diff --git a/src/shared/utils/ngSession.ts b/src/shared/utils/ngSession.ts
index fd38aa7..2243c62 100644
--- a/src/shared/utils/ngSession.ts
+++ b/src/shared/utils/ngSession.ts
@@ -10,7 +10,26 @@ import { configure } from "@ng-eventually/client/polyfill";
 // SDK-shaped surface used by ngSession itself — taken from the lib, not @ng-org.
 import { ng, init as initNgWeb, initNg as initNgSignals } from "@ng-eventually/client";
 
-configure({ ng: realNg, useShape: realUseShape, init: realInit, initNg: realInitNg });
+// DIAGNOSTIC (shared-wallet isolation): turn on the SDK's OFF-by-default access
+// log to SEE every read/write prefixed by the active identity — the way to catch
+// a doc read under the wrong identity in the REAL app (the e2e harness can't
+// reproduce it — cross-invocation reads return nothing there). Runtime toggle, no
+// rebuild: in the browser console run
+//   localStorage.setItem('festipod.debug.accessLog','1')   // then reload
+// (unset / '0' turns it off). Also honoured: window.__FESTIPOD_ACCESS_LOG__.
+function accessLogEnabled(): boolean {
+    try {
+        if (typeof localStorage !== "undefined"
+            && localStorage.getItem("festipod.debug.accessLog") === "1") return true;
+    } catch { /* storage may be unavailable */ }
+    return typeof window !== "undefined"
+        && (window as unknown as Record<string, unknown>).__FESTIPOD_ACCESS_LOG__ === true;
+}
+
+configure({
+    ng: realNg, useShape: realUseShape, init: realInit, initNg: realInitNg,
+    debugAccessLog: accessLogEnabled(),
+});
 
 export let session: NextGraphSession | undefined;