botmux 3.13.0 → 3.14.0

package/dist/daemon.js

@@ -17,6 +17,7 @@ import { writeHeartbeat } from './core/daemon-heartbeat.js';
 import { botmuxWrapperFiles, resolveBotmuxWrapperBinDir } from './core/botmux-wrapper.js';
 import { evaluateOverload, formatOverloadAlert, buildOverloadAlertCard, buildOverloadRecoveredCard, initialOverloadCardState, INITIAL_OVERLOAD_STATE, computeOverloadThresholds, isOverloadAlertTarget, } from './core/host-overload-alert.js';
 import { registerOverloadNonce } from './im/lark/overload-nonce.js';
+import { resolveBrowserTargets, detectRunningBrowsers } from './core/browser-restart.js';
 import { countHostOverload } from './im/lark/card-handler.js';
 import { startMaintenance, stopMaintenance } from './core/maintenance.js';
 import { selectCodexRuntimeUpdateTargets, startCliRuntimeUpdateMonitor, stopCliRuntimeUpdateMonitor, } from './core/cli-runtime-update.js';
@@ -26,8 +27,11 @@ import { readSupervisorProcessStartIdentity } from './core/process-start-identit
 import { statSync } from 'node:fs';
 import { addReaction, deleteMessage, getChatContext, getChatMode, getChatNameAndMode, getMessageChatId, listChatMemberOpenIds, MessageWithdrawnError, replyMessage, resolveAllowedUsersWithMap, sendMessage, sendUserMessage, updateMessage } from './im/lark/client.js';
 import { resolveGroupJoinPrompt, waitForAllowedUserInChat } from './core/auto-start.js';
-import { loadBotConfigAtIndex, loadBotConfigs, isManagedActivationStartingAtIndex, registerBot, getBot, getAllBots, getOwnerOpenId, findOncallChat, effectiveDefaultWorkingDir, effectiveBotDisplayName, resolveVcMeetingConsumerProfiles, setResolvedAllowedUsersRepublishHook, setAllowedUsersResolveRetryHook, vcMeetingAgentConfigActive, } from './bot-registry.js';
+import { loadBotConfigAtIndex, loadBotConfigs, isManagedActivationStartingAtIndex, registerBot, getBot, getAllBots, getOwnerOpenId, findOncallChat, effectiveDefaultWorkingDir, effectiveBotDisplayName, resolveVcMeetingConsumerProfiles, setResolvedAllowedUsersRepublishHook, setAllowedUsersResolveRetryHook, vcMeetingAgentConfigActive, botAcceptsSlashFromBots, } from './bot-registry.js';
 import { setDisplayNameRefresher, findConfigField, applyConfigField } from './services/bot-config-store.js';
+import { getSkillFeedbackStore } from './services/skill-feedback-store.js';
+import { enqueueTurnTerminal, drainTurnTerminalQueue } from './services/turn-completion-events.js';
+import { FeedbackWebhookSecretStore, startFeedbackWebhookDispatcher } from './services/feedback-webhook-dispatcher.js';
 import { resolveRegularGroupMode } from './services/chat-reply-mode-store.js';
 import { renameBotOnOpenPlatform, changeBotAvatarOnOpenPlatform } from './services/open-platform-rename.js';
 import { migrateSandboxConfigAtStartup } from './services/sandbox-migration.js';
@@ -73,13 +77,17 @@ import { isLocalCliOpenReady } from './services/local-cli-opener.js';
 import { RECEIVED_REACTION_EMOJI_TYPE, SUBSTITUTE_RECEIVED_REACTION_EMOJI_TYPE } from './core/pending-response.js';
 import { t as tr, localeForBot } from './i18n/index.js';
 import { createCliAdapterSync } from './adapters/cli/registry.js';
-import { initWorkerPool, setActiveSessionsRegistry, forkWorker, forkAdoptWorker, sendWorkerInput, promoteQueuedActivationTail, admitQueuedActivationTail, reserveQueuedActivationTailAdmission, codexAppCleanInputAcceptedForSession, hasQueuedActivationAdmissionGate, sendWorkerSessionInput, killWorker, reapOrphanWorkers, scheduleCardPatch, setCurrentCliVersion, getCurrentCliVersion, CARD_POSTING_SENTINEL, parkStreamCard, closeSession as closeSessionHelper, setActiveSessionIfActive, rollbackRejectedSessionAndGetWinner, ensureCliEnv, sweepGlobalBotmuxSkills, writableTerminalLinkFor, workerHasInitialized, sessionSupportsWebTerminal, readableTerminalUrlFor, findActiveBySessionId, withActiveSessionKeyLock, getDaemonBootId, getDaemonStreamingCardUsageSnapshot, postTurnStartingCard, isSessionTransferring, } from './core/worker-pool.js';
+import { initWorkerPool, setActiveSessionsRegistry, forkWorker, forkAdoptWorker, sendWorkerInput, promoteQueuedActivationTail, admitQueuedActivationTail, reserveQueuedActivationTailAdmission, codexAppCleanInputAcceptedForSession, hasQueuedActivationAdmissionGate, sendWorkerSessionInput, killWorker, reapOrphanWorkers, scheduleCardPatch, setCurrentCliVersion, getCurrentCliVersion, CARD_POSTING_SENTINEL, parkStreamCard, closeSession as closeSessionHelper, setActiveSessionIfActive, rollbackRejectedSessionAndGetWinner, ensureCliEnv, sweepGlobalBotmuxSkills, writableTerminalLinkFor, workerHasInitialized, sessionSupportsWebTerminal, readableTerminalUrlFor, findActiveBySessionId, withActiveSessionKeyLock, getDaemonBootId, getDaemonStreamingCardUsageSnapshot, postTurnStartingCard, isSessionTransferring, snapshotCodexAppFinalSettlements, codexAppFinalSettlementCount, } from './core/worker-pool.js';
+import { waitAllWithin, trackProducerQuiet, trackProcessExited } from './core/producer-quiescence.js';
 import { AbortDeadlineError, hasExactSafeJsonKeys, ipcRoute, isTrustedHostIpcRequest, JsonBodyTooLargeError, jsonRes, readJsonBody, runWithAbortDeadline, setBotName, setLarkAppId, startIpcServer, setBotRenamer, setBotAvatarChanger, armCoreOnlyReadinessGate, setCoreOnlyReady, setSupervisorShutdownHandler } from './core/dashboard-ipc-server.js';
 import { setDeviceIsolationDaemonIdentity } from './core/device-isolation-daemon.js';
 import { cancelSessionReadyAck, waitForSessionReadyAck, } from './core/session-ready-handshake.js';
 import { loadOrCreateDashboardSecret, loadPersistedToken } from './dashboard/auth.js';
-import { daemonIpcAuthHeaders, loadDaemonIpcSecret } from './core/daemon-ipc-auth.js';
+import { daemonIpcAuthHeaders, fetchDaemonIpc, loadDaemonIpcSecret } from './core/daemon-ipc-auth.js';
 import { authorizeSessionScopedIpc, bindSessionScopedIpcIdentity, } from './core/daemon-ipc-session-auth.js';
+import { authorizeReportSessionRelayRequest, buildOrchestratorReportTrigger, REPORT_SESSION_RELAY_MAX_BYTES, REPORT_SESSION_RELAY_ROUTE, } from './core/report-session-relay.js';
+import { createDispatchReportBinding, dispatchReportBindingSecretPath, DISPATCH_REPORT_REGISTER_MAX_BYTES, DISPATCH_REPORT_REGISTER_ROUTE, } from './core/dispatch-report-binding.js';
+import { recordDispatchRegistryEntry } from './core/dispatch-registry.js';
 import { saveFrozenCards } from './services/frozen-card-store.js';
 import { DAEMON_COMMANDS, SESSIONLESS_DAEMON_COMMANDS, EXISTING_SESSION_ONLY_DAEMON_COMMANDS, resolvePassthroughCommands, resolveAdapterDefaultPassthroughCommands, handleCommand, handleCardCommand, handleTermLinkCommand, parseSlashCommandInvocation, parseForceTopicInvocation } from './core/command-handler.js';
 import { docWatchCommandNeedsSession } from './core/doc-watch-command.js';
@@ -88,13 +96,13 @@ import { findInheritablePeer } from './core/inherit-peer.js';
 import { isCallbackUrl, handleCallbackUrl } from './utils/user-token.js';
 import { consumeQuota, removeChatGrant, removeGlobalGrant } from './services/grant-store.js';
 import { abortCharge, commitCharge, beginCharge } from './services/quota-dedup.js';
-import { getSessionWorkingDir, getProjectScanDirs, getProjectScanDirsForBot, expandHome, downloadResources, formatAttachmentsHint, buildNewTopicCliInput, buildFollowUpCliInput, buildBridgeInputContent, buildReforkCliInput, getAvailableBots, restoreActiveSessions, executeScheduledTask, persistStreamCardState, rememberLastCliInput, ensureTerminalWorkerPort, ensureSessionWhiteboard, closeCliMismatchedSessionsForBot, } from './core/session-manager.js';
-import { triggerSessionTurn, reconcileIdempotencyLeasesOnBoot, convergeIdempotentAsyncTurnOnWorkerExit } from './core/trigger-session.js';
+import { getSessionWorkingDir, getProjectScanDirs, getProjectScanDirsForBot, expandHome, downloadResources, formatAttachmentsHint, buildNewTopicCliInput, buildFollowUpCliInput, buildBridgeInputContent, buildReforkCliInput, getAvailableBots, restoreActiveSessions, executeScheduledTask, persistStreamCardState, rememberLastCliInput, ensureTerminalWorkerPort, ensureSessionWhiteboard, resumeSession, closeCliMismatchedSessionsForBot, } from './core/session-manager.js';
+import { triggerSessionTurn, reconcileIdempotencyLeasesOnBoot, convergeIdempotentAsyncTurnOnWorkerExit, externalEventOpensOwnTopic } from './core/trigger-session.js';
 import { runDetachedBotTurnMutation, tryWithBotTurnMutation, withBotTurnAdmission, withBotTurnMutation, } from './core/bot-turn-mutation-gate.js';
 import { claimInitialUserTurn, isInitialUserTurnPending, releaseInitialUserTurn } from './core/initial-user-turn.js';
 import { applyQueuedCodexAppLegacyFallback, mergeQueuedCodexAppTurn } from './core/session-create.js';
 import { findOnlineDaemon, listOnlineDaemons } from './utils/daemon-discovery.js';
-import { beginReplyTargetTurn, buildTurnParticipantsFrom, fallbackTurnId, isSubstituteTurn, resolveSessionReplyTarget, syncReplyTargetState } from './core/reply-target.js';
+import { beginReplyTargetTurn, buildTurnParticipantsFrom, fallbackTurnId, isSubstituteTurn, resolveInboundReplyTarget, resolveSessionReplyTarget, syncReplyTargetState } from './core/reply-target.js';
 import { readDeferredTopicBinding } from './core/deferred-topic-binding.js';
 import { buildBotmuxLarkNativeSessionTitle, extractBotmuxLarkNativeSessionTitlePrompt, } from './core/session-title.js';
 import { settleDeferredScheduleRun } from './core/deferred-schedule-settlement.js';
@@ -187,11 +195,14 @@ import { computeCocoPickerKeys } from './core/coco-picker-keys.js';
 import { createLarkAskCardDispatcher } from './im/lark/ask-card.js';
 import { normalizeVcMeetingEvents } from './vc-agent/normalizer.js';
 import { beginVcIngestionPass, collectStableTranscriptItems, createVcMeetingSessionState, ingestNormalizedVcMeetingItems, markVcTranscriptItemsFlushed, } from './vc-agent/meeting-state.js';
-import { fetchMeetingEventsAsBot, joinMeetingAsBot, sendMeetingTextMessageAsBot, } from './vc-agent/polling-source.js';
+import { ensureLarkCliBotProfile, fetchMeetingEventsAsBot, joinMeetingAsBot, sendMeetingTextMessageAsBot, } from './vc-agent/polling-source.js';
 import { buildVcMeetingConfirmCard, buildVcMeetingConsumerCard, buildVcMeetingConsumerRecoveryCard, buildVcMeetingListenerRejoinCard, buildVcMeetingOutputReviewCard, } from './vc-agent/cards.js';
 import { connectRealtimeVoiceTransport, createProtoRealtimeVoiceProtocol, fetchRealtimeVoiceEndpoint, RealtimeVoiceSession, } from './vc-agent/realtime/index.js';
 import { createGroupWithBots } from './services/group-creator.js';
 import { addBotToChat, isInChat } from './services/groups-store.js';
+import { initSessionGroups, isSessionGroup, getSessionGroup, touchSessionGroup } from './services/session-groups-store.js';
+import { maybeBirthSessionGroup } from './core/session-group-birth.js';
+import { scheduleSessionGroupTitle } from './services/session-group-title.js';
 import { setChatReplyMode } from './services/chat-reply-mode-store.js';
 import { hasVcMeetingEndedTombstone, listVcMeetingRuntimeSessionsByListenerAndAgent, listVcMeetingRuntimeSessions, pruneExpiredVcMeetingRuntimeSessions, recordVcMeetingEndedTombstone, recordVcMeetingRuntimeSession, removeVcMeetingRuntimeSession, } from './services/vc-meeting-runtime-store.js';
 import { computeVcMeetingConsumerProfileHash, normalizeVcMeetingProfileInstructions, } from './services/vc-meeting-profile-instructions.js';
@@ -1085,6 +1096,17 @@ const VC_MEETING_ACTIVATION_CONTEXT_FIELD = 'vc_meeting_activation_context';
 const VC_MEETING_ACTIVATION_CONTEXT_MAX_CHARS = 2_000;
 const vcMeetingEndedTombstones = new BoundedMap(2_000);
 const vcMeetingPendingInvites = new BoundedMap(2_000);
+/**
+ * De-dupes the owner DM for an eager-join failure that happens BEFORE a session
+ * exists (invite carries only a meeting_no, no meeting.id — so there is no
+ * session to hang `inviteFailureNotified` on). Keyed by `${larkAppId}:${no}`;
+ * bounded and best-effort. Cleared once the meeting is successfully joined so a
+ * later genuine failure can still notify. */
+const vcMeetingEagerJoinFailureNotified = new BoundedMap(2_000);
+const VC_MEETING_EAGER_JOIN_FAILURE_TTL_MS = 30 * 60 * 1000;
+function vcMeetingEagerJoinFailureKey(larkAppId, meetingNo) {
+    return `${larkAppId}:${meetingNo}`;
+}
 function vcMeetingSessionKey(larkAppId, meetingId) {
     return `${larkAppId}:${meetingId}`;
 }
@@ -1268,6 +1290,70 @@ function vcMeetingConfiguredBotConfigs() {
 function vcMeetingConfiguredBotConfig(larkAppId) {
     return vcMeetingConfiguredBotConfigs().find(cfg => cfg.larkAppId === larkAppId);
 }
+/**
+ * Ensure the lark-cli bot profile used for `--as bot` meeting join actually
+ * exists, provisioning it from the bot's stored appSecret when absent.
