botmux 3.16.0 → 3.17.0

package/dist/daemon.js

@@ -4,6 +4,7 @@ import { readFileSync, existsSync, mkdirSync, unlinkSync } from 'node:fs';
 import { installDaemonRejectionGuard } from './utils/daemon-rejection-guard.js';
 import { atomicWriteFileSync } from './utils/atomic-write.js';
 import { readPeerCrossRef } from './services/peer-cross-ref-store.js';
+import { parseBotSteerDirective } from './core/bot-steer-directive.js';
 import { readAllowedUsersResolveCache, writeAllowedUsersResolveCache } from './utils/allowed-users-cache.js';
 import { join, dirname } from 'node:path';
 import { homedir, loadavg, cpus, totalmem, freemem } from 'node:os';
@@ -114,6 +115,7 @@ import { runIdempotencyFailClose, runWithdrawAutoClose, } from './core/daemon-ba
 import { runDetachedBotTurnMutation, tryWithBotTurnMutation, withBotTurnAdmission, withBotTurnMutation, } from './core/bot-turn-mutation-gate.js';
 import { claimInitialUserTurn, isInitialUserTurnPending, releaseInitialUserTurn } from './core/initial-user-turn.js';
 import { applyQueuedCodexAppLegacyFallback, mergeQueuedCodexAppTurn } from './core/session-create.js';
+import { fillNativeTopicId } from './core/native-topic-id.js';
 import { findOnlineDaemon, listOnlineDaemons } from './utils/daemon-discovery.js';
 import { beginReplyTargetTurn, buildTurnParticipantsFrom, fallbackTurnId, isSubstituteTurn, resolveInboundReplyTarget, resolveSessionReplyTarget, syncReplyTargetState } from './core/reply-target.js';
 import { readDeferredTopicBinding } from './core/deferred-topic-binding.js';
@@ -188,7 +190,7 @@ function republishResolvedAllowedUsers(larkAppId, resolved) {
     catch { /* best effort */ }
 }
 let vcMeetingTerminalReconciler;
-import { isBotMentioned, probeBotOpenId, startLarkEventDispatcher, markForwardFollowupsSessionsReady, writeBotInfoFile, canOperate, canRunDaemonCommand, evaluateTalk, evaluateBotTalk, evaluateAskAnswerTalk, askCustomReplyCandidate, grantCommandRestriction, isKnownPeerBot, checkRequiredScopes } from './im/lark/event-dispatcher.js';
+import { isBotMentioned, probeBotOpenId, startLarkEventDispatcher, markForwardFollowupsSessionsReady, writeBotInfoFile, canOperate, canRunDaemonCommand, evaluateTalk, evaluateBotTalk, evaluateAskAnswerTalk, askCustomReplyCandidate, grantCommandRestriction, isKnownPeerBot, resolveSiblingBotNameByUnionId, checkRequiredScopes, ensureVcMeetingEventsSubscribed } from './im/lark/event-dispatcher.js';
 import { getDocSubscription, listAllDocSubscriptions, putDocSubscription, removeDocSubscription, setDocCommentPollCursor } from './services/doc-subs-store.js';
 import { BOT_REPLY_SENTINEL, subscribeDocFile, unsubscribeDocFile, addCommentReaction, removeCommentReaction, hasBotSentinel, isBotAuthoredReply, listDocComments } from './im/lark/doc-comment.js';
 import { learnFromMentions, resolveSender, flushIdentityCacheSync } from './im/lark/identity-cache.js';
@@ -200,7 +202,7 @@ import { shutdownBackendDisposition } from './core/persistent-backend.js';
 import { abortRemoteShutdownFleet, canAbortVerifiedExitedRemotePreparation, collectUniqueDaemonShutdownSessions, commitPreparedRemoteShutdown, isPreparedRemoteSessionCurrent, persistPreparedRemoteShutdownFleet, prepareRemoteFleetForShutdown, } from './core/remote-shutdown-detach.js';
 import { BOT_TURN_MUTATION_SHUTDOWN_ACQUIRE_TIMEOUT_MS, DAEMON_SHUTDOWN_MAX_MS, DAEMON_WORKER_EXIT_GRACE_MS, } from './core/shutdown-budgets.js';
 import { evaluateVcMeetingConsumerIsolation } from './services/vc-meeting-consumer-isolation.js';
-import { markSessionActivity, announcePendingRepoSession, publishAttentionPatch, publishLastInputFromBotPatch, publishSessionMessagePreviewPatch, publishClosedSessionPatch, clearAgentAttention, } from './core/session-activity.js';
+import { markSessionActivity, announcePendingRepoSession, publishAttentionPatch, publishLastInputFromBotPatch, publishNativeTopicLinkPatch, publishSessionMessagePreviewPatch, publishClosedSessionPatch, clearAgentAttention, } from './core/session-activity.js';
 import { emitSessionLifecycleHook } from './services/session-lifecycle-hooks.js';
 import { botAutoWorktreeEnabled } from './services/default-worktree.js';
 import { setCardDispatcher as setAskCardDispatcher, setCanTalkChecker as setAskCanTalkChecker, setAskPersistStore as setAskPersistStoreBroker, registerAsk as registerAskBroker, restorePersistedAsks as restorePersistedAsksBroker, findPendingAskByAnchor, submitCustomReply, } from './core/ask-broker.js';
@@ -222,7 +224,7 @@ import { scheduleSessionGroupTitle } from './services/session-group-title.js';
 import { setChatReplyMode } from './services/chat-reply-mode-store.js';
 import { hasVcMeetingEndedTombstone, listVcMeetingRuntimeSessionsByListenerAndAgent, listVcMeetingRuntimeSessions, pruneExpiredVcMeetingRuntimeSessions, recordVcMeetingEndedTombstone, recordVcMeetingRuntimeSession, removeVcMeetingRuntimeSession, } from './services/vc-meeting-runtime-store.js';
 import { computeVcMeetingConsumerProfileHash, normalizeVcMeetingProfileInstructions, } from './services/vc-meeting-profile-instructions.js';
-import { bootstrapVcMeetingDefaultConsumerProfile } from './services/vc-meeting-consumer-profile-bootstrap.js';
+import { bindVcMeetingConsumerCatalogToBot } from './services/vc-meeting-shared-consumer-catalog.js';
 import { getVcMeetingPreparation, normalizeVcMeetingNumber, } from './services/vc-meeting-preparations-store.js';
 import { abandonPoisonedVcMeetingDelivery, getVcMeetingDeliveryStatus, handleVcMeetingTurnTerminal, handleVcMeetingWorkerGenerationExit, receiveVcMeetingDelivery, registerVcMeetingMember, retryPoisonedVcMeetingDelivery, } from './services/vc-meeting-delivery-receiver.js';
 import { abandonVcMeetingDeliveryStream, applyVcMeetingMemberProjection, expireVcMeetingDeliveryLeases, findVcMeetingDeliveryByKey, getVcMeetingMemberProjection, listVcMeetingMemberProjections, reconcileVcMeetingDeliveriesOnBoot, } from './services/vc-meeting-delivery-store.js';
@@ -231,7 +233,7 @@ import { buildVcMeetingDeliveryEntries, renderVcMeetingDeliveryItem, sealVcMeeti
 import { applyVcMeetingHubMemberProjection, freezeVcMeetingHubDeliveryAssignment, getVcMeetingHubCloseState, getVcMeetingHubDeliveryAssignment, getVcMeetingHubMember, listVcMeetingHubMembers, observeVcMeetingHubReceiverReceipt, updateVcMeetingHubCloseState, } from './services/vc-meeting-delivery-hub-store.js';
 import { getVcMeetingFeedMetadataState, ingestVcMeetingFeedMetadata, } from './services/vc-meeting-feed-metadata-store.js';
 import { VcMeetingTerminalReconciler } from './services/vc-meeting-terminal-reconciler.js';
-import { resolveVcMeetingImTurnOrigin, verifyVcMeetingManagedOriginClaim, } from './services/vc-meeting-send-policy.js';
+import { resolveVcMeetingImTurnOrigin, verifyVcMeetingManagedOriginClaim, evaluateVcMeetingManagedSend, } from './services/vc-meeting-send-policy.js';
 import { ensureVcMeetingListenerTopicRoot, } from './services/vc-meeting-listener-topic-store.js';
 import { finishVcMeetingManagedActionProvider, finishVcMeetingManagedApprovalCard, requestVcMeetingManagedImAction, requestVcMeetingManagedAction, resolveVcMeetingManagedActionApproval, } from './services/vc-meeting-action-gate.js';
 import { claimVcMeetingApprovalCardAttempt, findVcMeetingAction, listVcMeetingActionScopes, listVcMeetingActions, reconcileVcMeetingActionsOnBoot, } from './services/vc-meeting-action-store.js';
@@ -1129,14 +1131,34 @@ function vcMeetingConsumerRecoveryResolutionGraceMs() {
 const vcMeetingClosingConsumerSessions = new Map();
 let vcMeetingAgentGlobalEnabledOverrideForTest;
 let vcMeetingAgentGlobalListenerBotAppIdOverrideForTest;
+let vcMeetingListenerPinDeprecationWarned = false;
 function vcMeetingAgentGlobalEnabled() {
     return vcMeetingAgentGlobalEnabledOverrideForTest ?? isVcMeetingAgentGloballyEnabled();
 }
+/**
+ * RETIRED (2026-08): the global VC listener pin is gone — every bot with
+ * `vcMeetingAgent.enabled` now handles the meeting events IT receives, so a
+ * meeting can run multiple bots (each with its own presets) instead of routing
+ * everything through one designated listener. Always returns undefined so the
+ * `listenerAppId &&` guards at every call site short-circuit to the
+ * every-bot-handles-its-own behaviour (which was already the semantics when
+ * `listenerBotAppId` was unset). A legacy `vcMeetingAgent.listenerBotAppId`
+ * still in config is ignored with a one-time warning.
