botmux 3.7.1 → 3.8.0

package/dist/core/worker-pool.js

@@ -11,16 +11,18 @@ import { fileURLToPath } from 'node:url';
 import { ensureSkills, ensureAskSkill, ensurePluginSkills, ensureWhiteboardSkill, removeGlobalBotmuxSkills } from '../skills/installer.js';
 import { shouldInstallGlobalSkills } from '../skills/injection-mode.js';
 import { whiteboardEnabled } from '../services/whiteboard-store.js';
+import { cliSupportsNativeUsage } from '../services/transcript-resolver.js';
 import { cleanupTraexAskHooks, installHook } from '../adapters/hook-installer.js';
 import { hookCommandFor } from '../adapters/hook-command.js';
 import { randomBytes, randomUUID } from 'node:crypto';
 import { config } from '../config.js';
 import * as sessionStore from '../services/session-store.js';
 import * as asyncTriggerStore from '../services/async-trigger-store.js';
+import { markMessageListenerRunPreviewFailed, markMessageListenerRunPreviewReplied, markMessageListenerRunPreviewRunning, } from '../services/message-listener-run-preview-store.js';
 import { persistStreamCardState, rememberLastCliInput } from './session-manager.js';
 import { fallbackTurnId, isSubstituteTurn } from './reply-target.js';
 import { updateMessage, deleteMessage, sendEphemeralCard, sendUserMessage, addReaction, removeReaction, getMessageChatId, MessageWithdrawnError } from '../im/lark/client.js';
-import { buildStreamingCard, buildPrivateSnapshotCard, buildSessionCard, buildTuiPromptCard, buildTuiPromptResolvedCard, buildRelayedFrozenCard, getCliDisplayName } from '../im/lark/card-builder.js';
+import { buildStreamingCard, buildPrivateSnapshotCard, buildSessionCard, buildTuiPromptCard, buildTuiPromptResolvedCard, buildTuiPromptFailedCard, buildRelayedFrozenCard, getCliDisplayName } from '../im/lark/card-builder.js';
 import { loadFrozenCards, saveFrozenCards } from '../services/frozen-card-store.js';
 import { hashUrlForLog, cancelRiffTaskById } from '../adapters/backend/riff-backend.js';
 import { logger } from '../utils/logger.js';
@@ -29,15 +31,19 @@ import { traeHome } from '../services/traex-paths.js';
 import { botLocale, localeForBot, t as tr } from '../i18n/index.js';
 import { claudeJsonlPathForSession } from '../adapters/cli/claude-code.js';
 import { findUniqueClaudeSessionByCwd } from './session-discovery.js';
-import { buildMarkdownCard, buildContextualReplyCard } from '../im/lark/md-card.js';
+import { buildMarkdownCard, buildContextualReplyCard, } from '../im/lark/md-card.js';
+import { getSessionUsageSnapshot } from './cost-calculator.js';
 import { renderBrandTemplate } from '../im/lark/brand-template.js';
 import { replyToDocComment, chunkCommentText, unsubscribeDocFile, removeCommentReaction } from '../im/lark/doc-comment.js';
 import { listDocSubscriptionsForSession, removeDocSubscription } from '../services/doc-subs-store.js';
 import { TmuxBackend } from '../adapters/backend/tmux-backend.js';
 import { HerdrBackend } from '../adapters/backend/herdr-backend.js';
+import { ZmxBackend } from '../adapters/backend/zmx-backend.js';
+import { backendSupportsWebTerminal } from '../adapters/backend/capabilities.js';
 import { sandboxEnabled } from '../adapters/backend/sandbox.js';
-import { isSuspendableBackendType, getSessionPersistentBackendType, persistentBackendTargetForSession, killPersistentBackendTarget, probePersistentBackendTarget, managedTargetsForCliChange, resolvePairedSpawnBackendType, resolvePersistentBackendTarget } from './persistent-backend.js';
-import { getBot, getAllBots, resolveBrandLabel } from '../bot-registry.js';
+import { isStrongManagedHerdrAgentName, managedHerdrAgentName, } from '../adapters/backend/session-backend-selector.js';
+import { isSuspendableBackendType, getSessionPersistentBackendType, persistentBackendTargetForSession, persistentSessionName, killPersistentBackendTarget, killPersistentSession, probePersistentBackendTarget, resolvePairedSpawnBackendType, resolvePersistentBackendTarget } from './persistent-backend.js';
+import { getBot, getAllBots, resolveBrandLabel, getLoadedConfigPath, resolveUsageDisplay } from '../bot-registry.js';
 import { RestartCoordinator } from './restart-coordinator.js';
 import { runtimeBuildIdentity } from '../utils/runtime-build-id.js';
 /** A random id minted once per daemon process (this lifetime). Stamped onto
@@ -45,6 +51,38 @@ import { runtimeBuildIdentity } from '../utils/runtime-build-id.js';
  *  distinguishable from a pane surviving a daemon restart (different id). */
 const DAEMON_BOOT_ID = randomUUID();
 const restartCoordinator = new RestartCoordinator();
+const lifecycleRetiringWorkers = new WeakMap();
+const transferRetiringWorkers = new WeakSet();
+function trackLifecycleRetirement(ds, worker) {
+    let workers = lifecycleRetiringWorkers.get(ds);
+    if (!workers) {
+        workers = new Set();
+        lifecycleRetiringWorkers.set(ds, workers);
+    }
+    if (workers.has(worker))
+        return;
+    workers.add(worker);
+    const release = () => {
+        const current = lifecycleRetiringWorkers.get(ds);
+        current?.delete(worker);
+        if (current?.size === 0)
+            lifecycleRetiringWorkers.delete(ds);
+    };
+    worker.once('exit', release);
+}
+function clearLifecycleRetirement(ds, worker) {
+    const workers = lifecycleRetiringWorkers.get(ds);
+    workers?.delete(worker);
+    if (workers?.size === 0)
+        lifecycleRetiringWorkers.delete(ds);
+}
+/** Symmetric lifecycle fence: relay must not start while another operation is
+ * still restarting, spawning, suspending, or closing this worker generation. */
+export function isSessionLifecycleInFlight(ds) {
+    return lifecycleRetiringWorkers.has(ds)
+        || restartCoordinator.activeAttemptId(ds.session.sessionId) !== undefined
+        || (!!ds.worker && !ds.worker.killed && ds.workerReady === false);
+}
 export function getDaemonBootId() {
     return DAEMON_BOOT_ID;
 }
@@ -62,19 +100,90 @@ function daemonCardLocalHomeLinkMode(ds) {
         ? 'lexical'
         : 'filesystem';
 }
+/** Read one frozen native-usage snapshot at the reply boundary. Card delivery
+ * remains best-effort even when a CLI has no supported transcript or a usage
+ * resolver fails. */
+export function getDaemonSessionUsageSnapshot(ds, effectiveCliId, opts) {
+    try {
+        const resolvedCliId = effectiveCliId ?? (ds.session.cliId
+            ?? ds.session.adoptedFrom?.cliId
+            ?? ds.adoptedFrom?.cliId
+            ?? getBot(ds.larkAppId).config.cliId);
+        return getSessionUsageSnapshot({
+            cliId: resolvedCliId,
+            sessionId: ds.session.sessionId,
+            cliSessionId: ds.session.cliSessionId
+                ?? ds.session.adoptedFrom?.sessionId
+                ?? ds.adoptedFrom?.sessionId,
+            cwd: ds.workingDir
+                ?? ds.session.workingDir
+                ?? ds.session.adoptedFrom?.cwd
+                ?? ds.adoptedFrom?.cwd,
+            // Enable the BOT_HOME transcript fallback for CLI-data-redirected /
+            // sandboxed bots (same as the ledger and dashboard-row readers). Without
+            // it a read-isolated bot's transcript is invisible and the card shows no
+            // usage even though it exists under BOT_HOME.
+            larkAppId: ds.larkAppId ?? ds.session.larkAppId,
+            // Reply cards read at the exact turn boundary (fresh); the live streaming
+            // card refreshes on every status tick and rides the reader's reparse
+            // throttle instead (fresh:false) to stay off the disk.
+            fresh: opts?.fresh ?? true,
+        });
+    }
+    catch (error) {
+        logger.warn(`[${ds.session.sessionId.slice(0, 8)}] Failed to read card usage snapshot: `
+            + `${error instanceof Error ? error.message : String(error)}`);
+        return { context: null, tokens: null };
+    }
+}
+/** Reply-card (final output / adopt preamble / local-turn) usage. Only the
+ * `'footer'` display mode surfaces usage here; `'streaming'` and `'off'` yield a
+ * concrete empty snapshot. Keeping the display decision out of the native usage
+ * reader leaves accounting and dashboard consumers intact; the concrete empty
+ * snapshot (rather than undefined) also freezes "hidden" over final-output
+ * retries. */
+export function getDaemonReplyCardUsageSnapshot(ds, effectiveCliId) {
+    try {
+        if (resolveUsageDisplay(ds.larkAppId) !== 'footer') {
+            return { context: null, tokens: null };
+        }
+    }
+    catch {
+        // Missing runtime config → default 'streaming' → no footer usage.
+        return { context: null, tokens: null };
+    }
+    return getDaemonSessionUsageSnapshot(ds, effectiveCliId);
+}
+/** Streaming-card usage. Only the `'streaming'` display mode (the default)
+ * surfaces usage in the live card body; `'footer'` and `'off'` yield empty.
+ * Returns a concrete empty snapshot on any config failure so the streaming
+ * renderer stays best-effort. `fresh` forces an exact read at meaningful
+ * boundaries (turn end / idle); intra-turn ticks leave it false to ride the
+ * reader's reparse throttle and stay off the disk. */
+export function getDaemonStreamingCardUsageSnapshot(ds, effectiveCliId, opts) {
+    try {
+        if (resolveUsageDisplay(ds.larkAppId) !== 'streaming') {
+            return { context: null, tokens: null };
+        }
+    }
+    catch {
+        // Missing runtime config → default 'streaming' → show usage (best-effort).
