botmux 3.14.0 → 3.16.0

package/dist/daemon.js

@@ -1,7 +1,9 @@
 import { execFileSync } from 'node:child_process';
 import { createHash, randomUUID } from 'node:crypto';
 import { readFileSync, existsSync, mkdirSync, unlinkSync } from 'node:fs';
+import { installDaemonRejectionGuard } from './utils/daemon-rejection-guard.js';
 import { atomicWriteFileSync } from './utils/atomic-write.js';
+import { readPeerCrossRef } from './services/peer-cross-ref-store.js';
 import { readAllowedUsersResolveCache, writeAllowedUsersResolveCache } from './utils/allowed-users-cache.js';
 import { join, dirname } from 'node:path';
 import { homedir, loadavg, cpus, totalmem, freemem } from 'node:os';
@@ -9,7 +11,7 @@ import { fileURLToPath } from 'node:url';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 import { config, getDashboardExternalHost, isVcMeetingAgentGloballyEnabled, vcMeetingAgentGlobalListenerBotAppId, } from './config.js';
-import { readGlobalConfig, repoPickerScanOptions } from './global-config.js';
+import { readGlobalConfig, repoPickerScanOptions, isWorkflowFeatureEnabled } from './global-config.js';
 import { buildDashboardUrls } from './core/dashboard-url.js';
 import { resolveBotmuxDataDir } from './core/data-dir.js';
 import { reloadExactDaemonBotConfig } from './core/daemon-config-fence.js';
@@ -63,6 +65,15 @@ import { scrubTmuxServerGlobalEnv } from './setup/ensure-tmux.js';
 import { entryNeedsContactResolve } from './setup/bot-config-editor.js';
 import { invalidWorkingDirs } from './utils/working-dir.js';
 import { validateWorkingDir } from './core/working-dir.js';
+function trustedCallerForTurn(larkAppId, senderOpenId, senderUnionId) {
+    if (!senderOpenId && !senderUnionId)
+        return undefined;
+    return {
+        ...(senderOpenId ? { requestUserOpenId: senderOpenId } : {}),
+        ...(senderUnionId ? { requestUserUnionId: senderUnionId } : {}),
+        requestLarkAppId: larkAppId,
+    };
+}
 import { activeSessionKey, sessionKey, sessionAnchorId, storedSessionAnchorId, larkTransportEnabled, } from './core/types.js';
 import { stagePendingRepoSetup, persistPendingRepoCardMessageId } from './core/pending-repo-journal.js';
 import { setTerminalProxyPort, setTerminalExternalPort } from './core/terminal-url.js';
@@ -77,10 +88,11 @@ import { isLocalCliOpenReady } from './services/local-cli-opener.js';
 import { RECEIVED_REACTION_EMOJI_TYPE, SUBSTITUTE_RECEIVED_REACTION_EMOJI_TYPE } from './core/pending-response.js';
 import { t as tr, localeForBot } from './i18n/index.js';
 import { createCliAdapterSync } from './adapters/cli/registry.js';
-import { initWorkerPool, setActiveSessionsRegistry, forkWorker, forkAdoptWorker, sendWorkerInput, promoteQueuedActivationTail, admitQueuedActivationTail, reserveQueuedActivationTailAdmission, codexAppCleanInputAcceptedForSession, hasQueuedActivationAdmissionGate, sendWorkerSessionInput, killWorker, reapOrphanWorkers, scheduleCardPatch, setCurrentCliVersion, getCurrentCliVersion, CARD_POSTING_SENTINEL, parkStreamCard, closeSession as closeSessionHelper, setActiveSessionIfActive, rollbackRejectedSessionAndGetWinner, ensureCliEnv, sweepGlobalBotmuxSkills, writableTerminalLinkFor, workerHasInitialized, sessionSupportsWebTerminal, readableTerminalUrlFor, findActiveBySessionId, withActiveSessionKeyLock, getDaemonBootId, getDaemonStreamingCardUsageSnapshot, postTurnStartingCard, isSessionTransferring, snapshotCodexAppFinalSettlements, codexAppFinalSettlementCount, } from './core/worker-pool.js';
+import { initWorkerPool, setActiveSessionsRegistry, forkWorker, forkAdoptWorker, sendWorkerInput, promoteQueuedActivationTail, admitQueuedActivationTail, reserveQueuedActivationTailAdmission, codexAppCleanInputAcceptedForSession, hasQueuedActivationAdmissionGate, sendWorkerSessionInput, killWorker, retireWorkerProcessOnly, retiringWorkersForSession, reapOrphanWorkers, scheduleCardPatch, setCurrentCliVersion, getCurrentCliVersion, CARD_POSTING_SENTINEL, parkStreamCard, closeSession as closeSessionHelper, closeSessionForBackgroundCleanup, setActiveSessionIfActive, rollbackRejectedSessionAndGetWinner, ensureCliEnv, sweepGlobalBotmuxSkills, writableTerminalLinkFor, workerHasInitialized, sessionSupportsWebTerminal, readableTerminalUrlFor, findActiveBySessionId, withActiveSessionKeyLock, getDaemonBootId, getDaemonStreamingCardUsageSnapshot, postTurnStartingCard, isSessionTransferring, snapshotCodexAppFinalSettlements, codexAppFinalSettlementCount, migrateMojoSessionIdentities, mojoLivePatchForSession, } from './core/worker-pool.js';
 import { waitAllWithin, trackProducerQuiet, trackProcessExited } from './core/producer-quiescence.js';
 import { AbortDeadlineError, hasExactSafeJsonKeys, ipcRoute, isTrustedHostIpcRequest, JsonBodyTooLargeError, jsonRes, readJsonBody, runWithAbortDeadline, setBotName, setLarkAppId, startIpcServer, setBotRenamer, setBotAvatarChanger, armCoreOnlyReadinessGate, setCoreOnlyReady, setSupervisorShutdownHandler } from './core/dashboard-ipc-server.js';
 import { setDeviceIsolationDaemonIdentity } from './core/device-isolation-daemon.js';
+import { reconcileContainmentHandlesOnBoot } from './core/mojo-containment.js';
 import { cancelSessionReadyAck, waitForSessionReadyAck, } from './core/session-ready-handshake.js';
 import { loadOrCreateDashboardSecret, loadPersistedToken } from './dashboard/auth.js';
 import { daemonIpcAuthHeaders, fetchDaemonIpc, loadDaemonIpcSecret } from './core/daemon-ipc-auth.js';
@@ -98,6 +110,7 @@ import { consumeQuota, removeChatGrant, removeGlobalGrant } from './services/gra
 import { abortCharge, commitCharge, beginCharge } from './services/quota-dedup.js';
 import { getSessionWorkingDir, getProjectScanDirs, getProjectScanDirsForBot, expandHome, downloadResources, formatAttachmentsHint, buildNewTopicCliInput, buildFollowUpCliInput, buildBridgeInputContent, buildReforkCliInput, getAvailableBots, restoreActiveSessions, executeScheduledTask, persistStreamCardState, rememberLastCliInput, ensureTerminalWorkerPort, ensureSessionWhiteboard, resumeSession, closeCliMismatchedSessionsForBot, } from './core/session-manager.js';
 import { triggerSessionTurn, reconcileIdempotencyLeasesOnBoot, convergeIdempotentAsyncTurnOnWorkerExit, externalEventOpensOwnTopic } from './core/trigger-session.js';
+import { runIdempotencyFailClose, runWithdrawAutoClose, } from './core/daemon-background-close.js';
 import { runDetachedBotTurnMutation, tryWithBotTurnMutation, withBotTurnAdmission, withBotTurnMutation, } from './core/bot-turn-mutation-gate.js';
 import { claimInitialUserTurn, isInitialUserTurnPending, releaseInitialUserTurn } from './core/initial-user-turn.js';
 import { applyQueuedCodexAppLegacyFallback, mergeQueuedCodexAppTurn } from './core/session-create.js';
@@ -113,11 +126,14 @@ import { HerdrBackend } from './adapters/backend/herdr-backend.js';
 import { ZellijBackend } from './adapters/backend/zellij-backend.js';
 import { ZmxBackend } from './adapters/backend/zmx-backend.js';
 import { sweepIdleWorkersAfterTurnDrain, DEFAULT_MAX_LIVE_WORKERS } from './core/idle-worker-sweeper.js';
-import { getSessionPersistentBackendType, killPersistentBackendTarget, killPersistentSession, probePersistentBackendTarget, probePersistentSession, resolvePersistentBackendTarget, resolvePairedSpawnBackendType, } from './core/persistent-backend.js';
+import { DEFAULT_SESSION_OWNER_REMINDER, SessionOwnerReminderController, } from './core/session-owner-reminder.js';
+import { loadSessionOwnerReminderRecords, saveSessionOwnerReminderRecords, } from './services/session-owner-reminder-store.js';
+import { sendSessionOwnerThreadNotification } from './services/session-owner-notification.js';
+import { getSessionPersistentBackendType, isRemoteBackendSession, killPersistentBackendTarget, killPersistentSession, probePersistentBackendTarget, probePersistentSession, resolvePersistentBackendTarget, resolvePairedSpawnBackendType, } from './core/persistent-backend.js';
 import { handleCardAction, runAutoWorktreeCommit } from './im/lark/card-handler.js';
 import { setIssueActivate } from './im/lark/issue-command-deps.js';
 import { startIssueOutboxPump } from './services/issue-outbox-pump.js';
-import { parseWorkflowGrillTrigger, buildWorkflowGrillPrompt, isLegacyTemplateCommand, LEGACY_TEMPLATE_RETIRED_MESSAGE, WORKFLOW_USAGE, } from './im/lark/workflow-slash-command.js';
+import { parseWorkflowGrillTrigger, buildWorkflowGrillPrompt, isLegacyTemplateCommand, LEGACY_TEMPLATE_RETIRED_MESSAGE, WORKFLOW_USAGE, WORKFLOW_DISABLED_MESSAGE, } from './im/lark/workflow-slash-command.js';
 import { parseV3SavedWorkflowCommand, v3SavedWorkflowUsage, } from './im/lark/v3-saved-workflow-command.js';