+ *
+ * The test override is retained ONLY so the test harness can still call the
+ * setter without a signature change; it no longer re-pins routing.
+ */
 function vcMeetingAgentGlobalListenerAppId() {
-    if (vcMeetingAgentGlobalListenerBotAppIdOverrideForTest !== undefined) {
-        return vcMeetingAgentGlobalListenerBotAppIdOverrideForTest ?? undefined;
+    const legacyPin = vcMeetingAgentGlobalListenerBotAppIdOverrideForTest !== undefined
+        ? (vcMeetingAgentGlobalListenerBotAppIdOverrideForTest ?? undefined)
+        : vcMeetingAgentGlobalListenerBotAppId();
+    if (legacyPin && !vcMeetingListenerPinDeprecationWarned) {
+        vcMeetingListenerPinDeprecationWarned = true;
+        logger.warn(`[vc-agent] vcMeetingAgent.listenerBotAppId=${legacyPin} is deprecated and ignored: `
+            + 'every bot with vcMeetingAgent.enabled now handles its own meeting invites. '
+            + 'Remove this field from the global config.');
     }
-    return vcMeetingAgentGlobalListenerBotAppId();
+    return undefined;
 }
 function vcMeetingPushIsTrackedLifecycleEvent(ctx) {
     const key = ctx.meeting.id ? vcMeetingSessionKey(ctx.larkAppId, ctx.meeting.id) : '';
@@ -1151,7 +1173,11 @@ const DEFAULT_VC_MEETING_FLUSH_INTERVAL_MS = 30_000;
 const DEFAULT_VC_MEETING_TIME_ZONE = 'Asia/Shanghai';
 const DEFAULT_VC_MEETING_CONSUMER_SELECTION_TIMEOUT_MS = 20_000;
 const DEFAULT_VC_MEETING_CONSUMER_INJECT_INTERVAL_MS = 30_000;
-const DEFAULT_VC_MEETING_CONSUMER_MIN_BATCH_CHARS = 400;
+// Effectively no char-accumulation gate: with minBatchItems=1 a single
+// finalized transcript segment already qualifies, and the operator explicitly
+// asked for no "wait until enough text piles up" behavior (esp. at meeting
+// start). Kept as a config knob for bots that want to raise it.
+const DEFAULT_VC_MEETING_CONSUMER_MIN_BATCH_CHARS = 1;
 const VC_MEETING_CONSUMER_DELIVERY_MAX_ITEMS = 100;
 const VC_MEETING_CONSUMER_DELIVERY_MAX_RENDERED_CHARS = 20_000;
 // By default, keep the selected agent as fresh as the listener group: one new
@@ -1345,11 +1371,42 @@ function vcMeetingConsumerMinBatchItems(cfg) {
 function vcMeetingConsumerMaxInjectIntervalMs(cfg) {
     return cfg.meetingConsumer?.maxInjectIntervalMs ?? DEFAULT_VC_MEETING_CONSUMER_MAX_INJECT_INTERVAL_MS;
 }
-function defaultVcMeetingTextOutputPolicy() {
-    return 'approval';
+function defaultVcMeetingTextOutputPolicy(cfg) {
+    // In-meeting text now sends without per-message approval by default; an
+    // operator can restore the review gate per-bot via
+    // meetingConsumer.textOutputPolicy = 'approval' (or 'deny').
+    const configured = cfg?.meetingConsumer?.textOutputPolicy;
+    if (configured === 'approval' || configured === 'deny' || configured === 'allow')
+        return configured;
+    return 'allow';
 }
 function defaultVcMeetingVoiceOutputPolicy(cfg) {
-    return cfg.realtimeVoice?.enabled === true ? 'approval' : 'deny';
+    // Voice is denied only when realtime voice is explicitly OFF. Realtime voice is
+    // now ON BY DEFAULT (vcMeetingRealtimeVoiceEnabled: unset ⇒ enabled), so unless
+    // an operator set realtimeVoice.enabled:false, voice falls through to the
+    // default below. ⚠ That default is 'allow' — matching text — meaning a bot
+    // pulled into a meeting speaks aloud WITHOUT per-utterance approval by default.
+    // Tighten per-bot to 'approval'/'deny' via meetingConsumer.voiceOutputPolicy
+    // (dashboard-editable). 'allow' only drops the per-send approval step; the
+    // managed request-output/action gate + capability check still apply.
+    if (!vcMeetingRealtimeVoiceEnabled(cfg))
+        return 'deny';
+    const configured = cfg.meetingConsumer?.voiceOutputPolicy;
+    if (configured === 'approval' || configured === 'deny' || configured === 'allow')
+        return configured;
+    return 'allow';
+}
+/**
+ * 实时语音能力现在**默认开启**：`realtimeVoice.enabled` 未配 = 视为开,只有显式
+ * `false` 才关。scope 已 fleet 级预授(实测含 vc:meeting.bot.realtime:write),所以
+ * 语音关着只是保守默认、不是权限卡。
+ *
+ * 注意「能力开」不等于「入会即建连」:语音 WebSocket 只在这个 bot 真要发言时
+ * (deliverVcMeetingVoiceOutput → ensureVcMeetingRealtimeVoiceSession)按需建立,
+ * 纯监听 / 从不发言的 bot 不会挂空闲连接。见 maybeStartVcMeetingRealtimeVoice。
+ */
+function vcMeetingRealtimeVoiceEnabled(cfg) {
+    return cfg?.realtimeVoice?.enabled !== false;
 }
 function vcMeetingOutputReviewTimeoutMs(channel) {
     return channel === 'voice' ? DEFAULT_VC_MEETING_VOICE_REVIEW_TIMEOUT_MS : DEFAULT_VC_MEETING_TEXT_REVIEW_TIMEOUT_MS;
@@ -1616,36 +1673,29 @@ async function ensureVcMeetingReceiverSession(request, existingSessionId, receiv
         if (!existing) {
             throw new Error(`registered receiver session is not active or lacks managed side-effect isolation: ${existingSessionId}`);
         }
+        // Plan B: the meeting agent is an ordinary chat-scope session, so a chat can
+        // legitimately host several meeting projections in one transcript. The old
+        // strict "one session ⇔ one exact meeting/member/epoch" identity check no
+        // longer holds. Only require that the resolved session is the right listener
+        // chat under the right agent app (verified via the resolver binding above)
+        // and stamp/refresh the delivery-identity metadata for this member epoch so
+        // later meeting-directed output (Stage 6) can find it. The marker is pure
+        // metadata now — it does not affect routing.
         const ds = [...activeSessions.values()].find(candidate => candidate.session.sessionId === existingSessionId) ?? findActiveBySessionId(existingSessionId);
-        const identity = ds?.session.vcMeetingReceiver;
-        if (!identity
-            || identity.listenerAppId !== request.meeting.listenerAppId
-            || identity.meetingId !== request.meeting.meetingId
-            || identity.memberId !== request.member.memberId
-            || identity.memberEpoch !== request.member.epoch) {
-            throw new Error('registered receiver session is not dedicated to this meeting member epoch');
+        if (ds && ds.chatId === request.outputRoute.chatId) {
+            stampVcMeetingBinding(ds, request);
         }
         return existing;
     }
-    // A receiver session is a dedicated conversation. It deliberately shares
-    // the listener chat only as an output route; its activeSessions key is based
-    // on sessionId (activeSessionKey), so an ordinary chat-scope session or a
-    // second meeting/member cannot collapse into the same CLI transcript.
