diff --git a/src/channels/telegram/bot.ts b/src/channels/telegram/bot.ts
index 9f992ad..09b59dc 100644
--- a/src/channels/telegram/bot.ts
+++ b/src/channels/telegram/bot.ts
@@ -1,38 +1,9 @@
 import { createHash, timingSafeEqual } from "node:crypto";
 import type { IncomingMessage, ServerResponse } from "node:http";
-import { Bot, webhookCallback } from "grammy";
-import type { Logger } from "pino";
+import { webhookCallback, type Bot } from "grammy";
 import type { AppConfig } from "../../runtime/config.js";
-import { AiDraftService } from "../../domain/ai-drafts.js";
-import { AuditService } from "../../domain/audit.js";
-import { ConversationService } from "../../domain/conversations.js";
-import { DeliveryService } from "../../domain/deliveries.js";
-import { PermissionService } from "../../domain/permissions.js";
-import { RateLimitService } from "../../domain/rate-limit.js";
-import type { Database } from "../../storage/client.js";
 import { registerTelegramMenu } from "./menu.js";
-import { registerTelegramUpdates } from "./updates.js";
-
-export function createTelegramBot(config: AppConfig, db: Database, logger: Logger): Bot {
-  const bot = new Bot(config.TELEGRAM_BOT_TOKEN);
-  const conversations = new ConversationService(
-    db,
-    config.MESSAGE_RETENTION_DAYS,
-    config.DEFAULT_CONVERSATION_RETENTION_DAYS,
-  );
-  const deps = {
-    config,
-    conversations,
-    deliveries: new DeliveryService(db),
-    permissions: new PermissionService(config.TELEGRAM_ADMIN_USER_IDS),
-    rateLimit: new RateLimitService(config.RATE_LIMIT_WINDOW_SECONDS, config.RATE_LIMIT_MAX_MESSAGES),
-    aiDrafts: new AiDraftService(db, conversations, config),
-    audit: new AuditService(db),
-    logger: logger.child({ module: "telegram.messages" }),
-  };
-  registerTelegramUpdates(bot, deps);
-  return bot;
-}
+export { createTelegramBot } from "./factory.js";
 
 export async function startTelegramBot(bot: Bot, config: AppConfig): Promise<void> {
   await prepareTelegramBot(bot, config);
diff --git a/src/channels/telegram/commands.ts b/src/channels/telegram/commands.ts
index e9149cf..cc65034 100644
--- a/src/channels/telegram/commands.ts
+++ b/src/channels/telegram/commands.ts
@@ -183,7 +183,7 @@ export async function handleTopicCommand(
       }
       const updated = await deps.conversations.setConversationRetention(conversation.id, days);
       if (updated) {
-        deps.audit.log({ adminId, conversationId: conversation.id, action: "expire", detail: days === null ? "never" : String(days) });
+        await deps.audit.log({ adminId, conversationId: conversation.id, action: "expire", detail: days === null ? "never" : String(days) });
       }
       await ctx.reply(updated ? retentionText(updated) : "会话不存在，无法设置销毁策略。");
       return true;
@@ -212,7 +212,7 @@ export async function handleTopicCommand(
         return true;
       }
       await deps.conversations.addNote(conversation.id, adminId, args);
-      deps.audit.log({ adminId, conversationId: conversation.id, action: "note" });
+      await deps.audit.log({ adminId, conversationId: conversation.id, action: "note" });
       await ctx.reply("内部备注已保存。");
       return true;
     }
@@ -237,7 +237,7 @@ export async function handleTopicCommand(
         return true;
       }
       await deps.conversations.addTag(conversation.id, args);
-      deps.audit.log({ adminId, conversationId: conversation.id, action: "tag", detail: args });
+      await deps.audit.log({ adminId, conversationId: conversation.id, action: "tag", detail: args });
       await ctx.reply(`标签已添加：${args}`);
       return true;
     }
@@ -247,7 +247,7 @@ export async function handleTopicCommand(
         return true;
       }
       await deps.conversations.removeTag(conversation.id, args);
-      deps.audit.log({ adminId, conversationId: conversation.id, action: "untag", detail: args });
+      await deps.audit.log({ adminId, conversationId: conversation.id, action: "untag", detail: args });
       await ctx.reply(`标签已移除：${args}`);
       return true;
     }
@@ -262,7 +262,7 @@ export async function handleTopicCommand(
         return true;
       }
       await deps.conversations.setPriority(conversation.id, args as "low" | "normal" | "high" | "urgent");
-      deps.audit.log({ adminId, conversationId: conversation.id, action: "priority", detail: args });
+      await deps.audit.log({ adminId, conversationId: conversation.id, action: "priority", detail: args });
       await ctx.reply(`优先级已设置为 ${args}。`);
       return true;
     }
@@ -272,19 +272,19 @@ export async function handleTopicCommand(
         return true;
       }
       await deps.conversations.assign(conversation.id, args);
-      deps.audit.log({ adminId, conversationId: conversation.id, action: "assign", detail: args });
+      await deps.audit.log({ adminId, conversationId: conversation.id, action: "assign", detail: args });
       await ctx.reply(`已分配给 ${args}。`);
       return true;
     }
     case "ban": {
       await deps.conversations.blockContact(contact.id, adminId, args || undefined);
-      deps.audit.log({ adminId, conversationId: conversation.id, action: "ban", detail: args || undefined });
+      await deps.audit.log({ adminId, conversationId: conversation.id, action: "ban", detail: args || undefined });
       await ctx.reply("联系人已封禁，后续消息会被拒收。");
       return true;
     }
     case "unban": {
       await deps.conversations.unblockContact(contact.id);
-      deps.audit.log({ adminId, conversationId: conversation.id, action: "unban" });
+      await deps.audit.log({ adminId, conversationId: conversation.id, action: "unban" });
       await ctx.reply("联系人已解除封禁。");
       return true;
     }
@@ -294,7 +294,7 @@ export async function handleTopicCommand(
         return true;
       }
       await ctx.api.deleteForumTopic(Number(topicContext.topic.managementChatId), topicContext.topic.messageThreadId);
-      deps.audit.log({ adminId, conversationId: conversation.id, action: "delete" });
+      await deps.audit.log({ adminId, conversationId: conversation.id, action: "delete" });
       await deps.conversations.deleteConversationData(conversation.id);
       return true;
     }
@@ -304,20 +304,20 @@ export async function handleTopicCommand(
         return true;
       }
       await deps.conversations.resetConversation(conversation.id);
-      deps.audit.log({ adminId, conversationId: conversation.id, action: "reset" });
+      await deps.audit.log({ adminId, conversationId: conversation.id, action: "reset" });
       await ctx.reply("会话已重置。联系人映射和 Topic 已保留。");
       return true;
     }
     case "close": {
       await deps.conversations.setConversationStatus(conversation.id, "closed");
-      deps.audit.log({ adminId, conversationId: conversation.id, action: "close" });
+      await deps.audit.log({ adminId, conversationId: conversation.id, action: "close" });
       await ctx.reply("会话已关闭。");
       return true;
     }
     case "open":
     case "reopen": {
       await deps.conversations.setConversationStatus(conversation.id, "open");
-      deps.audit.log({ adminId, conversationId: conversation.id, action: "reopen" });
+      await deps.audit.log({ adminId, conversationId: conversation.id, action: "reopen" });
       await ctx.reply("会话已重新打开。");
       return true;
     }
@@ -328,14 +328,14 @@ export async function handleTopicCommand(
         return true;
       }
       await deps.conversations.mute(conversation.id, mutedUntil);
-      deps.audit.log({ adminId, conversationId: conversation.id, action: "mute", detail: mutedUntil });
+      await deps.audit.log({ adminId, conversationId: conversation.id, action: "mute", detail: mutedUntil });
       await ctx.reply(`已静音至 ${mutedUntil}。`);
       return true;
     }
     case "draft": {
       const subCommand = args.trim().split(/\s+/)[0]?.toLowerCase();
       if (subCommand === "send") {
-        const draft = deps.aiDrafts.findReady(conversation.id);
+        const draft = await deps.aiDrafts.findReady(conversation.id);
         if (!draft || !draft.draftText) {
           await ctx.reply("当前没有可发送的草稿，使用 /draft 生成。");
           return true;
@@ -350,8 +350,8 @@ export async function handleTopicCommand(
             await deps.deliveries.markFailed(deliveryId, errMsg, 3);
             throw error;
           }
-          deps.aiDrafts.markSent(draft.id);
-          deps.audit.log({ adminId, conversationId: conversation.id, action: "draft_send", detail: String(draft.id) });
+          await deps.aiDrafts.markSent(draft.id);
+          await deps.audit.log({ adminId, conversationId: conversation.id, action: "draft_send", detail: String(draft.id) });
           await ctx.reply("草稿已发送给外部用户。");
         } catch (error) {
           const msg = error instanceof Error ? error.message : String(error);
@@ -360,18 +360,18 @@ export async function handleTopicCommand(
         return true;
       }
       if (subCommand === "discard") {
-        const draft = deps.aiDrafts.findReady(conversation.id);
+        const draft = await deps.aiDrafts.findReady(conversation.id);
         if (!draft) {
           await ctx.reply("当前没有可丢弃的草稿。");
           return true;
         }
-        deps.aiDrafts.markDiscarded(draft.id);
-        deps.audit.log({ adminId, conversationId: conversation.id, action: "draft_discard", detail: String(draft.id) });
+        await deps.aiDrafts.markDiscarded(draft.id);
+        await deps.audit.log({ adminId, conversationId: conversation.id, action: "draft_discard", detail: String(draft.id) });
         await ctx.reply("草稿已丢弃。");
         return true;
       }
       if (subCommand === "view") {
-        const draft = deps.aiDrafts.findReady(conversation.id);
+        const draft = await deps.aiDrafts.findReady(conversation.id);
         if (!draft || !draft.draftText) {
           await ctx.reply("当前没有草稿，使用 /draft 生成。");
           return true;
@@ -402,7 +402,7 @@ export async function handleTopicCommand(
     }
     case "ai_on": {
       await deps.conversations.setAiEnabled(conversation.id, true);
-      deps.audit.log({ adminId, conversationId: conversation.id, action: "ai_on" });
+      await deps.audit.log({ adminId, conversationId: conversation.id, action: "ai_on" });
       const globalEnabled = isAiConfigured(deps.config);
       const hint = globalEnabled ? "" : "\n\n提示：全局 AI 未开启，需先在控制台启用 AI_DRAFTS_ENABLED。";
       await ctx.reply(`已对该会话开启 AI 草稿。${hint}`);
@@ -410,12 +410,12 @@ export async function handleTopicCommand(
     }
     case "ai_off": {
       await deps.conversations.setAiEnabled(conversation.id, false);
-      deps.audit.log({ adminId, conversationId: conversation.id, action: "ai_off" });
+      await deps.audit.log({ adminId, conversationId: conversation.id, action: "ai_off" });
       await ctx.reply("已对该会话关闭 AI 草稿。该会话不再自动生成回复草稿。");
       return true;
     }
     case "mine": {
-      const items = deps.conversations.listByAssignee(adminId, 20);
+      const items = await deps.conversations.listByAssignee(adminId, 20);
       if (items.length === 0) {
         await ctx.reply("当前没有分配给你的会话。使用 /assign <你的 user_id> 分配给自己。");
         return true;
@@ -434,7 +434,7 @@ export async function handleTopicCommand(
         await ctx.reply("用法：/search <关键词>，在当前会话历史消息中搜索。");
         return true;
       }
-      const results = deps.conversations.searchMessagesInConversation(conversation.id, args, 20);
+      const results = await deps.conversations.searchMessagesInConversation(conversation.id, args, 20);
       if (results.length === 0) {
         await ctx.reply("未找到匹配的消息。");
         return true;
@@ -445,7 +445,7 @@ export async function handleTopicCommand(
     }
     case "audit": {
       const limit = parseLimit(args, 20, 50);
-      const logs = deps.audit.listByConversation(conversation.id, limit);
+      const logs = await deps.audit.listByConversation(conversation.id, limit);
       if (logs.length === 0) {
         await ctx.reply("当前会话暂无审计记录。");
         return true;
diff --git a/src/channels/telegram/factory.ts b/src/channels/telegram/factory.ts
new file mode 100644
index 0000000..0c1e6b2
--- /dev/null
+++ b/src/channels/telegram/factory.ts
@@ -0,0 +1,32 @@
+import { Bot } from "grammy";
+import type { Logger } from "pino";
+import { AiDraftService } from "../../domain/ai-drafts.js";
+import { AuditService } from "../../domain/audit.js";
+import { ConversationService } from "../../domain/conversations.js";
+import { DeliveryService } from "../../domain/deliveries.js";
+import { PermissionService } from "../../domain/permissions.js";
+import { RateLimitService } from "../../domain/rate-limit.js";
+import type { Database } from "../../ports/database.js";
+import type { AppConfig } from "../../runtime/config.js";
+import { registerTelegramUpdates } from "./updates.js";
+
+export function createTelegramBot(config: AppConfig, db: Database, logger: Logger): Bot {
+  const bot = new Bot(config.TELEGRAM_BOT_TOKEN);
+  const conversations = new ConversationService(
+    db,
+    config.MESSAGE_RETENTION_DAYS,
+    config.DEFAULT_CONVERSATION_RETENTION_DAYS,
+  );
+  const deps = {
+    config,
+    conversations,
+    deliveries: new DeliveryService(db),
+    permissions: new PermissionService(config.TELEGRAM_ADMIN_USER_IDS),
+    rateLimit: new RateLimitService(config.RATE_LIMIT_WINDOW_SECONDS, config.RATE_LIMIT_MAX_MESSAGES),
+    aiDrafts: new AiDraftService(db, conversations, config),
+    audit: new AuditService(db),
+    logger: logger.child({ module: "telegram.messages" }),
+  };
+  registerTelegramUpdates(bot, deps);
+  return bot;
+}
diff --git a/src/channels/telegram/secrets.ts b/src/channels/telegram/secrets.ts
new file mode 100644
index 0000000..8f67bbb
--- /dev/null
+++ b/src/channels/telegram/secrets.ts
@@ -0,0 +1,8 @@
+import type { AppConfig } from "../../runtime/config.js";
+
+export async function telegramWebhookSecret(config: AppConfig): Promise<string> {
+  if (config.TELEGRAM_WEBHOOK_SECRET) return config.TELEGRAM_WEBHOOK_SECRET;
+  const data = new TextEncoder().encode(config.TELEGRAM_BOT_TOKEN);
+  const digest = await globalThis.crypto.subtle.digest("SHA-256", data);
+  return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
diff --git a/src/channels/telegram/worker-webhook.ts b/src/channels/telegram/worker-webhook.ts
new file mode 100644
index 0000000..c8cbd89
--- /dev/null
+++ b/src/channels/telegram/worker-webhook.ts
@@ -0,0 +1,18 @@
+import { webhookCallback, type Bot } from "grammy";
+
+export type WorkerTelegramWebhookHandler = (request: Request) => Promise<Response>;
+export type WorkerWebhookCallbackFactory = (bot: Bot, adapter: "cloudflare-mod") => WorkerTelegramWebhookHandler;
+
+export function createWorkerTelegramWebhookHandler(
+  bot: Bot,
+  expectedSecret: string,
+  callbackFactory: WorkerWebhookCallbackFactory = webhookCallback as WorkerWebhookCallbackFactory,
+): WorkerTelegramWebhookHandler {
+  const callback = callbackFactory(bot, "cloudflare-mod");
+  return async (request) => {
+    if (request.headers.get("x-telegram-bot-api-secret-token") !== expectedSecret) {
+      return new Response("Forbidden", { status: 403 });
+    }
+    return callback(request);
+  };
+}
diff --git a/src/domain/ai-drafts.ts b/src/domain/ai-drafts.ts
index 776eb67..0efa6da 100644
--- a/src/domain/ai-drafts.ts
+++ b/src/domain/ai-drafts.ts
@@ -1,6 +1,6 @@
 import type { AppConfig } from "../runtime/config.js";
 import { isAiConfigured } from "../runtime/config.js";
-import type { Database } from "../storage/client.js";
+import type { Database } from "../ports/database.js";
 import { nowIso, type ConversationService } from "./conversations.js";
 
 export interface DraftResult {
@@ -72,13 +72,13 @@ export class AiDraftService {
     }
 
     const timestamp = nowIso();
-    this.db
+    await this.db
       .prepare(
         `INSERT INTO ai_drafts (conversation_id, source_message_id, status, created_at, updated_at)
          VALUES (?, ?, 'pending', ?, ?)`,
       )
       .run(conversationId, sourceMessageId ?? null, timestamp, timestamp);
-    const row = this.db.prepare("SELECT last_insert_rowid() AS id").get() as { id: number };
+    const row = (await this.db.prepare("SELECT last_insert_rowid() AS id").get()) as { id: number };
     const draftId = Number(row.id);
 
     try {
@@ -136,7 +136,7 @@ export class AiDraftService {
           }
 
           const text = truncateText(rawText);
-          this.db
+          await this.db
             .prepare("UPDATE ai_drafts SET status = 'ready', draft_text = ?, updated_at = ? WHERE id = ?")
             .run(text, nowIso(), draftId);
           const elapsed = Date.now() - startTime;
@@ -151,46 +151,46 @@ export class AiDraftService {
       }
 
       const message = lastError?.message ?? "AI draft generation failed.";
-      this.db
+      await this.db
         .prepare("UPDATE ai_drafts SET status = 'failed', error = ?, updated_at = ? WHERE id = ?")
         .run(message, nowIso(), draftId);
       return { status: "failed", error: message };
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      this.db
+      await this.db
         .prepare("UPDATE ai_drafts SET status = 'failed', error = ?, updated_at = ? WHERE id = ?")
         .run(message, nowIso(), draftId);
       return { status: "failed", error: message };
     }
   }
 
-  findReady(conversationId: number): DraftRow | undefined {
-    const row = this.db
+  async findReady(conversationId: number): Promise<DraftRow | undefined> {
+    const row = (await this.db
       .prepare(
         `SELECT * FROM ai_drafts
          WHERE conversation_id = ? AND status = 'ready'
          ORDER BY created_at DESC LIMIT 1`,
       )
-      .get(conversationId) as Record<string, unknown> | undefined;
+      .get(conversationId)) as Record<string, unknown> | undefined;
     return row ? draftFromRow(row) : undefined;
   }
 
-  markSent(draftId: number): void {
-    this.db
+  async markSent(draftId: number): Promise<void> {
+    await this.db
       .prepare("UPDATE ai_drafts SET status = 'sent', updated_at = ? WHERE id = ?")
       .run(nowIso(), draftId);
   }
 
-  markDiscarded(draftId: number): void {
-    this.db
+  async markDiscarded(draftId: number): Promise<void> {
+    await this.db
       .prepare("UPDATE ai_drafts SET status = 'discarded', updated_at = ? WHERE id = ?")
       .run(nowIso(), draftId);
   }
 
-  stats(): { pending: number; ready: number; failed: number; sent: number; discarded: number } {
-    const rows = this.db
+  async stats(): Promise<{ pending: number; ready: number; failed: number; sent: number; discarded: number }> {
+    const rows = (await this.db
       .prepare("SELECT status, COUNT(*) AS cnt FROM ai_drafts GROUP BY status")
-      .all() as Array<{ status: string; cnt: number }>;
+      .all()) as Array<{ status: string; cnt: number }>;
     const result = { pending: 0, ready: 0, failed: 0, sent: 0, discarded: 0 };
     for (const row of rows) {
       if (row.status === "pending") result.pending = row.cnt;
diff --git a/src/domain/app-settings.ts b/src/domain/app-settings.ts
index 5818b32..3e273cc 100644
--- a/src/domain/app-settings.ts
+++ b/src/domain/app-settings.ts
@@ -1,4 +1,5 @@
-import type { Database } from "../storage/client.js";
+import type { Database } from "../ports/database.js";
+import type { ConfigMap } from "../runtime/config.js";
 
 export interface AppSetting {
   key: string;
@@ -9,31 +10,31 @@ export interface AppSetting {
 export class AppSettingsService {
   constructor(private readonly db: Database) {}
 
-  all(): NodeJS.ProcessEnv {
-    const rows = this.db.prepare("SELECT key, value FROM app_settings").all() as Array<{ key: string; value: string }>;
-    const env: NodeJS.ProcessEnv = {};
+  async all(): Promise<ConfigMap> {
+    const rows = (await this.db.prepare("SELECT key, value FROM app_settings").all()) as Array<{ key: string; value: string }>;
+    const env: ConfigMap = {};
     for (const row of rows) env[row.key] = row.value;
     return env;
   }
 
-  get(key: string): string | undefined {
-    const row = this.db.prepare("SELECT value FROM app_settings WHERE key = ?").get(key) as { value: string } | undefined;
+  async get(key: string): Promise<string | undefined> {
+    const row = (await this.db.prepare("SELECT value FROM app_settings WHERE key = ?").get(key)) as { value: string } | undefined;
     return row?.value;
   }
 
-  setMany(values: Record<string, string>): void {
+  async setMany(values: Record<string, string>): Promise<void> {
     const updatedAt = new Date().toISOString();
     const statement = this.db.prepare(
       `INSERT INTO app_settings (key, value, updated_at)
        VALUES (?, ?, ?)
        ON CONFLICT(key) DO UPDATE SET value = excluded.value, updated_at = excluded.updated_at`,
     );
-    this.db.exec("BEGIN");
+    await this.db.exec("BEGIN");
     try {
-      for (const [key, value] of Object.entries(values)) statement.run(key, value, updatedAt);
-      this.db.exec("COMMIT");
+      for (const [key, value] of Object.entries(values)) await statement.run(key, value, updatedAt);
+      await this.db.exec("COMMIT");
     } catch (error) {
-      this.db.exec("ROLLBACK");
+      await this.db.exec("ROLLBACK");
       throw error;
     }
   }
diff --git a/src/domain/audit.ts b/src/domain/audit.ts
index 75f92ec..a3449c6 100644
--- a/src/domain/audit.ts
+++ b/src/domain/audit.ts
@@ -1,4 +1,4 @@
-import type { DatabaseSync } from "node:sqlite";
+import type { Database } from "../ports/database.js";
 
 export interface AuditLogEntry {
   id: number;
@@ -36,11 +36,11 @@ function auditEntryFromRow(row: Record<string, unknown>): AuditLogEntry {
 }
 
 export class AuditService {
-  constructor(private db: DatabaseSync) {}
+  constructor(private db: Database) {}
 
-  log(input: AuditLogInput): void {
+  async log(input: AuditLogInput): Promise<void> {
     try {
-      this.db
+      await this.db
         .prepare(
           `INSERT INTO audit_logs (admin_id, conversation_id, action, detail, created_at)
            VALUES (?, ?, ?, ?, ?)`,
@@ -57,7 +57,7 @@ export class AuditService {
     }
   }
 
-  list(opts: AuditListOptions): { items: AuditLogEntry[]; total: number } {
+  async list(opts: AuditListOptions): Promise<{ items: AuditLogEntry[]; total: number }> {
     const conditions: string[] = [];
     const params: Array<string | number> = [];
     if (opts.conversationId !== undefined) {
@@ -73,21 +73,21 @@ export class AuditService {
       params.push(opts.action);
     }
     const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
-    const rows = this.db
+    const rows = (await this.db
       .prepare(
         `SELECT id, admin_id, conversation_id, action, detail, created_at
          FROM audit_logs ${where}
          ORDER BY created_at DESC, id DESC
          LIMIT ? OFFSET ?`,
       )
-      .all(...params, opts.limit, opts.offset) as Array<Record<string, unknown>>;
-    const countRow = this.db
+      .all(...params, opts.limit, opts.offset)) as Array<Record<string, unknown>>;
+    const countRow = (await this.db
       .prepare(`SELECT COUNT(*) AS cnt FROM audit_logs ${where}`)
-      .get(...params) as { cnt: number };
+      .get(...params)) as { cnt: number };
     return { items: rows.map(auditEntryFromRow), total: countRow.cnt };
   }
 
-  listByConversation(conversationId: number, limit: number): AuditLogEntry[] {
-    return this.list({ conversationId, limit, offset: 0 }).items;
+  async listByConversation(conversationId: number, limit: number): Promise<AuditLogEntry[]> {
+    return (await this.list({ conversationId, limit, offset: 0 })).items;
   }
 }
diff --git a/src/domain/conversation-expiry.ts b/src/domain/conversation-expiry.ts
index 9efbad9..8bddc85 100644
--- a/src/domain/conversation-expiry.ts
+++ b/src/domain/conversation-expiry.ts
@@ -1,6 +1,6 @@
 import type { Api } from "grammy";
 import type { Logger } from "pino";
-import type { Database } from "../storage/client.js";
+import type { Database } from "../ports/database.js";
 import { ConversationService } from "./conversations.js";
 
 export async function sweepExpiredConversations(input: {
diff --git a/src/domain/conversations.ts b/src/domain/conversations.ts
index 24657b9..a1de191 100644
--- a/src/domain/conversations.ts
+++ b/src/domain/conversations.ts
@@ -1,4 +1,4 @@
-import type { Database } from "../storage/client.js";
+import type { Database } from "../ports/database.js";
 import type { Contact, Conversation, Message, Tag, TelegramTopic } from "../storage/schema.js";
 
 export interface ContactInput {
@@ -168,36 +168,36 @@ export class ConversationService {
 
   async getOrCreateConversation(input: ContactInput): Promise<ConversationBundle> {
     const timestamp = nowIso();
-    let contact = this.findContact(input.platform, input.externalUserId);
+    let contact = await this.findContact(input.platform, input.externalUserId);
 
     if (!contact) {
-      this.db
+      await this.db
         .prepare(
           `INSERT INTO contacts (platform, external_user_id, username, display_name, created_at, updated_at)
            VALUES (?, ?, ?, ?, ?, ?)`,
         )
         .run(input.platform, input.externalUserId, input.username ?? null, input.displayName ?? null, timestamp, timestamp);
-      contact = this.findContact(input.platform, input.externalUserId);
+      contact = await this.findContact(input.platform, input.externalUserId);
     } else {
-      this.db
+      await this.db
         .prepare("UPDATE contacts SET username = ?, display_name = ?, updated_at = ? WHERE id = ?")
         .run(input.username ?? contact.username, input.displayName ?? contact.displayName, timestamp, contact.id);
-      contact = this.getContactSync(contact.id);
+      contact = await this.getContactSync(contact.id);
     }
 
     if (!contact) throw new Error("Failed to create or load contact.");
 
