, ensure_ascii=False)
+                            except Exception:  # noqa: BLE001
+                                tool_text = str(data)
+                        else:
+                            tool_text = ""
+                        if not ok:
+                            code = (
+                                err_obj.get("code") if isinstance(err_obj, dict) and err_obj.get("code") is not None
+                                else (envelope.get("code") if isinstance(envelope, dict) else None)
+                            )
+                            msg = (
+                                err_obj.get("message") if isinstance(err_obj, dict) and isinstance(err_obj.get("message"), str)
+                                else ""
+                            )
+                            prefix = ""
+                            if code is not None or msg:
+                                prefix = f"[{code if code is not None else 'ERROR'}] {msg}".strip() + "\n"
+                            tool_text = f"{prefix}{tool_text}".strip()
+                        logger.info(
+                            "[APIPILOT] REASONING PASS-2 (WS realtime): execute DONE name=%s success=%s len=%d t=%.0fms",
+                            marker_name, "ok" if ok else "error", len(tool_text), t1,
+                        )
+                        call_result_dict = {
+                            "name": marker_name,
+                            "text": tool_text or "",
+                            "error": (not ok),
+                        }
+                        # 2026-09-25: PRE-SANITIZE PASS-2 INTERNO con funzione LEGGERA
+                        #   _sanitize_pass2_internal_context (NON _sanitize_text_strip_apipilot_markers!).
+                        #   Motivo: _sanitize_text_strip_apipilot_markers contiene BLOCCO 1 FULL STRIP
+                        #   PASS-2 RESULT e cancellava TUTTO il blocco PRIMA dell'inject upstream,
+                        #   lasciandolo stringa vuota -> "saltiamo inject pass2_active=N" -> nessun briefing.
+                        len_raw_tool_text = len(call_result_dict.get("text") or "")
+                        if isinstance(call_result_dict.get("text"), str):
+                            call_result_dict["text"] = _sanitize_pass2_internal_context(call_result_dict["text"])
+                        len_sanitized_tool_text = len(call_result_dict.get("text") or "")
+                        blk_pass2 = _resolve_apipilot_reasoning_context_block(
+                            None, call_result=call_result_dict,
+                        ) or ""
+                        if not blk_pass2.strip():
+                            blk_pass2 = (tool_text or "").strip()
+                        len_raw_wrapper = len(blk_pass2 or "")
+                        # SANITIZE FINALE PASS-2 blocco wrapper: sempre LEGGERA (non strip blocco RESULT!)
+                        if blk_pass2.strip():
+                            blk_pass2 = _sanitize_pass2_internal_context(blk_pass2)
+                        len_sanitized_wrapper = len(blk_pass2 or "")
+                        logger.info(
+                            "[APIPILOT] REASONING PASS-2 (WS realtime): blocco DIMENSIONI len_raw_tool_text=%d len_sanitized_tool_text=%d len_raw_wrapper=%d len_sanitized_wrapper=%d success=%s",
+                            len_raw_tool_text, len_sanitized_tool_text,
+                            len_raw_wrapper, len_sanitized_wrapper,
+                            ("ok" if ok else "error"),
+                        )
+                        if blk_pass2.strip():
+                            # 2026-09-25: RESET _ws_current_response_id PRIMA di
+                            # inject PASS-2. Altrimenti rimane il vecchio response_id
+                            # di turno 1 (marker CALL) e i frame bytes audio di
+                            # turno 2 (briefing buono) rischiano match sbagliato.
+                            session_ctx["_ws_current_response_id"] = None
+                            logger.info(
+                                "[APIPILOT] REASONING PASS-2 (WS realtime): inject blocco PASS-2 len=%d -> invio conversation.item.create + response.create a upstream",
+                                len(blk_pass2),
+                            )
+                            try:
+                                await upstream.send(
+                                    json.dumps(
+                                        {
+                                            "type": "conversation.item.create",
+                                            "item": {
+                                                "type": "message",
+                                                "role": "user",
+                                                "content": [
+                                                    {"type": "input_text", "text": blk_pass2}
+                                                ],
+                                            },
+                                        },
+                                        ensure_ascii=False,
+                                    )
+                                )
+                                await upstream.send(json.dumps({"type": "response.create"}, ensure_ascii=False))
+                                logger.info(
+                                    "[APIPILOT] REASONING PASS-2 (WS realtime): inject OK. attendiamo nuova risposta AI (pass2_active=Y fino a prossimo response.done)",
+                                )
+                            except Exception as exc2:  # noqa: BLE001
+                                session_ctx["_ws_apipilot_pass2_active"] = False
+                                logger.info(
+                                    "[APIPILOT] REASONING PASS-2 (WS realtime): inject FAIL upstream send err=%r. pass2_active=N.",
+                                    exc2,
+                                )
+                        else:
+                            session_ctx["_ws_apipilot_pass2_active"] = False
+                            logger.info(
+                                "[APIPILOT] REASONING PASS-2 (WS realtime): blocco risultato VUOTO -> saltiamo inject. pass2_active=N.",
+                            )
+                    except Exception as exc:  # noqa: BLE001
+                        session_ctx["_ws_apipilot_pass2_active"] = False
+                        logger.info(
+                            "[APIPILOT] REASONING PASS-2 (WS realtime): ABORT marker=%s err=%r. pass2_active=N (safety).",
+                            marker_name, exc,
+                        )
+                elif isinstance(session_ctx.get("_ws_apipilot_pass2_active"), bool) and bool(session_ctx.get("_ws_apipilot_pass2_active")):
+                    session_ctx["_ws_apipilot_pass2_active"] = False
+                    logger.info(
+                        "[APIPILOT] REASONING PASS-2 (WS realtime): response.done PASS-2 FINALE -> pass2_active=N safety counter=%s",
+                        int(session_ctx.get("_ws_apipilot_pass2_count") or 0),
+                    )
+            # ── STRATO 7 POST-PROCESSING (2026-09-11 anti-leak) ────────
+            # (marker sono già stati processati sopra, adesso la sanitizzazione
+            #  li rimuove tranquillamente prima del client)
+            message, was_sanitized = _sanitize_realtime_event_raw(message, session_ctx)
             # #region debug-point B:upstream-text-forward
             summary = _realtime_event_summary(message)
             if summary:
@@ -2770,13 +6471,15 @@ async def _upstream_to_client(ws: WebSocket, upstream, client_ip: str, session_c
                 item_id = summary.get("item_id")
                 if event_type in {"response.audio_transcript.done",
                                   "response.output_audio_transcript.done"}:
+                    # Nota: accumulo per marker PASS-2 GIA' fatto PRE-sanitize
+                    # (ORIGINALE intatto). Qui agent_text è sanitizzato
+                    # (marker → placeholder) → usato solo per UI/logs.
                     agent_text = (summary.get("text") or "").strip()
                     if agent_text:
                         logger.info(
                             "[OUTPUT AGENTE] client=%s tts=%s",
                             client_ip, agent_text,
                         )
-                        # ── Forward fire-and-forget a Node-RED (FASE 1 LOG-ONLY) ──
                         asyncio.create_task(_forward_agent_text_to_nodered({
                             "tts": agent_text,
                             "response_id": response_id,
@@ -2787,7 +6490,6 @@ async def _upstream_to_client(ws: WebSocket, upstream, client_ip: str, session_c
                             "user_transcript": session_ctx.get("last_user_transcript") or "",
                         }))
                     else:
-                        # Ispezione: questo evento custom non emette testo nel campo atteso
                         raw_preview = summary.get("_raw_preview") or json.dumps(summary, ensure_ascii=True)
                         logger.debug(
                             "[OUTPUT AGENTE][ISPEZIONE] client=%s %s ha summary=%s raw=%s",
@@ -2843,7 +6545,6 @@ async def _upstream_to_client(ws: WebSocket, upstream, client_ip: str, session_c
                             "source_event": event_type,
                             "user_transcript": session_ctx.get("last_user_transcript") or "",
                         }))
-                # Log dettagliato evento solo se non è un tipo rumoroso
                 if event_type not in _NOISY_REALTIME_EVENT_TYPES:
                     logger.debug(
                         "[EXT][S2S-PROXY] client=%s UPSTREAM→ event=%s summary=%s",
diff --git a/s2s-client/style.css b/s2s-client/style.css
index 6e61dea..ec438d5 100644
--- a/s2s-client/style.css
+++ b/s2s-client/style.css
@@ -357,6 +357,30 @@ a:hover {
   box-sizing: border-box;
 }
 