+    }
+    return getDaemonSessionUsageSnapshot(ds, effectiveCliId, { fresh: opts?.fresh ?? false });
+}
 import { normalizeBrand } from '../im/lark/lark-hosts.js';
 import { dashboardEventBus } from './dashboard-events.js';
 import { composeRowFromActive, composeRowFromClosed } from './dashboard-rows.js';
-import { publishAttentionPatch } from './session-activity.js';
+import { publishAttentionPatch, publishClosedSessionPatch } from './session-activity.js';
 import { knownBotOpenIdsFromCrossRef } from '../utils/bot-routing.js';
 import { emitSessionLifecycleHook, emitSessionStateTransitionHook } from '../services/session-lifecycle-hooks.js';
 import { anchorUsageForDaemonSession, recordOwnershipForDaemonSession, recordUsageForDaemonSession, reconcileUsageForDaemonSession } from '../services/usage-ledger.js';
 import { isStructuredBridgeAdoptCli } from '../services/structured-bridge-clis.js';
 import { ensureGatewayEntry } from './plugins/mcp/gateway-installer.js';
-import { activeSessionKey, sessionKey, sessionAnchorId, isDocNativeSession } from './types.js';
+import { activeSessionKey, sessionKey, sessionAnchorId, storedSessionAnchorId, isDocNativeSession, larkTransportEnabled } from './types.js';
 import { DONE_REACTION_EMOJI_TYPE } from './pending-response.js';
 import { buildTerminalUrl } from './terminal-url.js';
-import { prependBotmuxBin } from './botmux-wrapper.js';
+import { prependBotmuxBin, resolveBotmuxWrapperBinDir } from './botmux-wrapper.js';
 import { usageLimitStateKey } from '../utils/cli-usage-limit.js';
 import { evaluateVcMeetingManagedSend, resolveVcMeetingImTurnOrigin, } from '../services/vc-meeting-send-policy.js';
 import { finishVcMeetingImReply, prepareVcMeetingDeliveryReply, prepareVcMeetingImReply, } from '../services/vc-meeting-im-reply.js';
@@ -86,14 +195,20 @@ import { isLocalCliOpenEnabled, isLocalCliOpenReady } from '../services/local-cl
 import { isSilentScheduledTurn } from './silent-schedule-turns.js';
 import { isTriggerFinalSuppressed } from './trigger-final-suppression.js';
 import { writeDeferredTopicBinding } from './deferred-topic-binding.js';
-import { deferWorkerSpawnDuringDeviceIsolation } from './device-isolation-activation.js';
+import { currentDeviceIsolationFreezeLease, deferWorkerSpawnDuringDeviceIsolation, } from './device-isolation-activation.js';
 import { buildBotmuxLarkNativeSessionTitle, extractBotmuxLarkNativeSessionTitlePrompt, } from './session-title.js';
 import { acknowledgeSessionReady } from './session-ready-handshake.js';
 import { recordDispatchInputCommit } from './dispatch.js';
+import { sendWorkerIpc } from './worker-ipc.js';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 const WORKER_SIGTERM_BACKSTOP_MS = 2_000;
 const WORKER_SIGKILL_BACKSTOP_MS = 7_000;
+const CLOSE_FENCE_WARN_MS = 8_000;
+// Peer relay waits 5s for the whole transfer request. Tmux observer detach has
+// its own 3s command timeout, so this fence leaves headroom for routing/fork.
+const TRANSFER_DETACH_FENCE_MS = 3_500;
+const TRANSFER_FORCE_EXIT_MS = 500;
 const WORKER_REDACTED_ENV_KEYS = ['GITHUB_TOKEN', 'GH_TOKEN'];
 function workerForkEnv(base) {
     const env = { ...base };
@@ -186,6 +301,18 @@ export function isRelayableRealSession(ds) {
         return true;
     return false;
 }
+/** A worker-less row that never represented a CLI and carries no deferred
+ * user intent. Only this narrow class is safe to evict as command scaffolding. */
+export function isDisposableCommandScratch(ds) {
+    return !ds.worker
+        && !ds.pendingRepo
+        && ds.pendingPrompt === undefined
+        && ds.pendingRawInput === undefined
+        && !ds.adoptedFrom
+        && !ds.session.adoptedFrom
+        && !ds.session.queued
+        && !isRelayableRealSession(ds);
+}
 // Per-bot opt-out: when true, botmux never posts/patches the live streaming
 // session card. Read fresh from the in-memory registry so a dashboard toggle
 // takes effect without a daemon restart. The `/card` command can override it
@@ -223,11 +350,34 @@ function doneReactionEmojiFor(ds) {
         return DONE_REACTION_EMOJI_TYPE;
     }
 }
+/** Worker lifecycle readiness is independent from Web Terminal availability.
+ * Legacy/test sessions predate workerReady, so retain the old port inference
+ * only while the explicit flag is absent. */
+export function workerHasInitialized(ds) {
+    return ds.workerReady === true
+        || (ds.workerReady === undefined
+            && sessionSupportsWebTerminal(ds)
+            && !!(ds.workerPort ?? ds.session.webPort));
+}
+/** Capability of the backend frozen onto this worker/session generation. */
+export function sessionSupportsWebTerminal(ds) {
+    const backendType = ds.initConfig?.backendType ?? ds.session.backendType;
+    // Pre-backend-stamp sessions are legacy tmux sessions and retain Web TUI.
+    return backendType === undefined || backendSupportsWebTerminal(backendType);
+}
+/** Empty means this session intentionally has no Web Terminal surface. */
+export function readableTerminalUrlFor(ds) {
+    return sessionSupportsWebTerminal(ds) && (ds.workerPort ?? ds.session.webPort)
+        ? buildTerminalUrl(ds)
+        : '';
+}
 // Per-bot opt-in: the writable terminal link to embed directly in the streaming
 // card body (token included). Returns undefined unless the bot enabled it AND
 // the worker port/token are known. Exported for card-handler's re-renders so the
 // link stays put across button-driven card updates.
 export function writableTerminalLinkFor(ds) {
+    if (!sessionSupportsWebTerminal(ds))
+        return undefined;
     try {
         if (getBot(ds.larkAppId).config.writableTerminalLinkInCard !== true)
             return undefined;
@@ -251,13 +401,13 @@ function scheduleLocalCliOpenReadinessPatch(ds) {
         ds.pendingLocalCliButtonRefresh = true;
         return;
     }
-    if (!ds.streamCardId || !ds.workerPort)
+    if (!ds.streamCardId || !workerHasInitialized(ds))
         return;
     ds.pendingLocalCliButtonRefresh = undefined;
     const botCfg = getBot(ds.larkAppId).config;
     const effectiveCliId = sessionCliId(ds, botCfg);
     const status = ds.usageLimit ? 'limited' : (ds.lastScreenStatus ?? 'starting');
-    const cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), buildTerminalUrl(ds), ds.currentTurnTitle || ds.session.title || getCliDisplayName(effectiveCliId), ds.lastScreenContent ?? '', status, effectiveCliId, ds.displayMode ?? 'hidden', ds.streamCardNonce, ds.currentImageKey, !!ds.adoptedFrom, false, localeForBot(ds.larkAppId), status === 'limited' ? ds.usageLimit : undefined, writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: effectiveCliId }));
+    const cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readableTerminalUrlFor(ds), ds.currentTurnTitle || ds.session.title || getCliDisplayName(effectiveCliId), ds.lastScreenContent ?? '', status, effectiveCliId, ds.displayMode ?? 'hidden', ds.streamCardNonce, ds.currentImageKey, !!ds.adoptedFrom, false, localeForBot(ds.larkAppId), status === 'limited' ? ds.usageLimit : undefined, writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: effectiveCliId }), getDaemonStreamingCardUsageSnapshot(ds, effectiveCliId));
     scheduleCardPatch(ds, cardJson);
 }
 function flushPendingLocalCliOpenReadinessPatch(ds) {
@@ -266,6 +416,100 @@ function flushPendingLocalCliOpenReadinessPatch(ds) {
     ds.pendingLocalCliButtonRefresh = undefined;
     scheduleLocalCliOpenReadinessPatch(ds);
 }
+/** How often the live streaming card is re-PATCHed with fresh usage while a
+ *  turn executes. 12s stays off the prompt-cache-friendly path; the tick reads
+ *  with fresh:true so it bypasses (does not merely out-wait) the usage reader's
+ *  15s reparse throttle — the transcript grows per tool step, so each refresh
+ *  folds only the newly appended bytes. */
+export const USAGE_REFRESH_INTERVAL_MS = 12_000;
+/** Single source of truth for "this session should be periodically re-rendering
+ *  its streaming card with fresh usage right now". Used by both the arm gate and
+ *  the interval tick so arm/clear is a state-boundary invariant, not tied to one
+ *  PATCH path. Requires: an actively-working turn, a live (non-sentinel, not a
+ *  new-turn handoff) streaming card, the worker initialized (NOT a Web-Terminal
+ *  port — ZMX reports ready with port=0), usageDisplay='streaming', and a CLI
+ *  that actually has a native-usage transcript (gemini/opencode/pi/… have none
+ *  → nothing to show). */
+export function usageRefreshShouldRun(ds) {
+    if (ds.lastScreenStatus !== 'working')
+        return false;
+    if (streamingCardDisabled(ds) || ds.suppressRecoveryCard)
+        return false;
+    // New-turn handoff window: beginNewTurn sets streamCardPending=true and swaps
+    // currentTurnTitle while the OLD streamCardId is still present (the live
+    // worker is still `working`). A stray tick here would PATCH the previous
+    // card with the NEW turn's title/content before the next screen_update's
+    // managed/silent gate runs. The POST-in-flight sentinel is also covered.