 import { authorizeV3SavedWorkflowInvocation, defaultV3SavedWorkflowExecutionServices, deliverV3SavedWorkflowNotification, executeV3SavedWorkflowCommand, resolveV3SavedWorkflowMessageTargets, } from './im/lark/v3-saved-workflow-handler.js';
 import { createV3GateRunner, preflightV3RunStart, readV3RunChatBinding, requestV3RunCancel, requestV3Retry, requestV3LoopGrant, } from './workflows/v3/daemon-run.js';
@@ -172,7 +188,7 @@ function republishResolvedAllowedUsers(larkAppId, resolved) {
     catch { /* best effort */ }
 }
 let vcMeetingTerminalReconciler;
-import { isBotMentioned, probeBotOpenId, startLarkEventDispatcher, markForwardFollowupsSessionsReady, writeBotInfoFile, canOperate, canRunDaemonCommand, evaluateTalk, evaluateBotTalk, evaluateAskAnswerTalk, grantCommandRestriction, isKnownPeerBot, checkRequiredScopes } from './im/lark/event-dispatcher.js';
+import { isBotMentioned, probeBotOpenId, startLarkEventDispatcher, markForwardFollowupsSessionsReady, writeBotInfoFile, canOperate, canRunDaemonCommand, evaluateTalk, evaluateBotTalk, evaluateAskAnswerTalk, askCustomReplyCandidate, grantCommandRestriction, isKnownPeerBot, checkRequiredScopes } from './im/lark/event-dispatcher.js';
 import { getDocSubscription, listAllDocSubscriptions, putDocSubscription, removeDocSubscription, setDocCommentPollCursor } from './services/doc-subs-store.js';
 import { BOT_REPLY_SENTINEL, subscribeDocFile, unsubscribeDocFile, addCommentReaction, removeCommentReaction, hasBotSentinel, isBotAuthoredReply, listDocComments } from './im/lark/doc-comment.js';
 import { learnFromMentions, resolveSender, flushIdentityCacheSync } from './im/lark/identity-cache.js';
@@ -181,7 +197,7 @@ import { buildDocCommentTurnInput, buildDocWatchWarmupTurnInput } from './core/d
 import { advanceDocCommentCursor, docCommentRepliesAfterCursor, latestDocCommentPollCursor } from './core/doc-comment-poller.js';
 import { renderBufferedSenderBlock } from './core/session-manager.js';
 import { shutdownBackendDisposition } from './core/persistent-backend.js';
-import { abortRiffShutdownFleet, canAbortVerifiedExitedRiffPreparation, collectUniqueDaemonShutdownSessions, commitPreparedRiffShutdown, isPreparedRiffSessionCurrent, persistPreparedRiffShutdownFleet, prepareRiffFleetForShutdown, } from './core/riff-shutdown-detach.js';
+import { abortRemoteShutdownFleet, canAbortVerifiedExitedRemotePreparation, collectUniqueDaemonShutdownSessions, commitPreparedRemoteShutdown, isPreparedRemoteSessionCurrent, persistPreparedRemoteShutdownFleet, prepareRemoteFleetForShutdown, } from './core/remote-shutdown-detach.js';
 import { BOT_TURN_MUTATION_SHUTDOWN_ACQUIRE_TIMEOUT_MS, DAEMON_SHUTDOWN_MAX_MS, DAEMON_WORKER_EXIT_GRACE_MS, } from './core/shutdown-budgets.js';
 import { evaluateVcMeetingConsumerIsolation } from './services/vc-meeting-consumer-isolation.js';
 import { markSessionActivity, announcePendingRepoSession, publishAttentionPatch, publishLastInputFromBotPatch, publishSessionMessagePreviewPatch, publishClosedSessionPatch, clearAgentAttention, } from './core/session-activity.js';
@@ -201,7 +217,7 @@ import { connectRealtimeVoiceTransport, createProtoRealtimeVoiceProtocol, fetchR
 import { createGroupWithBots } from './services/group-creator.js';
 import { addBotToChat, isInChat } from './services/groups-store.js';
 import { initSessionGroups, isSessionGroup, getSessionGroup, touchSessionGroup } from './services/session-groups-store.js';
-import { maybeBirthSessionGroup } from './core/session-group-birth.js';
+import { maybeBirthSessionGroup, declinesSessionGroupBirthAsSlashCommand } from './core/session-group-birth.js';
 import { scheduleSessionGroupTitle } from './services/session-group-title.js';
 import { setChatReplyMode } from './services/chat-reply-mode-store.js';
 import { hasVcMeetingEndedTombstone, listVcMeetingRuntimeSessionsByListenerAndAgent, listVcMeetingRuntimeSessions, pruneExpiredVcMeetingRuntimeSessions, recordVcMeetingEndedTombstone, recordVcMeetingRuntimeSession, removeVcMeetingRuntimeSession, } from './services/vc-meeting-runtime-store.js';
@@ -230,6 +246,9 @@ const activeSessions = new Map();
  *  (codex P1-2). While false, /api/asks returns a retryable 503 for unknown
  *  sessions instead, so the reconnecting hook keeps waiting through the restore. */
 let sessionsRestored = false;
+/** Once-per-daemon guard for the mojo containment boot reconciliation. The store
+ *  is bot-agnostic, so it must run once regardless of how many bots start. */
+let mojoContainmentReconciledThisBoot = false;
 const VC_MEETING_DELIVERY_LEASE_MS = 15 * 60_000;
 const VC_MEETING_DELIVERY_LEASE_SCAN_MS = 60_000;
 const VC_MEETING_RUNTIME_EXPIRY_ACK_TIMEOUT_MS = 3_000;
@@ -366,15 +385,37 @@ function vcMeetingPersistentBackendAvailable(backendType) {
         return ZellijBackend.isAvailable();
     return ZmxBackend.isAvailable();
 }
+/**
+ * VC receiver teardown: this fence's job is to guarantee the local PRODUCER
+ * process is dead before hub replay is admitted. killWorker refuses an
+ * unprepared live remote worker (P0-2) — the fail-safe direction for lineage,
+ * but for THIS caller a silent refusal is fail-OPEN: the pane probes then read
+ * `missing` (mojo has no persistent pane) and the fence cleared while the
+ * producer kept running. Remote-frozen receivers are therefore retired
+ * process-only — no close IPC, no remote cancel, lineage and containment
+ * handles intact — with retireWorkerProcessOnly's SIGTERM→SIGKILL backstop
+ * guaranteeing death; local receivers keep killWorker so their backing
+ * session is torn down as before.
+ */
+function teardownVcReceiverWorker(ds) {
+    if (isRemoteBackendSession(ds))
+        retireWorkerProcessOnly(ds, 'vc_runtime_lease');
+    else
+        killWorker(ds);
+}
 let testOnlyVcMeetingBootBackingMissing;
 function vcMeetingBootBackingMissing(sessionId, destroy) {
     if (testOnlyVcMeetingBootBackingMissing) {
         return testOnlyVcMeetingBootBackingMissing(sessionId, destroy);
     }
     const ds = findActiveBySessionId(sessionId);
+    // Captured BEFORE teardown: retirement nulls ds.worker while the process
+    // dies asynchronously, and the producer-liveness check below needs the real
+    // ChildProcess to prove the exit.
+    const workerBefore = ds?.worker && !ds.worker.killed ? ds.worker : null;
     if (destroy && ds) {
         try {
-            killWorker(ds);
+            teardownVcReceiverWorker(ds);
         }
         catch (err) {
             logger.warn(`[vc-delivery] boot recovery worker teardown failed session=${sessionId}: ${err}`);
@@ -415,6 +456,16 @@ function vcMeetingBootBackingMissing(sessionId, destroy) {
                 + `backend=${backendType} session=${sessionId}`);
         }
     }
+    // The worker PROCESS is itself the producer this recovery gates on; pane
+    // probes say nothing about it (mojo has no pane at all, so they always read
+    // `missing`). Clear only once the previously-live worker has actually
+    // exited — the retirement's SIGTERM→SIGKILL backstop makes a later reprobe
+    // see it gone.
+    if (workerBefore && workerBefore.exitCode === null && workerBefore.signalCode === null) {
+        allMissing = false;
+        logger.error(`[vc-delivery] boot recovery worker process still live; receiver remains gated `
+            + `session=${sessionId}`);
+    }
     return allMissing;
 }
 function scheduleVcMeetingBootRecoveryProbe(key, sessionId, delayMs) {
@@ -448,9 +499,11 @@ function escalateVcMeetingBootRecovery(key, sessionId) {
     vcMeetingReceiverRecoveryEscalating.add(key);
     const ds = findActiveBySessionId(sessionId);
     if (ds)
-        killWorker(ds);
-    // Wait past killWorker's 7s SIGKILL backstop, then direct-kill and probe the
-    // persisted exact backend. exists/unknown stays scoped-gated and reprobes.
+        teardownVcReceiverWorker(ds);
+    // Wait past the retirement's SIGTERM→SIGKILL backstop window (killWorker for
+    // local receivers, retireWorkerProcessOnly for remote-frozen ones — a plain
+    // killWorker would REFUSE a live remote worker and arm nothing), then
+    // direct-kill and probe. exists/unknown stays scoped-gated and reprobes.
     scheduleVcMeetingBootRecoveryProbe(key, sessionId, VC_MEETING_RUNTIME_EXPIRY_TEARDOWN_MS);
 }
 function acknowledgeVcMeetingReceiverRecovery(key) {
@@ -579,6 +632,34 @@ function createVcMeetingRuntimeLeaseRecovery(deps) {
             scheduleReprobe(fence, 'identity conflict');
             return false;
         }
+        // Captured BEFORE teardown: retirement nulls ds.worker while the process
+        // dies asynchronously; the producer-liveness gate below needs the real
+        // ChildProcess to prove the exit. Falls back to the process observed at
+        // arm time when the registry no longer resolves the ds — a deleted
+        // registry entry is not proof the producer died (fourth-round review).