+.feedback-link {
+  align-self: flex-end;
+  display: inline-flex;
+  align-items: center;
+  min-height: 44px;
+  margin: 12px 16px 0;
+  padding: 10px 18px;
+  border: none;
+  border-radius: 10px;
+  background: #2563eb;
+  color: #ffffff;
+  font-size: 16px;
+  font-weight: 600;
+  position: relative;
+  z-index: 2;
+}
+.feedback-link:hover {
+  background: #1d4ed8;
+}
+.feedback-link:focus-visible {
+  outline: 2px solid var(--text);
+  outline-offset: 3px;
+}
+
 .brand {
   display: flex;
   align-items: flex-start;
@@ -4208,3 +4232,1291 @@ button[data-reports-sidebar-toggle] {
   .reports-hint { max-height: 28svh; padding: 6px 8px; }
   .circle { width: clamp(90px, min(40svw, 34svh), 200px); }
 }
+
+/* ═══════════════════════════════════════════════════════════════════════
+   THEME GATING (shared between purple-dark S2S_THEME="dark" / empty and
+   light mobile S2S_THEME="white")
+   ═══════════════════════════════════════════════════════════════════════ */
+
+/* Anti-FOUC veil: until fetchConfig() resolves, <html> does not carry any
+   `data-theme` attribute yet. Keep every parallel UI block tagged with
+   `data-theme-only` INVISIBLE in that window so the user never sees the
+   purple orb flash-and-disappear on `S2S_THEME=white` deploys, nor the
+   light-blue mic flash on dark deploys.
+   As soon as fetchConfig runs (main.js fetchConfig → root.setAttribute)
+   the html tag receives either data-theme="dark" or data-theme="white"
+   → this guard stops applying → the correctly gated branch paints. */
+html:not([data-theme]) [data-theme-only] {
+  visibility: hidden !important;
+  pointer-events: none !important;
+}
+/* Explicit defaults when data-theme is SET (so stray [hidden] attributes
+   left by previous runs / partial hydration do not accidentally suppress
+   the visible branch). Rules only re-show elements that belong to the
+   currently active theme. */
+html[data-theme="white"] [data-theme-only="white"]:not([data-debug-only]),
+html[data-theme="dark"]  [data-theme-only="dark"]:not([data-debug-only]) {
+  visibility: visible;
+  pointer-events: auto;
+}
+/* Hard guarantee: sidebar reports (desktop: always-on left column) is NEVER
+   rendered on the light Vocero mobile theme. Double-safety even if the
+   `data-theme-only="dark"` gate is somehow stripped or JS runtime fails. */
+html[data-theme="white"] #reports-sidebar,
+html[data-theme="white"] .reports-sidebar,
+html[data-theme="white"] .reports-sidebar-inner,
+html[data-theme="white"] #reports-sidebar-toggle,
+html[data-theme="white"] #reports-hint,
+html[data-theme="white"] .reports-hint {
+  display: none !important;
+  width: 0 !important;
+  height: 0 !important;
+  padding: 0 !important;
+  margin: 0 !important;
+  transform: translateX(-9999px) !important;
+  visibility: hidden !important;
+}
+/* In white theme, app column must not leave a 320px gutter for the desktop
+   reports-sidebar (which was the dark-theme default layout). Reset paddings. */
+html[data-theme="white"] #app,
+html[data-theme="white"] .app-column {
+  padding-left: 16px !important;
+  padding-right: 16px !important;
+  margin-left: 0 !important;
+}
+/* ─────────────────────────────────────────────────────────────────────
+   USER FIX 2026-09-10 "la chat deve apparire solo nel chat box":
+   The dark theme renders a SECOND ephemeral transcript into #bubble-stack
+   (floating anchored top-right — the grey/light blue bubbles the user
+   circled in red with an X on the last screenshot). Since the white
+   mobile theme shows ALL conversation exclusively inside the persistent
+   "Conversación" card (chat-history inside .chat-panel bounded 58dvh),
+   we kill the parallel floating bubble stack HARD in white theme — both
+   the ID and the class, zero width/height/transform so it can't leave
+   layout artifacts. */
+html[data-theme="white"] #bubble-stack,
+html[data-theme="white"] .bubble-stack {
+  display: none !important;
+  width: 0 !important;
+  height: 0 !important;
+  padding: 0 !important;
+  margin: 0 !important;
+  transform: translateX(-9999px) !important;
+  visibility: hidden !important;
+  pointer-events: none !important;
+}
+
+/* ═══════════════════════════════════════════════════════════════════════
+   THEME WHITE — S2S_THEME="white"
+   Light mobile "Vocero app" theme matching the provided screenshot:
+   pure white background, deep blue accents, card-based UI, avatar+timestamp
+   per chat bubble, rounded input with clip+send.
+   Activated on <html data-theme="white"> (main.js sets the attr from
+   /api/config response). All selectors below are scoped to that attribute
+   so the native dark theme is 100% preserved when the flag is off.
+   ═══════════════════════════════════════════════════════════════════════ */
+
+html[data-theme="white"] {
+  color-scheme: light;
+  /* ── Token overrides ─────────────────────────────────────────────── */
+  --bg:            #ffffff;
+  --bg-elev:       #f8fafc;
+  --bg-elev-2:     #f1f5f9;
+  --border:        rgba(15, 23, 42, 0.08);
+  --border-strong: rgba(15, 23, 42, 0.16);
+  --glass:         rgba(255, 255, 255, 0.85);
+  --glass-strong:  rgba(248, 250, 252, 0.92);
+  --text:          #0f172a;                 /* slate-900 */
+  --text-dim:      rgba(15, 23, 42, 0.72);
+  --text-faint:    rgba(15, 23, 42, 0.55);
+
+  --brand:         #1f6feb;                 /* deep corporate blue */
+  --brand-2:       #3b82f6;                 /* medium blue */
+  --brand-3:       #60a5fa;                 /* light blue */
+  --accent:        #2563eb;                 /* primary blue */
+  --accent-2:      #3b82f6;                 /* call-to-action blue */
+  --listening:     #2563eb;
+  --speaking:      #1d4ed8;
+  --processing:    #d97706;
+  --error:         #dc2626;
+  --success:       #16a34a;
+
+  --brand-gradient: linear-gradient(135deg, #2563eb 0%, #3b82f6 55%, #60a5fa 100%);
+  --brand-soft-gradient: linear-gradient(135deg, rgba(37, 99, 235, 0.18),
+                                                      rgba(59, 130, 246, 0.14) 55%,
+                                                      rgba(96, 165, 250, 0.18));
+
+  --voice-user:      #2563eb;
+  --voice-assistant: #64748b;
+  --voice-tool:      #d97706;
+
+  --shadow-soft:        0 6px 20px rgba(15, 23, 42, 0.06);
+  --shadow-glow-brand:  0 0 28px -6px rgba(37, 99, 235, 0.45),
+                        0 0 60px -18px rgba(59, 130, 246, 0.40);
+  --shadow-glass:       0 2px 12px rgba(15, 23, 42, 0.06), 0 1px 3px rgba(15, 23, 42, 0.04);
+
+  --radius-sm: 10px;
+  --radius-md: 16px;
+  --radius-lg: 22px;
+  --radius-xl: 28px;
+}
+
+/* ── Page chrome (strip aurora gradients / dot patterns) ────────────── */
+html[data-theme="white"] body {
+  background: #ffffff !important;
+  color: var(--text);
+  background-image: none;
+}
+html[data-theme="white"] body::before,
+html[data-theme="white"] body::after {
+  display: none !important;
+  background-image: none;
+  animation: none;
+}
+
+/* ── App column: slightly reduce reserved bottom room (footer is thinner in white theme) */
+html[data-theme="white"] #app {
+  padding-bottom: max(100px, calc(env(safe-area-inset-bottom, 0px) + 100px));
+}
+
+/* ── Talk-unlocker (S2S_START_SESSION_MODE=TALK) — restyle for light bg */
+html[data-theme="white"] .talk-unlocker {
+  background: linear-gradient(180deg, rgba(255,255,255,0.70) 0%, rgba(255,255,255,0.88) 100%);
+}
+html[data-theme="white"] .talk-unlocker-hint {
+  background: #ffffff;
+  border-color: rgba(15, 23, 42, 0.08);
+  color: #0f172a;
+  box-shadow: 0 20px 60px rgba(15, 23, 42, 0.10), inset 0 1px 0 rgba(255,255,255,1);
+}
+html[data-theme="white"] .talk-unlocker-spinner {
+  border-color: rgba(37,99,235,0.10);
+  border-top-color: #2563eb;
+  border-right-color: #3b82f6;
+}
+html[data-theme="white"] .talk-unlocker-title { color: #0f172a; }
+html[data-theme="white"] .talk-unlocker-sub   { color: rgba(15,23,42,0.65); }
+
+/* ── Topbar — flat, no card, center brand, hamburger left, avatar right ── */
+html[data-theme="white"] .topbar {
+  padding: 18px 18px 6px 18px;
+  align-items: center;
+  gap: 10px;
+}
+html[data-theme="white"] .menu-btn {
+  color: #0f172a;
+  width: 44px;
+  height: 44px;
+  padding: 0;
+  border-radius: 12px;
+  display: inline-flex !important;
+  align-items: center;
+  justify-content: center;
+  opacity: 0.9;
+}
+html[data-theme="white"] .menu-btn:hover {
+  background: rgba(15, 23, 42, 0.05);
+  opacity: 1;
+}
+/* ── Topbar layout (theme=white): 3-column grid ──────────────────────────
+   Col1 = hamburger 52 px  ·  Col2 = brand centered  ·  Col3 = user avatar 52 px
+   Using a real grid eliminates absolute-position overlap bugs between the
+   avatar circle and the 2-line brand title/subtitle that plagued the previous
+   implementation. Every item lives inside its own grid cell → no collision. */
+html[data-theme="white"] .topbar {
+  display: grid !important;
+  grid-template-columns: 52px minmax(0, 1fr) 52px;
+  grid-auto-rows: min-content;
+  align-items: start;
+  justify-items: center;
+  column-gap: 4px;
+  row-gap: 0;
+  padding: 16px 10px 0;
+  position: static !important;
+  box-sizing: border-box;
+  width: 100%;
+  background: transparent;
+  border: none;
+}
+html[data-theme="white"] .menu-btn {
+  grid-column: 1 / 2;
+  grid-row: 1 / 2;
+  justify-self: start;
+  align-self: center;
+  margin: 0 0 0 2px;
+}
+/* Brand card → strip glass, becomes a transparent centered title block */
+html[data-theme="white"] .brand {
+  grid-column: 2 / 3;
+  grid-row: 1 / 2;
+  flex: none;
+  width: 100%;
+  max-width: 100%;
+  padding: 0;
+  margin: 0;
+  background: transparent !important;
+  border: none !important;
+  backdrop-filter: none;
+  -webkit-backdrop-filter: none;
+  box-shadow: none;
+  display: flex;
+  justify-content: center;
+  text-align: center;
+  border-radius: 0;
+  justify-self: center;
+}
+html[data-theme="white"] .brand::before { display: none; }
+html[data-theme="white"] .ident {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  justify-content: center;
+  text-align: center;
+  gap: 2px;
+  width: 100%;
+  max-width: 100%;
+  padding: 0 4px !important;
+  box-sizing: border-box;
+}
+html[data-theme="white"] .ident-head {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  justify-content: center;
+  text-align: center;
+  gap: 2px;
+  width: 100%;
+  max-width: 100%;
+  margin: 0 auto;
+  /* Prevent 2-line brand words from ever overflowing on narrow phones */
+  word-break: keep-all;
+  overflow-wrap: normal;
+}
+html[data-theme="white"] .ident-user-name {
+  grid-column: 3 / 4;
+  grid-row: 1 / 2;
+  position: static !important;
+  justify-self: end;
+  align-self: center;
+  margin: 0 2px 0 0;
+  z-index: 2;
+  width: 42px;
+  height: 42px;
+  border-radius: 999px;
+  background: linear-gradient(135deg, #3b82f6 0%, #60a5fa 100%);
+  color: #ffffff;
+  font-size: 13px;
+  font-weight: 700;
+  display: inline-flex !important;
+  align-items: center;
+  justify-content: center;
+  border: 2px solid rgba(59, 130, 246, 0.25);
+  box-shadow: 0 3px 10px rgba(37, 99, 235, 0.22);
+}
+html[data-theme="white"] .ident-title {
+  font-size: clamp(24px, 6vw, 32px);
+  font-weight: 800;
+  letter-spacing: -0.02em;
+  color: #0f172a !important;
+  background: none !important;
+  -webkit-background-clip: initial;
+          background-clip: initial;
+  -webkit-text-fill-color: initial;
+  text-shadow: none;
+  filter: none;
+  line-height: 1.05;
+  white-space: nowrap;
+}
+/* Subtitle "Agente conversacional" below Vocero (theme=white only) */
+html[data-theme="white"] .ident-subtitle {
+  margin: 0;
+  font-size: clamp(12px, 2.6vw, 14px);
+  color: rgba(15, 23, 42, 0.60);
+  font-weight: 500;
+  letter-spacing: -0.005em;
+  display: block;
+  line-height: 1.3;
+  white-space: nowrap;
+}
+html[data-theme="white"] .topbar-right {
+  /* debug-only controls (tools/settings) hidden; keep them out of grid flow */
+  display: none;
+}
+
+/* ── Status card: "Listo para conversar / Informes, análisis..." ───────
+     User request 2026-09-10 "nascondi box listo para conversar" — hide the
+     entire status card in white theme (the grey rounded banner with the
+     chart icon and arrow between topbar and mic stage, which the user
+     circled with a red X). Previously we hid only the right chevron; now
+     we kill the full container with the same double-guarantee pattern
+     used for the sidebar / bubble-stack. ──────────────────────────────── */
+html[data-theme="white"] .status-card,
+html[data-theme="white"] .status-card-icon,
+html[data-theme="white"] .status-card-text,
+html[data-theme="white"] .status-card-title,
+html[data-theme="white"] .status-card-sub,
+html[data-theme="white"] .status-card-arrow {
+  display: none !important;
+  width: 0 !important;
+  height: 0 !important;
+  padding: 0 !important;
+  margin: 0 !important;
+  transform: translateX(-9999px) !important;
+  visibility: hidden !important;
+  pointer-events: none !important;
+}
+
+/* ── Stage: tighten room (purple orb + arc hidden by data-theme-only=dark) */
+html[data-theme="white"] .stage {
+  padding: 10px 16px 6px;
+  gap: 12px;
+  min-height: 0;
+}
+/* Safety: hide orb wrapper even if data-theme-only=dark fails for any reason */
+html[data-theme="white"] .orb-wrap,
+html[data-theme="white"] #mic-gate,
+html[data-theme="white"] #stop-btn {
+  display: none !important;
+}
+html[data-theme="white"] #circle-caption    { display: none !important; }
+html[data-theme="white"] #circle-subcaption { display: none !important; }
+
+/* ── White mic stage (116px blue circle, waveform banks, caption, stop pill) ── */
+html[data-theme="white"] .white-mic-stage {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  gap: 16px;
+  padding: 22px 0 6px;
+  position: relative;
+  box-sizing: border-box;
+}
+/* Row: waveform-left · mic-circle · waveform-right (absolute centered row) */
+html[data-theme="white"] .white-mic-circle {
+  position: relative;
+  z-index: 2;
+  width: 116px;
+  height: 116px;
+  border-radius: 999px;
+  border: none;
+  padding: 0;
+  cursor: pointer;
+  background: #ffffff;
+  color: #ffffff;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  box-sizing: border-box;
+  overflow: visible;
+  flex: none;
+  transition: transform 180ms cubic-bezier(.2,.7,.2,1), box-shadow 180ms ease;
+}
+/* Concentric layers of the blue mic button */
+html[data-theme="white"] .white-mic-circle .wmc-halo {
+  position: absolute;
+  inset: -22px;
+  border-radius: 999px;
+  background: radial-gradient(closest-side,
+    rgba(59, 130, 246, 0.22),
+    rgba(59, 130, 246, 0.10) 55%,
+    transparent 75%);
+  z-index: 0;
+  pointer-events: none;
+  animation: wmcHaloPulse 3.2s ease-in-out infinite alternate;
+}
+@keyframes wmcHaloPulse {
+  0%   { transform: scale(0.98); opacity: 0.75; }
+  100% { transform: scale(1.08); opacity: 1; }
+}
+html[data-theme="white"] .white-mic-circle .wmc-ring {
+  position: absolute;
+  inset: 0;
+  border-radius: 999px;
+  padding: 4px;
+  background: linear-gradient(135deg, #2563eb 0%, #3b82f6 45%, #60a5fa 100%);
+  z-index: 0;
+  pointer-events: none;
+  box-sizing: border-box;
+  display: block;
+}
+/* The ring paints a thin blue 4-px border around a transparent inner circle
+   (NOT a full white disc that would occlude the solid blue core behind it). */
+html[data-theme="white"] .white-mic-circle .wmc-ring::before {
+  content: "";
+  display: block;
+  width: 100%;
+  height: 100%;
+  border-radius: 999px;
+  background: transparent;
+}
+/* Solid blue disc filling everything inside the 4-px ring. This sits BEHIND
+   the white mic icon so the button looks like a solid blue circle with a
+   thin gradient light-blue border — exactly the screenshot look. */
+html[data-theme="white"] .white-mic-circle .wmc-core {
+  position: absolute;
+  inset: 4px;                 /* sit flush inside the 4-px wmc-ring padding */
+  border-radius: 999px;
+  background: linear-gradient(135deg, #2563eb 0%, #3b82f6 55%, #60a5fa 100%);
+  box-shadow:
+    inset 0 1px 0 rgba(255, 255, 255, 0.35),
+    inset 0 -3px 6px rgba(15, 23, 42, 0.12),
+    0 8px 22px rgba(37, 99, 235, 0.22);
+  z-index: 1;
+  pointer-events: none;
+}
+/* Icon layer: WHITE on top of the solid blue disc, never occluded. */
+html[data-theme="white"] .white-mic-circle .wmc-icon {
+  position: relative;
+  z-index: 5;                     /* above halo / ring / core */
+  color: #ffffff !important;
+  fill: #ffffff;
+  stroke: #ffffff;
+  width: 48px;
+  height: 48px;
+  flex: none;
+  display: none;
+  filter: drop-shadow(0 2px 4px rgba(15, 23, 42, 0.14));
+}
+/* Force visibility of the mic SVG in idle / your-turn / error states — the
+   most common customer-reported missing-icon bug comes from a stale state
+   where `state-idle` exists but `.wmc-mic` still has `display:none`. The
+   rules below are written with high specificity and !important on the
+   display property so they cannot be overridden by accidental resets. */
+html[data-theme="white"] .white-mic-circle.state-idle > svg.wmc-icon.wmc-mic,
+html[data-theme="white"] .white-mic-circle.state-idle .wmc-icon.wmc-mic {
+  display: inline-flex !important;
+}
+html[data-theme="white"] .white-mic-circle.state-your-turn > svg.wmc-icon.wmc-mic,