+    // Plan B core cut: a meeting agent is a normal chat-scope session in its
+    // listener group, keyed by the ordinary `(chatId, appId)` slot. Plain IM and
+    // meeting transcripts therefore fold into the SAME session (transcripts are
+    // delivered by target.sessionId; IM is routed by the chat anchor). Reuse an
+    // existing chat-scope session at that slot if present (whether it was opened
+    // by IM or by an earlier meeting), else create a cold `worker:null` session
+    // shaped exactly like an auto-created IM session so triggerSessionTurn's
+    // cold-fork path spawns it on first delivery.
     const chatId = request.outputRoute.chatId;
-    const matching = [...activeSessions.values()].find((candidate) => {
-        const identity = candidate.session.vcMeetingReceiver;
-        return candidate.larkAppId === selfAppId
-            && identity?.listenerAppId === request.meeting.listenerAppId
-            && identity.meetingId === request.meeting.meetingId
-            && identity.memberId === request.member.memberId
-            && identity.memberEpoch === request.member.epoch;
-    });
-    if (matching) {
-        const binding = resolveVcMeetingReceiverSession(matching.session.sessionId);
-        if (!binding)
-            throw new Error('existing dedicated receiver session has an unsupported CLI adapter');
-        return binding;
-    }
     const bot = getBot(selfAppId);
     const isolation = vcMeetingConsumerIsolationForBot(bot.config);
     if (!isolation.decision.ok) {
@@ -1657,56 +1707,84 @@ async function ensureVcMeetingReceiverSession(request, existingSessionId, receiv
     // whose environment/working dir was never set up for bwrap, and the CLI would
     // fail to spawn or be unable to work (the "joined but never replies" bug).
     const receiverSandboxed = isolation.decision.isolated;
-    const rawWorkingDir = findOncallChat(selfAppId, chatId)?.workingDir
-        ?? effectiveDefaultWorkingDir(bot.config)
-        ?? bot.config.workingDir
-        ?? '~';
-    const workingDir = validateWorkingDir(rawWorkingDir, localeForBot(selfAppId));
-    if (!workingDir.ok)
-        throw new Error(workingDir.error);
-    const session = sessionStore.createSession(chatId, chatId, `[Meeting] ${request.meeting.meetingId}`.slice(0, 50), 'group');
-    const now = Date.now();
-    session.larkAppId = selfAppId;
-    session.scope = 'chat';
-    session.vcMeetingReceiver = {
+    const key = sessionKey(chatId, selfAppId);
+    const bound = await withActiveSessionKeyLock(activeSessions, key, () => {
+        const current = activeSessions.get(key);
+        if (current) {
+            // A chat-scope session already occupies this slot. Adopt it as the meeting
+            // agent by stamping the delivery-identity metadata; do NOT create a second
+            // universe. The session keeps whatever launch/sandbox decision it already
+            // froze — we never retroactively weaken or strengthen a live session here.
+            stampVcMeetingBinding(current, request);
+            return current;
+        }
+        const rawWorkingDir = findOncallChat(selfAppId, chatId)?.workingDir
+            ?? effectiveDefaultWorkingDir(bot.config)
+            ?? bot.config.workingDir
+            ?? '~';
+        const workingDir = validateWorkingDir(rawWorkingDir, localeForBot(selfAppId));
+        if (!workingDir.ok)
+            throw new Error(workingDir.error);
+        const session = sessionStore.createSession(chatId, chatId, `[Meeting] ${request.meeting.meetingId}`.slice(0, 50), 'group');
+        const now = Date.now();
+        session.larkAppId = selfAppId;
+        session.scope = 'chat';
+        session.vcMeetingReceiver = {
+            listenerAppId: request.meeting.listenerAppId,
+            meetingId: request.meeting.meetingId,
+            memberId: request.member.memberId,
+            memberEpoch: request.member.epoch,
+        };
+        session.lastMessageAt = new Date(now).toISOString();
+        session.workingDir = workingDir.resolvedPath;
+        session.cliId = bot.config.cliId;
+        // Freeze the security-critical launch decision at creation.  A later live
+        // Bot-config edit must neither weaken this session nor make an old
+        // unisolated session appear eligible retroactively. Under plan B the frozen
+        // value follows the bot's opt-in, not a hardcoded true.
+        session.sandbox = receiverSandboxed;
+        session.sandboxHidePaths = receiverSandboxed ? (bot.config.sandboxHidePaths ?? []) : [];
+        session.sandboxReadonlyPaths = receiverSandboxed ? (bot.config.sandboxReadonlyPaths ?? []) : [];
+        session.sandboxNetwork = receiverSandboxed ? (bot.config.sandboxNetwork !== false) : true;
+        session.backendType = isolation.backendType;
+        sessionStore.updateSession(session);
+        const ds = {
+            session,
+            worker: null,
+            workerPort: null,
+            workerToken: null,
+            larkAppId: selfAppId,
+            chatId,
+            chatType: 'group',
+            scope: 'chat',
+            spawnedAt: Date.parse(session.createdAt) || now,
+            cliVersion: getCurrentCliVersion(),
+            lastMessageAt: now,
+            hasHistory: false,
+            workingDir: workingDir.resolvedPath,
+        };
+        activeSessions.set(key, ds);
+        return ds;
+    });
+    const binding = resolveVcMeetingReceiverSession(bound.session.sessionId);
+    if (!binding)
+        throw new Error('meeting agent session has an unsupported CLI adapter');
+    return binding;
+}
+/** Stamp/refresh the VC meeting delivery-identity metadata onto an ordinary
+ * chat-scope session (Plan B). This binds the session as the delivery + future
+ * meeting-output target for this member epoch WITHOUT changing routing: the
+ * session is still keyed by its normal chat slot. The most-recent meeting/member
+ * epoch wins when one chat hosts several meetings, matching the transcript
+ * delivery model (targets pick the session by id, not by this marker). */
+function stampVcMeetingBinding(ds, request) {
+    ds.session.vcMeetingReceiver = {
         listenerAppId: request.meeting.listenerAppId,
         meetingId: request.meeting.meetingId,
         memberId: request.member.memberId,
         memberEpoch: request.member.epoch,
     };
-    session.lastMessageAt = new Date(now).toISOString();
-    session.workingDir = workingDir.resolvedPath;
-    session.cliId = bot.config.cliId;
-    // Freeze the security-critical launch decision at receiver creation.  A
-    // later live Bot-config edit must neither weaken this session nor make an
-    // old unisolated receiver appear eligible retroactively. Under plan B the
-    // frozen value follows the bot's opt-in, not a hardcoded true.
-    session.sandbox = receiverSandboxed;
-    session.sandboxHidePaths = receiverSandboxed ? (bot.config.sandboxHidePaths ?? []) : [];
-    session.sandboxReadonlyPaths = receiverSandboxed ? (bot.config.sandboxReadonlyPaths ?? []) : [];
-    session.sandboxNetwork = receiverSandboxed ? (bot.config.sandboxNetwork !== false) : true;
-    session.backendType = isolation.backendType;
-    sessionStore.updateSession(session);
-    const ds = {
-        session,
-        worker: null,
-        workerPort: null,
-        workerToken: null,
-        larkAppId: selfAppId,
-        chatId,
-        chatType: 'group',
-        scope: 'chat',
-        spawnedAt: Date.parse(session.createdAt) || now,
-        cliVersion: getCurrentCliVersion(),
-        lastMessageAt: now,
-        hasHistory: false,
-        workingDir: workingDir.resolvedPath,
-    };
-    activeSessions.set(activeSessionKey(ds), ds);
-    const binding = resolveVcMeetingReceiverSession(session.sessionId);
-    if (!binding)
-        throw new Error('created receiver session has an unsupported CLI adapter');
-    return binding;
+    sessionStore.updateSession(ds.session);
 }
 function vcMeetingDeliveryReceiverDeps(receiverAppId) {
     const selfAppId = receiverAppId ?? selfDaemonLarkAppId;
@@ -1722,6 +1800,18 @@ function vcMeetingDeliveryReceiverDeps(receiverAppId) {
             const target = findActiveBySessionId(request.target.sessionId ?? '');
             if (target)
                 target.vcMeetingImTurnOrigin = undefined;
+            // VC transcript delivery turns dispatch straight through triggerSessionTurn,
+            // which (unlike the ordinary IM path) never calls beginNewTurn — so without
+            // this the meeting agent's streaming-card lifecycle would never arm and no
+            // live card would post for a transcript-driven turn. Under Plan B the
+            // meeting agent is an ordinary chat-scope session whose card should surface
+            // like any group session (the "看不到流式卡片" report), so arm it for every
+            // delivery turn. A silent-responseMode turn still suppresses only its final
+            // output (managedFinalOutputSuppressed), not the live card.