+    if (ds.streamCardPending)
+        return false;
+    if (!ds.streamCardId || ds.streamCardId === CARD_POSTING_SENTINEL)
+        return false;
+    if (!workerHasInitialized(ds))
+        return false;
+    if (!cliSupportsNativeUsage(sessionCliId(ds, getBot(ds.larkAppId).config)))
+        return false;
+    try {
+        if (resolveUsageDisplay(ds.larkAppId) !== 'streaming')
+            return false;
+    }
+    catch { /* missing config → default streaming → allowed */ }
+    return true;
+}
+/** Re-render the current streaming card with the freshest usage snapshot. The
+ *  interval tick is self-correcting: if the session no longer qualifies (turn
+ *  settled, card gone, limit, etc.) it clears its own timer, bounding any missed
+ *  explicit clear to a single interval. Reads with fresh:true so the periodic
+ *  PATCH actually beats the cost reader's 15s reparse throttle. */
+export function refreshStreamingCardUsage(ds) {
+    if (!usageRefreshShouldRun(ds)) {
+        clearUsageRefreshTimer(ds);
+        return;
+    }
+    const botCfg = getBot(ds.larkAppId).config;
+    const effectiveCliId = sessionCliId(ds, botCfg);
+    const cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), 
+    // readableTerminalUrlFor (NOT raw buildTerminalUrl): now that this tick can
+    // run for a port=0 backend (ZMX reports ready without a Web Terminal), a raw
+    // URL would render a fake `:undefined`/backend-less link. Mirror every other
+    // card path — empty string when there is no real terminal.
+    readableTerminalUrlFor(ds), ds.currentTurnTitle || ds.session.title || getCliDisplayName(effectiveCliId), ds.lastScreenContent ?? '', ds.lastScreenStatus ?? 'working', effectiveCliId, ds.displayMode ?? 'hidden', ds.streamCardNonce, ds.currentImageKey, !!ds.adoptedFrom, false, localeForBot(ds.larkAppId), cardUsageLimit(ds), writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: effectiveCliId }), 
+    // fresh:true — the whole point of the tick is to break the 15s throttle so
+    // the total/turn usage actually climbs on-screen every interval.
+    getDaemonStreamingCardUsageSnapshot(ds, effectiveCliId, { fresh: true }));
+    scheduleCardPatch(ds, cardJson);
+}
+/** Bring the periodic usage refresh in line with current state — arm when the
+ *  session qualifies, clear otherwise. Idempotent; safe to call after ANY
+ *  lastScreenStatus assignment or streaming-card lifecycle change. This is the
+ *  single choke point that makes the timer a state-boundary invariant. */
+export function syncUsageRefreshTimer(ds) {
+    if (usageRefreshShouldRun(ds))
+        armUsageRefreshTimer(ds);
+    else
+        clearUsageRefreshTimer(ds);
+}
+/** Arm the periodic usage refresh. Idempotent — a running timer is left in
+ *  place. Callers gate via syncUsageRefreshTimer/usageRefreshShouldRun; this
+ *  just owns the setInterval. */
+function armUsageRefreshTimer(ds) {
+    if (ds.usageRefreshTimer)
+        return;
+    ds.usageRefreshTimer = setInterval(() => {
+        try {
+            refreshStreamingCardUsage(ds);
+        }
+        catch { /* best-effort */ }
+    }, USAGE_REFRESH_INTERVAL_MS);
+    // Don't keep the daemon event loop alive solely for this cosmetic refresh.
+    ds.usageRefreshTimer.unref?.();
+}
+/** Stop the periodic usage refresh (turn ended, card gone, session closing). */
+function clearUsageRefreshTimer(ds) {
+    if (ds.usageRefreshTimer) {
+        clearInterval(ds.usageRefreshTimer);
+        ds.usageRefreshTimer = undefined;
+    }
+}
 /**
  * PATCH the live streaming card with the freshest riff sandbox URL. Mirrors
  * {@link scheduleLocalCliOpenReadinessPatch}: when the card POST is still
@@ -290,7 +534,7 @@ export function scheduleRiffAccessUrlPatch(ds) {
     const botCfg = getBot(ds.larkAppId).config;
     const effectiveCliId = sessionCliId(ds, botCfg);
     const status = ds.usageLimit ? 'limited' : (ds.lastScreenStatus ?? 'starting');
-    const cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), buildTerminalUrl(ds), ds.currentTurnTitle || ds.session.title || getCliDisplayName(effectiveCliId), ds.lastScreenContent ?? '', status, effectiveCliId, ds.displayMode ?? 'hidden', ds.streamCardNonce, ds.currentImageKey, !!ds.adoptedFrom, false, localeForBot(ds.larkAppId), status === 'limited' ? ds.usageLimit : undefined, writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: effectiveCliId }));
+    const cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), buildTerminalUrl(ds), ds.currentTurnTitle || ds.session.title || getCliDisplayName(effectiveCliId), ds.lastScreenContent ?? '', status, effectiveCliId, ds.displayMode ?? 'hidden', ds.streamCardNonce, ds.currentImageKey, !!ds.adoptedFrom, false, localeForBot(ds.larkAppId), status === 'limited' ? ds.usageLimit : undefined, writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: effectiveCliId }), getDaemonStreamingCardUsageSnapshot(ds, effectiveCliId));
     scheduleCardPatch(ds, cardJson);
 }
 function flushPendingRiffUrlPatch(ds) {
@@ -336,6 +580,7 @@ function sessionAgentConfig(ds, botCfg) {
         cliPathOverride: ds.session.cliPathOverride,
         wrapperCli: ds.session.wrapperCli,
         model: ds.session.model,
+        reasoningEffort: ds.session.reasoningEffort,
     };
 }
 function loadKnownBotOpenIdsForApp(larkAppId) {
@@ -410,14 +655,13 @@ function scheduleUsageLimitCardPatch(ds) {
         return;
     if (ds.lastScreenStatus !== 'limited')
         return;
-    const port = ds.workerPort ?? ds.session.webPort;
-    if (!ds.streamCardId || ds.streamCardId === CARD_POSTING_SENTINEL || !port)
+    if (!ds.streamCardId || ds.streamCardId === CARD_POSTING_SENTINEL || !workerHasInitialized(ds))
         return;
     const bot = getBot(ds.larkAppId);
     const effectiveCliId = sessionCliId(ds, bot.config);
-    const readUrl = buildTerminalUrl(ds);
+    const readUrl = readableTerminalUrlFor(ds);
     const turnTitle = ds.currentTurnTitle || ds.session.title || getCliDisplayName(effectiveCliId);
-    const cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, turnTitle, ds.lastScreenContent ?? '', 'limited', effectiveCliId, ds.displayMode ?? 'hidden', ds.streamCardNonce, ds.currentImageKey, !!ds.adoptedFrom, false, localeForBot(ds.larkAppId), ds.usageLimit, writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: effectiveCliId }));
+    const cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, turnTitle, ds.lastScreenContent ?? '', 'limited', effectiveCliId, ds.displayMode ?? 'hidden', ds.streamCardNonce, ds.currentImageKey, !!ds.adoptedFrom, false, localeForBot(ds.larkAppId), ds.usageLimit, writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: effectiveCliId }), getDaemonStreamingCardUsageSnapshot(ds, effectiveCliId));
     scheduleCardPatch(ds, cardJson);
 }
 function armUsageLimitRetryTimer(ds, previous) {
@@ -556,8 +800,8 @@ export function recallFrozenCards(ds) {
  * manually summon a live card in an otherwise-quiet session. Parks the current
  * card (if any) first so `recallFrozenCards` withdraws it once the fresh one
  * lands — the thread ends up with a single live card. Returns false when the
- * worker terminal isn't ready yet (no port), so the caller can surface a
- * friendly "not ready" message.
+ * worker isn't initialized yet, so the caller can surface a friendly "not
+ * ready" message. A ready backend without Web Terminal still gets the card.
  *
  * Note: this does NOT itself flip `ds.streamingCardForced` — the caller sets
  * that so the card keeps live-patching afterwards even when the bot opted out.
@@ -569,12 +813,11 @@ export async function postFreshStreamingCard(ds, sessionReply) {
         return false;
     if (isDocNativeSession(ds))
         return false;
-    const port = ds.workerPort ?? ds.session.webPort;
-    if (!port)
+    if (!workerHasInitialized(ds))
         return false;
     const botCfg = getBot(ds.larkAppId).config;
     const effectiveCliId = sessionCliId(ds, botCfg);
-    const readUrl = buildTerminalUrl(ds);
+    const readUrl = readableTerminalUrlFor(ds);
     const title = ds.currentTurnTitle || ds.session.title || getCliDisplayName(effectiveCliId);
     const status = ds.lastScreenStatus ?? 'idle';
     // Park the current card (no-op when there's none) so the fresh one replaces
@@ -586,7 +829,7 @@ export async function postFreshStreamingCard(ds, sessionReply) {
     const prevNonce = ds.streamCardNonce;
     const prevPending = ds.streamCardPending;
     ds.streamCardNonce = randomBytes(4).toString('hex');
-    const cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, title, ds.lastScreenContent ?? '', status, effectiveCliId, ds.displayMode ?? 'hidden', ds.streamCardNonce, ds.currentImageKey, !!ds.adoptedFrom, false, localeForBot(ds.larkAppId), cardUsageLimit(ds), writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: effectiveCliId }));
+    const cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, title, ds.lastScreenContent ?? '', status, effectiveCliId, ds.displayMode ?? 'hidden', ds.streamCardNonce, ds.currentImageKey, !!ds.adoptedFrom, false, localeForBot(ds.larkAppId), cardUsageLimit(ds), writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: effectiveCliId }), getDaemonStreamingCardUsageSnapshot(ds, effectiveCliId));
     ds.streamCardId = CARD_POSTING_SENTINEL;
     try {
         ds.streamCardId = await sessionReply(sessionAnchorId(ds), cardJson, 'interactive', ds.larkAppId, ds.currentReplyTarget?.turnId);
@@ -599,6 +842,10 @@ export async function postFreshStreamingCard(ds, sessionReply) {
         recallFrozenCards(ds);
         flushPendingLocalCliOpenReadinessPatch(ds);
         flushPendingRiffUrlPatch(ds);
+        // Manual /card during a working turn lands a live card whose subsequent
+        // screen_updates are working→working (no status edge) — arm the periodic
+        // usage refresh here, now that the real id is committed and pending cleared.