+html[data-theme="white"] .white-mic-circle.state-your-turn .wmc-icon.wmc-mic {
+  display: inline-flex !important;
+}
+html[data-theme="white"] .white-mic-circle.state-error > svg.wmc-icon.wmc-mic,
+html[data-theme="white"] .white-mic-circle.state-error .wmc-icon.wmc-mic {
+  display: inline-flex !important;
+}
+html[data-theme="white"] .white-mic-circle.state-processing > .wmc-icon.wmc-spinner,
+html[data-theme="white"] .white-mic-circle.state-processing .wmc-icon.wmc-spinner,
+html[data-theme="white"] .white-mic-circle.state-connecting > .wmc-icon.wmc-spinner,
+html[data-theme="white"] .white-mic-circle.state-connecting .wmc-icon.wmc-spinner,
+html[data-theme="white"] .white-mic-circle.state-queued > .wmc-icon.wmc-spinner,
+html[data-theme="white"] .white-mic-circle.state-queued .wmc-icon.wmc-spinner {
+  display: block !important;
+  width: 40px !important;
+  height: 40px !important;
+  border-radius: 999px;
+  border: 4px solid rgba(255, 255, 255, 0.22) !important;
+  border-top-color: #ffffff !important;
+  animation: talkSpinnerSpin 850ms linear infinite;
+  margin: 4px !important;
+  padding: 0 !important;
+  background: transparent !important;
+  box-sizing: border-box;
+}
+html[data-theme="white"] .white-mic-circle.state-ai-speaking > svg.wmc-icon.wmc-stop,
+html[data-theme="white"] .white-mic-circle.state-ai-speaking .wmc-icon.wmc-stop {
+  display: inline-flex !important;
+  width: 34px !important;
+  height: 34px !important;
+  margin: 7px !important;
+  border-radius: 4px !important;
+}
+/* Subtle ring pulse while listening — uses box-shadow because the ring
+   itself is a hard 4-px painted border and transform:scale() would also
+   scale the icon. */
+html[data-theme="white"] .white-mic-circle.state-your-turn .wmc-ring {
+  animation: wmcListeningPulse 1.6s ease-in-out infinite;
+}
+@keyframes wmcListeningPulse {
+  0%, 100% { box-shadow: 0 0 0 0   rgba(59, 130, 246, 0.45); }
+  50%      { box-shadow: 0 0 0 18px rgba(59, 130, 246, 0); }
+}
+
+/* ── Waveform banks (7 bars each side) ──────────────────────────────── */
+html[data-theme="white"] .white-waveform {
+  position: absolute;
+  top: calc(22px + 116px / 2);
+  transform: translateY(-50%);
+  display: flex;
+  align-items: center;
+  gap: 7px;
+  height: 70px;
+  pointer-events: none;
+  z-index: 1;
+}
+html[data-theme="white"] .white-waveform-left  { left:  calc(50% - 58px - 90px); }
+html[data-theme="white"] .white-waveform-right { right: calc(50% - 58px - 90px); }
+html[data-theme="white"] .white-waveform .w-bar {
+  display: block;
+  width: 6px;
+  border-radius: 999px;
+  background: linear-gradient(180deg, #3b82f6, #60a5fa);
+  opacity: 0.8;
+  transform-origin: center;
+  height: calc(var(--bar-h, 0.5) * 70px);
+  min-height: 8px;
+}
+html[data-theme="white"] .white-mic-circle.state-your-turn ~ * .w-bar,
+html[data-theme="white"] .white-mic-stage:has(.state-your-turn) .w-bar {
+  animation: wBarDance 900ms ease-in-out infinite alternate;
+}
+@keyframes wBarDance {
+  from { transform: scaleY(0.55); }
+  to   { transform: scaleY(1.05); }
+}
+html[data-theme="white"] .white-waveform .wb-1 { animation-delay: -0.6s; }
+html[data-theme="white"] .white-waveform .wb-2 { animation-delay: -0.5s; }
+html[data-theme="white"] .white-waveform .wb-3 { animation-delay: -0.4s; }
+html[data-theme="white"] .white-waveform .wb-4 { animation-delay: -0.3s; }
+html[data-theme="white"] .white-waveform .wb-5 { animation-delay: -0.2s; }
+html[data-theme="white"] .white-waveform .wb-6 { animation-delay: -0.1s; }
+html[data-theme="white"] .white-waveform .wb-7 { animation-delay:  0.0s; }
+html[data-theme="white"] .white-waveform-right .wb-1 { animation-delay: -0.0s; }
+html[data-theme="white"] .white-waveform-right .wb-2 { animation-delay: -0.1s; }
+html[data-theme="white"] .white-waveform-right .wb-3 { animation-delay: -0.2s; }
+html[data-theme="white"] .white-waveform-right .wb-4 { animation-delay: -0.3s; }
+html[data-theme="white"] .white-waveform-right .wb-5 { animation-delay: -0.4s; }
+html[data-theme="white"] .white-waveform-right .wb-6 { animation-delay: -0.5s; }
+html[data-theme="white"] .white-waveform-right .wb-7 { animation-delay: -0.6s; }
+
+/* ── Mic caption "Escuchando... / Hablando..." ───────────────────────── */
+html[data-theme="white"] .white-mic-caption {
+  margin: 4px 0 0;
+  color: #2563eb;
+  font-size: clamp(17px, 4.2vw, 20px);
+  font-weight: 600;
+  letter-spacing: -0.005em;
+  text-align: center;
+  line-height: 1.25;
+}
+html[data-theme="white"] .white-mic-caption.muted   { color: #64748b; }
+html[data-theme="white"] .white-mic-caption.error   { color: #dc2626; }
+
+/* ── "Detener" pill ─────────────────────────────────────────────────── */
+html[data-theme="white"] .white-stop-btn {
+  display: inline-flex;
+  align-items: center;
+  gap: 10px;
+  padding: 10px 22px 10px 16px;
+  background: #e2e8f0;
+  color: #0f172a;
+  border: none;
+  border-radius: 999px;
+  cursor: pointer;
+  font-size: clamp(14px, 3.4vw, 16px);
+  font-weight: 600;
+  letter-spacing: -0.005em;
+  box-shadow: 0 2px 8px rgba(15, 23, 42, 0.06);
+  transition: background 160ms ease, transform 160ms ease;
+}
+html[data-theme="white"] .white-stop-btn:hover {
+  background: #cbd5e1;
+  transform: translateY(-1px);
+}
+html[data-theme="white"] .white-stop-btn svg {
+  width: 18px;
+  height: 18px;
+  border-radius: 3px;
+  color: #0f172a;
+  flex: none;
+}
+
+/* ── Quick actions — 3 pills (Resumen / Consultar datos / Crear respuesta).
+     User request 2026-09-10 "nascondi le cose in rosso": all 3 quick action
+     pills are circled in red → hide the entire quick-actions container. */
+html[data-theme="white"] .quick-actions {
+  display: none !important;
+}
+html[data-theme="white"] .quick-action-btn {
+  display: none !important;
+}
+
+/* ── Chat panel (Conversación card): white rounded card + "En línea" pill.
+     CRITICAL SCROLL FIX 2026-09-10 (per "non fa lo scrolling della chatbox"):
+     The previous white-theme override set `flex: 0 0 auto` + `max-height: none`
+     which removed every vertical constraint on the chat panel → it grew beyond
+     the viewport edge → overflow on the *page* body instead of the chat
+     history scrollbox. Instead we preserve the dark-theme flex-col panel
+     contract (chat-panel grows into the free space, chat-panel-inner and
+     chat-history are flex items with min-height:0 to enable shrinking) and
+     we cap the whole card at 58dvh so the topbar + status + mic stage + quick
+     actions are always visible above it.  ─────────────────────────────────── */
+html[data-theme="white"] .chat-panel {
+  margin: 6px 18px 0;
+  padding: 0;
+  background: #ffffff;
+  border: 1px solid rgba(15, 23, 42, 0.06);
+  border-radius: 22px;
+  box-shadow: var(--shadow-soft);
+  width: auto;
+  max-width: none;
+  /* Layout contract for scrollable chat: absorb remaining vertical room,
+     shrink as low as needed, cap the card for a sensible upper bound,
+     and hide any panel-level overflow (chat-history will own the scroll). */
+  flex: 1 1 auto !important;
+  min-height: 180px;
+  max-height: 58dvh !important;
+  max-height: 58svh !important;
+  display: flex;
+  flex-direction: column;
+  overflow: hidden;
+  box-sizing: border-box;
+}
+html[data-theme="white"] .chat-panel-inner {
+  padding: 14px 14px 12px;
+  /* Critical: pass the chat-panel's fixed height down into the inner so
+     chat-history can later compute its own flex shrink/scroll correctly. */
+  display: flex !important;
+  flex-direction: column !important;
+  height: 100% !important;
+  width: 100%;
+  box-sizing: border-box;
+  min-height: 0;
+  overflow: hidden;
+}
+html[data-theme="white"] .chat-panel-header {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 12px;
+  padding: 2px 4px 12px;
+  margin: 0 0 4px;
+  border-bottom: 1px solid rgba(15, 23, 42, 0.06);
+  /* Header never shrinks out of existence; keep it pinned. */
+  flex: none;
+}
+html[data-theme="white"] .chat-panel-header h3 {
+  margin: 0;
+  color: #0f172a !important;        /* slate-900 flat, no brand gradient */
+  background: none !important;
+  -webkit-background-clip: initial !important;
+          background-clip: initial !important;
+  -webkit-text-fill-color: initial !important;
+          text-fill-color: initial !important;
+  text-shadow: none;
+  filter: none;
+  opacity: 1;
+  font-size: clamp(18px, 4.3vw, 22px);
+  font-weight: 700 !important;
+  letter-spacing: -0.01em !important;
+  text-transform: none !important;      /* TitleCase, no ALLCAPS */
+  text-decoration: none !important;     /* kill the underline */
+  border-bottom: none !important;
+  box-shadow: none !important;
+}
+/* Also force the header <hr>-like bottom border to be a thin divider (not a
+   thick blue underline visually sitting right below "CONVERSACIÓN" — which is
+   what the user's screenshot is showing as the blue underline effect). */
+html[data-theme="white"] .chat-panel-header {
+  border-bottom-style: solid !important;
+  border-bottom-color: rgba(15, 23, 42, 0.06) !important;
+  border-bottom-width: 1px !important;
+  text-decoration: none !important;
+}
+/* "En línea" status pill — green dot + text */
+html[data-theme="white"] .chat-status-pill {
+  display: inline-flex;
+  align-items: center;
+  gap: 7px;
+  padding: 5px 11px 5px 8px;
+  background: rgba(22, 163, 74, 0.08);
+  border-radius: 999px;
+  color: #16a34a;
+  font-size: 12.5px;
+  font-weight: 600;
+  flex: none;
+}
+html[data-theme="white"] .chat-status-dot {
+  width: 9px;
+  height: 9px;
+  border-radius: 999px;
+  background: #16a34a;
+  box-shadow: 0 0 0 3px rgba(22, 163, 74, 0.14);
+  display: block;
+  flex: none;
+  animation: chatStatusDotPulse 2s ease-in-out infinite;
+}
+@keyframes chatStatusDotPulse {
+  0%, 100% { box-shadow: 0 0 0 3px rgba(22, 163, 74, 0.14); }
+  50%      { box-shadow: 0 0 0 5px rgba(22, 163, 74, 0.08); }
+}
+
+/* ── Chat header actions row: contiene "En línea" status pill + Export button.
+      Aggiunto 2026-09-23: bottone download conversación.
+      Layout orizzontale, allineato a destra, auto-wrap con gap per evitare
+      overflow su schermi stretti.                                                         */
+.chat-header-actions {
+  display: inline-flex;
+  align-items: center;
+  justify-content: flex-end;
+  gap: 8px;
+  flex: 0 0 auto;
+  flex-wrap: wrap;
+  min-width: 0;
+}
+/* Botón export conversación (icon button baseline: coerente con altri .icon-btn). */
+.chat-export-btn {
+  position: relative;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 32px;
+  height: 32px;
+  padding: 0;
+  border-radius: 999px;
+  border: 1px solid rgba(255, 255, 255, 0.10);
+  background: rgba(255, 255, 255, 0.06);
+  color: rgba(255, 255, 255, 0.88);
+  cursor: pointer;
+  transition: transform 0.12s ease, background 0.16s ease, color 0.16s ease, border-color 0.16s ease, box-shadow 0.16s ease;
+  flex: 0 0 auto;
+  overflow: visible;
+  -webkit-tap-highlight-color: transparent;
+}
+.chat-export-btn:focus-visible {
+  outline: 2px solid var(--brand, #6d63ff);
+  outline-offset: 2px;
+}
+.chat-export-btn:hover {
+  background: rgba(255, 255, 255, 0.12);
+  border-color: rgba(255, 255, 255, 0.18);
+  transform: translateY(-0.5px);
+}
+.chat-export-btn:active {
+  transform: translateY(0);
+  background: rgba(255, 255, 255, 0.08);
+}
+.chat-export-btn svg {
+  display: block;
+  pointer-events: none;
+  flex: 0 0 auto;
+}
+/* Feedback OK: verde temporáneo al exportar correctamente. */
+.chat-export-btn.chat-export-ok {
+  background: rgba(22, 163, 74, 0.18) !important;
+  border-color: rgba(22, 163, 74, 0.34) !important;
+  color: #22c55e !important;
+  box-shadow: 0 0 0 2px rgba(22, 163, 74, 0.12);
+}
+/* Feedback vacía: pulse ámbar (ningún mensaje para exportar). */
+.chat-export-btn.chat-export-empty {
+  background: rgba(245, 158, 11, 0.18) !important;
+  border-color: rgba(245, 158, 11, 0.34) !important;
+  color: #f59e0b !important;
+  animation: chatExportEmptyShake 0.42s ease-in-out;
+}
+@keyframes chatExportEmptyShake {
+  0%, 100% { transform: translateX(0); }
+  20%      { transform: translateX(-2px); }
+  40%      { transform: translateX(2px); }
+  60%      { transform: translateX(-1.5px); }
+  80%      { transform: translateX(1.5px); }
+}
+
+/* White-theme variants of the above (matches screenshot chat header). */
+html[data-theme="white"] .chat-header-actions {
+  gap: 10px;
+}
+html[data-theme="white"] .chat-export-btn {
+  border-color: rgba(15, 23, 42, 0.08);
+  background: rgba(15, 23, 42, 0.03);
+  color: #0f172a;
+}
+html[data-theme="white"] .chat-export-btn:hover {
+  background: rgba(59, 130, 246, 0.08);
+  border-color: rgba(59, 130, 246, 0.22);
+  color: #1d4ed8;
+}
+html[data-theme="white"] .chat-export-btn:active { background: rgba(59, 130, 246, 0.12); }
+html[data-theme="white"] .chat-export-btn.chat-export-ok {
+  background: rgba(22, 163, 74, 0.12) !important;
+  border-color: rgba(22, 163, 74, 0.24) !important;
+  color: #15803d !important;
+}
+html[data-theme="white"] .chat-export-btn.chat-export-empty {
+  background: rgba(245, 158, 11, 0.12) !important;
+  border-color: rgba(245, 158, 11, 0.24) !important;
+  color: #b45309 !important;
+}
+
+/* ──────────────────────────────────────────────────
+   THE SCROLLABLE HISTORY BOX (root cause of "non scorre")
+   Before: max-height:none. Now it's a flex item with flex:1 1 auto inside
+   .chat-panel-inner, which has a bounded 100% height of its parent.
+   min-height:0 is MANDATORY — without it, flex column children never shrink
+   below their content size, and overflow-y:auto never activates.      */
+html[data-theme="white"] .chat-history {
+  padding: 12px 4px 40px !important;   /* 40 px bottom air inside scroll */
+  gap: 14px;
+  display: flex;
+  flex-direction: column;
+  flex: 1 1 auto !important;
+  min-height: 0 !important;            /* MAGIC: enable shrink for scroll */
+  max-height: 100% !important;
+  overflow-y: auto !important;
+  overflow-x: hidden !important;
+  scrollbar-width: thin;
+  -webkit-overflow-scrolling: touch;
+  overscroll-behavior: contain;
+}
+
+/* ── Chat history bubbles (white theme rewrite).
+     The real renderer (ui/chat.js _buildMessageEl) builds rows as:
+        <div class="hist-msg user|assistant">
+          <div class="hist-role">You / Assistant</div>   ← HIDE in white theme
+          <div class="hist-body">…message text…</div>   ← restyle as flat bubble
+     We target those classes (not the .bubble class, which is for the floating
+     ephemeral stack) because the persistent conversation rows live here. ─── */
+
+/* 1) Kill the old "You / Assistant / Tool call" uppercase mono eyebrow. The
+      Vocero mobile design replaces it with a name+timestamp meta line above
+      each bubble instead. */
+html[data-theme="white"] .chat-history .hist-role,
+html[data-theme="white"] .chat-history .bubble-role {
+  display: none !important;
+}
+
+/* 2) Layout: each row is a flex column with room for the 36 px avatar circle
+      sitting outside the bubble on the role side. */
+html[data-theme="white"] .chat-history .hist-msg,
+html[data-theme="white"] #bubble-stack .bubble {
+  display: flex;
+  flex-direction: column;
+  gap: 4px;
+  max-width: calc(100% - 56px);
+  box-sizing: border-box;
+  position: relative;
+  margin-top: 8px;
+  padding-top: 22px;      /* 22 px reserved for the "Vocero 16:14" meta label above */
+}
+/* Anchor hist-body/bubble-body so absolute-positioned floating meta labels
+   (painted via ::before on the body) use the bubble itself as the reference
+   box instead of climbing up to chat-history. This is the ROOT FIX of the
+   "16:14 timestamp floats in the middle of the page" bug from the previous
+   screenshot.   */
+html[data-theme="white"] .chat-history .hist-msg .hist-body,
+html[data-theme="white"] #bubble-stack .bubble .bubble-body {
+  position: relative;
+}
+
+/* 3) FLIP the default dark-theme alignment. Screenshot reference:
+      ASSISTANT = left side (blue bot avatar left of bubble, grey bubble)
+      USER      = right side (EM/AV initials circle on RIGHT, light-blue bubble)
+      The default dark purple theme stores them the opposite way, so we flip
+      align-self AND the auto margin here. */
+html[data-theme="white"] .chat-history .hist-msg.assistant,
+html[data-theme="white"] #bubble-stack .bubble.assistant {
+  align-self: flex-start !important;
+  margin-right: auto !important;
+  margin-left: 52px !important;    /* 36 avatar + 16 gap */
+}
+html[data-theme="white"] .chat-history .hist-msg.user,
+html[data-theme="white"] #bubble-stack .bubble.user {
+  align-self: flex-end !important;
+  margin-left: auto !important;
+  margin-right: 52px !important;
+}
+
+/* 4) The actual speech bubble body.
+      Assistant (grey flat 200-level): #F3F4F6 rounded 18 except bottom-left corner 6px
+      User  (light-blue 100):        #DBEAFE rounded 18 except bottom-right corner 6px
+      Drop every original dark-theme decoration: glass backdrop, 28px deep
+      drop shadow, gradient borders. Keep it perfectly flat. */
+html[data-theme="white"] .chat-history .hist-msg .hist-body,
+html[data-theme="white"] #bubble-stack .bubble .bubble-body {
+  padding: 12px 15px !important;