-    let conversation = this.findLatestConversation(contact.id);
+    let conversation = await this.findLatestConversation(contact.id);
     if (!conversation) {
       const expiresAt = this.defaultConversationRetentionDays === null ? null : addDaysIso(this.defaultConversationRetentionDays);
-      this.db
+      await this.db
         .prepare(
           `INSERT INTO conversations (
             contact_id, retention_days, expires_at, created_at, updated_at, last_message_at
           ) VALUES (?, ?, ?, ?, ?, ?)`,
         )
         .run(contact.id, this.defaultConversationRetentionDays, expiresAt, timestamp, timestamp, timestamp);
-      conversation = this.findLatestConversation(contact.id);
+      conversation = await this.findLatestConversation(contact.id);
     }
 
     if (!conversation) throw new Error("Failed to create or load conversation.");
@@ -205,69 +205,69 @@ export class ConversationService {
   }
 
   async isBlocked(contactId: number): Promise<boolean> {
-    const row = this.db.prepare("SELECT id FROM blocks WHERE contact_id = ?").get(contactId);
+    const row = await this.db.prepare("SELECT id FROM blocks WHERE contact_id = ?").get(contactId);
     return Boolean(row);
   }
 
   async blockContact(contactId: number, createdBy: string, reason?: string): Promise<void> {
-    this.db
+    await this.db
       .prepare(
         `INSERT INTO blocks (contact_id, reason, created_by, created_at)
          VALUES (?, ?, ?, ?)
          ON CONFLICT(contact_id) DO UPDATE SET reason = excluded.reason, created_by = excluded.created_by, created_at = excluded.created_at`,
       )
       .run(contactId, reason ?? null, createdBy, nowIso());
-    this.db.prepare("UPDATE contacts SET status = 'blocked', updated_at = ? WHERE id = ?").run(nowIso(), contactId);
+    await this.db.prepare("UPDATE contacts SET status = 'blocked', updated_at = ? WHERE id = ?").run(nowIso(), contactId);
   }
 
   async unblockContact(contactId: number): Promise<void> {
-    this.db.prepare("DELETE FROM blocks WHERE contact_id = ?").run(contactId);
-    this.db.prepare("UPDATE contacts SET status = 'active', updated_at = ? WHERE id = ?").run(nowIso(), contactId);
+    await this.db.prepare("DELETE FROM blocks WHERE contact_id = ?").run(contactId);
+    await this.db.prepare("UPDATE contacts SET status = 'active', updated_at = ? WHERE id = ?").run(nowIso(), contactId);
   }
 
   async setConversationStatus(conversationId: number, status: "open" | "closed"): Promise<void> {
-    this.db.prepare("UPDATE conversations SET status = ?, updated_at = ? WHERE id = ?").run(status, nowIso(), conversationId);
+    await this.db.prepare("UPDATE conversations SET status = ?, updated_at = ? WHERE id = ?").run(status, nowIso(), conversationId);
   }
 
   async setPriority(conversationId: number, priority: "low" | "normal" | "high" | "urgent"): Promise<void> {
-    this.db.prepare("UPDATE conversations SET priority = ?, updated_at = ? WHERE id = ?").run(priority, nowIso(), conversationId);
+    await this.db.prepare("UPDATE conversations SET priority = ?, updated_at = ? WHERE id = ?").run(priority, nowIso(), conversationId);
   }
 
   async assign(conversationId: number, adminUserId: string): Promise<void> {
-    this.db
+    await this.db
       .prepare("UPDATE conversations SET assigned_admin_id = ?, updated_at = ? WHERE id = ?")
       .run(adminUserId, nowIso(), conversationId);
   }
 
   async mute(conversationId: number, mutedUntil: string): Promise<void> {
-    this.db
+    await this.db
       .prepare("UPDATE conversations SET muted_until = ?, updated_at = ? WHERE id = ?")
       .run(mutedUntil, nowIso(), conversationId);
   }
 
   async setConversationRetention(conversationId: number, days: number | null): Promise<Conversation | undefined> {
     const expiresAt = days === null ? null : addDaysIso(days);
-    this.db
+    await this.db
       .prepare("UPDATE conversations SET retention_days = ?, expires_at = ?, updated_at = ? WHERE id = ?")
       .run(days, expiresAt, nowIso(), conversationId);
     return this.getConversation(conversationId);
   }
 
   async setAiEnabled(conversationId: number, enabled: boolean): Promise<void> {
-    this.db
+    await this.db
       .prepare("UPDATE conversations SET ai_enabled = ?, updated_at = ? WHERE id = ?")
       .run(enabled ? 1 : 0, nowIso(), conversationId);
   }
 
   async getAiEnabled(conversationId: number): Promise<boolean> {
-    const row = this.db
+    const row = (await this.db
       .prepare("SELECT ai_enabled FROM conversations WHERE id = ?")
-      .get(conversationId) as { ai_enabled?: number } | undefined;
+      .get(conversationId)) as { ai_enabled?: number } | undefined;
     return row?.ai_enabled === undefined ? true : Boolean(row.ai_enabled);
   }
 
   async addNote(conversationId: number, adminUserId: string, note: string): Promise<void> {
-    this.db
+    await this.db
       .prepare("INSERT INTO admin_notes (conversation_id, admin_user_id, note, created_at) VALUES (?, ?, ?, ?)")
       .run(conversationId, adminUserId, note, nowIso());
   }
@@ -275,12 +275,12 @@ export class ConversationService {
   async addTag(conversationId: number, name: string): Promise<void> {
     const cleanName = name.trim().toLowerCase();
     if (!cleanName) return;
-    this.db
+    await this.db
       .prepare("INSERT INTO tags (name, created_at) VALUES (?, ?) ON CONFLICT(name) DO NOTHING")
       .run(cleanName, nowIso());
-    const tag = this.findTag(cleanName);
+    const tag = await this.findTag(cleanName);
     if (!tag) return;
-    this.db
+    await this.db
       .prepare(
         `INSERT INTO conversation_tags (conversation_id, tag_id, created_at)
          VALUES (?, ?, ?)
@@ -290,13 +290,13 @@ export class ConversationService {
   }
 
   async removeTag(conversationId: number, name: string): Promise<void> {
-    const tag = this.findTag(name.trim().toLowerCase());
+    const tag = await this.findTag(name.trim().toLowerCase());
     if (!tag) return;
-    this.db.prepare("DELETE FROM conversation_tags WHERE conversation_id = ? AND tag_id = ?").run(conversationId, tag.id);
+    await this.db.prepare("DELETE FROM conversation_tags WHERE conversation_id = ? AND tag_id = ?").run(conversationId, tag.id);
   }
 
   async listTags(conversationId: number): Promise<Tag[]> {
-    const rows = this.db
+    const rows = (await this.db
       .prepare(
         `SELECT tags.*
          FROM tags
@@ -304,61 +304,61 @@ export class ConversationService {
          WHERE conversation_tags.conversation_id = ?
          ORDER BY tags.name ASC`,
       )
-      .all(conversationId) as Array<Record<string, unknown>>;
+      .all(conversationId)) as Array<Record<string, unknown>>;
     return rows.map(tagFromRow);
   }
 
   async recentNotes(conversationId: number, limit: number): Promise<AdminNote[]> {
-    const rows = this.db
+    const rows = (await this.db
       .prepare("SELECT * FROM admin_notes WHERE conversation_id = ? ORDER BY created_at DESC LIMIT ?")
-      .all(conversationId, limit) as Array<Record<string, unknown>>;
+      .all(conversationId, limit)) as Array<Record<string, unknown>>;
     return rows.map(noteFromRow);
   }
 
   async deleteConversationData(conversationId: number): Promise<void> {
-    this.db.exec("BEGIN");
+    await this.db.exec("BEGIN");
     try {
-      this.db
+      await this.db
         .prepare(
           `DELETE FROM deliveries
            WHERE source_message_id IN (SELECT id FROM messages WHERE conversation_id = ?)`,
         )
         .run(conversationId);
-      this.db.prepare("DELETE FROM ai_drafts WHERE conversation_id = ?").run(conversationId);
-      this.db.prepare("DELETE FROM conversation_tags WHERE conversation_id = ?").run(conversationId);
-      this.db.prepare("DELETE FROM admin_notes WHERE conversation_id = ?").run(conversationId);
-      this.db.prepare("DELETE FROM telegram_topics WHERE conversation_id = ?").run(conversationId);
-      this.db.prepare("DELETE FROM messages WHERE conversation_id = ?").run(conversationId);
-      this.db.prepare("DELETE FROM conversations WHERE id = ?").run(conversationId);
-      this.db.exec("COMMIT");
+      await this.db.prepare("DELETE FROM ai_drafts WHERE conversation_id = ?").run(conversationId);
+      await this.db.prepare("DELETE FROM conversation_tags WHERE conversation_id = ?").run(conversationId);
+      await this.db.prepare("DELETE FROM admin_notes WHERE conversation_id = ?").run(conversationId);
+      await this.db.prepare("DELETE FROM telegram_topics WHERE conversation_id = ?").run(conversationId);
+      await this.db.prepare("DELETE FROM messages WHERE conversation_id = ?").run(conversationId);
+      await this.db.prepare("DELETE FROM conversations WHERE id = ?").run(conversationId);
+      await this.db.exec("COMMIT");
     } catch (error) {
-      this.db.exec("ROLLBACK");
+      await this.db.exec("ROLLBACK");
       throw error;
     }
   }
 
   async resetConversation(conversationId: number): Promise<void> {
-    this.db.exec("BEGIN");
+    await this.db.exec("BEGIN");
     try {
-      this.db
+      await this.db
         .prepare(
           `DELETE FROM deliveries
            WHERE source_message_id IN (SELECT id FROM messages WHERE conversation_id = ?)`,
         )
         .run(conversationId);
-      this.db.prepare("DELETE FROM ai_drafts WHERE conversation_id = ?").run(conversationId);
-      this.db.prepare("DELETE FROM conversation_tags WHERE conversation_id = ?").run(conversationId);
-      this.db.prepare("DELETE FROM admin_notes WHERE conversation_id = ?").run(conversationId);
-      this.db.prepare("DELETE FROM messages WHERE conversation_id = ?").run(conversationId);
-      this.db.exec("COMMIT");
+      await this.db.prepare("DELETE FROM ai_drafts WHERE conversation_id = ?").run(conversationId);
+      await this.db.prepare("DELETE FROM conversation_tags WHERE conversation_id = ?").run(conversationId);
+      await this.db.prepare("DELETE FROM admin_notes WHERE conversation_id = ?").run(conversationId);
+      await this.db.prepare("DELETE FROM messages WHERE conversation_id = ?").run(conversationId);
+      await this.db.exec("COMMIT");
     } catch (error) {
-      this.db.exec("ROLLBACK");
+      await this.db.exec("ROLLBACK");
       throw error;
     }
   }
 
   async expiredConversations(now = nowIso()): Promise<Array<{ conversation: Conversation; topic: TelegramTopic }>> {
-    const rows = this.db
+    const rows = (await this.db
       .prepare(
         `SELECT
            conversations.id AS c_id,
@@ -384,7 +384,7 @@ export class ConversationService {
          WHERE conversations.expires_at IS NOT NULL AND conversations.expires_at <= ?
          ORDER BY conversations.expires_at ASC`,
       )
-      .all(now) as Array<Record<string, unknown>>;
+      .all(now)) as Array<Record<string, unknown>>;
 
     return rows.map((row) => ({
       conversation: conversationFromRow({
@@ -424,7 +424,7 @@ export class ConversationService {
   }): Promise<Message> {
     const timestamp = nowIso();
     const expiresAt = input.direction === "internal" ? null : addDaysIso(this.retentionDays);
-    this.db
+    await this.db
       .prepare(
         `INSERT INTO messages (
           conversation_id, contact_id, direction, platform, message_type, text, raw_payload,
@@ -443,24 +443,24 @@ export class ConversationService {
         timestamp,
         expiresAt,
       );
-    this.db
+    await this.db
       .prepare("UPDATE conversations SET last_message_at = ?, updated_at = ? WHERE id = ?")
       .run(timestamp, timestamp, input.conversationId);
-    const row = this.db.prepare("SELECT * FROM messages WHERE id = last_insert_rowid()").get() as Record<string, unknown>;
+    const row = (await this.db.prepare("SELECT * FROM messages WHERE id = last_insert_rowid()").get()) as Record<string, unknown>;
     return messageFromRow(row);
   }
 
   async getTopicByThread(managementChatId: string, messageThreadId: number): Promise<TelegramTopic | undefined> {
-    const row = this.db
+    const row = (await this.db
       .prepare("SELECT * FROM telegram_topics WHERE management_chat_id = ? AND message_thread_id = ?")
-      .get(managementChatId, messageThreadId) as Record<string, unknown> | undefined;
+      .get(managementChatId, messageThreadId)) as Record<string, unknown> | undefined;
     return row ? topicFromRow(row) : undefined;
   }
 
   async getTopicByConversation(conversationId: number): Promise<TelegramTopic | undefined> {
-    const row = this.db
+    const row = (await this.db
       .prepare("SELECT * FROM telegram_topics WHERE conversation_id = ?")
-      .get(conversationId) as Record<string, unknown> | undefined;
+      .get(conversationId)) as Record<string, unknown> | undefined;
     return row ? topicFromRow(row) : undefined;
   }
 
@@ -471,7 +471,7 @@ export class ConversationService {
     topicName: string;
   }): Promise<TelegramTopic> {
     const timestamp = nowIso();
-    this.db
+    await this.db
       .prepare(
         `INSERT INTO telegram_topics (conversation_id, management_chat_id, message_thread_id, topic_name, created_at, updated_at)
          VALUES (?, ?, ?, ?, ?, ?)
@@ -496,54 +496,54 @@ export class ConversationService {
   }
 
   async recentMessages(conversationId: number, limit: number): Promise<Message[]> {
-    const rows = this.db
+    const rows = (await this.db
       .prepare("SELECT * FROM messages WHERE conversation_id = ? ORDER BY created_at DESC LIMIT ?")
-      .all(conversationId, limit) as Array<Record<string, unknown>>;
+      .all(conversationId, limit)) as Array<Record<string, unknown>>;
     return rows.map(messageFromRow);
   }
 
   async getMessage(messageId: number): Promise<Message | undefined> {
-    const row = this.db
+    const row = (await this.db
       .prepare("SELECT * FROM messages WHERE id = ?")
-      .get(messageId) as Record<string, unknown> | undefined;
+      .get(messageId)) as Record<string, unknown> | undefined;
     return row ? messageFromRow(row) : undefined;
   }
 
-  private findContact(platform: string, externalUserId: string): Contact | undefined {
-    const row = this.db
+  private async findContact(platform: string, externalUserId: string): Promise<Contact | undefined> {
+    const row = (await this.db
       .prepare("SELECT * FROM contacts WHERE platform = ? AND external_user_id = ?")
-      .get(platform, externalUserId) as Record<string, unknown> | undefined;
+      .get(platform, externalUserId)) as Record<string, unknown> | undefined;
     return row ? contactFromRow(row) : undefined;
   }
 
-  private getContactSync(contactId: number): Contact | undefined {
-    const row = this.db.prepare("SELECT * FROM contacts WHERE id = ?").get(contactId) as Record<string, unknown> | undefined;
+  private async getContactSync(contactId: number): Promise<Contact | undefined> {
+    const row = (await this.db.prepare("SELECT * FROM contacts WHERE id = ?").get(contactId)) as Record<string, unknown> | undefined;
     return row ? contactFromRow(row) : undefined;
   }
 
-  private findLatestConversation(contactId: number): Conversation | undefined {
-    const row = this.db
+  private async findLatestConversation(contactId: number): Promise<Conversation | undefined> {
+    const row = (await this.db
       .prepare("SELECT * FROM conversations WHERE contact_id = ? ORDER BY created_at DESC LIMIT 1")
-      .get(contactId) as Record<string, unknown> | undefined;
+      .get(contactId)) as Record<string, unknown> | undefined;
     return row ? conversationFromRow(row) : undefined;
   }
 
-  private getConversationSync(conversationId: number): Conversation | undefined {
-    const row = this.db
+  private async getConversationSync(conversationId: number): Promise<Conversation | undefined> {
+    const row = (await this.db
       .prepare("SELECT * FROM conversations WHERE id = ?")
-      .get(conversationId) as Record<string, unknown> | undefined;
+      .get(conversationId)) as Record<string, unknown> | undefined;
     return row ? conversationFromRow(row) : undefined;
   }
 
-  private findTag(name: string): Tag | undefined {
-    const row = this.db.prepare("SELECT * FROM tags WHERE name = ?").get(name) as Record<string, unknown> | undefined;
+  private async findTag(name: string): Promise<Tag | undefined> {
+    const row = (await this.db.prepare("SELECT * FROM tags WHERE name = ?").get(name)) as Record<string, unknown> | undefined;
     return row ? tagFromRow(row) : undefined;
   }
 
-  conversationStats(): { open: number; closed: number } {
-    const rows = this.db
+  async conversationStats(): Promise<{ open: number; closed: number }> {
+    const rows = (await this.db
       .prepare("SELECT status, COUNT(*) AS cnt FROM conversations GROUP BY status")
-      .all() as Array<{ status: string; cnt: number }>;
+      .all()) as Array<{ status: string; cnt: number }>;
     const result = { open: 0, closed: 0 };
     for (const row of rows) {
       if (row.status === "open") result.open = row.cnt;
@@ -552,10 +552,10 @@ export class ConversationService {
     return result;
   }
 
-  messageStats(): { inbound: number; outbound: number; internal: number } {
-    const rows = this.db
+  async messageStats(): Promise<{ inbound: number; outbound: number; internal: number }> {
+    const rows = (await this.db
       .prepare("SELECT direction, COUNT(*) AS cnt FROM messages GROUP BY direction")
-      .all() as Array<{ direction: string; cnt: number }>;
+      .all()) as Array<{ direction: string; cnt: number }>;
     const result = { inbound: 0, outbound: 0, internal: 0 };
     for (const row of rows) {
       if (row.direction === "inbound") result.inbound = row.cnt;
@@ -565,12 +565,12 @@ export class ConversationService {
     return result;
   }
 
-  listConversations(opts: {
+  async listConversations(opts: {
     status?: "open" | "closed";
     assignedTo?: string;
     limit: number;
     offset: number;
-  }): { items: ConversationListItem[]; total: number } {
+  }): Promise<{ items: ConversationListItem[]; total: number }> {
     const conditions: string[] = [];
     const params: Array<string | number> = [];
     if (opts.status) {
@@ -582,7 +582,7 @@ export class ConversationService {
       params.push(opts.assignedTo);
     }
     const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
-    const rows = this.db
+    const rows = (await this.db
       .prepare(
         `SELECT c.id, c.status, c.priority, c.assigned_admin_id, c.created_at, c.last_message_at,
                 ct.display_name, ct.username, t.topic_name, t.message_thread_id
@@ -593,36 +593,36 @@ export class ConversationService {
          ORDER BY c.last_message_at DESC NULLS LAST
          LIMIT ? OFFSET ?`,
       )
-      .all(...params, opts.limit, opts.offset) as Array<Record<string, unknown>>;
-    const countRow = this.db
+      .all(...params, opts.limit, opts.offset)) as Array<Record<string, unknown>>;
+    const countRow = (await this.db
       .prepare(`SELECT COUNT(*) AS cnt FROM conversations c ${where}`)
-      .get(...params) as { cnt: number };
+      .get(...params)) as { cnt: number };
     return { items: rows.map(conversationListItemFromRow), total: countRow.cnt };
   }
 
-  listByAssignee(adminId: string, limit: number): ConversationListItem[] {
-    return this.listConversations({ assignedTo: adminId, limit, offset: 0 }).items;
+  async listByAssignee(adminId: string, limit: number): Promise<ConversationListItem[]> {
+    return (await this.listConversations({ assignedTo: adminId, limit, offset: 0 })).items;
   }
 
-  searchMessagesInConversation(conversationId: number, query: string, limit: number): Message[] {
+  async searchMessagesInConversation(conversationId: number, query: string, limit: number): Promise<Message[]> {
     const pattern = `%${query.replace(/[%_]/g, (m) => "\\" + m)}%`;
-    const rows = this.db
+    const rows = (await this.db
       .prepare(
         `SELECT * FROM messages
          WHERE conversation_id = ? AND text LIKE ? ESCAPE '\\'
          ORDER BY created_at DESC
          LIMIT ?`,
       )
-      .all(conversationId, pattern, limit) as Array<Record<string, unknown>>;
+      .all(conversationId, pattern, limit)) as Array<Record<string, unknown>>;
     return rows.map(messageFromRow);
   }
 
-  searchMessages(opts: {
+  async searchMessages(opts: {
     query: string;
     conversationId?: number;
     limit: number;
     offset: number;
-  }): { items: MessageSearchResult[]; total: number } {
+  }): Promise<{ items: MessageSearchResult[]; total: number }> {
     const pattern = `%${opts.query.replace(/[%_]/g, (m) => "\\" + m)}%`;
     const conditions = ["m.text LIKE ? ESCAPE '\\'"];
     const params: Array<string | number> = [pattern];
@@ -631,7 +631,7 @@ export class ConversationService {
       params.push(opts.conversationId);
     }
     const where = `WHERE ${conditions.join(" AND ")}`;
-    const rows = this.db
+    const rows = (await this.db
       .prepare(
         `SELECT m.id, m.conversation_id, m.direction, m.message_type, m.text, m.created_at,
                 ct.display_name, t.topic_name
@@ -643,10 +643,10 @@ export class ConversationService {
          ORDER BY m.created_at DESC
          LIMIT ? OFFSET ?`,
       )
-      .all(...params, opts.limit, opts.offset) as Array<Record<string, unknown>>;
-    const countRow = this.db
+      .all(...params, opts.limit, opts.offset)) as Array<Record<string, unknown>>;
+    const countRow = (await this.db
       .prepare(`SELECT COUNT(*) AS cnt FROM messages m ${where}`)
-      .get(...params) as { cnt: number };
+      .get(...params)) as { cnt: number };
     return { items: rows.map(messageSearchResultFromRow), total: countRow.cnt };
   }
 }
diff --git a/src/domain/deliveries.ts b/src/domain/deliveries.ts
index 348bd9b..4f0ee81 100644
--- a/src/domain/deliveries.ts
+++ b/src/domain/deliveries.ts
@@ -1,4 +1,4 @@
-import type { Database } from "../storage/client.js";
+import type { Database } from "../ports/database.js";
 import type { Delivery } from "../storage/schema.js";
 import { nowIso } from "./conversations.js";
 
@@ -23,25 +23,25 @@ export class DeliveryService {
 
   async createPending(sourceMessageId: number | undefined, target: string): Promise<number> {
     const timestamp = nowIso();
-    this.db
+    await this.db
       .prepare(
         `INSERT INTO deliveries (source_message_id, target, status, created_at, updated_at)
          VALUES (?, ?, 'pending', ?, ?)`,
       )
       .run(sourceMessageId ?? null, target, timestamp, timestamp);
-    const row = this.db.prepare("SELECT last_insert_rowid() AS id").get() as { id: number };
+    const row = (await this.db.prepare("SELECT last_insert_rowid() AS id").get()) as { id: number };
     return Number(row.id);
   }
 
   async markSent(deliveryId: number): Promise<void> {
-    this.db
+    await this.db
       .prepare("UPDATE deliveries SET status = 'sent', last_error = NULL, updated_at = ? WHERE id = ?")
       .run(nowIso(), deliveryId);
   }
 
   async markFailed(deliveryId: number, error: string, attemptCount: number): Promise<void> {
     const retryAt = new Date(Date.now() + Math.min(60_000, 2 ** attemptCount * 1000)).toISOString();
-    this.db
+    await this.db
       .prepare(
         `UPDATE deliveries
          SET status = 'failed', attempt_count = ?, last_error = ?, next_retry_at = ?, updated_at = ?
@@ -51,14 +51,14 @@ export class DeliveryService {
   }
 
   async dueFailed(now = nowIso()): Promise<Delivery[]> {
-    const rows = this.db
+    const rows = (await this.db
       .prepare("SELECT * FROM deliveries WHERE status = 'failed' AND next_retry_at <= ?")
-      .all(now) as Array<Record<string, unknown>>;
+      .all(now)) as Array<Record<string, unknown>>;
     return rows.map(deliveryFromRow);
   }
 
   async markPermanentFailure(deliveryId: number, error: string): Promise<void> {
-    this.db
+    await this.db
       .prepare(
         `UPDATE deliveries
          SET status = 'permanent_failure', last_error = ?, next_retry_at = NULL, updated_at = ?
@@ -67,15 +67,15 @@ export class DeliveryService {
       .run(error, nowIso(), deliveryId);
   }
 
-  stats(): {
+  async stats(): Promise<{
     pending: number;
     sent: number;
     failed: number;
     permanentFailure: number;
-  } {
-    const rows = this.db
+  }> {
+    const rows = (await this.db
       .prepare("SELECT status, COUNT(*) AS cnt FROM deliveries GROUP BY status")
-      .all() as Array<{ status: string; cnt: number }>;
+      .all()) as Array<{ status: string; cnt: number }>;
     const result = { pending: 0, sent: 0, failed: 0, permanentFailure: 0 };
     for (const row of rows) {
       if (row.status === "pending") result.pending = row.cnt;
@@ -86,26 +86,26 @@ export class DeliveryService {
     return result;
   }
 
-  listFailedDeliveries(opts: {
+  async listFailedDeliveries(opts: {
     limit: number;
     offset: number;
-  }): { items: Delivery[]; total: number } {
-    const rows = this.db
+  }): Promise<{ items: Delivery[]; total: number }> {
+    const rows = (await this.db
       .prepare(
         `SELECT * FROM deliveries
          WHERE status IN ('failed', 'permanent_failure')
          ORDER BY created_at ASC
          LIMIT ? OFFSET ?`,
       )
-      .all(opts.limit, opts.offset) as Array<Record<string, unknown>>;
-    const countRow = this.db
+      .all(opts.limit, opts.offset)) as Array<Record<string, unknown>>;
+    const countRow = (await this.db
       .prepare(`SELECT COUNT(*) AS cnt FROM deliveries WHERE status IN ('failed', 'permanent_failure')`)
-      .get() as { cnt: number };
+      .get()) as { cnt: number };
     return { items: rows.map(deliveryFromRow), total: countRow.cnt };
   }
 
-  scheduleRetry(deliveryId: number): void {
-    this.db
+  async scheduleRetry(deliveryId: number): Promise<void> {
+    await this.db
       .prepare(
         `UPDATE deliveries
          SET next_retry_at = ?, updated_at = ?
diff --git a/src/domain/retention.ts b/src/domain/retention.ts
index 9640f0e..4a298a0 100644
--- a/src/domain/retention.ts
+++ b/src/domain/retention.ts
@@ -1,4 +1,4 @@
-import type { Database } from "../storage/client.js";
+import type { Database } from "../ports/database.js";
 import { nowIso } from "./conversations.js";
 import type { Logger } from "pino";
 
@@ -15,7 +15,7 @@ export class RetentionService {
     let cleaned = 0;
 
     const staleCutoff = new Date(Date.now() - STALE_PENDING_THRESHOLD_MS).toISOString();
-    const staleResult = this.db
+    const staleResult = await this.db
       .prepare(
         `UPDATE ai_drafts
          SET status = 'failed', error = 'Draft generation timed out (process may have restarted)', updated_at = ?
@@ -30,7 +30,7 @@ export class RetentionService {
     if (this.retentionDays > 0) {
       const retentionCutoff = new Date(Date.now() - this.retentionDays * 86400 * 1000).toISOString();
 
-      const deleted = this.db
+      const deleted = await this.db
         .prepare(
           `DELETE FROM ai_drafts
            WHERE status IN ('sent', 'discarded', 'failed') AND created_at < ?`,
@@ -38,7 +38,7 @@ export class RetentionService {
         .run(retentionCutoff);
       cleaned += Number(deleted.changes);
 
-      const softCleaned = this.db
+      const softCleaned = await this.db
         .prepare(
           `UPDATE ai_drafts
            SET draft_text = NULL, error = NULL, updated_at = ?
@@ -48,7 +48,7 @@ export class RetentionService {
       cleaned += Number(softCleaned.changes);
     }
 