+ *
+ * Historically `larkCliProfile` defaulted to the bot's own appId (see the
+ * dashboard managed-listener bootstrap) but nothing ever registered that
+ * profile with lark-cli, so the first real invite failed with "profile not
+ * found" and the bot was stuck ringing. This closes the gap in the trusted
+ * daemon process (the secret only reaches lark-cli's encrypted store, never a
+ * worker/sandbox and never argv). Idempotent: a present profile is a no-op.
+ */
+function ensureVcMeetingJoinProfile(larkAppId, cfg) {
+    const profile = cfg.larkCliProfile?.trim();
+    if (!profile) {
+        return { ok: false, reason: 'no_profile', error: '缺少 vcMeetingAgent.larkCliProfile' };
+    }
+    const botCfg = vcMeetingLocalBotConfig(larkAppId) ?? vcMeetingConfiguredBotConfig(larkAppId);
+    const result = ensureLarkCliBotProfile({
+        profileName: profile,
+        appId: larkAppId,
+        appSecret: botCfg?.larkAppSecret ?? '',
+        ...(botCfg?.brand ? { brand: botCfg.brand } : {}),
+    });
+    if (result.ok) {
+        if (result.created) {
+            logger.info(`[vc-agent] auto-provisioned lark-cli profile ${profile} for ${larkAppId} before join`);
+        }
+        return { ok: true, profile, created: result.created };
+    }
+    return { ok: false, reason: result.reason, profile, error: result.error };
+}
+/** Actionable, operator-facing text for a failed join-profile provision. */
+function vcMeetingJoinProfileErrorText(larkAppId, result) {
+    switch (result.reason) {
+        case 'no_profile':
+            return '缺少 vcMeetingAgent.larkCliProfile，拒绝使用 lark-cli 默认 profile 入会';
+        case 'missing_secret':
+            return `无法为 ${larkAppId} 自动创建 lark-cli profile「${result.profile}」：配置里没有该 bot 的 appSecret（apiOnly bot 无法入会）`;
+        case 'add_failed':
+            return `自动创建 lark-cli profile「${result.profile}」失败：${result.error}`;
+    }
+}
+/**
+ * DM the meeting-agent owner when an invite fails, so a broken join no longer
+ * shows up only as a silently-ringing bot + one log line. Best-effort and
+ * de-duped per session so retries don't spam. `errorText` is already the
+ * actionable operator-facing message from startVcMeetingMonitoring.
+ */
+function notifyVcMeetingInviteFailure(larkAppId, cfg, session, meeting, errorText) {
+    if (session) {
+        if (session.inviteFailureNotified)
+            return;
+        session.inviteFailureNotified = true;
+    }
+    const target = vcMeetingTargetOpenId(larkAppId, cfg);
+    if (!target)
+        return;
+    const title = vcMeetingTitle(meeting);
+    void sendUserMessage(larkAppId, target, `⚠️ 机器人未能加入会议「${title}」。\n\n原因：${errorText}\n\n`
+        + '请到 dashboard 检查该会议 bot 的 lark-cli profile / appSecret / VC 权限后重新邀请。', 'text').catch((err) => {
+        logger.warn(`[vc-agent] invite failure notice failed meeting=${meeting.id || '?'}: `
+            + `${err instanceof Error ? err.message : String(err)}`);
+    });
+}
 function vcMeetingConsumerBotOnline(larkAppId) {
     return !!vcMeetingLocalBotConfig(larkAppId) || !!findOnlineDaemon(larkAppId);
 }
@@ -1459,6 +1545,12 @@ async function ensureVcMeetingReceiverSession(request, existingSessionId, receiv
     if (!isolation.decision.ok) {
         throw new Error(`receiver agent ${selfAppId} has no managed side-effect isolation: ${isolation.decision.error}`);
     }
+    // Plan B: the receiver runs sandboxed only when the bot actually opted in and
+    // the boundary is deliverable. An unsandboxed opt-out (isolated:false) must
+    // spawn WITHOUT the sandbox — hardcoding sandbox=true here would confine a bot
+    // whose environment/working dir was never set up for bwrap, and the CLI would
+    // fail to spawn or be unable to work (the "joined but never replies" bug).
+    const receiverSandboxed = isolation.decision.isolated;
     const rawWorkingDir = findOncallChat(selfAppId, chatId)?.workingDir
         ?? effectiveDefaultWorkingDir(bot.config)
         ?? bot.config.workingDir
@@ -1481,11 +1573,12 @@ async function ensureVcMeetingReceiverSession(request, existingSessionId, receiv
     session.cliId = bot.config.cliId;
     // Freeze the security-critical launch decision at receiver creation.  A
     // later live Bot-config edit must neither weaken this session nor make an
-    // old unisolated receiver appear eligible retroactively.
-    session.sandbox = true;
-    session.sandboxHidePaths = bot.config.sandboxHidePaths ?? [];
-    session.sandboxReadonlyPaths = bot.config.sandboxReadonlyPaths ?? [];
-    session.sandboxNetwork = bot.config.sandboxNetwork !== false;
+    // old unisolated receiver appear eligible retroactively. Under plan B the
+    // frozen value follows the bot's opt-in, not a hardcoded true.
+    session.sandbox = receiverSandboxed;
+    session.sandboxHidePaths = receiverSandboxed ? (bot.config.sandboxHidePaths ?? []) : [];
+    session.sandboxReadonlyPaths = receiverSandboxed ? (bot.config.sandboxReadonlyPaths ?? []) : [];
+    session.sandboxNetwork = receiverSandboxed ? (bot.config.sandboxNetwork !== false) : true;
     session.backendType = isolation.backendType;
     sessionStore.updateSession(session);
     const ds = {
@@ -2052,23 +2145,6 @@ function receivedReactionEmojiFor(ds) {
         return RECEIVED_REACTION_EMOJI_TYPE;
     }
 }
-function readSessionFreshFromDisk(sessionId, larkAppId) {
-    const paths = [
-        join(config.session.dataDir, `sessions-${larkAppId}.json`),
-        join(config.session.dataDir, 'sessions.json'),
-    ];
-    for (const fp of paths) {
-        if (!existsSync(fp))
-            continue;
-        try {
-            const data = JSON.parse(readFileSync(fp, 'utf-8'));
-            if (data[sessionId])
-                return data[sessionId];
-        }
-        catch { /* ignore corrupt/racing session file */ }
-    }
-    return undefined;
-}
 export async function noteTurnReceived(ds, triggerMessageId, _prompt, _sender, _turnId, receivedReactionEmoji) {
     // Replaces the old 「处理中」 placeholder card. That card existed only to be
     // PATCHed with the final answer, and `im.v1.message.patch` is silent (no Feishu
@@ -2239,7 +2315,7 @@ async function sessionReply(anchor, content, msgType = 'text', larkAppId, turnId
             return replyWithHookPolicy(root.rootMessageId, content, msgType, true, opts.uuid);
         }
         if (ds?.scope === 'chat') {
-            const fresh = readSessionFreshFromDisk(ds.session.sessionId, ds.larkAppId);
+            const fresh = sessionStore.readSessionRowFromDisk(ds.session.sessionId, ds.larkAppId);
             if (fresh)
                 syncReplyTargetState(ds, fresh);
             // Resolve through fallbackTurnId so daemon-side sends that carry no turn of
@@ -3127,6 +3203,7 @@ async function prewarmDocCommentSession(ds, sub) {
             botCliPathOverride: botCfg.cliPathOverride,
             sender,
             mode: 'live',
+            turnId,
         });
         rememberLastCliInput(ds, promptContent, cliInput);
         sessionStore.updateSession(ds.session);
@@ -3145,6 +3222,7 @@ async function prewarmDocCommentSession(ds, sub) {
             botIdentity: { name: bot.botName, openId: bot.botOpenId },
             sender,
             mode: 'refork',
+            turnId,
         });
         rememberLastCliInput(ds, promptContent, wrappedInput);
         sessionStore.updateSession(ds.session);
@@ -3161,6 +3239,24 @@ const commandDeps = {
     lastRepoScan,
     prewarmDocCommentSession,
 };
+/** Bind every reply produced by one slash-command invocation to the routing
+ * decision already made for its inbound Lark message. Commands return before
+ * the normal turn-registration path, and lifecycle commands may remove or
+ * replace their session before replying, so mutable session state cannot be
+ * the authority for placement here. */
+function commandDepsForInvocation(input) {
+    const replyTarget = resolveInboundReplyTarget({
+        scope: input.scope,
+        chatId: input.chatId,
+        threadRootId: input.anchor,
+        replyRootId: input.replyRootId,
+    });
+    return {
+        ...commandDeps,
+        invocationReplyTarget: replyTarget,
+        sessionReply: (rootId, content, msgType, larkAppId, turnId, opts) => sessionReply(rootId, content, msgType, larkAppId, turnId ?? input.messageId, opts?.replyTarget ? opts : { ...opts, replyTarget }),
+    };
+}
 /**
  * Fire a session-less daemon command (`/group`, `/g`) WITHOUT blocking the Lark
  * event ACK on its slow work — the fast-ACK path.
@@ -3181,8 +3277,8 @@ const commandDeps = {
  * wraps its whole body in try/catch and replies failures to the chat; the `.catch`
  * here is only a last-resort backstop for anything that somehow escapes.
  */
-function fireSessionlessCommandDetached(cmd, anchor, message, larkAppId) {
-    void handleCommand(cmd, anchor, message, commandDeps, larkAppId).catch((err) => logger.error(`[sessionless ${cmd}] ${anchor.substring(0, 12)} failed: ${err?.message ?? err}`));
+function fireSessionlessCommandDetached(cmd, anchor, message, larkAppId, deps) {
+    void handleCommand(cmd, anchor, message, deps, larkAppId).catch((err) => logger.error(`[sessionless ${cmd}] ${anchor.substring(0, 12)} failed: ${err?.message ?? err}`));
 }
 // Dependencies passed to card-handler
 // v3 run-level progress is a best-effort IM projection. journal.ndjson remains
@@ -3975,6 +4071,187 @@ workflowDaemonMutationRoute('grant', async (reply, params, body, identity) => {
     v3GateRunner.driveDetached(runId);
     return reply(202, { ok: true, runId, ...outcome });
 });
+// ─── report session relay：隔离 CLI 的 dispatch 完成回注 ──────────────────
+//
+// Linux credential-only bwrap / macOS read isolation 都
+// 不允许 CLI 读取 `.dashboard-secret`。这里验证 source session 当前轮换的
+// capability，并把 dispatch root 与 daemon 自己的 live session 绑定；目标
+// app/session 只从宿主签名的 dispatch binding 派生，再由本 daemon 用 HMAC 转发。
+ipcRoute('POST', DISPATCH_REPORT_REGISTER_ROUTE, async (req, res) => {
+    let raw;
+    try {
+        raw = await readJsonBody(req, DISPATCH_REPORT_REGISTER_MAX_BYTES);
+    }
+    catch (error) {
+        if (error instanceof JsonBodyTooLargeError) {
+            return jsonRes(res, 413, { ok: false, error: 'body_too_large' });
+        }
+        return jsonRes(res, 400, { ok: false, error: 'bad_json' });
+    }
+    const body = raw && typeof raw === 'object' && !Array.isArray(raw)
+        ? raw
+        : undefined;
+    const sessionId = typeof body?.sessionId === 'string' ? body.sessionId.trim() : '';
+    const seedText = typeof body?.seedText === 'string' ? body.seedText.trim() : '';
+    const targetChatId = typeof body?.targetChatId === 'string' ? body.targetChatId.trim() : '';
+    const title = typeof body?.title === 'string' ? body.title.trim().slice(0, 200) : '';
+    if (!sessionId)
+        return jsonRes(res, 400, { ok: false, error: 'missing_session_id' });
+    if (!seedText) {
+        return jsonRes(res, 400, { ok: false, error: 'missing_seed_text' });
+    }
+    if (!/^oc_[A-Za-z0-9_-]{1,128}$/.test(targetChatId)) {
+        return jsonRes(res, 400, { ok: false, error: 'bad_target_chat_id' });
+    }
+    const ds = findActiveBySessionId(sessionId);
+    const verified = authorizeSessionScopedIpc({
+        trustedHost: isTrustedHostIpcRequest(req),
+        sessionExists: !!ds && ds.session.sessionId === sessionId,
+        receiverSession: !!ds?.session.vcMeetingReceiver,
+        allowReceiver: false,
+        sessionId,
+        ...(ds?.managedTurnOrigin ? { liveOrigin: ds.managedTurnOrigin } : {}),
+        ...(typeof body?.originCapability === 'string'
+            ? { claimedCapability: body.originCapability }
+            : {}),
+        ...(typeof body?.originTurnId === 'string' ? { claimedTurnId: body.originTurnId } : {}),
+        ...(typeof body?.originDispatchAttempt === 'number'
+            ? { claimedDispatchAttempt: body.originDispatchAttempt }
+            : {}),
+    });
+    if (!verified.ok)
+        return jsonRes(res, 403, { ok: false, error: verified.error });
+    if (!ds || !ds.larkAppId || ds.larkAppId !== selfDaemonLarkAppId) {
+        return jsonRes(res, 403, { ok: false, error: 'session_identity_incomplete' });
+    }
+    let dispatchRoot;
+    try {
+        dispatchRoot = await sendMessage(ds.larkAppId, targetChatId, seedText, 'text');
+    }
+    catch (error) {
+        return jsonRes(res, 502, {
+            ok: false,