+        syncUsageRefreshTimer(ds);
         logger.info(`[${tag(ds)}] Posted streaming card via /card`);
         return true;
     }
@@ -608,6 +855,9 @@ export async function postFreshStreamingCard(ds, sessionReply) {
         ds.streamCardPending = prevPending;
         flushPendingLocalCliOpenReadinessPatch(ds);
         flushPendingRiffUrlPatch(ds);
+        // Rolled back to the prior card identity — re-sync so a restored still-live
+        // working card keeps (or resumes) its refresh rather than losing the timer.
+        syncUsageRefreshTimer(ds);
         logger.warn(`[${tag(ds)}] /card POST failed: ${err}`);
         return false;
     }
@@ -637,12 +887,11 @@ export function resolvePrivateCardAudience(ds) {
  * the audience list into the chat.
  */
 export async function postPrivateSnapshotCard(ds, audience) {
-    const port = ds.workerPort ?? ds.session.webPort;
-    if (!port)
+    if (!workerHasInitialized(ds))
         return { sent: 0, total: audience.length, notReady: true };
     const botCfg = getBot(ds.larkAppId).config;
     const effectiveCliId = sessionCliId(ds, botCfg);
-    const readUrl = buildTerminalUrl(ds);
+    const readUrl = readableTerminalUrlFor(ds);
     const title = ds.currentTurnTitle || ds.session.title || getCliDisplayName(effectiveCliId);
     const status = ds.lastScreenStatus ?? 'idle';
     const cardJson = buildPrivateSnapshotCard(readUrl, title, status, effectiveCliId, ds.currentImageKey, ds.lastScreenContent ?? '', ds.session.sessionId, sessionAnchorId(ds), localeForBot(ds.larkAppId), cardUsageLimit(ds));
@@ -716,6 +965,8 @@ export async function deliverWriteLinkCard(ds, operatorOpenId, cardJson) {
  * ({@link deliverWritableTerminalCardTo}, behind the `/term` slash command).
  */
 export function buildWritableTerminalCard(ds) {
+    if (!sessionSupportsWebTerminal(ds))
+        return null;
     // Riff backend: the sandbox URL is the writable link — no local worker/token needed.
     if (ds.riffAccessUrl) {
         const botCfg = getBot(ds.larkAppId).config;
@@ -744,6 +995,9 @@ export function buildWritableTerminalCard(ds) {
  * these private channels — it is never returned to the CLI caller / stdout.
  */
 export async function deliverWriteLinkCardToOwners(ds) {
+    if (!sessionSupportsWebTerminal(ds)) {
+        return { ok: false, error: 'terminal_unsupported', delivered: 0, total: 0, channels: [] };
+    }
     const cardJson = buildWritableTerminalCard(ds);
     if (!cardJson)
         return { ok: false, error: 'terminal_unavailable', delivered: 0, total: 0, channels: [] };
@@ -773,19 +1027,40 @@ export async function deliverWriteLinkCardToOwners(ds) {
  * 'not_ready' when the terminal isn't up yet, else the channel actually used.
  */
 export async function deliverWritableTerminalCardTo(ds, operatorOpenId) {
+    if (!sessionSupportsWebTerminal(ds))
+        return 'unsupported';
     const cardJson = buildWritableTerminalCard(ds);
     if (!cardJson)
         return 'not_ready';
     return deliverWriteLinkCard(ds, operatorOpenId, cardJson);
 }
 /**
- * DM a writable-terminal control card to the bot's owner(s) for a substitute-mode session.
+ * Build the private owner control card used by substitute-mode sessions.
+ * Web-capable backends keep the writable-terminal card; backends without a
+ * Web Terminal (currently ZMX) still need restart / close controls.
+ */
+function buildSubstituteControlCard(ds) {
+    const writableCard = buildWritableTerminalCard(ds);
+    if (writableCard)
+        return writableCard;
+    // A Web-capable backend returning null simply is not ready yet. Preserve the
+    // existing retry-on-next-ready behavior instead of sending a partial card.
+    if (sessionSupportsWebTerminal(ds))
+        return null;
+    const botCfg = getBot(ds.larkAppId).config;
+    const effectiveCliId = sessionCliId(ds, botCfg);
+    return buildSessionCard(ds.session.sessionId, sessionAnchorId(ds), '', // Manage-only: this backend intentionally has no Web Terminal URL.
+    ds.session.title || getCliDisplayName(effectiveCliId), effectiveCliId, true, !!ds.adoptedFrom, localeForBot(ds.larkAppId), isLocalCliOpenReady(ds, { cliId: effectiveCliId }));
+}
+/**
+ * DM a control card to the bot's owner(s) for a substitute-mode session.
+ * ZMX receives a manage-only card because it has no Web Terminal surface.
  * Guards against duplicate sends via `session.substituteControlCardSent`.
  */
 export async function deliverSubstituteControlCard(ds) {
     if (ds.session.substituteControlCardSent)
         return { sent: 0, total: 0 };
-    const cardJson = buildWritableTerminalCard(ds);
+    const cardJson = buildSubstituteControlCard(ds);
     if (!cardJson) {
         logger.warn(`[${tag(ds)}] substitute control card skipped: terminal not ready`);
         return { sent: 0, total: 0 };
@@ -863,6 +1138,12 @@ export async function deliverEphemeralOrReply(ds, operatorOpenId, content, msgTy
  * any previously queued value — only the latest state matters).
  */
 export function scheduleCardPatch(ds, cardJson, turnId) {
+    // Defense-in-depth transport gate: a no-transport session (apiOnly bot or HTTP
+    // virtual chat) has no real Feishu card to PATCH. Callers already suppress via
+    // managedAuxUiSuppressed, but guarding the flush entry too means a stray direct
+    // call can never dial updateMessage on a synthetic id.
+    if (!larkTransportEnabled({ chatId: ds.chatId, apiOnly: getBot(ds.larkAppId).config.apiOnly }))
+        return;
     // Bot opted out of the streaming card — never patch one into existence.
     // Turn-exact when the caller has turn context (screen updates): a substitute
     // turn arriving mid-PATCH must not suppress a normal turn's card (or vice
@@ -1104,6 +1385,8 @@ export function ensureClaudeFolderTrust(workingDir, stateJsonPath = join(homedir
 export function killWorker(ds) {
     restartCoordinator.cancelSession(ds.session.sessionId);
     clearUsageLimitState(ds);
+    ds.workerReady = false;
+    clearUsageRefreshTimer(ds);
     ds.localProcessAttestation = undefined;
     // A managed-turn capability belongs to one concrete worker generation.
     // Retiring (or observing the absence of) that generation must revoke the
@@ -1114,9 +1397,10 @@ export function killWorker(ds) {
     // must be invalidated so a late click cannot inject keys into a replacement
     // worker (or into nothing, if no replacement comes).
     invalidateStuckWarning(ds, 'killWorker');
+    invalidateTuiPrompt(ds, 'killWorker');
     if (!ds.worker || ds.worker.killed) {
         // No live worker to receive {type:'close'}, so its destroySession() — which
-        // tears down the persistent backing session (tmux/herdr/zellij) — never
+        // tears down the persistent backing session (tmux/herdr/zellij/zmx) — never
         // fires. Those sessions survive a worker exit BY DESIGN (idle-suspend /
         // lazy-restore keep the CLI alive for later resume), so /close on such a
         // session would leave an orphaned CLI running in tmux that still replies.
@@ -1129,6 +1413,8 @@ export function killWorker(ds) {
     }
     catch { /* IPC already closed */ }
     const w = ds.worker;
+    trackLifecycleRetirement(ds, w);
+    armCloseFence(ds, w);
     // riff：worker close 分支要有界 await 远端 task-cancel（destroySession 5s×2 重试，
     // 外层 race 8s）。默认 2s SIGTERM backstop 会在取消发出前掐死进程，已关闭话题
     // 的远端任务照跑——冻结为 riff 的会话放宽到 24s（层级：destroy 20s < worker 22s
@@ -1140,6 +1426,111 @@ export function killWorker(ds) {
     ds.workerToken = null;
     ds.workerViewToken = null;
 }
+function clearTransferWorkerState(ds, worker, reason) {
+    restartCoordinator.cancelSession(ds.session.sessionId);
+    clearUsageLimitState(ds);
+    ds.workerReady = false;
+    ds.localProcessAttestation = undefined;
+    ds.managedTurnOrigin = undefined;
+    invalidateStuckWarning(ds, reason);
+    invalidateTuiPrompt(ds, reason);
+    if (!worker || ds.worker === worker || ds.worker === null) {
+        ds.worker = null;
+        ds.workerPort = null;
+        ds.workerToken = null;
+        ds.workerViewToken = null;
+    }
+}
+/**
+ * Retire the old worker generation during a routing transfer without applying
+ * ordinary `/close` semantics to its backend.
+ *
+ * The replacement worker reuses the same logical session after this completion
+ * fence. Sending `close` here would call `destroySession()` in the old worker
+ * and race that replacement's persistent-backend reattach. A worker-less
+ * session is already detached, so unlike killWorker() this path must never
+ * destroy its orphaned backing resource.