-    const result = this.db
+    const result = await this.db
       .prepare(
         `UPDATE messages
          SET text = NULL, raw_payload = NULL
diff --git a/src/ports/database.ts b/src/ports/database.ts
new file mode 100644
index 0000000..75a48b2
--- /dev/null
+++ b/src/ports/database.ts
@@ -0,0 +1,21 @@
+export type SqlValue = string | number | bigint | null | Uint8Array;
+
+export interface StatementResult {
+  changes: number | bigint;
+  lastInsertRowid?: number | bigint;
+}
+
+export interface PreparedStatement {
+  run(...params: SqlValue[]): Promise<StatementResult>;
+  get(...params: SqlValue[]): Promise<unknown>;
+  all(...params: SqlValue[]): Promise<unknown[]>;
+}
+
+export interface Database {
+  prepare(sql: string): PreparedStatement;
+  exec(sql: string): Promise<void>;
+}
+
+export interface ClosableDatabase extends Database {
+  close(): void;
+}
diff --git a/src/runtime/config.ts b/src/runtime/config.ts
index 0b1d606..97d0dbe 100644
--- a/src/runtime/config.ts
+++ b/src/runtime/config.ts
@@ -2,6 +2,8 @@ import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { z } from "zod";
 
+export type ConfigMap = Record<string, string | undefined>;
+
 const booleanFromString = z
   .string()
   .optional()
@@ -83,7 +85,7 @@ const databaseEnvSchema = z.object({
 export type AppConfig = z.infer<typeof envSchema>;
 export type DatabaseConfig = z.infer<typeof databaseEnvSchema>;
 
-export function loadConfig(env: NodeJS.ProcessEnv = loadEnv()): AppConfig {
+export function loadConfig(env: ConfigMap = loadEnv()): AppConfig {
   const parsed = envSchema.parse(env);
   if (parsed.TELEGRAM_UPDATE_MODE === "webhook" && !parsed.TELEGRAM_WEBHOOK_URL) {
     throw new Error("TELEGRAM_WEBHOOK_URL is required when TELEGRAM_UPDATE_MODE=webhook");
@@ -94,11 +96,11 @@ export function loadConfig(env: NodeJS.ProcessEnv = loadEnv()): AppConfig {
   return parsed;
 }
 
-export function loadConfigFromSources(storedEnv: NodeJS.ProcessEnv, env: NodeJS.ProcessEnv = process.env): AppConfig {
+export function loadConfigFromSources(storedEnv: ConfigMap, env: ConfigMap = process.env): AppConfig {
   return loadConfig({ ...storedEnv, ...env });
 }
 
-export function configIssues(storedEnv: NodeJS.ProcessEnv, env: NodeJS.ProcessEnv = process.env): string[] {
+export function configIssues(storedEnv: ConfigMap, env: ConfigMap = process.env): string[] {
   try {
     loadConfigFromSources(storedEnv, env);
     return [];
@@ -108,12 +110,12 @@ export function configIssues(storedEnv: NodeJS.ProcessEnv, env: NodeJS.ProcessEn
   }
 }
 
-export function loadDatabaseConfig(env: NodeJS.ProcessEnv = loadEnv()): DatabaseConfig {
+export function loadDatabaseConfig(env: ConfigMap = loadEnv()): DatabaseConfig {
   return databaseEnvSchema.parse(env);
 }
 
-export function loadEnv(env: NodeJS.ProcessEnv = process.env, envPath = ".env"): NodeJS.ProcessEnv {
-  const merged: NodeJS.ProcessEnv = { ...env };
+export function loadEnv(env: ConfigMap = process.env, envPath = ".env"): ConfigMap {
+  const merged: ConfigMap = { ...env };
   const fullPath = resolve(process.cwd(), envPath);
   if (!existsSync(fullPath)) return merged;
 
diff --git a/src/runtime/main.ts b/src/runtime/main.ts
index 3710f35..165bfcc 100644
--- a/src/runtime/main.ts
+++ b/src/runtime/main.ts
@@ -9,14 +9,13 @@ import {
   startTelegramBot,
   startTelegramPolling,
 } from "../channels/telegram/bot.js";
-import { sweepExpiredConversations } from "../domain/conversation-expiry.js";
-import { RetentionService } from "../domain/retention.js";
 import { startDeliveryRetryWorker } from "../domain/delivery-retry.js";
 import { DeliveryService } from "../domain/deliveries.js";
 import { ConversationService } from "../domain/conversations.js";
 import { AiDraftService } from "../domain/ai-drafts.js";
 import { AuditService } from "../domain/audit.js";
 import { AppSettingsService } from "../domain/app-settings.js";
+import { runConversationExpiryJob, runMessageRetentionJob } from "./maintenance.js";
 import { ensureSetupToken, startWebConsole } from "./web-console.js";
 import type { IncomingMessage, ServerResponse } from "node:http";
 
@@ -26,7 +25,7 @@ const databaseConfig = loadDatabaseConfig();
 const handle = createDb(databaseConfig.DATABASE_URL);
 await migrate(handle.client);
 const settings = new AppSettingsService(handle.db);
-const setupToken = ensureSetupToken(settings);
+const setupToken = await ensureSetupToken(settings);
 if (setupToken) {
   logger.info({ setupToken }, "Open the web console and use this setup token to finish InboxBridge configuration.");
 }
@@ -42,13 +41,12 @@ let restartQueue = Promise.resolve();
 
 async function runExpirySweep(): Promise<void> {
   if (!activeBot) return;
-  const config = loadConfigFromSources(settings.all());
-  const cleaned = await sweepExpiredConversations({
+  const config = loadConfigFromSources(await settings.all());
+  const cleaned = await runConversationExpiryJob({
     api: activeBot.api,
     db: handle.db,
-    messageRetentionDays: config.MESSAGE_RETENTION_DAYS,
-    defaultConversationRetentionDays: config.DEFAULT_CONVERSATION_RETENTION_DAYS,
-    logger: logger.child({ module: "conversation-expiry" }),
+    config,
+    logger,
   });
   if (cleaned > 0) {
     logger.info({ cleaned }, "Expired conversations cleaned.");
@@ -56,9 +54,13 @@ async function runExpirySweep(): Promise<void> {
 }
 
 async function runMessageRetentionSweep(): Promise<void> {
-  const config = loadConfigFromSources(settings.all());
-  const retention = new RetentionService(handle.db, config.MESSAGE_RETENTION_DAYS, logger.child({ module: "retention" }));
-  const cleaned = await retention.cleanupExpired();
+  const config = loadConfigFromSources(await settings.all());
+  const cleaned = await runMessageRetentionJob({
+    api: activeBot?.api ?? ({} as never),
+    db: handle.db,
+    config,
+    logger,
+  });
   if (cleaned > 0) {
     logger.info({ cleaned }, "Message retention sweep cleaned expired message content.");
   } else {
@@ -74,14 +76,14 @@ async function restartRuntime(): Promise<void> {
 
 async function restartRuntimeUnlocked(): Promise<void> {
   await stopRuntime();
-  const issues = configIssues(settings.all());
+  const issues = configIssues(await settings.all());
   if (issues.length > 0) {
     lastRuntimeError = issues.join("; ");
     logger.warn({ issues }, "InboxBridge bot is waiting for complete configuration.");
     return;
   }
 
-  const config = loadConfigFromSources(settings.all());
+  const config = loadConfigFromSources(await settings.all());
   const bot = createTelegramBot(config, handle.db, logger);
   activeBot = bot;
   pollingBot = config.TELEGRAM_UPDATE_MODE === "polling";
@@ -250,9 +252,9 @@ process.once("SIGTERM", () => gracefulShutdown("SIGTERM"));
 await startWebConsole({
   settings,
   port: databaseConfig.WEB_CONSOLE_PORT,
-  getStatus: () => ({
+  getStatus: async () => ({
     bot: activeBot ? "running" : "stopped",
-    issues: lastRuntimeError ? [lastRuntimeError] : configIssues(settings.all()),
+    issues: lastRuntimeError ? [lastRuntimeError] : configIssues(await settings.all()),
   }),
   onConfigSaved: restartRuntime,
   telegramWebhook: (req, res) => {
@@ -263,22 +265,23 @@ await startWebConsole({
     res.end("Telegram webhook is not configured.");
     return Promise.resolve();
   },
-  dbHealthCheck: () => {
-    handle.db.prepare("SELECT 1").get();
+  dbHealthCheck: async () => {
+    await handle.db.prepare("SELECT 1").get();
     return true;
   },
-  collectMetrics: () => {
+  collectMetrics: async () => {
+    const config = loadConfigFromSources(await settings.all());
     const conversations = new ConversationService(
       handle.db,
-      Number(loadConfigFromSources(settings.all()).MESSAGE_RETENTION_DAYS) || 30,
-      loadConfigFromSources(settings.all()).DEFAULT_CONVERSATION_RETENTION_DAYS ?? 30,
+      Number(config.MESSAGE_RETENTION_DAYS) || 30,
+      config.DEFAULT_CONVERSATION_RETENTION_DAYS ?? 30,
     );
     const deliveries = new DeliveryService(handle.db);
-    const aiDrafts = new AiDraftService(handle.db, conversations, loadConfigFromSources(settings.all()));
-    const msgStats = conversations.messageStats();
-    const convStats = conversations.conversationStats();
-    const delStats = deliveries.stats();
-    const draftStats = aiDrafts.stats();
+    const aiDrafts = new AiDraftService(handle.db, conversations, config);
+    const msgStats = await conversations.messageStats();
+    const convStats = await conversations.conversationStats();
+    const delStats = await deliveries.stats();
+    const draftStats = await aiDrafts.stats();
     return {
       messages: {
         inbound_total: msgStats.inbound,
@@ -304,8 +307,8 @@ await startWebConsole({
       timestamp: new Date().toISOString(),
     };
   },
-  collectOperationsOverview: () => {
-    const config = loadConfigFromSources(settings.all());
+  collectOperationsOverview: async () => {
+    const config = loadConfigFromSources(await settings.all());
     const conversations = new ConversationService(
       handle.db,
       config.MESSAGE_RETENTION_DAYS,
@@ -313,10 +316,10 @@ await startWebConsole({
     );
     const deliveries = new DeliveryService(handle.db);
     const aiDrafts = new AiDraftService(handle.db, conversations, config);
-    const msgStats = conversations.messageStats();
-    const convStats = conversations.conversationStats();
-    const delStats = deliveries.stats();
-    const draftStats = aiDrafts.stats();
+    const msgStats = await conversations.messageStats();
+    const convStats = await conversations.conversationStats();
+    const delStats = await deliveries.stats();
+    const draftStats = await aiDrafts.stats();
     return {
       messages: { inboundTotal: msgStats.inbound, outboundTotal: msgStats.outbound, internalTotal: msgStats.internal },
       deliveries: { pending: delStats.pending, sent: delStats.sent, failed: delStats.failed, permanentFailure: delStats.permanentFailure },
@@ -325,13 +328,14 @@ await startWebConsole({
       uptimeSeconds: Math.round(process.uptime()),
     };
   },
-  listConversations: (opts) => {
+  listConversations: async (opts) => {
+    const config = loadConfigFromSources(await settings.all());
     const conversations = new ConversationService(
       handle.db,
-      loadConfigFromSources(settings.all()).MESSAGE_RETENTION_DAYS,
-      loadConfigFromSources(settings.all()).DEFAULT_CONVERSATION_RETENTION_DAYS,
+      config.MESSAGE_RETENTION_DAYS,
+      config.DEFAULT_CONVERSATION_RETENTION_DAYS,
     );
-    const result = conversations.listConversations({
+    const result = await conversations.listConversations({
       status: opts.status === "open" || opts.status === "closed" ? opts.status : undefined,
       assignedTo: opts.assignedTo || undefined,
       limit: opts.pageSize,
@@ -353,9 +357,9 @@ await startWebConsole({
       total: result.total,
     };
   },
-  listFailedDeliveries: (opts) => {
+  listFailedDeliveries: async (opts) => {
     const deliveries = new DeliveryService(handle.db);
-    const result = deliveries.listFailedDeliveries({
+    const result = await deliveries.listFailedDeliveries({
       limit: opts.pageSize,
       offset: (opts.page - 1) * opts.pageSize,
     });
@@ -376,11 +380,11 @@ await startWebConsole({
   },
   scheduleRetry: async (deliveryId: number) => {
     const deliveries = new DeliveryService(handle.db);
-    deliveries.scheduleRetry(deliveryId);
+    await deliveries.scheduleRetry(deliveryId);
   },
-  listAuditLogs: (opts) => {
+  listAuditLogs: async (opts) => {
     const audit = new AuditService(handle.db);
-    const result = audit.list({
+    const result = await audit.list({
       adminId: opts.adminId || undefined,
       action: opts.action || undefined,
       limit: opts.pageSize,
@@ -398,13 +402,14 @@ await startWebConsole({
       total: result.total,
     };
   },
-  searchMessages: (opts) => {
+  searchMessages: async (opts) => {
+    const config = loadConfigFromSources(await settings.all());
     const conversations = new ConversationService(
       handle.db,
-      loadConfigFromSources(settings.all()).MESSAGE_RETENTION_DAYS,
-      loadConfigFromSources(settings.all()).DEFAULT_CONVERSATION_RETENTION_DAYS,
+      config.MESSAGE_RETENTION_DAYS,
+      config.DEFAULT_CONVERSATION_RETENTION_DAYS,
     );
-    const result = conversations.searchMessages({
+    const result = await conversations.searchMessages({
       query: opts.query,
       limit: opts.pageSize,
       offset: (opts.page - 1) * opts.pageSize,
diff --git a/src/runtime/maintenance.ts b/src/runtime/maintenance.ts
new file mode 100644
index 0000000..e3e746a
--- /dev/null
+++ b/src/runtime/maintenance.ts
@@ -0,0 +1,47 @@
+import type { Bot } from "grammy";
+import type { Logger } from "pino";
+import { sweepExpiredConversations as defaultSweepExpiredConversations } from "../domain/conversation-expiry.js";
+import { RetentionService } from "../domain/retention.js";
+import type { Database } from "../ports/database.js";
+import type { AppConfig } from "./config.js";
+
+export interface MaintenanceJobInput {
+  api: Bot["api"];
+  db: Database;
+  config: AppConfig;
+  logger: Logger;
+}
+
+export interface MaintenanceJobsInput extends MaintenanceJobInput {
+  sweepExpiredConversations?: (input: MaintenanceJobInput) => Promise<number>;
+  cleanupExpiredMessages?: (input: MaintenanceJobInput) => Promise<number>;
+}
+
+export interface MaintenanceJobSummary {
+  expiredConversations: number;
+  expiredMessages: number;
+}
+
+export async function runConversationExpiryJob(input: MaintenanceJobInput): Promise<number> {
+  return defaultSweepExpiredConversations({
+    api: input.api,
+    db: input.db,
+    messageRetentionDays: input.config.MESSAGE_RETENTION_DAYS,
+    defaultConversationRetentionDays: input.config.DEFAULT_CONVERSATION_RETENTION_DAYS,
+    logger: input.logger.child({ module: "conversation-expiry" }),
+  });
+}
+
+export async function runMessageRetentionJob(input: MaintenanceJobInput): Promise<number> {
+  return new RetentionService(
+    input.db,
+    input.config.MESSAGE_RETENTION_DAYS,
+    input.logger.child({ module: "retention" }),
+  ).cleanupExpired();
+}
+
+export async function runMaintenanceJobs(input: MaintenanceJobsInput): Promise<MaintenanceJobSummary> {
+  const expiredConversations = await (input.sweepExpiredConversations ?? runConversationExpiryJob)(input);
+  const expiredMessages = await (input.cleanupExpiredMessages ?? runMessageRetentionJob)(input);
+  return { expiredConversations, expiredMessages };
+}
diff --git a/src/runtime/web-console.ts b/src/runtime/web-console.ts
index 7cd4181..7f97282 100644
--- a/src/runtime/web-console.ts
+++ b/src/runtime/web-console.ts
@@ -271,29 +271,31 @@ export const auditActionOptions = [
 export interface WebConsoleOptions {
   settings: AppSettingsService;
   port: number;
-  getStatus: () => ConsoleStatus;
+  getStatus: () => ConsoleStatus | Promise<ConsoleStatus>;
   onConfigSaved: () => Promise<void>;
   telegramWebhook?: (req: IncomingMessage, res: ServerResponse) => Promise<void>;
-  dbHealthCheck: () => boolean;
-  collectMetrics: () => MetricsSnapshot;
-  collectOperationsOverview: () => OperationsOverview;
-  listConversations: (opts: { page: number; status?: string; assignedTo?: string; pageSize: number }) => { items: ConversationListItemView[]; total: number };
-  listFailedDeliveries: (opts: { page: number; pageSize: number }) => { items: DeliveryView[]; total: number };
+  dbHealthCheck: () => boolean | Promise<boolean>;
+  collectMetrics: () => MetricsSnapshot | Promise<MetricsSnapshot>;
+  collectOperationsOverview: () => OperationsOverview | Promise<OperationsOverview>;
+  listConversations: (opts: { page: number; status?: string; assignedTo?: string; pageSize: number }) => { items: ConversationListItemView[]; total: number } | Promise<{ items: ConversationListItemView[]; total: number }>;
+  listFailedDeliveries: (opts: { page: number; pageSize: number }) => { items: DeliveryView[]; total: number } | Promise<{ items: DeliveryView[]; total: number }>;
   scheduleRetry: (deliveryId: number) => Promise<void>;
-  listAuditLogs: (opts: { page: number; adminId?: string; action?: string; pageSize: number }) => { items: AuditLogView[]; total: number };
-  searchMessages: (opts: { query: string; page: number; pageSize: number }) => { items: MessageSearchView[]; total: number };
+  listAuditLogs: (opts: { page: number; adminId?: string; action?: string; pageSize: number }) => { items: AuditLogView[]; total: number } | Promise<{ items: AuditLogView[]; total: number }>;
+  searchMessages: (opts: { query: string; page: number; pageSize: number }) => { items: MessageSearchView[]; total: number } | Promise<{ items: MessageSearchView[]; total: number }>;
 }
 
 type SessionKind = "password" | "setup";
+type OperationsTab = "overview" | "conversations" | "deliveries" | "audit" | "search";
+export type WebConsoleSessionStore = Map<string, SessionKind>;
 
 class FormBodyTooLargeError extends Error {}
 
-export function ensureSetupToken(settings: AppSettingsService): string | undefined {
-  if (settings.get(passwordHashKey)) return undefined;
-  const existing = settings.get(setupTokenKey);
+export async function ensureSetupToken(settings: AppSettingsService): Promise<string | undefined> {
+  if (await settings.get(passwordHashKey)) return undefined;
+  const existing = await settings.get(setupTokenKey);
   if (existing) return existing;
   const token = randomBytes(16).toString("hex");
-  settings.setMany({ [setupTokenKey]: token });
+  await settings.setMany({ [setupTokenKey]: token });
   return token;
 }
 
@@ -311,11 +313,11 @@ export async function startWebConsole(options: WebConsoleOptions): Promise<Serve
       if (url.pathname === "/healthz" && req.method === "GET") {
         let dbReachable = false;
         try {
-          dbReachable = options.dbHealthCheck();
+          dbReachable = await options.dbHealthCheck();
         } catch {
           dbReachable = false;
         }
-        const botRunning = options.getStatus().bot === "running";
+        const botRunning = (await options.getStatus()).bot === "running";
         const healthy = dbReachable && botRunning;
         send(
           res,
@@ -333,13 +335,13 @@ export async function startWebConsole(options: WebConsoleOptions): Promise<Serve
       }
 
       if (url.pathname === "/login" && req.method === "GET") {
-        renderLogin(res, options.settings);
+        await renderLogin(res, options.settings);
         return;
       }
 
       if (url.pathname === "/login" && req.method === "POST") {
         const form = await readForm(req);
-        const sessionKind = loginSessionKind(options.settings, form);
+        const sessionKind = await loginSessionKind(options.settings, form);
         if (sessionKind) {
           const session = randomBytes(24).toString("hex");
           sessions.set(session, sessionKind);
@@ -347,7 +349,7 @@ export async function startWebConsole(options: WebConsoleOptions): Promise<Serve
           redirect(res, "/");
           return;
         }
-        renderLogin(res, options.settings, "登录凭据无效。");
+        await renderLogin(res, options.settings, "登录凭据无效。");
         return;
       }
 
@@ -359,7 +361,7 @@ export async function startWebConsole(options: WebConsoleOptions): Promise<Serve
 
       if (url.pathname === "/metrics" && req.method === "GET") {
         try {
-          const metrics = options.collectMetrics();
+          const metrics = await options.collectMetrics();
           send(res, 200, "application/json", JSON.stringify(metrics));
         } catch {
           send(res, 500, "application/json", JSON.stringify({ error: "metrics query failed" }));
@@ -367,67 +369,19 @@ export async function startWebConsole(options: WebConsoleOptions): Promise<Serve
         return;
       }
 
-      if (url.pathname === "/operations" || url.pathname === "/operations/overview") {
-        const data = options.collectOperationsOverview();
-        renderOperationsOverview(res, data, url.searchParams.get("action") === "retryed");
-        return;
-      }
-
-      if (url.pathname === "/operations/conversations") {
-        const pageNum = Math.max(1, Number(url.searchParams.get("page") ?? "1"));
-        const status = url.searchParams.get("status") ?? undefined;
-        const assignedTo = url.searchParams.get("assigned_to") ?? undefined;
-        const data = options.listConversations({ page: pageNum, status, assignedTo, pageSize: 50 });
-        renderConversations(res, data, pageNum, status, assignedTo);
-        return;
-      }
-
-      if (url.pathname === "/operations/deliveries") {
-        const pageNum = Math.max(1, Number(url.searchParams.get("page") ?? "1"));
-        const data = options.listFailedDeliveries({ page: pageNum, pageSize: 50 });
-        renderDeliveries(res, data, pageNum);
-        return;
-      }
-
       if (url.pathname === "/operations/deliveries/retry" && req.method === "POST") {
         const form = await readForm(req);
         const deliveryId = Number(form.get("delivery_id"));
         if (deliveryId > 0) {
           await options.scheduleRetry(deliveryId);
         }
-        redirect(res, "/operations/deliveries?action=retryed");
-        return;
-      }
-
-      if (url.pathname === "/operations/audit" && req.method === "GET") {
-        const pageNum = Math.max(1, Number(url.searchParams.get("page") ?? "1"));
-        const adminId = url.searchParams.get("admin_id") ?? undefined;
-        const action = url.searchParams.get("action") ?? undefined;
-        const data = options.listAuditLogs({ page: pageNum, adminId, action, pageSize: 50 });
-        renderAuditLogs(res, data, pageNum, adminId, action);
-        return;
-      }
-
-      if (url.pathname === "/operations/search" && req.method === "GET") {
-        const query = url.searchParams.get("q") ?? "";
-        const pageNum = Math.max(1, Number(url.searchParams.get("page") ?? "1"));
-        if (!query.trim()) {
-          renderSearch(res, { items: [], total: 0 }, query, pageNum);
-          return;
-        }
-        const data = options.searchMessages({ query: query.trim(), page: pageNum, pageSize: 50 });
-        renderSearch(res, data, query, pageNum);
-        return;
-      }
-
-      if (url.pathname === "/" && req.method === "GET") {
-        renderDashboard(res, options.settings, options.getStatus(), url.searchParams.get("saved") === "1");
+        redirect(res, "/operations/deliveries?retryed=1");
         return;
       }
 
       if (url.pathname === "/config" && req.method === "POST") {
         const form = await readForm(req);
-        const values = configValuesFromForm(options.settings, form);
+        const values = await configValuesFromForm(options.settings, form);
         const password = form.get("WEB_CONSOLE_PASSWORD")?.trim();
         if (sessionKind === "setup" && !password) {
           send(res, 400, "text/plain", "首次配置必须设置控制台密码。");
@@ -435,9 +389,25 @@ export async function startWebConsole(options: WebConsoleOptions): Promise<Serve
         }
         if (password) values[passwordHashKey] = hashPassword(password);
         if (password) values[setupTokenKey] = "";
-        options.settings.setMany(values);
+        await options.settings.setMany(values);
         await options.onConfigSaved();
-        redirect(res, "/?saved=1");
+        const group = form.get("group") ?? "security";
+        redirect(res, `/config/${group}?saved=1`);
+        return;
+      }
+
+      if (url.pathname === "/" && req.method === "GET") {
+        await renderOverview(res, options, url.searchParams.get("saved") === "1");
+        return;
+      }
+
+      if (url.pathname.startsWith("/config") && req.method === "GET") {
+        await renderConfigPage(res, options, url.pathname, url.searchParams);
+        return;
+      }
+
+      if (url.pathname.startsWith("/operations") && req.method === "GET") {
+        await renderOperationsPage(res, options, url.pathname, url.searchParams);
         return;
       }
 
@@ -467,8 +437,105 @@ export async function startWebConsole(options: WebConsoleOptions): Promise<Serve
   return server;
 }
 
-function renderLogin(res: ServerResponse, settings: AppSettingsService, error = ""): void {
-  const hasPassword = Boolean(settings.get(passwordHashKey));
+export async function handleWebConsoleRequest(
+  request: Request,
+  options: WebConsoleOptions,
+  sessions: WebConsoleSessionStore = new Map(),
+): Promise<Response> {
+  try {
+    const url = new URL(request.url);
+    const res = new FetchResponseSink();
+
+    if (url.pathname === "/healthz" && request.method === "GET") {
+      let dbReachable = false;
+      try {
+        dbReachable = await options.dbHealthCheck();
+      } catch {
+        dbReachable = false;
+      }
+      const botRunning = (await options.getStatus()).bot === "running";
+      const healthy = dbReachable && botRunning;
+      return jsonResponse(
+        {
+          status: healthy ? "ok" : "degraded",
+          bot: botRunning ? "running" : "stopped",
+          db: dbReachable ? "reachable" : "unreachable",
+        },
+        healthy ? 200 : 503,
+      );
+    }
+
+    if (url.pathname === "/login" && request.method === "GET") {
+      await renderLogin(res.asServerResponse(), options.settings);
+      return res.toResponse();
+    }
+
+    const sessionKind = authenticatedFetchSessionKind(request, sessions);
+    if (!sessionKind) return redirectResponse("/login");
+
+    return textResponse("页面不存在", 404);
+  } catch (error) {
+    if (error instanceof FormBodyTooLargeError) return textResponse("请求体过大。", 413);
+    return textResponse(`控制台处理失败：${error instanceof Error ? error.message : String(error)}`, 500);
+  }
+}
+
+class FetchResponseSink {
+  statusCode = 200;
+  private readonly headers = new Headers();
+  private body = "";
+
+  asServerResponse(): ServerResponse {
+    const sink = this;
+    return {
+      setHeader: (name: string, value: number | string | readonly string[]) => {
+        if (Array.isArray(value)) sink.headers.set(name, value.join(", "));
+        else sink.headers.set(name, String(value));
+      },
+      end: (body?: string | Buffer) => {
+        if (body !== undefined) sink.body = Buffer.isBuffer(body) ? body.toString("utf8") : String(body);
+      },
+      get statusCode() {
+        return sink.statusCode;
+      },
+      set statusCode(value: number) {
+        sink.statusCode = value;
+      },
+    } as unknown as ServerResponse;
+  }
+
+  toResponse(): Response {
+    return new Response(this.body, { status: this.statusCode, headers: this.headers });
+  }
+}
+
+function authenticatedFetchSessionKind(request: Request, sessions: WebConsoleSessionStore): SessionKind | undefined {
+  const cookie = request.headers.get("cookie") ?? "";
+  const token = cookie
+    .split(";")
+    .map((part) => part.trim())
+    .find((part) => part.startsWith(`${sessionCookie}=`))
+    ?.slice(sessionCookie.length + 1);
+  return token ? sessions.get(token) : undefined;
+}
+
+function jsonResponse(body: unknown, status: number): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "content-type": "application/json" },
+  });
+}
+
+function textResponse(body: string, status: number): Response {
+  return new Response(body, { status, headers: { "content-type": "text/plain" } });
+}
+
+function redirectResponse(location: string): Response {
+  return new Response(null, { status: 302, headers: { location } });
+}
+
+async function renderLogin(res: ServerResponse, settings: AppSettingsService, error = ""): Promise<void> {
+  const hasPassword = Boolean(await settings.get(passwordHashKey));
   const label = hasPassword ? "控制台密码" : "首次设置令牌";
   const name = hasPassword ? "password" : "setupToken";
   send(
@@ -488,28 +555,64 @@ function renderLogin(res: ServerResponse, settings: AppSettingsService, error =
           <label for="login-secret">${escapeHtml(label)}</label>
           <input id="login-secret" type="password" name="${name}" autocomplete="current-password" autofocus required>
         </div>
-        <button type="submit"><span class="spinner" aria-hidden="true"></span><span class="btn-label">进入控制台</span></button>
+        <div style="margin-top:var(--space-4)">
+          <button type="submit"><span class="spinner" aria-hidden="true"></span><span class="btn-label">进入控制台</span></button>
+        </div>
       </form>`),
   );
 }
 