+            if (target?.session.vcMeetingReceiver && context.stableTurnId) {
+                const title = target.currentTurnTitle || target.session.title || '会议监听';
+                beginNewTurn(target, title, context.stableTurnId);
+            }
             return triggerSessionTurn(request, { larkAppId: selfAppId, activeSessions }, {
                 stableTurnId: context.stableTurnId,
                 beforeDispatch: context.beforeDispatch,
@@ -1926,7 +2016,13 @@ async function maybeCatchUpVcMeetingConsumerBeforeTurn(data, ctx) {
         logger.warn(`[vc-agent] IM follow-up routed with possibly stale context meeting=${caughtUp.candidate.meetingId} `
             + `agent=${ctx.larkAppId} status=${caughtUp.catchUpStatus} error=${caughtUp.catchUpError ?? '-'}`);
     }
-    return { anchorOverride: `vc-receiver:${caughtUp.candidate.receiverSessionId}` };
+    // Plan B: the meeting agent is an ordinary chat-scope session keyed by the
+    // normal `(chatId, appId)` slot, so the natural chat anchor already resolves
+    // it — no `vc-receiver:` anchor override is needed (or correct) anymore. This
+    // hook now only (a) blocks on ambiguous/undeliverable meeting context and
+    // (b) stamps vcMeetingImTurnOrigin so an @mention follow-up carries the
+    // meeting delivery identity for catch-up/echo purposes.
+    return;
 }
 async function pinVcMeetingConsumerChatReplyMode(larkAppId, chatId) {
     if (vcMeetingConsumerUsesLocalReceiver(larkAppId)) {
@@ -2282,7 +2378,14 @@ export async function noteTurnReceived(ds, triggerMessageId, _prompt, _sender, _
     // message — not a worker status edge — means type-ahead / busy-batched messages
     // each get their own ✋. `finishTurnReactions` flips every pending ✋ to ✅ when
     // the worker next goes idle.
-    if (ds.session.vcMeetingReceiver)
+    // Plan B: a meeting agent is an ordinary chat-scope session that hosts plain
+    // user turns. A plain user message should get the ✋→✅ progress reaction like
+    // any card-off session. Only a stamped meeting @mention follow-up stays
+    // reaction-free (it is meeting-driven and routes through the audited listener
+    // action, not the ordinary progress-reaction channel). Transcript deliveries
+    // never reach this inbound-message acceptance point at all.
+    if (ds.session.vcMeetingReceiver
+        && resolveVcMeetingImTurnOrigin(ds.session, triggerMessageId) !== undefined)
         return;
     // Turn-exact card-off check: the reaction ack belongs to THIS message's turn,
     // not to whichever turn most recently overwrote currentReplyTarget.
@@ -4194,7 +4297,8 @@ workflowDaemonMutationRoute('retry', async (reply, params, body, identity) => {
             error: outcome.reason === 'missing' ? 'unknown_run'
                 : outcome.reason === 'loop-node' ? 'loop_node_use_grant'
                     : outcome.reason === 'host-effect-uncertain' ? 'host_effect_reconcile_required'
-                        : 'not_blocked',
+                        : outcome.reason === 'revise-workflow-required' ? 'workflow_revision_required'
+                            : 'not_blocked',
         });
     }
     // requested / already-requested → make sure the run is moving.
@@ -5185,8 +5289,66 @@ ipcRoute('POST', '/api/vc-meetings/action-request', async (req, res) => {
         claimedTurnId: typeof body.originTurnId === 'string' ? body.originTurnId : undefined,
         claimedDispatchAttempt: claimedAttempt,
     });
-    if (!verified.ok)
-        return jsonRes(res, 403, verified);
+    // Plan B: the meeting agent is an ordinary chat-scope session that interleaves
+    // plain user IM turns with meeting deliveries and reaches idle between them.
+    // The in-memory managedTurnOrigin is cleared at each delivery turn's terminal
+    // edge, so a request-output the model runs AFTER the delivery turn goes idle
+    // (or after an intervening IM turn) finds no live origin and would fail
+    // `origin_unproven` — even though the durable delivery receipt still fully
+    // authorizes it. Fall back to the DURABLE receipt for a claimed delivery origin
+    // (turnId + dispatchAttempt): evaluateVcMeetingManagedSend re-derives authority
+    // from the on-disk receipt exactly as the final-output path does — receipt must
+    // exist for THIS receiver session, the attempt must match, its status must be
+    // dispatched/completed, the projection must still be active, and a silent
+    // delivery is refused. This never authorizes anything the receipt itself
+    // wouldn't, so it does not weaken the boundary; it only survives the idle gap.
+    //
+    // The fallback intentionally does NOT require the live origin to be absent:
+    // live verification proves origin via the rotating worker capability only,
+    // and non-sandboxed sessions have no origin-channel transport for that
+    // capability (managedOriginChannelRequired is darwin-isolate/credential-only
+    // bwrap), so their live check ALWAYS fails — including while the delivery
+    // turn is still executing. Gating the fallback on "live origin cleared"
+    // hard-bricked exactly that case (in-turn speech from a non-sandboxed
+    // meeting agent). The durable receipt check is the same strength either way,
+    // so the fallback runs whenever live verification failed.
+    let effectiveVerified = verified;
+    if (!verified.ok
+        && typeof body.originTurnId === 'string'
+        && body.originTurnId.trim()
+        && claimedAttempt !== undefined) {
+        const claimedDeliveryTurnId = body.originTurnId.trim();
+        const durable = evaluateVcMeetingManagedSend(config.session.dataDir, {
+            receiverSessionId,
+            receiverSession: true,
+            turnId: claimedDeliveryTurnId,
+            dispatchAttempt: claimedAttempt,
+            allowTerminalReceipt: true,
+            // In-meeting output channel: silent responseMode gates only listener-group
+            // auto-post, not in-meeting speech (the hub applies capability +
+            // textOutputPolicy/voiceOutputPolicy). Prove receipt identity/liveness here
+            // but do not apply the silent veto.
+            forInMeetingOutput: true,
+        });
+        if (durable.ok && durable.kind === 'listener_thread') {
+            logger.info(`[vc-agent] request-output authorized via durable receipt fallback `
+                + `(live origin ${ds.managedTurnOrigin ? 'present but unverifiable — no capability transport' : 'cleared at turn terminal'}) `
+                + `session=${receiverSessionId.slice(0, 8)} `
+                + `turn=${claimedDeliveryTurnId.slice(0, 12)} attempt=${claimedAttempt}`);
+            effectiveVerified = {
+                ok: true,
+                origin: {
+                    receiverSessionId,
+                    turnId: claimedDeliveryTurnId,
+                    dispatchAttempt: claimedAttempt,
+                    currentImTurnId: undefined,
+                    currentImTurnOrigin: undefined,
+                },
+            };
+        }
+    }
+    if (!effectiveVerified.ok)
+        return jsonRes(res, 403, effectiveVerified);
     const channel = body.channel === 'text' || body.channel === 'voice' ? body.channel : undefined;
     const content = sanitizeVcMeetingOutputContent(body.content, 'content');
     const reason = sanitizeVcMeetingOutputContent(body.reason, 'reason');
@@ -5198,13 +5360,13 @@ ipcRoute('POST', '/api/vc-meetings/action-request', async (req, res) => {
         ? body.expectedListenerAppId.trim()
         : '';
     const expectedMeetingId = typeof body.expectedMeetingId === 'string' ? body.expectedMeetingId.trim() : '';
-    if (verified.origin.dispatchAttempt === undefined) {
-        const imOrigin = resolveVcMeetingImTurnOrigin(ds.session, verified.origin.turnId);
-        if (!verified.origin.turnId
-            || verified.origin.currentImTurnId !== verified.origin.turnId
+    if (effectiveVerified.origin.dispatchAttempt === undefined) {
+        const imOrigin = resolveVcMeetingImTurnOrigin(ds.session, effectiveVerified.origin.turnId);
+        if (!effectiveVerified.origin.turnId
+            || effectiveVerified.origin.currentImTurnId !== effectiveVerified.origin.turnId
             || !imOrigin
             || imOrigin.receiverSessionId !== receiverSessionId
-            || imOrigin.larkMessageId !== verified.origin.turnId) {
+            || imOrigin.larkMessageId !== effectiveVerified.origin.turnId) {
             return jsonRes(res, 409, {
                 ok: false,
                 errorCode: 'im_turn_origin_mismatch',
@@ -5233,14 +5395,14 @@ ipcRoute('POST', '/api/vc-meetings/action-request', async (req, res) => {
         });
         return jsonRes(res, upstream.status, upstream.body);
     }
-    if (!verified.origin.turnId) {
+    if (!effectiveVerified.origin.turnId) {
         return jsonRes(res, 409, {
             ok: false,
             errorCode: 'delivery_origin_mismatch',
             error: 'durable delivery action has no stable turn id',
         });
     }
-    const lookup = findVcMeetingDeliveryByKey(config.session.dataDir, verified.origin.turnId, {
+    const lookup = findVcMeetingDeliveryByKey(config.session.dataDir, effectiveVerified.origin.turnId, {
         receiverSessionId,
     });
     if (!lookup) {
@@ -5271,8 +5433,8 @@ ipcRoute('POST', '/api/vc-meetings/action-request', async (req, res) => {
         body: JSON.stringify({
             agentAppId: ds.larkAppId,
             receiverSessionId,
-            stableTurnId: verified.origin.turnId,
-            dispatchAttempt: verified.origin.dispatchAttempt,
+            stableTurnId: effectiveVerified.origin.turnId,
+            dispatchAttempt: effectiveVerified.origin.dispatchAttempt,
             channel,
             content,
             ...(reason ? { reason } : {}),
@@ -5428,7 +5590,48 @@ function effectiveVcMeetingAgentConfig(larkAppId) {
     // `restoreVcMeetingRuntimeSessionsForBot`, whose call site sits OUTSIDE the
     // `!cfg.apiOnly` boot block — so a migrated bots.json (normal VC bot flipped to
     // apiOnly, stale runtime record on disk) can no longer re-spawn lark-cli at boot.