+            error: 'dispatch_seed_send_failed',
+            detail: error instanceof Error ? error.message : String(error),
+        });
+    }
+    const bindingSecret = loadOrCreateDashboardSecret(dispatchReportBindingSecretPath(config.session.dataDir));
+    const issuedAt = new Date().toISOString();
+    const reportBinding = createDispatchReportBinding(bindingSecret, {
+        dispatchRoot,
+        targetLarkAppId: ds.larkAppId,
+        targetSessionId: ds.session.sessionId,
+        sourceName: title || 'dispatched subtask',
+        issuedAt,
+    });
+    const stringArray = (value) => Array.isArray(value)
+        ? value.filter((item) => typeof item === 'string')
+            .map(item => item.trim()).filter(Boolean).slice(0, 64)
+        : [];
+    try {
+        await recordDispatchRegistryEntry(join(config.session.dataDir, 'orchestrate-dispatch.json'), dispatchRoot, {
+            orchRoot: ds.session.rootMessageId ?? '',
+            orchChatId: ds.session.chatId,
+            orchScope: ds.scope ?? ds.session.scope ?? 'thread',
+            orchAppId: ds.larkAppId,
+            orchSessionId: ds.session.sessionId,
+            targetChatId,
+            targetAppIds: stringArray(body?.targetAppIds),
+            title,
+            bots: stringArray(body?.bots),
+            createdAt: issuedAt,
+            reportBinding,
+        });
+    }
+    catch (error) {
+        return jsonRes(res, 500, {
+            ok: false,
+            error: 'dispatch_registry_write_failed',
+            detail: error instanceof Error ? error.message : String(error),
+        });
+    }
+    return jsonRes(res, 201, { ok: true, dispatchRoot });
+});
+ipcRoute('POST', REPORT_SESSION_RELAY_ROUTE, async (req, res) => {
+    let raw;
+    try {
+        raw = await readJsonBody(req, REPORT_SESSION_RELAY_MAX_BYTES);
+    }
+    catch (error) {
+        if (error instanceof JsonBodyTooLargeError) {
+            return jsonRes(res, 413, { ok: false, error: 'body_too_large' });
+        }
+        return jsonRes(res, 400, { ok: false, error: 'bad_json' });
+    }
+    const claimedSessionId = raw && typeof raw === 'object' && !Array.isArray(raw)
+        ? raw.sessionId
+        : undefined;
+    const ds = typeof claimedSessionId === 'string'
+        ? findActiveBySessionId(claimedSessionId)
+        : undefined;
+    let registry = {};
+    try {
+        const parsed = JSON.parse(readFileSync(join(config.session.dataDir, 'orchestrate-dispatch.json'), 'utf8'));
+        if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+            registry = parsed;
+        }
+    }
+    catch { /* missing/malformed registry fails closed below */ }
+    const decision = authorizeReportSessionRelayRequest({
+        raw,
+        trustedHost: isTrustedHostIpcRequest(req),
+        session: ds
+            ? {
+                sessionId: ds.session.sessionId,
+                larkAppId: ds.larkAppId,
+                receiver: !!ds.session.vcMeetingReceiver,
+                scope: ds.scope ?? ds.session.scope,
+                rootMessageId: ds.session.rootMessageId,
+                ...(ds.managedTurnOrigin ? { liveOrigin: ds.managedTurnOrigin } : {}),
+                ...(ds.session.quoteTargetId ? { quoteTargetId: ds.session.quoteTargetId } : {}),
+                ...(ds.session.replyTargets ? { replyTargets: ds.session.replyTargets } : {}),
+                ...((ds.currentReplyTarget ?? ds.session.currentReplyTarget)
+                    ? { currentReplyTarget: ds.currentReplyTarget ?? ds.session.currentReplyTarget }
+                    : {}),
+            }
+            : undefined,
+        selfLarkAppId: selfDaemonLarkAppId,
+        registry,
+        bindingSecret: loadOrCreateDashboardSecret(dispatchReportBindingSecretPath(config.session.dataDir)),
+    });
+    if (!decision.ok) {
+        return jsonRes(res, decision.status, { ok: false, error: decision.error });
+    }
+    const targetDaemon = findOnlineDaemon(decision.target.larkAppId);
+    if (!targetDaemon) {
+        return jsonRes(res, 503, { ok: false, error: 'orchestrator_daemon_offline' });
+    }
+    const trigger = buildOrchestratorReportTrigger(decision, {
+        requestId: `report:${decision.source.sessionId}:${Date.now()}`,
+        receivedAt: new Date().toISOString(),
+    });
+    try {
+        const response = await fetchDaemonIpc(targetDaemon.ipcPort, '/api/trigger', {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify(trigger),
+        });
+        const responseBody = await response.json().catch(() => ({}));
+        return jsonRes(res, response.status, {
+            ...(responseBody && typeof responseBody === 'object' && !Array.isArray(responseBody)
+                ? responseBody
+                : {}),
+            reportTarget: decision.target,
+        });
+    }
+    catch (error) {
+        return jsonRes(res, 502, {
+            ok: false,
+            error: 'orchestrator_daemon_unreachable',
+            detail: error instanceof Error ? error.message : String(error),
+        });
+    }
+});
 // ─── v3 session relay：sandbox / read-isolation 会话的 workflow 变更通道 ─────
 //
 // 沙盒（Linux bwrap）/ read-isolation（macOS）里的 chat CLI 读不到宿主进程树
@@ -4532,6 +4809,57 @@ ipcRoute('GET', '/api/adopt-session/:pid', (_req, res, params) => {
     }
     return jsonRes(res, 404, { ok: false, error: 'no_adopt_session' });
 });
+/**
+ * 按 (cliId, cliSessionId) 在活跃会话里反查 CLI 原生会话绑定。
+ *
+ * 反查 identity 必须是组合键：OpenCode V1→V2 迁移会原样保留 ses_* id（同一
+ * id 同时存在于 V1 session 与 V2 session_v2），只按 cliSessionId 匹配会把
+ * V1 会话（cliId=opencode）当成唯一 hit，错投到 V1 话题。本查询只服务
+ * opencode2 共享托管 service，命中必须恰好一个：0 个 → miss，≥2 个
+ * （两个话题/机器人并发导入同一外部会话的重复绑定）→ conflict。
+ */
+export function matchCliSession(activeSessions, cliId, cliSessionId) {
+    const matches = [...activeSessions].filter((ds) => ds.session.cliId === cliId && ds.session.cliSessionId === cliSessionId);
+    if (matches.length === 0)
+        return { kind: 'miss' };
+    if (matches.length > 1)
+        return { kind: 'conflict' };
+    return { kind: 'hit', session: matches[0] };
+}
+// GET /api/session-by-cli/:cliId/:cliSessionId — 按 (cliId, cliSessionId) 反查
+// 活跃 botmux 会话路由。托管 service 场景（opencode2 的 ask 插件运行在所有
+// 客户端共用的 service 里）：hook 子进程继承的是启动该 service 时固化的 ambient
+// env，与当前会话无关；必须用 payload 携带的 native sessionID 显式反查，否则
+// 跨会话错投（多 bot/多会话会放行或错投到首个启动 service 的会话）。
+// 反查 identity 必须是 (cliId, cliSessionId)：OpenCode V1→V2 迁移会原样保留
+// ses_* id（真实环境验证同一 id 同时存在于 V1 session 与 V2 session_v2），
+// 只按 cliSessionId 匹配会把 V1 会话当成唯一 hit，V2 hook 的问题被投到 V1 话题。
+// 本端点只服务 opencode2 共享托管 service 的反查，强制 cliId === 'opencode2'；
+// 多命中返回 409 conflict，让反查侧 fail closed（歧义时 passthrough）。
+ipcRoute('GET', '/api/session-by-cli/:cliId/:cliSessionId', (_req, res, params) => {
+    const cliId = params.cliId;
+    const cliSessionId = params.cliSessionId;
+    if (cliId !== 'opencode2') {
+        return jsonRes(res, 400, { ok: false, error: 'unsupported_cli' });
+    }
+    if (!cliSessionId || cliSessionId.length > 512) {
+        return jsonRes(res, 400, { ok: false, error: 'bad_cli_session_id' });
+    }
+    const match = matchCliSession(activeSessions.values(), cliId, cliSessionId);
+    if (match.kind === 'miss') {
+        return jsonRes(res, 404, { ok: false, error: 'no_session' });
+    }
+    if (match.kind === 'conflict') {
+        return jsonRes(res, 409, { ok: false, error: 'ambiguous_cli_session' });
+    }
+    const ds = match.session;
+    return jsonRes(res, 200, {
+        sessionId: ds.session.sessionId,
+        chatId: ds.chatId,
+        larkAppId: ds.larkAppId,
+        rootMessageId: sessionAnchorId(ds),
+    });
+});
 for (const path of ['/api/vc-meetings/members/register', '/api/vc-meetings/members/update']) {
     ipcRoute('POST', path, async (req, res) => {
         if (!guardVcMeetingDaemonControlRoute(req, res))
@@ -6375,6 +6703,7 @@ async function applyVcMeetingTemporaryAuthCommand(active, parsed, input) {
         await sendMessage(session.larkAppId, listenerChatId, vcMeetingTemporaryAuthUsage(), 'text');
         return true;
     }
+    input.onMutating?.();
     const changed = [];
     const unchanged = [];
     for (const target of parsed.targets) {
@@ -6527,6 +6856,7 @@ async function handleVcMeetingTemporaryAuthCommand(input) {
         mentions: input.mentions,
         senderOpenId: input.senderOpenId,
         senderUnionId: input.senderUnionId,
+        onMutating: input.onMutating,
     });
 }
 function clearVcMeetingOutputRequestTimer(req) {
@@ -11234,13 +11564,14 @@ async function startVcMeetingMonitoring(input) {
                 throw new Error('meeting already ended');
             }
             if (input.forceJoin || !session.joined || session.listenerPresenceStale) {
-                if (!input.cfg.larkCliProfile) {
-                    throw new Error('缺少 vcMeetingAgent.larkCliProfile，拒绝使用 lark-cli 默认 profile 入会');
+                const provisioned = ensureVcMeetingJoinProfile(input.larkAppId, input.cfg);
+                if (!provisioned.ok) {
+                    throw new Error(vcMeetingJoinProfileErrorText(input.larkAppId, provisioned));
                 }
                 if (!meeting.meetingNo) {
                     throw new Error('会议事件没有 meeting_no，无法执行 BotJoinMeeting');
                 }
-                const joined = joinMeetingAsBot({ meetingNumber: meeting.meetingNo, profile: input.cfg.larkCliProfile });
+                const joined = joinMeetingAsBot({ meetingNumber: meeting.meetingNo, profile: provisioned.profile });
                 if (joined.meetingId && joined.meetingId !== meeting.id) {
                     if (input.forceJoin || session.listenerPresenceStale) {
                         throw new Error(`rejoin meeting id mismatch expected=${meeting.id} joined=${joined.meetingId}`);
@@ -12542,15 +12873,43 @@ async function handleVcMeetingPush(ctx) {
     if (ctx.kind === 'meeting_invited') {
         let meeting = ctx.meeting;
         let joinedByInvite = false;
-        if (!meeting.id && meeting.meetingNo && cfg.larkCliProfile) {
+        // Eager join: an invite that carries only a meeting_no (no meeting.id) must
+        // be joined here to learn the id. A failure in THIS block used to only WARN
+        // and then fall through to the silent "no meeting id yet" return below — so
+        // the original "profile not found → bot rings forever" bug produced no user
+        // signal at all (there is no session yet for the manual-invite DM path). We
+        // now DM the owner here too, deduped per meeting_no so redelivered invites
+        // don't spam.
+        if (!meeting.id && meeting.meetingNo) {
+            const eagerNo = meeting.meetingNo;
+            const notifyEagerFailure = (errorText) => {
+                const dmKey = vcMeetingEagerJoinFailureKey(ctx.larkAppId, eagerNo);
+                const last = vcMeetingEagerJoinFailureNotified.get(dmKey);
+                const now = Date.now();
+                if (last !== undefined && now - last <= VC_MEETING_EAGER_JOIN_FAILURE_TTL_MS)
+                    return;
+                vcMeetingEagerJoinFailureNotified.set(dmKey, now);
+                // session is undefined here → notify skips per-session dedup and sends.
+                notifyVcMeetingInviteFailure(ctx.larkAppId, cfg, undefined, meeting, errorText);
+            };
             try {
-                const joined = joinMeetingAsBot({ meetingNumber: meeting.meetingNo, profile: cfg.larkCliProfile });
+                // A missing larkCliProfile previously skipped this whole block (the old
+                // `&& cfg.larkCliProfile` guard) and died silently; surface it instead.
+                const provisioned = ensureVcMeetingJoinProfile(ctx.larkAppId, cfg);
+                if (!provisioned.ok)
+                    throw new Error(vcMeetingJoinProfileErrorText(ctx.larkAppId, provisioned));
+                const joined = joinMeetingAsBot({ meetingNumber: eagerNo, profile: provisioned.profile });
                 meeting = { ...meeting, id: joined.meetingId };
                 joinedByInvite = true;
-                logger.info(`[vc-agent] manual invite joined before session create meeting=${meeting.id} meetingNo=${meeting.meetingNo} profile=${cfg.larkCliProfile}`);
+                // Success → clear any prior failure tombstone so a later real failure
+                // (e.g. rotated secret on a subsequent meeting) can notify again.