+        const armedAlive = fence.armedWorker
+            && !fence.armedWorker.killed
+            && fence.armedWorker.exitCode === null
+            && fence.armedWorker.signalCode === null
+            ? fence.armedWorker : null;
+        // Third source, for a fence armed AFTER the registry delete (the other
+        // half of the collision-loser timing): a process-only retirement is still
+        // dying for this session id, and neither ds nor arm-time capture ever saw
+        // it. Pin it onto the fence so later reprobes keep tracking the same
+        // process.
+        let retiringAlive = null;
+        if (!armedAlive && !(ds?.worker && !ds.worker.killed)) {
+            for (const w of deps.resolveRetiringWorkers?.(fence.receiverSessionId) ?? []) {
+                if (w && !w.killed && w.exitCode === null && w.signalCode === null) {
+                    retiringAlive = w;
+                    fence.armedWorker = w;
+                    break;
+                }
+            }
+        }
+        const workerBefore = (ds?.worker && !ds.worker.killed ? ds.worker : null)
+            ?? armedAlive
+            ?? retiringAlive;
         if (ds) {
             try {
                 deps.killWorker(ds);
@@ -625,6 +706,17 @@ function createVcMeetingRuntimeLeaseRecovery(deps) {
                     + `attempt=${fence.dispatchAttempt}`);
             }
         }
+        // The worker PROCESS is itself the producer this fence gates on; pane
+        // probes say nothing about it — mojo owns no pane, so they always read
+        // `missing`, which is exactly how a refused/incomplete teardown became
+        // fail-OPEN (third-round review, gate 3). Clear only once the previously
+        // live worker has actually EXITED; the retirement's SIGTERM→SIGKILL
+        // backstop guarantees a later reprobe sees it gone.
+        if (workerBefore && workerBefore.exitCode === null && workerBefore.signalCode === null) {
+            allMissing = false;
+            deps.error(`[vc-delivery] runtime lease worker process still live; delivery remains gated `
+                + `session=${fence.receiverSessionId} attempt=${fence.dispatchAttempt}`);
+        }
         // PTY has no surviving backing process once its worker has crossed the
         // SIGKILL backstop. Persistent backends unlock only after every applicable
         // deterministic name probes authoritatively missing. The backing proof is
@@ -679,8 +771,11 @@ function createVcMeetingRuntimeLeaseRecovery(deps) {
             deps.error(`[vc-delivery] runtime lease escalation failed to kill worker `
                 + `session=${fence.receiverSessionId}: ${err instanceof Error ? err.message : String(err)}`);
         }
-        // killWorker's live path has a 7s SIGKILL backstop. Only after that window
-        // do we directly kill + probe the deterministic owned pane.
+        // The teardown above arms a SIGTERM→SIGKILL backstop (killWorker's close
+        // path for local receivers; retireWorkerProcessOnly for remote-frozen
+        // ones — a plain killWorker would REFUSE a live remote worker and arm
+        // nothing, which is why the fence used to fail open for mojo). Only after
+        // that window do we directly kill + probe the deterministic owned pane.
         fence.timer = setTimeout(() => {
             if (!isCurrent(fence) || fence.phase !== 'escalating')
                 return;
@@ -717,6 +812,10 @@ function createVcMeetingRuntimeLeaseRecovery(deps) {
             teardownAndProbe(fence, !ds ? 'missing-session teardown' : 'workerless teardown');
             return;
         }
+        // Remember the live producer process itself: registry state can stop
+        // resolving this ds before the process has died, and the liveness gate in
+        // teardownAndProbe must keep seeing it.
+        fence.armedWorker = ds.worker;
         if ((ds.workerGeneration ?? 0) !== ref.workerGeneration) {
             deps.error(`[vc-delivery] runtime lease worker generation mismatch; escalating `
                 + `session=${ref.receiverSessionId} receipt=${ref.workerGeneration} `
@@ -765,6 +864,12 @@ function createVcMeetingRuntimeLeaseRecovery(deps) {
             return false;
         }
         if (context.disposition === 'queued_removed') {
+            // No producer-exit proof required here, deliberately: `queued_removed`
+            // is an ACK from the EXACT expected worker generation saying it removed
+            // the queued delivery itself. The producer is alive, current and
+            // cooperating — the double-delivery risk this fence gates on is gone
+            // without anyone dying. Exit proof is demanded only on the teardown
+            // paths, where the producer's state is unknown or adversarial.
             clearFence(fence);
             return true;
         }
@@ -836,7 +941,8 @@ const vcMeetingRuntimeLeaseRecovery = createVcMeetingRuntimeLeaseRecovery({
             throw new Error('receiver worker is not live');
         ds.worker.send(message);
     },
-    killWorker,
+    killWorker: teardownVcReceiverWorker,
+    resolveRetiringWorkers: retiringWorkersForSession,
     resolvePersistentScope(ds) {
         const backendType = getSessionPersistentBackendType(ds);
         if (backendType)
@@ -1942,19 +2048,34 @@ function scheduleDeferredScheduleSettlement(ds, context) {
     // Exact transcript terminal needs only a short filesystem visibility grace.
     // Screen-only adapters use a longer confirmation and re-check that the same
     // turn is still idle before reclaiming the hidden session.
+    // Remote backends (riff / mojo) report their turn boundary over the network,
+    // so allow the same longer grace as the screen-only path instead of the 300ms
+    // local-filesystem one.
+    const remoteTerminal = ds.session.backendType === 'riff'
+        || ds.session.backendType === 'mojo';
     const delayMs = context.source === 'terminal'
-        ? (ds.session.backendType === 'riff' ? 1_500 : 300)
+        ? (remoteTerminal ? 1_500 : 300)
         : 1_500;
     const timer = setTimeout(() => {
         deferredScheduleSettleTimers.delete(sessionId);
         void settleDeferredScheduleRun(ds, context, {
             reconcile: reconcileDeferredTopicBinding,
-            closeSession: closeSessionHelper,
+            // Background path: no user surface, so a residual/refusal must at least be
+            // logged with its remote id instead of being discarded.
+            closeSession: (id) => closeSessionForBackgroundCleanup(id, 'deferred-schedule settlement'),
         }).then((result) => {
             if (result.action === 'materialized') {
                 logger.info(`[scheduler] Deferred topic materialized session=${sessionId.slice(0, 8)} root=${result.rootMessageId.slice(0, 12)}`);
                 return;
             }
+            if (result.action === 'close_refused') {
+                // Must NOT print "Auto-closed": the row is still active and its remote
+                // session may still be running. Two contradictory log lines about the same
+                // session is exactly how a false success hides.
+                logger.error(`[scheduler] Deferred run close REFUSED (${result.error ?? 'unknown'}); session stays `
+                    + `ACTIVE session=${sessionId.slice(0, 8)} turn=${context.turnId.slice(0, 12)} source=${context.source}`);
+                return;
+            }
             if (result.action === 'closed') {
                 logger.info(`[scheduler] Auto-closed silent deferred run with no botmux send `
                     + `session=${sessionId.slice(0, 8)} turn=${context.turnId.slice(0, 12)} source=${context.source}`);
@@ -2374,8 +2495,11 @@ async function maybeSeedCardlessForceTopicTurn(args) {
     }
 }
 async function revokeQuotaGrant(larkAppId, chatId, senderOpenId, ev) {
+    // 会话群里的 chatGrant 是**继承**来的：授权记录挂在出生前那个私聊上（ev.grantChatId），
+    // 不在会话群自己身上。撤销必须落到来源 chat，否则删了个不存在的记录，硬上限失效。
+    const grantChatId = ev.grantChatId ?? chatId;
     const result = ev.reason === 'chatGrant'
-        ? await removeChatGrant(larkAppId, chatId, senderOpenId)
+        ? await removeChatGrant(larkAppId, grantChatId, senderOpenId)
         : ev.reason === 'globalGrant'
             ? await removeGlobalGrant(larkAppId, senderOpenId)
             : { ok: true, removed: false };
@@ -2396,6 +2520,20 @@ async function notifyQuotaExhausted(larkAppId, anchor, senderOpenId, limit) {
 export async function enforceMessageQuotaForCliInput(larkAppId, chatId, senderOpenId, messageId, anchor, senderUnionId, memberUnionId, chatType, botSender, opts) {
     if (opts?.listenerAuthorized)
         return true;
+    // 会话群出生轮：**同一条消息**的授权判定与扣费，刚刚由本函数在原 DM 上下文里
+    // 一起做完（handleNewTopicAdmitted 的建群前扣费点：扣费被拒必须零外部副作用，
+    // 所以它必须排在 createGroupWithBots 之前）。这一轮绝不能再复查一次：
+    //   • 新群是 bot 刚为这个发送者建的，chat 维度的 talk 来源（chatGrant /
+    //     allowedChatGroup / oncall / p2p 专属的 p2pOpen）按定义不可能已经落在它
+    //     上面，复查只会产出假阴性；
+    //   • 而这条消息**已经扣过一次费**——被假阴性丢掉就成了「扣了费还把任务丢了」：
+    //     用户额度少一格，任务无声消失，连一句拒绝提示都没有（丢弃分支只打 debug 日志）。
+    // 「扣了费就不能丢任务，丢任务就不能扣费」是这道闸的硬不变量，两侧只能同进同退。
+    // 授权本身并没有被放宽：真正的判定就是 DM 那次（真实 chatId + chatType='p2p'），
+    // 这里只是不拿一个必然更严的新上下文去推翻它。跨 chat 的授权继承缺口是另一件事
+    //（新群里的**后续**消息仍按新 chat 判定），不由这条已扣费的出生轮来承担。
+    if (opts?.alreadyAuthorizedAndCharged)
+        return true;
     // senderUnionId（bot-locked）让 evaluateTalk 认出跨部署团队 peer bot（teamBot 腿）；
     // memberUnionId（可为真人 union）走 teamMember 腿——否则外部闸门/群闸门放进来的
     // 团队 bot 或团队成员消息会在这里复查处被静默丢弃（#332 端到端断点，人腿同理）。
@@ -2993,6 +3131,13 @@ async function handleV3SavedWorkflowCommandIfAny(invocation) {
         await notify('❌ Saved Workflow 需要可验证的飞书用户身份。', 'authorization');
         return true;
     }
+    // Machine-wide workflow kill-switch: refuse starting/authoring a workflow when
+    // the feature is off. `cancel` (and other decrease-only management) stays
+    // available so an in-flight run started before the flip can be wound down.