-    return vcMeetingAgentConfigActive(getBot(larkAppId)?.config);
+    //
+    // 这是 daemon 侧唯一一处产出 VcMeetingAgentConfig 的地方，所以角色预设的绑定也在
+    // 这里做：没有自己 consumerProfiles 的 bot 继承 fleet 共享目录，且**所有**预设的
+    // 执行方一律重绑为 larkAppId 本人——「拉 A 进会却拉 B 进群」在这一层被彻底切断，
+    // 历史配置里写歪的 agentAppId 也在读路径上被纠正，不需要迁移写盘。
+    const cfg = vcMeetingAgentConfigActive(getBot(larkAppId)?.config);
+    if (!cfg)
+        return cfg;
+    return withDefaultVcMeetingJoinProfile(larkAppId, bindVcMeetingConsumerCatalogToBot(larkAppId, cfg));
+}
+/**
+ * 没配 `larkCliProfile` 的 bot，入会身份默认用它**自己的 appId** 作为 lark-cli
+ * profile 名。
+ *
+ * 背景：入会门禁 {@link ensureVcMeetingJoinProfile} 要求 `larkCliProfile` 非空，
+ * 否则以 `no_profile` 拒绝入会。而这个字段过去只有 Dashboard 的「配置权限」按钮
+ * 会落盘（见 preflightVcMeetingBot），于是 fleet 里绝大多数从没点过那颗按钮的 bot
+ * 被拉进会一律被拒——正是「拉别的 bot 进会还是不行」。
+ *
+ * 把默认值放在**读路径**而不是要求人工点按钮，是因为这个默认值是纯确定性的：
+ *   - 就是 bot **自己的 appId**，既不是跨 app 身份、也不含任何 secret，app-scoped，
+ *     不触碰 owner 身份边界；
+ *   - profile 一旦有名字，{@link ensureLarkCliBotProfile} 会用该 bot **自己**保存的
+ *     appSecret 走 `--app-secret-stdin`（不进 argv、只落 lark-cli 加密库、只在受信
+ *     daemon 里）自动注册它——PR #392 当年之所以 fail-closed（“no faked profile”），
+ *     是因为那时没有自动注册、写个名字会 ringing；PR #782 补上自动注册后这个顾虑
+ *     已消除。
+ *
+ * 真正需要人在场的是**开放平台权限开通 / 事件订阅**（可能要扫码登录），那部分仍留在
+ * 「配置权限」按钮里；权限/secret 真缺时，入会会在后面以 `missing_secret` /
+ * `add_failed` / scope 校验等**可操作**错误失败，而不是这里这条造出来的 `no_profile`。
+ *
+ * apiOnly bot 在 {@link vcMeetingAgentConfigActive} 已返回 undefined，走不到这里，
+ * 所以默认只加给结构上真能入会的 bot。纯函数，不改入参、不写盘。
+ */
+function withDefaultVcMeetingJoinProfile(larkAppId, cfg) {
+    if (cfg.larkCliProfile?.trim())
+        return cfg;
+    const appId = larkAppId.trim();
+    if (!appId)
+        return cfg;
+    return { ...cfg, larkCliProfile: appId };
 }
 function configuredVcMeetingListenerChatId(cfg) {
     return cfg.listenerChatId ?? cfg.notificationChatId;
@@ -5557,7 +5760,7 @@ function restoreVcMeetingRuntimeSessionsForBot(larkAppId, cfg) {
         session.consumerPaused = migratePreparedConsumer ? false : record.consumerPaused;
         if (session.consumerMode === 'agent')
             session.consumerLastInjectedAtMs = undefined;
-        session.textOutputPolicy = record.textOutputPolicy ?? defaultVcMeetingTextOutputPolicy();
+        session.textOutputPolicy = record.textOutputPolicy ?? defaultVcMeetingTextOutputPolicy(cfg);
         session.voiceOutputPolicy = record.voiceOutputPolicy ?? defaultVcMeetingVoiceOutputPolicy(cfg);
         session.syncIntervalMs = record.syncIntervalMs;
         session.consumerSelectionExpiresAt = record.consumerSelectionExpiresAt;
@@ -5727,32 +5930,36 @@ function restoreVcMeetingRuntimeSessionsForBot(larkAppId, cfg) {
 }
 async function maybeStartVcMeetingRealtimeVoice(larkAppId, session, cfg) {
     const voiceCfg = cfg.realtimeVoice;
-    if (voiceCfg?.enabled !== true)
+    if (!vcMeetingRealtimeVoiceEnabled(cfg))
+        return;
+    // 按需建连:实时语音能力默认开,但入会时**不**急着开语音 WS——真正要发言时
+    // deliverVcMeetingVoiceOutput 会按需 ensureVcMeetingRealtimeVoiceSession 建连,
+    // 纯监听 / 从不发言的 bot 不挂空闲连接。唯一在入会时就预热的情况是显式配了
+    // testSpeakOnStartText 的 dogfood 场景(要在入会瞬间说一句自检话)。
+    if (!voiceCfg?.testSpeakOnStartText || session.realtimeVoiceTestUtteranceSent)
         return;
     try {
         const voice = await ensureVcMeetingRealtimeVoiceSession(larkAppId, session, cfg);
-        if (voiceCfg.testSpeakOnStartText && !session.realtimeVoiceTestUtteranceSent) {
-            session.realtimeVoiceTestUtteranceSent = true;
-            void (async () => {
-                let sent = false;
-                try {
-                    const r = await voice.speak(voiceCfg.testSpeakOnStartText);
-                    sent = true;
-                    logger.info(`[vc-agent] realtime voice test utterance sent meeting=${session.state.meeting.id} frames=${r.frames} durationMs=${r.durationMs}`);
-                    await delay(DEFAULT_VC_REALTIME_TEST_SPEAK_CLOSE_GRACE_MS);
-                }
-                catch (err) {
-                    logger.warn(`[vc-agent] realtime voice test utterance failed meeting=${session.state.meeting.id}: ${err instanceof Error ? err.message : String(err)}`);
-                }
-                finally {
-                    await voice.stop(sent ? 'test-speak-finished' : 'test-speak-failed').catch((err) => {
-                        logger.warn(`[vc-agent] realtime voice test utterance stop failed meeting=${session.state.meeting.id}: ${err instanceof Error ? err.message : String(err)}`);
-                    });
-                    if (session.realtimeVoice === voice)
-                        session.realtimeVoice = undefined;
-                }
-            })();
-        }
+        session.realtimeVoiceTestUtteranceSent = true;
+        void (async () => {
+            let sent = false;
+            try {
+                const r = await voice.speak(voiceCfg.testSpeakOnStartText);
+                sent = true;
+                logger.info(`[vc-agent] realtime voice test utterance sent meeting=${session.state.meeting.id} frames=${r.frames} durationMs=${r.durationMs}`);
+                await delay(DEFAULT_VC_REALTIME_TEST_SPEAK_CLOSE_GRACE_MS);
+            }
+            catch (err) {
+                logger.warn(`[vc-agent] realtime voice test utterance failed meeting=${session.state.meeting.id}: ${err instanceof Error ? err.message : String(err)}`);
+            }
+            finally {
+                await voice.stop(sent ? 'test-speak-finished' : 'test-speak-failed').catch((err) => {
+                    logger.warn(`[vc-agent] realtime voice test utterance stop failed meeting=${session.state.meeting.id}: ${err instanceof Error ? err.message : String(err)}`);
+                });
+                if (session.realtimeVoice === voice)
+                    session.realtimeVoice = undefined;
+            }
+        })();
     }
     catch (err) {
         await session.realtimeVoice?.stop('start-failed').catch(() => { });
@@ -5761,9 +5968,9 @@ async function maybeStartVcMeetingRealtimeVoice(larkAppId, session, cfg) {
     }
 }
 async function ensureVcMeetingRealtimeVoiceSession(larkAppId, session, cfg) {
-    const voiceCfg = cfg.realtimeVoice;
-    if (voiceCfg?.enabled !== true)
+    if (!vcMeetingRealtimeVoiceEnabled(cfg))
         throw new Error('realtime voice is disabled');
+    const voiceCfg = cfg.realtimeVoice;
     if (session.realtimeVoice && (session.realtimeVoice.status === 'failed' || session.realtimeVoice.status === 'stopped')) {
         await session.realtimeVoice.stop('rebuild-stale-session').catch((err) => {
             logger.warn(`[vc-agent] stale realtime voice cleanup failed meeting=${session.state.meeting.id}: ${err instanceof Error ? err.message : String(err)}`);
@@ -5780,9 +5987,9 @@ async function ensureVcMeetingRealtimeVoiceSession(larkAppId, session, cfg) {
             protocol: createProtoRealtimeVoiceProtocol(),
             transport,