+ */
+export async function detachWorkerForTransfer(ds, opts = {}) {
+    const w = ds.worker;
+    if (!w) {
+        clearTransferWorkerState(ds, null, 'detachWorkerForTransfer:no_worker');
+        return true;
+    }
+    if (w.killed && (w.exitCode !== null || w.signalCode !== null)) {
+        clearTransferWorkerState(ds, w, 'detachWorkerForTransfer:already_exited');
+        return true;
+    }
+    const requestId = randomUUID();
+    transferRetiringWorkers.add(w);
+    let acked = false;
+    let exited = w.exitCode !== null || w.signalCode !== null;
+    let finish;
+    const completion = new Promise((resolve) => { finish = resolve; });
+    const maybeFinish = () => {
+        if (acked && exited)
+            finish(true);
+    };
+    const onMessage = (raw) => {
+        const msg = raw;
+        if (msg.type !== 'transfer_detached' || msg.requestId !== requestId)
+            return;
+        acked = true;
+        maybeFinish();
+    };
+    const onExit = () => {
+        exited = true;
+        maybeFinish();
+    };
+    w.on('message', onMessage);
+    w.on('exit', onExit);
+    const timeout = setTimeout(() => finish(false), opts.timeoutMs ?? TRANSFER_DETACH_FENCE_MS);
+    timeout.unref?.();
+    // Do not await ChildProcess.send() itself: its callback can stall forever.
+    // The independent completion timer is the authority for this bounded fence.
+    void sendWorkerIpc(w, { type: 'detach_for_transfer', requestId })
+        .catch(() => finish(false));
+    const completed = await completion;
+    // A timed-out detach request may still be queued in Node's IPC channel and
+    // arrive later. Never hand new input back to that uncertain worker. SIGKILL
+    // skips its ordinary process-exit cleanup, preserving sandbox state and the
+    // persistent backing for a source-route cold reattach.
+    if (!completed && !exited) {
+        logger.warn(`[${tag(ds)}] Transfer detach timed out; hard-retiring old worker`);
+        const forcedExit = new Promise((resolve) => {
+            let settled = false;
+            let forcedTimeout;
+            const finish = (didExit) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(forcedTimeout);
+                w.off('exit', onForcedExit);
+                resolve(didExit);
+            };
+            const onForcedExit = () => finish(true);
+            w.once('exit', onForcedExit);
+            forcedTimeout = setTimeout(() => finish(false), TRANSFER_FORCE_EXIT_MS);
+            forcedTimeout.unref?.();
+        });
+        try {
+            w.kill('SIGKILL');
+        }
+        catch { /* already gone */ }
+        exited = await forcedExit || exited;
+    }
+    clearTimeout(timeout);
+    w.off('message', onMessage);
+    w.off('exit', onExit);
+    if (!completed || (ds.worker !== w && ds.worker !== null)) {
+        if (exited)
+            clearTransferWorkerState(ds, w, 'detachWorkerForTransfer:forced_exit');
+        logger.warn(`[${tag(ds)}] Transfer detach fence failed; source routing remains unchanged`);
+        return false;
+    }
+    clearTransferWorkerState(ds, w, 'detachWorkerForTransfer');
+    return true;
+}
 /**
  * Whether a worker-less restart must first destroy the session's persistent
  * backing pane. Adopt sessions are excluded — botmux never owned the user's
@@ -1150,7 +1541,7 @@ export function shouldDestroyPaneBeforeRestart(ds) {
     return !ds.initConfig?.adoptMode && !ds.adoptedFrom;
 }
 /**
- * Destroy a still-alive persistent backing pane (tmux/herdr/zellij) before a
+ * Destroy a still-alive persistent backing pane (tmux/herdr/zellij/zmx) before a
  * worker-less restart forks a fresh worker. Without this, a session that lost
  * its worker but kept its pane (the normal post-daemon-restart state) would let
  * spawnCli REATTACH the surviving CLI instead of relaunching it — the CLI is
@@ -1183,7 +1574,7 @@ function destroyLivePaneBeforeRestart(ds) {
         return;
     const killOnce = () => {
         try {
-            killPersistentBackendTarget(target);
+            killPersistentBackendTarget(target, ds.session.sessionId);
         }
         catch (err) {
             // The primitives normally swallow their own errors; this only catches a
@@ -1224,11 +1615,34 @@ function destroyLivePaneBeforeRestart(ds) {
         logger.info(`[${tag(ds)}] restart: ${target.backendType} pane missing after kill — CLI will physically relaunch`);
     }
 }
+/**
+ * Live-worker /restart 携带的最新 per-bot env（bots.json `env`）。worker 收到
+ * restart 时在 respawn 前全量覆盖 lastInitConfig.env —— 否则 live-worker 重启
+ * 一直用 fork 时刻的旧快照，dashboard 改完 env（如切 provider 的
+ * ANTHROPIC_BASE_URL/TOKEN）后 /restart 并不会生效（只有 refork 路径生效）。
+ * 三分态返回：对象 = 最新 env；null = 明确清空（dashboard 已删）；
+ * undefined = 取不到（bot 已注销等异常），让 worker 保持快照不动（=旧行为）。
+ * 只热更 env 一个字段：sandbox/backendType 是刻意 freeze-once 的设计（见
+ * forkWorker init 注释），cliId 换 CLI 会踩 resume transcript 对齐，均不带。
+ */
+export function latestPerBotEnvForRestart(ds) {
+    try {
+        return getBot(ds.larkAppId).config.env ?? null;
+    }
+    catch {
+        return undefined;
+    }
+}
 /** Join or start one correlated physical restart for a session. */
 export function requestSessionRestart(ds, observer) {
+    if (isSessionTransferring(ds)) {
+        logger.warn(`[${tag(ds)}] Restart refused while routing transfer is in progress`);
+        return undefined;
+    }
     return restartCoordinator.request(ds.session.sessionId, observer, attemptId => {
         if (ds.worker && !ds.worker.killed) {
-            ds.worker.send({ type: 'restart', attemptId });
+            ds.workerReady = false;
+            ds.worker.send({ type: 'restart', attemptId, env: latestPerBotEnvForRestart(ds) });
             return;
         }
         // No live worker but the persistent pane may still be alive (e.g. after a
@@ -1246,7 +1660,7 @@ export function __testOnly_resetRestartCoordinator() {
     restartCoordinator.reset();
 }
 /**
- * Tear down a persistent backing session (tmux/herdr/zellij) directly from the
+ * Tear down a persistent backing session (tmux/herdr/zellij/zmx) directly from the
  * daemon when there is no live worker to do it via the 'close' IPC. The session
  * name is deterministic from the session UUID, and each killSession() is a no-op
  * if the session is already gone.
@@ -1284,7 +1698,7 @@ function destroyOrphanedBackingSession(ds) {
     if (!backendType)
         return;
     try {
-        killPersistentBackendTarget(persistentBackendTargetForSession(ds));
+        killPersistentBackendTarget(persistentBackendTargetForSession(ds), ds.session.sessionId);
         logger.info(`[${tag(ds)}] killWorker: no live worker — destroyed orphaned ${backendType} backing session`);
     }
     catch (err) {
@@ -1312,14 +1726,21 @@ function reclaimParkedCrashDiagnostic(ds) {
     catch { /* absent — benign */ }
 }
 export function suspendWorker(ds, reason = 'suspended_idle') {
+    if (isSessionTransferring(ds)) {
+        logger.warn(`[${tag(ds)}] Suspend refused while routing transfer is in progress`);
+        return false;
+    }
     if (!ds.worker || ds.worker.killed) {
+        ds.workerReady = false;
         // There is no live generation that can still own this capability.
         ds.managedTurnOrigin = undefined;
+        invalidateTuiPrompt(ds, 'suspendWorker:no_worker');
         return false;
     }
     if (!isSuspendableBackendType(ds.initConfig?.backendType))
         return false;
     const w = ds.worker;
+    trackLifecycleRetirement(ds, w);
     try {
         w.send({ type: 'suspend' });
     }
@@ -1331,6 +1752,7 @@ export function suspendWorker(ds, reason = 'suspended_idle') {
     }
     armWorkerKillBackstop(w, tag(ds));
     ds.worker = null;
+    ds.workerReady = false;
     ds.localProcessAttestation = undefined;
     ds.workerPort = null;
     ds.workerToken = null;
@@ -1340,6 +1762,7 @@ export function suspendWorker(ds, reason = 'suspended_idle') {
     // later. Invalidate any stuck-warning card so a late click cannot inject keys
     // after the CLI is gone (or into a different CLI on resume).
     invalidateStuckWarning(ds, 'suspendWorker');
+    invalidateTuiPrompt(ds, 'suspendWorker');
     // Screen state describes the process we just stopped. Keeping it would make
     // the dashboard hydrate this process-less logical session as idle/working.