+    if ((command.kind === 'save' || command.kind === 'run') && !isWorkflowFeatureEnabled()) {
+        await notify(WORKFLOW_DISABLED_MESSAGE, 'validation');
+        return true;
+    }
     if (
     // Cancellation is decrease-only and is still protected below by the
     // immutable owner/chat/app binding (or explicit canOperate). Keep it
@@ -3128,6 +3273,7 @@ function beginNewTurn(ds, title, turnId) {
             ds.parkedStreamCardNonce = ds.streamCardNonce;
             ds.frozenCards.set(ds.streamCardNonce, {
                 messageId: ds.streamCardId,
+                replyTargetKey: ds.streamCardReplyTargetKey,
                 content: ds.lastScreenContent ?? '',
                 title: prevTitle,
                 displayMode: prevMode,
@@ -3685,10 +3831,16 @@ async function adoptCodexNotifierEvent(larkAppId, event, cardMessageId, ownerOpe
         }
         // 接管原生 Codex App 线程时固定为纯 codex-app 启动，不能继承通知 Bot 的
         // wrapper/model；这些配置针对普通 CLI，会错误包装 app-server runner。
+        // model 由 resolveSessionLaunchModel 在每次 spawn 时解析：这里把 cliId 钉成
+        // codex-app 后，若通知 Bot 自己不是 codex-app，session 与 bot 的 cliId 不匹配
+        // → 不会拿 bot 那个面向别的 CLI 的 model；清掉历史记录值让兜底也为空。
+        // spawnModelOverride（trigger 的一次性 model）优先级最高且无条件，必须一并清掉，
+        // 否则它会泄漏进接管后的 codex-app 启动。
         ds.session.cliId = 'codex-app';
         ds.session.cliPathOverride = botCfg.cliPathOverride;
         delete ds.session.wrapperCli;
         delete ds.session.model;
+        ds.spawnModelOverride = undefined;
         ds.session.agentFrozen = true;
         sessionStore.updateSession(ds.session);
         // 默认 flat DM(p2pMode=chat)下这条按钮回调复用同一私聊的现有会话。若该会话
@@ -3906,6 +4058,14 @@ workflowDaemonMutationRoute('start', async (reply, params, _body, identity) => {
     const runId = params.runId;
     if (!isValidV3RunId(runId))
         return reply(400, { ok: false, error: 'bad_run_id' });
+    // Machine-wide workflow kill-switch: refuse launching a NEW daemon-driven run
+    // when the feature is off. This is the common sink for both `botmux workflow
+    // start` and the grill `approve-dag` kick, so gating here closes the edge where
+    // a run was grilled+approved before the flip. Restart recovery of an
+    // already-started run (coldAttach / reconcileV3PendingGates) is a separate path
+    // and is intentionally NOT gated, and `retry`/`grant`/`cancel` stay available.
+    if (!isWorkflowFeatureEnabled())
+        return reply(409, { ok: false, error: 'workflow_disabled' });
     const runDir = join(v3DefaultBaseDir(), runId);
     const preflight = preflightV3RunStart(runDir);
     if (!preflight.ok) {
@@ -13696,12 +13856,14 @@ export const __testOnly_onQueuedActivationSubmitted = onQueuedActivationSubmitte
  * deliberately no await between the final buffered-input snapshot, fork, and
  * release: a later handler either buffers before this block or observes the
  * live worker after it. */
-function forkReservedInitialSession(ds, availableBots) {
+function forkReservedInitialSession(ds, availableBots, trustedCaller) {
     const userPrompt = ds.pendingPrompt ?? '';
     const input = buildReservedInitialInput(ds, availableBots);
+    if (trustedCaller)
+        input.trustedCaller = trustedCaller;
     rememberLastCliInput(ds, userPrompt, input);
     const turnId = ds.pendingTurnId ?? ds.session.pendingRepoSetup?.turnId;
-    forkWorker(ds, input, turnId ? { turnId } : false);
+    forkWorker(ds, input, turnId ? { turnId, trustedCaller } : false);
     ds.pendingTurnId = undefined;
     // A no-project pendingRepo fallback enters forkWorker with `session.queued`
     // still set. forkWorker materializes the exact opening as a tokened
@@ -13804,15 +13966,15 @@ function isInitialSessionPassthrough(larkAppId, cmd) {
 /** `/fast` is a passthrough keystroke to Codex's native tier toggle — it only
  *  reaches the executor on a real paste TUI. In RPC input mode the pane is a
  *  pure viewer (turns go over JSON-RPC, keystrokes never reach the app-server),
- *  and the Riff backend turns the text+Enter into two remote task writes. On
- *  those backends the toggle is a silent no-op (or worse), so fail closed:
+ *  and a remote backend (riff / mojo) turns the text+Enter into two independent
+ *  remote turns. On those backends the toggle is a silent no-op (or worse), so fail closed:
  *  reject with a clear message instead of pretending it worked. The read-only
  *  card badge is unaffected — it reflects whatever tier Codex actually runs. */
 function fastToggleUnsupportedBackend(ds) {
     if (!ds)
         return false;
     const backendType = ds.initConfig?.backendType ?? ds.session.backendType;
-    if (backendType === 'riff')
+    if (backendType === 'riff' || backendType === 'mojo')
         return true;
     return ds.initConfig?.codexRpcInput === true;
 }
@@ -13887,6 +14049,9 @@ function deliverPassthroughToExistingSession(ds, cmd, commandContent, anchor, la
         sendWorkerSessionInput(ds, {
             type: 'raw_input',
             content: commandContent,
+            // Same reason as the worker-pool raw_input send: a passthrough is a real
+            // mojo turn, so it needs the live credential snapshot too.
+            ...(mojoLivePatchForSession(ds) ?? {}),
             turnId: turn.messageId,
         });
         turn.onDelivered?.();
@@ -14151,6 +14316,7 @@ async function handleNewTopicAdmitted(data, ctx) {
     // routing into thread-scope so the bot's first reply seeds a Lark thread.
     let scope = ctx.scope;
     let anchor = ctx.anchor;
+    let quotaConsumedBeforeSessionGroupBirth = false;
     // ─── p2pMode='group'：会话群出生 ────────────────────────────────────────
     // group 模式下，顶层 DM 消息在任何会话机制启动前先改道：建一个专属会话群
     //（bot 保留群主），把本轮 context 重写到新群（chat-scope）后递归。返回 null
@@ -14166,10 +14332,32 @@ async function handleNewTopicAdmitted(data, ctx) {
         && !substituteTrigger
         && scope === 'thread'
         && anchor === messageId
-        && !data?.message?.thread_id) {
+        // 「话题内发送 + 同时发送到会话」的消息 root_id 为空但带 thread_id——
+        // 语境属于既有话题，绝不当全新会话建群（回退 thread 旧行为）。
+        && !data?.message?.thread_id
+        // 斜杠命令判定必须**早于扣费**：/help、/login、/close 本来就不进 CLI，既不该
+        // 被预扣一次额度，也不该在额度耗尽时被这道闸静默丢掉（下面的 return 会让命令
+        // 根本执行不到）。maybeBirthSessionGroup 对同一条消息本就返回 null（命令不建
+        // 群），所以这里只是把它的结论提前一步，建群行为一字未改；命令随后照常走
+        // parseSlashCommandInvocation 分支，真正会注入 CLI 的消息（含未注册的 /foo，
+        // 它落不进命令分支）仍由下面 pre-worker 那道闸按原样扣一次费——净扣费不变。
+        // 谓词刻意复用 birth 内部的同一个：两侧同源才能保证「跳过扣费」与「不建群」
+        // 是同一个判断——窄于它会退回本 bug，宽于它则会让本该建群的消息不再建群。
+        && !declinesSessionGroupBirthAsSlashCommand(data)) {
+        // A quota denial must have zero external side effects. Charge the original
+        // DM before creating the real Feishu chat, then mark the rewritten turn so
+        // the ordinary pre-worker gate below does not charge it a second time.