             audioFormat: {
-                ...(voiceCfg.sampleRate !== undefined ? { sampleRate: voiceCfg.sampleRate } : {}),
-                ...(voiceCfg.channels !== undefined ? { channels: voiceCfg.channels } : {}),
-                ...(voiceCfg.frameMs !== undefined ? { frameMs: voiceCfg.frameMs } : {}),
+                ...(voiceCfg?.sampleRate !== undefined ? { sampleRate: voiceCfg.sampleRate } : {}),
+                ...(voiceCfg?.channels !== undefined ? { channels: voiceCfg.channels } : {}),
+                ...(voiceCfg?.frameMs !== undefined ? { frameMs: voiceCfg.frameMs } : {}),
             },
         });
     }
@@ -5907,7 +6114,7 @@ function getOrCreateVcMeetingDaemonSession(larkAppId, meeting, cfg, opts = {}) {
             monitoringStarted: false,
             ...(listenerChatId ? { listenerChatId } : {}),
             pendingItems: [],
-            textOutputPolicy: defaultVcMeetingTextOutputPolicy(),
+            textOutputPolicy: defaultVcMeetingTextOutputPolicy(cfg),
             voiceOutputPolicy: defaultVcMeetingVoiceOutputPolicy(cfg),
             pendingOutputRequests: {},
             consumerPendingItems: [],
@@ -5937,7 +6144,7 @@ function getOrCreateVcMeetingDaemonSession(larkAppId, meeting, cfg, opts = {}) {
             session.listenerChatId = listenerChatId;
             session.state.notificationChatId = listenerChatId;
         }
-        session.textOutputPolicy ??= defaultVcMeetingTextOutputPolicy();
+        session.textOutputPolicy ??= defaultVcMeetingTextOutputPolicy(cfg);
         session.voiceOutputPolicy ??= defaultVcMeetingVoiceOutputPolicy(cfg);
         session.pendingOutputRequests ??= {};
         session.consumerPendingItems ??= [];
@@ -8322,7 +8529,11 @@ function vcMeetingConsumerHasFastSignal(session, cfg, items) {
             : item.type === 'transcript_received'
                 ? item.speaker
                 : undefined;
-        if (isInstructionSource(actor) && /[?？]/.test(text))
+        // Any speech/chat from an instruction source (the authorizing user) is a
+        // fast signal — not only questions. Waiting out the regular flush tick on
+        // the operator's own words made the agent feel unresponsive in-meeting;
+        // other participants still batch on the normal cadence.
+        if (isInstructionSource(actor))
             return true;
     }
     return false;
@@ -11699,6 +11910,42 @@ async function restoreVcMeetingMonitoringAfterObservedJoin(key, session, cfg, oc
     await resolveVcMeetingListenerRejoinCard(session, cfg, 'rejoined');
     logger.info(`[vc-agent] listener monitoring restored from own join event meeting=${session.state.meeting.id}`);
 }
+/**
+ * 入会即预热会议 agent 的 CLI 会话——复用「进群自动开工」(handleBotAdded)而不是走
+ * VC delivery 冷 fork,把 bot 刚进监听群时就把会话冷起来待命,首条字幕/弹幕来了秒回
+ * (否则要等选择卡默认生效 + 首次投递,实测 ~28s)。
+ *
+ * 为什么安全复用 handleBotAdded:
+ *  - Plan B 下会议 agent 本就是这个监听群的普通 chat-scope 会话,key = sessionKey(
+ *    chatId, appId);handleBotAdded 普通群 chat-scope 会话同 key。预热出来的正是后面
+ *    VC 投递 `ensureVcMeetingReceiverSession` 会 adopt 的那个(它见已有会话只 stamp
+ *    binding、不另建),零重复会话、零 delivery 机制改动。
+ *  - forcePrompt='' 绕过 autoStartOnGroupJoin 开关(入会预热是我们主动的),D7(群里
+ *    要有 allowedUser)照跑——监听群有 owner,天然过。空 prompt = 模型自己读群上下文
+ *    (与场景① D8 一致),不塞合成指令。
+ *
+ * **只在会落到 chat-scope 时预热**:若这个 bot 的普通群回复模式是 new-topic,
+ * handleBotAdded 会给监听群开一个话题(thread-scope,锚点漂移),就和 VC 固定的
+ * chat key 岔开、可能双开会话。这种情况跳过预热,退回老的懒启动(无回归)。
+ * best-effort:任何失败只 warn,会话仍会在首次投递时冷 fork。
+ */
+async function warmSpawnVcMeetingAgentSession(larkAppId, listenerChatId, meeting) {
+    try {
+        // 监听群是新建的普通群(createGroupWithBots),mode='group';只有当这个 bot 的普通群
+        // 回复模式是 new-topic 时 handleBotAdded 才会开话题,那时跳过以免与 VC chat key 岔开。
+        const regularGroupMode = resolveRegularGroupMode(larkAppId, listenerChatId);
+        if (externalEventOpensOwnTopic('group', regularGroupMode)) {
+            logger.info(`[vc-agent] skip warm-spawn for meeting=${meeting.id} chat=${listenerChatId}: `
+                + `bot reply mode opens a topic (would diverge from the chat-scope meeting key)`);
+            return;
+        }
+        await handleBotAdded(listenerChatId, undefined, larkAppId, { forcePrompt: '' });
+    }
+    catch (err) {
+        logger.warn(`[vc-agent] warm-spawn on join failed meeting=${meeting.id} chat=${listenerChatId}: `
+            + `${err instanceof Error ? err.message : String(err)} (falling back to lazy spawn on first delivery)`);
+    }
+}
 async function startVcMeetingMonitoring(input) {
     if (!input.forceJoin
         && input.session.monitoringStarted
@@ -11786,6 +12033,13 @@ async function startVcMeetingMonitoring(input) {
             persistVcMeetingRuntimeSession(session, input.cfg);
             scheduleVcMeetingListenerFlush(currentKey, input.cfg);
             void maybeStartVcMeetingRealtimeVoice(input.larkAppId, session, input.cfg);
+            // 入会即预热 CLI：监听群一建好就把这个 bot 的会话冷起来待命,而不是等第一条
+            // 字幕/弹幕投递才冷 fork(实测那要 ~28s)。复用「进群自动开工」的 handleBotAdded
+            // ——不碰 VC delivery/attribution 机制,且 Plan B 下会议 agent 本就是这个监听群的
+            // 普通 chat-scope 会话(sessionKey(chatId,appId)),与 handleBotAdded 普通群 chat
+            // 会话同 key:预热出来的正是后面 VC 投递会 adopt 的那个,零重复会话。best-effort,
+            // 失败只 warn(会话仍会在首次投递时按老路径冷 fork)。
+            void warmSpawnVcMeetingAgentSession(input.larkAppId, listenerChatId, meeting);
             await sendMessage(input.larkAppId, listenerChatId, formatVcMeetingStartMessage(meeting, input.cfg), 'text', `vc_${meeting.id.slice(-12)}_start`).catch((err) => {
                 logger.warn(`[vc-agent] listener start message failed meeting=${meeting.id}: ${err instanceof Error ? err.message : String(err)}`);
             });
@@ -13363,6 +13617,8 @@ export const __vcMeetingAgentTest = {
         if (cfg)
             restoreVcMeetingRuntimeSessionsForBot(larkAppId, cfg);
     },
+    /** 测试用：读某个 bot 的有效 VC 配置（含共享目录绑定 + larkCliProfile 默认值）。 */
+    effectiveConfig: (larkAppId) => effectiveVcMeetingAgentConfig(larkAppId),
     reset: () => {
         for (const session of vcMeetingSessions.values()) {
             if (session.flushTimer)
@@ -14102,6 +14358,7 @@ async function startInitialPassthroughSession(args) {
     session.quoteTargetSenderIsBot = resolvedSenderIsBot;
     session.lastMessageAt = new Date(now).toISOString();
     session.scope = scope;
+    fillNativeTopicId(session, scope, parsed.threadId);
     sessionStore.updateSession(session);
     const { pinnedWorkingDir, oncallEntry, inheritedFrom, pinnedFromBotDefault } = await resolvePinnedWorkingDir({ scope, anchor, chatId, chatType, larkAppId });
     // Auto-worktree: register PENDING (router buffers, no force-fork) and build the
@@ -14286,19 +14543,20 @@ async function handleNewTopic(data, ctx) {
  * (handleNewTopicAdmitted + handleThreadReplyAdmitted), so a plain-human turn is
  * authorized identically whether it opens a new topic or continues one (R6/R7-B1).