     ds.lastScreenStatus = undefined;
@@ -1398,7 +1821,169 @@ function armWorkerKillBackstop(w, label, sigtermMs = WORKER_SIGTERM_BACKSTOP_MS)
         clearTimeout(sigkill);
     });
 }
-// ─── Idempotent session close (dashboard IPC) ───────────────────────────────
+const closeFences = new Map();
+function closeFenceGeneration(ds) {
+    return ds.workerGeneration ?? ds.session.workerGeneration ?? 0;
+}
+function closeFenceKey(sessionId, workerGeneration) {
+    return `${sessionId}:${workerGeneration}`;
+}
+function closeFenceFor(sessionId, workerGeneration) {
+    if (workerGeneration === undefined)
+        return undefined;
+    return closeFences.get(closeFenceKey(sessionId, workerGeneration))?.promise;
+}
+function armCloseFence(ds, worker) {
+    const sessionId = ds.session.sessionId;
+    const workerGeneration = closeFenceGeneration(ds);
+    const key = closeFenceKey(sessionId, workerGeneration);
+    const existing = closeFences.get(key);
+    if (existing)
+        return existing.promise;
+    let resolveFence;
+    const promise = new Promise(resolve => { resolveFence = resolve; });
+    const fence = {
+        sessionId,
+        workerGeneration,
+        promise,
+        resolve: resolveFence,
+        worker,
+    };
+    closeFences.set(key, fence);
+    sessionStore.registerSessionBridgeSendMarkerCleanupFence(sessionId, promise);
+    const timer = setTimeout(() => {
+        logger.warn(`[${sessionId.substring(0, 8)}] worker close fence still waiting; `
+            + `generation=${workerGeneration}; bridge markers remain until ACK or worker exit`);
+    }, CLOSE_FENCE_WARN_MS);
+    timer.unref?.();
+    worker.once('exit', resolveFence);
+    if (worker.exitCode != null || worker.signalCode != null) {
+        queueMicrotask(resolveFence);
+    }
+    void promise.finally(() => {
+        clearTimeout(timer);
+        worker.off('exit', resolveFence);
+        if (closeFences.get(key) === fence)
+            closeFences.delete(key);
+    });
+    return promise;
+}
+function resolveCloseFence(sessionId, workerGeneration) {
+    closeFences.get(closeFenceKey(sessionId, workerGeneration))?.resolve();
+}
+function persistedDocCommentTarget(session, turnId) {
+    return session.docCommentTargets?.[turnId];
+}
+/** Resolve the daemon-local target first, but fill cleanup identifiers from
+ * the persisted per-turn route. After a daemon restart only the latter exists. */
+function resolveDocCommentTarget(ds, turnId) {
+    const memory = ds.docCommentTurns?.get(turnId);
+    const persisted = persistedDocCommentTarget(ds.session, turnId);
+    if (!memory)
+        return persisted;
+    if (!persisted)
+        return memory;
+    return {
+        ...persisted,
+        ...memory,
+        replyId: memory.replyId ?? persisted.replyId,
+        reactionId: memory.reactionId ?? persisted.reactionId,
+    };
+}
+/** Consume one successfully-delivered document turn from both runtime and
+ * persisted state. Persistence is best-effort: a reply that already landed
+ * must never be retried (and duplicated) merely because local cleanup failed. */
+function consumeDocCommentTurn(ds, turnId) {
+    if (ds.docCommentTurns) {
+        ds.docCommentTurns.delete(turnId);
+        if (ds.docCommentTurns.size === 0)
+            ds.docCommentTurns = undefined;
+    }
+    const targets = ds.session.docCommentTargets;
+    if (targets?.[turnId]) {
+        delete targets[turnId];
+        if (Object.keys(targets).length === 0)
+            ds.session.docCommentTargets = undefined;
+        try {
+            sessionStore.updateSession(ds.session);
+        }
+        catch { /* best-effort */ }
+    }
+}
+function collectDocCommentReactionTargets(ds, stored) {
+    const unique = new Map();
+    const add = (target) => {
+        if (!target.replyId || !target.reactionId)
+            return;
+        const key = `${target.fileToken}\0${target.commentId}\0${target.replyId}\0${target.reactionId}`;
+        unique.set(key, target);
+    };
+    if (ds?.docCommentTurns) {
+        for (const target of ds.docCommentTurns.values())
+            add(target);
+    }
+    for (const target of Object.values(ds?.session.docCommentTargets ?? {}))
+        add(target);
+    if (stored && stored !== ds?.session) {
+        for (const target of Object.values(stored.docCommentTargets ?? {}))
+            add(target);
+    }
+    return [...unique.values()];
+}
+function clearAllDocCommentTurnState(ds, stored) {
+    if (ds) {
+        ds.docCommentTurns = undefined;
+        ds.session.docCommentTargets = undefined;
+    }
+    if (stored && stored !== ds?.session)
+        stored.docCommentTargets = undefined;
+}
+function sessionAnchorForStoredRow(session) {
+    return session.scope === 'chat' ? session.chatId : session.rootMessageId;
+}
+function isLegacyApiDocSubscription(managedBy) {
+    return managedBy === undefined || managedBy === 'subscribe-lark-doc';
+}
+/**
+ * Perform the close-time teardown that must be proven before callers mutate
+ * the active registry or persisted Session row.
+ *
+ * ZMX is deliberately fail-closed: killManagedSession verifies the managed
+ * UUID/generation and throws when ownership is ambiguous. Most close paths go
+ * through closeSession(), but repo replacement reuses the live DaemonSession
+ * object and therefore cannot call closeSession() without deleting the routing
+ * generation it is about to repopulate. Those paths call this synchronous seam
+ * first, while every bit of old-session state is still intact.
+ *
+ * Other backends retain their existing worker-side graceful teardown. Adopted,
+ * queued, and already-closed rows never own a ZMX process to destroy.
+ */
+function teardownAuthoritativePersistentBackingBeforeCloseImpl(target, closeWinsTransfer) {
+    const ds = 'session' in target ? target : undefined;
+    const session = ds?.session ?? target;
+    if (ds && isSessionTransferring(ds)) {
+        if (!closeWinsTransfer) {
+            throw new Error('session_transferring');
+        }
+        // Explicit close wins over relay. The old worker may already be handling
+        // detach_for_transfer concurrently, so daemon-side teardown is the only
+        // deterministic way to prevent that detach path from skipping ordinary
+        // close cleanup (notably a surviving tmux/Herdr/ZMX pane or Riff task).
+        destroyOrphanedBackingSession(ds);
+    }
+    const backendType = ds ? getSessionPersistentBackendType(ds) : session.backendType;
+    if (backendType !== 'zmx'
+        || ds?.initConfig?.adoptMode
+        || ds?.adoptedFrom
+        || session.adoptedFrom
+        || session.queued
+        || session.status === 'closed')
+        return;
+    killPersistentSession('zmx', persistentSessionName('zmx', session.sessionId), session.sessionId);
+}
+export function teardownAuthoritativePersistentBackingBeforeClose(target) {
+    teardownAuthoritativePersistentBackingBeforeCloseImpl(target, false);
+}
 /**
  * Idempotent close: kill worker if alive, mark Session status='closed' + closedAt,
  * publish session.exited (if a live worker was killed) and session.update
@@ -1409,29 +1994,64 @@ function armWorkerKillBackstop(w, label, sigtermMs = WORKER_SIGTERM_BACKSTOP_MS)
  */
 export async function closeSession(sessionId) {
     const ds = findActiveBySessionId(sessionId);
+    const stored = sessionStore.getOwnedSession(sessionId);
+    // Prove fail-closed ZMX teardown before any registry/store mutation. Repo
+    // replacement paths reuse the same helper before their own state transition.
+    const teardownTarget = ds ?? stored;
+    if (teardownTarget) {
+        teardownAuthoritativePersistentBackingBeforeCloseImpl(teardownTarget, true);
+    }
     let killedLive = false;
     // 会话关闭即可回收其崩溃重启计数；否则每个曾崩溃过的 session 会在 daemon
     // 生命周期内永久占位（restartCounts 此前无任何 delete）。
     restartCounts.delete(sessionId);
+    const hadLiveWorker = !!ds?.worker && !ds.worker.killed;
+    const closeWorkerGeneration = ds ? closeFenceGeneration(ds) : undefined;
+    // Snapshot ownership + transition state before mutating the live object:
+    // sessionStore commonly holds the very same Session reference as `ds`.
+    const known = !!ds || !!stored;
+    const wasOpen = !!stored && stored.status !== 'closed';
+    const storedHadDocCommentTargets = Object.keys(stored?.docCommentTargets ?? {}).length > 0;
+    const docReactionTargets = collectDocCommentReactionTargets(ds, stored);
+    // Per-turn comment routes are transient capabilities. Clear them from both
+    // live and owner-scoped persisted objects inside the synchronous close
+    // critical section, before any best-effort Lark cleanup can yield.
+    clearAllDocCommentTurnState(ds, stored);
+    // An idempotent re-close has no status transition for closeSession() to
+    // persist, but stale per-turn capabilities must still be removed on disk.
+    if (stored && !wasOpen && storedHadDocCommentTargets) {
+        sessionStore.updateSession(stored);
+    }
     if (ds) {
         // Usage ledger: flush the final delta before the worker goes away (a
         // crash/limited turn may never have reached an idle edge).
         recordUsageForDaemonSession(ds);
         killWorker(ds);
-        // Commit the daemon-visible close barrier before any network await below.
-        // `botmux delete` may be running inside the session being destroyed; once
-        // its worker/backing pane exits, a new IM message must not find this stale
-        // entry and resurrect the old logical session while doc cleanup is pending.
-        activeSessionsRegistry?.delete(activeSessionKey(ds));
+        const activeKey = activeSessionKey(ds);
+        if (activeSessionsRegistry?.get(activeKey) === ds) {
+            activeSessionsRegistry.delete(activeKey);
+        }
+        // Mark the captured object too. Async message/card paths may already hold a
+        // reference to `ds`; deleting only the registry entry would not stop one of
+        // those continuations from re-forking the closed session after its await.
+        ds.session.status = 'closed';
+        ds.session.closedAt ??= new Date().toISOString();
         killedLive = true;
     }
-    // Persistence is part of the same no-await barrier as Map eviction. If the
-    // daemon crashes during best-effort doc cleanup, restart recovery must not
-    // restore a session that was already explicitly closed.
-    const stored = sessionStore.getSession(sessionId);
-    const wasOpen = !!stored && stored.status !== 'closed';
-    if (wasOpen)
-        sessionStore.closeSession(sessionId);
+    // Mutations are bot-owner scoped. getSession() has a read-only cross-file
+    // fallback for agent CLI discovery, so it must not authorize close.
+    if (wasOpen) {
+        if (!ds && stored)
+            destroyUnregisteredPersistentBacking(stored);
+        sessionStore.closeSession(sessionId, {
+            cleanupBridgeMarkers: !hadLiveWorker,
+        });
+        const after = sessionStore.getOwnedSession(sessionId);
+        if (ds) {
+            ds.session.status = 'closed';
+            ds.session.closedAt = after?.closedAt ?? ds.session.closedAt;
+        }
+    }
     if (ds) {
         if (!ds.exitEventEmitted) {
             ds.exitEventEmitted = true;
@@ -1442,53 +2062,106 @@ export async function closeSession(sessionId) {
             emitSessionLifecycleHook(ds, 'session.exit', { reason: 'dashboard_close' });
         }
     }
-    // Preserve the existing externally-visible event order: exit first, then
-    // the final persisted-row update. Persistence itself was already committed
-    // above as part of the close barrier.