+        const quotaSenderOpenId = data.sender?.sender_id?.open_id;
+        const quotaSenderUnionId = data.sender?.sender_id?.union_id;
+        const quotaTeamTrustUnionId = (data.sender?.sender_type === 'app' || data.sender?.sender_type === 'bot')
+            ? quotaSenderUnionId
+            : undefined;
+        if (!await enforceMessageQuotaForCliInput(larkAppId, chatId, quotaSenderOpenId, messageId, anchor, quotaTeamTrustUnionId, quotaSenderUnionId, chatType))
+            return;
+        quotaConsumedBeforeSessionGroupBirth = true;
         const reborn = await maybeBirthSessionGroup(data, ctx);
         if (reborn)
-            return handleNewTopic(data, reborn);
+            return handleNewTopic(data, { ...reborn, sessionGroupQuotaConsumed: true });
     }
     // ─── 会话群同群续聊 ─────────────────────────────────────────────────────
     // 会话群里的新消息发现登记的会话已关闭时，自动 resume 原会话（与话题内续聊
@@ -14251,6 +14439,7 @@ async function handleNewTopicAdmitted(data, ctx) {
     }
     // senderOpenId 已在上方（force-topic grant 限制前）声明；这里只补 master 新增的 senderUnionId。
     const senderUnionId = data.sender?.sender_id?.union_id;
+    const trustedCaller = trustedCallerForTurn(larkAppId, senderOpenId, senderUnionId);
     // union_id 信任腿（canOperate/evaluateTalk 的 teamBot）只对**飞书盖章的 bot 发送方**
     // 生效：平台 roster 是成员机器自报的，若不锁 sender_type，恶意成员把某个真人的
     // union_id 报成"自家 bot"，那个真人就会在全团队机器上被当队友 bot 放行（talk +
@@ -14327,6 +14516,10 @@ async function handleNewTopicAdmitted(data, ctx) {
     let workflowGrillPrompt;
     const newTopicGrill = parseWorkflowGrillTrigger(cmdContent);
     if (newTopicGrill) {
+        if (!isWorkflowFeatureEnabled()) {
+            await sessionReply(anchor, WORKFLOW_DISABLED_MESSAGE, 'text', larkAppId);
+            return;
+        }
         if (await replyGrantRestrictionIfNeeded(larkAppId, chatId, senderOpenId, anchor, '/workflow')) {
             return;
         }
@@ -14550,9 +14743,20 @@ async function handleNewTopicAdmitted(data, ctx) {
         && buildQuoteHint(parsed, scope, anchor, localeForBot(larkAppId)) === ''
         && !ctx.forwardSeedData
         && !messageListener;
+    // Session-group birth charges the ORIGINAL DM before creating the Feishu chat
+    // (a quota denial must have zero external side effects), so by the time the
+    // rewritten group turn gets here THIS message is already authorized AND
+    // already paid for — see `alreadyAuthorizedAndCharged` in
+    // enforceMessageQuotaForCliInput for why re-deciding it here can only lose
+    // the unit we just took. `skipCharge` stays set as well so that even if that
+    // short-circuit is ever removed, the worst case is a redundant recheck, never
+    // a double charge.
+    const sessionGroupAlreadyCharged = !!ctx.sessionGroupQuotaConsumed
+        || quotaConsumedBeforeSessionGroupBirth;
     if (!await enforceMessageQuotaForCliInput(larkAppId, chatId, senderOpenId, messageId, anchor, teamTrustUnionId, senderUnionId, chatType, isBotSenderType, {
         listenerAuthorized: !!messageListener,
-        skipCharge: isBareForceTopic,
+        skipCharge: isBareForceTopic || sessionGroupAlreadyCharged,
+        alreadyAuthorizedAndCharged: sessionGroupAlreadyCharged,
     })) {
         return;
     }
@@ -14834,7 +15038,7 @@ async function handleNewTopicAdmitted(data, ctx) {
         // Ack reaction targets the ORIGINAL inbound message (2nd arg); the turn id
         // (5th arg) is the reply anchor so provenance holds on session-group births.
         await noteTurnReceived(ds, messageId, content, newTopicSender, replyAnchorId, substituteTrigger ? SUBSTITUTE_RECEIVED_REACTION_EMOJI_TYPE : undefined);
-        forkReservedInitialSession(ds, availableBots);
+        forkReservedInitialSession(ds, availableBots, trustedCaller);
         // fork 成功即开场已交给 CLI；fork 抛错则开场只存在于内存，保持重发提示。
         markIngressAdmitted(ctx);
         const reason = oncallEntry
@@ -14886,7 +15090,7 @@ async function handleNewTopicAdmitted(data, ctx) {
         // Ack reaction targets the ORIGINAL inbound message (2nd arg); the turn id
         // (5th arg) is the reply anchor so provenance holds on session-group births.
         await noteTurnReceived(ds, messageId, content, newTopicSender, replyAnchorId, substituteTrigger ? SUBSTITUTE_RECEIVED_REACTION_EMOJI_TYPE : undefined);
-        forkReservedInitialSession(ds, availableBots);
+        forkReservedInitialSession(ds, availableBots, trustedCaller);
         logger.info(`Session ${session.sessionId} ready (no projects to select), total active: ${getActiveCount()}`);
     }
 }
@@ -15092,6 +15296,15 @@ async function handleBotAdded(chatId, operatorOpenId, larkAppId, opts) {
             anchor = chatId;
             scope = 'chat';
         }
+        // bot.added 是成员变更事件，没有用户 message_id 可作首轮 turn 身份。非 shared
+        // 路径没有 shared reply seed 兜底，若以 pendingTurnId=undefined 直接 fork，
+        // worker 发布的 managed_turn_origin 不含 turnId，CLI 首轮 `botmux send` 的
+        // managed-origin attestation 会被 daemon 以 origin_unproven 拒绝——首轮回复
+        // 发不回飞书。这里自行铸造首轮 turn 身份：
+        //   - thread scope：seed 消息本身就是可见锚点且是真实 om_ id，直接复用；
+        //   - chat scope：没有任何消息存在，铸造 daemon-owned 合成 turn id（同 trigger
+        //     会话的 trg_ 约定），仅作身份标识，不冒充用户消息 id。
+        const joinTurnId = scope === 'thread' ? anchor : `join_${randomUUID()}`;
         const dsKey = sessionKey(anchor, larkAppId);
         if (activeSessions.has(dsKey)) {
             logger.info(`[auto-start:入群] ${chatId.substring(0, 12)} 锚点已有会话，跳过`);
@@ -15134,7 +15347,9 @@ async function handleBotAdded(chatId, operatorOpenId, larkAppId, opts) {
             ownerOpenId: operatorOpenId,
             currentTurnTitle: title,
             workingDir: pinnedWorkingDir,
-            pendingTurnId: undefined,
+            // 非 shared 路径的首轮 turn 身份（joinTurnId）；shared 路径由
+            // armSharedReplyTarget 用 shared seed id 覆盖。
+            pendingTurnId: needsSharedReply ? undefined : joinTurnId,
         };
         const registration = await claimNewDaemonSession(activeSessions, ds);
         if (!registration.accepted) {
@@ -15147,7 +15362,9 @@ async function handleBotAdded(chatId, operatorOpenId, larkAppId, opts) {
             stageClaimedPendingRepoSetup(activeSessions, ds, {
                 mode: autoWt ? 'auto_worktree' : 'picker',
                 ...(autoWt && pinnedWorkingDir ? { baseDir: pinnedWorkingDir } : {}),
-                turnId: anchor,
+                // 非 shared 路径复用首轮 turn 身份；shared 路径保留 anchor（随后被
+                // armSharedReplyTarget 的 shared seed id 覆盖，此处仅作未 arm 时的兜底）。
+                turnId: needsSharedReply ? anchor : joinTurnId,
             });
         }
         const joinBootstrapExternallyTakenOver = () => (activeSessions.get(dsKey) !== ds
@@ -15194,6 +15411,11 @@ async function handleBotAdded(chatId, operatorOpenId, larkAppId, opts) {
             const closing = closeSessionHelper(session.sessionId);
             if (activeSessions.get(dsKey) === ds)
                 activeSessions.delete(dsKey);
+            // 入群去重锚点同样只清自己登记的那条：shared 路径在登记锚点之前就可能
+            // 回滚（此时 get 为 undefined，no-op）；非 shared 路径在锚点登记之后
+            // 回滚，不清掉会让后续 bot.added 带着 stale 锚点走进来。
+            if (groupJoinAnchorByChat.get(chatLiveKey) === dsKey)
+                groupJoinAnchorByChat.delete(chatLiveKey);
             await closing;
         };
         // Shared-mode seed/reply authority is externally visible. Publish it only
@@ -15244,6 +15466,28 @@ async function handleBotAdded(chatId, operatorOpenId, larkAppId, opts) {
         // Register the anchor so a later duplicate bot.added for this chat is deduped
         // even in 话题群 (where dsKey is the seed id, not chatId).
         groupJoinAnchorByChat.set(chatLiveKey, dsKey);
+        // 持久化非 shared 首轮的 turn provenance（shared 路径已由 armSharedReplyTarget
+        // 写入）。thread scope 以 seed 为 reply root；chat scope 无根，落 plain chat
+        // 目标且不写 sender——首轮无真人发送者，--mention 回指天然走 incomplete →
+        // 显式指定的安全方向。没有这条记录，worker 虽带 turnId fork，daemon 侧的
+        // 首轮回复目标/参与者窗口仍无据可查。
+        if (!needsSharedReply) {
+            try {
+                beginReplyTargetTurn(ds, scope === 'thread' ? anchor : undefined, joinTurnId, new Date(now).toISOString());
+                sessionStore.updateSession(ds.session);
+            }
+            catch (err) {
+                // 持久化失败（文件系统/数据库瞬态错误）时必须回滚已发布的会话：此时
+                // 会话已进 activeSessions 且 groupJoinAnchorByChat 已登记，finally 只
+                // settle barrier 和释放 in-flight 锁——留下 active 但 worker-null 的会话
+                // 会让后续 bot.added 被无限去重，自动开工无法重试。同
+                // stageClaimedPendingRepoSetup 的 unpublish/close 回滚。
+                logger.warn(`[auto-start:入群] ${chatId.substring(0, 12)} 首轮 turn provenance 持久化失败，回滚会话注册：`
+                    + `${err instanceof Error ? err.message : String(err)}`);
+                await rollbackRegisteredJoinSession();
+                return;
+            }
+        }
         // Auto-worktree: register PENDING, build worktree off-path, commit+fork later.
         if (pinnedWorkingDir && autoWt) {
             if (await replyInvalidWorkingDirs(anchor, larkAppId, ds) || joinBootstrapWasTakenOver()) {
@@ -15347,17 +15591,10 @@ export const __testOnly_handleBotAdded = handleBotAdded;
  *  than blocking the message.