-function renderDashboard(res: ServerResponse, settings: AppSettingsService, status: ConsoleStatus, saved: boolean): void {
-  const stored = settings.all();
-  const needsPassword = !settings.get(passwordHashKey);
+const configGroupSlugs: Array<{ slug: string; title: string }> = [
+  { slug: "security", title: "访问安全" },
+  { slug: "telegram", title: "Telegram 基础配置" },
+  { slug: "runtime", title: "运行方式" },
+  { slug: "retention", title: "数据保留与自动清理" },
+  { slug: "ratelimit", title: "限流设置" },
+  { slug: "delivery", title: "投递可靠性" },
+  { slug: "ai-drafts", title: "AI 草稿" },
+];
+
+async function renderOverview(
+  res: ServerResponse,
+  options: WebConsoleOptions,
+  saved: boolean,
+): Promise<void> {
+  const status = await options.getStatus();
+  const stored = await options.settings.all();
   const completedRequired = ["TELEGRAM_BOT_TOKEN", "TELEGRAM_MANAGEMENT_CHAT_ID", "TELEGRAM_ADMIN_USER_IDS"].filter(
     (key) => Boolean(stored[key]),
   ).length;
   const issueList = status.issues.length
     ? `<ul class="issue-list">${status.issues.map((issue) => `<li><svg class="icon" viewBox="0 0 24 24" aria-hidden="true"><path d="M10.29 3.86 1.82 18a2 2 0 0 0 1.71 3h16.94a2 2 0 0 0 1.71-3L13.71 3.86a2 2 0 0 0-3.42 0z"/><path d="M12 9v4M12 17h.01"/></svg><span class="issue-content">${translateIssue(issue)}</span></li>`).join("")}</ul>`
     : `<p class="status-copy"><svg class="icon" viewBox="0 0 24 24" aria-hidden="true" style="vertical-align:-4px;margin-right:6px;color:var(--color-ok)"><path d="M22 11.08V12a10 10 0 1 1-5.93-9.14"/><path d="M22 4 12 14.01l-3-3"/></svg>配置完整，bot 可以正常启动。</p>`;
-  const groups = fieldGroups.map((group) => renderGroup(group, stored)).join("\n");
-  const navigation = ["访问安全", ...fieldGroups.map((group) => group.title)]
-    .map(
-      (title, index) =>
-        `<button type="button" class="tab-button${index === 0 ? " active" : ""}" data-tab="tab-${index}" aria-selected="${index === 0 ? "true" : "false"}">${escapeHtml(title)}</button>`,
-    )
-    .join("");
   const statusRunning = status.bot === "running";
+
+  let opsMetrics = "";
+  try {
+    const data = await options.collectOperationsOverview();
+    opsMetrics = `
+      <div class="ops-grid">
+        <div class="ops-card"><h3>消息</h3>
+          <div class="ops-metric"><span class="label">入站</span><span class="value">${data.messages.inboundTotal}</span></div>
+          <div class="ops-metric"><span class="label">出站</span><span class="value">${data.messages.outboundTotal}</span></div>
+        </div>
+        <div class="ops-card"><h3>投递</h3>
+          <div class="ops-metric"><span class="label">sent</span><span class="value ok">${data.deliveries.sent}</span></div>
+          <div class="ops-metric"><span class="label">failed</span><span class="value ${data.deliveries.failed > 0 ? "danger" : ""}">${data.deliveries.failed}</span></div>
+        </div>
+        <div class="ops-card"><h3>会话</h3>
+          <div class="ops-metric"><span class="label">open</span><span class="value ok">${data.conversations.open}</span></div>
+          <div class="ops-metric"><span class="label">closed</span><span class="value">${data.conversations.closed}</span></div>
+        </div>
+      </div>`;
+  } catch {
+    opsMetrics = `<p class="hint" style="margin:var(--space-4) 0">Bot 未完成配置，运维数据暂不可用。</p>`;
+  }
+
+  const savedBanner = saved
+    ? `<p class="banner success" role="status"><svg class="icon" viewBox="0 0 24 24" aria-hidden="true"><path d="M22 11.08V12a10 10 0 1 1-5.93-9.14"/><path d="M22 4 12 14.01l-3-3"/></svg><span>配置已保存，运行状态已刷新。</span></p>`
+    : "";
+
   send(
     res,
     200,
@@ -518,12 +621,12 @@ function renderDashboard(res: ServerResponse, settings: AppSettingsService, stat
       <section class="hero">
         <div>
           <p class="eyebrow">InboxBridge</p>
-          <h1>控制台</h1>
-          <p class="hero-copy">集中管理 bot 连接、管理员白名单、数据保留、限流和 AI 草稿。常规部署无需手写环境变量。</p>
+          <h1>控制台概览</h1>
+          <p class="hero-copy">运行状态、配置进度和关键指标一览。</p>
         </div>
         <span class="status-pill ${statusRunning ? "ok" : "warn"}" role="status"><span class="dot" aria-hidden="true"></span>${statusRunning ? "Bot 运行中" : "Bot 待配置"}</span>
       </section>
-      ${saved ? `<p class="banner success" role="status"><svg class="icon" viewBox="0 0 24 24" aria-hidden="true"><path d="M22 11.08V12a10 10 0 1 1-5.93-9.14"/><path d="M22 4 12 14.01l-3-3"/></svg><span>配置已保存，运行状态已刷新。</span></p>` : ""}
+      ${savedBanner}
       <div class="dashboard-shell">
         <aside class="sidebar">
           <section class="card status-card" aria-label="运行状态">
@@ -541,55 +644,207 @@ function renderDashboard(res: ServerResponse, settings: AppSettingsService, stat
             <p class="hint">基础配置包含 Bot Token、管理群 ID 和管理员白名单。</p>
             <div class="progress-track" role="progressbar" aria-valuenow="${completedRequired}" aria-valuemin="0" aria-valuemax="3"><span style="width:${Math.round((completedRequired / 3) * 100)}%"></span></div>
           </section>
-          <nav class="card quick-nav" aria-label="配置页切换">
-            <p class="eyebrow">配置页</p>
-            ${navigation}
+          <nav class="card quick-nav" aria-label="快捷入口">
+            <p class="eyebrow">仪表盘</p>
+            <a href="/config/security" class="ops-link">配置仪表盘</a>
+            <a href="/operations" class="ops-link">运维仪表盘</a>
           </nav>
         </aside>
-        <form method="post" action="/config" class="config-panel" aria-label="配置表单">
-          <section class="config-section access-section tab-panel active" data-panel="tab-0" aria-hidden="false">
-            <div class="section-heading split-heading">
+        <div class="config-panel">
+          <section class="config-section active">
+            <div class="section-heading">
               <div>
-                <p class="eyebrow">访问安全</p>
-                <h2>${needsPassword ? "设置控制台密码" : "修改控制台密码"}</h2>
-                <p class="hint">${needsPassword ? "首次配置必须设置密码，后续登录使用该密码。" : "留空表示保持现有密码。"}</p>
+                <p class="eyebrow">关键指标</p>
+                <h2>实时数据</h2>
               </div>
-              <span class="section-badge">本地保存</span>
-            </div>
-            <div class="field single-field">
-              <p class="field-note">控制台密码只保存在本地 SQLite 数据库中，用于保护配置页面。</p>
-              <label for="WEB_CONSOLE_PASSWORD">控制台密码</label>
-              <input id="WEB_CONSOLE_PASSWORD" type="password" name="WEB_CONSOLE_PASSWORD" autocomplete="new-password" ${needsPassword ? "required" : ""}>
+              <a href="/operations" class="ops-link" style="display:inline">查看详情</a>
             </div>
+            ${opsMetrics}
           </section>
-          ${groups}
-          <div class="form-actions">
-            <div>
-              <strong>保存后立即生效</strong>
-              <p class="hint">系统会重新读取配置；配置完整时 bot 会自动启动。</p>
-            </div>
-            <button type="submit"><span class="spinner" aria-hidden="true"></span><span class="btn-label">保存并重启 Bot</span></button>
-          </div>
-        </form>
+        </div>
       </div>`),
   );
 }
 
-function renderGroup(group: (typeof fieldGroups)[number], stored: NodeJS.ProcessEnv): string {
-  const index = fieldGroups.indexOf(group) + 1;
-  return `<section class="config-section tab-panel" data-panel="tab-${index}" aria-hidden="true">
-    <div class="section-heading split-heading">
-      <div>
-        <p class="eyebrow">配置分组 ${index}</p>
-        <h2>${escapeHtml(group.title)}</h2>
-        <p class="hint">${escapeHtml(group.description)}</p>
+async function renderConfigPage(
+  res: ServerResponse,
+  options: WebConsoleOptions,
+  pathname: string,
+  searchParams: URLSearchParams,
+): Promise<void> {
+  const slug = pathname.replace(/^\/config\/?/, "") || "security";
+  const groupIndex = configGroupSlugs.findIndex((g) => g.slug === slug);
+  const validSlug = groupIndex >= 0 ? slug : "security";
+  const currentIndex = groupIndex >= 0 ? groupIndex : 0;
+
+  const settings = options.settings;
+  const stored = await settings.all();
+  const needsPassword = !(await settings.get(passwordHashKey));
+  const statusRunning = (await options.getStatus()).bot === "running";
+  const saved = searchParams.get("saved") === "1";
+
+  const nav = configGroupSlugs
+    .map((g, i) => `<a href="/config/${g.slug}" class="ops-nav-link${i === currentIndex ? " active" : ""}">${escapeHtml(g.title)}</a>`)
+    .join("\n");
+
+  let formBody: string;
+  if (currentIndex === 0) {
+    formBody = `
+      <div class="section-heading split-heading">
+        <div>
+          <p class="eyebrow">访问安全</p>
+          <h2>${needsPassword ? "设置控制台密码" : "修改控制台密码"}</h2>
+          <p class="hint">${needsPassword ? "首次配置必须设置密码，后续登录使用该密码。" : "留空表示保持现有密码。"}</p>
+        </div>
+        <span class="section-badge">本地保存</span>
       </div>
-      <span class="section-badge">${group.fields.length} 项</span>
-    </div>
-    <div class="field-grid">
-      ${group.fields.map((field) => renderField(field, stored[field.key] ?? "")).join("\n")}
-    </div>
-  </section>`;
+      <div class="field single-field">
+        <p class="field-note">控制台密码只保存在本地 SQLite 数据库中，用于保护配置页面。</p>
+        <label for="WEB_CONSOLE_PASSWORD">控制台密码</label>
+        <input id="WEB_CONSOLE_PASSWORD" type="password" name="WEB_CONSOLE_PASSWORD" autocomplete="new-password" ${needsPassword ? "required" : ""}>
+      </div>`;
+  } else {
+    const group = fieldGroups[currentIndex - 1];
+    formBody = `
+      <div class="section-heading split-heading">
+        <div>
+          <p class="eyebrow">配置分组 ${currentIndex}</p>
+          <h2>${escapeHtml(group.title)}</h2>
+          <p class="hint">${escapeHtml(group.description)}</p>
+        </div>
+        <span class="section-badge">${group.fields.length} 项</span>
+      </div>
+      <div class="field-grid">
+        ${group.fields.map((field) => renderField(field, stored[field.key] ?? "")).join("\n")}
+      </div>`;
+  }
+
+  const savedBanner = saved
+    ? `<p class="banner success" role="status"><svg class="icon" viewBox="0 0 24 24" aria-hidden="true"><path d="M22 11.08V12a10 10 0 1 1-5.93-9.14"/><path d="M22 4 12 14.01l-3-3"/></svg><span>配置已保存，运行状态已刷新。</span></p>`
+    : "";
+
+  const pageTitle = configGroupSlugs[currentIndex].title;
+
+  send(
+    res,
+    200,
+    "text/html; charset=utf-8",
+    page(`配置 · ${pageTitle} - InboxBridge`, `
+      <nav class="ops-topnav" aria-label="配置分组">
+        ${nav}
+      </nav>
+      <section class="hero">
+        <div>
+          <a href="/" class="back-link" aria-label="返回概览"><svg class="icon icon-sm" viewBox="0 0 24 24" aria-hidden="true"><path d="M19 12H5M12 19l-7-7 7-7"/></svg>概览</a>
+          <p class="eyebrow">配置仪表盘</p>
+          <h1>${escapeHtml(pageTitle)}</h1>
+          <p class="hero-copy">管理 bot 连接、管理员白名单、数据保留、限流和 AI 草稿。</p>
+        </div>
+        <span class="status-pill ${statusRunning ? "ok" : "warn"}" role="status"><span class="dot" aria-hidden="true"></span>${statusRunning ? "Bot 运行中" : "Bot 待配置"}</span>
+      </section>
+      ${savedBanner}
+      <form method="post" action="/config" class="config-panel" aria-label="配置表单">
+        <input type="hidden" name="group" value="${validSlug}">
+        <section class="config-section active">
+          ${formBody}
+        </section>
+        <div class="form-actions">
+          <div>
+            <strong>保存后立即生效</strong>
+            <p class="hint">系统会重新读取配置；配置完整时 bot 会自动启动。</p>
+          </div>
+          <button type="submit"><span class="spinner" aria-hidden="true"></span><span class="btn-label">保存</span></button>
+        </div>
+      </form>`),
+  );
+}
+
+const opsRoutes: Array<{ pattern: RegExp; key: OperationsTab }> = [
+  { pattern: /^\/operations\/?$/, key: "overview" },
+  { pattern: /^\/operations\/overview\/?$/, key: "overview" },
+  { pattern: /^\/operations\/conversations\/?$/, key: "conversations" },
+  { pattern: /^\/operations\/deliveries\/?$/, key: "deliveries" },
+  { pattern: /^\/operations\/audit\/?$/, key: "audit" },
+  { pattern: /^\/operations\/search\/?$/, key: "search" },
+];
+
+async function renderOperationsPage(
+  res: ServerResponse,
+  options: WebConsoleOptions,
+  pathname: string,
+  searchParams: URLSearchParams,
+): Promise<void> {
+  const route = opsRoutes.find((r) => r.pattern.test(pathname));
+  if (!route) {
+    send(res, 404, "text/plain", "运维页面不存在");
+    return;
+  }
+  const tab = route.key;
+  const retryed = searchParams.get("retryed") === "1";
+
+  let opsBody: string;
+  try {
+    if (tab === "overview") {
+      opsBody = renderOperationsOverviewBody(await options.collectOperationsOverview(), retryed);
+    } else if (tab === "conversations") {
+      const pageNum = Math.max(1, Number(searchParams.get("page") ?? "1"));
+      const convStatus = searchParams.get("status") ?? undefined;
+      const assignedTo = searchParams.get("assigned_to") ?? undefined;
+      const data = await options.listConversations({ page: pageNum, status: convStatus, assignedTo, pageSize: 50 });
+      opsBody = renderConversationsBody(data, pageNum, convStatus, assignedTo);
+    } else if (tab === "deliveries") {
+      const pageNum = Math.max(1, Number(searchParams.get("page") ?? "1"));
+      const data = await options.listFailedDeliveries({ page: pageNum, pageSize: 50 });
+      opsBody = renderDeliveriesBody(data, pageNum);
+    } else if (tab === "audit") {
+      const pageNum = Math.max(1, Number(searchParams.get("page") ?? "1"));
+      const adminId = searchParams.get("admin_id") ?? undefined;
+      const action = searchParams.get("action") ?? undefined;
+      const data = await options.listAuditLogs({ page: pageNum, adminId, action, pageSize: 50 });
+      opsBody = renderAuditLogsBody(data, pageNum, adminId, action);
+    } else {
+      const query = searchParams.get("q") ?? "";
+      const pageNum = Math.max(1, Number(searchParams.get("page") ?? "1"));
+      const data = query.trim()
+        ? await options.searchMessages({ query: query.trim(), page: pageNum, pageSize: 50 })
+        : { items: [], total: 0 };
+      opsBody = renderSearchBody(data, query, pageNum);
+    }
+  } catch {
+    opsBody = `<div class="ops-empty">Bot 未完成配置，运维数据暂不可用。请先在配置控制台填写 Bot Token、管理群 ID 和管理员白名单。</div>`;
+  }
+
+  const navItems: Array<{ key: OperationsTab; href: string; label: string }> = [
+    { key: "overview", href: "/operations", label: "概览" },
+    { key: "conversations", href: "/operations/conversations", label: "会话" },
+    { key: "deliveries", href: "/operations/deliveries", label: "投递" },
+    { key: "audit", href: "/operations/audit", label: "审计" },
+    { key: "search", href: "/operations/search", label: "搜索" },
+  ];
+  const nav = navItems
+    .map((item) => `<a href="${item.href}" class="ops-nav-link${tab === item.key ? " active" : ""}">${item.label}</a>`)
+    .join("\n");
+  const pageTitle = navItems.find((n) => n.key === tab)?.label ?? "运维";
+
+  send(
+    res,
+    200,
+    "text/html; charset=utf-8",
+    page(`运维 · ${pageTitle} - InboxBridge`, `
+      <nav class="ops-topnav" aria-label="运维导航">
+        ${nav}
+      </nav>
+      <section class="hero">
+        <div>
+          <a href="/" class="back-link" aria-label="返回概览"><svg class="icon icon-sm" viewBox="0 0 24 24" aria-hidden="true"><path d="M19 12H5M12 19l-7-7 7-7"/></svg>概览</a>
+          <p class="eyebrow">运维仪表盘</p>
+          <h1>${escapeHtml(pageTitle)}</h1>
+          <p class="hero-copy">监控会话、投递、审计与消息检索。</p>
+        </div>
+      </section>
+      <div class="config-panel"><section class="config-section active">${opsBody}</section></div>
+    `),
+  );
 }
 
 function renderField(field: FieldMeta, value: string): string {
@@ -630,8 +885,8 @@ function translateIssue(issue: string): string {
   return escapeHtml(issue);
 }
 
-function configValuesFromForm(settings: AppSettingsService, form: URLSearchParams): Record<string, string> {
-  const current = settings.all();
+async function configValuesFromForm(settings: AppSettingsService, form: URLSearchParams): Promise<Record<string, string>> {
+  const current = await settings.all();
   const values: Record<string, string> = {};
   for (const key of editableConfigKeys) {
     const value = form.get(key)?.trim() ?? "";
@@ -641,10 +896,11 @@ function configValuesFromForm(settings: AppSettingsService, form: URLSearchParam
   return values;
 }
 
-function loginSessionKind(settings: AppSettingsService, form: URLSearchParams): SessionKind | undefined {
-  const hash = settings.get(passwordHashKey);
+async function loginSessionKind(settings: AppSettingsService, form: URLSearchParams): Promise<SessionKind | undefined> {
+  const hash = await settings.get(passwordHashKey);
   if (hash) return verifyPassword(form.get("password") ?? "", hash) ? "password" : undefined;
-  return settings.get(setupTokenKey) && form.get("setupToken") === settings.get(setupTokenKey) ? "setup" : undefined;
+  const setupToken = await settings.get(setupTokenKey);
+  return setupToken && form.get("setupToken") === setupToken ? "setup" : undefined;
 }
 
 function authenticatedSessionKind(req: IncomingMessage, sessions: Map<string, SessionKind>): SessionKind | undefined {
@@ -685,27 +941,27 @@ function verifyPassword(password: string, stored: string): boolean {
 