+  border-radius: 18px !important;
+  font-size: clamp(14.5px, 3.3vw, 16.5px) !important;
+  line-height: 1.45 !important;
+  letter-spacing: -0.005em !important;
+  color: #0f172a !important;
+  background: #ffffff;
+  border: 1px solid transparent !important;
+  box-shadow: none !important;
+  backdrop-filter: none !important;
+  -webkit-backdrop-filter: none !important;
+  word-break: break-word;
+  white-space: pre-wrap;
+}
+html[data-theme="white"] .chat-history .hist-msg.assistant .hist-body,
+html[data-theme="white"] #bubble-stack .bubble.assistant .bubble-body {
+  background: #f3f4f6 !important;
+  border-bottom-left-radius: 6px !important;
+  color: #0f172a !important;
+}
+html[data-theme="white"] .chat-history .hist-msg.user .hist-body,
+html[data-theme="white"] #bubble-stack .bubble.user .bubble-body {
+  background: #dbeafe !important;
+  border-bottom-right-radius: 6px !important;
+  color: #0f172a !important;
+}
+/* Partial-streaming bubble (growing AI response) = same shape, slightly lower opacity */
+html[data-theme="white"] .chat-history .hist-body.partial,
+html[data-theme="white"] .bubble-body.partial {
+  opacity: 0.92;
+}
+
+/* 5) AVATAR circles outside each bubble (painted on the row wrapper ::before)
+      Assistant: blue circle + inline robot SVG,  LEFT, outside bubble
+      User     : light-blue "AV"/"EM" initials, RIGHT, outside bubble
+      Initials placeholder for user is pulled from data-user-initials attribute
+      if the chat renderer writes it; fallback is the letters "AV" (matches the
+      Alessandro V… user shown in the customer screenshot).
+
+      NOTE 2026-09-10: we replaced the 🤖 emoji with a tiny hand-crafted SVG
+      robot icon painted via background-image. The emoji rendered as a
+      crown-head robot on some Android versions; the SVG is pixel-perfect
+      cross-platform and matches the deep-blue assistant avatar.   */
+html[data-theme="white"] .chat-history .hist-msg::before,
+html[data-theme="white"] #bubble-stack .bubble::before {
+  position: absolute !important;
+  top: 22px !important;              /* line up with bubble body, below the meta line */
+  width: 36px;
+  height: 36px;
+  border-radius: 999px;
+  display: inline-flex !important;
+  align-items: center;
+  justify-content: center;
+  color: #ffffff;
+  font-size: 14px;
+  font-weight: 700;
+  letter-spacing: -0.01em;
+  z-index: 2;
+  content: "";
+  box-shadow: 0 2px 8px rgba(15, 23, 42, 0.10);
+}
+html[data-theme="white"] .chat-history .hist-msg.assistant::before,
+html[data-theme="white"] #bubble-stack .bubble.assistant::before {
+  left: -52px;
+  background-color: #2563eb !important;
+  background-image: url("data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24' fill='none' stroke='white' stroke-width='1.8' stroke-linecap='round' stroke-linejoin='round'><rect x='3' y='7' width='18' height='12' rx='3'/><path d='M12 2v4'/><circle cx='9' cy='13' r='1.1' fill='white' stroke='none'/><circle cx='15' cy='13' r='1.1' fill='white' stroke='none'/><path d='M9 17h6'/></svg>");
+  background-repeat: no-repeat;
+  background-position: center center;
+  background-size: 20px 20px;
+  border: 1px solid rgba(59, 130, 246, 0.25);
+}
+/* Remove the old ::after with the robot emoji that was overlaying the avatar. */
+html[data-theme="white"] .chat-history .hist-msg.assistant::after,
+html[data-theme="white"] #bubble-stack .bubble.assistant::after {
+  display: none !important;
+  content: none !important;
+}
+html[data-theme="white"] .chat-history .hist-msg.user::before,
+html[data-theme="white"] #bubble-stack .bubble.user::before {
+  right: -52px;
+  background: linear-gradient(135deg, #3b82f6 0%, #60a5fa 100%);
+  border: 1px solid rgba(96, 165, 250, 0.35);
+  /* Pull initials from a custom data attribute when chat.js sets it, else show
+     "AV" as a generic 2-letter default that matches the customer screenshot */
+  content: attr(data-user-initials, "AV");
+  align-items: center;
+  justify-content: center;
+}
+
+/* 6) META label "name HH:MM" on the same single line, ONE pseudo-element.
+      ──── USER FIX 2026-09-10 "perche mette sempre Emilio" ────
+      The previous iteration hardcoded the Spanish names "Vocero" (assistant)
+      and "Emilio" (user) plus a fake "16:14" timestamp. Instead we now read
+      BOTH values dynamically from data attributes written by ui/chat.js at the
+      moment each row is inserted:
+        • assistant: data-asst-name + data-timestamp  on .hist-body
+        • user     : data-user-name + data-timestamp  on .hist-body
+      Names fall back to "Vocero" / "Usuario" (Spanish generic) when chat.js
+      hasn't resolved a profile yet; timestamp falls back to "" which leaves
+      just the name visible. The concat format uses two non-breaking spaces
+      (\A0\A0 = U+00A0 ×2) between name and time, matching the screenshot.
+
+      ──── ROOT CAUSE FIX of the previous "timestamp in the middle of the page" bug ────
+      The earlier implementation split the meta across TWO selectors that used
+      different relative reference boxes:
+        • `> :first-child::before` → targetted .hist-role (hidden, display:none)
+          with `position:absolute; top:-20px` which had NO containing block, so
+          the browser walked up and used chat-history (full-width) → label
+          ended up at left=50% → "16:14" alone in the page centre.
+      NEW approach:
+        • Use the BUBBLE body itself (.hist-body / .bubble-body) as the single
+          relative reference box. Paint both NAME + HH:MM in ONE `content:`
+          string via `.hist-body::before`. Same absolute positioning as
+          before, but now contained inside the width of each bubble → name and
+          timestamp sit *perfectly aligned* above their bubble on every row,
+          at any viewport width.   */
+html[data-theme="white"] .chat-history .hist-msg.assistant .hist-body::before,
+html[data-theme="white"] #bubble-stack .bubble.assistant .bubble-body::before {
+  /* Assistant meta = "<real assistant name>  <real HH:MM>" */
+  content: attr(data-asst-name, "Vocero") "\A0\A0" attr(data-timestamp, "");
+  position: absolute;
+  top: -22px;
+  left: 0;
+  width: auto;
+  height: 16px;
+  line-height: 16px;
+  font-size: 12.5px;
+  font-weight: 600;
+  color: #64748b;
+  letter-spacing: -0.01em;
+  white-space: nowrap;
+  pointer-events: none;
+  display: inline-block !important;
+}
+html[data-theme="white"] .chat-history .hist-msg.user .hist-body::before,
+html[data-theme="white"] #bubble-stack .bubble.user .bubble-body::before {
+  /* User meta = "<real user name>  <real HH:MM>"
+     Falls back to "Usuario" when no caller profile has been injected yet,
+     never "Emilio" — user explicitly flagged the hard-coded name as wrong. */
+  content: attr(data-user-name, "Usuario") "\A0\A0" attr(data-timestamp, "");
+  position: absolute;
+  top: -22px;
+  right: 0;
+  width: auto;
+  height: 16px;
+  line-height: 16px;
+  font-size: 12.5px;
+  font-weight: 600;
+  color: #64748b;
+  letter-spacing: -0.01em;
+  white-space: nowrap;
+  pointer-events: none;
+  text-align: right;
+  display: inline-block !important;
+}
+/* Tool-call rows: shrink to pale inline card with no avatar */
+html[data-theme="white"] .chat-history .hist-msg.tool,
+html[data-theme="white"] .chat-history .bubble.tool {
+  max-width: 100% !important;
+  padding-top: 0;
+  margin: 6px 0 !important;
+  align-self: center !important;
+}
+html[data-theme="white"] .chat-history .hist-msg.tool::before,
+html[data-theme="white"] .chat-history .bubble.tool::before,
+html[data-theme="white"] .chat-history .hist-msg.tool::after,
+html[data-theme="white"] .chat-history .bubble.tool::after {
+  display: none !important;
+  content: none;
+}
+/* Also strip the floating meta from tool rows (they don't have a human role). */
+html[data-theme="white"] .chat-history .hist-msg.tool .hist-body::before {
+  content: none !important;
+  display: none !important;
+}
+
+/* ── Chat form (input footer bar): clip · rounded input · blue send ────── */
+html[data-theme="white"] .chat-form {
+  display: flex !important;
+  align-items: center;
+  gap: 10px;
+  padding: 6px 6px 6px 6px;
+  background: #ffffff;
+  border: 1px solid rgba(15, 23, 42, 0.08);
+  border-radius: 999px;
+  margin: 4px 0 0;
+  box-shadow: var(--shadow-soft);
+  /* Keep the input row pinned at the bottom of the chat card header; never
+     let the history (flex:1) squeeze the form out of the panel. */
+  flex: none !important;
+}
+html[data-theme="white"] .chat-form[hidden],
+html[data-theme="white"] .chat-form[style*="display:none"] {
+  display: flex !important;
+}
+html[data-theme="white"] .chat-attach-btn {
+  flex: none;
+  width: 44px;
+  height: 44px;
+  padding: 0;
+  border-radius: 999px;
+  color: #64748b;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+}
+html[data-theme="white"] .chat-attach-btn:hover {
+  color: #2563eb;
+  background: rgba(37, 99, 235, 0.08);
+}
+html[data-theme="white"] .chat-input {
+  flex: 1 1 auto;
+  min-width: 0;
+  height: 44px;
+  padding: 0 10px 0 6px;
+  margin: 0;
+  background: transparent !important;
+  border: none !important;
+  color: #0f172a;
+  font-size: clamp(14px, 3.2vw, 16px);
+  border-radius: 0;
+  box-shadow: none !important;
+  outline: none !important;
+}
+html[data-theme="white"] .chat-input::placeholder {
+  color: rgba(15, 23, 42, 0.48);
+}
+html[data-theme="white"] .chat-input:focus {
+  border-color: transparent;
+  box-shadow: none;
+  outline: none;
+}
+/* Hide original square send button in white theme */
+html[data-theme="white"] .chat-form .chat-send-btn {
+  display: none !important;
+}
+/* New big round blue send button with paper airplane */
+html[data-theme="white"] .chat-send-btn-round {
+  flex: none;
+  width: 48px;
+  height: 48px;
+  padding: 0;
+  border: none;
+  border-radius: 999px;
+  background: linear-gradient(135deg, #2563eb, #3b82f6);
+  color: #ffffff;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  cursor: pointer;
+  box-shadow: 0 4px 12px rgba(37, 99, 235, 0.28), inset 0 1px 0 rgba(255, 255, 255, 0.3);
+  transition: transform 140ms ease, filter 140ms ease;
+}
+html[data-theme="white"] .chat-send-btn-round:hover {
+  transform: translateY(-1px);
+  filter: brightness(1.05);
+}
+html[data-theme="white"] .chat-send-btn-round svg {
+  width: 22px;
+  height: 22px;
+  stroke-width: 2.2;
+  fill: #ffffff;
+  stroke: #ffffff;
+}
+
+/* ── App footer: thin white bar, just a subtle separator + brand line ─── */
+html[data-theme="white"] .app-footer {
+  background: #ffffff;
+  backdrop-filter: none;
+  -webkit-backdrop-filter: none;
+  padding-top: 10px;
+  padding-bottom: max(10px, env(safe-area-inset-bottom, 0px));
+}
+html[data-theme="white"] .app-footer::before {
+  background: linear-gradient(90deg, transparent, rgba(37, 99, 235, 0.28) 30%, rgba(59, 130, 246, 0.28) 70%, transparent);
+  opacity: 0.6;
+}
+html[data-theme="white"] .app-footer-text {
+  color: rgba(15, 23, 42, 0.60);
+  background: none;
+  -webkit-text-fill-color: inherit;
+  -webkit-background-clip: initial;
+          background-clip: initial;
+  filter: none;
+  letter-spacing: 0.12em;
+  font-weight: 600;
+}
+
+/* ── Modals: light theme restyle to match the white palette ─────────── */
+html[data-theme="white"] .modal-content {
+  background: #ffffff;
+  color: #0f172a;
+  border: 1px solid rgba(15, 23, 42, 0.08);
+  box-shadow: 0 30px 80px rgba(15, 23, 42, 0.18);
+}
+html[data-theme="white"] .modal-header h2 { color: #0f172a; }
+html[data-theme="white"] .modal-header { border-bottom-color: rgba(15, 23, 42, 0.08); }
+html[data-theme="white"] .modal-footer { border-top-color: rgba(15, 23, 42, 0.08); }
+html[data-theme="white"] .modal input[type=text],
+html[data-theme="white"] .modal input[type=password],
+html[data-theme="white"] .modal textarea,
+html[data-theme="white"] .modal select {
+  background: #f8fafc;
+  border-color: rgba(15, 23, 42, 0.10);
+  color: #0f172a;
+}
+html[data-theme="white"] .modal input[type=text]:focus,
+html[data-theme="white"] .modal input[type=password]:focus,
+html[data-theme="white"] .modal textarea:focus,
+html[data-theme="white"] .modal select:focus {
+  border-color: #3b82f6;
+  box-shadow: 0 0 0 3px rgba(59, 130, 246, 0.15);
+}
+html[data-theme="white"] .btn.primary {
+  background: linear-gradient(135deg, #2563eb, #3b82f6);
+  color: #ffffff;
+  border-color: transparent;
+}
+html[data-theme="white"] .btn.primary:disabled {
+  opacity: 0.6;
+  filter: grayscale(0%);
+}
+html[data-theme="white"] .btn.secondary {
+  background: #f1f5f9;
+  color: #0f172a;
+  border-color: rgba(15, 23, 42, 0.10);
+}
+html[data-theme="white"] .btn.secondary:hover {
+  background: #e2e8f0;
+}
+
+/* ── Reports sidebar restyle (the off-canvas panel + left sidebar) ───── */
+html[data-theme="white"] .reports-sidebar,
+html[data-theme="white"] .reports-sidebar-inner {
+  background: #ffffff;
+  color: #0f172a;
+  border-color: rgba(15, 23, 42, 0.08);
+}
+html[data-theme="white"] .reports-sidebar-header {
+  border-bottom-color: rgba(15, 23, 42, 0.08);
+  color: #0f172a;
+}
+html[data-theme="white"] .reports-sidebar-header h3 { color: #0f172a; }
+
+/* ── Limit modal (budget) ───────────────────────────────────────────── */
+html[data-theme="white"] .limit-card {
+  background: #ffffff;
+  border: 1px solid rgba(15, 23, 42, 0.08);
+}
+html[data-theme="white"] .limit-title,
+html[data-theme="white"] .limit-msg { color: #0f172a; }
+html[data-theme="white"] .limit-note   { color: rgba(15, 23, 42, 0.62); }
+
+/* ── User profile modal ─────────────────────────────────────────────── */
+html[data-theme="white"] .user-profile-card {
+  background: #ffffff;
+}
+html[data-theme="white"] .user-profile-avatar {
+  background: linear-gradient(135deg, #2563eb, #60a5fa);
+  color: #ffffff;
+  border-color: rgba(37, 99, 235, 0.20);
+}
+html[data-theme="white"] .user-profile-title    { color: #0f172a; }
+html[data-theme="white"] .user-profile-subtitle { color: rgba(15, 23, 42, 0.65); }
+
+/* ── Tools modal switches ───────────────────────────────────────────── */
+html[data-theme="white"] .switch-track {
+  background: #cbd5e1;
+}
+html[data-theme="white"] .switch input:checked + .switch-track {
+  background: #2563eb;
+}
+
+/* ── Mobile: tighten when room is short ─────────────────────────────── */
+@media (max-width: 480px) {
+  html[data-theme="white"] .topbar { padding: 14px 14px 4px; }
+  html[data-theme="white"] .status-card { margin: 10px 14px 4px; }
+  html[data-theme="white"] .chat-panel { margin: 4px 14px 0; }
+  html[data-theme="white"] .white-waveform-left  { left:  calc(50% - 58px - 72px); }
+  html[data-theme="white"] .white-waveform-right { right: calc(50% - 58px - 72px); }
+  html[data-theme="white"] .white-waveform { gap: 5px; }
+  html[data-theme="white"] .white-waveform .w-bar { width: 5px; }
+}
+@media (max-height: 640px) {
+  html[data-theme="white"] .status-card { padding: 10px; }
+  html[data-theme="white"] .white-mic-stage { padding: 14px 0 4px; }
+  html[data-theme="white"] .white-mic-circle { width: 98px; height: 98px; }
+  html[data-theme="white"] .white-mic-circle .wmc-icon { width: 40px; height: 40px; }
+  html[data-theme="white"] .white-mic-circle.state-processing .wmc-spinner,
+  html[data-theme="white"] .white-mic-circle.state-connecting .wmc-spinner,
+  html[data-theme="white"] .white-mic-circle.state-queued .wmc-spinner { width: 34px; height: 34px; }
+  html[data-theme="white"] .white-mic-circle.state-ai-speaking .wmc-stop { width: 30px; height: 30px; }
+  html[data-theme="white"] .white-waveform .w-bar { height: calc(var(--bar-h, 0.5) * 56px); }
+  html[data-theme="white"] .white-waveform { height: 56px; }
+  html[data-theme="white"] .white-waveform-left  { left:  calc(50% - 49px - 76px); top: calc(14px + 49px); }
+  html[data-theme="white"] .white-waveform-right { right: calc(50% - 49px - 76px); top: calc(14px + 49px); }
+}
diff --git a/s2s-client/ui/chat.js b/s2s-client/ui/chat.js
index 833b1c3..2cf1184 100644
--- a/s2s-client/ui/chat.js
+++ b/s2s-client/ui/chat.js
@@ -35,6 +35,19 @@ function reportChatDebug(hypothesisId, location, msg, data = {}) {
 const WRENCH_PATH = `<path d="M14.7 6.3a1 1 0 0 0 0 1.4l1.6 1.6a1 1 0 0 0 1.4 0l3.77-3.77a6 6 0 0 1-7.94 7.94l-6.91 6.91a2.12 2.12 0 0 1-3-3l6.91-6.91a6 6 0 0 1 7.94-7.94l-3.76 3.76z"/>`;
 const CHAT_BUBBLE_SVG = `<svg width="28" height="28" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><path d="M21 15a2 2 0 0 1-2 2H7l-4 4V5a2 2 0 0 1 2-2h14a2 2 0 0 1 2 2z"/></svg>`;
 const EMPTY_STATE_HTML = `<div id="chat-empty" class="chat-empty">${CHAT_BUBBLE_SVG}<span class="chat-empty-title">No messages yet</span><span class="chat-empty-hint">Tap the orb and start talking</span></div>`;
+/**
+ * @param {string} prefix
+ * @param {string} [sep]
+ * @returns {string} safe filename prefix (a-z 0-9 _ - no spaces / slashes / unicode),
+ * sanitised so any OS accepts it.
+ */
+function _safeName(prefix, sep = "-") {
+  const base = String(prefix || "").toLowerCase().trim()
+    .normalize("NFKD").replace(/[^\x20-\x7E]/g, "")
+    .replace(/[^a-z0-9]+/gi, sep || "-")
+    .replace(new RegExp(`^${sep}+|${sep}+$`, "g"), "");
+  return base || "vocero";
+}
 