+                vcMeetingEagerJoinFailureNotified.delete(vcMeetingEagerJoinFailureKey(ctx.larkAppId, eagerNo));
+                logger.info(`[vc-agent] manual invite joined before session create meeting=${meeting.id} meetingNo=${eagerNo} profile=${provisioned.profile}`);
             }
             catch (err) {
-                logger.warn(`[vc-agent] manual invite join failed meetingNo=${meeting.meetingNo}: ${err instanceof Error ? err.message : String(err)}`);
+                const message = err instanceof Error ? err.message : String(err);
+                logger.warn(`[vc-agent] manual invite join failed meetingNo=${eagerNo}: ${message}`);
+                notifyEagerFailure(message);
             }
         }
         if (!meeting.id) {
@@ -12575,6 +12934,7 @@ async function handleVcMeetingPush(ctx) {
         });
         if (!result.ok) {
             logger.warn(`[vc-agent] manual invite start failed meeting=${meeting.id}: ${result.error}`);
+            notifyVcMeetingInviteFailure(ctx.larkAppId, cfg, session, meeting, result.error);
         }
         else {
             deleteVcMeetingPendingInvite(key);
@@ -12871,6 +13231,7 @@ export const __vcMeetingAgentTest = {
         vcMeetingEndedTombstones.clear();
         for (const key of [...vcMeetingPendingInvites.keys()])
             deleteVcMeetingPendingInvite(key);
+        vcMeetingEagerJoinFailureNotified.clear();
     },
 };
 // ─── Event handling ──────────────────────────────────────────────────────────
@@ -13219,6 +13580,10 @@ function releaseQueuedActivationReservation(ds, acknowledgedToken) {
         const bot = getBot(ds.larkAppId);
         const cliId = ds.session.cliId ?? bot.config.cliId;
         const rawCodexText = (ds.pendingCodexAppFollowUps ?? []).join('\n\n');
+        const bufferedTurnIds = ds.pendingFollowUpTurnIds ?? [];
+        const turnId = bufferedTurnIds[bufferedTurnIds.length - 1]
+            ?? ds.currentReplyTarget?.turnId
+            ?? `queued-activation-followup-${randomUUID()}`;
         const followUp = buildFollowUpCliInput(buffered.join('\n\n'), ds.session.sessionId, {
             cliId,
             cliPathOverride: ds.session.cliPathOverride ?? bot.config.cliPathOverride,
@@ -13227,15 +13592,13 @@ function releaseQueuedActivationReservation(ds, acknowledgedToken) {
             chatId: ds.chatId,
             whiteboardId: ds.session.whiteboardId,
             codexAppText: rawCodexText || buffered.join('\n\n'),
+            sessionBackendType: ds.session.backendType,
+            turnId,
             codexAppApplicationContext: ds.pendingCodexAppApplicationContext,
             codexAppMessageContext: (ds.pendingCodexAppFollowUpContexts ?? [])
                 .filter(Boolean)
                 .join('\n\n'),
         });
-        const bufferedTurnIds = ds.pendingFollowUpTurnIds ?? [];
-        const turnId = bufferedTurnIds[bufferedTurnIds.length - 1]
-            ?? ds.currentReplyTarget?.turnId
-            ?? `queued-activation-followup-${randomUUID()}`;
         const reservation = reserveQueuedActivationTailAdmission(ds);
         const bufferedGateDecisions = ds.pendingCodexAppFollowUpGateAccepted ?? [];
         // Runtime buffers are rolling-upgrade compatibility only. If they carry an
@@ -13526,6 +13889,7 @@ function deliverPassthroughToExistingSession(ds, cmd, commandContent, anchor, la
             content: commandContent,
             turnId: turn.messageId,
         });
+        turn.onDelivered?.();
         markSessionActivity(ds);
         logger.info(`[${anchor.substring(0, 12)}] Passthrough ${cmd} → worker`);
         return;
@@ -13534,7 +13898,7 @@ function deliverPassthroughToExistingSession(ds, cmd, commandContent, anchor, la
 }
 export const __testOnly_deliverPassthroughToExistingSession = deliverPassthroughToExistingSession;
 async function startInitialPassthroughSession(args) {
-    const { larkAppId, chatId, chatType, scope, anchor, messageId, replyRootId, parsed, cmd, commandContent, senderOpenId, substitute, senderUnionId, memberUnionId, ownerOpenId, ownerUnionId, creatorOpenId, botSender, senderIsBot, cardlessForceTopicSeed, routeToCanonicalOwner, } = args;
+    const { larkAppId, chatId, chatType, scope, anchor, messageId, replyRootId, parsed, cmd, commandContent, senderOpenId, substitute, senderUnionId, memberUnionId, ownerOpenId, ownerUnionId, creatorOpenId, botSender, senderIsBot, cardlessForceTopicSeed, onDurablyAdmitted, routeToCanonicalOwner, } = args;
     if (!await enforceMessageQuotaForCliInput(larkAppId, chatId, senderOpenId, messageId, anchor, senderUnionId, memberUnionId, chatType, botSender)) {
         return;
     }
@@ -13625,9 +13989,14 @@ async function startInitialPassthroughSession(args) {
     }
     messageQueue.ensureQueue(anchor);
     messageQueue.appendMessage(anchor, { ...parsed, content: commandContent });
+    // 接纳标记按分支下沉，不绑在 appendMessage 上：queues/*.jsonl 仅供 dashboard
+    // 预览，无投递重放语义；且 replyInvalidWorkingDirs 是「放弃本轮」分支（关闭
+    // 会话后才回复），放弃前的失败必须保持「请重发」提示。
     if (pinnedWorkingDir && autoWt) {
         if (await replyInvalidWorkingDirs(anchor, larkAppId, ds))
             return;
+        // 已 durable staging（auto_worktree）且通过放弃闸：detached 建库流程接管投递。
+        onDurablyAdmitted?.();
         ds.initialStartPending = false; // pendingRepo/worktree now owns buffering
         // 挂起态提交：worktree 建好后经 runAutoWorktreeCommit → commitRepoSelection 拉起
         // pendingRawInput 冷启动会话。detach → 立即返回，不阻塞本条消息处理。
@@ -13645,6 +14014,8 @@ async function startInitialPassthroughSession(args) {
         });
         const availableBots = await getAvailableBots(larkAppId, chatId);
         forkReservedInitialRawSession(ds, availableBots);
+        // fork 成功即开场已交给 CLI；fork 抛错则本轮只存在于内存，保持重发提示。
+        onDurablyAdmitted?.();
         const reason = oncallEntry
             ? `oncall-bound chat ${chatId}`
             : inheritedFrom
@@ -13660,6 +14031,9 @@ async function startInitialPassthroughSession(args) {
     if (projects.length > 0) {
         ds.initialStartPending = false; // pendingRepo/card now owns buffering
         lastRepoScan.set(chatId, projects);
+        // 已 durable staging（picker）且通过放弃闸；接下来卡片发送失败不得诱导重发
+        //（重发会在 pendingRepo 缓冲里再入一份）。
+        onDurablyAdmitted?.();
         const cardJson = buildRepoSelectCard(projects, getSessionWorkingDir(ds), anchor, localeForBot(larkAppId), getBot(larkAppId).config.worktreeMultiPicker);
         ds.repoCardMessageId = await sessionReply(anchor, cardJson, 'interactive', larkAppId);
         persistPendingRepoCardMessageId(ds, ds.repoCardMessageId);
@@ -13667,6 +14041,9 @@ async function startInitialPassthroughSession(args) {
         logger.info(`[${tag(ds)}] Waiting for repo selection before initial raw passthrough (${projects.length} projects)`);
         return;
     }
+    // 已 durable staging（picker，含 rawInput）且通过放弃闸：fork 失败后本条 raw
+    // passthrough 仍 durable 挂在会话上，重发会重复执行非幂等命令——先打接纳标。
+    onDurablyAdmitted?.();
     ds.pendingRepo = false;
     await maybeSeedCardlessForceTopicTurn({
         ds,
@@ -13694,8 +14071,49 @@ function mergeVcMeetingApplicationContext(existing, incoming) {
         return undefined;
     return `${[...new Set(lines)].join('\n')}\n`;
 }
+/** 本轮 inbound 已被真正接纳后打标：durable 写入（queuedActivationTail /
+ * pendingRepo staging）且已通过 replyInvalidWorkingDirs 之类的放弃闸，或已实际
+ * 送达 worker（live send 被接受 / refork·初次冷 fork 成功 / PTY raw input 已写入 /
+ * vc-auth 真实变更开始）。标记落在 ctx.ingressAdmission 共享 box 上（见其字段
+ * 注释），notifyOrdinaryIngressFailure 据此区分「没送达请重发」与「已接纳勿重发」。
+ * messageQueue.appendMessage 不算接纳——queues/*.jsonl 仅供 dashboard 预览，
+ * 没有投递重放语义；handleCommand 命令路径不参与（其内部 catch 吞掉一切异常）。 */
+function markIngressAdmitted(ctx) {
+    if (ctx.ingressAdmission)
+        ctx.ingressAdmission.admitted = true;
+    else
+        ctx.ingressAdmission = { admitted: true };
+}
+/**
+ * 普通消息处理链的终态失败收口：transport 已 ACK（用户看到消息发出去了），但
+ * 异常把整条投递链掀翻——此前只剩 dispatcher 的 log-only catch，用户视角就是
+ * 机器人吞消息。best-effort 回一条可行动提示后原样重抛，dispatcher 既有的错误
+ * 日志与调用方语义不变。rejected 类失败（quota/权限拦截）由各自路径回复后正常
+ * return，不会走到这里。
+ *
+ * 提示文案按接纳阶段二选一：本轮一旦被 durable queue / worker 接纳
+ * （ctx.ingressAdmission.admitted，各接纳点经 markIngressAdmitted 翻转），失败
+ * 只可能出在接纳之后的状态回复等 UX 支路——此时绝不能提示「请重发」，否则一次
+ * Lark 瞬时发送故障会被放大成同一任务再次入队、CLI 重复执行；改为「已接收，
+ * 勿重发」的澄清。未接纳的失败保持原有重发提示。
+ */
+async function notifyOrdinaryIngressFailure(ctx, err) {
+    const replyAnchor = ctx.scope === 'thread' ? ctx.anchor : ctx.chatId;
+    const noticeKey = ctx.ingressAdmission?.admitted
+        ? 'daemon.ordinary_ingress_admitted_reply_failed'
+        : 'daemon.ordinary_ingress_failed';
+    try {
+        await sessionReply(replyAnchor, tr(noticeKey, undefined, localeForBot(ctx.larkAppId)), 'text', ctx.larkAppId);
+    }
+    catch (noticeErr) {
+        logger.warn(`[${ctx.larkAppId}] ordinary ingress failure notice for ${ctx.messageId.substring(0, 12)} `
+            + `could not be delivered: ${noticeErr instanceof Error ? noticeErr.message : String(noticeErr)}`);
+    }
+    throw err;
+}
 async function handleNewTopic(data, ctx) {
-    return withBotTurnAdmission(ctx.larkAppId, () => handleNewTopicAdmitted(data, ctx));
+    ctx.ingressAdmission ??= { admitted: false };
+    return withBotTurnAdmission(ctx.larkAppId, () => handleNewTopicAdmitted(data, ctx)).catch(err => notifyOrdinaryIngressFailure(ctx, err));
 }
 /**
  * Codex App steer authorization (Blocking 1, decision A) from INBOUND SOURCE
@@ -13724,10 +14142,53 @@ function computeCodexAppSteerable(facts) {
 }
 async function handleNewTopicAdmitted(data, ctx) {
     const { chatId, messageId, chatType, larkAppId, replyRootId, substituteTrigger, messageListener } = ctx;
+    // Session-group birth re-homes the turn into the new group: replies/quotes
+    // anchor on the in-group intro message, while `messageId` (the ORIGINAL
+    // inbound message) keeps serving resource downloads / merge-forward
+    // expansion / dedup — their keys belong to the source message.
+    const replyAnchorId = ctx.replyAnchorMessageId ?? messageId;
     // scope/anchor are mutable here: `/t` / `/topic` may flip a 普通群 chat-scope
     // routing into thread-scope so the bot's first reply seeds a Lark thread.
     let scope = ctx.scope;
     let anchor = ctx.anchor;
+    // ─── p2pMode='group'：会话群出生 ────────────────────────────────────────
+    // group 模式下，顶层 DM 消息在任何会话机制启动前先改道：建一个专属会话群
+    //（bot 保留群主），把本轮 context 重写到新群（chat-scope）后递归。返回 null
+    // 表示跳过/失败（斜杠命令、建群失败已私聊提示），落回旧的 DM 话题行为。
+    // sessionGroupBirth 防递归；scope/anchor 形状约束保证只有全新顶层种子会出生
+    //（回复旧 DM 话题的消息仍归原会话）。thread_id 检查兜住「话题内发送 + 同时
+    // 发送到会话」的消息形态：它的事件 root_id 为空（顶层形态）但携带 thread_id
+    // ——语境属于既有话题，绝不能当全新会话去建群；放行后按旧 thread 行为在
+    // 原 DM 落话题（用户实测反馈的误建群场景）。
+    if (chatType === 'p2p'
+        && getBot(larkAppId).config.p2pMode === 'group'
+        && !ctx.sessionGroupBirth
+        && !substituteTrigger
+        && scope === 'thread'
+        && anchor === messageId
+        && !data?.message?.thread_id) {
+        const reborn = await maybeBirthSessionGroup(data, ctx);
+        if (reborn)
+            return handleNewTopic(data, reborn);
+    }
+    // ─── 会话群同群续聊 ─────────────────────────────────────────────────────
+    // 会话群里的新消息发现登记的会话已关闭时，自动 resume 原会话（与话题内续聊
+    // 同款体验），而不是新开 CLI。恢复失败则照常走全新会话。
+    if (chatType === 'group' && scope === 'chat' && !ctx.sessionGroupBirth) {
+        const sgEntry = getSessionGroup(chatId);
+        if (sgEntry?.lastSessionId) {
+            const prevSession = sessionStore.getSession(sgEntry.lastSessionId);
+            if (prevSession?.status === 'closed') {
+                const resumed = await resumeSession(sgEntry.lastSessionId, activeSessions);
+                if (resumed.ok) {
+                    touchSessionGroup(chatId);
+                    logger.info(`[session-group] resumed session=${sgEntry.lastSessionId.substring(0, 8)} in chat=${chatId.substring(0, 12)}`);
+                    return handleThreadReply(data, ctx);
+                }
+                logger.warn(`[session-group] resume failed (${resumed.error}) chat=${chatId.substring(0, 12)}; spawning fresh session`);
+            }
+        }
+    }
     const numberer = createImgNumberer();
     let forwardSeedContent = '';
     let forwardSeedResources = [];
@@ -13883,17 +14344,31 @@ async function handleNewTopicAdmitted(data, ctx) {
         return;
     }
     // Intercept daemon commands in new topics (no session needed for some commands)
-    const invocation = parseSlashCommandInvocation(cmdContent);
+    // acceptSlashFromBots gate: a bot sender's slash command is only routed as a
+    // command when this bot opts in (default on). When off, fall through to
+    // ordinary message handling — the peer bot can still talk, it just can't drive
+    // /clear /model /close … into this bot. Human senders are never gated here.
+    const senderIsBotForSlashGate = isBotSenderType || isForeignBotSender;
+    const invocation = (senderIsBotForSlashGate && !botAcceptsSlashFromBots(larkAppId))
+        ? null
+        : parseSlashCommandInvocation(cmdContent);
     if (invocation) {
         const { cmd, content: commandContent } = invocation;
+        const invocationDeps = commandDepsForInvocation({
+            scope,
+            chatId,
+            anchor,
+            messageId: parsed.messageId,
+            replyRootId,
+        });
         const restrictedText = grantRestrictedSlashCommandText(larkAppId, chatId, senderOpenId, cmd);
         if (restrictedText) {
-            await sessionReply(anchor, restrictedText, 'text', larkAppId);
+            await invocationDeps.sessionReply(anchor, restrictedText, 'text', larkAppId);
             return;
         }
         if (cmd === '/vc-auth') {
             if (!canOperate(larkAppId, chatId, senderOpenId, teamTrustUnionId)) {
-                await sessionReply(anchor, tr('daemon.cmd_allowed_users_only', { cmd }, localeForBot(larkAppId)), 'text', larkAppId);
+                await invocationDeps.sessionReply(anchor, tr('daemon.cmd_allowed_users_only', { cmd }, localeForBot(larkAppId)), 'text', larkAppId);
                 return;
             }
             await handleVcMeetingTemporaryAuthCommand({
@@ -13904,6 +14379,9 @@ async function handleNewTopicAdmitted(data, ctx) {
                 mentions: parsed.mentions,
                 senderOpenId,
                 senderUnionId,
+                // help/invalid/无监听等纯拒绝分支不打接纳标（回复失败应保持「请重发」）；
+                // 只有真正开始改临时授权状态后，结果回复失败才不得诱导重发。
+                onMutating: () => markIngressAdmitted(ctx),
             });
             return;
         }
@@ -13911,14 +14389,14 @@ async function handleNewTopicAdmitted(data, ctx) {
         // summon has nothing to show in a brand-new topic. Route here so the generic
         // daemon-command block below does not pre-create a worker=null session.
         if (cmd === '/card') {
-            await handleCardCommand(anchor, larkAppId, chatId, senderOpenId, commandContent, commandDeps);
+            await handleCardCommand(anchor, larkAppId, chatId, senderOpenId, commandContent, invocationDeps);
             return;
         }
         // /term needs a live session's terminal; in a brand-new topic there's none.