+    // Persistence path — load → mark closed → save (delegated to sessionStore).
+    // Mutations are bot-owner scoped. getSession() has a read-only cross-file
+    // fallback for agent CLI discovery; using it here lets the wrong daemon see
+    // another bot's active row, report a false successful close, then write only
+    // its own file (a no-op). The CLI relies on alreadyClosed to decide whether a
+    // legacy local fallback is safe, so owner proof must be real.
     if (wasOpen) {
-        const after = sessionStore.getSession(sessionId);
-        dashboardEventBus.publish({
-            type: 'session.update',
-            body: {
-                sessionId,
-                patch: {
-                    status: 'closed',
-                    closedAt: after?.closedAt ? Date.parse(after.closedAt) : Date.now(),
-                    tokenUsage: after ? composeRowFromClosed(after).tokenUsage : null,
-                },
-            },
-        });
+        const after = sessionStore.getOwnedSession(sessionId);
+        publishClosedSessionPatch(sessionId, after?.closedAt ? Date.parse(after.closedAt) : undefined, { tokenUsage: after ? composeRowFromClosed(after).tokenUsage : null });
     }
-    if (ds) {
-        // 文档入口清理：会话关闭即删除其绑定。只有旧
-        // /subscribe-lark-doc 记录需要调飞书逐文件退订 API；
-        // /watch-comment 仅依赖应用级评论事件，删本地监听表即可。此段允许 await，
-        // 因为上面的内存 + 持久化关闭屏障已经提交。
+    if (wasOpen && hadLiveWorker) {
+        await closeFenceFor(sessionId, closeWorkerGeneration);
+        sessionStore.cleanupSessionBridgeSendMarkersNow(sessionId);
+    }
+    // All authoritative map/status/store/event state above transitions
+    // synchronously, before the first await. Lark reaction/unsubscribe cleanup is
+    // best-effort and can be slow; it must not leave a resurrection window.
+    const cleanupAppId = ds?.larkAppId ?? stored?.larkAppId;
+    if (cleanupAppId) {
+        for (const target of docReactionTargets) {
+            try {
+                await removeCommentReaction(cleanupAppId, { fileToken: target.fileToken, fileType: target.fileType }, target.commentId, target.replyId, target.reactionId);
+            }
+            catch (err) {
+                logger.debug(`[doc-comment] close cleanup could not remove reaction ${target.reactionId}: ${err?.message ?? err}`);
+            }
+        }
+        const anchor = ds ? sessionAnchorId(ds) : stored ? sessionAnchorForStoredRow(stored) : undefined;
+        let subs = [];
         try {
-            const anchor = sessionAnchorId(ds);
-            const subs = listDocSubscriptionsForSession(config.session.dataDir, ds.larkAppId, anchor);
-            for (const sub of subs) {
-                if (sub.managedBy !== 'watch-comment') {
-                    await unsubscribeDocFile(ds.larkAppId, { fileToken: sub.fileToken, fileType: sub.fileType });
-                }
-                removeDocSubscription(config.session.dataDir, ds.larkAppId, sub.fileToken);
+            if (anchor) {
+                subs = listDocSubscriptionsForSession(config.session.dataDir, cleanupAppId, anchor);
             }
-            if (subs.length)
-                logger.info(`[doc-comment] session ${sessionId.slice(0, 8)} closed → removed ${subs.length} doc binding(s)`);
         }
         catch (err) {
-            logger.warn(`[doc-comment] cleanup on close failed for ${sessionId.slice(0, 8)}: ${err?.message ?? err}`);
+            logger.warn(`[doc-comment] failed to list bindings on close for ${sessionId.slice(0, 8)}: ${err?.message ?? err}`);
         }
+        for (const sub of subs) {
+            try {
+                // `/subscribe-lark-doc` (and pre-managedBy legacy rows) owns a
+                // per-file remote subscription. `/watch-comment` is app-level event /
+                // poller state and must only remove its local routing binding.
+                if (isLegacyApiDocSubscription(sub.managedBy)) {
+                    await unsubscribeDocFile(cleanupAppId, { fileToken: sub.fileToken, fileType: sub.fileType });
+                }
+            }
+            catch (err) {
+                logger.warn(`[doc-comment] remote unsubscribe failed for ${sub.fileToken.slice(0, 12)} on close: ${err?.message ?? err}`);
+            }
+            finally {
+                // Local ownership must always be released, even when one remote API
+                // call fails; each item is isolated so later bindings still clean up.
+                try {
+                    removeDocSubscription(config.session.dataDir, cleanupAppId, sub.fileToken);
+                }
+                catch (err) {
+                    logger.warn(`[doc-comment] local binding removal failed for ${sub.fileToken.slice(0, 12)} on close: ${err?.message ?? err}`);
+                }
+            }
+        }
+        if (subs.length)
+            logger.info(`[doc-comment] session ${sessionId.slice(0, 8)} closed → removed ${subs.length} doc binding(s)`);
     }
     // alreadyClosed = nothing happened on either path.
     const alreadyClosed = !killedLive && !wasOpen;
-    return { ok: true, alreadyClosed };
+    return { ok: true, alreadyClosed, known };
+}
+/**
+ * Close can arrive through daemon IPC before startup restore has registered the
+ * persisted row. In that window there is no DaemonSession for killWorker(), but
+ * a stamped persistent backing may still be running. Tear down only backends
+ * whose ownership is explicit; never touch adopted user panes, queued rows, or
+ * legacy rows whose backend is unknown.
+ */
+export function destroyUnregisteredPersistentBacking(session, kill = killPersistentBackendTarget) {
+    if (session.adoptedFrom || session.queued)
+        return false;
+    const backendType = session.backendType;
+    if (!isSuspendableBackendType(backendType))
+        return false;
+    const target = resolvePersistentBackendTarget(backendType, session.sessionId, session.persistentBackendTarget);
+    const targetName = target.backendType === 'herdr' && target.agentName
+        ? `${target.sessionName}/${target.agentName}`
+        : target.sessionName;
+    try {
+        kill(target, session.sessionId);
+        logger.info(`[${session.sessionId.substring(0, 8)}] Closed unregistered ${backendType} backing ${targetName}`);
+        return true;
+    }
+    catch (err) {
+        logger.warn(`[${session.sessionId.substring(0, 8)}] Failed to close unregistered ${backendType} backing ${targetName}: ` +
+            `${err instanceof Error ? err.message : String(err)}`);
+        return false;
+    }
 }
 /**
- * Set an entry on an active-sessions Map, but if the key is already occupied
- * by a DIFFERENT DaemonSession, close that occupant first. Replaces bare
- * `activeSessions.set(key, ds)` at sites where a silent overwrite would leak
- * the prior entry's worker + leave its store row stuck in `status='active'`.
+ * Compare-and-set an entry on an active-sessions Map. A different current
+ * occupant always wins; callers must roll back the rejected incoming row.
+ * Replaces bare `activeSessions.set(key, ds)` at sites where a silent overwrite
+ * would leak the prior entry's worker + leave its store row stuck active.
  *
  * The Map is passed explicitly so callers operate on the same instance they
  * already hold (restoreActiveSessions takes the daemon's Map as a parameter;
@@ -1496,24 +2169,290 @@ export async function closeSession(sessionId) {
  * both refer to the same object — the daemon registers its Map at boot — but
  * decoupling avoids module-state assumptions in tests.
  *
- * Canonical collision case: restoreActiveSessions at daemon boot iterating
- * two on-disk active sessions that resolve to the same chat-scope key (e.g.
- * a /relay command's scratch session + the real session that was transferred
- * into the same chat by a prior daemon run). Without this helper the later
- * iterated entry silently wins, the earlier one becomes a ghost-active.
+ * Registration is compare-and-set: a different current occupant always wins.
+ * The caller owns rollback of its rejected incoming row. This is deliberately
+ * non-destructive because the occupant may be a fresh live session created
+ * while an older async restore/create continuation was in flight.
+ */
+function removeInactiveRegistration(map, key, ds) {
+    if (ds.session.status === 'active')
+        return false;
+    // Only remove our exact stale object. A newer session may already own the
+    // same routing key and must never be evicted by this continuation.
+    if (map.get(key) === ds)
+        map.delete(key);
+    logger.warn(`[${tag(ds)}] Refusing to register an inactive session ` +
+        `(status=${ds.session.status})`);
+    return true;
+}
+function persistedActiveSessionKey(session, fallbackLarkAppId) {
+    const larkAppId = session.larkAppId ?? fallbackLarkAppId;
+    const anchor = session.vcMeetingReceiver
+        ? `vc-receiver:${session.sessionId}`
+        : storedSessionAnchorId(session);
+    return sessionKey(anchor, larkAppId);
+}
+/**
+ * Return an active persisted row that deliberately reserves this routing key
+ * after an inconclusive exact-backend teardown.
  *
- * Setting the same `ds` at its own key is a no-op (no close).
+ * The store is the durable authority rather than a process-local Set: a daemon
+ * restart must not forget the quarantine and create a second runtime beside a
+ * possibly-live ZMX/other persistent target. Closed rows are ignored so an
+ * operator's successful close immediately releases the route.