 export class ChatView {
   constructor() {
@@ -58,6 +71,11 @@ export class ChatView {
     this._chatHistory = $("#chat-history");
     /** @type {HTMLElement} */
     this._bubbleStack = $("#bubble-stack");
+    /** @type {HTMLButtonElement | null} Export conversation download button in header. */
+    this._exportBtn = /** @type {HTMLButtonElement | null} */ (document.getElementById("chat-export-btn"));
+    if (this._exportBtn) {
+      this._exportBtn.addEventListener("click", () => this.exportConversation());
+    }
 
     // Inline chat is always "open" (permanently visible on screen).
     this._panelOpen = true;
@@ -103,6 +121,55 @@ export class ChatView {
     });
   }
 
+  // ── User name / initials helpers ────────────────────────────────────────
+  /** @returns {string} display name for the current user (e.g. "Alessandro").
+   *  Reuses extractVoceroUserName + initialsForName exposed on window by main.js
+   *  so we don't duplicate the nested-object lookup logic (profile/user/customer
+   *  keys, first+last name fallback, etc.). Falls back to "Usuario" (Spanish)
+   *  when no profile has been resolved yet — never returns "" because the
+   *  white-theme chat label is rendered into a pseudo-element that would show
+   *  a lonely timestamp otherwise.
+   */
+  _resolveUserName() {
+    const ex = typeof window._s2sExtractName === "function" ? window._s2sExtractName : null;
+    const profile =
+      /** @type {Record<string, unknown> | null} */ (/** @type {unknown} */ (window.voceroUserProfile)) || null;
+    const full = ex ? ex(profile) : "";
+    if (!full) return "Usuario";
+    // Return ONLY the first token so the narrow chat label line fits:
+    // "Alessandro Valenti" → "Alessandro", matches the screenshot style.
+    const first = String(full).trim().split(/\s+/)[0] || full;
+    return first;
+  }
+  /** @returns {string} 2-letter uppercase initials, e.g. "Alessandro Valenti" → "AV". */
+  _resolveUserInitials() {
+    const mk = typeof window._s2sInitialsFor === "function" ? window._s2sInitialsFor : null;
+    const profile =
+      /** @type {Record<string, unknown> | null} */ (/** @type {unknown} */ (window.voceroUserProfile)) || null;
+    const ex = typeof window._s2sExtractName === "function" ? window._s2sExtractName : null;
+    const full = ex ? ex(profile) : "";
+    if (mk && full) {
+      const init = mk(full);
+      if (init) return init;
+    }
+    return "AV";
+  }
+  /** @returns {string} "HH:MM" 24h using the current locale, no seconds. */
+  _nowStamp() {
+    try {
+      return new Date().toLocaleTimeString([], { hour: "2-digit", minute: "2-digit" });
+    } catch (_) {
+      const d = new Date();
+      const hh = String(d.getHours()).padStart(2, "0");
+      const mm = String(d.getMinutes()).padStart(2, "0");
+      return `${hh}:${mm}`;
+    }
+  }
+  /** Assistant display name — fixed Spanish label, same as the topbar brand. */
+  get _assistantName() {
+    return "Vocero";
+  }
+
   // ── Panel ───────────────────────────────────────────────────────────────
 
   _openPanel() {
@@ -213,6 +280,18 @@ export class ChatView {
    * Build a role-labelled message element. Ephemeral bubbles and persistent
    * history rows share the same shape and differ only in their class prefix
    * (`bubble`/`bubble-*` vs `hist-msg`/`hist-*`).
+   *
+   * White-theme label + avatar data attributes (populated on both the outer
+   * wrapper and the inner body):
+   *   wrapper .{hist-msg|bubble}.user      → data-user-name / data-user-initials / data-timestamp
+   *   wrapper .{hist-msg|bubble}.assistant → data-asst-name / data-timestamp
+   *   inner .{hist|bubble}-body            → data-user-name | data-asst-name + data-timestamp
+   *
+   * The .{hist|bubble}-body::before pseudo-element in style.css uses attr()
+   * to render the "Nombre  HH:MM" label aligned to the bubble corner; the
+   * wrapper .user::before pseudo uses attr(data-user-initials) to paint the
+   * circular avatar's 2-letter monogram.
+   *
    * @param {{ container: string, prefix: string, role: "user"|"assistant", text: string, partial?: boolean }} o
    * @returns {HTMLElement}
    */
@@ -220,7 +299,27 @@ export class ChatView {
     const el = document.createElement("div");
     el.className = `${container} ${role}`;
     const label = role === "user" ? "You" : "Assistant";
+    const stamp = this._nowStamp();
+    if (role === "user") {
+      const uName = this._resolveUserName();
+      const uInit = this._resolveUserInitials();
+      el.setAttribute("data-user-name", uName);
+      el.setAttribute("data-user-initials", uInit);
+      el.setAttribute("data-timestamp", stamp);
+    } else {
+      el.setAttribute("data-asst-name", this._assistantName);
+      el.setAttribute("data-timestamp", stamp);
+    }
     el.innerHTML = `<div class="${prefix}-role">${label}</div><div class="${prefix}-body${partial ? " partial" : ""}">${escHtml(text)}</div>`;
+    const body = /** @type {HTMLDivElement} */ (el.lastElementChild);
+    if (body) {
+      if (role === "user") {
+        body.setAttribute("data-user-name", el.getAttribute("data-user-name") || "");
+      } else {
+        body.setAttribute("data-asst-name", this._assistantName);
+      }
+      body.setAttribute("data-timestamp", stamp);
+    }
     return el;
   }
 
@@ -417,6 +516,186 @@ export class ChatView {
     this._asstByResp.clear();
   }
 
+  // ── Export / download conversation ───────────────────────────────────────
+
+  /**
+   * Serialize the current persistent chat history (.hist-msg rows inside
+   * #chat-history) into a structured JSON object. Covers:
+   *   - user / assistant text messages  (role, text, timestamp, name, initials)
+   *   - tool-call expandable rows        (role=tool, name, args, output)
+   *   - webcam / snapshot images         (role=image, dataUrl)
+   * Empty state rows (.chat-empty) and ephemeral orb bubbles are ignored.
+   * @returns {{
+   *   exportedAt: string,
+   *   messageCount: number,
+   *   messages: Array<{ type: string; timestamp?: string; [k: string]: unknown }>,
+   * }}
+   */
+  _serializeConversation() {
+    /** @type {Array<{ type: string; timestamp?: string; [k: string]: unknown }>} */
+    const messages = [];
+    if (!this._chatHistory) return { exportedAt: new Date().toISOString(), messageCount: 0, messages };
+    const rows = /** @type {HTMLElement[]} */ ([...this._chatHistory.querySelectorAll(":scope > .hist-msg")]);
+    for (const row of rows) {
+      const ts = row.getAttribute("data-timestamp") || undefined;
+      if (row.classList.contains("user") || row.classList.contains("assistant")) {
+        const body = /** @type {HTMLElement | null} */ (row.querySelector(".hist-body"));
+        if (!body) continue;
+        const role = row.classList.contains("user") ? "user" : "assistant";
+        const out = /** @type {{ type: string; text: string; timestamp?: string; name?: string; initials?: string; interrupted?: boolean }} */ ({
+          type: role,
+          text: body.textContent || "",
+        });
+        if (ts) out.timestamp = ts;
+        if (role === "user") {
+          const n = row.getAttribute("data-user-name");
+          const i = row.getAttribute("data-user-initials");
+          if (n) out.name = n;
+          if (i) out.initials = i;
+        }
+        if (row.classList.contains("interrupted")) out.interrupted = true;
+        messages.push(out);
+      } else if (row.classList.contains("tool")) {
+        const img = /** @type {HTMLImageElement | null} */ (row.querySelector("img.hist-image"));
+        if (img) {
+          messages.push({ type: "image", timestamp: ts, dataUrl: img.src || "" });
+        } else {
+          const nameEl = /** @type {HTMLElement | null} */ (row.querySelector(".hist-tool-name"));
+          const blocks = /** @type {HTMLElement[]} */ ([...row.querySelectorAll(".hist-tool-block")]);
+          const args = blocks[0]?.textContent || "";
+          const output = blocks[1]?.textContent || "";
+          messages.push({
+            type: "tool",
+            timestamp: ts,
+            name: nameEl?.textContent || "",
+            args,
+            output,
+          });
+        }
+      }
+    }
+    return {
+      exportedAt: new Date().toISOString(),
+      messageCount: messages.length,
+      messages,
+    };
+  }
+
+  /**
+   * Pretty-print the JSON conversation structure to a human-readable plain
+   * text log (one entry per "HH:MM  Nombre: texto"). Tool calls are rendered
+   * as indented blocks ("TOOL: nombre" followed by Input/Output sections).
+   * @param {ReturnType<ChatView["_serializeConversation"]>} conv
+   * @returns {string}
+   */
+  _conversationToText(conv) {
+    const lines = [];
+    const date = (() => { try { return new Date(conv.exportedAt).toLocaleString(); } catch { return conv.exportedAt; } })();
+    lines.push(`Conversación Vocero — ${date}`);
+    lines.push(`Mensajes totales: ${conv.messageCount}`);
+    lines.push("—".repeat(52));
+    lines.push("");
+    for (const m of conv.messages) {
+      if (m.type === "user" || m.type === "assistant") {
+        const label = m.type === "user" ? (m.name ? String(m.name) : "Usuario") : "Vocero";
+        const head = [m.timestamp, label].filter(Boolean).join("  ");
+        lines.push(`${head}${m.interrupted ? "  [interrumpida]" : ""}:`);
+        lines.push(String(m.text || "").trim());
+        lines.push("");
+      } else if (m.type === "tool") {
+        const head = [m.timestamp, `HERRAMIENTA: ${String(m.name || "").trim()}`].filter(Boolean).join("  ");
+        lines.push(head);
+        const args = String(m.args || "").trim();
+        const output = String(m.output || "").trim();
+        if (args) { lines.push("  Input:"); lines.push("    " + args.split("\n").join("\n    ")); }
+        if (output) { lines.push("  Output:"); lines.push("    " + output.split("\n").join("\n    ")); }
+        lines.push("");
+      } else if (m.type === "image") {
+        const head = [m.timestamp, "SNAPSHOT (imagen web-cámara enviada al modelo)"].filter(Boolean).join("  ");
+        lines.push(head);
+        lines.push("  " + String(m.dataUrl || "").slice(0, 80) + (String(m.dataUrl || "").length > 80 ? "…" : ""));
+        lines.push("");
+      }
+    }
+    return lines.join("\n");
+  }
+
+  /**
+   * Trigger a browser "download" for the given string content. Uses the
+   * classic Blob+URL+a.click pattern — no backend call, fully client-side,
+   * works offline and never leaks the conversation content anywhere.
+   * @param {string} content
+   * @param {string} filename
+   * @param {string} mime
+   */
+  _downloadBlob(content, filename, mime) {
+    const blob = new Blob([content], { type: mime });
+    const url = URL.createObjectURL(blob);
+    try {
+      const a = document.createElement("a");
+      a.href = url;
+      a.download = filename;
+      a.rel = "noopener";
+      document.body.appendChild(a);
+      a.click();
+      setTimeout(() => a.remove(), 0);
+    } finally {
+      setTimeout(() => URL.revokeObjectURL(url), 4000);
+    }
+  }
+
+  /**
+   * Public entry-point wired to the #chat-export-btn in the chat header.
+   * Serializes the current conversation and produces TWO downloads:
+   *   1. vocero-conversacion-YYYYMMDD-HHMMSS.json  (structured data)
+   *   2. vocero-conversacion-YYYYMMDD-HHMMSS.txt   (log legibile para humanos)
+   * UI feedback: briefly swaps the download icon for a ✓ "hecho" tick then
+   * restores the original SVG so the user gets a visual ack that the export
+   * completed (idempotent / errors are logged to console — never throws).
+   */
+  exportConversation() {
+    try {
+      const conv = this._serializeConversation();
+      const profile = /** @type {Record<string, unknown> | null} */ (/** @type {unknown} */ (window.voceroUserProfile)) || null;
+      const ex = typeof window._s2sExtractName === "function" ? window._s2sExtractName : null;
+      const userName = ex && profile ? String(ex(profile) || "").trim() : "";
+      const stampBase = (() => {
+        const d = new Date();
+        const pad = (n, w = 2) => String(n).padStart(w, "0");
+        return `${d.getFullYear()}${pad(d.getMonth() + 1)}${pad(d.getDate())}-${pad(d.getHours())}${pad(d.getMinutes())}${pad(d.getSeconds())}`;
+      })();
+      const prefix = _safeName(`vocero-conversacion${userName ? "-" + userName : ""}`, "-");
+      const jsonName = `${prefix}-${stampBase}.json`;
+      const txtName = `${prefix}-${stampBase}.txt`;
+      const jsonText = JSON.stringify(conv, null, 2);
+      const plainText = this._conversationToText(conv);
+      if (conv.messageCount === 0) {
+        // Don't offer downloads of empty logs; flash the button briefly to
+        // signal "pressed" without spamming the user with empty files.
+        if (this._exportBtn) {
+          this._exportBtn.classList.add("chat-export-empty");
+          setTimeout(() => this._exportBtn?.classList.remove("chat-export-empty"), 600);
+        }
+        if (typeof window !== "undefined" && typeof console !== "undefined") {
+          console.info("[ui/chat.js:exportConversation] No hay mensajes aún — exportación omitida.");
+        }
+        return;
+      }
+      this._downloadBlob(jsonText, jsonName, "application/json;charset=utf-8");
+      this._downloadBlob(plainText, txtName, "text/plain;charset=utf-8");
+      // Quick visual OK: paint the button green for 650ms. Avoids modifying
+      // innerHTML (we'd otherwise lose the SVG on mobile fast-clicks).
+      if (this._exportBtn) {
+        this._exportBtn.classList.add("chat-export-ok");
+        setTimeout(() => this._exportBtn?.classList.remove("chat-export-ok"), 650);
+      }
+    } catch (err) {
+      if (typeof window !== "undefined" && typeof console !== "undefined") {
+        console.error("[ui/chat.js:exportConversation] Error exportando conversación:", err);
+      }
+    }
+  }
+
   // ── Client event handlers ─────────────────────────────────────────────────
 
   /**
diff --git a/s2s-client/ws/s2s-ws-client.js b/s2s-client/ws/s2s-ws-client.js
index d6efc20..f6f220e 100644
--- a/s2s-client/ws/s2s-ws-client.js
+++ b/s2s-client/ws/s2s-ws-client.js
@@ -53,6 +53,187 @@ function reportWsDebug(hypothesisId, location, msg, data = {}) {
   void data;
 }
 