  *
- * FAIL-CLOSED by construction (R7-B1): authorization requires a POSITIVE
- * `humanSender` (senderType === 'user' AND not a known peer bot) AND the absence
- * of every control-rewrite / dedicated-receiver signal. Excluding a list of
- * known non-human sources is NOT enough — an exclude-list is never complete, so
- * any un-enumerated non-user source would fail OPEN. The positive humanSender
- * gate makes the default deny: anything that is not provably a real human turn
- * with no special semantics stays forced-serial.
+ * FAIL-CLOSED by construction (R7-B1): authorization requires either a POSITIVE
+ * `humanSender` (senderType === 'user' AND not a known peer bot), or a known peer
+ * bot carrying the explicit `@steer` directive. Both lanes must also have no
+ * control-rewrite / dedicated-receiver signal. Anything not positively matched
+ * by one of those lanes stays forced-serial.
  */
 function computeCodexAppSteerable(facts) {
-    return facts.humanSender
-        && !facts.adopted
+    const plainHuman = facts.humanSender
         && !facts.isForeignBot
-        && !facts.isBotSenderType
+        && !facts.isBotSenderType;
+    const explicitBotSteer = facts.explicitBotSteer
+        && facts.isForeignBot;
+    return (plainHuman || explicitBotSteer)
+        && !facts.adopted
         && !facts.substituteTrigger
         && !facts.controlRewrite
         && !facts.messageListener
@@ -14409,6 +14667,19 @@ async function handleNewTopicAdmitted(data, ctx) {
     // every event that flows through us teaches the cache without touching
     // the contact API. Must run before any await on the sender resolver.
     learnFromMentions(larkAppId, parsed.mentions);
+    const senderOpenId = data.sender?.sender_id?.open_id;
+    const isBotSenderType = data.sender?.sender_type === 'app' || data.sender?.sender_type === 'bot';
+    const isForeignBotSender = isBotSenderType
+        || (!!senderOpenId && senderOpenId !== getBot(larkAppId).botOpenId
+            && isKnownPeerBot(config.session.dataDir, larkAppId, senderOpenId));
+    // `@steer` is a generic bot-to-bot transport directive, not model content.
+    // Consume it only from a positively classified bot sender; a human writing
+    // the same text keeps the literal body (human turns are already steerable).
+    const botSteerDirective = isForeignBotSender
+        ? parseBotSteerDirective(parsed.content)
+        : { requested: false, content: parsed.content };
+    if (botSteerDirective.requested)
+        parsed.content = botSteerDirective.content;
     const followupContent = parsed.content.trim();
     let content = composeForwardFollowupContent(forwardSeedContent, followupContent);
     // Strip leading @<bot> mentions so "@bot /oncall bind" is recognized as a command.
@@ -14420,7 +14691,6 @@ async function handleNewTopicAdmitted(data, ctx) {
     // (already thread-scope) it's just a prefix strip — no routing change.
     // Empty prompt is allowed: later setup chooses either a repo picker or a
     // visible thread that waits for the first real task, without an empty worker.
-    const senderOpenId = data.sender?.sender_id?.open_id;
     const forceTopic = parseForceTopicInvocation(cmdContent);
     if (forceTopic) {
         if (await replyGrantRestrictionIfNeeded(larkAppId, chatId, senderOpenId, anchor, forceTopicCommandLabel(cmdContent))) {
@@ -14449,7 +14719,6 @@ async function handleNewTopicAdmitted(data, ctx) {
     // 飞书盖章的 bot 发送方。既锁 union 信任腿（下面的 teamTrustUnionId），也决定
     // talk 复查走哪个谓词（evaluateBotTalk vs evaluateTalk）——两者必须同源，见
     // enforceMessageQuotaForCliInput 的 botSender 说明。
-    const isBotSenderType = data.sender?.sender_type === 'app' || data.sender?.sender_type === 'bot';
     const teamTrustUnionId = isBotSenderType ? senderUnionId : undefined;
     // A bot-sent new topic (e.g. a message-listener match on a third-party alert
     // bot's card) must NOT make that bot the session owner: daemon-generated
@@ -14458,9 +14727,6 @@ async function handleNewTopicAdmitted(data, ctx) {
     // surfaces (restart/report/cards) to it. Mirror the handleThreadReply +
     // auto-create paths (isForeignBot → ownerOpenId/ownerUnionId undefined); keep
     // creatorOpenId + quoteTarget* so botmux report / first-turn quote still work.
-    const isForeignBotSender = isBotSenderType
-        || (!!senderOpenId && senderOpenId !== getBot(larkAppId).botOpenId
-            && isKnownPeerBot(config.session.dataDir, larkAppId, senderOpenId));
     const ownerOpenIdForSession = isForeignBotSender ? undefined : senderOpenId;
     const ownerUnionIdForSession = isForeignBotSender ? undefined : senderUnionId;
     const botCfg = getBot(larkAppId).config;
@@ -14682,6 +14948,7 @@ async function handleNewTopicAdmitted(data, ctx) {
             session.lastCallerOpenId = senderOpenId;
             session.lastMessageAt = new Date(now).toISOString();
             session.scope = scope;
+            fillNativeTopicId(session, scope, parsed.threadId);
             // First-message `/repo`: seed the same pending-repo state the card flow
             // uses, so the `/repo` handler launches the CLI straight away —
             // `/repo <arg>` in that repo, bare `/repo` in the default workingDir —
@@ -14890,6 +15157,7 @@ async function handleNewTopicAdmitted(data, ctx) {
     session.quoteTargetSenderIsBot = isForeignBotSender || parsed.senderType === 'app' || parsed.senderType === 'bot';
     session.lastMessageAt = new Date(now).toISOString();
     session.scope = scope;
+    fillNativeTopicId(session, scope, parsed.threadId);
     session.nativeSessionTitle = buildBotmuxLarkNativeSessionTitle(parsed.content, parsed.mentions, groupChatName);
     sessionStore.updateSession(session);
     // Control card compensates for the card-less (avatar-style) chat-scope
@@ -14927,8 +15195,10 @@ async function handleNewTopicAdmitted(data, ctx) {
         pendingSubstituteTrigger: substituteTrigger,
         pendingSubstituteControlCard: shouldSendSubstituteControlCard,
         pendingSender: newTopicSender,
-        // R6-B1: freeze the plain-human steer authorization into the NEW-TOPIC opening
-        // metadata from inbound source facts (the same helper the follow-up twin uses).
+        // Freeze steer authorization into the NEW-TOPIC opening metadata from
+        // inbound source facts (the same helper the follow-up twin uses). The two
+        // allowed lanes are a plain human turn and a foreign bot carrying the
+        // explicit, language-neutral `@steer` directive; ordinary bot traffic is serial.
         // A brand-new session has no VC receiver yet; foreign-bot maps to the bot-sender
         // fact here. buildReservedInitialInput COPIES this onto the opening payload;
         // forkReservedInitialSession never infers it.
@@ -14944,6 +15214,7 @@ async function handleNewTopicAdmitted(data, ctx) {
             isForeignBot: isBotSenderType
                 || isKnownPeerBot(config.session.dataDir, larkAppId, senderOpenId),
             isBotSenderType,
+            explicitBotSteer: botSteerDirective.requested,
             substituteTrigger: !!substituteTrigger,
             controlRewrite: !!newTopicGrill,
             messageListener: !!messageListener,
@@ -15579,18 +15850,29 @@ async function handleBotAdded(chatId, operatorOpenId, larkAppId, opts) {
     }
 }
 export const __testOnly_handleBotAdded = handleBotAdded;
-/** Reverse-lookup a foreign bot's display name for a sender open_id observed on
- *  this app's WS events. Priority:
+/** Reverse-lookup a foreign bot's display name for a sender observed on this
+ *  app's WS events. Priority:
+ *    0) union_id → current sibling name — rename-proof. The sender's tenant-
+ *       stable union_id (stamped on the event) maps to the one locally-configured
+ *       sibling that learned it, whose bots-info.json botName is rewritten by its
+ *       OWN daemon on every rename. This is the only source that reflects a rename
+ *       when the renamed bot merely SENDS to us (no @ of it flows through us, so
+ *       the by-name cross-ref below never refreshes on that event).
  *    1) bot-openids-${larkAppId}.json — per-app cross-ref populated by
  *       updateBotOpenIdCrossRef when @mentions go through us. Open_id is
  *       per-app scoped, so this is the authoritative map for this larkAppId.
+ *       (The writer now evicts pre-rename aliases, so a stale name here self-heals
+ *       the next time that bot is @-mentioned by its new name.)