 function page(title: string, body: string): string {
   const fingerprint = createHash("sha256").update(title).digest("hex").slice(0, 8);
-  return `<!doctype html><html lang="zh-CN"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover"><meta name="color-scheme" content="light dark"><meta name="theme-color" content="#f6f8fc" media="(prefers-color-scheme: light)"><meta name="theme-color" content="#0b1220" media="(prefers-color-scheme: dark)"><title>${escapeHtml(title)}</title><link rel="preconnect" href="https://fonts.googleapis.com"><link rel="preconnect" href="https://fonts.gstatic.com" crossorigin><link href="https://fonts.googleapis.com/css2?family=Fira+Code:wght@400;500;600&family=Fira+Sans:wght@300;400;500;600;700&display=swap" rel="stylesheet"><style>
-:root{color-scheme:light dark;--font-sans:"Fira Sans",ui-sans-serif,system-ui,-apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif;--font-mono:"Fira Code",ui-monospace,SFMono-Regular,Menlo,monospace;--radius-xs:8px;--radius-sm:12px;--radius-md:16px;--radius-lg:20px;--radius-xl:24px;--space-1:4px;--space-2:8px;--space-3:12px;--space-4:16px;--space-5:20px;--space-6:24px;--space-7:32px;--space-8:40px;--shadow-sm:0 1px 2px rgba(15,23,42,.06);--shadow-md:0 8px 24px rgba(15,23,42,.08);--shadow-lg:0 18px 48px rgba(15,23,42,.12);--ring:0 0 0 3px var(--color-ring);--transition:160ms cubic-bezier(.4,0,.2,1);--ease-out:cubic-bezier(0,.55,.45,1)}
-@media (prefers-color-scheme:light){:root{--color-bg:#f6f8fc;--color-bg-gradient:radial-gradient(circle at 12% -8%,#dbe7ff 0,#f6f8fc 38%,#ffffff 100%);--color-surface:#ffffff;--color-surface-2:#f8fafc;--color-surface-3:#f1f5f9;--color-overlay:rgba(255,255,255,.92);--color-border:#e2e8f0;--color-border-strong:#cbd5e1;--color-text:#0f172a;--color-text-secondary:#475569;--color-text-muted:#94a3b8;--color-primary:#2563eb;--color-primary-hover:#1d4ed8;--color-primary-soft:#eff4ff;--color-primary-soft-text:#1e40af;--color-accent:#0ea5e9;--color-ok:#059669;--color-ok-soft:#ecfdf5;--color-ok-border:#a7f3d0;--color-warn:#d97706;--color-warn-soft:#fffbeb;--color-warn-border:#fde68a;--color-danger:#dc2626;--color-danger-soft:#fef2f2;--color-danger-border:#fecaca;--color-ring:rgba(37,99,235,.35);--color-card-border:rgba(226,232,240,.8);--color-hero-border:rgba(37,99,235,.16);--color-hero-bg:linear-gradient(135deg,#ffffff,#eff4ff)}}
-@media (prefers-color-scheme:dark){:root{--color-bg:#0b1220;--color-bg-gradient:radial-gradient(circle at 12% -8%,#1e293b 0,#0b1220 42%,#020617 100%);--color-surface:#111a2e;--color-surface-2:#0e1626;--color-surface-3:#16223a;--color-overlay:rgba(17,26,46,.86);--color-border:#1f2a40;--color-border-strong:#334155;--color-text:#f1f5f9;--color-text-secondary:#94a3b8;--color-text-muted:#64748b;--color-primary:#3b82f6;--color-primary-hover:#60a5fa;--color-primary-soft:rgba(59,130,246,.14);--color-primary-soft-text:#93c5fd;--color-accent:#38bdf8;--color-ok:#10b981;--color-ok-soft:rgba(16,185,129,.12);--color-ok-border:rgba(16,185,129,.34);--color-warn:#f59e0b;--color-warn-soft:rgba(245,158,11,.12);--color-warn-border:rgba(245,158,11,.34);--color-danger:#ef4444;--color-danger-soft:rgba(239,68,68,.12);--color-danger-border:rgba(239,68,68,.34);--color-ring:rgba(59,130,246,.45);--color-card-border:rgba(31,42,64,.8);--color-hero-border:rgba(59,130,246,.24);--color-hero-bg:linear-gradient(135deg,#111a2e,#1a2740)}}
-[data-theme="light"]{color-scheme:light;--color-bg:#f6f8fc;--color-bg-gradient:radial-gradient(circle at 12% -8%,#dbe7ff 0,#f6f8fc 38%,#ffffff 100%);--color-surface:#ffffff;--color-surface-2:#f8fafc;--color-surface-3:#f1f5f9;--color-overlay:rgba(255,255,255,.92);--color-border:#e2e8f0;--color-border-strong:#cbd5e1;--color-text:#0f172a;--color-text-secondary:#475569;--color-text-muted:#94a3b8;--color-primary:#2563eb;--color-primary-hover:#1d4ed8;--color-primary-soft:#eff4ff;--color-primary-soft-text:#1e40af;--color-accent:#0ea5e9;--color-ok:#059669;--color-ok-soft:#ecfdf5;--color-ok-border:#a7f3d0;--color-warn:#d97706;--color-warn-soft:#fffbeb;--color-warn-border:#fde68a;--color-danger:#dc2626;--color-danger-soft:#fef2f2;--color-danger-border:#fecaca;--color-ring:rgba(37,99,235,.35);--color-card-border:rgba(226,232,240,.8);--color-hero-border:rgba(37,99,235,.16);--color-hero-bg:linear-gradient(135deg,#ffffff,#eff4ff)}
-[data-theme="dark"]{color-scheme:dark;--color-bg:#0b1220;--color-bg-gradient:radial-gradient(circle at 12% -8%,#1e293b 0,#0b1220 42%,#020617 100%);--color-surface:#111a2e;--color-surface-2:#0e1626;--color-surface-3:#16223a;--color-overlay:rgba(17,26,46,.86);--color-border:#1f2a40;--color-border-strong:#334155;--color-text:#f1f5f9;--color-text-secondary:#94a3b8;--color-text-muted:#64748b;--color-primary:#3b82f6;--color-primary-hover:#60a5fa;--color-primary-soft:rgba(59,130,246,.14);--color-primary-soft-text:#93c5fd;--color-accent:#38bdf8;--color-ok:#10b981;--color-ok-soft:rgba(16,185,129,.12);--color-ok-border:rgba(16,185,129,.34);--color-warn:#f59e0b;--color-warn-soft:rgba(245,158,11,.12);--color-warn-border:rgba(245,158,11,.34);--color-danger:#ef4444;--color-danger-soft:rgba(239,68,68,.12);--color-danger-border:rgba(239,68,68,.34);--color-ring:rgba(59,130,246,.45);--color-card-border:rgba(31,42,64,.8);--color-hero-border:rgba(59,130,246,.24);--color-hero-bg:linear-gradient(135deg,#111a2e,#1a2740)}
+  return `<!doctype html><html lang="zh-CN"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover"><meta name="color-scheme" content="light dark"><meta name="theme-color" content="#f6f8fc" media="(prefers-color-scheme: light)"><meta name="theme-color" content="#0b1220" media="(prefers-color-scheme: dark)"><title>${escapeHtml(title)}</title><link rel="preconnect" href="https://fonts.googleapis.com"><link rel="preconnect" href="https://fonts.gstatic.com" crossorigin><link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&family=JetBrains+Mono:wght@400;500;600&display=swap" rel="stylesheet"><style>
+:root{color-scheme:light dark;--font-sans:"Inter",ui-sans-serif,system-ui,-apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif;--font-mono:"JetBrains Mono",ui-monospace,SFMono-Regular,Menlo,monospace;--radius-sm:6px;--radius-md:8px;--radius-lg:10px;--radius-xl:12px;--space-1:4px;--space-2:8px;--space-3:12px;--space-4:16px;--space-5:20px;--space-6:24px;--space-7:32px;--space-8:40px;--shadow-sm:0 1px 2px rgba(0,0,0,.04);--shadow-md:0 2px 8px rgba(0,0,0,.06);--shadow-lg:0 8px 24px rgba(0,0,0,.08);--ring:0 0 0 2px var(--color-ring);--transition:120ms cubic-bezier(.4,0,.2,1);--ease-out:cubic-bezier(0,.55,.45,1)}
+@media (prefers-color-scheme:light){:root{--color-bg:#fafafa;--color-surface:#ffffff;--color-surface-2:#f5f5f5;--color-surface-3:#ededed;--color-overlay:#ffffff;--color-border:#e5e5e5;--color-border-strong:#d4d4d4;--color-text:#171717;--color-text-secondary:#525252;--color-text-muted:#a3a3a3;--color-primary:#171717;--color-primary-hover:#000000;--color-primary-soft:#f5f5f5;--color-primary-soft-text:#171717;--color-accent:#0070f3;--color-ok:#0070f3;--color-ok-soft:#f0f7ff;--color-ok-border:#bfdbfe;--color-warn:#f5a623;--color-warn-soft:#fffbeb;--color-warn-border:#fde68a;--color-danger:#e5484d;--color-danger-soft:#fef2f2;--color-danger-border:#fecaca;--color-ring:rgba(0,112,243,.4);--color-card-border:#e5e5e5;--color-hero-border:#e5e5e5;--color-hero-bg:#ffffff}}
+@media (prefers-color-scheme:dark){:root{--color-bg:#0a0a0a;--color-surface:#111111;--color-surface-2:#1a1a1a;--color-surface-3:#262626;--color-overlay:#111111;--color-border:#262626;--color-border-strong:#404040;--color-text:#ededed;--color-text-secondary:#a3a3a3;--color-text-muted:#525252;--color-primary:#ededed;--color-primary-hover:#ffffff;--color-primary-soft:#1a1a1a;--color-primary-soft-text:#ffffff;--color-accent:#3291ff;--color-ok:#3291ff;--color-ok-soft:rgba(50,145,255,.1);--color-ok-border:rgba(50,145,255,.3);--color-warn:#f5a623;--color-warn-soft:rgba(245,166,35,.1);--color-warn-border:rgba(245,166,35,.3);--color-danger:#ff6366;--color-danger-soft:rgba(255,99,102,.1);--color-danger-border:rgba(255,99,102,.3);--color-ring:rgba(50,145,255,.5);--color-card-border:#262626;--color-hero-border:#262626;--color-hero-bg:#111111}}
+[data-theme="light"]{color-scheme:light;--color-bg:#fafafa;--color-surface:#ffffff;--color-surface-2:#f5f5f5;--color-surface-3:#ededed;--color-overlay:#ffffff;--color-border:#e5e5e5;--color-border-strong:#d4d4d4;--color-text:#171717;--color-text-secondary:#525252;--color-text-muted:#a3a3a3;--color-primary:#171717;--color-primary-hover:#000000;--color-primary-soft:#f5f5f5;--color-primary-soft-text:#171717;--color-accent:#0070f3;--color-ok:#0070f3;--color-ok-soft:#f0f7ff;--color-ok-border:#bfdbfe;--color-warn:#f5a623;--color-warn-soft:#fffbeb;--color-warn-border:#fde68a;--color-danger:#e5484d;--color-danger-soft:#fef2f2;--color-danger-border:#fecaca;--color-ring:rgba(0,112,243,.4);--color-card-border:#e5e5e5;--color-hero-border:#e5e5e5;--color-hero-bg:#ffffff}
+[data-theme="dark"]{color-scheme:dark;--color-bg:#0a0a0a;--color-surface:#111111;--color-surface-2:#1a1a1a;--color-surface-3:#262626;--color-overlay:#111111;--color-border:#262626;--color-border-strong:#404040;--color-text:#ededed;--color-text-secondary:#a3a3a3;--color-text-muted:#525252;--color-primary:#ededed;--color-primary-hover:#ffffff;--color-primary-soft:#1a1a1a;--color-primary-soft-text:#ffffff;--color-accent:#3291ff;--color-ok:#3291ff;--color-ok-soft:rgba(50,145,255,.1);--color-ok-border:rgba(50,145,255,.3);--color-warn:#f5a623;--color-warn-soft:rgba(245,166,35,.1);--color-warn-border:rgba(245,166,35,.3);--color-danger:#ff6366;--color-danger-soft:rgba(255,99,102,.1);--color-danger-border:rgba(255,99,102,.3);--color-ring:rgba(50,145,255,.5);--color-card-border:#262626;--color-hero-border:#262626;--color-hero-bg:#111111}
 *{box-sizing:border-box}
 html{scroll-behavior:smooth}
-body{margin:0;font-family:var(--font-sans);background:var(--color-bg);background-image:var(--color-bg-gradient);background-attachment:fixed;color:var(--color-text);line-height:1.6;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;min-height:100vh;min-height:100dvh}
-main{max-width:1240px;margin:0 auto;padding:var(--space-7) var(--space-5) var(--space-8);padding-top:max(var(--space-7),env(safe-area-inset-top));padding-bottom:max(var(--space-8),env(safe-area-inset-bottom))}
-h1{font-size:clamp(28px,4vw,40px);line-height:1.1;letter-spacing:-.02em;margin:0;font-weight:700}
-h2{font-size:20px;line-height:1.3;letter-spacing:-.01em;margin:0 0 var(--space-2);font-weight:600}
+body{margin:0;font-family:var(--font-sans);background:var(--color-bg);color:var(--color-text);line-height:1.5;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;min-height:100vh;min-height:100dvh;font-feature-settings:"cv11","ss01"}
+main{max-width:1200px;margin:0 auto;padding:var(--space-7) var(--space-5) var(--space-8);padding-top:max(var(--space-7),env(safe-area-inset-top));padding-bottom:max(var(--space-8),env(safe-area-inset-bottom))}
+h1{font-size:clamp(24px,3vw,32px);line-height:1.2;letter-spacing:-.02em;margin:0;font-weight:700}
+h2{font-size:16px;line-height:1.4;letter-spacing:-.01em;margin:0 0 var(--space-2);font-weight:600}
 p{margin:0}
-a{color:var(--color-primary);text-decoration:none;transition:color var(--transition)}
+a{color:var(--color-accent);text-decoration:none;transition:color var(--transition)}
 a:hover{color:var(--color-primary-hover)}
 .icon{width:20px;height:20px;flex-shrink:0;stroke-width:2;stroke:currentColor;fill:none;stroke-linecap:round;stroke-linejoin:round}
 .icon-sm{width:16px;height:16px}
 .icon-lg{width:24px;height:24px}
-.theme-toggle{position:fixed;top:max(var(--space-4),env(safe-area-inset-top));right:var(--space-4);z-index:50;width:44px;height:44px;display:inline-flex;align-items:center;justify-content:center;border:1px solid var(--color-border);border-radius:var(--radius-full,999px);background:var(--color-overlay);color:var(--color-text);cursor:pointer;backdrop-filter:blur(12px);-webkit-backdrop-filter:blur(12px);box-shadow:var(--shadow-sm);transition:border-color var(--transition),background var(--transition),transform var(--transition)}
-.theme-toggle:hover{border-color:var(--color-border-strong);transform:scale(1.05)}
-.theme-toggle:active{transform:scale(.95)}
+.theme-toggle{position:fixed;top:max(var(--space-4),env(safe-area-inset-top));right:var(--space-4);z-index:50;width:36px;height:36px;display:inline-flex;align-items:center;justify-content:center;border:1px solid var(--color-border);border-radius:var(--radius-sm);background:var(--color-surface);color:var(--color-text-secondary);cursor:pointer;transition:border-color var(--transition),color var(--transition)}
+.theme-toggle:hover{border-color:var(--color-border-strong);color:var(--color-text)}
+.theme-toggle:active{transform:scale(.96)}
 .theme-toggle:focus-visible{outline:none;box-shadow:var(--ring)}
 .theme-toggle .icon-sun{display:none}
 .theme-toggle .icon-moon{display:block}
@@ -713,30 +969,37 @@ a:hover{color:var(--color-primary-hover)}
 [data-theme="dark"] .theme-toggle .icon-moon{display:none}
 @media (prefers-color-scheme:dark){.theme-toggle .icon-sun{display:block}.theme-toggle .icon-moon{display:none}}
 @media (prefers-color-scheme:dark){[data-theme="light"] .theme-toggle .icon-sun{display:none}[data-theme="light"] .theme-toggle .icon-moon{display:block}}
-.hero{display:flex;align-items:flex-end;justify-content:space-between;gap:var(--space-5);margin-bottom:var(--space-5);padding:var(--space-6);border:1px solid var(--color-hero-border);border-radius:var(--radius-xl);background:var(--color-hero-bg);box-shadow:var(--shadow-md)}
+.hero{display:flex;align-items:flex-end;justify-content:space-between;gap:var(--space-5);margin-bottom:var(--space-6);padding:0 0 var(--space-4) 0;border-bottom:1px solid var(--color-border)}
 .hero.compact{display:block;max-width:560px;margin:var(--space-8) auto var(--space-5)}
-.hero-copy{max-width:680px;margin:var(--space-3) 0 0;color:var(--color-text-secondary);font-size:16px;line-height:1.65}
-.eyebrow{margin:0 0 var(--space-2);color:var(--color-primary);font-size:12px;font-weight:600;letter-spacing:.14em;text-transform:uppercase}
-.dashboard-shell{display:grid;grid-template-columns:300px minmax(0,1fr);gap:var(--space-5);align-items:start}
-.sidebar{position:sticky;top:var(--space-5);display:grid;gap:var(--space-4)}
-.card,.config-section{background:var(--color-overlay);border:1px solid var(--color-card-border);border-radius:var(--radius-lg);box-shadow:var(--shadow-md);backdrop-filter:blur(12px);-webkit-backdrop-filter:blur(12px)}
-.card{padding:var(--space-5)}
+.hero-copy{max-width:680px;margin:var(--space-2) 0 0;color:var(--color-text-secondary);font-size:14px;line-height:1.6}
+.back-link{width:max-content;display:inline-flex;align-items:center;gap:var(--space-2);margin:0 0 var(--space-3);padding:5px var(--space-3);border:1px solid var(--color-border);border-radius:999px;background:var(--color-surface);color:var(--color-text-secondary);font-size:13px;font-weight:500;box-shadow:var(--shadow-sm);transition:background var(--transition),border-color var(--transition),color var(--transition),transform var(--transition)}
+.back-link:hover{background:var(--color-surface-2);border-color:var(--color-border-strong);color:var(--color-text)}
+.back-link:active{transform:translateX(-1px)}
+.back-link:focus-visible{outline:none;box-shadow:var(--ring)}
+.eyebrow{margin:0 0 var(--space-1);color:var(--color-text-muted);font-size:12px;font-weight:500;letter-spacing:0;text-transform:none}
+.dashboard-shell{display:grid;grid-template-columns:240px minmax(0,1fr);gap:var(--space-6);align-items:start}
+.sidebar{position:sticky;top:var(--space-5);display:grid;gap:var(--space-3)}
+.card,.config-section{background:var(--color-surface);border:1px solid var(--color-card-border);border-radius:var(--radius-md);box-shadow:var(--shadow-sm)}
+.card{padding:var(--space-4)}
 .config-panel{padding:0;background:transparent;border:0;box-shadow:none}
-.status-card{border-left:4px solid var(--color-primary)}
+.status-card{border-left:2px solid var(--color-border-strong)}
 .status-card .section-heading{display:flex;align-items:center;gap:var(--space-2)}
-.status-card .section-heading .icon{color:var(--color-primary)}
-.setup-card{background:linear-gradient(180deg,var(--color-surface),var(--color-surface-2))}
-.progress-number{font-size:36px;font-weight:700;letter-spacing:-.04em;line-height:1;margin-top:var(--space-1)}
-.progress-track{height:8px;border-radius:999px;background:var(--color-surface-3);overflow:hidden;margin-top:var(--space-3)}
-.progress-track span{display:block;height:100%;border-radius:inherit;background:linear-gradient(90deg,var(--color-primary),var(--color-accent));transition:width 400ms var(--ease-out)}
-.quick-nav{display:grid;gap:var(--space-2)}
-.tab-button{width:100%;border:1px solid var(--color-border);border-radius:var(--radius-md);background:var(--color-surface-2);color:var(--color-text);text-align:left;font-weight:500;font:inherit;font-weight:500;padding:var(--space-3) var(--space-4);cursor:pointer;transition:border-color var(--transition),background var(--transition),color var(--transition),transform var(--transition);position:relative}
-.tab-button:hover{border-color:var(--color-primary);color:var(--color-primary);background:var(--color-primary-soft)}
+.status-card .section-heading .icon{color:var(--color-text-secondary)}
+.setup-card{background:var(--color-surface)}
+.progress-number{font-size:24px;font-weight:700;letter-spacing:-.03em;line-height:1;margin-top:var(--space-1)}
+.progress-track{height:4px;border-radius:999px;background:var(--color-surface-3);overflow:hidden;margin-top:var(--space-2)}
+.progress-track span{display:block;height:100%;border-radius:inherit;background:var(--color-accent);transition:width 300ms var(--ease-out)}
+.quick-nav{display:grid;gap:var(--space-1)}
+.ops-link{display:block;width:100%;border:1px solid transparent;border-radius:var(--radius-sm);background:transparent;color:var(--color-text-secondary);text-align:left;font:inherit;font-weight:500;font-size:13px;padding:var(--space-2) var(--space-3);cursor:pointer;text-decoration:none;transition:background var(--transition),color var(--transition)}
+.ops-link:hover{background:var(--color-surface-2);color:var(--color-text)}
+.ops-link:active{transform:scale(.98)}
+.tab-button{width:100%;border:1px solid transparent;border-radius:var(--radius-sm);background:transparent;color:var(--color-text-secondary);text-align:left;font-weight:500;font:inherit;font-weight:500;font-size:13px;padding:var(--space-2) var(--space-3);cursor:pointer;transition:background var(--transition),color var(--transition);position:relative}
+.tab-button:hover{background:var(--color-surface-2);color:var(--color-text)}
 .tab-button:active{transform:scale(.98)}
-.tab-button.active{border-color:var(--color-primary);color:var(--color-primary);background:var(--color-primary-soft);box-shadow:inset 4px 0 0 var(--color-primary)}
+.tab-button.active{border-color:transparent;color:var(--color-text);background:var(--color-surface-2)}
 .tab-button:focus-visible{outline:none;box-shadow:var(--ring)}
-.config-section{display:none;padding:var(--space-6);border-top:4px solid var(--color-primary)}
-.config-section.active{display:block;animation:fade-in 220ms var(--ease-out)}
+.config-section{display:none;padding:var(--space-5);border-top:0}
+.config-section.active{display:block;animation:fade-in 150ms var(--ease-out)}
 @keyframes fade-in{from{opacity:0;transform:translateY(4px)}to{opacity:1;transform:translateY(0)}}
 @media (prefers-reduced-motion:reduce){.config-section.active{animation:none}.progress-track span,.theme-toggle,.tab-button{transition:none}}
 .section-heading{margin-bottom:var(--space-5)}
@@ -746,49 +1009,50 @@ a:hover{color:var(--color-primary-hover)}
 .field-grid{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:var(--space-5)}
 .field{min-width:0}
 .single-field{max-width:560px}
-.field-note{margin:0 0 var(--space-2);padding:var(--space-3) var(--space-3);border-radius:var(--radius-sm);background:var(--color-surface-2);border:1px solid var(--color-border)}
-label{display:block;margin:0 0 var(--space-2);font-weight:500}
-code{display:inline-block;margin-left:var(--space-1);padding:2px var(--space-2);border-radius:6px;background:var(--color-primary-soft);color:var(--color-primary-soft-text);font-family:var(--font-mono);font-size:12px;font-weight:500}
-input,select{width:100%;border:1px solid var(--color-border-strong);border-radius:var(--radius-sm);padding:11px var(--space-3);font:inherit;background:var(--color-surface);color:var(--color-text);outline:none;transition:border-color var(--transition),box-shadow var(--transition);min-height:44px}
+.field-note{margin:0 0 var(--space-2);padding:var(--space-2) var(--space-3);border-radius:var(--radius-sm);background:var(--color-surface-2);border:1px solid var(--color-border);font-size:13px}
+label{display:block;margin:0 0 var(--space-1);font-weight:500;font-size:13px}
+code{display:inline-block;margin-left:var(--space-1);padding:1px var(--space-1);border-radius:4px;background:var(--color-surface-3);color:var(--color-text-secondary);font-family:var(--font-mono);font-size:11px;font-weight:500}
+input,select{width:100%;border:1px solid var(--color-border);border-radius:var(--radius-sm);padding:8px var(--space-3);font:inherit;font-size:14px;background:var(--color-surface);color:var(--color-text);outline:none;transition:border-color var(--transition),box-shadow var(--transition);min-height:36px}
 input::placeholder{color:var(--color-text-muted)}
-input:hover,select:hover{border-color:var(--color-primary)}
-input:focus,select:focus{border-color:var(--color-primary);box-shadow:var(--ring)}
+input:hover,select:hover{border-color:var(--color-border-strong)}
+input:focus,select:focus{border-color:var(--color-accent);box-shadow:var(--ring)}
 input:disabled,select:disabled{opacity:.5;cursor:not-allowed}
-button[type="submit"],button[type="button"].primary{border:0;border-radius:var(--radius-sm);background:var(--color-primary);color:#fff;font:inherit;font-weight:600;padding:12px var(--space-6);cursor:pointer;box-shadow:0 4px 14px rgba(37,99,235,.28);transition:background var(--transition),transform var(--transition),box-shadow var(--transition);min-height:44px;display:inline-flex;align-items:center;justify-content:center;gap:var(--space-2)}
-button[type="submit"]:hover{background:var(--color-primary-hover);box-shadow:0 6px 20px rgba(37,99,235,.36)}
+button[type="submit"],button[type="button"].primary{border:1px solid var(--color-primary);border-radius:var(--radius-sm);background:var(--color-primary);color:var(--color-bg);font:inherit;font-weight:600;font-size:14px;padding:8px var(--space-5);cursor:pointer;transition:background var(--transition),transform var(--transition);min-height:36px;display:inline-flex;align-items:center;justify-content:center;gap:var(--space-2)}
+button[type="submit"]:hover{background:var(--color-primary-hover)}
 button[type="submit"]:active{transform:scale(.97)}
-button[type="submit"]:focus-visible{outline:none;box-shadow:var(--ring),0 4px 14px rgba(37,99,235,.28)}
-button[type="submit"]:disabled{opacity:.6;cursor:not-allowed;transform:none}
-button[type="submit"] .spinner{width:18px;height:18px;border:2px solid rgba(255,255,255,.4);border-top-color:#fff;border-radius:50%;animation:spin 600ms linear infinite;display:none}
+button[type="submit"]:focus-visible{outline:none;box-shadow:var(--ring)}
+button[type="submit"]:disabled{opacity:.5;cursor:not-allowed;transform:none}
+button[type="submit"] .spinner{width:14px;height:14px;border:2px solid rgba(255,255,255,.3);border-top-color:#fff;border-radius:50%;animation:spin 600ms linear infinite;display:none}
 button[type="submit"][data-loading="true"] .spinner{display:inline-block}
 button[type="submit"][data-loading="true"] .btn-label{opacity:.85}
 @keyframes spin{to{transform:rotate(360deg)}}
-.form-actions{position:sticky;bottom:var(--space-4);display:flex;align-items:center;justify-content:space-between;gap:var(--space-4);padding:var(--space-4) var(--space-5);margin-top:var(--space-4);border:1px solid var(--color-card-border);border-radius:var(--radius-lg);background:var(--color-overlay);box-shadow:var(--shadow-lg);backdrop-filter:blur(14px);-webkit-backdrop-filter:blur(14px)}
-.form-actions strong{display:block;margin-bottom:var(--space-1);font-weight:600}
-.banner{display:flex;align-items:flex-start;gap:var(--space-3);border-radius:var(--radius-md);padding:var(--space-3) var(--space-4);margin:0 0 var(--space-4);font-weight:500;line-height:1.55}
-.banner .icon{flex-shrink:0;margin-top:1px}
+.form-actions{position:sticky;bottom:var(--space-3);display:flex;align-items:center;justify-content:space-between;gap:var(--space-4);padding:var(--space-3) var(--space-4);margin-top:var(--space-4);border:1px solid var(--color-border);border-radius:var(--radius-md);background:var(--color-surface);box-shadow:var(--shadow-md)}
+.form-actions strong{display:block;margin-bottom:var(--space-1);font-weight:600;font-size:14px}
+.banner{display:flex;align-items:flex-start;gap:var(--space-2);border-radius:var(--radius-sm);padding:var(--space-2) var(--space-3);margin:0 0 var(--space-3);font-weight:500;line-height:1.5;font-size:13px}
+.banner .icon{flex-shrink:0;margin-top:1px;width:16px;height:16px}
 .banner.success{background:var(--color-ok-soft);color:var(--color-ok);border:1px solid var(--color-ok-border)}
 .banner.danger{background:var(--color-danger-soft);color:var(--color-danger);border:1px solid var(--color-danger-border)}
-.status-pill{display:inline-flex;align-items:center;gap:var(--space-2);white-space:nowrap;border-radius:999px;padding:8px var(--space-4);font-weight:600;font-size:14px}
-.status-pill .dot{width:8px;height:8px;border-radius:50%;flex-shrink:0}
+.status-pill{display:inline-flex;align-items:center;gap:var(--space-2);white-space:nowrap;border-radius:999px;padding:4px var(--space-3);font-weight:500;font-size:13px}
+.status-pill .dot{width:6px;height:6px;border-radius:50%;flex-shrink:0}
 .status-pill.ok{color:var(--color-ok);background:var(--color-ok-soft);border:1px solid var(--color-ok-border)}
-.status-pill.ok .dot{background:var(--color-ok);box-shadow:0 0 0 3px var(--color-ok-soft)}
+.status-pill.ok .dot{background:var(--color-ok)}
 .status-pill.warn{color:var(--color-warn);background:var(--color-warn-soft);border:1px solid var(--color-warn-border)}
-.status-pill.warn .dot{background:var(--color-warn);box-shadow:0 0 0 3px var(--color-warn-soft)}
-.issue-list{display:grid;gap:var(--space-2);margin:0;padding:0;list-style:none}
-.issue-list li{display:flex;gap:var(--space-3);padding:var(--space-3) var(--space-4);border-radius:var(--radius-md);background:var(--color-warn-soft);border:1px solid var(--color-warn-border);color:var(--color-text)}
-.issue-list li .icon{color:var(--color-warn);flex-shrink:0;margin-top:1px}
+.status-pill.warn .dot{background:var(--color-warn)}
+.issue-list{display:grid;gap:var(--space-1);margin:0;padding:0;list-style:none}
+.issue-list li{display:flex;gap:var(--space-2);padding:var(--space-2) var(--space-3);border-radius:var(--radius-sm);background:var(--color-warn-soft);border:1px solid var(--color-warn-border);color:var(--color-text);font-size:13px}
+.issue-list li .icon{color:var(--color-warn);flex-shrink:0;margin-top:1px;width:16px;height:16px}
 .issue-list li .issue-content{flex:1;min-width:0}
-.issue-list span{display:block;margin-top:var(--space-1);color:var(--color-text-muted);font-size:12px;font-family:var(--font-mono);word-break:break-all}
-.login-card{max-width:560px;margin:0 auto}
+.issue-list span{display:block;margin-top:var(--space-1);color:var(--color-text-muted);font-size:11px;font-family:var(--font-mono);word-break:break-all}
+.login-card{max-width:400px;margin:0 auto}
 .login-card button[type="submit"]{width:100%}
-footer{color:var(--color-text-muted);font-size:12px;margin-top:var(--space-6);text-align:center;font-family:var(--font-mono)}
-@media (max-width:1024px){.dashboard-shell{grid-template-columns:260px minmax(0,1fr)}}
-@media (max-width:980px){main{padding:var(--space-6) var(--space-4) var(--space-7)}.dashboard-shell{grid-template-columns:1fr}.sidebar{position:static;grid-template-columns:repeat(2,minmax(0,1fr))}.quick-nav{grid-column:1/-1;display:flex;overflow-x:auto;padding-bottom:var(--space-1);scroll-snap-type:x mandatory}.tab-button{min-width:140px;scroll-snap-align:start;text-align:center}.tab-button.active{box-shadow:inset 0 -3px 0 var(--color-primary)}.config-section{padding:var(--space-5)}}
+footer{color:var(--color-text-muted);font-size:11px;margin-top:var(--space-6);text-align:center;font-family:var(--font-mono)}
+@media (max-width:1024px){.dashboard-shell{grid-template-columns:200px minmax(0,1fr)}}
+@media (max-width:980px){main{padding:var(--space-6) var(--space-4) var(--space-7)}.dashboard-shell{grid-template-columns:1fr}.sidebar{position:static;grid-template-columns:repeat(2,minmax(0,1fr))}.quick-nav{grid-column:1/-1;display:flex;overflow-x:auto;padding-bottom:var(--space-1);scroll-snap-type:x mandatory}.tab-button{min-width:120px;scroll-snap-align:start;text-align:center}.tab-button.active{box-shadow:inset 0 -2px 0 var(--color-accent)}.config-section{padding:var(--space-4)}}
 @media (max-width:640px){h1{font-size:28px}.hero{display:block;padding:var(--space-5);border-radius:var(--radius-lg)}.status-pill{display:inline-flex;margin-top:var(--space-4)}.sidebar{grid-template-columns:1fr}.field-grid{grid-template-columns:1fr}.config-section,.card{border-radius:var(--radius-md);padding:var(--space-4)}.split-heading{display:block}.section-badge{display:inline-block;margin-top:var(--space-2)}.form-actions{display:block;padding:var(--space-4)}.form-actions button[type="submit"]{width:100%;margin-top:var(--space-3)}code{display:block;width:max-content;margin:var(--space-1) 0 0}}
 .skip-link{position:absolute;left:-9999px;top:0;z-index:100;padding:var(--space-3) var(--space-4);background:var(--color-primary);color:#fff;border-radius:0 0 var(--radius-sm) 0;font-weight:600}
 .skip-link:focus{left:0}
 .sr-only{position:absolute;width:1px;height:1px;padding:0;margin:-1px;overflow:hidden;clip:rect(0,0,0,0);white-space:nowrap;border:0}
+${opsExtraCss}
   </style></head><body><a href="#main-content" class="skip-link">跳到主要内容</a><button type="button" class="theme-toggle" aria-label="切换主题" title="切换浅色/暗色模式" onclick="toggleTheme()"><svg class="icon icon-sun" viewBox="0 0 24 24" aria-hidden="true"><circle cx="12" cy="12" r="4"/><path d="M12 2v2M12 20v2M4.93 4.93l1.41 1.41M17.66 17.66l1.41 1.41M2 12h2M20 12h2M6.34 17.66l-1.41 1.41M19.07 4.93l-1.41 1.41"/></svg><svg class="icon icon-moon" viewBox="0 0 24 24" aria-hidden="true"><path d="M21 12.79A9 9 0 1 1 11.21 3 7 7 0 0 0 21 12.79z"/></svg></button><main id="main-content">${body}<footer>InboxBridge ${fingerprint}</footer></main><script>
     (function(){
       try{
@@ -805,13 +1069,6 @@ footer{color:var(--color-text-muted);font-size:12px;margin-top:var(--space-6);te
         try{localStorage.setItem("ib-theme",next)}catch(e){}
       };
     })();
-    document.querySelectorAll('[data-tab]').forEach(function(button){
-      button.addEventListener('click',function(){
-        var target=button.getAttribute('data-tab');
-        document.querySelectorAll('[data-tab]').forEach(function(item){item.classList.toggle('active',item===button);item.setAttribute('aria-selected',item===button?'true':'false')});
-        document.querySelectorAll('[data-panel]').forEach(function(panel){panel.classList.toggle('active',panel.getAttribute('data-panel')===target);panel.setAttribute('aria-hidden',panel.getAttribute('data-panel')===target?'false':'true')});
-      });
-    });
     var form=document.querySelector('form[action="/config"]');
     if(form){
       form.addEventListener('submit',function(){
@@ -826,64 +1083,50 @@ function escapeHtml(value: string): string {
   return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
 }
 