         // Route here (own owner-gate inside) so the generic block below doesn't
         // pre-create a worker=null phantom session just to reply "no session".
         if (cmd === '/term') {
-            await handleTermLinkCommand(anchor, larkAppId, chatId, senderOpenId, commandContent, commandDeps);
+            await handleTermLinkCommand(anchor, larkAppId, chatId, senderOpenId, commandContent, invocationDeps);
             return;
         }
         if (resolvePassthroughCommands(larkAppId).has(cmd)) {
@@ -13949,6 +14427,7 @@ async function handleNewTopicAdmitted(data, ctx) {
                     ownerOpenId: senderOpenId,
                     ownerUnionId: senderUnionId,
                     creatorOpenId: senderOpenId,
+                    onDurablyAdmitted: () => markIngressAdmitted(ctx),
                     routeToCanonicalOwner: () => handleThreadReplyAdmitted(data, {
                         ...ctx,
                         scope,
@@ -13957,7 +14436,7 @@ async function handleNewTopicAdmitted(data, ctx) {
                 });
                 return;
             }
-            await sessionReply(anchor, tr('daemon.cmd_requires_session', { cmd }, localeForBot(larkAppId)), 'text', larkAppId);
+            await invocationDeps.sessionReply(anchor, tr('daemon.cmd_requires_session', { cmd }, localeForBot(larkAppId)), 'text', larkAppId);
             return;
         }
         if (DAEMON_COMMANDS.has(cmd)) {
@@ -13969,7 +14448,7 @@ async function handleNewTopicAdmitted(data, ctx) {
             // canRunDaemonCommand = canOperate ∪（cmd ∈ canTalkDaemonCommands && canTalk）：
             // bot 可通过名单把选定命令（如 /status）降到 canTalk；未配置时与 canOperate 全等。
             if (!canRunDaemonCommand(larkAppId, chatId, senderOpenId, teamTrustUnionId, cmd, senderUnionId, chatType, isBotSenderType, isBotSenderType)) {
-                await sessionReply(anchor, tr('daemon.cmd_allowed_users_only', { cmd }, localeForBot(larkAppId)), 'text', larkAppId);
+                await invocationDeps.sessionReply(anchor, tr('daemon.cmd_allowed_users_only', { cmd }, localeForBot(larkAppId)), 'text', larkAppId);
                 return;
             }
             // `/group` (`/g`) doesn't open a conversation — creating a sessionStore
@@ -13980,7 +14459,7 @@ async function handleNewTopicAdmitted(data, ctx) {
                 // Fast-ACK: run detached so the WS event ack isn't blocked on /group's
                 // slow Lark API work → no Feishu redelivery → no duplicate group.
                 // See fireSessionlessCommandDetached.
-                fireSessionlessCommandDetached(cmd, anchor, { ...parsed, content: commandContent, chatId }, larkAppId);
+                fireSessionlessCommandDetached(cmd, anchor, { ...parsed, content: commandContent, chatId }, larkAppId, invocationDeps);
                 return;
             }
             // These commands operate on an EXISTING session; a brand-new topic has none. Route
@@ -13991,7 +14470,7 @@ async function handleNewTopicAdmitted(data, ctx) {
             // permission gates inside their handlers) this branch MUST stay after
             // the canOperate gate above — their handlers do not repeat that gate.
             if (EXISTING_SESSION_ONLY_DAEMON_COMMANDS.has(cmd)) {
-                await handleCommand(cmd, anchor, { ...parsed, content: commandContent }, commandDeps, larkAppId);
+                await handleCommand(cmd, anchor, { ...parsed, content: commandContent }, invocationDeps, larkAppId);
                 return;
             }
             // Same rootMessageId reasoning as below in the main spawn path:
@@ -14051,11 +14530,13 @@ async function handleNewTopicAdmitted(data, ctx) {
             else if (cmdDs.pendingRepo) {
                 stageClaimedPendingRepoSetup(activeSessions, cmdDs, {
                     mode: 'picker',
-                    turnId: messageId,
+                    // Turn identity unified on the reply anchor (slash commands never
+                    // birth a session group, so this always equals messageId today).
+                    turnId: replyAnchorId,
                 });
             }
             // Pass mention-stripped content so /command argument parsing works.
-            await handleCommand(cmd, anchor, { ...parsed, content: commandContent }, commandDeps, larkAppId);
+            await handleCommand(cmd, anchor, { ...parsed, content: commandContent }, invocationDeps, larkAppId);
             return;
         }
     }
@@ -14169,9 +14650,16 @@ async function handleNewTopicAdmitted(data, ctx) {
     // disconnect click silently no-ops.
     // For chat-scope, rootMessageId stores the seed message_id (audit only);
     // routing keys off chatId via sessionAnchorId(), so any value works.
-    const rootIdForStore = scope === 'thread' ? anchor : messageId;
+    // Session-group births store the in-group intro (reply anchor) here so the
+    // audit trail points at a message that actually lives in the session's chat.
+    const rootIdForStore = scope === 'thread' ? anchor : replyAnchorId;
     const initialTurnTitle = (messageListener?.replyCardTitle ?? (ctx.forwardSeedData ? followupContent : content)).substring(0, 50);
     const session = sessionStore.createSession(chatId, rootIdForStore, initialTurnTitle, chatType);
+    // Session-group registry: point the group at its (new) resident session so
+    // same-group resume and the async AI title can find it.
+    if (chatType === 'group' && isSessionGroup(chatId)) {
+        touchSessionGroup(chatId, session.sessionId);
+    }
     const now = Date.now();
     setDirectChatDisplayNameFromSender(session, chatType, newTopicSender);
     const groupChatName = await groupChatNamePromise;
@@ -14189,7 +14677,11 @@ async function handleNewTopicAdmitted(data, ctx) {
     // `botmux send` can --mention-back / 引用 the triggering message (chat scope).
     // Without this the first reply hits hasQuoteTargetSender=false (exit 2) and
     // chat-scope首条不引用. Use the event's sender open_id (correct app scope).
-    session.quoteTargetId = parsed.messageId;
+    // Keyed off the REPLY anchor (== messageId except for session-group births,
+    // where it is the in-group intro message so quotes stay in the group instead
+    // of leaking to the source DM — while messageId itself keeps serving
+    // resource/merge-forward lookups against the original inbound message).
+    session.quoteTargetId = replyAnchorId;
     session.quoteTargetSenderOpenId = senderOpenId;
     session.quoteTargetSenderIsBot = isForeignBotSender || parsed.senderType === 'app' || parsed.senderType === 'bot';
     session.lastMessageAt = new Date(now).toISOString();
@@ -14219,7 +14711,10 @@ async function handleNewTopicAdmitted(data, ctx) {
         initialStartPending: true,
         pendingRepo: !pinnedWorkingDir || autoWt,
         pendingPrompt: promptContent,
-        pendingTurnId: messageId,
+        // Turn identity must equal the reply anchor so current-turn provenance
+        // (quoteTargetId === marker.turnId) holds on session-group first turns.
+        // Outside a birth replyAnchorId === messageId, so plain paths are unchanged.
+        pendingTurnId: replyAnchorId,
         pendingCodexAppText: codexAppVisibleText,
         pendingCodexAppApplicationContext: codexAppApplicationContext || undefined,
         pendingCodexAppMessageContext: codexAppMessageContext,
@@ -14267,7 +14762,10 @@ async function handleNewTopicAdmitted(data, ctx) {
     // exact same set (a race-losing scratch's seed @s must not vanish).
     const newTopicPostAt = collectPostAtMentions(data?.message, ctx.forwardSeedData?.message);
     const newTopicWindow = buildTurnParticipants(larkAppId, senderOpenId, senderIsBotTriState(parsed.senderType, isForeignBotSender), parsed.mentions, newTopicSender?.name, newTopicPostAt);
-    beginReplyTargetTurn(ds, replyRootId, messageId, new Date().toISOString(), { quoteOnly: substituteReplyMode === 'quote', substitute: !!substituteTrigger, senderOpenId, participants: newTopicWindow.participants, participantsIncomplete: newTopicWindow.incomplete });
+    // Turn key is the reply anchor (== messageId outside session-group births) so
+    // the per-turn reply context and currentReplyTarget.turnId line up with the
+    // worker's turn id — current-turn provenance requires that equality.
+    beginReplyTargetTurn(ds, replyRootId, replyAnchorId, new Date().toISOString(), { quoteOnly: substituteReplyMode === 'quote', substitute: !!substituteTrigger, senderOpenId, participants: newTopicWindow.participants, participantsIncomplete: newTopicWindow.incomplete });
     sessionStore.updateSession(ds.session);
     const registration = await claimNewDaemonSession(activeSessions, ds);
     if (!registration.accepted) {
@@ -14298,17 +14796,25 @@ async function handleNewTopicAdmitted(data, ctx) {
         stageClaimedPendingRepoSetup(activeSessions, ds, {
             mode: autoWt ? 'auto_worktree' : 'picker',
             ...(autoWt && pinnedWorkingDir ? { baseDir: pinnedWorkingDir } : {}),
-            turnId: messageId,
+            // Persisted turn identity feeds the eventual fork's turnId; it must be the
+            // reply anchor so provenance (quoteTargetId === marker.turnId) holds on
+            // session-group first turns that go through the repo picker / worktree.
+            turnId: replyAnchorId,
         });
     }
     messageQueue.ensureQueue(anchor);
     messageQueue.appendMessage(anchor, parsed);
+    // 接纳标记按分支下沉，不绑在 appendMessage 上：queues/*.jsonl 仅供 dashboard
+    // 预览，无投递重放语义；且 replyInvalidWorkingDirs 是「放弃本轮」分支（关闭
+    // 会话后才回复），放弃前的失败必须保持「请重发」提示。
     // Auto-worktree: session is registered PENDING; build the worktree off the
     // critical path, then commitRepoSelection pins it + forks (folding in any
     // messages buffered during creation). detach → return immediately.
     if (pinnedWorkingDir && autoWt) {
         if (await replyInvalidWorkingDirs(anchor, larkAppId, ds))
             return;
+        // 已 durable staging（auto_worktree）且通过放弃闸：detached 建库流程接管投递。
+        markIngressAdmitted(ctx);
         ds.initialStartPending = false; // pendingRepo/worktree now owns buffering
         startAutoWorktreePending(ds, { anchor, baseDir: pinnedWorkingDir, title: session.title, prompt: promptContent, operatorOpenId: senderOpenId });
         return;
@@ -14325,8 +14831,12 @@ async function handleNewTopicAdmitted(data, ctx) {
             messageId,
         });
         const availableBots = await getAvailableBots(larkAppId, chatId);
-        await noteTurnReceived(ds, messageId, content, newTopicSender, messageId, substituteTrigger ? SUBSTITUTE_RECEIVED_REACTION_EMOJI_TYPE : undefined);
+        // Ack reaction targets the ORIGINAL inbound message (2nd arg); the turn id
+        // (5th arg) is the reply anchor so provenance holds on session-group births.
+        await noteTurnReceived(ds, messageId, content, newTopicSender, replyAnchorId, substituteTrigger ? SUBSTITUTE_RECEIVED_REACTION_EMOJI_TYPE : undefined);
         forkReservedInitialSession(ds, availableBots);
+        // fork 成功即开场已交给 CLI；fork 抛错则开场只存在于内存，保持重发提示。
+        markIngressAdmitted(ctx);
         const reason = oncallEntry
             ? `oncall-bound chat ${chatId}`
             : inheritedFrom
@@ -14348,6 +14858,9 @@ async function handleNewTopicAdmitted(data, ctx) {
     if (projects.length > 0) {
         ds.initialStartPending = false; // pendingRepo/card now owns buffering
         lastRepoScan.set(chatId, projects);
+        // 已 durable staging（picker）且通过放弃闸；接下来卡片发送失败不得诱导重发
+        //（重发会在 pendingRepo 缓冲里再入一份）。
+        markIngressAdmitted(ctx);
         const currentCwd = getSessionWorkingDir(ds);
         const cardJson = buildRepoSelectCard(projects, currentCwd, anchor, localeForBot(larkAppId), getBot(larkAppId).config.worktreeMultiPicker);
         ds.repoCardMessageId = await sessionReply(anchor, cardJson, 'interactive', larkAppId);
@@ -14356,7 +14869,11 @@ async function handleNewTopicAdmitted(data, ctx) {
         logger.info(`[${tag(ds)}] Waiting for repo selection (${projects.length} projects)`);
     }
     else {
-        // No projects found — skip repo selection, spawn directly
+        // No projects found — skip repo selection, spawn directly.
+        // 已 durable staging（picker）且通过放弃闸：即使下面 fork 失败，opening 仍由
+        // 会话 durable 持有（pre-init 回滚恢复 queued journal，重启复活），重发会
+        // 重复执行——先打接纳标。
+        markIngressAdmitted(ctx);
         ds.pendingRepo = false;
         ensureSessionWhiteboard(ds);
         await maybeSeedCardlessForceTopicTurn({
@@ -14366,7 +14883,9 @@ async function handleNewTopicAdmitted(data, ctx) {
             messageId,
         });
         const availableBots = await getAvailableBots(larkAppId, chatId);
-        await noteTurnReceived(ds, messageId, content, newTopicSender, messageId, substituteTrigger ? SUBSTITUTE_RECEIVED_REACTION_EMOJI_TYPE : undefined);
+        // Ack reaction targets the ORIGINAL inbound message (2nd arg); the turn id
+        // (5th arg) is the reply anchor so provenance holds on session-group births.
+        await noteTurnReceived(ds, messageId, content, newTopicSender, replyAnchorId, substituteTrigger ? SUBSTITUTE_RECEIVED_REACTION_EMOJI_TYPE : undefined);
         forkReservedInitialSession(ds, availableBots);
         logger.info(`Session ${session.sessionId} ready (no projects to select), total active: ${getActiveCount()}`);
     }
@@ -14555,11 +15074,16 @@ async function handleBotAdded(chatId, operatorOpenId, larkAppId, opts) {
         // synthetic instruction. Codex App still needs a non-blank visible
         // UserMessage; reuse the localized session title only in its clean sidecar.
         const codexAppText = promptBody || title;
-        // Pick scope + anchor. 话题群 → seed a topic and anchor thread-scope there;
-        // 普通群 → chat-scope anchored at chatId.
