Problem

When session.dmScope is set to "per-channel-peer", WhatsApp DMs correctly resolve isolated session keys, but updateLastRouteInBackground unconditionally wrote lastTo to the main session key. This caused:

1. Reply routing corruption: Every WhatsApp DM sender overwrites the main session's lastTo — subsequent auto-replies route to whoever messaged last
2. Privacy violation: Agent replies intended for User A get delivered to User B if User B messaged more recently
3. Heartbeat/cron misrouting: Heartbeats using channel: "last" resolve against the corrupted main session

Root Cause

In src/web/auto-reply/monitor/process-message.ts, updateLastRouteInBackground always wrote to params.route.mainSessionKey regardless of whether the DM was isolated.

Fix

Only update main session's lastRoute when the DM session actually IS the main session (sessionKey === mainSessionKey):

// Only update main session's lastRoute when DM actually IS the main session.
// When dmScope="per-channel-peer", the DM uses an isolated sessionKey,
// and updating mainSessionKey would corrupt routing for the session owner.
if (dmRouteTarget && params.route.sessionKey === params.route.mainSessionKey) {
  updateLastRouteInBackground({ ... });
}

Testing

• pnpm build passes
• pnpm tsgo passes
• pnpm lint passes

Behavior

• When dmScope="main" (default): sessionKey === mainSessionKey → updateLastRoute fires as before. No behavior change.
• When dmScope="per-channel-peer": sessionKey !== mainSessionKey → updateLastRoute is skipped, preventing main session corruption.

Fixes #24912

Greptile Summary

Prevented WhatsApp DM routing corruption when session.dmScope="per-channel-peer" by guarding updateLastRouteInBackground to only update the main session's lastRoute when the DM session actually IS the main session.

• Fixed critical bug where isolated DM sessions (sessionKey !== mainSessionKey) were overwriting the main session's lastRoute, causing replies to route to whoever messaged last instead of the intended recipient
• Added condition params.route.sessionKey === params.route.mainSessionKey to guard the update (line 330 in src/web/auto-reply/monitor/process-message.ts:330)
• Maintains backward compatibility: when dmScope="main" (default), sessionKey === mainSessionKey so behavior is unchanged
• PR also includes PR_STATUS.md tracking file for agent workflow coordination (non-functional change)

Confidence Score: 5/5

• This PR is safe to merge with minimal risk
• The fix is surgical and correct: it adds a single condition to prevent corrupting the main session's lastRoute when DM sessions are isolated. The logic is sound - when dmScope="per-channel-peer", isolated DM sessions have different sessionKey values from mainSessionKey, and updating the main session with isolated DM routing data breaks reply routing. The guard preserves existing behavior for default dmScope="main" since those keys are equal. All CI checks passed.
• No files require special attention

_{Last reviewed commit: 7296045}