  */
 function lookupForeignBotName(senderOpenId, larkAppId) {
-    try {
-        const fp = join(config.session.dataDir, `bot-openids-${larkAppId}.json`);
-        if (existsSync(fp)) {
-            const data = JSON.parse(readFileSync(fp, 'utf-8'));
-            for (const [name, openId] of Object.entries(data)) {
-                if (openId === senderOpenId)
-                    return name;
-            }
-        }
+    for (const [name, openId] of Object.entries(readPeerCrossRef(config.session.dataDir, larkAppId))) {
+        if (openId === senderOpenId)
+            return name;
     }
-    catch { /* fall through */ }
     try {
         const infoPath = join(config.session.dataDir, 'bots-info.json');
         if (existsSync(infoPath)) {
@@ -15488,6 +15725,7 @@ async function handleThreadReplyAdmitted(data, ctx, prepared) {
     // 类型的话，把真人 union_id 报成 bot 就能让真人在全团队被当队友 bot 放行
     //（talk + operate）。与旧联邦 team-bots「学习入口限 bot sender」同一不变量。
     const threadTeamTrustUnionId = (isBotSenderType || isForeignBot) ? threadSenderUnionId : undefined;
+    const threadTrustedCaller = trustedCallerForTurn(larkAppId, threadSenderOpenId, threadSenderUnionId);
     const threadChatId = ctxChatId ?? data?.message?.chat_id;
     const clearAgentAttentionForHumanInbound = () => {
         if (isForeignBot || isBotSenderType)
@@ -15546,6 +15784,10 @@ async function handleThreadReplyAdmitted(data, ctx, prepared) {
     // `/template` 只保留退役提示。
     const threadGrill = parseWorkflowGrillTrigger(cmdContent);
     if (threadGrill) {
+        if (!isWorkflowFeatureEnabled()) {
+            await sessionReply(anchor, WORKFLOW_DISABLED_MESSAGE, 'text', larkAppId);
+            return;
+        }
         if (await replyGrantRestrictionIfNeeded(larkAppId, threadChatId, threadSenderOpenId, anchor, '/workflow')) {
             return;
         }
@@ -15785,35 +16027,38 @@ async function handleThreadReplyAdmitted(data, ctx, prepared) {
     // 回调 URL 已在上方 return，可用来中止）。答复权限 = canTalk，由
     // broker 在 submitCustomReply 内按注入的 canTalkChecker 判定：非授权人返回
     // 'unauthorized'，这里 fall through 到正常路由。卡片由 broker.onSettle 自动 PATCH。
-    // `!threadGrill`：grill goal 分支只改写 promptContent 后 fall-through（不 return），
-    // cmdContent 仍是字面量 `/workflow new <目标>`；若不排除，待回答 ask 会把它当答案吞掉，
-    // grill 永远不启动。grill 必须穿过拦截器走正常转发。
-    if (threadSenderOpenId && threadChatId && !threadGrill) {
-        const askReplyText = cmdContent.trim();
-        if (askReplyText) {
-            const pendingAsk = findPendingAskByAnchor({ larkAppId, chatId: threadChatId, anchor });
-            if (pendingAsk) {
-                const outcome = submitCustomReply({
-                    askId: pendingAsk.askId,
-                    by: threadSenderOpenId,
-                    text: askReplyText,
-                    // Actor context so the broker's talk check uses the same predicate as
-                    // the dispatcher gate / quota recheck: a bot text-reply → evaluateBotTalk
-                    // (covers team-拉群 with no union_id), a platform teamMember human →
-                    // evaluateTalk's teamMember union leg. Omitting it (card clicks) degrades
-                    // to the plain evaluateTalk(openId, chatType).
-                    actor: {
-                        botSender: isBotSenderType || isForeignBot,
-                        senderUnionId: threadTeamTrustUnionId,
-                        memberUnionId: threadSenderUnionId,
-                    },
-                });
-                if (outcome === 'accepted') {
-                    logger.info(`[${anchor.substring(0, 12)}] ask custom reply accepted from ${threadSenderOpenId.substring(0, 12)}`);
-                    return;
-                }
-                logger.info(`[${anchor.substring(0, 12)}] ask custom reply not accepted (${outcome}); falling through to normal routing`);
+    // 「哪些消息算纯文字答复」收口在 askCustomReplyCandidate（含带资源消息与 grill
+    // 触发的排除理由），拦截器这里只负责拿着结果去 settle。
+    const askCandidate = askCustomReplyCandidate({
+        senderOpenId: threadSenderOpenId,
+        chatId: threadChatId,
+        cmdContent,
+        resourceCount: resources.length,
+        isWorkflowGrillTrigger: !!threadGrill,
+    });
+    if (askCandidate) {
+        const pendingAsk = findPendingAskByAnchor({ larkAppId, chatId: askCandidate.chatId, anchor });
+        if (pendingAsk) {
+            const outcome = submitCustomReply({
+                askId: pendingAsk.askId,
+                by: askCandidate.senderOpenId,
+                text: askCandidate.text,
+                // Actor context so the broker's talk check uses the same predicate as
+                // the dispatcher gate / quota recheck: a bot text-reply → evaluateBotTalk
+                // (covers team-拉群 with no union_id), a platform teamMember human →
+                // evaluateTalk's teamMember union leg. Omitting it (card clicks) degrades
+                // to the plain evaluateTalk(openId, chatType).
+                actor: {
+                    botSender: isBotSenderType || isForeignBot,
+                    senderUnionId: threadTeamTrustUnionId,
+                    memberUnionId: threadSenderUnionId,
+                },
+            });
+            if (outcome === 'accepted') {
+                logger.info(`[${anchor.substring(0, 12)}] ask custom reply accepted from ${askCandidate.senderOpenId.substring(0, 12)}`);
+                return;
             }
+            logger.info(`[${anchor.substring(0, 12)}] ask custom reply not accepted (${outcome}); falling through to normal routing`);
         }
     }
     logger.info(`Reply in ${scope}-scope session ${anchor.substring(0, 12)}: ${content.substring(0, 100)} (resources: ${resources.length})`);
@@ -16402,7 +16647,7 @@ async function handleThreadReplyAdmitted(data, ctx, prepared) {
                 ensureSessionWhiteboard(newDs);
                 const availableBots = await getAvailableBots(larkAppId, autoCreateChatId);
                 await noteTurnReceived(newDs, parsed.messageId, parsed.content, autoCreateSender, parsed.messageId, substituteTrigger ? SUBSTITUTE_RECEIVED_REACTION_EMOJI_TYPE : undefined);
-                forkReservedInitialSession(newDs, availableBots);
+                forkReservedInitialSession(newDs, availableBots, threadTrustedCaller);
                 // fork 成功即开场已交给 CLI；fork 抛错则开场只存在于内存，保持重发提示。
                 markIngressAdmitted(ctx);
                 const reason = oncallEntry
@@ -16442,7 +16687,7 @@ async function handleThreadReplyAdmitted(data, ctx, prepared) {
                 ensureSessionWhiteboard(newDs);
                 const availableBots = await getAvailableBots(larkAppId, autoCreateChatId);
                 await noteTurnReceived(newDs, parsed.messageId, parsed.content, autoCreateSender, parsed.messageId, substituteTrigger ? SUBSTITUTE_RECEIVED_REACTION_EMOJI_TYPE : undefined);
-                forkReservedInitialSession(newDs, availableBots);
+                forkReservedInitialSession(newDs, availableBots, threadTrustedCaller);
             }
             return;
         }
@@ -16520,7 +16765,10 @@ async function handleThreadReplyAdmitted(data, ctx, prepared) {
             // above (R4-B1); reuse the same frozen value here for the live-worker path.
             let accepted = false;
             try {
-                accepted = sendWorkerInput(ds, cliInput, parsed.messageId, codexAppSteerable ? { codexAppSteerable: true } : {});
+                accepted = sendWorkerInput(ds, cliInput, parsed.messageId, {
+                    ...(codexAppSteerable ? { codexAppSteerable: true } : {}),
+                    ...(threadTrustedCaller ? { trustedCaller: threadTrustedCaller } : {}),
+                });
                 // Record the input as the session's last real CLI turn ONLY after the
                 // worker accepted it. Recording before delivery (the old order) persisted
                 // lastCliInput / lastUserPrompt / Codex-App sidecar for a turn that never
@@ -16616,6 +16864,8 @@ async function handleThreadReplyAdmitted(data, ctx, prepared) {
                     // here, never re-inferred). System/recovery openings keep it absent.
                     if (codexAppSteerable)
                         currentFollowUp.codexAppSteerable = true;
+                    if (threadTrustedCaller)
+                        currentFollowUp.trustedCaller = threadTrustedCaller;
                     admitQueuedActivationTail(ds, {
                         userPrompt: promptContent,
                         cliInput: currentFollowUp,
@@ -16642,6 +16892,9 @@ async function handleThreadReplyAdmitted(data, ctx, prepared) {
                         resume: ds.session.queuedActivationResume ?? ds.hasHistory,
                         turnId: ds.session.queuedActivationTurnId,
                         dispatchAttempt: ds.session.queuedActivationDispatchAttempt,
+                        ...(ds.session.queuedActivationInput?.trustedCaller
+                            ? { trustedCaller: ds.session.queuedActivationInput.trustedCaller }
+                            : {}),
                     });
                     if (ownsInitialStartClaim())
                         retainInitialStartClaim = true;
@@ -16667,6 +16920,7 @@ async function handleThreadReplyAdmitted(data, ctx, prepared) {
                         resume: ds.hasHistory,
                         turnId: ds.session.queuedActivationTurnId,
                         dispatchAttempt: ds.session.queuedActivationDispatchAttempt,
+                        ...(retainedQueuedActivation.trustedCaller ? { trustedCaller: retainedQueuedActivation.trustedCaller } : {}),
                     });
                     if (ownsInitialStartClaim())
                         retainInitialStartClaim = true;
@@ -16789,6 +17043,9 @@ async function handleThreadReplyAdmitted(data, ctx, prepared) {
                     if (codexAppSteerable && !queuedDashboardTurn && !queuedHasDurableTail) {
                         wrappedInput.codexAppSteerable = true;
                     }
+                    if (threadTrustedCaller && !queuedHasDurableTail) {
+                        wrappedInput.trustedCaller = threadTrustedCaller;
+                    }
                     reforkAccepted = forkWorker(ds, wrappedInput, {
                         // See `hadPriorCliInput` above — an opening on a CLI that never took any
                         // input cold-spawns rather than `--resume`-ing an empty session.