-const opsBaseCss = `
-:root{color-scheme:light dark;--font-sans:"Fira Sans",ui-sans-serif,system-ui,-apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif;--font-mono:"Fira Code",ui-monospace,SFMono-Regular,Menlo,monospace}
-@media (prefers-color-scheme:light){:root{--color-bg:#f6f8fc;--color-surface:#ffffff;--color-surface-2:#f8fafc;--color-border:#e2e8f0;--color-text:#0f172a;--color-text-secondary:#475569;--color-text-muted:#94a3b8;--color-primary:#2563eb;--color-ok:#059669;--color-warn:#d97706;--color-danger:#dc2626;--shadow-md:0 8px 24px rgba(15,23,42,.08)}}
-@media (prefers-color-scheme:dark){:root{--color-bg:#0b1220;--color-surface:#111a2e;--color-surface-2:#0e1626;--color-border:#1f2a40;--color-text:#f1f5f9;--color-text-secondary:#94a3b8;--color-text-muted:#64748b;--color-primary:#3b82f6;--color-ok:#10b981;--color-warn:#f59e0b;--color-danger:#ef4444;--shadow-md:0 8px 24px rgba(0,0,0,.3)}}
-*{box-sizing:border-box}
-body{margin:0;font-family:var(--font-sans);background:var(--color-bg);color:var(--color-text);line-height:1.6}
-.ops-header{display:flex;gap:16px;align-items:center;padding:12px 24px;border-bottom:1px solid var(--color-border);background:var(--color-surface)}
-.ops-header a{color:var(--color-text-secondary);text-decoration:none;font-size:14px;font-weight:500;padding:6px 12px;border-radius:8px;transition:all 160ms}
-.ops-header a:hover{background:var(--color-surface-2);color:var(--color-text)}
-.ops-header a.active{color:var(--color-primary);background:rgba(37,99,235,.08)}
-.ops-main{max-width:1240px;margin:0 auto;padding:24px}
-.ops-grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(260px,1fr));gap:16px;margin-bottom:32px}
-.ops-card{background:var(--color-surface);border:1px solid var(--color-border);border-radius:16px;padding:20px;box-shadow:var(--shadow-md)}
-.ops-card h3{margin:0 0 12px;font-size:14px;color:var(--color-text-secondary);text-transform:uppercase;letter-spacing:.05em}
-.ops-metric{display:flex;justify-content:space-between;align-items:center;padding:6px 0;font-size:15px}
-.ops-metric .label{color:var(--color-text-secondary)}
-.ops-metric .value{font-family:var(--font-mono);font-weight:600;font-size:18px}
+const opsExtraCss = `
+.ops-topnav{display:flex;gap:var(--space-1);align-items:center;flex-wrap:wrap;margin-bottom:var(--space-5);padding:0 0 var(--space-3) 0;border-bottom:1px solid var(--color-border)}
+.ops-nav-link{color:var(--color-text-secondary);text-decoration:none;font-size:13px;font-weight:500;padding:6px var(--space-3);border-radius:var(--radius-sm);transition:background var(--transition),color var(--transition)}
+.ops-nav-link:hover{background:var(--color-surface-2);color:var(--color-text)}
+.ops-nav-link.active{color:var(--color-text);background:var(--color-surface-2)}
+.ops-nav-sep{color:var(--color-border-strong);margin:0 var(--space-1)}
+.ops-link.active{color:var(--color-text);background:var(--color-surface-2)}
+.ops-grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(220px,1fr));gap:var(--space-3);margin-bottom:var(--space-6)}
+.ops-card{background:var(--color-surface);border:1px solid var(--color-border);border-radius:var(--radius-md);padding:var(--space-4)}
+.ops-card h3{margin:0 0 var(--space-3);font-size:11px;color:var(--color-text-muted);text-transform:uppercase;letter-spacing:.05em;font-weight:500}
+.ops-metric{display:flex;justify-content:space-between;align-items:center;padding:4px 0;font-size:13px}
+.ops-metric .label{color:var(--color-text-secondary);font-family:var(--font-mono)}
+.ops-metric .value{font-family:var(--font-mono);font-weight:600;font-size:15px}
 .ops-metric .value.ok{color:var(--color-ok)}
 .ops-metric .value.warn{color:var(--color-warn)}
 .ops-metric .value.danger{color:var(--color-danger)}
-.ops-banner{padding:12px 16px;border-radius:12px;margin-bottom:16px;font-size:14px}
-.ops-banner.success{background:rgba(5,150,105,.1);color:var(--color-ok);border:1px solid rgba(5,150,105,.2)}
-.ops-table{width:100%;border-collapse:collapse;font-size:14px}
-.ops-table th{text-align:left;padding:10px 12px;border-bottom:2px solid var(--color-border);color:var(--color-text-secondary);font-weight:600;font-size:13px;text-transform:uppercase;letter-spacing:.03em}
-.ops-table td{padding:10px 12px;border-bottom:1px solid var(--color-border)}
+.ops-table{width:100%;border-collapse:collapse;font-size:13px;background:var(--color-surface);border:1px solid var(--color-border);border-radius:var(--radius-md);overflow:hidden}
+.ops-table th{text-align:left;padding:var(--space-2) var(--space-3);border-bottom:1px solid var(--color-border);color:var(--color-text-muted);font-weight:500;font-size:12px;background:var(--color-surface-2)}
+.ops-table td{padding:var(--space-2) var(--space-3);border-bottom:1px solid var(--color-border)}
+.ops-table tr:last-child td{border-bottom:0}
 .ops-table tr:hover td{background:var(--color-surface-2)}
-.ops-badge{display:inline-block;padding:2px 8px;border-radius:6px;font-size:12px;font-weight:600}
-.ops-badge.open{background:rgba(5,150,105,.12);color:var(--color-ok)}
-.ops-badge.closed{background:rgba(148,163,184,.12);color:var(--color-text-muted)}
-.ops-badge.failed{background:rgba(217,119,6,.12);color:var(--color-warn)}
-.ops-badge.permanent_failure{background:rgba(220,38,38,.12);color:var(--color-danger)}
-.ops-btn{padding:4px 12px;border:1px solid var(--color-primary);background:transparent;color:var(--color-primary);border-radius:6px;cursor:pointer;font-size:13px;font-family:inherit}
-.ops-btn:hover{background:rgba(37,99,235,.08)}
-.ops-pager{display:flex;gap:8px;justify-content:center;margin-top:16px}
-.ops-pager a{padding:6px 12px;border:1px solid var(--color-border);border-radius:8px;text-decoration:none;color:var(--color-text-secondary);font-size:14px}
+.ops-badge{display:inline-block;padding:1px var(--space-2);border-radius:4px;font-size:11px;font-weight:500;font-family:var(--font-mono)}
+.ops-badge.open{background:var(--color-ok-soft);color:var(--color-ok)}
+.ops-badge.closed{background:var(--color-surface-3);color:var(--color-text-muted)}
+.ops-badge.failed{background:var(--color-warn-soft);color:var(--color-warn)}
+.ops-badge.permanent_failure{background:var(--color-danger-soft);color:var(--color-danger)}
+.ops-badge.sent,.ops-badge.ready{background:var(--color-ok-soft);color:var(--color-ok)}
+.ops-badge.pending{background:var(--color-warn-soft);color:var(--color-warn)}
+.ops-btn{padding:3px var(--space-2);border:1px solid var(--color-border-strong);background:transparent;color:var(--color-text-secondary);border-radius:var(--radius-sm);cursor:pointer;font-size:12px;font-family:inherit;transition:background var(--transition),color var(--transition)}
+.ops-btn:hover{background:var(--color-surface-2);color:var(--color-text)}
+.ops-pager{display:flex;gap:var(--space-1);justify-content:center;margin-top:var(--space-4)}
+.ops-pager a{padding:4px var(--space-2);border:1px solid var(--color-border);border-radius:var(--radius-sm);text-decoration:none;color:var(--color-text-secondary);font-size:13px;font-family:var(--font-mono)}
 .ops-pager a:hover{background:var(--color-surface-2)}
-.ops-pager .current{background:var(--color-primary);color:#fff;border-color:var(--color-primary)}
-.ops-empty{text-align:center;padding:40px;color:var(--color-text-muted);font-size:15px}
-.ops-section-title{font-size:20px;font-weight:600;margin:0 0 16px}
+.ops-pager .current{background:var(--color-primary);color:var(--color-bg);border-color:var(--color-primary)}
+.ops-empty{text-align:center;padding:var(--space-8);color:var(--color-text-muted);font-size:13px}
+.ops-filter-form{display:flex;gap:var(--space-2);margin-bottom:var(--space-3);align-items:flex-end;flex-wrap:wrap}
+.ops-filter-form label{font-size:11px;color:var(--color-text-muted);display:block;margin-bottom:var(--space-1)}
+.ops-filter-form input,.ops-filter-form select{padding:6px var(--space-2);border:1px solid var(--color-border);border-radius:var(--radius-sm);background:var(--color-surface);color:var(--color-text);font:inherit;font-size:13px;min-height:32px}
+.ops-uptime{color:var(--color-text-muted);font-size:13px;margin-top:var(--space-4)}
 `;
 
-function opsPage(title: string, body: string, activeNav: "overview" | "conversations" | "deliveries" | "audit" | "search"): string {
-  return `<!doctype html><html lang="zh-CN"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${escapeHtml(title)}</title><style>${opsBaseCss}</style></head><body>
-<header class="ops-header">
-<a href="/">配置</a>
-<a href="/operations" class="${activeNav === "overview" ? "active" : ""}">概览</a>
-<a href="/operations/conversations" class="${activeNav === "conversations" ? "active" : ""}">会话</a>
-<a href="/operations/deliveries" class="${activeNav === "deliveries" ? "active" : ""}">投递</a>
-<a href="/operations/audit" class="${activeNav === "audit" ? "active" : ""}">审计</a>
-<a href="/operations/search" class="${activeNav === "search" ? "active" : ""}">搜索</a>
-</header>
-<main class="ops-main">${body}</main>
-</body></html>`;
-}
-
-function renderOperationsOverview(res: ServerResponse, data: OperationsOverview, showRetryBanner: boolean): void {
-  const banner = showRetryBanner ? `<div class="ops-banner success">投递已加入重试队列，将在下次扫描时重试。</div>` : "";
-  const body = `
+function renderOperationsOverviewBody(data: OperationsOverview, showRetryBanner: boolean): string {
+  const banner = showRetryBanner ? `<div class="banner success"><svg class="icon" viewBox="0 0 24 24" aria-hidden="true"><path d="M22 11.08V12a10 10 0 1 1-5.93-9.14"/><path d="M22 4 12 14.01l-3-3"/></svg><span>投递已加入重试队列，将在下次扫描时重试。</span></div>` : "";
+  return `
     ${banner}
     <div class="ops-grid">
       <div class="ops-card"><h3>消息总量</h3>
@@ -909,40 +1152,33 @@ function renderOperationsOverview(res: ServerResponse, data: OperationsOverview,
         <div class="ops-metric"><span class="label">discarded</span><span class="value">${data.aiDrafts.discarded}</span></div>
       </div>
     </div>
-    <p style="color:var(--color-text-muted);font-size:13px">进程运行时长：${Math.floor(data.uptimeSeconds / 3600)}h ${Math.floor((data.uptimeSeconds % 3600) / 60)}m</p>
+    <p class="ops-uptime">进程运行时长：${Math.floor(data.uptimeSeconds / 3600)}h ${Math.floor((data.uptimeSeconds % 3600) / 60)}m</p>
   `;
-  send(res, 200, "text/html; charset=utf-8", opsPage("运维概览 - InboxBridge", body, "overview"));
 }
 
-function renderConversations(
-  res: ServerResponse,
+function renderConversationsBody(
   data: { items: ConversationListItemView[]; total: number },
   page: number,
   status: string | undefined,
   assignedTo: string | undefined,
-): void {
+): string {
   const pageSize = 50;
   const totalPages = Math.max(1, Math.ceil(data.total / pageSize));
+  const buildTabUrl = (params: Record<string, string | undefined>): string => {
+    const sp = new URLSearchParams();
+    for (const [k, v] of Object.entries(params)) if (v) sp.set(k, v);
+    const qs = sp.toString();
+    return `/operations/conversations${qs ? `?${qs}` : ""}`;
+  };
   const filterLinks = ["", "open", "closed"]
     .map((s) => {
       const label = s === "" ? "全部" : s === "open" ? "open" : "closed";
       const active = (status ?? "") === s ? "current" : "";
-      const params = new URLSearchParams();
-      if (s) params.set("status", s);
-      if (assignedTo) params.set("assigned_to", assignedTo);
-      const qs = params.toString();
-      return `<a href="/operations/conversations${qs ? `?${qs}` : ""}" class="${active}">${label}</a>`;
+      return `<a href="${buildTabUrl({ status: s || undefined, assigned_to: assignedTo })}" class="${active}">${label}</a>`;
     })
     .join("");
   const assignedValue = assignedTo ? escapeHtml(assignedTo) : "";
-  const buildQs = (p: number): string => {
-    const params = new URLSearchParams();
-    if (status) params.set("status", status);
-    if (assignedTo) params.set("assigned_to", assignedTo);
-    if (p > 1) params.set("page", String(p));
-    const qs = params.toString();
-    return qs ? `?${qs}` : "";
-  };
+  const buildPageUrl = (p: number): string => buildTabUrl({ status, assigned_to: assignedTo, page: p > 1 ? String(p) : undefined });
   const rows = data.items.length
     ? data.items
         .map(
@@ -959,13 +1195,13 @@ function renderConversations(
         .join("")
     : `<tr><td colspan="7" class="ops-empty">没有符合条件的会话。</td></tr>`;
   const pager = Array.from({ length: Math.min(totalPages, 10) }, (_, i) => i + 1)
-    .map((p) => `<a href="/operations/conversations${buildQs(p)}" class="${p === page ? "current" : ""}">${p}</a>`)
+    .map((p) => `<a href="${buildPageUrl(p)}" class="${p === page ? "current" : ""}">${p}</a>`)
     .join("");
-  const body = `
-    <h2 class="ops-section-title">会话列表 (${data.total})</h2>
-    <div class="ops-pager" style="justify-content:flex-start;margin-bottom:16px">${filterLinks}</div>
-    <form method="get" action="/operations/conversations" style="display:flex;gap:12px;margin-bottom:16px;align-items:flex-end">
-      <div><label style="font-size:12px;color:var(--color-text-secondary)">负责人 ID</label><br><input type="text" name="assigned_to" value="${assignedValue}" placeholder="可选" style="padding:6px 10px;border:1px solid var(--color-border);border-radius:8px"></div>
+  return `
+    <h2>会话列表 <span style="color:var(--color-text-muted);font-weight:400">(${data.total})</span></h2>
+    <div class="ops-pager" style="justify-content:flex-start;margin-bottom:var(--space-4)">${filterLinks}</div>
+    <form method="get" action="/operations/conversations" class="ops-filter-form">
+      <div><label>负责人 ID</label><input type="text" name="assigned_to" value="${assignedValue}" placeholder="可选"></div>
       <button type="submit" class="ops-btn">筛选</button>
     </form>
     <table class="ops-table">
@@ -974,14 +1210,12 @@ function renderConversations(
     </table>
     ${totalPages > 1 ? `<div class="ops-pager">${pager}</div>` : ""}
   `;
-  send(res, 200, "text/html; charset=utf-8", opsPage("会话列表 - InboxBridge", body, "conversations"));
 }
 
-function renderDeliveries(
-  res: ServerResponse,
+function renderDeliveriesBody(
   data: { items: DeliveryView[]; total: number },
   page: number,
-): void {
+): string {
   const pageSize = 50;
   const totalPages = Math.max(1, Math.ceil(data.total / pageSize));
   const rows = data.items.length
@@ -1003,37 +1237,35 @@ function renderDeliveries(
   const pager = Array.from({ length: Math.min(totalPages, 10) }, (_, i) => i + 1)
     .map((p) => `<a href="/operations/deliveries?page=${p}" class="${p === page ? "current" : ""}">${p}</a>`)
     .join("");
-  const body = `
-    <h2 class="ops-section-title">失败投递队列 (${data.total})</h2>
+  return `
+    <h2>失败投递队列 <span style="color:var(--color-text-muted);font-weight:400">(${data.total})</span></h2>
     <table class="ops-table">
       <thead><tr><th>ID</th><th>目标</th><th>状态</th><th>尝试</th><th>最后错误</th><th>创建时间</th><th>下次重试</th><th>操作</th></tr></thead>
       <tbody>${rows}</tbody>
     </table>
     ${totalPages > 1 ? `<div class="ops-pager">${pager}</div>` : ""}
   `;
-  send(res, 200, "text/html; charset=utf-8", opsPage("投递队列 - InboxBridge", body, "deliveries"));
 }
 
-function renderAuditLogs(
-  res: ServerResponse,
+function renderAuditLogsBody(
   data: { items: AuditLogView[]; total: number },
   page: number,
   adminId: string | undefined,
   action: string | undefined,
-): void {
+): string {
   const pageSize = 50;
   const totalPages = Math.max(1, Math.ceil(data.total / pageSize));
   const actionOptions = auditActionOptions
     .map((a) => `<option value="${a}" ${action === a ? "selected" : ""}>${a}</option>`)
     .join("");
   const adminValue = adminId ? escapeHtml(adminId) : "";
-  const buildQs = (p: number): string => {
-    const params = new URLSearchParams();
-    if (p > 1) params.set("page", String(p));
-    if (adminId) params.set("admin_id", adminId);
-    if (action) params.set("action", action);
-    const qs = params.toString();
-    return qs ? `?${qs}` : "";
+  const buildTabUrl = (p: number): string => {
+    const sp = new URLSearchParams({ tab: "audit" });
+    if (p > 1) sp.set("page", String(p));
+    if (adminId) sp.set("admin_id", adminId);
+    if (action) sp.set("action", action);
+    const qs = sp.toString();
+    return `/operations/audit${qs ? `?${qs}` : ""}`;
   };
   const rows = data.items.length
     ? data.items
@@ -1050,13 +1282,13 @@ function renderAuditLogs(
         .join("")
     : `<tr><td colspan="6" class="ops-empty">没有符合条件的审计记录。</td></tr>`;
   const pager = Array.from({ length: Math.min(totalPages, 10) }, (_, i) => i + 1)
-    .map((p) => `<a href="/operations/audit${buildQs(p)}" class="${p === page ? "current" : ""}">${p}</a>`)
+    .map((p) => `<a href="${buildTabUrl(p)}" class="${p === page ? "current" : ""}">${p}</a>`)
     .join("");
-  const body = `
-    <h2 class="ops-section-title">审计日志 (${data.total})</h2>
-    <form method="get" action="/operations/audit" class="ops-filter-form" style="display:flex;gap:12px;margin-bottom:16px;align-items:flex-end">
-      <div><label style="font-size:12px;color:var(--color-text-secondary)">管理员 ID</label><br><input type="text" name="admin_id" value="${adminValue}" placeholder="可选" style="padding:6px 10px;border:1px solid var(--color-border);border-radius:8px"></div>
-      <div><label style="font-size:12px;color:var(--color-text-secondary)">操作类型</label><br><select name="action" style="padding:6px 10px;border:1px solid var(--color-border);border-radius:8px"><option value="">全部</option>${actionOptions}</select></div>
+  return `
+    <h2>审计日志 <span style="color:var(--color-text-muted);font-weight:400">(${data.total})</span></h2>
+    <form method="get" action="/operations/audit" class="ops-filter-form">
+      <div><label>管理员 ID</label><input type="text" name="admin_id" value="${adminValue}" placeholder="可选"></div>
+      <div><label>操作类型</label><select name="action"><option value="">全部</option>${actionOptions}</select></div>
       <button type="submit" class="ops-btn">筛选</button>
     </form>
     <table class="ops-table">
@@ -1065,24 +1297,22 @@ function renderAuditLogs(
     </table>
     ${totalPages > 1 ? `<div class="ops-pager">${pager}</div>` : ""}
   `;
-  send(res, 200, "text/html; charset=utf-8", opsPage("审计日志 - InboxBridge", body, "audit"));
 }
 
-function renderSearch(
-  res: ServerResponse,
+function renderSearchBody(
   data: { items: MessageSearchView[]; total: number },
   query: string,
   page: number,
-): void {
+): string {
   const pageSize = 50;
   const totalPages = Math.max(1, Math.ceil(data.total / pageSize));
   const queryValue = escapeHtml(query);
-  const buildQs = (p: number): string => {
-    const params = new URLSearchParams();
-    if (query) params.set("q", query);
-    if (p > 1) params.set("page", String(p));
-    const qs = params.toString();
-    return qs ? `?${qs}` : "";
+  const buildTabUrl = (p: number): string => {
+    const sp = new URLSearchParams();
+    if (query) sp.set("q", query);
+    if (p > 1) sp.set("page", String(p));
+    const qs = sp.toString();
+    return `/operations/search${qs ? `?${qs}` : ""}`;
   };
   const rows = data.items.length
     ? data.items
@@ -1102,12 +1332,12 @@ function renderSearch(
       ? `<tr><td colspan="7" class="ops-empty">未找到匹配的消息。</td></tr>`
       : `<tr><td colspan="7" class="ops-empty">输入关键词开始搜索。</td></tr>`;
   const pager = Array.from({ length: Math.min(totalPages, 10) }, (_, i) => i + 1)
-    .map((p) => `<a href="/operations/search${buildQs(p)}" class="${p === page ? "current" : ""}">${p}</a>`)
+    .map((p) => `<a href="${buildTabUrl(p)}" class="${p === page ? "current" : ""}">${p}</a>`)
     .join("");
-  const body = `
-    <h2 class="ops-section-title">消息搜索${query.trim() ? ` (${data.total})` : ""}</h2>
-    <form method="get" action="/operations/search" style="display:flex;gap:12px;margin-bottom:16px">
-      <input type="text" name="q" value="${queryValue}" placeholder="搜索消息内容..." style="flex:1;padding:8px 12px;border:1px solid var(--color-border);border-radius:8px">
+  return `
+    <h2>消息搜索${query.trim() ? ` <span style="color:var(--color-text-muted);font-weight:400">(${data.total})</span>` : ""}</h2>
+    <form method="get" action="/operations/search" class="ops-filter-form" style="align-items:center">
+      <input type="text" name="q" value="${queryValue}" placeholder="搜索消息内容..." style="flex:1;min-width:240px">
       <button type="submit" class="ops-btn">搜索</button>
     </form>
     <table class="ops-table">
@@ -1116,7 +1346,6 @@ function renderSearch(
     </table>
     ${totalPages > 1 ? `<div class="ops-pager">${pager}</div>` : ""}
   `;
-  send(res, 200, "text/html; charset=utf-8", opsPage("消息搜索 - InboxBridge", body, "search"));
 }
 
 function redirect(res: ServerResponse, location: string): void {
diff --git a/src/runtime/worker.ts b/src/runtime/worker.ts
new file mode 100644
index 0000000..db54de6
--- /dev/null
+++ b/src/runtime/worker.ts
@@ -0,0 +1,116 @@
+import type { Bot } from "grammy";
+import type { Logger } from "pino";
+import { createTelegramBot as defaultCreateTelegramBot } from "../channels/telegram/factory.js";
+import { createWorkerTelegramWebhookHandler, type WorkerTelegramWebhookHandler } from "../channels/telegram/worker-webhook.js";
+import { telegramWebhookSecret } from "../channels/telegram/secrets.js";
+import { AppSettingsService } from "../domain/app-settings.js";
+import type { Database } from "../ports/database.js";
+import { D1DatabaseAdapter, type D1DatabaseBinding } from "../storage/d1.js";
+import { migrate } from "../storage/migrations/0001_initial.js";
+import { loadConfigFromSources, type AppConfig, type ConfigMap } from "./config.js";
+import { runMaintenanceJobs as defaultRunMaintenanceJobs, type MaintenanceJobsInput, type MaintenanceJobSummary } from "./maintenance.js";
+
+export interface WorkerEnv {
+  DB: D1DatabaseBinding;
+  [key: string]: D1DatabaseBinding | string | undefined;
+}
+
+export function workerEnvToConfigMap(env: WorkerEnv): ConfigMap {
+  const config: ConfigMap = {};
+  for (const [key, value] of Object.entries(env)) {
+    if (typeof value === "string") config[key] = value;
+  }
+  return config;
+}
+
+export interface WorkerRuntimeOptions {
+  telegramWebhookHandler?: WorkerTelegramWebhookHandler;
+  createTelegramBot?: (config: AppConfig, db: Database, logger: Logger) => Bot;
+  createTelegramWebhookHandler?: (bot: Bot, expectedSecret: string) => WorkerTelegramWebhookHandler;
+  runMaintenanceJobs?: (input: MaintenanceJobsInput) => Promise<MaintenanceJobSummary>;
+  logger?: Logger;
+}
+
+export interface WorkerScheduledController {
+  cron: string;
+  scheduledTime: number;
+}
+
+export interface WorkerExecutionContext {
+  waitUntil(promise: Promise<unknown>): void;
+}
+
+export async function handleWorkerFetch(request: Request, env: WorkerEnv, options: WorkerRuntimeOptions = {}): Promise<Response> {
+  const db = new D1DatabaseAdapter(env.DB);
+  await migrate(db);
+
+  const url = new URL(request.url);
+  if (url.pathname === "/healthz") {
+    await db.prepare("SELECT 1").get();
+    return json({ status: "ok", database: "reachable" });
+  }
+
+  if (url.pathname === "/telegram/webhook") {
+    const handler = options.telegramWebhookHandler ?? (await createDefaultTelegramWebhookHandler(db, env, options));
+    return handler(request);
+  }
+
+  return json({ error: "not_found" }, { status: 404 });
+}
+
+export async function handleWorkerScheduled(
+  _controller: WorkerScheduledController,
+  env: WorkerEnv,
+  _ctx: WorkerExecutionContext,
+  options: WorkerRuntimeOptions = {},
+): Promise<void> {
+  const db = new D1DatabaseAdapter(env.DB);
+  await migrate(db);
+  const settings = new AppSettingsService(db);
+  const config = loadConfigFromSources(await settings.all(), workerEnvToConfigMap(env));
+  const logger = options.logger ?? createWorkerLogger();
+  const bot = (options.createTelegramBot ?? defaultCreateTelegramBot)(config, db, logger);
+  const summary = await (options.runMaintenanceJobs ?? defaultRunMaintenanceJobs)({
+    api: bot.api,
+    db,
+    config,
+    logger,
+  });
+  logger.info(summary, "Worker scheduled maintenance completed.");
+}
+
+async function createDefaultTelegramWebhookHandler(
+  db: Database,
+  env: WorkerEnv,
+  options: WorkerRuntimeOptions,
+): Promise<WorkerTelegramWebhookHandler> {
+  const settings = new AppSettingsService(db);
+  const config = loadConfigFromSources(await settings.all(), workerEnvToConfigMap(env));
+  const logger = options.logger ?? createWorkerLogger();
+  const bot = (options.createTelegramBot ?? defaultCreateTelegramBot)(config, db, logger);
+  return (options.createTelegramWebhookHandler ?? createWorkerTelegramWebhookHandler)(bot, await telegramWebhookSecret(config));
+}
+
+function createWorkerLogger(): Logger {
+  const logger = {
+    child: () => logger,
+    debug: console.debug,
+    info: console.info,
+    warn: console.warn,
+    error: console.error,
+  };
+  return logger as unknown as Logger;
+}
+
+function json(body: unknown, init?: ResponseInit): Response {
+  const headers = new Headers(init?.headers);
+  headers.set("content-type", "application/json; charset=utf-8");
+  return new Response(JSON.stringify(body), { ...init, headers });
+}
+
+export default {
+  fetch: handleWorkerFetch,
+  scheduled(controller: WorkerScheduledController, env: WorkerEnv, ctx: WorkerExecutionContext) {
+    ctx.waitUntil(handleWorkerScheduled(controller, env, ctx));
+  },
+};
diff --git a/src/storage/client.ts b/src/storage/client.ts
index 02b5d67..303a212 100644
--- a/src/storage/client.ts
+++ b/src/storage/client.ts
@@ -1,22 +1,54 @@
 import { mkdirSync } from "node:fs";
 import { dirname } from "node:path";
-import { DatabaseSync } from "node:sqlite";
-
-export type Database = DatabaseSync;
+import { DatabaseSync, type StatementSync } from "node:sqlite";
+import type { ClosableDatabase, Database, PreparedStatement, SqlValue, StatementResult } from "../ports/database.js";
 
 export interface DbHandle {
-  client: DatabaseSync;
-  db: DatabaseSync;
+  client: ClosableDatabase;
+  db: Database;
 }
 
 export function createDb(databaseUrl: string): DbHandle {
   const path = databasePathFromUrl(databaseUrl);
   ensureFileParent(path);
-  const db = new DatabaseSync(path);
-  db.exec("PRAGMA foreign_keys = ON");
+  const sqlite = new DatabaseSync(path);
+  const db = new NodeSqliteDatabase(sqlite);
+  sqlite.exec("PRAGMA foreign_keys = ON");
   return { client: db, db };
 }
 