  *    2) bots-info.json — fallback for bots not yet in our cross-ref but
  *       registered as botmux peers (matches by their self-reported open_id;
  *       only works when the peer's app id space coincides with ours).
- *  Returns "Bot" if neither lookup hits — keeps the prefix readable rather
- *  than blocking the message.
+ *  Returns "Bot" if nothing hits — keeps the prefix readable rather than
+ *  blocking the message.
  */
-function lookupForeignBotName(senderOpenId, larkAppId) {
+function lookupForeignBotName(senderOpenId, larkAppId, senderUnionId) {
+    const currentName = resolveSiblingBotNameByUnionId(config.session.dataDir, larkAppId, senderUnionId);
+    if (currentName)
+        return currentName;
     for (const [name, openId] of Object.entries(readPeerCrossRef(config.session.dataDir, larkAppId))) {
         if (openId === senderOpenId)
             return name;
@@ -15660,7 +15942,13 @@ async function handleThreadReplyAdmitted(data, ctx, prepared) {
         senderOpenIdForPrefix !== selfBotOpenId &&
         (isBotSenderType ||
             isKnownPeerBot(config.session.dataDir, larkAppId, senderOpenIdForPrefix));
-    const foreignBotName = isForeignBot ? lookupForeignBotName(senderOpenIdForPrefix, larkAppId) : undefined;
+    const botSteerDirective = isForeignBot
+        ? parseBotSteerDirective(parsed.content)
+        : { requested: false, content: parsed.content };
+    if (botSteerDirective.requested)
+        parsed.content = botSteerDirective.content;
+    const senderUnionIdForPrefix = parsed.senderUnionId || data?.sender?.sender_id?.union_id;
+    const foreignBotName = isForeignBot ? lookupForeignBotName(senderOpenIdForPrefix, larkAppId, senderUnionIdForPrefix) : undefined;
     const botSenderPrefix = isForeignBot
         ? `${tr('daemon.foreign_bot_mention_prefix', { botName: foreignBotName }, localeForBot(larkAppId))}\n`
         : '';
@@ -15971,6 +16259,7 @@ async function handleThreadReplyAdmitted(data, ctx, prepared) {
                 session.lastCallerOpenId = threadSenderOpenId;
                 session.lastMessageAt = new Date(now).toISOString();
                 session.scope = scope;
+                fillNativeTopicId(session, scope, parsed.threadId);
                 let cmdPending;
                 if (cmd === '/repo') {
                     const { pinnedWorkingDir } = await resolvePinnedWorkingDir({ scope, anchor, chatId: threadChatId, chatType: ctxChatType, larkAppId });
@@ -16063,6 +16352,10 @@ async function handleThreadReplyAdmitted(data, ctx, prepared) {
     }
     logger.info(`Reply in ${scope}-scope session ${anchor.substring(0, 12)}: ${content.substring(0, 100)} (resources: ${resources.length})`);
     let ds = activeSessions.get(sessionKey(anchor, larkAppId));
+    if (ds && fillNativeTopicId(ds.session, scope, parsed.threadId)) {
+        sessionStore.updateSession(ds.session);
+        publishNativeTopicLinkPatch(ds);
+    }
     // If another bot already owns this anchor, ignore unmentioned replies here as a
     // second line of defense. Explicit @mentions are still allowed to spin up/take over.
     // For chat-scope: another bot's session in the same chat is keyed by its own chatId.
@@ -16193,14 +16486,15 @@ async function handleThreadReplyAdmitted(data, ctx, prepared) {
         // opening path — would silently drop it. When a claim token IS held (a
         // concurrent first turn owns the opening) or a queued-activation ACK is
         // pending, a live worker MUST keep buffering to preserve FIFO submission order.
-        // Codex App steer authorization (Blocking 1, decision A) — computed ONCE here,
+        // Codex App steer authorization — computed ONCE here,
         // BEFORE every admission/fork branch below (R5-B1-1): the earliest tail-admit
         // (initialStartPending follower), pending-repo follower, worker-null refork,
         // and new-topic auto-create paths all need the same frozen value, and several
         // of them return before the later existing-owner branch. Explicit positive
-        // ONLY for a plain-human-interactive turn (real human sender; none of
-        // foreign-bot / bot-sender / substitute-rewrite / v3-grill / message-listener /
-        // VC receiver / VC origin / adopt). Never inferred from the delivery sink;
+        // only for a plain-human-interactive turn or a foreign bot carrying an
+        // explicit `@steer` directive. Plain @mentions, reports, other bot traffic,
+        // substitute-rewrite, v3-grill, message-listener, VC and adopt stay serial.
+        // Never inferred from the delivery sink;
         // ignored by acceptCodexAppDispatch for non-codex-app CLIs. A new-topic root
         // must FREEZE this into its opening payload — forkReservedInitialSession is
         // shared by bot-added / scheduler / system bootstrap and only COPIES an
@@ -16212,6 +16506,7 @@ async function handleThreadReplyAdmitted(data, ctx, prepared) {
             adopted: !!ds?.adoptedFrom,
             isForeignBot,
             isBotSenderType,
+            explicitBotSteer: botSteerDirective.requested,
             substituteTrigger: !!substituteTrigger,
             controlRewrite: !!threadGrill,
             messageListener: !!ctx.messageListener,
@@ -16521,6 +16816,7 @@ async function handleThreadReplyAdmitted(data, ctx, prepared) {
             session.quoteTargetSenderIsBot = isForeignBot;
             session.lastMessageAt = new Date(now).toISOString();
             session.scope = scope;
+            fillNativeTopicId(session, scope, parsed.threadId);
             const groupChatName = await groupChatNamePromise;
             if (groupChatName)
                 session.chatDisplayName = groupChatName;
@@ -17813,23 +18109,15 @@ export async function startDaemon(botIndex) {
         botConfigs = loadBotConfigs();
         cfg = loadBotConfigAtIndex(idx);
     }
-    // One-time, lock-protected catalog bootstrap. This runs only after the
-    // complete bots.json has parsed successfully, and the helper re-reads the
-    // latest file under its lock before deciding. Explicit [] and legacy agent
-    // policy are durable opt-outs. Reload the selected config after a write so
-    // this daemon exposes the seeded selection card immediately on the same boot.
+    // 这里曾经有一次「给本 bot 播种默认会议角色预设」的启动写盘。已退役：角色预设
+    // 改成全 fleet 共享目录 + 读路径内置默认（services/vc-meeting-shared-consumer-
+    // catalog.ts），没有任何 bot 还需要自己那份 per-bot 拷贝。退役的两个理由：
+    //   1. 播种出来的 per-bot `consumerProfiles` 会永久遮蔽共享目录——操作者在
+    //      Dashboard 改共享预设，被播种过的 bot 完全不跟随；
+    //   2. 那次写盘还会把「另一个 bot」的 appId 焊进预设（旧的换人兜底），正是
+    //      「拉 A 进会却把 B 拉进监听群」的源头。
+    // 现在启动路径对 VC 预设零写盘，fleet 里几十个 daemon 同时启动也不再有写竞争。
     const selectedAppId = cfg.larkAppId;
-    const profileBootstrap = await bootstrapVcMeetingDefaultConsumerProfile(selectedAppId);
-    if (profileBootstrap.ok) {
-        if (profileBootstrap.seeded) {
-            logger.info(`[vc-agent] seeded default meeting minutes profile listener=${selectedAppId} `
-                + `agent=${profileBootstrap.agentAppId}`);
-        }
-    }
-    else if (!profileBootstrap.ok) {
-        logger.warn(`[vc-agent] default consumer profile bootstrap skipped: ${profileBootstrap.reason}`
-            + `${profileBootstrap.error ? ` (${profileBootstrap.error})` : ''}`);
-    }
     // A bootstrap failure is not authority to keep an earlier in-memory config.
     // Every explicit PM2 daemon must prove its same raw slot and App identity
     // immediately before registerBot, regardless of the bootstrap result.
@@ -18622,6 +18910,14 @@ export async function startDaemon(botIndex) {
             checkRequiredScopes(cfg.larkAppId).catch(err => {
                 logger.debug(`[${cfg.larkAppId}] required-scope check failed: ${err?.message ?? err}`);
             });
+            // Ensure VC meeting events are subscribed so ANY invited bot can receive
+            // meeting invites (bot-agnostic auto-join). Check-first + best-effort: a
+            // read-only probe over the cached web session, auto-subscribing only when
+            // events are missing. Never blocks boot; the fn itself skips VC-inactive
+            // bots via vcMeetingAgentConfigActive.
+            ensureVcMeetingEventsSubscribed(cfg.larkAppId).catch(err => {
+                logger.debug(`[${cfg.larkAppId}] VC event subscription check failed: ${err?.message ?? err}`);
+            });
         }
         // 主动开工 — 场景①: the bot.added event can't be self-verified via API, and
         // if it isn't subscribed the handler simply never fires (no runtime signal).