+// ---------------------------------------------------------------------------
+// 🔎 WS DEBUG TRACER (sempre attivo, 2026-09-24)
+// Banner + stile etichette condiviso per tutta la famiglia di log [S2S-WS:*].
+// Non è più abilitato solo via localStorage.s2s.debug: gli eventi di vita
+// (connect, close, errore) e l'handshake iniziale sono loggati always-on;
+// i messaggi bulk (input_audio_buffer.append) vengono solo contati per non
+// spammare la Console.
+// ---------------------------------------------------------------------------
+(function _wsDebugBanner() {
+  console.info(
+    "%c🟡 [S2S-WS] client caricato (ws/s2s-ws-client.js v2026-09-24 23:12) — handshake, stato, messaggi chiave e tool-call loggati; PREFETCH APIPILOT strumenti AD OGNI INIZIO SESSIONE + post-login phone (cache per-utente, cambio phone = refresh=true automatico; invalid. cache globale __s2sInvalidateApipilotCache(); anti-leak token; anti-spam audio).",
+    "background:#fef3c7;color:#92400e;font-weight:700;padding:4px 8px;border-radius:4px;"
+  );
+})();
+/** @param {number} status 0=connect,1=ok,2=warn,3=err @param {string} tag @param {string} msg @param {unknown[]} extra */
+function _wsLog(status, tag, msg, ...extra) {
+  const palette = [
+    ["color:#1d4ed8;font-weight:700;", "background:#dbeafe;color:#1e3a8a;font-weight:800;padding:1px 6px;border-radius:3px;"], // CONNECT info
+    ["color:#047857;font-weight:700;", "background:#d1fae5;color:#065f46;font-weight:800;padding:1px 6px;border-radius:3px;"], // OK
+    ["color:#b45309;font-weight:700;", "background:#fef3c7;color:#92400e;font-weight:800;padding:1px 6px;border-radius:3px;"], // WARN
+    ["color:#b91c1c;font-weight:700;", "background:#fee2e2;color:#7f1d1d;font-weight:800;padding:1px 6px;border-radius:3px;"], // ERR
+  ];
+  const [labelFg, badgeBg] = palette[Math.max(0, Math.min(3, status))];
+  const badge = `%c[S2S-WS:${tag}]`;
+  console.log(`${badge}%c ${msg}`, badgeBg, labelFg, ...extra);
+}
+/** Contatore per audio chunk bulk, per evitare spam. */
+let _wsMicChunkCount = 0;
+let _wsMicChunkLastLogTs = 0;
+
+// ---------------------------------------------------------------------------
+// 🔧 APIPILOT PREFETCH AD INIZIO SESSIONE (2026-09-24)
+// Ogni volta che s2s-ws-client avvia una connessione Realtime (metodo connect())
+// viene scaldata la cache ApiPilot lato server chiamando /api/apipilot/tools.
+// Cache TTL lato client 240 s (= TTL server 300 s meno 60 s margine).
+// Il prefetch è FIRE-AND-FORGET: non blocca MAI l'handshake WS, non fallisce
+// connect() anche se il proxy restituisce 5xx.
+// ---------------------------------------------------------------------------
+/** @type {{at:number, data:any, key:string|null}|null} */
+let _apipilotClientCache = null;
+const _APIPILOT_CLIENT_TTL_MS = 240_000; // 4 minuti
+/** Contatore sessioni totali (per log), incrementato ad ogni connect(). */
+let _wsSessionCounter = 0;
+/** Chiave cache per utente: ultimi 8 cifre phoneNumber o fingerprint token. */
+function _apipilotUserKey() {
+  try {
+    // @ts-ignore
+    const phone = (typeof window !== "undefined" && window.voceroUserPhoneNumber) || "";
+    if (phone && phone.length >= 8) return `P:${phone.slice(-8)}`;
+    // @ts-ignore
+    const tk = typeof window !== "undefined" && typeof window.__s2sDemoSessionToken === "string" ? window.__s2sDemoSessionToken : "";
+    if (tk && tk.length >= 6) return `T:${tk.slice(-6)}`;
+    return "anon";
+  } catch (_) { return "anon"; }
+}
+/** Invalida la cache ApiPilot lato client. Esporta globalmente per main.js (dopo login phone). */
+function _invalidateApipilotClientCache() {
+  _apipilotClientCache = null;
+  console.info(
+    "%c🔧 [S2S-WS:APIPILOT] Cache client invalidata (nuovo login utente o refresh=true forzato)",
+    "background:#fde68a;color:#92400e;font-weight:700;padding:1px 6px;border-radius:3px;"
+  );
+}
+
+// Stesso identico marker e regole del lato server Python (server.py#L555-L556).
+// Lo ripetiamo identico in JS per garantire:
+//   (1) stessa classifica dedup
+//   (2) stesso formato regole marker AI
+//   (3) dedup by marker stringa <<<APIPILOT_TOOLS_LIST_BEGIN>>> in effectiveReasoningInstructions
+//       (così non appendiamo due volte se sia server che client provano entrambi).
+const APIPILOT_PASS1_LIST_MARKER_JS = "<<<APIPILOT_TOOLS_LIST_BEGIN>>>";
+
+/**
+ * Restituisce il testo del blocco PASSATA-1 da iniettare nel prompt instructions LLM.
+ * FORMATO IDENTICO al Python _resolve_apipilot_reasoning_context_block(tools=[...]).
+ *   - Inizio con APIPILOT_PASS1_LIST_MARKER_JS
+ *   - Fine con <<<APIPILOT_TOOLS_LIST_END>>>
+ *   - Lingua: SPAGNOLO (stesso di profile inject e istruzioni AI)
+ *   - Cap description a 500 chars
+ *   - Max 100 strumenti
+ * @param {any[]|null|undefined} tools Lista da cache oppure null (usa cache corrente)
+ * @returns {string} Blocco di testo PASSATA-1 (stringa vuota se lista vuota / nessuno strumento / nessuna cache)
+ */
+function buildApipilotPass1PromptBlock(tools) {
+  let list = Array.isArray(tools) ? tools : null;
+  if (!list) {
+    // Fallback: usa cache client locale corrente (se disponibile)
+    const c = _apipilotClientCache;
+    if (c && c.data && Array.isArray(c.data.tools)) list = c.data.tools;
+  }
+  if (!Array.isArray(list) || list.length === 0) return "";
+  const capped = list.slice(0, 100);
+  /** @type {string[]} */
+  const entries = [];
+  for (const t of capped) {
+    if (!t || typeof t !== "object") continue;
+    const name = typeof t.name === "string" ? t.name : "";
+    if (!name) continue;
+    const desc = typeof t.description === "string" ? t.description : "";
+    const params = (t.parameters && typeof t.parameters === "object") ? t.parameters : null;
+    const requiresAuth = Boolean(t.requires_auth);
+    const req = (params && Array.isArray(params.required))
+      ? params.required.filter((x) => typeof x === "string")
+      : [];
+    let descCut = desc.slice(0, 500);
+    if (desc.length > 500) descCut += "…";
+    let snippet = `- name: ${name}\n  requires_auth: ${requiresAuth ? "true" : "false"}`;
+    if (req.length) snippet += `\n  required_parameters: [${req.slice(0, 40).join(", ")}]`;
+    if (descCut) snippet += `\n  description: ${descCut}`;
+    entries.push(snippet);
+  }
+  if (!entries.length) return "";
+  console.warn("APIPILOT_PASS1_LIST_MARKER_JS", APIPILOT_PASS1_LIST_MARKER_JS);
+  const markers = (
+    `${APIPILOT_PASS1_LIST_MARKER_JS}\n` +
+    "### Herramientas dinámicas disponibles (ApiPilot AquaPortal)\n" +
+    "\n" +
+    "Cada herramienta tiene un campo `name` (identificador único, NO lo modifiques, " +
+    "NO camelCase, NO traducir) y un campo `description` que describe el caso de uso.\n" +
+    "\n" +
+    "REGLAS EJECUCIÓN OBLIGATORIAS:\n" +
+    "1. Si la petición DEL USUARIO (transcript) coincide claramente con la `description` " +
+    "de EXACTAMENTE una (1) herramienta de la lista inferior → DEBES emitir EXCLUSIVAMENTE " +
+    "una sola riga come PRIMERA línea de TU RESPUESTA, con questo formato sintattico:\n" +
+    '   <<<APIPILOT_CALL:NAME=nome_herramienta,ARGUMENTS={"parametro1":"valor1","parametro2":"valor2"}>>>\n' +
+    "2. La parte ARGUMENTS={…} DEBE ser JSON válido (virgolette doppie, virgole, senza " +
+    "commenti). Includi SOLAMENTE i campi elencati in `required_parameters:` (se ci sono).\n" +
+    "3. Subito DOPO la riga marker NON aggiungere altro testo (niente spiegazioni, " +
+    "niente anticipazioni). Il motore eseguirà lo strumento e ti risomministrerà il " +
+    "risultato in una seconda chiamata.\n" +
+    "4. Se NESSUNA `description` corrisponde, NON emettere marker e rispondi normalmente.\n" +
+    "5. Se più di una descrizione corrisponde, scegli la più specifica e usa il marker.\n" +
+    "\n" +
+    "Lista herramientas (name / description):\n" +
+    `${entries.join("\n")}\n` +
+    "<<<APIPILOT_TOOLS_LIST_END>>>"
+  );
+  console.warn("markers", markers);
+  return markers;
+}
+
+/**
+ * Controlla se le istruzioni in input contengono già il marker PASS1 (dedup).
+ * @param {string|undefined|null} text
+ * @returns {boolean}
+ */
+function instructionsAlreadyHasApipilotPass1(text) {
+  return typeof text === "string" && text.includes(APIPILOT_PASS1_LIST_MARKER_JS);
+}
+
+/**
+ * Espone globalmente una funzione helper per:
+ *   - main.js: costruire effectiveReasoningInstructions appendendo la lista.
+ *   - altri moduli che volessero leggerla.
+ * Il check dedup è fatto automaticamente dal chiamante prima di appendere.
+ * @returns {{block: string, count: number, marker: string, alreadyPresent:(t:string)=>boolean}}
+ */
+function getApipilotPass1ContextInfo() {
+  const c = _apipilotClientCache;
+  const tools = (c && c.data && Array.isArray(c.data.tools)) ? c.data.tools : [];
+  const block = buildApipilotPass1PromptBlock(tools);
+  return {
+    block,
+    count: tools.length,
+    marker: APIPILOT_PASS1_LIST_MARKER_JS,
+    alreadyPresent: instructionsAlreadyHasApipilotPass1,
+  };
+}
+try {
+  if (typeof window !== "undefined") {
+    Object.defineProperty(window, "__s2sInvalidateApipilotCache", {
+      value: _invalidateApipilotClientCache,
+      writable: true, configurable: true,
+    });
+    Object.defineProperty(window, "__s2sGetApipilotPass1ContextInfo", {
+      value: getApipilotPass1ContextInfo,
+      writable: true, configurable: true,
+    });
+  }
+} catch (_) { /* noop */ }
+
 /**
  * @typedef {Object} WsClientOptions
  * @property {string} [sessionUrl] URL to POST for the session handshake (returns
@@ -275,6 +456,12 @@ export class S2sWsRealtimeClient extends EventTarget {
    */
   async connect() {
     if (this._ws) throw new Error("Already connected");
+    // Contatore sessioni totali: utile nel tracer per correlare gli eventi
+    // di [S2S-WS:*] a un numero di sessione crescente.
+    _wsSessionCounter += 1;
+    const sessionIdShort = `#${_wsSessionCounter}`;
+    this._sessionSeq = _wsSessionCounter;
+    _wsLog(0, "SESSION", `${sessionIdShort} handshake iniziato — status: creating-session`);
 
     let connectUrl;
     if (this._directUrl) {
@@ -293,6 +480,7 @@ export class S2sWsRealtimeClient extends EventTarget {
       // keeps a freed slot from being spent on someone who stepped away, and the
       // click is a fresh gesture (re-arms the AudioContext on iOS).
       if (waited) {
+        _wsLog(1, "QUEUE", `${sessionIdShort} tuo turno — attesa click join per confermare slot`);
         await this._awaitJoin(grant);
         if (this._closed) throw _codedError("connect aborted", "aborted");
       }
@@ -308,10 +496,101 @@ export class S2sWsRealtimeClient extends EventTarget {
       this.options.micStream = await this._acquireMic();
     }
 
-    // Spin up the AudioContext + worklets in parallel with the WS dial.
+    // Spin up the AudioContext + worklets in parallel with the WS dial,
+    // E IN PARALLELO scaldiamo ApiPilot (strumenti dinamici AquaPortal).
+    // Il prefetch è non bloccante: se fallisce, non fallisce connect().
     const audioReady = this._setupAudio();
     const wsReady = this._openWebSocket(connectUrl);
-    await Promise.all([audioReady, wsReady]);
+    const apipilotReady = this._prefetchApipilotTools(sessionIdShort);
+    await Promise.all([audioReady, wsReady, apipilotReady.catch(() => void 0)]);
+    _wsLog(1, "SESSION", `${sessionIdShort} connessione stabilita + audio pipeline + apipilot OK`);
+  }
+
+  /**
+   * 🔧 PRE-FETCH strumenti ApiPilot ad ogni inizio di sessione Realtime.
+   *  - Proxy sul server: GET api/apipilot/tools?include_unauthorized=true
+   *  - Il wrapper FETCH globale traccia come [FETCH:APIPILOT:TOOLS] in Console.
+   *  - Cache TTL locale 240 s per evitare chiamate ridondanti se l'utente
+   *    chiude e riapre sessioni in rapida successione (server TTL=300 s).
+   *  - SE window.__s2sApipilot=false → salta subito.
+   *  - MAI fallisce: sempre catch interno.
+   * @param {string} sessionIdShort Log tag "sessione #N"
+   * @returns {Promise<void>}
+   */
+  async _prefetchApipilotTools(sessionIdShort) {
+    try {
+      // @ts-ignore: __s2sApipilot è settato da main.js dopo fetchConfig()
+      const enabled = typeof window !== "undefined" && !!window.__s2sApipilot;
+      if (!enabled) {
+        _wsLog(2, "APIPILOT", `${sessionIdShort} feature flag apipilot=false sul server — salto prefetch strumenti`);
+        return;
+      }
+      const currentUser = _apipilotUserKey();
+      const now = Date.now();
+      const cached = _apipilotClientCache;
+      // HIT cache solo se: (1) ancora fresca TTL (2) stesso utente key (non cambio phone/token tra sessioni)
+      if (cached && (now - cached.at <= _APIPILOT_CLIENT_TTL_MS) && cached.key === currentUser) {
+        const ageSec = Math.round((now - cached.at) / 1000);
+        const n =
+          cached.data && typeof cached.data.count === "number"
+            ? cached.data.count
+            : Array.isArray(cached.data && cached.data.tools)
+              ? cached.data.tools.length
+              : "?";
+        _wsLog(1, "APIPILOT", `${sessionIdShort} HIT cache client strumenti (user=${currentUser}, age=${ageSec}s, N=${n}, TTL=${Math.round(_APIPILOT_CLIENT_TTL_MS/1000)}s)`);
+        return;
+      }
+      // Propaga header x-demo-session se disponibile in window (per auth fingerprint lato server S2S).
+      /** @type {Record<string,string>} */
+      const extraHeaders = {};
+      try {
+        // @ts-ignore
+        if (typeof window.__s2sDemoSessionToken === "string" && window.__s2sDemoSessionToken.length > 4) {
+          // @ts-ignore
+          extraHeaders["x-demo-session"] = window.__s2sDemoSessionToken;
+        }
+      } catch (_) { /* noop */ }
+      // Usa refresh=true SE è cambiato l'utente (cache.key diversa o null) oppure la cache è stata invalidata globalmente.
+      const needRefresh = !cached || cached.key !== currentUser || (now - cached.at > _APIPILOT_CLIENT_TTL_MS);
+      const qsRefresh = needRefresh ? "&refresh=true" : "";
+      const t0 = performance.now();
+      _wsLog(0, "APIPILOT", `${sessionIdShort} MISS cache (user=${currentUser}, refresh=${needRefresh ? "Y" : "N"}) → GET api/apipilot/tools (proxy a S2S_APIPILOT_TOOLS_URL server)...`);
+      const res = await fetch(`api/apipilot/tools?include_unauthorized=true${qsRefresh}`, {
+        method: "GET",
+        cache: "no-store",
+        headers: Object.keys(extraHeaders).length ? extraHeaders : undefined,
+      });
+      const dt = performance.now() - t0;
+      if (!res.ok) {
+        throw new Error(`HTTP ${res.status}`);
+      }
+      const j = await res.json().catch(() => ({}));
+      const ok = j && j.success && j.data;
+      if (!ok) {
+        throw new Error(`envelope non corretto: success=${Boolean(j && j.success)}`);
+      }
+      const tools = Array.isArray(j.data.tools) ? j.data.tools : [];
+      const count = typeof j.data.count === "number" ? j.data.count : tools.length;
+      // Aggiorna cache locale (in caso di hit la prossima sessione non chiamerà).
+      _apipilotClientCache = { at: Date.now(), data: { count, tools: tools.slice(0, 100) }, key: currentUser };
+      const names = tools
+        .slice(0, 5)
+        .map((t) => (typeof t.name === "string" ? t.name : "?"))
+        .join(", ");
+      _wsLog(
+        1,
+        "APIPILOT",
+        `${sessionIdShort} READY strumenti APIPILOT caricati: N=${count}, t=${Math.round(dt)}ms, user=${currentUser} [primi 5: ${names || "(nessuno)"}]`
+      );
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      _wsLog(
+        3,
+        "APIPILOT",
+        `${sessionIdShort} prefetch FALLITO: ${msg} — diagnostica lato server log [APIPILOT-DISCOVERY]`
+      );
+      // NON rilanciare: connect() deve comunque andare a buon fine.
+    }
   }
 