+class NodeSqliteDatabase implements ClosableDatabase {
+  constructor(private readonly db: DatabaseSync) {}
+
+  prepare(sql: string): PreparedStatement {
+    return new NodeSqliteStatement(this.db.prepare(sql));
+  }
+
+  async exec(sql: string): Promise<void> {
+    this.db.exec(sql);
+  }
+
+  close(): void {
+    this.db.close();
+  }
+}
+
+class NodeSqliteStatement implements PreparedStatement {
+  constructor(private readonly statement: StatementSync) {}
+
+  async run(...params: SqlValue[]): Promise<StatementResult> {
+    return this.statement.run(...params);
+  }
+
+  async get(...params: SqlValue[]): Promise<unknown> {
+    return this.statement.get(...params);
+  }
+
+  async all(...params: SqlValue[]): Promise<unknown[]> {
+    return this.statement.all(...params);
+  }
+}
+
 function databasePathFromUrl(databaseUrl: string): string {
   if (!databaseUrl.startsWith("file:")) return databaseUrl;
   return databaseUrl.slice("file:".length);
diff --git a/src/storage/d1.ts b/src/storage/d1.ts
new file mode 100644
index 0000000..a009b87
--- /dev/null
+++ b/src/storage/d1.ts
@@ -0,0 +1,60 @@
+import type { Database, PreparedStatement, SqlValue, StatementResult } from "../ports/database.js";
+
+interface D1RunResult {
+  meta?: {
+    changes?: number;
+    last_row_id?: number;
+  };
+}
+
+interface D1AllResult {
+  results?: unknown[];
+}
+
+interface D1BoundStatement {
+  run(): Promise<D1RunResult>;
+  first(): Promise<unknown>;
+  all(): Promise<D1AllResult>;
+}
+
+interface D1PreparedStatement {
+  bind(...params: SqlValue[]): D1BoundStatement;
+  run(): Promise<D1RunResult>;
+}
+
+export interface D1DatabaseBinding {
+  prepare(sql: string): D1PreparedStatement;
+}
+
+export class D1DatabaseAdapter implements Database {
+  constructor(private readonly db: D1DatabaseBinding) {}
+
+  prepare(sql: string): PreparedStatement {
+    return new D1StatementAdapter(this.db.prepare(sql));
+  }
+
+  async exec(sql: string): Promise<void> {
+    await this.db.prepare(sql).run();
+  }
+}
+
+class D1StatementAdapter implements PreparedStatement {
+  constructor(private readonly statement: D1PreparedStatement) {}
+
+  async run(...params: SqlValue[]): Promise<StatementResult> {
+    const result = await this.statement.bind(...params).run();
+    return {
+      changes: result.meta?.changes ?? 0,
+      lastInsertRowid: result.meta?.last_row_id,
+    };
+  }
+
+  async get(...params: SqlValue[]): Promise<unknown> {
+    return this.statement.bind(...params).first();
+  }
+
+  async all(...params: SqlValue[]): Promise<unknown[]> {
+    const result = await this.statement.bind(...params).all();
+    return result.results ?? [];
+  }
+}
diff --git a/src/storage/migrations/0001_initial.ts b/src/storage/migrations/0001_initial.ts
index 3c1c58c..04e2b83 100644
--- a/src/storage/migrations/0001_initial.ts
+++ b/src/storage/migrations/0001_initial.ts
@@ -1,6 +1,8 @@
-import type { DatabaseSync } from "node:sqlite";
+import type { Database } from "../../ports/database.js";
+import { runMigration, type MigrationDefinition } from "./runner.js";
 
-const statements = [
+const migration: MigrationDefinition = {
+  statements: [
   `CREATE TABLE IF NOT EXISTS contacts (
     id INTEGER PRIMARY KEY AUTOINCREMENT,
     platform TEXT NOT NULL,
@@ -119,21 +121,15 @@ const statements = [
   )`,
   "CREATE INDEX IF NOT EXISTS audit_logs_conversation_idx ON audit_logs(conversation_id, created_at DESC)",
   "CREATE INDEX IF NOT EXISTS audit_logs_admin_idx ON audit_logs(admin_id, created_at DESC)",
-];
+  ],
+  columns: [
+    { table: "conversations", column: "retention_days", definition: "INTEGER" },
+    { table: "conversations", column: "expires_at", definition: "TEXT" },
+    { table: "conversations", column: "ai_enabled", definition: "INTEGER NOT NULL DEFAULT 1" },
+  ],
+  afterColumns: ["CREATE INDEX IF NOT EXISTS conversations_expires_idx ON conversations(expires_at)"],
+};
 
-export async function migrate(client: DatabaseSync): Promise<void> {
-  for (const statement of statements) {
-    client.exec(statement);
-  }
-  addColumnIfMissing(client, "conversations", "retention_days", "INTEGER");
-  addColumnIfMissing(client, "conversations", "expires_at", "TEXT");
-  client.exec("CREATE INDEX IF NOT EXISTS conversations_expires_idx ON conversations(expires_at)");
-  addColumnIfMissing(client, "conversations", "ai_enabled", "INTEGER NOT NULL DEFAULT 1");
-}
-
-function addColumnIfMissing(client: DatabaseSync, table: string, column: string, definition: string): void {
-  const rows = client.prepare(`PRAGMA table_info(${table})`).all() as Array<{ name: string }>;
-  if (!rows.some((row) => row.name === column)) {
-    client.exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${definition}`);
-  }
+export async function migrate(client: Database): Promise<void> {
+  await runMigration(client, migration);
 }
diff --git a/src/storage/migrations/runner.ts b/src/storage/migrations/runner.ts
new file mode 100644
index 0000000..d39fb66
--- /dev/null
+++ b/src/storage/migrations/runner.ts
@@ -0,0 +1,34 @@
+import type { Database } from "../../ports/database.js";
+
+export interface MigrationColumn {
+  table: string;
+  column: string;
+  definition: string;
+}
+
+export interface MigrationDefinition {
+  statements: string[];
+  columns?: MigrationColumn[];
+  afterColumns?: string[];
+}
+
+export async function runMigration(client: Database, migration: MigrationDefinition): Promise<void> {
+  for (const statement of migration.statements) {
+    await client.exec(statement);
+  }
+
+  for (const column of migration.columns ?? []) {
+    await addColumnIfMissing(client, column.table, column.column, column.definition);
+  }
+
+  for (const statement of migration.afterColumns ?? []) {
+    await client.exec(statement);
+  }
+}
+
+async function addColumnIfMissing(client: Database, table: string, column: string, definition: string): Promise<void> {
+  const rows = (await client.prepare(`PRAGMA table_info(${table})`).all()) as Array<{ name: string }>;
+  if (!rows.some((row) => row.name === column)) {
+    await client.exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${definition}`);
+  }
+}
diff --git a/src/tools/check-telegram.ts b/src/tools/check-telegram.ts
index 90d8372..a9b2b04 100644
--- a/src/tools/check-telegram.ts
+++ b/src/tools/check-telegram.ts
@@ -34,7 +34,7 @@ const databaseConfig = loadDatabaseConfig();
 const handle = createDb(databaseConfig.DATABASE_URL);
 try {
   await migrate(handle.client);
-  const config = loadConfigFromSources(new AppSettingsService(handle.db).all());
+  const config = loadConfigFromSources(await new AppSettingsService(handle.db).all());
   const sendTest = process.env.TELEGRAM_CHECK_SEND_TEST === "true";
   const topicTest = process.env.TELEGRAM_CHECK_TOPIC_TEST === "true";
 
diff --git a/src/tools/retention-cleanup.ts b/src/tools/retention-cleanup.ts
index f4c5b7a..e0a054e 100644
--- a/src/tools/retention-cleanup.ts
+++ b/src/tools/retention-cleanup.ts
@@ -8,7 +8,7 @@ const config = loadDatabaseConfig();
 const handle = createDb(config.DATABASE_URL);
 await migrate(handle.client);
 const settings = new AppSettingsService(handle.db);
-const appConfig = loadConfigFromSources(settings.all());
+const appConfig = loadConfigFromSources(await settings.all());
 
 const cleaned = await new RetentionService(handle.db, appConfig.MESSAGE_RETENTION_DAYS).cleanupExpired();
 handle.client.close();
diff --git a/test/core.test.ts b/test/core.test.ts
index 29edb78..d8690b7 100644
--- a/test/core.test.ts
+++ b/test/core.test.ts
@@ -6,7 +6,7 @@ import type { AddressInfo } from "node:net";
 import assert from "node:assert/strict";
 import { afterEach, beforeEach, describe, it } from "node:test";
 import { configIssues, loadConfig, loadConfigFromSources, loadDatabaseConfig, loadEnv } from "../src/runtime/config.js";
-import { startWebConsole } from "../src/runtime/web-console.js";
+import { handleWebConsoleRequest, startWebConsole } from "../src/runtime/web-console.js";
 import { AppSettingsService } from "../src/domain/app-settings.js";
 import { ConversationService } from "../src/domain/conversations.js";
 import { DeliveryService } from "../src/domain/deliveries.js";
@@ -16,12 +16,18 @@ import { RetentionService } from "../src/domain/retention.js";
 import { AiDraftService } from "../src/domain/ai-drafts.js";
 import { AuditService } from "../src/domain/audit.js";
 import { createDb, type DbHandle } from "../src/storage/client.js";
+import { D1DatabaseAdapter } from "../src/storage/d1.js";
 import { migrate } from "../src/storage/migrations/0001_initial.js";
+import { runMigration } from "../src/storage/migrations/runner.js";
+import { runMaintenanceJobs } from "../src/runtime/maintenance.js";
+import { handleWorkerFetch, handleWorkerScheduled, workerEnvToConfigMap, type WorkerEnv } from "../src/runtime/worker.js";
+import { createWorkerTelegramWebhookHandler } from "../src/channels/telegram/worker-webhook.js";
 import { buildTopicName } from "../src/channels/telegram/topics.js";
 import { detectMessageType, extractText, summarizeTelegramMessage } from "../src/channels/telegram/media.js";
 import { topicHelpText } from "../src/channels/telegram/commands.js";
 import { adminBotCommands, privateBotCommands } from "../src/channels/telegram/menu.js";
 import { configureTelegramWebhook } from "../src/channels/telegram/bot.js";
+import type { Database, PreparedStatement, SqlValue, StatementResult } from "../src/ports/database.js";
 
 let tempDir: string;
 let handle: DbHandle;
@@ -92,16 +98,16 @@ describe("configuration", () => {
     assert.equal(config.WEB_CONSOLE_PORT, 3000);
   });
 
-  it("loads runtime config from saved settings while allowing env overrides", () => {
+  it("loads runtime config from saved settings while allowing env overrides", async () => {
     const settings = new AppSettingsService(handle.db);
-    settings.setMany({
+    await settings.setMany({
       TELEGRAM_BOT_TOKEN: "from-db",
       TELEGRAM_MANAGEMENT_CHAT_ID: "-1001",
       TELEGRAM_ADMIN_USER_IDS: "1",
       AI_DRAFTS_ENABLED: "false",
     });
 
-    const config = loadConfigFromSources(settings.all(), { TELEGRAM_BOT_TOKEN: "from-env" });
+    const config = loadConfigFromSources(await settings.all(), { TELEGRAM_BOT_TOKEN: "from-env" });
 
     assert.equal(config.TELEGRAM_BOT_TOKEN, "from-env");
     assert.equal(config.TELEGRAM_MANAGEMENT_CHAT_ID, -1001);
@@ -109,6 +115,30 @@ describe("configuration", () => {
     assert.equal(config.AI_DRAFTS_ENABLED, false);
   });
 
+  it("loads saved settings through an async settings API", async () => {
+    const settings = new AppSettingsService(handle.db);
+    await settings.setMany({ TELEGRAM_BOT_TOKEN: "from-db" });
+
+    const stored = settings.all();
+
+    assert.equal(stored instanceof Promise, true);
+    assert.equal((await stored).TELEGRAM_BOT_TOKEN, "from-db");
+  });
+
+  it("loads runtime config from a platform-neutral config map", () => {
+    const config = loadConfig({
+      TELEGRAM_BOT_TOKEN: "token",
+      TELEGRAM_MANAGEMENT_CHAT_ID: "-1001",
+      TELEGRAM_ADMIN_USER_IDS: "1,2",
+      AI_DRAFTS_ENABLED: "false",
+    });
+
+    assert.equal(config.TELEGRAM_BOT_TOKEN, "token");
+    assert.equal(config.TELEGRAM_MANAGEMENT_CHAT_ID, -1001);
+    assert.deepEqual(config.TELEGRAM_ADMIN_USER_IDS, [1, 2]);
+    assert.equal(config.AI_DRAFTS_ENABLED, false);
+  });
+
   it("does not let repository .env values override saved runtime settings", async () => {
     const previousCwd = process.cwd();
     const envKeys = ["TELEGRAM_BOT_TOKEN", "TELEGRAM_MANAGEMENT_CHAT_ID", "TELEGRAM_ADMIN_USER_IDS"];
@@ -170,10 +200,427 @@ describe("configuration", () => {
   });
 });
 
+describe("storage migrations", () => {
+  it("runs migration statements and adds only missing columns through the database port", async () => {
+    const execs: string[] = [];
+    const columns = new Map<string, Set<string>>([
+      ["conversations", new Set(["id", "retention_days"])],
+    ]);
+    const db: Database = {
+      prepare(sql: string): PreparedStatement {
+        return {
+          async run(..._params: SqlValue[]): Promise<StatementResult> {
+            return { changes: 0 };
+          },
+          async get(..._params: SqlValue[]): Promise<unknown> {
+            return undefined;
+          },
+          async all(..._params: SqlValue[]): Promise<unknown[]> {
+            const match = sql.match(/^PRAGMA table_info\(([^)]+)\)$/);
+            const table = match?.[1] ?? "";
+            return [...(columns.get(table) ?? new Set<string>())].map((name) => ({ name }));
+          },
+        };
+      },
+      async exec(sql: string): Promise<void> {
+        execs.push(sql);
+        const match = sql.match(/^ALTER TABLE (\w+) ADD COLUMN (\w+) /);
+        if (match) {
+          const [, table, column] = match;
+          if (!columns.has(table)) columns.set(table, new Set());
+          columns.get(table)?.add(column);
+        }
+      },
+    };
+
+    await runMigration(db, {
+      statements: ["CREATE TABLE IF NOT EXISTS conversations (id INTEGER PRIMARY KEY)"],
+      columns: [
+        { table: "conversations", column: "retention_days", definition: "INTEGER" },
+        { table: "conversations", column: "expires_at", definition: "TEXT" },
+      ],
+      afterColumns: ["CREATE INDEX IF NOT EXISTS conversations_expires_idx ON conversations(expires_at)"],
+    });
+
+    assert.deepEqual(execs, [
+      "CREATE TABLE IF NOT EXISTS conversations (id INTEGER PRIMARY KEY)",
+      "ALTER TABLE conversations ADD COLUMN expires_at TEXT",
+      "CREATE INDEX IF NOT EXISTS conversations_expires_idx ON conversations(expires_at)",
+    ]);
+  });
+});
+
+describe("D1 database adapter", () => {
+  it("maps D1 prepared statements to the database port", async () => {
+    const calls: Array<{ sql: string; params: SqlValue[]; method: string }> = [];
+    const d1 = {
+      prepare(sql: string) {
+        return {
+          bind(...params: SqlValue[]) {
+            return {
+              async run() {
+                calls.push({ sql, params, method: "run" });
+                return { meta: { changes: 2, last_row_id: 42 } };
+              },
+              async first() {
+                calls.push({ sql, params, method: "first" });
+                return { id: 42 };
+              },
+              async all() {
+                calls.push({ sql, params, method: "all" });
+                return { results: [{ id: 42 }] };
+              },
+            };
+          },
+          async run() {
+            calls.push({ sql, params: [], method: "run" });
+            return { meta: { changes: 1, last_row_id: 7 } };
+          },
+        };
+      },
+    };
+    const db = new D1DatabaseAdapter(d1);
+
+    await db.exec("CREATE TABLE example (id INTEGER PRIMARY KEY)");
+    const statement = db.prepare("SELECT * FROM example WHERE id = ?");
+    const result = await statement.run(42);
+    const first = await statement.get(42);
+    const rows = await statement.all(42);
+
+    assert.deepEqual(result, { changes: 2, lastInsertRowid: 42 });
+    assert.deepEqual(first, { id: 42 });
+    assert.deepEqual(rows, [{ id: 42 }]);
+    assert.deepEqual(calls, [
+      { sql: "CREATE TABLE example (id INTEGER PRIMARY KEY)", params: [], method: "run" },
+      { sql: "SELECT * FROM example WHERE id = ?", params: [42], method: "run" },
+      { sql: "SELECT * FROM example WHERE id = ?", params: [42], method: "first" },
+      { sql: "SELECT * FROM example WHERE id = ?", params: [42], method: "all" },
+    ]);
+  });
+});
+
+describe("Workers runtime", () => {
+  it("initializes D1 and serves the health check from a Fetch request", async () => {
+    const calls: Array<{ sql: string; params: SqlValue[]; method: string }> = [];
+    const env: WorkerEnv = {
+      DB: {
+        prepare(sql: string) {
+          return {
+            bind(...params: SqlValue[]) {
+              return {
+                async run() {
+                  calls.push({ sql, params, method: "run" });
+                  return { meta: { changes: 0 } };
+                },
+                async first() {
+                  calls.push({ sql, params, method: "first" });
+                  return { ok: 1 };
+                },
+                async all() {
+                  calls.push({ sql, params, method: "all" });
+                  return { results: [] };
+                },
+              };
+            },
+            async run() {
+              calls.push({ sql, params: [], method: "run" });
+              return { meta: { changes: 0 } };
+            },
+          };
+        },
+      },
+    };
+
+    const response = await handleWorkerFetch(new Request("https://example.com/healthz"), env);
+    const body = (await response.json()) as { status: string; database: string };
+
+    assert.equal(response.status, 200);
+    assert.deepEqual(body, { status: "ok", database: "reachable" });
+    assert.ok(calls.some((call) => call.sql.startsWith("CREATE TABLE IF NOT EXISTS contacts")));
+    assert.deepEqual(calls.at(-1), { sql: "SELECT 1", params: [], method: "first" });
+  });
+
+  it("maps string Worker env bindings into a config map", () => {
+    const env = {
+      DB: { prepare: () => ({ bind: () => ({ run: async () => ({}), first: async () => undefined, all: async () => ({ results: [] }) }), run: async () => ({}) }) },
+      TELEGRAM_BOT_TOKEN: "token",
+      TELEGRAM_MANAGEMENT_CHAT_ID: "-1001",
+      TELEGRAM_ADMIN_USER_IDS: "1,2",
+      RATE_LIMIT_MAX_MESSAGES: "10",
+    } as unknown as WorkerEnv;
+
+    const configMap = workerEnvToConfigMap(env);
+
+    assert.deepEqual(configMap, {
+      TELEGRAM_BOT_TOKEN: "token",
+      TELEGRAM_MANAGEMENT_CHAT_ID: "-1001",
+      TELEGRAM_ADMIN_USER_IDS: "1,2",
+      RATE_LIMIT_MAX_MESSAGES: "10",
+    });
+  });
+
+  it("routes Telegram webhook requests through the injected Worker webhook handler", async () => {
+    const requests: Request[] = [];
+    const env: WorkerEnv = {
+      DB: {
+        prepare(sql: string) {
+          return {
+            bind(..._params: SqlValue[]) {
+              return {
+                async run() {
+                  return { meta: { changes: 0 } };
+                },
+                async first() {
+                  return { sql };
+                },
+                async all() {
+                  return { results: [] };
+                },
+              };
+            },
+            async run() {
+              return { meta: { changes: 0 } };
+            },
+          };
+        },
+      },
+    };
+    const request = new Request("https://example.com/telegram/webhook", { method: "POST" });
+
+    const response = await handleWorkerFetch(request, env, {
+      telegramWebhookHandler: async (received) => {
+        requests.push(received);
+        return new Response("telegram", { status: 202 });
+      },
+    });
+
+    assert.equal(response.status, 202);
+    assert.deepEqual(requests, [request]);
+  });
+
+  it("builds a Telegram webhook handler from Worker configuration", async () => {
+    const calls: Array<{ sql: string; params: SqlValue[]; method: string }> = [];
+    const created: unknown[] = [];
+    const secrets: string[] = [];
+    const requests: Request[] = [];
+    const env: WorkerEnv = {
+      DB: {
+        prepare(sql: string) {
+          return {
+            bind(...params: SqlValue[]) {
+              return {
+                async run() {
+                  calls.push({ sql, params, method: "run" });
+                  return { meta: { changes: 0 } };
+                },
+                async first() {
+                  calls.push({ sql, params, method: "first" });
+                  return undefined;
+                },
+                async all() {
+                  calls.push({ sql, params, method: "all" });
+                  if (sql === "SELECT key, value FROM app_settings") return { results: [] };
+                  return { results: [] };
+                },
+              };
+            },
+            async run() {
+              calls.push({ sql, params: [], method: "run" });
+              return { meta: { changes: 0 } };
+            },
+          };
+        },
+      },
+      TELEGRAM_BOT_TOKEN: "token",
+      TELEGRAM_MANAGEMENT_CHAT_ID: "-1001",
+      TELEGRAM_ADMIN_USER_IDS: "1",
+      TELEGRAM_UPDATE_MODE: "webhook",
+      TELEGRAM_WEBHOOK_URL: "https://example.com/telegram/webhook",
+      TELEGRAM_WEBHOOK_SECRET: "secret",
+    };
+    const request = new Request("https://example.com/telegram/webhook", {
+      method: "POST",
+      headers: { "x-telegram-bot-api-secret-token": "secret" },
+    });
+
+    const response = await handleWorkerFetch(request, env, {
+      createTelegramBot: (config) => {
+        created.push(config);
+        return { token: config.TELEGRAM_BOT_TOKEN } as never;
+      },
+      createTelegramWebhookHandler: (bot, secret) => {
+        created.push(bot);
+        secrets.push(secret);
+        return async (received) => {
+          requests.push(received);
+          return new Response("handled", { status: 202 });
+        };
+      },
+    });
+
+    assert.equal(response.status, 202);
+    assert.equal(await response.text(), "handled");
+    assert.equal(secrets[0], "secret");
+    assert.deepEqual(requests, [request]);
+    assert.ok(created.length >= 2);
+    assert.ok(calls.some((call) => call.sql === "SELECT key, value FROM app_settings"));
+  });
+
+  it("runs maintenance jobs from a Worker scheduled event", async () => {
+    const calls: Array<{ sql: string; params: SqlValue[]; method: string }> = [];
+    const summaries: unknown[] = [];
+    const env: WorkerEnv = {
+      DB: {
+        prepare(sql: string) {
+          return {
+            bind(...params: SqlValue[]) {
+              return {
+                async run() {
+                  calls.push({ sql, params, method: "run" });
+                  return { meta: { changes: 0 } };
+                },
+                async first() {
+                  calls.push({ sql, params, method: "first" });
+                  return undefined;
+                },
+                async all() {
+                  calls.push({ sql, params, method: "all" });
+                  return { results: [] };
+                },
+              };
+            },
+            async run() {
+              calls.push({ sql, params: [], method: "run" });
+              return { meta: { changes: 0 } };
+            },
+          };
+        },
+      },
+      TELEGRAM_BOT_TOKEN: "token",
+      TELEGRAM_MANAGEMENT_CHAT_ID: "-1001",
+      TELEGRAM_ADMIN_USER_IDS: "1",
+    };
+
+    await handleWorkerScheduled({ cron: "*/15 * * * *", scheduledTime: Date.now() }, env, { waitUntil: () => {} }, {
+      logger: {
+        child: () => ({ debug: () => {}, info: () => {}, warn: () => {}, error: () => {} }),
+        debug: () => {},
+        info: () => {},
+        warn: () => {},
+        error: () => {},
+      } as never,
+      createTelegramBot: (config) => ({ api: { token: config.TELEGRAM_BOT_TOKEN } }) as never,
+      runMaintenanceJobs: async (input) => {
+        summaries.push({ config: input.config.TELEGRAM_BOT_TOKEN, api: input.api });
+        return { expiredConversations: 1, expiredMessages: 2 };
+      },
+    });
+
+    assert.ok(calls.some((call) => call.sql.startsWith("CREATE TABLE IF NOT EXISTS contacts")));
+    assert.ok(calls.some((call) => call.sql === "SELECT key, value FROM app_settings"));
+    assert.deepEqual(summaries, [{ config: "token", api: { token: "token" } }]);
+  });
+});
+
+describe("runtime maintenance", () => {
+  it("runs conversation expiry and message retention jobs", async () => {
+    const events: string[] = [];
+    const summary = await runMaintenanceJobs({
+      api: {} as never,
+      db: handle.db,
+      config: loadConfig({
+        TELEGRAM_BOT_TOKEN: "token",
+        TELEGRAM_MANAGEMENT_CHAT_ID: "-1001",
+        TELEGRAM_ADMIN_USER_IDS: "1",
+      }),
+      logger: { child: () => ({}) } as never,
+      sweepExpiredConversations: async () => {
+        events.push("expiry");
+        return 1;
+      },
+      cleanupExpiredMessages: async () => {
+        events.push("retention");
+        return 2;
+      },
+    });
+
+    assert.deepEqual(events, ["expiry", "retention"]);
+    assert.deepEqual(summary, { expiredConversations: 1, expiredMessages: 2 });
+  });
+});
+
+describe("Workers Telegram webhook", () => {
+  it("forwards valid Telegram webhook requests to the Cloudflare callback", async () => {
+    const requests: Request[] = [];
+    const handler = createWorkerTelegramWebhookHandler({} as never, "secret", () => async (request: Request) => {
+      requests.push(request);
+      return new Response("handled", { status: 202 });
+    });
+    const request = new Request("https://example.com/telegram/webhook", {
+      method: "POST",
+      headers: { "x-telegram-bot-api-secret-token": "secret" },
+    });
+
+    const response = await handler(request);
+
+    assert.equal(response.status, 202);
+    assert.equal(await response.text(), "handled");
+    assert.deepEqual(requests, [request]);
+  });
+
+  it("rejects Telegram webhook requests with an invalid secret", async () => {
+    let called = false;
+    const handler = createWorkerTelegramWebhookHandler({} as never, "secret", () => async () => {
+      called = true;
+      return new Response("handled");
+    });
+    const request = new Request("https://example.com/telegram/webhook", {
+      method: "POST",
+      headers: { "x-telegram-bot-api-secret-token": "wrong" },
+    });
+
+    const response = await handler(request);
+
+    assert.equal(response.status, 403);
+    assert.equal(await response.text(), "Forbidden");
+    assert.equal(called, false);
+  });
+});
+
 describe("web console", () => {
+  it("handles login and health checks through Fetch requests", async () => {
+    const settings = new AppSettingsService(handle.db);
+    await settings.setMany({ WEB_CONSOLE_SETUP_TOKEN: "setup-token" });
+    const sessions = new Map<string, never>();
+    const options = {
+      settings,
+      port: 0,
+      getStatus: () => ({ bot: "running" as const, issues: [] }),
+      onConfigSaved: async () => {},
+      dbHealthCheck: async () => true,
+      collectMetrics: stubMetrics,
+      collectOperationsOverview: stubOpsOverview,
+      listConversations: stubListConversations,
+      listFailedDeliveries: stubListFailedDeliveries,
+      scheduleRetry: stubScheduleRetry,
+      listAuditLogs: stubListAuditLogs,
+      searchMessages: stubSearchMessages,
+    };
+
+    const login = await handleWebConsoleRequest(new Request("https://example.com/login"), options, sessions);
+    const health = await handleWebConsoleRequest(new Request("https://example.com/healthz"), options, sessions);
+    const body = (await health.json()) as { status: string; bot: string; db: string };
+
+    assert.equal(login.status, 200);
+    assert.match(await login.text(), /登录控制台/);
+    assert.equal(login.headers.get("content-type"), "text/html; charset=utf-8");
+    assert.equal(health.status, 200);
+    assert.deepEqual(body, { status: "ok", bot: "running", db: "reachable" });
+  });
+
   it("requires a password before setup-token sessions can save configuration", async () => {
     const settings = new AppSettingsService(handle.db);
-    settings.setMany({ WEB_CONSOLE_SETUP_TOKEN: "setup-token" });
+    await settings.setMany({ WEB_CONSOLE_SETUP_TOKEN: "setup-token" });
     const server = await startWebConsole({
       settings,
       port: 0,
@@ -210,8 +657,8 @@ describe("web console", () => {
       });
 