+        // Pick scope + anchor. 话题群 或 普通群 new-topic 模式 → seed a topic and
+        // anchor thread-scope there；其余普通群 → chat-scope anchored at chatId。
+        // 复用入站 @ 的路由判据（externalEventOpensOwnTopic）：否则「自动进群主动开工」
+        // 会无视群配的 new-topic，把首轮平铺进群顶层 chat-scope，而不是像用户手动 @
+        // 那样开一个独立话题。
+        const regularGroupMode = resolveRegularGroupMode(larkAppId, chatId);
+        const opensOwnTopic = externalEventOpensOwnTopic(mode, regularGroupMode);
         let scope;
         let anchor;
-        if (mode === 'topic') {
+        if (opensOwnTopic) {
             const seedText = tr('daemon.auto_start_join_seed', undefined, localeForBot(larkAppId));
             anchor = await sendMessage(larkAppId, chatId, seedText, 'text');
             scope = 'thread';
@@ -14574,7 +15098,7 @@ async function handleBotAdded(chatId, operatorOpenId, larkAppId, opts) {
             return;
         }
         const needsSharedReply = mode === 'group'
-            && resolveRegularGroupMode(larkAppId, chatId) === 'shared';
+            && regularGroupMode === 'shared';
         const { pinnedWorkingDir, pinnedFromBotDefault } = await resolvePinnedWorkingDir({ scope, anchor, chatId, chatType, larkAppId });
         const autoWt = willAutoWorktree(larkAppId, pinnedWorkingDir, pinnedFromBotDefault);
         refreshCliVersion(botCfg);
@@ -14852,7 +15376,8 @@ async function handleThreadReply(data, ctx, prepared) {
     // quota/resource/sender preparation awaits. Synthetic keys share the same
     // lock registry without occupying or mutating an active-session slot.
     const deliveryKey = `\u0000thread-delivery:${ctx.larkAppId}:${ctx.scope}:${ctx.anchor}`;
-    return withActiveSessionKeyLock(activeSessions, deliveryKey, () => withBotTurnAdmission(ctx.larkAppId, () => handleThreadReplyAdmitted(data, ctx, prepared)));
+    ctx.ingressAdmission ??= { admitted: false };
+    return withActiveSessionKeyLock(activeSessions, deliveryKey, () => withBotTurnAdmission(ctx.larkAppId, () => handleThreadReplyAdmitted(data, ctx, prepared))).catch(err => notifyOrdinaryIngressFailure(ctx, err));
 }
 async function handleThreadReplyAdmitted(data, ctx, prepared) {
     const { chatId: ctxChatId, chatType: ctxChatType, scope, anchor, larkAppId, replyRootId, substituteTrigger } = ctx;
@@ -14869,6 +15394,15 @@ async function handleThreadReplyAdmitted(data, ctx, prepared) {
     }
     if (!prepared)
         learnFromMentions(larkAppId, parsed.mentions);
+    // 会话群自愈命名：出生时 AI 命名失败（CLI 抖动/超时/当时无模板）的群会停在
+    // 截断占位名——任意后续文本消息触发一次补跑（title 服务内 in-flight 去重 +
+    // titled 标记幂等），把偶发失败自动治愈，而不是永远留疤。
+    if (ctxChatType === 'group' && isSessionGroup(ctxChatId)) {
+        const sgEntry = getSessionGroup(ctxChatId);
+        if (sgEntry && !sgEntry.titled && parsed.content.trim() && !parsed.content.trim().startsWith('/')) {
+            scheduleSessionGroupTitle({ larkAppId, chatId: ctxChatId, userText: parsed.content });
+        }
+    }
     // Foreign bot @mention prefix: when sender is another botmux bot，把内容包成
     // [来自 X 的 @mention]\n<原文> 喂给 worker，让 CLI 知道这是另一个 bot 发的——
     // 不是用户直接发的——后续不需要按"对话用户"的方式处理。signal-file 路径
@@ -15035,19 +15569,31 @@ async function handleThreadReplyAdmitted(data, ctx, prepared) {
         return;
     }
     // Intercept daemon commands
-    const invocation = parseSlashCommandInvocation(cmdContent);
+    // acceptSlashFromBots gate (mirror of the new-topic path): a bot sender's
+    // slash is only routed as a command when this bot opts in (default on); when
+    // off it falls through to ordinary message handling. Human senders unaffected.
+    const invocation = ((isBotSenderType || isForeignBot) && !botAcceptsSlashFromBots(larkAppId))
+        ? null
+        : parseSlashCommandInvocation(cmdContent);
     if (invocation) {
         const { cmd, content: commandContent } = invocation;
+        const invocationDeps = commandDepsForInvocation({
+            scope,
+            chatId: ctxChatId,
+            anchor,
+            messageId: parsed.messageId,
+            replyRootId,
+        });
         const existingDs = activeSessions.get(sessionKey(anchor, larkAppId));
         const effectiveThreadChatId = existingDs?.chatId ?? threadChatId;
         const restrictedText = grantRestrictedSlashCommandText(larkAppId, effectiveThreadChatId, threadSenderOpenId, cmd);
         if (restrictedText) {
-            await sessionReply(anchor, restrictedText, 'text', larkAppId);
+            await invocationDeps.sessionReply(anchor, restrictedText, 'text', larkAppId);
             return;
         }
         if (cmd === '/vc-auth') {
             if (!canOperate(larkAppId, effectiveThreadChatId, threadSenderOpenId, threadTeamTrustUnionId)) {
-                await sessionReply(anchor, tr('daemon.cmd_allowed_users_only', { cmd }, localeForBot(larkAppId)), 'text', larkAppId);
+                await invocationDeps.sessionReply(anchor, tr('daemon.cmd_allowed_users_only', { cmd }, localeForBot(larkAppId)), 'text', larkAppId);
                 return;
             }
             await handleVcMeetingTemporaryAuthCommand({
@@ -15058,10 +15604,17 @@ async function handleThreadReplyAdmitted(data, ctx, prepared) {
                 mentions: parsed.mentions,
                 senderOpenId: threadSenderOpenId,
                 senderUnionId: threadSenderUnionId,
+                // 同 new-topic 路径：仅在真正开始改状态后打接纳标。
+                onMutating: () => markIngressAdmitted(ctx),
             });
             return;
         }
-        if (resolvePassthroughCommands(larkAppId).has(cmd)) {
+        // Existing sessions freeze their CLI independently from the bot's current
+        // config. Route passthrough capability from that frozen runtime so changing
+        // `/botconfig cli` cannot make an old Codex App session receive raw_input
+        // (or make an old interactive TUI lose its native slash commands).
+        const passthroughCliId = existingDs?.session.cliId ?? getBot(larkAppId).config.cliId;
+        if (resolvePassthroughCommands(larkAppId, passthroughCliId).has(cmd)) {
             if (!existingDs && threadChatId && isInitialSessionPassthrough(larkAppId, cmd)) {
                 await startInitialPassthroughSession({
                     larkAppId,
@@ -15089,6 +15642,7 @@ async function handleThreadReplyAdmitted(data, ctx, prepared) {
                     ownerOpenId: isForeignBot ? undefined : threadSenderOpenId,
                     ownerUnionId: isForeignBot ? undefined : data?.sender?.sender_id?.union_id,
                     creatorOpenId: threadSenderOpenId,
+                    onDurablyAdmitted: () => markIngressAdmitted(ctx),
                     routeToCanonicalOwner: () => handleThreadReplyAdmitted(data, {
                         ...ctx,
                         scope,
@@ -15106,7 +15660,7 @@ async function handleThreadReplyAdmitted(data, ctx, prepared) {
             // 收紧到与 daemon 命令同档；这会同时改变真人 oncall 成员的现有行为，应单独评估。
             const ds = existingDs;
             if (ds?.worker && !ds.worker.killed && hasQueuedActivationAdmissionGate(ds)) {
-                sessionReply(anchor, tr('daemon.cmd_activation_pending', { cmd }, localeForBot(larkAppId)), 'text', larkAppId);
+                invocationDeps.sessionReply(anchor, tr('daemon.cmd_activation_pending', { cmd }, localeForBot(larkAppId)), 'text', larkAppId);
                 logger.warn(`[${anchor.substring(0, 12)}] Refused passthrough ${cmd} before acceptance `
                     + 'while queued activation owns raw submission order');
                 return;
@@ -15117,7 +15671,7 @@ async function handleThreadReplyAdmitted(data, ctx, prepared) {
                 // a clear message rather than deliver a silent no-op (or spawn junk Riff
                 // tasks). Other passthrough commands are unaffected.
                 if (cmd === '/fast' && fastToggleUnsupportedBackend(ds)) {
-                    await sessionReply(anchor, tr('daemon.fast_unsupported_backend', undefined, localeForBot(larkAppId)), 'text', larkAppId);
+                    await invocationDeps.sessionReply(anchor, tr('daemon.fast_unsupported_backend', undefined, localeForBot(larkAppId)), 'text', larkAppId);
                     return;
                 }
                 deliverPassthroughToExistingSession(ds, cmd, commandContent, anchor, larkAppId, {
@@ -15126,10 +15680,11 @@ async function handleThreadReplyAdmitted(data, ctx, prepared) {
                     senderOpenId: threadSenderOpenId,
                     senderIsBot: isForeignBot,
                     substitute: !!substituteTrigger,
+                    onDelivered: () => markIngressAdmitted(ctx),
                 });
             }
             else
-                void sessionReply(anchor, tr('daemon.cmd_needs_active_cli', { cmd }, localeForBot(larkAppId)), 'text', larkAppId);
+                void invocationDeps.sessionReply(anchor, tr('daemon.cmd_needs_active_cli', { cmd }, localeForBot(larkAppId)), 'text', larkAppId);
             return;
         }
         if (DAEMON_COMMANDS.has(cmd)) {
@@ -15140,7 +15695,7 @@ async function handleThreadReplyAdmitted(data, ctx, prepared) {
             // /term in a thread with no existingDs would spawn a worker:null phantom
             // session and pollute the dashboard before replying not_ready/owner_only.
             if (cmd === '/term') {
-                await handleTermLinkCommand(anchor, larkAppId, threadChatId ?? '', threadSenderOpenId, commandContent, commandDeps);
+                await handleTermLinkCommand(anchor, larkAppId, threadChatId ?? '', threadSenderOpenId, commandContent, invocationDeps);
                 return;
             }
             // canOperate gate for thread-reply daemon commands — required in every chat
@@ -15148,7 +15703,7 @@ async function handleThreadReplyAdmitted(data, ctx, prepared) {
             // canRunDaemonCommand：canTalkDaemonCommands 名单内的命令降到 canTalk，
             // 与 new-topic 路径的统一闸同款（未配置时与 canOperate 全等）。
             if (!canRunDaemonCommand(larkAppId, effectiveThreadChatId, threadSenderOpenId, threadTeamTrustUnionId, cmd, threadSenderUnionId, ctxChatType, isBotSenderType || isForeignBot, isBotSenderType)) {
-                sessionReply(anchor, tr('daemon.cmd_allowed_users_only', { cmd }, localeForBot(larkAppId)), 'text', larkAppId);
+                invocationDeps.sessionReply(anchor, tr('daemon.cmd_allowed_users_only', { cmd }, localeForBot(larkAppId)), 'text', larkAppId);
                 return;
             }
             // First message of a fresh thread carrying a session-needing daemon command
@@ -15215,10 +15770,12 @@ async function handleThreadReplyAdmitted(data, ctx, prepared) {
             const cmdMessage = { ...parsed, content: commandContent, chatId: threadChatId };
             if (isSessionlessCommandInvocation(cmd, commandContent)) {
                 // Fast-ACK for /group invoked mid-thread. See fireSessionlessCommandDetached.
-                fireSessionlessCommandDetached(cmd, anchor, cmdMessage, larkAppId);
+                fireSessionlessCommandDetached(cmd, anchor, cmdMessage, larkAppId, invocationDeps);
                 return;
             }
-            await handleCommand(cmd, anchor, cmdMessage, commandDeps, larkAppId);
+            // 命令路径不打接纳标：handleCommand 内部 catch 吞掉一切异常并记日志
+            //（command-handler.ts 收口），异常到不了 ingress catch，标记永远读不到。
+            await handleCommand(cmd, anchor, cmdMessage, invocationDeps, larkAppId);
             return;
         }
     }
@@ -15440,6 +15997,8 @@ async function handleThreadReplyAdmitted(data, ctx, prepared) {
                     codexAppText: parsed.content,
                     codexAppApplicationContext,
                     codexAppMessageContext,
+                    sessionBackendType: ds.session.backendType,
+                    turnId: parsed.messageId,
                 });
                 // R5-B1-1: freeze the admission-time steer authorization onto this earliest
                 // (initialStartPending follower) tail entry — the strip-proof admit rebuild
@@ -15451,6 +16010,7 @@ async function handleThreadReplyAdmitted(data, ctx, prepared) {
                     cliInput: followUp,
                     turnId: parsed.messageId,
                 }, tailReservation);
+                markIngressAdmitted(ctx);
             }
             finally {
                 settleAsyncQueuedActivationTailAdmission(ds);
@@ -15579,6 +16139,8 @@ async function handleThreadReplyAdmitted(data, ctx, prepared) {
                             codexAppText: parsed.content,
                             codexAppApplicationContext,
                             codexAppMessageContext,
+                            sessionBackendType: ds.session.backendType,
+                            turnId: parsed.messageId,
                         });
                         ds.session.queuedPrompt ??= ds.pendingPrompt;
                         ds.session.queuedCodexAppText ??= ds.pendingCodexAppText;
@@ -15592,6 +16154,9 @@ async function handleThreadReplyAdmitted(data, ctx, prepared) {
                             turnId: parsed.messageId,
                         }, durableTailReservation);
                     }
+                    // 本轮已持久化接纳（durable opening 或 durable tail）；下面的状态回复再
+                    // 失败也不得诱导重发（PR #846 review）。
+                    markIngressAdmitted(ctx);
                     const pendingReplyKey = ds.worktreeCreating
                         ? 'daemon.worktree_building_wait'
                         : 'daemon.choose_repo_first';
@@ -15818,10 +16383,13 @@ async function handleThreadReplyAdmitted(data, ctx, prepared) {
             // creator re-enters the canonical route above, which appends exactly once.
             messageQueue.ensureQueue(anchor);
             messageQueue.appendMessage(anchor, parsed);
+            // 接纳标记按分支下沉（同 handleNewTopicAdmitted）：append 仅供 dashboard 预览，
+            // replyInvalidWorkingDirs 是放弃分支，放弃前的失败必须保持「请重发」提示。
             // Auto-worktree: register PENDING, build worktree off-path, commit+fork later.
             if (pinnedWorkingDir && autoWt) {
                 if (await replyInvalidWorkingDirs(anchor, larkAppId, newDs))
                     return;
+                markIngressAdmitted(ctx);
                 newDs.initialStartPending = false; // pendingRepo/worktree now owns buffering
                 startAutoWorktreePending(newDs, { anchor, baseDir: pinnedWorkingDir, title: parsed.content.substring(0, 50), prompt: promptContent, operatorOpenId: ownerOpenId });
                 return;
@@ -15835,6 +16403,8 @@ async function handleThreadReplyAdmitted(data, ctx, prepared) {
                 const availableBots = await getAvailableBots(larkAppId, autoCreateChatId);
                 await noteTurnReceived(newDs, parsed.messageId, parsed.content, autoCreateSender, parsed.messageId, substituteTrigger ? SUBSTITUTE_RECEIVED_REACTION_EMOJI_TYPE : undefined);
                 forkReservedInitialSession(newDs, availableBots);
+                // fork 成功即开场已交给 CLI；fork 抛错则开场只存在于内存，保持重发提示。
+                markIngressAdmitted(ctx);
                 const reason = oncallEntry
                     ? `oncall-bound chat ${autoCreateChatId}`
                     : inheritedFrom
@@ -15854,6 +16424,8 @@ async function handleThreadReplyAdmitted(data, ctx, prepared) {
             if (projects.length > 0) {
                 newDs.initialStartPending = false; // pendingRepo/card now owns buffering
                 lastRepoScan.set(autoCreateChatId, projects);
+                // 已 durable staging（picker）且通过放弃闸；卡片发送失败不得诱导重发。
+                markIngressAdmitted(ctx);
                 const currentCwd = getSessionWorkingDir(newDs);
                 const cardJson = buildRepoSelectCard(projects, currentCwd, anchor, localeForBot(larkAppId), getBot(larkAppId).config.worktreeMultiPicker);
                 newDs.repoCardMessageId = await sessionReply(anchor, cardJson, 'interactive', larkAppId);
@@ -15862,7 +16434,10 @@ async function handleThreadReplyAdmitted(data, ctx, prepared) {
                 logger.info(`[${tag(newDs)}] Waiting for repo selection (${projects.length} projects)`);
             }
             else {
-                // No projects found — skip repo selection, spawn directly
+                // No projects found — skip repo selection, spawn directly.