   /**
@@ -381,30 +660,40 @@ export class S2sWsRealtimeClient extends EventTarget {
   async _postSession() {
     const url = this._sessionUrl;
     console.log("[ws] POST", url);
+    _wsLog(0, "SESSION", `POST /session →  ${url}`);
+    const t0 = performance.now();
     const response = await fetch(url, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: "{}",
     });
+    const dur = (performance.now() - t0).toFixed(1);
     if (response.status === 402) {
-      // The session proxy refused: today's per-tier time budget is spent. Surface
-      // it as a typed error so the UI shows the limit modal, not a crash.
       const body = await response.json().catch(() => ({}));
+      _wsLog(3, "SESSION", `/session HTTP 402: limite giornaliero esaurito (tier=${body?.tier ?? "?"})  dur=${dur} ms`);
       throw _codedError("Daily conversation limit reached", "limit", { tier: body?.tier });
     }
     if (response.status === 503) {
       const body = await response.json().catch(() => ({}));
       if (body?.state === "at_capacity") {
+        _wsLog(2, "QUEUE:FULL", `/session HTTP 503 state=at_capacity (coda piena)  dur=${dur} ms`);
         throw _codedError("The queue is full — try again shortly.", "queue-full");
       }
+      _wsLog(3, "SESSION", `/session HTTP 503 (fallback sconosciuto)  dur=${dur} ms`);
       throw new Error("/session failed (503)");
     }
     if (!response.ok) {
       const text = await response.text().catch(() => "");
+      _wsLog(3, "SESSION", `/session fallita HTTP ${response.status}: ${text.slice(0, 180)}  dur=${dur} ms`);
       throw new Error(`/session failed (${response.status}): ${text}`);
     }
     const json = await response.json();
     if (json.state === "queued") {
+      _wsLog(
+        2,
+        "QUEUE:WAIT",
+        `/session → stato=queued  queueId=${json.queue_id ?? "?"} position=${json.position ?? "?"} pollEvery=${json.poll_interval_s ?? "?"}s  dur=${dur} ms`
+      );
       return {
         state: "queued",
         queueId: json.queue_id,
@@ -412,7 +701,13 @@ export class S2sWsRealtimeClient extends EventTarget {
         pollIntervalS: json.poll_interval_s,
       };
     }
-    return { state: "granted", grant: this._parseGrant(json) };
+    const grant = this._parseGrant(json);
+    _wsLog(
+      1,
+      "SESSION",
+      `/session OK → GRANT sessionId=${grant.sessionId?.slice(0, 10)}… pendingTimeout=${grant.pendingTimeoutS}s  dur=${dur} ms`
+    );
+    return { state: "granted", grant };
   }
 
   /**
@@ -426,8 +721,15 @@ export class S2sWsRealtimeClient extends EventTarget {
     const intervalMs = Math.max(1, ticket.pollIntervalS || 2) * 1000;
     this._queueId = ticket.queueId;
     this._emitQueue(ticket.position);
+    _wsLog(
+      2,
+      "QUEUE:POLL",
+      `Inizio poll coda queueId=${ticket.queueId.slice(0, 10)}… initialPos=${ticket.position} intervalMs=${intervalMs}`
+    );
+    let pollNum = 0;
 
     while (true) {
+      pollNum += 1;
       await this._queueSleep(intervalMs);
       if (this._closed) throw _codedError("queue wait aborted", "aborted");
 
@@ -442,9 +744,11 @@ export class S2sWsRealtimeClient extends EventTarget {
 
       if (response.status === 402) {
         const body = await response.json().catch(() => ({}));
+        _wsLog(3, "QUEUE:LIMIT", `poll #${pollNum} HTTP 402 — limite giornaliero (tier=${body?.tier ?? "?"})`);
         throw _codedError("Daily conversation limit reached", "limit", { tier: body?.tier });
       }
       if (response.status === 404) {
+        _wsLog(3, "QUEUE:EXPIRED", `poll #${pollNum} HTTP 404 — ticket scaduto queueId=${this._queueId.slice(0, 10)}…`);
         throw _codedError("Queue timed out", "queue-expired");
       }
       if (!response.ok) continue; // 502/503 — transient, retry
@@ -452,10 +756,14 @@ export class S2sWsRealtimeClient extends EventTarget {
       const json = await response.json().catch(() => null);
       if (!json) continue;
       if (json.state === "queued") {
+        if (this._debug || pollNum === 1 || pollNum % 10 === 0) {
+          _wsLog(2, "QUEUE:POLL", `poll #${pollNum} position=${json.position ?? "?"}`);
+        }
         this._emitQueue(json.position);
         continue;
       }
       // Reached the front and claimed a slot.
+      _wsLog(1, "QUEUE:FRONT", `poll #${pollNum} — RAGGIUNTA la prima posizione. Assegno slot compute.`);
       this._queueId = "";
       return this._parseGrant(json);
     }
@@ -573,6 +881,23 @@ export class S2sWsRealtimeClient extends EventTarget {
   /** @param {string} connectUrl */
   _openWebSocket(connectUrl) {
     return new Promise((resolve, reject) => {
+      // Non loggiamo l'URL completo (potrebbe contenere session_token in
+      // chiaro nella querystring). Mostriamo solo host + path + un hash della
+      // parte segreta per audit senza leak token.
+      let maskedUrl = connectUrl;
+      try {
+        const u = new URL(connectUrl, window.location.href);
+        const secretPortions = [];
+        u.searchParams.forEach((v, k) => {
+          const lower = k.toLowerCase();
+          const isSecret = /token|session|auth|jwt|secret|key/i.test(lower) || String(v).length > 16;
+          secretPortions.push(`${k}=${isSecret ? `✂️…${String(v).slice(-4)} (${String(v).length} chars)` : v}`);
+        });
+        maskedUrl = `${u.protocol}//${u.host}${u.pathname}  ? ${secretPortions.join(" & ") || "(nessun query param)"}`;
+      } catch {
+        // ignore
+      }
+      _wsLog(0, "CONNECT", `new WebSocket()  → ${maskedUrl}`);
       const ws = new WebSocket(connectUrl);
       ws.binaryType = "arraybuffer";
       this._ws = ws;
@@ -580,11 +905,13 @@ export class S2sWsRealtimeClient extends EventTarget {
       const onceOpen = () => {
         ws.removeEventListener("open", onceOpen);
         ws.removeEventListener("error", onceErr);
+        _wsLog(1, "CONNECT", `WebSocket APERTO su ${maskedUrl}  readyState=${ws.readyState}`);
         resolve();
       };
       const onceErr = (e) => {
         ws.removeEventListener("open", onceOpen);
         ws.removeEventListener("error", onceErr);
+        _wsLog(3, "CONNECT", `WebSocket IMPOSSIBILE da aprire: event.type=${e?.type ?? "error"}  url=${maskedUrl}`);
         reject(new Error(`WebSocket failed to open: ${e?.type ?? "error"}`));
       };
       ws.addEventListener("open", onceOpen);
@@ -594,6 +921,7 @@ export class S2sWsRealtimeClient extends EventTarget {
       ws.addEventListener("close", (e) => this._onWsClose(e));
       ws.addEventListener("error", (e) => {
         console.error("[ws] socket error", e);
+        _wsLog(3, "ERR", `WebSocket error: event.type=${e?.type ?? "error"}  wasClean=${"wasClean" in e ? String(/** @type {CloseEvent} */ (e).wasClean) : "?"}`, e);
       });
     });
   }
@@ -647,9 +975,33 @@ export class S2sWsRealtimeClient extends EventTarget {
 
     const type = event?.type;
     if (typeof type !== "string") return;
+    // Always-on tracing for high-signal events (lifecycle, transcript/tool calls,
+    // errors). For bulk streams (audio/text deltas) we log only count / first
+    // + last so the console doesn't scroll into uselessness.
+    const isHighSignal = /^(session\.|error$|conversation\.item\.created|conversation\.item\.input_audio_transcription\.completed|response\.created|response\.output_item\.done|response\.audio_transcript\.done|response\.output_audio_transcript\.done|response\.done|response\.function_call_arguments\.done|rate_limits\.updated)/i.test(
+      type,
+    );
+    if (isHighSignal) {
+      const isError = type === "error";
+      const extra = type.startsWith("conversation.item.input_audio_transcription")
+        ? ` item=${event.item_id} ci=${event.content_index} — ${String(event.delta ?? event.transcript ?? "").slice(0, 180)}`
+        : type.startsWith("response.")
+          ? ` resp=${String(event.response_id ?? event.response?.id ?? "").slice(0, 10)} status=${event.response?.status ?? "-"}  ${String(event.transcript ?? event.text ?? event.delta ?? "").slice(0, 200)}`
+          : type === "response.function_call_arguments.done"
+            ? ` tool=${event.name}  callId=${String(event.call_id ?? "").slice(0, 10)}  argsPreview=${String(event.arguments ?? "").slice(0, 220)}`
+            : type === "error"
+              ? ` code=${String(event.code ?? "-")} message=${String(event.message ?? "").slice(0, 200)}`
+              : type === "rate_limits.updated"
+                ? ` ${String(JSON.stringify(event.rate_limits ?? [])).slice(0, 220)}`
+                : "";
+      _wsLog(isError ? 3 : (type.startsWith("response.") && /(text_done|audio_transcript\.done|output_item\.done|output_audio_transcript\.done|function_call_arguments)/i.test(type) ? 1 : 0),
+        "MSG",
+        `← ${type}${extra}`
+      );
+    }
     // Opt-in event tracing for diagnosing turn/transcript issues. Enable with
     // `localStorage.setItem("s2s.debug", "1")` in the browser console.
-    if (this._debug) {
+    if (this._debug && !isHighSignal) {
       const extra = type.startsWith("conversation.item.input_audio_transcription")
         ? ` item=${event.item_id} ci=${event.content_index} ${event.delta ?? event.transcript ?? ""}`
         : type.startsWith("response.")
@@ -1008,6 +1360,11 @@ export class S2sWsRealtimeClient extends EventTarget {
   /** @param {CloseEvent} ev */
   _onWsClose(ev) {
     console.log("[ws] socket closed:", ev.code, ev.reason);
+    _wsLog(
+      (ev.code === 1000 || ev.code === 1001) ? 1 : (ev.code ? 3 : 2),
+      "CLOSE",
+      `WebSocket CHIUSO code=${ev.code ?? "?"} reason=${String(ev.reason ?? "(nessuna)").slice(0, 160)} wasClean=${ev.wasClean}`
+    );
     if (this._status === "closed" || this._status === "error") return;
     if (ev.code === 1000) {
       this._setStatus("closed");
@@ -1037,6 +1394,38 @@ export class S2sWsRealtimeClient extends EventTarget {
         output: { voice: this.options.voice },
       },
     };
+    // ───────────────────────────────────────────────────────────────────────────
+    // 2026-09-25 INIETTA API-PILOT HERRAMIENTAS DINÁMICAS (PASADA-1) nel session.update.
+    // 3 strati di assicurazione (in ordine di priorità crescente, dedup by marker):
+    //   (A) main.js effectiveReasoningInstructions() ha già appeso la lista.
+    //   (B) NOSTRO server.py proxy realtime ri-inietta (se routing lo attraversa).
+    //   (C) QUI s2s-ws-client: ultimo punto di catch-all prima dell'invio al
+    //       canale, GARANTISCE che la lista sia SEMPRE presente in istruzioni
+    //       (anche se qualcuno fa updateSession() con text sovrascritto poco dopo).
+    {
+      const currentInstr = (typeof session.instructions === "string") ? session.instructions : "";
+      if (!instructionsAlreadyHasApipilotPass1(currentInstr)) {
+        try {
+          const info = typeof window !== "undefined" && typeof window.__s2sGetApipilotPass1ContextInfo === "function"
+            ? window.__s2sGetApipilotPass1ContextInfo()
+            : null;
+          const blk = (info && typeof info.block === "string") ? info.block : buildApipilotPass1PromptBlock(null);
+          if (blk && blk.trim()) {
+            session.instructions = currentInstr
+              ? `${currentInstr}\n\n${blk}`
+              : blk;
+            const lenBlk = blk.length;
+            const cntTools = (info && typeof info.count === "number") ? info.count : "?";
+            _wsLog(
+              1, "APIPILOT",
+              `_sendSessionUpdate: APPENDED PASS-1 instructions (N=${cntTools}, +${lenBlk} chars). origLen=${currentInstr.length} newLen=${session.instructions.length}`,
+            );
+          }
+        } catch (_) {
+          /* never-fail */
+        }
+      }
+    }
     // Tools are declared here; the backend already accepts them in
     // session.update and emits response.function_call_arguments.done when the
     // model decides to call one. Only include the keys when we actually have
@@ -1049,8 +1438,9 @@ export class S2sWsRealtimeClient extends EventTarget {
     reportWsDebug("B", "s2s-ws-client.js:_sendSessionUpdate", "sending initial session.update", {
       toolCount: this._tools.length,
       toolNames: this._tools.map((tool) => tool.name),
-      hasInstructions: !!this.options.instructions,
-      instructionLength: (this.options.instructions || "").length,
+      hasInstructions: !!session.instructions,
+      instructionLength: (session.instructions || "").length,
+      apipilotPass1Present: instructionsAlreadyHasApipilotPass1(session.instructions),
     });
     // #endregion
     this._send({ type: "session.update", session });
@@ -1061,14 +1451,35 @@ export class S2sWsRealtimeClient extends EventTarget {
   updateSession(patch) {
     /** @type {Record<string, any>} */
     const session = { type: "realtime" };
-    if (patch.instructions) session.instructions = patch.instructions;
+    if (patch.instructions) {
+      let instr = patch.instructions;
+      // ── 2026-09-25 catch-all apipilot PASS-1 anche per patch live. ──
+      if (typeof instr === "string" && !instructionsAlreadyHasApipilotPass1(instr)) {
+        try {
+          const info = typeof window !== "undefined" && typeof window.__s2sGetApipilotPass1ContextInfo === "function"
+            ? window.__s2sGetApipilotPass1ContextInfo()
+            : null;
+          const blk = (info && typeof info.block === "string") ? info.block : buildApipilotPass1PromptBlock(null);
+          if (blk && blk.trim()) {
+            const origLen = instr.length;
+            instr = `${instr}\n\n${blk}`;
+            _wsLog(
+              1, "APIPILOT",
+              `updateSession: APPENDED PASS-1 on live patch (N=${(info && typeof info.count === "number") ? info.count : "?"}, +${blk.length} chars). origLen=${origLen} newLen=${instr.length}`,
+            );
+          }
+        } catch (_) { /* never-fail */ }
+      }
+      session.instructions = instr;
+    }
     if (patch.voice) session.audio = { output: { voice: patch.voice } };
     if (Object.keys(session).length > 1) {
       // #region debug-point C:update-session
       reportWsDebug("C", "s2s-ws-client.js:updateSession", "sending patch session.update", {
-        hasInstructions: !!patch.instructions,
-        instructionLength: (patch.instructions || "").length,
+        hasInstructions: !!session.instructions,
+        instructionLength: (session.instructions || "").length,
         hasVoice: !!patch.voice,
+        apipilotPass1Present: typeof session.instructions === "string" && instructionsAlreadyHasApipilotPass1(session.instructions),
       });
       // #endregion
       this._send({ type: "session.update", session });
@@ -1365,14 +1776,46 @@ export class S2sWsRealtimeClient extends EventTarget {
   /** @param {Record<string, unknown>} event */
   _send(event) {
     if (!this._ws || this._ws.readyState !== WebSocket.OPEN) return;
+    // Anti-spam bulk-rate limiter per eventi audio (~25 al secondo).
+    // Loggiamo un resoconto ogni 250 chunk (circa 10s a 25Hz) invece di ogni singolo.
+    if (event.type === "input_audio_buffer.append") {
+      _wsMicChunkCount += 1;
+      const now = performance.now();
+      if (_wsMicChunkCount === 1 || now - _wsMicChunkLastLogTs >= 2500 || _wsMicChunkCount % 250 === 0) {
+        _wsMicChunkLastLogTs = now;
+        _wsLog(0, "SEND:BULK", `→ input_audio_buffer.append chunk #${_wsMicChunkCount} audio_len=${String(event.audio ?? "").length} chars (base64)`);
+      }
+      let payloadLength = 0;
+      let stringifyMs = 0;
+      let payload = "";
+      if (event.type === "conversation.item.create") {
+        const startedAt = performance.now();
+        payload = JSON.stringify(event);
+        stringifyMs = performance.now() - startedAt;
+        payloadLength = payload.length;
+        // #region debug-point A:conversation-item-create
+        reportWsDebug("A", "s2s-ws-client.js:_send", "sending conversation.item.create payload", {
+          payloadLength,
+          stringifyMs: Math.round(stringifyMs),
+        });
+        // #endregion
+      }
+      if (this._debug && (event.type === "session.update" || event.type === "conversation.item.create")) {
+        const preview = (payload || JSON.stringify(event)).slice(0, 400);
+        console.debug(`[Vocero WS OUT] type=${event.type} payload=${preview}`);
+      }
+      this._ws.send(payload || JSON.stringify(event));
+      return;
+    }
+    // Messaggi non bulk: log sempre [S2S-WS:SEND] con anteprima del payload.
     let payloadLength = 0;
     let stringifyMs = 0;
     let payload = "";
+    const startedAt = performance.now();
+    payload = JSON.stringify(event);
+    stringifyMs = performance.now() - startedAt;
+    payloadLength = payload.length;
     if (event.type === "conversation.item.create") {
-      const startedAt = performance.now();
-      payload = JSON.stringify(event);
-      stringifyMs = performance.now() - startedAt;
-      payloadLength = payload.length;
       // #region debug-point A:conversation-item-create
       reportWsDebug("A", "s2s-ws-client.js:_send", "sending conversation.item.create payload", {
         payloadLength,
@@ -1380,11 +1823,17 @@ export class S2sWsRealtimeClient extends EventTarget {
       });
       // #endregion
     }
+    const isToolish = /tool|function|response\.create/i.test(event.type || "");
+    const preview = payload.slice(0, isToolish ? 600 : 260);
+    _wsLog(
+      isToolish ? 1 : 0,
+      "SEND",
+      `→ ${String(event.type ?? "?")}  payload=${payloadLength} bytes  stringify=${Math.round(stringifyMs)} ms — ${preview}${payload.length > (isToolish ? 600 : 260) ? "…" : ""}`
+    );
     if (this._debug && (event.type === "session.update" || event.type === "conversation.item.create")) {
-      const preview = (payload || JSON.stringify(event)).slice(0, 400);
-      console.debug(`[Vocero WS OUT] type=${event.type} payload=${preview}`);
+      console.debug(`[Vocero WS OUT] type=${event.type} payload=${payload.slice(0, 400)}`);
     }
-    this._ws.send(payload || JSON.stringify(event));
+    this._ws.send(payload);
   }
 