       assert.equal(save.status, 400);
-      assert.equal(settings.get("WEB_CONSOLE_PASSWORD_HASH"), undefined);
-      assert.equal(settings.get("WEB_CONSOLE_SETUP_TOKEN"), "setup-token");
+      assert.equal(await settings.get("WEB_CONSOLE_PASSWORD_HASH"), undefined);
+      assert.equal(await settings.get("WEB_CONSOLE_SETUP_TOKEN"), "setup-token");
     } finally {
       await new Promise<void>((resolve) => server.close(() => resolve()));
     }
@@ -219,7 +666,7 @@ describe("web console", () => {
 
   it("rejects oversized unauthenticated login form bodies", async () => {
     const settings = new AppSettingsService(handle.db);
-    settings.setMany({ WEB_CONSOLE_SETUP_TOKEN: "setup-token" });
+    await settings.setMany({ WEB_CONSOLE_SETUP_TOKEN: "setup-token" });
     const server = await startWebConsole({
       settings,
       port: 0,
@@ -250,7 +697,7 @@ describe("web console", () => {
 
   it("awaits Telegram webhook errors so they return a handled response", async () => {
     const settings = new AppSettingsService(handle.db);
-    settings.setMany({ WEB_CONSOLE_PASSWORD_HASH: "bad:hash" });
+    await settings.setMany({ WEB_CONSOLE_PASSWORD_HASH: "bad:hash" });
     const server = await startWebConsole({
       settings,
       port: 0,
@@ -313,7 +760,7 @@ describe("web console", () => {
 
   it("exposes /healthz without authentication", async () => {
     const settings = new AppSettingsService(handle.db);
-    settings.setMany({ WEB_CONSOLE_PASSWORD_HASH: "bad:hash" });
+    await settings.setMany({ WEB_CONSOLE_PASSWORD_HASH: "bad:hash" });
     const server = await startWebConsole({
       settings,
       port: 0,
@@ -343,7 +790,7 @@ describe("web console", () => {
 
   it("returns 200 from /healthz when bot is running and db is reachable", async () => {
     const settings = new AppSettingsService(handle.db);
-    settings.setMany({ WEB_CONSOLE_PASSWORD_HASH: "bad:hash" });
+    await settings.setMany({ WEB_CONSOLE_PASSWORD_HASH: "bad:hash" });
     const server = await startWebConsole({
       settings,
       port: 0,
@@ -371,7 +818,7 @@ describe("web console", () => {
 
   it("redirects /metrics to /login without authentication", async () => {
     const settings = new AppSettingsService(handle.db);
-    settings.setMany({ WEB_CONSOLE_PASSWORD_HASH: "bad:hash" });
+    await settings.setMany({ WEB_CONSOLE_PASSWORD_HASH: "bad:hash" });
     const server = await startWebConsole({
       settings,
       port: 0,
@@ -398,7 +845,7 @@ describe("web console", () => {
 
   it("returns metrics JSON after authentication", async () => {
     const settings = new AppSettingsService(handle.db);
-    settings.setMany({ WEB_CONSOLE_PASSWORD_HASH: "bad:hash" });
+    await settings.setMany({ WEB_CONSOLE_PASSWORD_HASH: "bad:hash" });
     const server = await startWebConsole({
       settings,
       port: 0,
@@ -443,7 +890,7 @@ describe("web console", () => {
 
   it("redirects unauthenticated /operations to /login", async () => {
     const settings = new AppSettingsService(handle.db);
-    settings.setMany({ WEB_CONSOLE_PASSWORD_HASH: "bad:hash" });
+    await settings.setMany({ WEB_CONSOLE_PASSWORD_HASH: "bad:hash" });
     const server = await startWebConsole({
       settings,
       port: 0,
@@ -470,7 +917,7 @@ describe("web console", () => {
 
   it("returns operations overview HTML after authentication", async () => {
     const settings = new AppSettingsService(handle.db);
-    settings.setMany({ WEB_CONSOLE_PASSWORD_HASH: "bad:hash" });
+    await settings.setMany({ WEB_CONSOLE_PASSWORD_HASH: "bad:hash" });
     const server = await startWebConsole({
       settings,
       port: 0,
@@ -680,11 +1127,11 @@ describe("conversation service", () => {
       text: "hello",
     });
 
-    const convStats = service.conversationStats();
+    const convStats = await service.conversationStats();
     assert.equal(convStats.open, 1);
     assert.equal(convStats.closed, 1);
 
-    const msgStats = service.messageStats();
+    const msgStats = await service.messageStats();
     assert.equal(msgStats.inbound, 1);
     assert.equal(msgStats.outbound, 1);
   });
@@ -700,16 +1147,16 @@ describe("conversation service", () => {
       if (i === 3) await service.setConversationStatus(bundle.conversation.id, "closed");
     }
 
-    const all = service.listConversations({ limit: 50, offset: 0 });
+    const all = await service.listConversations({ limit: 50, offset: 0 });
     assert.equal(all.total, 3);
     assert.equal(all.items.length, 3);
 
-    const openOnly = service.listConversations({ status: "open", limit: 50, offset: 0 });
+    const openOnly = await service.listConversations({ status: "open", limit: 50, offset: 0 });
     assert.equal(openOnly.total, 2);
     assert.equal(openOnly.items.length, 2);
     assert.ok(openOnly.items.every((c) => c.status === "open"));
 
-    const paged = service.listConversations({ limit: 2, offset: 0 });
+    const paged = await service.listConversations({ limit: 2, offset: 0 });
     assert.equal(paged.items.length, 2);
   });
 
@@ -718,18 +1165,18 @@ describe("conversation service", () => {
     const b1 = await service.getOrCreateConversation({ platform: "telegram", externalUserId: "600", displayName: "A" });
     const b2 = await service.getOrCreateConversation({ platform: "telegram", externalUserId: "601", displayName: "B" });
     const b3 = await service.getOrCreateConversation({ platform: "telegram", externalUserId: "602", displayName: "C" });
-    service.assign(b1.conversation.id, "100");
-    service.assign(b2.conversation.id, "100");
-    service.assign(b3.conversation.id, "200");
+    await service.assign(b1.conversation.id, "100");
+    await service.assign(b2.conversation.id, "100");
+    await service.assign(b3.conversation.id, "200");
 
-    const mine = service.listByAssignee("100", 20);
+    const mine = await service.listByAssignee("100", 20);
     assert.equal(mine.length, 2);
     assert.ok(mine.every((c) => c.assignedAdminId === "100"));
 
-    const combined = service.listConversations({ assignedTo: "100", status: "open", limit: 50, offset: 0 });
+    const combined = await service.listConversations({ assignedTo: "100", status: "open", limit: 50, offset: 0 });
     assert.equal(combined.total, 2);
 
-    const empty = service.listByAssignee("999", 20);
+    const empty = await service.listByAssignee("999", 20);
     assert.equal(empty.length, 0);
   });
 
@@ -740,8 +1187,8 @@ describe("conversation service", () => {
       externalUserId: "700",
       displayName: "UrgentUser",
     });
-    service.setPriority(bundle.conversation.id, "urgent");
-    service.assign(bundle.conversation.id, "500");
+    await service.setPriority(bundle.conversation.id, "urgent");
+    await service.assign(bundle.conversation.id, "500");
 
     const conv = await service.getConversation(bundle.conversation.id);
     assert.ok(conv);
@@ -863,10 +1310,10 @@ describe("telegram helpers", () => {
       messageType: "text",
       text: "hello",
     });
-    handle.db
+    await handle.db
       .prepare("INSERT INTO ai_drafts (conversation_id, status, created_at, updated_at) VALUES (?, 'ready', ?, ?)")
       .run(bundle.conversation.id, new Date().toISOString(), new Date().toISOString());
-    handle.db
+    await handle.db
       .prepare("INSERT INTO admin_notes (conversation_id, admin_user_id, note, created_at) VALUES (?, '1', 'note', ?)")
       .run(bundle.conversation.id, new Date().toISOString());
 
@@ -875,9 +1322,9 @@ describe("telegram helpers", () => {
     assert.ok(await service.getConversation(bundle.conversation.id));
     assert.ok(await service.getContact(bundle.contact.id));
     assert.equal((await service.recentMessages(bundle.conversation.id, 10)).length, 0);
-    const draftCount = handle.db.prepare("SELECT COUNT(*) AS c FROM ai_drafts WHERE conversation_id = ?").get(bundle.conversation.id) as { c: number };
+    const draftCount = (await handle.db.prepare("SELECT COUNT(*) AS c FROM ai_drafts WHERE conversation_id = ?").get(bundle.conversation.id)) as { c: number };
     assert.equal(draftCount.c, 0);
-    const noteCount = handle.db.prepare("SELECT COUNT(*) AS c FROM admin_notes WHERE conversation_id = ?").get(bundle.conversation.id) as { c: number };
+    const noteCount = (await handle.db.prepare("SELECT COUNT(*) AS c FROM admin_notes WHERE conversation_id = ?").get(bundle.conversation.id)) as { c: number };
     assert.equal(noteCount.c, 0);
   });
 
@@ -890,7 +1337,7 @@ describe("telegram helpers", () => {
     await deliveries.markFailed(id2, "error", 1);
     await deliveries.markPermanentFailure(id3, "fatal");
 
-    const stats = deliveries.stats();
+    const stats = await deliveries.stats();
     assert.equal(stats.pending, 0);
     assert.equal(stats.sent, 1);
     assert.equal(stats.failed, 1);
@@ -918,26 +1365,26 @@ describe("AI draft lifecycle", () => {
       displayName: "Test",
     });
 
-    handle.db
+    await handle.db
       .prepare(
         `INSERT INTO ai_drafts (conversation_id, status, draft_text, created_at, updated_at)
          VALUES (?, 'ready', 'old draft', '2026-01-01T00:00:00Z', '2026-01-01T00:00:00Z')`,
       )
       .run(bundle.conversation.id);
-    handle.db
+    await handle.db
       .prepare(
         `INSERT INTO ai_drafts (conversation_id, status, draft_text, created_at, updated_at)
          VALUES (?, 'ready', 'new draft', '2026-01-02T00:00:00Z', '2026-01-02T00:00:00Z')`,
       )
       .run(bundle.conversation.id);
-    handle.db
+    await handle.db
       .prepare(
         `INSERT INTO ai_drafts (conversation_id, status, draft_text, created_at, updated_at)
          VALUES (?, 'sent', 'sent draft', '2026-01-03T00:00:00Z', '2026-01-03T00:00:00Z')`,
       )
       .run(bundle.conversation.id);
 
-    const draft = aiDrafts.findReady(bundle.conversation.id);
+    const draft = await aiDrafts.findReady(bundle.conversation.id);
     assert.ok(draft);
     assert.equal(draft.draftText, "new draft");
   });
@@ -957,28 +1404,28 @@ describe("AI draft lifecycle", () => {
       displayName: "Test",
     });
 
-    handle.db
+    await handle.db
       .prepare(
         `INSERT INTO ai_drafts (conversation_id, status, draft_text, created_at, updated_at)
          VALUES (?, 'ready', 'hello', '2026-01-01T00:00:00Z', '2026-01-01T00:00:00Z')`,
       )
       .run(bundle.conversation.id);
-    const draft = aiDrafts.findReady(bundle.conversation.id);
+    const draft = await aiDrafts.findReady(bundle.conversation.id);
     assert.ok(draft);
 
-    aiDrafts.markSent(draft.id);
-    assert.equal(aiDrafts.findReady(bundle.conversation.id), undefined);
+    await aiDrafts.markSent(draft.id);
+    assert.equal(await aiDrafts.findReady(bundle.conversation.id), undefined);
 
-    handle.db
+    await handle.db
       .prepare(
         `INSERT INTO ai_drafts (conversation_id, status, draft_text, created_at, updated_at)
          VALUES (?, 'ready', 'world', '2026-01-02T00:00:00Z', '2026-01-02T00:00:00Z')`,
       )
       .run(bundle.conversation.id);
-    const draft2 = aiDrafts.findReady(bundle.conversation.id);
+    const draft2 = await aiDrafts.findReady(bundle.conversation.id);
     assert.ok(draft2);
-    aiDrafts.markDiscarded(draft2.id);
-    assert.equal(aiDrafts.findReady(bundle.conversation.id), undefined);
+    await aiDrafts.markDiscarded(draft2.id);
+    assert.equal(await aiDrafts.findReady(bundle.conversation.id), undefined);
   });
 
   it("recovers stale pending drafts as failed during retention cleanup", async () => {
@@ -990,7 +1437,7 @@ describe("AI draft lifecycle", () => {
     });
 
     const staleCutoff = new Date(Date.now() - 6 * 60 * 1000).toISOString();
-    handle.db
+    await handle.db
       .prepare(
         `INSERT INTO ai_drafts (conversation_id, status, created_at, updated_at)
          VALUES (?, 'pending', ?, ?)`,
@@ -1000,9 +1447,9 @@ describe("AI draft lifecycle", () => {
     const retention = new RetentionService(handle.db, 30);
     await retention.cleanupExpired();
 
-    const row = handle.db
+    const row = (await handle.db
       .prepare("SELECT status, error FROM ai_drafts WHERE conversation_id = ?")
-      .get(bundle.conversation.id) as { status: string; error: string };
+      .get(bundle.conversation.id)) as { status: string; error: string };
     assert.equal(row.status, "failed");
     assert.match(row.error, /timed out/);
   });
@@ -1016,7 +1463,7 @@ describe("AI draft lifecycle", () => {
     });
 
     const oldDate = new Date(Date.now() - 2 * 86400 * 1000).toISOString();
-    handle.db
+    await handle.db
       .prepare(
         `INSERT INTO ai_drafts (conversation_id, status, draft_text, created_at, updated_at)
          VALUES (?, 'sent', 'old', ?, ?)`,
@@ -1026,9 +1473,9 @@ describe("AI draft lifecycle", () => {
     const retention = new RetentionService(handle.db, 1);
     await retention.cleanupExpired();
 
-    const count = handle.db
+    const count = (await handle.db
       .prepare("SELECT COUNT(*) AS cnt FROM ai_drafts WHERE conversation_id = ?")
-      .get(bundle.conversation.id) as { cnt: number };
+      .get(bundle.conversation.id)) as { cnt: number };
     assert.equal(count.cnt, 0);
   });
 
@@ -1039,7 +1486,7 @@ describe("AI draft lifecycle", () => {
     await deliveries.markSent(id1);
     await deliveries.markPermanentFailure(id2, "fatal");
 
-    const stats = deliveries.stats();
+    const stats = await deliveries.stats();
     assert.equal(stats.sent, 1);
     assert.equal(stats.permanentFailure, 1);
   });
@@ -1053,15 +1500,15 @@ describe("AI draft lifecycle", () => {
     await deliveries.markFailed(id2, "error", 2);
     await deliveries.markPermanentFailure(id3, "fatal");
 
-    const list = deliveries.listFailedDeliveries({ limit: 50, offset: 0 });
+    const list = await deliveries.listFailedDeliveries({ limit: 50, offset: 0 });
     assert.equal(list.total, 3);
     assert.equal(list.items.length, 3);
 
-    deliveries.scheduleRetry(id1);
-    const row = handle.db.prepare("SELECT next_retry_at FROM deliveries WHERE id = ?").get(id1) as { next_retry_at: string };
+    await deliveries.scheduleRetry(id1);
+    const row = (await handle.db.prepare("SELECT next_retry_at FROM deliveries WHERE id = ?").get(id1)) as { next_retry_at: string };
     assert.ok(row.next_retry_at);
 
-    const beforePf = handle.db.prepare("SELECT next_retry_at FROM deliveries WHERE id = ?").get(id3) as { next_retry_at: string | null };
+    const beforePf = (await handle.db.prepare("SELECT next_retry_at FROM deliveries WHERE id = ?").get(id3)) as { next_retry_at: string | null };
     assert.equal(beforePf.next_retry_at, null);
   });
 });
@@ -1075,26 +1522,26 @@ describe("message search", () => {
       displayName: "SearchUser",
     });
     const convId = bundle.conversation.id;
-    handle.db
+    await handle.db
       .prepare(
         `INSERT INTO messages (conversation_id, contact_id, direction, platform, message_type, text, created_at)
          VALUES (?, NULL, 'inbound', 'telegram', 'text', ?, ?)`,
       )
       .run(convId, "hello world", "2026-06-29T10:00:00.000Z");
-    handle.db
+    await handle.db
       .prepare(
         `INSERT INTO messages (conversation_id, contact_id, direction, platform, message_type, text, created_at)
          VALUES (?, NULL, 'inbound', 'telegram', 'text', ?, ?)`,
       )
       .run(convId, "goodbye world", "2026-06-29T11:00:00.000Z");
-    handle.db
+    await handle.db
       .prepare(
         `INSERT INTO messages (conversation_id, contact_id, direction, platform, message_type, text, created_at)
          VALUES (?, NULL, 'outbound', 'telegram', 'text', ?, ?)`,
       )
       .run(convId, "no match here", "2026-06-29T12:00:00.000Z");
 
-    const results = conversations.searchMessagesInConversation(convId, "world", 20);
+    const results = await conversations.searchMessagesInConversation(convId, "world", 20);
     assert.equal(results.length, 2);
     assert.equal(results[0].text, "goodbye world");
     assert.equal(results[1].text, "hello world");
@@ -1108,7 +1555,7 @@ describe("message search", () => {
       displayName: "GlobalUser",
     });
     for (let i = 0; i < 5; i++) {
-      handle.db
+      await handle.db
         .prepare(
           `INSERT INTO messages (conversation_id, contact_id, direction, platform, message_type, text, created_at)
            VALUES (?, NULL, 'inbound', 'telegram', 'text', ?, ?)`,
@@ -1116,18 +1563,18 @@ describe("message search", () => {
         .run(bundle.conversation.id, `urgent issue ${i}`, `2026-06-29T${10 + i}:00:00.000Z`);
     }
 
-    const result = conversations.searchMessages({ query: "urgent", limit: 2, offset: 0 });
+    const result = await conversations.searchMessages({ query: "urgent", limit: 2, offset: 0 });
     assert.equal(result.total, 5);
     assert.equal(result.items.length, 2);
     assert.ok(result.items[0].text?.includes("urgent"));
 
-    const page2 = conversations.searchMessages({ query: "urgent", limit: 2, offset: 2 });
+    const page2 = await conversations.searchMessages({ query: "urgent", limit: 2, offset: 2 });
     assert.equal(page2.items.length, 2);
   });
 
   it("renders search page behind auth", async () => {
     const settings = new AppSettingsService(handle.db);
-    settings.setMany({ WEB_CONSOLE_SETUP_TOKEN: "setup-token" });
+    await settings.setMany({ WEB_CONSOLE_SETUP_TOKEN: "setup-token" });
     const server = await startWebConsole({
       settings,
       port: 0,
@@ -1182,11 +1629,11 @@ describe("audit log", () => {
     });
     const convId = bundle.conversation.id;
 
-    audit.log({ adminId: "100", conversationId: convId, action: "close" });
-    audit.log({ adminId: "200", conversationId: convId, action: "assign", detail: "300" });
-    audit.log({ adminId: "100", conversationId: convId, action: "priority", detail: "high" });
+    await audit.log({ adminId: "100", conversationId: convId, action: "close" });
+    await audit.log({ adminId: "200", conversationId: convId, action: "assign", detail: "300" });
+    await audit.log({ adminId: "100", conversationId: convId, action: "priority", detail: "high" });
 
-    const logs = audit.listByConversation(convId, 10);
+    const logs = await audit.listByConversation(convId, 10);
     assert.equal(logs.length, 3);
     assert.equal(logs[0].action, "priority");
     assert.equal(logs[1].action, "assign");
@@ -1206,20 +1653,20 @@ describe("audit log", () => {
     const convId = bundle.conversation.id;
 
     for (let i = 0; i < 5; i++) {
-      audit.log({ adminId: "100", conversationId: convId, action: "note" });
+      await audit.log({ adminId: "100", conversationId: convId, action: "note" });
     }
     for (let i = 0; i < 3; i++) {
-      audit.log({ adminId: "200", conversationId: convId, action: "close" });
+      await audit.log({ adminId: "200", conversationId: convId, action: "close" });
     }
 
-    const byAdmin = audit.list({ adminId: "100", limit: 50, offset: 0 });
+    const byAdmin = await audit.list({ adminId: "100", limit: 50, offset: 0 });
     assert.equal(byAdmin.total, 5);
     assert.equal(byAdmin.items.length, 5);
 
-    const byAction = audit.list({ action: "close", limit: 50, offset: 0 });
+    const byAction = await audit.list({ action: "close", limit: 50, offset: 0 });
     assert.equal(byAction.total, 3);
 
-    const paged = audit.list({ limit: 2, offset: 0 });
+    const paged = await audit.list({ limit: 2, offset: 0 });
     assert.equal(paged.items.length, 2);
     assert.equal(paged.total, 8);
   });
@@ -1255,10 +1702,10 @@ describe("audit log", () => {
       externalUserId: "333",
       displayName: "User3",
     });
-    audit.log({ adminId: "999", conversationId: bundle.conversation.id, action: "ban", detail: "spam" });
+    await audit.log({ adminId: "999", conversationId: bundle.conversation.id, action: "ban", detail: "spam" });
 
     const settings = new AppSettingsService(handle.db);
-    settings.setMany({ WEB_CONSOLE_SETUP_TOKEN: "setup-token" });
+    await settings.setMany({ WEB_CONSOLE_SETUP_TOKEN: "setup-token" });
     const server = await startWebConsole({
       settings,
       port: 0,
diff --git a/wrangler.toml b/wrangler.toml
new file mode 100644
index 0000000..27512e4
--- /dev/null
+++ b/wrangler.toml
@@ -0,0 +1,14 @@
+name = "inboxbridge"
+main = "src/runtime/worker.ts"
+compatibility_date = "2026-06-30"
+
+[triggers]
+crons = ["*/15 * * * *"]
+
+[[d1_databases]]
+binding = "DB"
+database_name = "inboxbridge"
+database_id = "00000000-0000-0000-0000-000000000000"
+
+[vars]
+TELEGRAM_UPDATE_MODE = "webhook"