@@ -16796,6 +17053,7 @@ async function handleThreadReplyAdmitted(data, ctx, prepared) {
                         turnId: queuedHasDurableTail
                             ? (ds.session.queuedActivationTurnId ?? `queued-opening:${ds.session.sessionId}`)
                             : parsed.messageId,
+                        ...(wrappedInput.trustedCaller ? { trustedCaller: wrappedInput.trustedCaller } : {}),
                     });
                 }
             }
@@ -17476,6 +17734,18 @@ async function waitForManagedActivationCommit(index, appId) {
     }
 }
 export async function startDaemon(botIndex) {
+    // Survive a fire-and-forget rejection instead of dying from it. Installed here
+    // rather than in index-daemon.ts on purpose: startDaemon has TWO entry points
+    // (index-daemon.ts and index-core-only.ts), so guarding the entry file would
+    // leave the other one unprotected. Idempotent, so an entry point may also call
+    // it earlier without harm.
+    //
+    // Node's default is to terminate the process, which is right for a worker (it
+    // owns one session) and wrong for the daemon (it owns every session): one
+    // missed `.catch` on one session's teardown would otherwise end every other
+    // live Lark session too. The rejection is logged loudly at error level — this
+    // is a backstop for the next missed `.catch`, not permission to omit them.
+    installDaemonRejectionGuard(logger);
     // Repair a shared tmux server polluted by an older botmux immediately on
     // daemon startup. This must not depend on restoring/spawning a bmx-* session:
     // a user-held tmux server can outlive every botmux pane and still leak stale
@@ -17892,8 +18162,7 @@ export async function startDaemon(botIndex) {
             // status becomes `closed` → trigger-result resolves `failed` (soft terminal),
             // and resolveIdempotencyHit sees a not-live session on retry. This is the
             // observable fail-closed path the round-8 finding requires.
-            void closeSessionHelper(ds.session.sessionId).catch(() => { });
-            logger.error(`[idempotency] fail-closed session ${ds.session.sessionId.slice(0, 8)} after exit-convergence write failure`);
+            void runIdempotencyFailClose(ds.session.sessionId, closeSessionForBackgroundCleanup, logger);
         }
     };
     // Initialise worker pool with daemon callbacks
@@ -17914,9 +18183,7 @@ export async function startDaemon(botIndex) {
                     logger.info(`[${sessionId.substring(0, 8)}] Withdraw auto-close deferred: Codex App FIFO became unsettled`);
                     return false;
                 }
-                await closeSessionHelper(sessionId);
-                logger.info(`[${sessionId.substring(0, 8)}] Session auto-closed (message withdrawn)`);
-                return true;
+                return runWithdrawAutoClose(sessionId, closeSessionForBackgroundCleanup, logger);
             }).catch((err) => {
                 logger.warn(`[${sessionId.substring(0, 8)}] Withdraw auto-close mutation failed; session retained: `
                     + `${err instanceof Error ? err.message : String(err)}`);
@@ -18039,6 +18306,20 @@ export async function startDaemon(botIndex) {
         logger.error(`[idempotency] boot reconcile failed to converge — aborting bot startup (fail-closed): ${err instanceof Error ? err.message : err}`);
         throw err instanceof Error ? err : new Error(String(err));
     }
+    // Release durable mojo containment handles a REBOOT provably killed, BEFORE the
+    // device-isolation activation inventory ever synthesises a blocker from them —
+    // otherwise a post-reboot handle keeps blocking activation forever (round-11
+    // P1-1). Daemon-global and idempotent: guarded so it runs once no matter how
+    // many bots start; any store/proc read failure fails closed inside the helper.
+    if (!mojoContainmentReconciledThisBoot) {
+        mojoContainmentReconciledThisBoot = true;
+        try {
+            reconcileContainmentHandlesOnBoot();
+        }
+        catch (err) {
+            logger.warn(`[mojo] containment boot reconciliation threw (blockers retained): ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
     // Seed dashboard IPC botName with the custom displayName (falling back to the
     // bot's config id); the friendly name from /bot/v3/info is wired into the
     // registry descriptor (below) but the IPC server also needs its own copy for
@@ -18401,6 +18682,12 @@ export async function startDaemon(botIndex) {
     // Restore complete → /api/asks may now safely 403 unknown sessions again; a
     // reconnecting ask hook that raced the restore got retryable 503s until here.
     sessionsRestored = true;
+    // Freeze the control plane of restored mojo sessions NOW, not at their next
+    // worker fork. Restore completes before the dispatcher can deliver a message,
+    // so this closes the window where an operator edits the bot's endpoint/workspace
+    // between the restart and a session's next wake — which would otherwise let that
+    // session adopt the NEW control plane as its original identity.
+    migrateMojoSessionIdentities(activeSessions);
     // Now that activeSessions is populated, release the forward-followup flush
     // barrier. Persisted seeds were loaded into the buffer at dispatcher startup
     // (so root-linked clarifications can pair with them), but their flushes wait
@@ -18529,6 +18816,45 @@ export async function startDaemon(botIndex) {
         enforceLiveSessionCap('periodic');
     }, 60_000);
     idleWorkerSweepTimer.unref?.();
+    const sessionOwnerReminder = new SessionOwnerReminderController({
+        load: () => loadSessionOwnerReminderRecords(config.session.dataDir, cfg.larkAppId),
+        save: records => saveSessionOwnerReminderRecords(config.session.dataDir, cfg.larkAppId, records),
+        canSend: ds => larkTransportEnabled({
+            chatId: ds.chatId,
+            apiOnly: getBot(ds.larkAppId).config.apiOnly,
+        }),
+        send: async (ds, text, uuid) => {
+            await sendSessionOwnerThreadNotification({
+                larkAppId: ds.larkAppId,
+                rootMessageId: ds.session.rootMessageId,
+                ownerOpenId: ds.session.ownerOpenId,
+            }, text, uuid);
+        },
+        onError: (ds, error) => logger.warn(`[session-owner-reminder] send failed session=${ds.session.sessionId}: `
+            + `${error instanceof Error ? error.message : String(error)}`),
+    });
+    let sessionOwnerReminderScanInFlight = false;
+    const scanSessionOwnerReminders = async () => {
+        if (sessionOwnerReminderScanInFlight)
+            return;
+        sessionOwnerReminderScanInFlight = true;
+        try {
+            const currentConfig = getBot(cfg.larkAppId).config.sessionOwnerReminder
+                ?? DEFAULT_SESSION_OWNER_REMINDER;
+            await sessionOwnerReminder.scan(activeSessions.values(), currentConfig);
+        }
+        catch (error) {
+            logger.warn(`[session-owner-reminder] scan failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        finally {
+            sessionOwnerReminderScanInFlight = false;
+        }
+    };
+    const sessionOwnerReminderTimer = setInterval(() => {
+        void scanSessionOwnerReminders();
+    }, 60_000);
+    sessionOwnerReminderTimer.unref?.();
+    void scanSessionOwnerReminders();
     // Periodic sandbox reconciler: the daemon's SIGKILL straggler-reaper (and any
     // worker SIGKILL) bypasses worker-side killCli(), so the pre-created deny-mask
     // mountpoints + per-session tree of a killed-but-still-active sandboxed session
@@ -18707,8 +19033,8 @@ export async function startDaemon(botIndex) {
         }, 30_000);
         overloadTimer.unref?.();
     }
-    // Graceful shutdown. Riff owners first run a three-phase non-cancelling drain
-    // that durably ACKs every exact final task lineage as one fleet transaction.
+    // Graceful shutdown. Remote owners first run a three-phase non-cancelling
+    // drain that durably ACKs every exact final lineage as one fleet transaction.
     // No worker exits until every participant is prepared and fresh-verified.
     // Ordinary workers then receive SIGTERM / close IPC and the daemon waits up
     // to DAEMON_WORKER_EXIT_GRACE_MS for them to exit
@@ -18735,23 +19061,23 @@ export async function startDaemon(botIndex) {
                 logger.error(`Daemon remains online: ${initialShutdownFleet.error}`);
                 return;
             }
-            // Preflight Riff before stopping services/removing descriptors. A failed
+            // Preflight all remote backends before stopping services/removing descriptors. A failed
             // drain or persistence write aborts every successfully prepared peer, so a
             // refused shutdown returns to a live fleet instead of leaving an early
             // participant workerless.