   async close() {
diff --git a/speech_to_speech/LLM/lm_output_processor.py b/speech_to_speech/LLM/lm_output_processor.py
index fcfb6a7..c1fec13 100644
--- a/speech_to_speech/LLM/lm_output_processor.py
+++ b/speech_to_speech/LLM/lm_output_processor.py
@@ -4,16 +4,80 @@ LLM Output Processor
 Intercepts LLM output to:
 1. Extract tool calls and send them via text_output_queue
 2. Forward clean text to TTS pipeline
+3. 2026-09-25: SANITIZE APIPILOT internal markers before clients / TTS (anti-leak tecnico)
 """
 
 from __future__ import annotations
 
 import logging
+import re
 from collections.abc import Iterator
 from queue import Queue
 
 from speech_to_speech.baseHandler import BaseHandler
 from speech_to_speech.pipeline.events import AssistantTextEvent, ResponseFailedEvent, TokenUsageEvent
+
+# 2026-09-25 SANITIZE APIPILOT CALL/RESULT markers in LLM output BEFORE:
+#   (a) AssistantTextEvent viene mandato ai client WS (e loggato come <<< TEXT:/ASSISTANT:)
+#   (b) TTSInput viene mandato a Qwen3-TTS (che lo pronuncerebbe ad alta voce).
+# Formati osservati reali oggi (upstream Vocero start_pipeline_rag):
+#   1) <<<APIPILOT_CALL:NAME=tool,ARGUMENTS=json>>>   standard 3x
+#   2) <APIPILOT_CALL:NAME=get_user_briefing,ARGUMENTS={"format":"voice"}
+#                                 singolo '<' '>' + args inventati da AI (format=voice)
+#   3) <<<APIPILOT_CALL:...}>  \n>>                      spezzato multi-riga
+#   4) >>>APIPILOT_CALL:...<<<                            invertito (errore sintassi AI)
+#   5) <<<APIPILOT_RESULT:PASS2>>> + blocco result.
+_APIPILOT_CALL_NORM = re.compile(
+    r"[<]{1,3}\s*APIPILOT_CALL:NAME=([A-Za-z0-9_.-]+),ARGUMENTS=(.*?)[>]{1,3}",
+    re.IGNORECASE | re.DOTALL,
+)
+_APIPILOT_CALL_INV = re.compile(
+    r"[>]{1,3}\s*APIPILOT_CALL:NAME=([A-Za-z0-9_.-]+),ARGUMENTS=(.*?)[<]{1,3}",
+    re.IGNORECASE | re.DOTALL,
+)
+_APIPILOT_RESULT = re.compile(
+    r"[<]{1,3}\s*APIPILOT_RESULT(?::PASS2)?[^<>\n]{0,4000}[>]{1,3}",
+    re.IGNORECASE | re.DOTALL,
+)
+_APIPILOT_SPANISH_PLACEHOLDER = ("Voy a consultar tus datos, un momento por favor.")
+
+
+def _sanitize_apipilot_before_client_and_tts(text: str) -> tuple[str, bool, str]:
+    if not isinstance(text, str) or not text.strip():
+        return text, False, ""
+    found_call = False
+    found_call_tool = ""
+    def _repl_call(m: re.Match) -> str:
+        nonlocal found_call, found_call_tool
+        found_call = True
+        try:
+            nm = m.group(1)
+            if isinstance(nm, str) and nm.strip():
+                found_call_tool = nm.strip()
+        except Exception:
+            pass
+        return f" {_APIPILOT_SPANISH_PLACEHOLDER} "
+    new_text = _APIPILOT_CALL_NORM.sub(_repl_call, text)
+    if not found_call:
+        new_text = _APIPILOT_CALL_INV.sub(_repl_call, new_text)
+    found_result = False
+    if _APIPILOT_RESULT.search(new_text):
+        new_text = _APIPILOT_RESULT.sub(" ", new_text)
+        found_result = True
+    # safety catchall frammenti marker senza wrapper (se marker troncato mid-stream)
+    low = new_text.lower()
+    if "apipilot" in low and ("call" in low or "result" in low or "name=" in low or "arguments=" in low):
+        new_text = re.sub(r"(?i)\bAPIPILOT(?:_CALL|_RESULT)?\b", " ", new_text)
+        new_text = re.sub(r"(?i)\b(?:NAME|ARGUMENTS|STATUS|PASS2)\s*[:=]", " ", new_text)
+        found_call = True
+    if found_call or found_result:
+        new_text = re.sub(r"\s{2,}", " ", new_text).strip()
+    tag = ""
+    if found_call:
+        tag = f"CALL({found_call_tool or '?'})"
+    if found_result:
+        tag = (tag + "+" if tag else "") + "RESULT"
+    return new_text, (found_call or found_result), tag
 from speech_to_speech.pipeline.handler_types import LLMOut, TTSIn
 from speech_to_speech.pipeline.messages import EndOfResponse, LLMResponseChunk, TokenUsage, TTSInput
 from speech_to_speech.pipeline.queue_types import TextEventItem
@@ -120,24 +184,44 @@ class LMOutputProcessor(BaseHandler[LLMOut, TTSIn]):
 
         logger.debug(f"LM processor: text='{lm_output.text}', tools={lm_output.tools}")
 
+        # 2026-09-25 SANITIZE SINGOLO PUNTO CENTRALE: PRIMA di AssistantTextEvent (client/log)
+        #    E PRIMA di TTSInput (Qwen3-TTS che pronuncerebbe marker APIPILOT CALL).
+        clean_text = lm_output.text
+        any_sanitized = False
+        sanitize_tag = ""
+        if clean_text and clean_text.strip():
+            clean_text, any_sanitized, sanitize_tag = _sanitize_apipilot_before_client_and_tts(clean_text)
+            if any_sanitized:
+                logger.warning(
+                    "[LM-OUTPUT-APIPILOT-SANITIZE] %s — tool=%s rawLen=%d cleanLen=%d (rimosso / sostituito con placeholder spagnolo PRIMA di client + TTS).",
+                    sanitize_tag or "-",
+                    (sanitize_tag if sanitize_tag else "marker"),
+                    len(lm_output.text or ""),
+                    len(clean_text or ""),
+                )
+                # evita che lo stesso chunk (marker solo) arrivi a TTS come "" → Hello.
+                # Se dopo sanitize testo vuoto MA avevamo trovato marker → placeholder.
+                if not clean_text.strip():
+                    clean_text = _APIPILOT_SPANISH_PLACEHOLDER
+
         if self.text_output_queue is not None:
             event = AssistantTextEvent(
-                text=lm_output.text,
+                text=clean_text,
                 turn_id=lm_output.turn_id,
                 turn_revision=lm_output.turn_revision,
                 cancel_generation=lm_output.cancel_generation,
             )
             if lm_output.tools:
                 event.tools = lm_output.tools
-                logger.info(f"Sending to clients: text='{lm_output.text}', tools={[t.name for t in lm_output.tools]}")
+                logger.info(f"Sending to clients: text='{clean_text}', tools={[t.name for t in lm_output.tools]}")
             else:
-                logger.debug(f"Sending to clients: text='{lm_output.text}' (no tools)")
+                logger.debug(f"Sending to clients: text='{clean_text}' (no tools)")
             self.text_output_queue.put(event)
 
-        if lm_output.text and response_wants_audio(lm_output.response):
-            logger.debug(f"Forwarding to TTS: '{lm_output.text}'")
+        if clean_text and response_wants_audio(lm_output.response):
+            logger.debug(f"Forwarding to TTS: '{clean_text}' (original marker was: {sanitize_tag if any_sanitized else 'none'})")
             yield TTSInput(
-                text=lm_output.text,
+                text=clean_text,
                 language_code=lm_output.language_code,
                 runtime_config=lm_output.runtime_config,
                 response=lm_output.response,
diff --git a/speech_to_speech/TTS/qwen3_tts_handler.py b/speech_to_speech/TTS/qwen3_tts_handler.py
index e71d6b0..7718b91 100644
--- a/speech_to_speech/TTS/qwen3_tts_handler.py
+++ b/speech_to_speech/TTS/qwen3_tts_handler.py
@@ -12,6 +12,78 @@ import math
 import re
 import tempfile
 import unicodedata
+
+# 2026-09-25 SANITIZE APIPILOT MARKERS PRIMA DI TTS (anti-leak pronunciato da Qwen3).
+#   Lato server S2S Python abbiamo gia' gate + sanitize ma come DOPPIA RETE
+#   di sicurezza sanitizziamo DIRETTAMENTE il testo che entra in Qwen3-TTS.
+#   Formati osservati reali oggi:
+#     (a) <<<APIPILOT_CALL:NAME=tool,ARGUMENTS=json>>>    standard 3 parentesi
+#     (b) <APIPILOT_CALL:NAME=tool,ARGUMENTS={"format":"voice"}
+#                                                         singolo < > (caso user oggi)
+#     (c) <<<APIPILOT_CALL:...}>   \n>>                    spezzato piu' righe
+#     (d) >>>APIPILOT_CALL:...<<<                          invertito
+#   Regola: CALL -> placeholder spagnolo (frase naturale utente), RESULT -> strip.
+_APIPILOT_CALL_NORMAL_RE = re.compile(
+    r"[<]{1,3}\s*APIPILOT_CALL:NAME=([A-Za-z0-9_.-]+),ARGUMENTS=(.*?)[>]{1,3}",
+    re.IGNORECASE | re.DOTALL,
+)
+_APIPILOT_CALL_INVERTED_RE = re.compile(
+    r"[>]{1,3}\s*APIPILOT_CALL:NAME=([A-Za-z0-9_.-]+),ARGUMENTS=(.*?)[<]{1,3}",
+    re.IGNORECASE | re.DOTALL,
+)
+_APIPILOT_RESULT_RE = re.compile(
+    r"[<]{1,3}\s*APIPILOT_RESULT(?::PASS2)?[^<>\n]{0,2000}[>]{1,3}",
+    re.IGNORECASE | re.DOTALL,
+)
+_APIPILOT_SPANISH_PLACEHOLDER = "Voy a consultar tus datos, un momento por favor."
+
+
+def _tts_sanitize_apipilot_markers(text: str) -> tuple[str, bool, str]:
+    """Rimuove marker APIPILOT dal testo TTS.
+
+    Returns (sanitized_text, found_any, log_tag).
+    """
+    if not isinstance(text, str) or not text.strip():
+        return text, False, "empty"
+    found_call = False
+    found_result = False
+    tool_name = ""
+    # 1) marker CALL standard + invertito -> placeholder spagnolo
+    def _repl_call(m: re.Match) -> str:
+        nonlocal found_call, tool_name
+        found_call = True
+        try:
+            nm = m.group(1)
+            if isinstance(nm, str) and nm.strip():
+                tool_name = nm.strip()
+        except Exception:
+            pass
+        return f" {_APIPILOT_SPANISH_PLACEHOLDER} "
+    text2 = _APIPILOT_CALL_NORMAL_RE.sub(_repl_call, text)
+    if not found_call:
+        text2 = _APIPILOT_CALL_INVERTED_RE.sub(_repl_call, text2)
+    # 2) marker RESULT -> strip silenzioso (non sono pronunciabili)
+    if _APIPILOT_RESULT_RE.search(text2):
+        found_result = True
+        text2 = _APIPILOT_RESULT_RE.sub(" ", text2)
+    # 3) safety: FRAMMENTI marker singoli che non hanno wrapper completo
+    low = text2.lower()
+    if "apipilot" in low and ("call" in low or "result" in low):
+        import re as _re_sf
+        text2 = _re_sf.sub(r"(?i)\bAPIPILOT(?:_CALL|_RESULT)?\b", " ", text2)
+        text2 = _re_sf.sub(r"(?i)\b(?:NAME|ARGUMENTS|STATUS|PASS2)\s*[:=]", " ", text2)
+        found_call = True
+    if found_call or found_result:
+        text2 = re.sub(r"\s{2,}", " ", text2).strip()
+    tag = "-"
+    if found_call and found_result:
+        tag = f"CALL({tool_name or '?'})+RESULT"
+    elif found_call:
+        tag = f"CALL({tool_name or '?'})"
+    elif found_result:
+        tag = "RESULT"
+    return text2, (found_call or found_result), tag
+
 from collections.abc import Callable
 from pathlib import Path
 from sys import platform
@@ -709,7 +781,20 @@ class Qwen3TTSHandler(BaseHandler[TTSIn, TTSOut]):
 
         coalesced_text, _language_code, _saw_end_of_response = self._coalesce_pending_tts_input(tts_input)
 
-        text = coalesced_text or "Hello."
+        raw_text = coalesced_text or "Hello."
+        # 2026-09-25 SANITIZE APIPILOT PRIMA DI TTS (doppia rete sicurezza):
+        #   Anche se lato server S2s Python abbiamo gia' gate audio drop + sanitize,
+        #   Qwen3-TTS puo' ricevere marker per race / nuovi formati. Quindi QUI
+        #   eliminiamo / sostituiamo con placeholder PRIMA di chiamare generate().
+        text, found_marker, sanitize_tag = _tts_sanitize_apipilot_markers(raw_text)
+        if found_marker:
+            logger.warning(
+                "[TTS-APIPILOT-SANITIZE] marker=%s rawLen=%d sanitizedLen=%d → sostituito con placeholder spagnolo / strip.",
+                sanitize_tag, len(raw_text or ""), len(text or ""),
+            )
+        if not text.strip():
+            # Safety se il marker era l'unica cosa: ripetiamo placeholder invece di Hello.
+            text = _APIPILOT_SPANISH_PLACEHOLDER
 
         model_type = self._model_type()
         self._apply_session_voice_override(model_type, runtime_config, response)
diff --git a/start_ui.sh b/start_ui.sh
index 3f3edec..7ebdeea 100755
--- a/start_ui.sh
+++ b/start_ui.sh
@@ -38,7 +38,7 @@ export S2S_PROXY_TARGET
 
 echo "💻 Avvio dell'interfaccia S2S Client UI (Porta $UI_PORT)..."
 echo "🔌 Proxy realtime verso $S2S_PROXY_TARGET"
-echo "💡 Premi Ctrl+C in questo terminale per fermarla."
+echo " Premi Ctrl+C in questo terminale per fermarla."
 echo "----------------------------------------------------"
 
 cd "$ROOT_DIR"