+                // 已 durable staging（picker）：fork 失败后 opening 仍由会话 durable 持有，
+                // 先打接纳标（同 handleNewTopicAdmitted 的 no-projects 分支）。
+                markIngressAdmitted(ctx);
                 newDs.pendingRepo = false;
                 ensureSessionWhiteboard(newDs);
                 const availableBots = await getAvailableBots(larkAppId, autoCreateChatId);
@@ -15872,6 +16447,8 @@ async function handleThreadReplyAdmitted(data, ctx, prepared) {
             return;
         }
         // Existing-owner route: append once after all pending-repo early returns.
+        // 接纳标记不打在这里：append 仅供 dashboard 预览，真正的接纳在下方 live worker
+        // 送达 / durable tail staging / refork 成功之后。
         messageQueue.ensureQueue(anchor);
         messageQueue.appendMessage(anchor, parsed);
         publishSessionMessagePreviewPatch(ds);
@@ -15934,6 +16511,8 @@ async function handleThreadReplyAdmitted(data, ctx, prepared) {
                         codexAppText: parsed.content,
                         codexAppApplicationContext,
                         codexAppMessageContext,
+                        sessionBackendType: ds.session.backendType,
+                        turnId: parsed.messageId,
                     });
             beginNewTurn(ds, parsed.content, parsed.messageId);
             await noteTurnReceived(ds, parsed.messageId, parsed.content, turnSender, parsed.messageId, substituteTrigger ? SUBSTITUTE_RECEIVED_REACTION_EMOJI_TYPE : undefined);
@@ -15948,8 +16527,11 @@ async function handleThreadReplyAdmitted(data, ctx, prepared) {
                 // reached the CLI; a rejected send then left that poison behind, and the
                 // next message's worker-null refork would read it as `hadPriorCliInput`
                 // and wrongly `--resume` a CLI that never took a real turn.
-                if (accepted)
+                if (accepted) {
+                    // 消息已实际送入 live worker——之后的收尾失败不得再诱导重发。
+                    markIngressAdmitted(ctx);
                     rememberLastCliInput(ds, promptContent, cliInput);
+                }
                 else
                     logger.warn(`[${tag(ds)}] Inbound ${parsed.messageId} was not accepted by the live worker`);
             }
@@ -16025,6 +16607,8 @@ async function handleThreadReplyAdmitted(data, ctx, prepared) {
                         codexAppText: parsed.content,
                         codexAppApplicationContext,
                         codexAppMessageContext,
+                        sessionBackendType: ds.session.backendType,
+                        turnId: parsed.messageId,
                     });
                     // R4-B1: freeze the admission-time steer authorization onto the queued
                     // opening payload so the worker-null re-fork path carries it exactly like
@@ -16037,6 +16621,9 @@ async function handleThreadReplyAdmitted(data, ctx, prepared) {
                         cliInput: currentFollowUp,
                         turnId: parsed.messageId,
                     }, tailReservation);
+                    // 本轮已进 durable tail——之后 fork/回执失败可由重启或下一条 inbound 恢复，
+                    // 不得再诱导重发。
+                    markIngressAdmitted(ctx);
                 }
                 finally {
                     settleAsyncQueuedActivationTailAdmission(ds);
@@ -16134,35 +16721,12 @@ async function handleThreadReplyAdmitted(data, ctx, prepared) {
             // its normal `--resume` instead of being cold-spawned over.
             const hadPriorCliInput = !!(ds.lastCliInput ?? ds.session.lastCliInput);
             const openingTurn = wantsOpening && claimInitialUserTurn(ds);
-            const builtReforkInput = buildReforkCliInput(ds, reforkContent, {
-                attachments: queuedHasDurableTail ? undefined : attachments,
-                mentions: queuedHasDurableTail ? undefined : parsed.mentions,
-                cliId: ds.session.cliId ?? dsBotCfgForFork.cliId,
-                cliPathOverride: ds.session.cliPathOverride ?? dsBotCfgForFork.cliPathOverride,
-                selfMention: { name: selfBot.botName, openId: selfBot.botOpenId },
-                sender: queuedHasDurableTail ? undefined : reforkSender,
-                substituteTrigger: queuedHasDurableTail ? undefined : substituteTrigger,
-                codexAppText: reforkCodexApp.text,
-                codexAppApplicationContext: queuedHasDurableTail ? undefined : codexAppApplicationContext,
-                codexAppMessageContext: reforkCodexApp.messageContext,
-            });
-            let wrappedInput = applyQueuedCodexAppLegacyFallback(builtReforkInput, {
-                queued: queuedDashboardTurn,
-                queuedText: queuedCodexAppText,
-            });
-            if (wrappedInput !== builtReforkInput && dsBotCfgForFork.codexAppCleanInput === true) {
-                // Backlog sessions persisted before clean-input have no raw queued text.
-                // Keep this activation entirely legacy: reforkContent already contains
-                // queuedPrompt + the current reply, whereas a structured turn could only
-                // contain the reply and would silently discard the original task.
-                logger.warn(`[${tag(ds)}] Legacy queued dashboard task has no clean-input text; using the full legacy activation prompt`);
-            }
+            // 先选 builder：opening 轮用 buildNewTopicCliInput，非 opening 才 buildRefork。
+            // 不能无条件先跑 buildRefork——它现在有副作用（写 follow-up sidecar），opening 时
+            // 结果会被 buildNewTopicCliInput 覆盖丢弃，但 sidecar 已写入 opening 的 turnId，
+            // opening 的 hook 会领到这份从没发出去的 speculative reminder → 双注入。
+            let wrappedInput;
             if (openingTurn) {
-                // Replace the follow-up envelope built above with the real opening. The
-                // discarded build is pure string assembly (no side effects) — keeping the
-                // refork statement unconditional keeps the queued/substitute wiring, and
-                // its guard test, on a single code path. (openingTurn is mutually
-                // exclusive with queuedDashboardTurn/queuedHasDurableTail.)
                 wrappedInput = buildNewTopicCliInput(reforkContent, ds.session.sessionId, ds.session.cliId ?? dsBotCfgForFork.cliId, ds.session.cliPathOverride ?? dsBotCfgForFork.cliPathOverride, attachments, parsed.mentions, openingBots, undefined, { name: selfBot.botName, openId: selfBot.botOpenId }, localeForBot(larkAppId), reforkSender, {
                     larkAppId,
                     chatId: ds.session.chatId,
@@ -16173,9 +16737,36 @@ async function handleThreadReplyAdmitted(data, ctx, prepared) {
                     codexAppMessageContext: reforkCodexApp.messageContext,
                 });
             }
+            else {
+                const builtReforkInput = buildReforkCliInput(ds, reforkContent, {
+                    attachments: queuedHasDurableTail ? undefined : attachments,
+                    mentions: queuedHasDurableTail ? undefined : parsed.mentions,
+                    cliId: ds.session.cliId ?? dsBotCfgForFork.cliId,
+                    cliPathOverride: ds.session.cliPathOverride ?? dsBotCfgForFork.cliPathOverride,
+                    selfMention: { name: selfBot.botName, openId: selfBot.botOpenId },
+                    sender: queuedHasDurableTail ? undefined : reforkSender,
+                    substituteTrigger: queuedHasDurableTail ? undefined : substituteTrigger,
+                    codexAppText: reforkCodexApp.text,
+                    codexAppApplicationContext: queuedHasDurableTail ? undefined : codexAppApplicationContext,
+                    codexAppMessageContext: reforkCodexApp.messageContext,
+                    turnId: parsed.messageId,
+                });
+                wrappedInput = applyQueuedCodexAppLegacyFallback(builtReforkInput, {
+                    queued: queuedDashboardTurn,
+                    queuedText: queuedCodexAppText,
+                });
+                if (wrappedInput !== builtReforkInput && dsBotCfgForFork.codexAppCleanInput === true) {
+                    // Backlog sessions persisted before clean-input have no raw queued text.
+                    // Keep this activation entirely legacy: reforkContent already contains
+                    // queuedPrompt + the current reply, whereas a structured turn could only
+                    // contain the reply and would silently discard the original task.
+                    logger.warn(`[${tag(ds)}] Legacy queued dashboard task has no clean-input text; using the full legacy activation prompt`);
+                }
+            }
             if (!queuedHasDurableTail) {
                 await noteTurnReceived(ds, parsed.messageId, parsed.content, reforkSender, parsed.messageId, substituteTrigger ? SUBSTITUTE_RECEIVED_REACTION_EMOJI_TYPE : undefined);
             }
+            let reforkAccepted = true;
             try {
                 // Adopt sessions must re-fork via forkAdoptWorker, NOT forkWorker: the
                 // latter would spawn a fresh botmux-managed bmx-* CLI in the adopt cwd,
@@ -16198,7 +16789,7 @@ async function handleThreadReplyAdmitted(data, ctx, prepared) {
                     if (codexAppSteerable && !queuedDashboardTurn && !queuedHasDurableTail) {
                         wrappedInput.codexAppSteerable = true;
                     }
-                    forkWorker(ds, wrappedInput, {
+                    reforkAccepted = forkWorker(ds, wrappedInput, {
                         // See `hadPriorCliInput` above — an opening on a CLI that never took any
                         // input cold-spawns rather than `--resume`-ing an empty session.
                         resume: ds.hasHistory && !(openingTurn && !hadPriorCliInput),
@@ -16213,6 +16804,11 @@ async function handleThreadReplyAdmitted(data, ctx, prepared) {
                     releaseInitialUserTurn(ds);
                 throw e;
             }
+            // refork 成功才算本轮已交给 CLI。fork 抛错（rethrow）或返回 false（quarantine /
+            // 会话已非 active 的不抛错拒绝腿）时，本轮只存在于内存、无 durable 兜底，
+            // 必须保持「请重发」提示——与 live 分支按 accepted 打标对称。
+            if (reforkAccepted)
+                markIngressAdmitted(ctx);
             // Record the input as the session's last real CLI turn ONLY after the fork
             // succeeded. Recording before the fork (the old order) persisted lastCliInput
             // for a turn that never launched when forkWorker threw; the retry then read
@@ -16515,6 +17111,7 @@ async function handleDocCommentAdmitted(ctx) {
                     botIdentity: { name: selfBot.botName, openId: selfBot.botOpenId },
                     sender,
                     mode: 'live',
+                    turnId,
                 });
                 beginNewTurn(ds, text, turnId);
                 (ds.session.docCommentTargets ??= {})[turnId] = docTarget; // per-turn map，不覆盖其他并发轮
@@ -16560,6 +17157,7 @@ async function handleDocCommentAdmitted(ctx) {
                 botIdentity: { name: selfBot.botName, openId: selfBot.botOpenId },
                 sender,
                 mode: 'refork',
+                turnId,
             });
             (ds.session.docCommentTargets ??= {})[turnId] = docTarget; // per-turn map，不覆盖其他并发轮
             rememberLastCliInput(ds, promptContent, wrappedInput);
@@ -16970,6 +17568,28 @@ export async function startDaemon(botIndex) {
     }
     registerBot(cfg);
     selfDaemonLarkAppId = cfg.larkAppId;
+    // The final-answer feedback subsystem is OPTIONAL: a bot with feedback
+    // disabled still opens the shared feedback DB here for turn-completion
+    // indexing, but a bootstrap failure (shared-dataDir lock storm, corruption,
+    // disk full) must NOT abort daemon startup for that bot — that would let one
+    // optional subsystem take down every PM2 bot sharing the dataDir. Fail soft:
+    // log and continue; delivery-time paths degrade to best-effort on their own.
+    let feedbackWebhookDispatcher;
+    try {
+        const feedbackWebhookStore = await getSkillFeedbackStore(config.session.dataDir);
+        const feedbackWebhookSecrets = new FeedbackWebhookSecretStore(config.session.dataDir);
+        feedbackWebhookDispatcher = startFeedbackWebhookDispatcher({
+            store: feedbackWebhookStore,
+            readSecret: ref => feedbackWebhookSecrets.get(ref),
+            onError: error => logger.warn(`[feedback-webhook] ${error instanceof Error ? error.message : String(error)}`),
+        });
+        await feedbackWebhookDispatcher.ready;
+    }
+    catch (error) {
+        logger.error(`[feedback] subsystem bootstrap failed; continuing without feedback indexing/webhooks: `
+            + `${error instanceof Error ? error.message : String(error)}`);
+        feedbackWebhookDispatcher = undefined;
+    }
     // Establish the target-scoped daemon control credential before publishing
     // the daemon descriptor or accepting IPC traffic. Corruption fails startup
     // closed; silently rotating here could strand peers on mismatched tokens.