-            const riffCandidates = initialShutdownFleet.sessions
-                .filter(ds => shutdownBackendDisposition(ds) === 'riff-drain-detach');
-            const riffPrepareResults = await prepareRiffFleetForShutdown(riffCandidates, {
+            const remoteCandidates = initialShutdownFleet.sessions
+                .filter(ds => shutdownBackendDisposition(ds) === 'remote-drain-detach');
+            const remotePrepareResults = await prepareRemoteFleetForShutdown(remoteCandidates, {
                 deadlineMs: shutdownDeadlineMs,
             });
-            const riffPrepared = riffPrepareResults.filter((entry) => entry.result.ok);
-            const riffFenced = riffPrepareResults.filter((entry) => entry.result.fence !== 'none');
-            const abortRiffFleet = async (reason, retainFenced = new Set()) => {
+            const remotePrepared = remotePrepareResults.filter((entry) => entry.result.ok);
+            const remoteFenced = remotePrepareResults.filter((entry) => entry.result.fence !== 'none');
+            const abortRemoteFleet = async (reason, retainFenced = new Set()) => {
                 for (const ds of retainFenced) {
-                    logger.error(`[${ds.session.sessionId.slice(0, 8)}] Riff shutdown participant remains fenced: `
+                    logger.error(`[${ds.session.sessionId.slice(0, 8)}] Remote shutdown participant remains fenced: `
                         + 'durable/runtime ownership could not be reconciled safely');
                 }
-                const aborts = await abortRiffShutdownFleet(riffFenced
+                const aborts = await abortRemoteShutdownFleet(remoteFenced
                     .filter(({ ds }) => !retainFenced.has(ds))
                     .map(({ ds, result }) => ({ ds, result })), {
                     deadlineMs: shutdownDeadlineMs,
@@ -18759,34 +19085,34 @@ export async function startDaemon(botIndex) {
                 for (const { ds, result } of aborts) {
                     if (result.ok)
                         continue;
-                    logger.error(`[${ds.session.sessionId.slice(0, 8)}] Riff shutdown rollback was not ACKed: `
+                    logger.error(`[${ds.session.sessionId.slice(0, 8)}] Remote shutdown rollback was not ACKed: `
                         + `${result.error ?? 'unknown'}; admission remains fail-closed`);
                 }
                 setSessionLifecycleShutdown(false);
                 shuttingDown = false;
                 logger.error(`Daemon remains online: ${reason}`);
             };
-            const riffPrepareFailures = riffPrepareResults.filter(entry => !entry.result.ok);
-            if (riffPrepareFailures.length > 0) {
-                for (const { ds, result } of riffPrepareFailures) {
+            const remotePrepareFailures = remotePrepareResults.filter(entry => !entry.result.ok);
+            if (remotePrepareFailures.length > 0) {
+                for (const { ds, result } of remotePrepareFailures) {
                     if (result.ok)
                         continue;
                     logger.error(`[${ds.session.sessionId.slice(0, 8)}] Daemon shutdown prepare refused: `
                         + `${result.error}${result.taskId ? ` (task ${result.taskId})` : ''}`);
                 }
-                await abortRiffFleet(`${riffPrepareFailures.length} Riff owner(s) could not be safely drained`);
+                await abortRemoteFleet(`${remotePrepareFailures.length} remote owner(s) could not be safely drained`);
                 return;
             }
-            const riffPersistence = persistPreparedRiffShutdownFleet(riffPrepared, {
+            const remotePersistence = persistPreparedRemoteShutdownFleet(remotePrepared, {
                 deadlineMs: shutdownDeadlineMs,
             });
-            if (!riffPersistence.ok) {
-                const retainIds = new Set(riffPersistence.retainFencedSessionIds);
-                const retainFenced = new Set(riffPrepared
+            if (!remotePersistence.ok) {
+                const retainIds = new Set(remotePersistence.retainFencedSessionIds);
+                const retainFenced = new Set(remotePrepared
                     .filter(({ ds }) => retainIds.has(ds.session.sessionId))
                     .map(({ ds }) => ds));
-                logger.error(`Daemon shutdown lineage verification refused: ${riffPersistence.error}`);
-                await abortRiffFleet(`${riffPersistence.sessionIds.length} Riff lineage row(s) could not be fresh-verified`, retainFenced);
+                logger.error(`Daemon shutdown lineage verification refused: ${remotePersistence.error}`);
+                await abortRemoteFleet(`${remotePersistence.sessionIds.length} remote lineage row(s) could not be fresh-verified`, retainFenced);
                 return;
             }
             // Recheck generation ownership while every participant is still fenced and
@@ -18794,33 +19120,33 @@ export async function startDaemon(botIndex) {
             const currentShutdownFleet = collectUniqueDaemonShutdownSessions(activeSessions.values());
             if (!currentShutdownFleet.ok) {
                 const ambiguousSessionId = currentShutdownFleet.sessionId;
-                await abortRiffFleet(`Riff ownership became ambiguous after shutdown preflight: ${currentShutdownFleet.error}`, new Set(riffPrepared
+                await abortRemoteFleet(`Remote ownership became ambiguous after shutdown preflight: ${currentShutdownFleet.error}`, new Set(remotePrepared
                     .filter(({ ds }) => ds.session.sessionId === ambiguousSessionId)
                     .map(({ ds }) => ds)));
                 return;
             }
-            const currentRiffOwners = currentShutdownFleet.sessions
-                .filter(ds => shutdownBackendDisposition(ds) === 'riff-drain-detach');
-            const riffPreparedOwners = new Set(riffPrepared.map(entry => entry.ds));
-            const riffGenerationMismatch = currentRiffOwners.some(ds => !riffPreparedOwners.has(ds))
-                || riffPrepared.some(({ ds, result }) => !currentRiffOwners.includes(ds) || !isPreparedRiffSessionCurrent(ds, result));
-            if (riffGenerationMismatch) {
-                const retainFenced = new Set(riffPrepared
-                    .filter(({ ds, result }) => (!currentRiffOwners.includes(ds) || !isPreparedRiffSessionCurrent(ds, result))
-                    && !canAbortVerifiedExitedRiffPreparation(ds, result))
+            const currentRemoteOwners = currentShutdownFleet.sessions
+                .filter(ds => shutdownBackendDisposition(ds) === 'remote-drain-detach');
+            const remotePreparedOwners = new Set(remotePrepared.map(entry => entry.ds));
+            const remoteGenerationMismatch = currentRemoteOwners.some(ds => !remotePreparedOwners.has(ds))
+                || remotePrepared.some(({ ds, result }) => !currentRemoteOwners.includes(ds) || !isPreparedRemoteSessionCurrent(ds, result));
+            if (remoteGenerationMismatch) {
+                const retainFenced = new Set(remotePrepared
+                    .filter(({ ds, result }) => (!currentRemoteOwners.includes(ds) || !isPreparedRemoteSessionCurrent(ds, result))
+                    && !canAbortVerifiedExitedRemotePreparation(ds, result))
                     .map(({ ds }) => ds));
-                await abortRiffFleet('Riff ownership changed after shutdown preflight', retainFenced);
+                await abortRemoteFleet('Remote ownership changed after shutdown preflight', retainFenced);
                 return;
             }
             // Validate-all above, then commit-all synchronously with no await or
             // callback boundary between peers.
-            const riffRetiredWorkers = [];
-            for (const { ds, result } of riffPrepared) {
-                if (!commitPreparedRiffShutdown(ds, result)) {
-                    throw new Error(`Riff shutdown commit invariant lost for ${ds.session.sessionId}`);
+            const remoteRetiredWorkers = [];
+            for (const { ds, result } of remotePrepared) {
+                if (!commitPreparedRemoteShutdown(ds, result)) {
+                    throw new Error(`Remote shutdown commit invariant lost for ${ds.session.sessionId}`);
                 }
                 if (result.worker)
-                    riffRetiredWorkers.push(result.worker);
+                    remoteRetiredWorkers.push(result.worker);
             }
             scheduler.stopScheduler();
             // NOTE: turn-terminal queue drain + webhook dispatcher stop are deliberately
@@ -18860,6 +19186,7 @@ export async function startDaemon(botIndex) {
                 deleteVcMeetingPendingInvite(key);
             clearInterval(descriptorHeartbeat);
             clearInterval(idleWorkerSweepTimer);
+            clearInterval(sessionOwnerReminderTimer);
             if (memoryDiagnostics)
                 clearInterval(memoryDiagnostics);
             removeDaemonDescriptor(cfg.larkAppId);
@@ -18905,7 +19232,10 @@ export async function startDaemon(botIndex) {
                     }
                 }
             };
-            for (const worker of riffRetiredWorkers)
+            // Union of two renames: this branch generalised the collection
+            // riffRetiredWorkers -> remoteRetiredWorkers (it now carries mojo too), while
+            // master renamed the local helper trackWorkerExit -> trackWorker.
+            for (const worker of remoteRetiredWorkers)
                 trackWorker(worker);
             for (const ds of currentShutdownFleet.sessions) {
                 const w = ds.worker;
@@ -18922,8 +19252,8 @@ export async function startDaemon(botIndex) {
                 if (!w.killed) {
                     logger.info(`Shutting down worker for session ${ds.session.sessionId}`);
                     const disposition = shutdownBackendDisposition(ds);
-                    if (disposition === 'riff-drain-detach') {
-                        throw new Error(`undrained Riff generation after atomic commit: ${ds.session.sessionId}`);
+                    if (disposition === 'remote-drain-detach') {
+                        throw new Error(`undrained remote generation after atomic commit: ${ds.session.sessionId}`);
                     }
                     // Branch by the session's FROZEN backend (stamped on Session.backendType
                     // at spawn), NOT the bot's live config — a dashboard backendType edit must
@@ -19072,6 +19402,7 @@ export async function startDaemon(botIndex) {
         setSupervisorShutdownHandler(null);
         clearInterval(descriptorHeartbeat);
         clearInterval(idleWorkerSweepTimer);
+        clearInterval(sessionOwnerReminderTimer);
         clearInterval(docCommentPollTimer);
         if (memoryDiagnostics)
             clearInterval(memoryDiagnostics);