@@ -17033,6 +17653,7 @@ export async function startDaemon(botIndex) {
     }
     sessionStore.init(cfg.larkAppId);
     chatFirstSeenStore.init(cfg.larkAppId);
+    initSessionGroups(cfg.larkAppId);
     const ambiguousOnBoot = reconcileVcMeetingDeliveriesOnBoot(config.session.dataDir, { receiverBootId: getDaemonBootId(), agentAppId: cfg.larkAppId });
     if (ambiguousOnBoot.length > 0) {
         logger.warn(`[vc-delivery] reconciled ${ambiguousOnBoot.length} stale dispatched receipt(s) as ambiguous`);
@@ -17304,12 +17925,32 @@ export async function startDaemon(botIndex) {
         },
         enforceLiveSessionCap: () => enforceLiveSessionCap('session_change'),
         onQueuedActivationSubmitted,
-        onTurnTerminal(ds, terminal, context) {
+        async onTurnTerminal(ds, terminal, context) {
+            // VC reconcile first: it is in-memory and latency-sensitive, and must not
+            // sit behind a synchronous SQLite write. (Master did only this enqueue.)
             const enqueued = vcMeetingTerminalReconciler?.enqueue(terminal, context);
             if (terminal.dispatchAttempt !== undefined && enqueued?.accepted) {
                 logger.info(`[vc-delivery] terminal queued ${terminal.status} turn=${terminal.turnId.slice(0, 12)} `
                     + `session=${ds.session.sessionId.slice(0, 8)} attempt=${terminal.dispatchAttempt}`);
             }
+            // Feedback turn-completion persistence is a synchronous node:sqlite write.
+            // Route it through the nonblocking, tracked retry queue so a cross-process
+            // write-lock (a `botmux send --response-kind final` subprocess) can never
+            // stall the daemon event loop up to busy_timeout — the queue fails fast on
+            // contention and retries on a timer that yields the loop. apiOnly bots
+            // never produce a feedback delivery, so skip them outright; everyone else
+            // enqueues (a hosted-team may have enabled feedback with no bot-level
+            // config, so we must not gate on bot config alone).
+            if (!getBot(ds.larkAppId).config.apiOnly) {
+                void enqueueTurnTerminal({
+                    dataDir: config.session.dataDir,
+                    botAppId: ds.larkAppId,
+                    sessionId: ds.session.sessionId,
+                    terminal: { turnId: terminal.turnId, dispatchAttempt: terminal.dispatchAttempt, status: terminal.status },
+                    onError: error => logger.error(`[turn-completion] persistence failed turn=${terminal.turnId.slice(0, 12)}: `
+                        + `${error instanceof Error ? error.message : String(error)}`),
+                });
+            }
         },
         onDeferredScheduleTurnSettled(ds, context) {
             scheduleDeferredScheduleSettlement(ds, context);
@@ -17420,6 +18061,11 @@ export async function startDaemon(botIndex) {
     // host-only shared secret on every daemon IPC route except the tiny
     // capability-gated receiver/readiness apertures in dashboard-ipc-server.
     loadOrCreateDashboardSecret(join(homedir(), '.botmux', '.dashboard-secret'));
+    // Create the dispatch-binding key before any credential-only child spawns.
+    // Linux bwrap snapshots `.dashboard-secret.*` authority leaves at launch;
+    // creating this later would leave the new key visible through its writable
+    // host-root bind until the pane cold-started.
+    loadOrCreateDashboardSecret(dispatchReportBindingSecretPath(config.session.dataDir));
     let markIpcReady;
     const ipcReady = new Promise((resolve) => { markIpcReady = resolve; });
     const coreOnly = process.env.BOTMUX_CORE_ONLY === '1';
@@ -18029,7 +18675,20 @@ export async function startDaemon(botIndex) {
                         catch (err) {
                             logger.warn(`[overload] count failed, showing 0: ${err instanceof Error ? err.message : String(err)}`);
                         }
-                        cardJson = buildOverloadAlertCard(initialOverloadCardState(action, counts, nonce));
+                        // Probe which configured browsers are running + holding memory so the
+                        // card can offer a per-browser「♻️ 重启」button (the real memory hog on
+                        // a dev Mac is usually a browser, not botmux sessions). Best-effort:
+                        // any probe failure just yields no browser buttons.
+                        let browsers = [];
+                        try {
+                            const targets = resolveBrowserTargets(alertCfg.browserRestartTargets);
+                            const running = await detectRunningBrowsers(targets);
+                            browsers = running.map(b => ({ bundleId: b.bundleId, label: b.label, memMB: b.memMB }));
+                        }
+                        catch (err) {
+                            logger.warn(`[overload] browser probe failed, no restart buttons: ${err instanceof Error ? err.message : String(err)}`);
+                        }
+                        cardJson = buildOverloadAlertCard(initialOverloadCardState(action, counts, nonce, browsers));
                     }
                     else {
                         cardJson = buildOverloadRecoveredCard(action);
@@ -18164,6 +18823,13 @@ export async function startDaemon(botIndex) {
                     riffRetiredWorkers.push(result.worker);
             }
             scheduler.stopScheduler();
+            // NOTE: turn-terminal queue drain + webhook dispatcher stop are deliberately
+            // deferred until AFTER workers have stopped producing (see below). Draining
+            // here would close queue admission while worker terminal IPC handlers are
+            // still alive, so a turn completing during shutdown would have its terminal
+            // refused and never persisted (delivery cannot be reconstructed to
+            // completed/failed/cancelled after the fact). Keep the queue and dispatcher
+            // live through worker teardown.
             stopMaintenance();
             vcMeetingTerminalReconciler?.stop();
             clearInterval(vcMeetingDeliveryLeaseTimer);
@@ -18200,32 +18866,65 @@ export async function startDaemon(botIndex) {
             ipcHandle.close().catch(() => { });
             if (terminalProxy)
                 terminalProxy.close().catch(() => { });
-            const pendingExits = [];
-            const survivors = [];
-            const trackWorkerExit = (w) => {
-                if (w.exitCode !== null || w.signalCode !== null)
-                    return;
-                pendingExits.push(new Promise(resolve => {
-                    w.once('exit', () => resolve());
-                    // Close the check/listener race if exit landed between the first
-                    // status read and once().
-                    if (w.exitCode !== null || w.signalCode !== null)
-                        resolve();
-                }));
-                survivors.push(w);
+            // Producer-closed fence. We must not close the turn-terminal queue admission
+            // until every worker's IPC channel is truly closed — a worker whose 'exit'
+            // Producer-quiescence fence. A worker whose 'exit' fired can still have
+            // queued 'message' terminals in flight; the IPC `disconnect` event is the
+            // real "no more terminals from this producer" signal (see producer-quiescence
+            // helper — it deliberately keys on disconnect, not 'close', which stdio
+            // inherited by grandchildren can delay). Dedup by ChildProcess.
+            // Two INDEPENDENT shutdown concerns, tracked over the same worker set but
+            // never conflated (conflating them regresses process reaping):
+            //   • reaping (workersToReap / workerExited): every live worker PROCESS must
+            //     exit or be SIGKILLed — orphan prevention. Keys on process death, NOT
+            //     on `connected`.
+            //   • producer fence (producerClosed): every worker's IPC channel must
+            //     disconnect — the "no more terminal messages" signal that gates closing
+            //     the feedback queue admission. Keys on `disconnect`, NOT on exit.
+            const producerClosed = [];
+            const workerExited = [];
+            const reapCandidates = [];
+            const trackedProducers = new Set();
+            const trackedReap = new Set();
+            const trackWorker = (w) => {
+                // Producer fence: disconnect-based, gates feedback admission only.
+                if (!trackedProducers.has(w)) {
+                    trackedProducers.add(w);
+                    const q = trackProducerQuiet(w);
+                    if (!q.alreadyQuiet && q.done)
+                        producerClosed.push(q.done);
+                }
+                // Reaping: exit-based, orphan prevention. Registered BEFORE any signal so
+                // a fast exit is not missed; dedup by ChildProcess.
+                if (!trackedReap.has(w)) {
+                    trackedReap.add(w);
+                    const e = trackProcessExited(w);
+                    if (!e.alreadyExited && e.done) {
+                        workerExited.push(e.done);
+                        reapCandidates.push(w);
+                    }
+                }
             };
             for (const worker of riffRetiredWorkers)
-                trackWorkerExit(worker);
+                trackWorker(worker);
             for (const ds of currentShutdownFleet.sessions) {
-                if (ds.worker && !ds.worker.killed) {
+                const w = ds.worker;
+                if (!w)
+                    continue;
+                // Track EVERY non-null worker (both concerns) unconditionally. `killed`
+                // only means a signal was already sent — NOT that the process exited or
+                // the IPC channel disconnected (a worker can be `killed=true &&
+                // connected=true` right after .kill(), e.g. the promoted-activation
+                // IPC-failure path that kills but defers ds.worker cleanup). `killed` only
+                // decides whether we still need to SEND a stop signal; it never decides
+                // whether the worker is tracked for reaping or the producer fence.
+                trackWorker(w);
+                if (!w.killed) {
                     logger.info(`Shutting down worker for session ${ds.session.sessionId}`);
-                    const w = ds.worker;
                     const disposition = shutdownBackendDisposition(ds);
                     if (disposition === 'riff-drain-detach') {
                         throw new Error(`undrained Riff generation after atomic commit: ${ds.session.sessionId}`);
                     }
-                    // Capture the exit promise BEFORE killWorker nulls ds.worker.
-                    trackWorkerExit(w);
                     // Branch by the session's FROZEN backend (stamped on Session.backendType
                     // at spawn), NOT the bot's live config — a dashboard backendType edit must
                     // not change how a running session is torn down, or we'd e.g. try to
@@ -18253,12 +18952,34 @@ export async function startDaemon(botIndex) {
                     }
                 }
             }
-            if (pendingExits.length > 0) {
-                const exitGraceMs = Math.min(DAEMON_WORKER_EXIT_GRACE_MS, Math.max(0, shutdownDeadlineMs - Date.now()));
-                const timeout = new Promise(resolve => setTimeout(resolve, exitGraceMs));
-                await Promise.race([Promise.all(pendingExits), timeout]);
+            // --- Staged producer quiescence before touching the feedback queue -------
+            // Contract (fail-closed): the turn-terminal queue admission may be closed
+            // (inside drainTurnTerminalQueue) ONLY after BOTH fences confirm quiescent
+            // within the shared absolute deadline:
+            //   (1) every worker IPC channel disconnected — no NEW terminal message can
+            //       be delivered; and
+            //   (2) every in-flight Codex App final-settlement resolved — an already
+            //       delivered final_output whose handler is awaiting network delivery
+            //       has finished its cb.onTurnTerminal (which synchronously enqueues).
+            // If either fence is not quiescent by the deadline we DO NOT close admission
+            // (closing it would refuse a terminal a still-live producer may yet emit —
+            // strictly worse than the pre-feature behaviour). We keep admission open,
+            // warn loudly, and let the process exit on its budget.
+            // Every wait shares the single absolute `shutdownDeadlineMs`; a ref'd
+            // keepalive (waitAllWithin) holds the loop so a fire-and-forget SIGTERM
+            // handler cannot exit mid-wait once workers/services have stopped.
+            const remainingBudget = () => Math.max(0, shutdownDeadlineMs - Date.now());
+            // --- Phase 1: process reaping (orphan prevention) ------------------------
+            // Give every live worker PROCESS a normal grace to exit, then SIGKILL any
+            // still alive, then confirm exit within the shared deadline. This is keyed
+            // on process death (exitCode/signalCode), independent of IPC state, so a
+            // worker that ignores SIGTERM — or that already disconnected its IPC but is
+            // still running — is still reaped and cannot become a ppid=1 orphan.
+            if (workerExited.length > 0) {
+                const exitGraceDeadline = Math.min(shutdownDeadlineMs, Date.now() + DAEMON_WORKER_EXIT_GRACE_MS);
+                await waitAllWithin(workerExited, exitGraceDeadline);
                 let stragglers = 0;
-                for (const w of survivors) {
+                for (const w of reapCandidates) {
                     if (w.exitCode === null && w.signalCode === null) {
                         stragglers++;
                         try {
@@ -18268,9 +18989,51 @@ export async function startDaemon(botIndex) {
                     }
                 }
                 if (stragglers > 0) {
-                    logger.warn(`${stragglers}/${survivors.length} worker(s) didn't exit within ${exitGraceMs}ms — SIGKILL'd to prevent ppid=1 orphans.`);
+                    logger.warn(`${stragglers}/${reapCandidates.length} worker(s) didn't exit within grace — SIGKILL'd to prevent ppid=1 orphans.`);
+                    // Confirm the SIGKILLed processes actually exit, still within the deadline.
+                    await waitAllWithin(workerExited, shutdownDeadlineMs);
+                }
+            }
+            // --- Phase 2: producer disconnect fence (gates feedback admission) -------
+            // Separate from reaping: this only decides whether it is safe to close the
+            // feedback queue admission. A late (but in-deadline) disconnect still counts
+            // as quiescent — we do not force it via SIGKILL here (Phase 1 already
+            // handled process liveness). By this point most workers have exited (which
+            // also disconnects their IPC), so producerClosed is typically already
+            // settled; we still await it explicitly under the shared deadline.
+            const disconnectQuiesced = await waitAllWithin(producerClosed, shutdownDeadlineMs);
+            // Settlement fence: only meaningful once IPC is confirmed disconnected (no
+            // new settlement can be created). Await the snapshot, then re-read the count
+            // — 0 confirms every in-flight settlement (and its enqueue) has completed.
+            let settlementQuiesced = false;
+            if (disconnectQuiesced) {
+                await waitAllWithin(snapshotCodexAppFinalSettlements(), shutdownDeadlineMs);
+                settlementQuiesced = codexAppFinalSettlementCount() === 0;
+            }
+            if (disconnectQuiesced && settlementQuiesced) {
+                // Both fences quiescent: safe to close admission and drain the last
+                // terminals into the durable outbox, bounded by the remaining budget.
+                const drainBudget = remainingBudget();
+                if (drainBudget > 0) {
+                    const undrained = await drainTurnTerminalQueue(drainBudget);
+                    if (undrained > 0)
+                        logger.warn(`[turn-completion] shutdown drain timed out with ${undrained} pending`);
+                }
+                else {
+                    logger.error('[turn-completion] shutdown deadline exhausted before drain — in-memory queued turn terminals were NOT persisted and are LOST (they are not yet in the durable store)');
                 }
             }
+            else {
+                // Fail-closed: a producer may still emit a terminal. Do NOT close
+                // admission (that would refuse and lose it). Hold open, warn, and let the
+                // process exit on its budget; unfinished work stays in the durable store.
+                logger.error(`[turn-completion] shutdown producer quiescence NOT confirmed `
+                    + `(ipcDisconnected=${disconnectQuiesced} settlementsSettled=${settlementQuiesced}); `
+                    + `leaving feedback queue admission OPEN to avoid refusing a late terminal`);
+            }
+            // Dispatcher stop always receives the hard-clamped remaining budget (never
+            // its internal 5s default), success or failure path alike.
+            await feedbackWebhookDispatcher?.stop(remainingBudget());
             // Flush any pending identity-cache writes before exit. The cache uses a
             // 2s debounce on disk persistence to dedupe writes from chatty groups; on
             // SIGTERM we want anything learned since the last flush to land.