  */
-export async function setActiveSessionSafe(map, key, ds) {
-    const prev = map.get(key);
-    if (prev && prev !== ds) {
-        logger.warn(`[setActiveSessionSafe] key already occupied by ${prev.session.sessionId.substring(0, 8)} ` +
-            `(worker=${prev.worker ? 'live' : 'null'}); closing it before set`);
-        await closeSession(prev.session.sessionId);
+export function findQuarantinedRoutingConflict(key, larkAppId, candidateSessionId) {
+    try {
+        return sessionStore.listSessions().find(session => session.status === 'active'
+            && !!session.restoreQuarantinedAt
+            && session.sessionId !== candidateSessionId
+            && persistedActiveSessionKey(session, larkAppId) === key);
+    }
+    catch {
+        // Registration still retains its existing in-memory CAS semantics when the
+        // store is temporarily unreadable. Restore marks/persists quarantine before
+        // yielding, so the normal production path reaches the durable guard.
+        return undefined;
+    }
+}
+/**
+ * Synchronous registration gate for creation paths that previously used a
+ * bare Map.set(). A daemon close can update the shared Session object while
+ * the creator is awaiting Lark/project metadata; never publish that now-closed
+ * row back into the live routing map when the continuation resumes.
+ */
+export function setActiveSessionIfActive(map, key, ds) {
+    if (removeInactiveRegistration(map, key, ds))
+        return false;
+    const current = map.get(key);
+    if (current && current !== ds) {
+        logger.warn(`[${tag(ds)}] Refusing to overwrite active routing occupant ` +
+            `${current.session.sessionId.substring(0, 8)}`);
+        return false;
+    }
+    const quarantined = findQuarantinedRoutingConflict(key, ds.larkAppId, ds.session.sessionId);
+    if (quarantined) {
+        logger.warn(`[${tag(ds)}] Refusing to occupy routing key reserved by quarantined session `
+            + `${quarantined.sessionId.substring(0, 8)}`);
+        return false;
     }
     map.set(key, ds);
+    if (ds.session.restoreQuarantinedAt) {
+        delete ds.session.restoreQuarantinedAt;
+        try {
+            sessionStore.updateSession(ds.session);
+        }
+        catch (err) {
+            // Runtime ownership is now authoritative and the Map prevents duplicates
+            // for this process. Keep running; a later persistence update (or the next
+            // restore attempt) will converge the stale on-disk marker.
+            logger.warn(`[${tag(ds)}] Registered quarantined session but could not clear its persisted marker: `
+                + `${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    return true;
+}
+export async function setActiveSessionSafe(map, key, ds) {
+    return setActiveSessionIfActive(map, key, ds);
+}
+/**
+ * Roll back a freshly-created row rejected by the registration CAS, then read
+ * the routing winner *after* that asynchronous rollback finishes.
+ *
+ * Message handlers use this to hand an already-deduped inbound event to a
+ * concurrent HTTP/dashboard/restore winner instead of silently dropping it.
+ * The post-await lookup matters: close cleanup must never return a stale object
+ * that another continuation replaced while the rollback was in flight.
+ */
+export async function rollbackRejectedSessionAndGetWinner(map, key, rejected, rollback = closeSession) {
+    await rollback(rejected.session.sessionId);
+    const winner = map.get(key);
+    if (!winner || winner === rejected || winner.session.status !== 'active')
+        return undefined;
+    return winner;
+}
+const transferInputGates = new WeakMap();
+// Only this module can mark the synchronous replacement fork. External callers
+// cannot forge an option that bypasses the transfer gate.
+const transferReplacementForkBypass = new WeakSet();
+export function isSessionTransferring(ds) {
+    return transferInputGates.has(ds);
+}
+/** Register follow-up work that must run only after the relay gate is fully
+ * released. Returns false when no transfer is active, so callers can proceed
+ * immediately without a check-then-register race. */
+export function deferUntilSessionTransferSettled(ds, callback) {
+    const gate = transferInputGates.get(ds);
+    if (!gate)
+        return false;
+    gate.settledCallbacks.add(callback);
+    return true;
+}
+function beginTransferInputGate(ds) {
+    if (transferInputGates.has(ds))
+        return undefined;
+    const gate = {
+        messages: [],
+        needsWorker: false,
+        released: false,
+        flushing: false,
+        settledCallbacks: new Set(),
+    };
+    transferInputGates.set(ds, gate);
+    return gate;
+}
+function forkTransferReplacement(ds, forkWorkerImpl) {
+    transferReplacementForkBypass.add(ds);
+    try {
+        forkWorkerImpl(ds, '', true);
+    }
+    finally {
+        transferReplacementForkBypass.delete(ds);
+    }
+}
+function bufferTransferInput(ds, message) {
+    const gate = transferInputGates.get(ds);
+    if (!gate)
+        return false;
+    gate.messages.push(message);
+    logger.info(`[${tag(ds)}] Buffered ${message.type} input during routing transfer`
+        + `${'turnId' in message && message.turnId ? ` (turn ${message.turnId.substring(0, 8)})` : ''}`);
+    // A committed transfer can retain its gate when the first replacement loses
+    // IPC. The next accepted input is also a safe recovery trigger; before
+    // commit, released=false prevents an eager fork on the source route.
+    if (gate.released && gate.forkWorkerImpl) {
+        queueMicrotask(() => {
+            if (transferInputGates.get(ds) === gate) {
+                releaseTransferInputGate(ds, gate, gate.forkWorkerImpl);
+            }
+        });
+    }
+    return true;
+}
+/** Route user/automation input through the transfer fence. Messages accepted
+ * during detach are replayed byte-for-byte to the replacement generation.
+ */
+export function sendWorkerSessionInput(ds, message) {
+    if (bufferTransferInput(ds, message))
+        return true;
+    if (!ds.worker || ds.worker.killed)
+        return false;
+    ds.worker.send(message);
+    return true;
+}
+function settleTransferInputGate(ds, gate) {
+    if (transferInputGates.get(ds) !== gate)
+        return;
+    transferInputGates.delete(ds);
+    const callbacks = [...gate.settledCallbacks];
+    gate.settledCallbacks.clear();
+    for (const callback of callbacks) {
+        queueMicrotask(() => {
+            try {
+                callback();
+            }
+            catch (err) {
+                logger.error(`[${tag(ds)}] Post-transfer callback failed: `
+                    + `${err instanceof Error ? err.message : String(err)}`);
+            }
+        });
+    }
+}
+function releaseTransferInputGate(ds, gate, forkWorkerImpl, waitForWorkerExit) {
+    gate.released = true;
+    gate.forkWorkerImpl = forkWorkerImpl;
+    const flush = () => {
+        if (transferInputGates.get(ds) !== gate)
+            return;
+        if (gate.flushing)
+            return;
+        gate.flushing = true;
+        try {
+            if (ds.session.status === 'active'
+                && (gate.needsWorker || gate.messages.length > 0)
+                && currentDeviceIsolationFreezeLease()
+                && deferWorkerSpawnDuringDeviceIsolation(ds.session.sessionId, flush)) {
+                logger.info(`[${tag(ds)}] Holding transfer-buffered input behind device-isolation freeze`);
+                return;
+            }
+            if (ds.session.status !== 'active') {
+                settleTransferInputGate(ds, gate);
+                if (gate.messages.length > 0) {
+                    logger.warn(`[${tag(ds)}] Dropping ${gate.messages.length} transfer-buffered input(s); session is no longer active`);
+                }
+                return;
+            }
+            const workerUnavailable = () => !ds.worker || ds.worker.killed || ds.worker.connected === false;
+            if (workerUnavailable() && (gate.needsWorker || gate.messages.length > 0)) {
+                // Source-route timeout and successful target transfer both preserve CLI
+                // history. Start an empty resume generation first, then replay the exact
+                // frozen IPC messages in order behind its init message.
+                try {
+                    forkTransferReplacement(ds, forkWorkerImpl);
+                }
+                catch (err) {
+                    gate.needsWorker = true;
+                    logger.error(`[${tag(ds)}] Replacement worker fork failed after routing transfer; `
+                        + `retaining ${gate.messages.length} buffered input(s): `
+                        + `${err instanceof Error ? err.message : String(err)}`);
+                    return;
+                }
+            }
+            if (gate.messages.length === 0) {
+                gate.needsWorker = false;
+                settleTransferInputGate(ds, gate);
+                return;
+            }
+            const worker = ds.worker;
+            if (!worker || worker.killed || worker.connected === false) {
+                gate.needsWorker = true;
+                logger.error(`[${tag(ds)}] Unable to replay ${gate.messages.length} transfer-buffered input(s); `
+                    + 'replacement worker has no live IPC channel, retaining them for recovery');
+                return;
+            }
+            while (gate.messages.length > 0) {
+                const message = gate.messages[0];
+                try {
+                    worker.send(message);
+                    gate.messages.shift();
+                }
+                catch (err) {
+                    gate.needsWorker = true;
+                    logger.error(`[${tag(ds)}] Replacement worker IPC failed while replaying ${message.type}; `
+                        + `retaining ${gate.messages.length} undelivered input(s): `
+                        + `${err instanceof Error ? err.message : String(err)}`);
+                    if (typeof worker.once === 'function'
+                        && worker.exitCode === null
+                        && worker.signalCode === null) {
+                        worker.once('exit', () => {
+                            if (ds.worker === worker)
+                                ds.worker = null;
+                            flush();
+                        });
+                    }
+                    return;
+                }
+            }
+            gate.needsWorker = false;
+            settleTransferInputGate(ds, gate);
+        }
+        finally {
+            gate.flushing = false;
+        }
+    };
+    if (waitForWorkerExit
+        && waitForWorkerExit.exitCode === null
+        && waitForWorkerExit.signalCode === null) {
+        // Hard retirement is fail-closed: keep buffering until the OS confirms the
+        // uncertain old worker can no longer receive a late detach or user input.
+        waitForWorkerExit.once('exit', () => {
+            clearTransferWorkerState(ds, waitForWorkerExit, 'releaseTransferInputGate:late_forced_exit');
+            flush();
+        });
+        return;
+    }
+    flush();
 }
-// ─── Session transfer (cross-chat relay) ────────────────────────────────────
 /**
  * Transfer an active session from its current chat to a new chat. The CLI
  * process keeps running inside its tmux session — only the routing fields
@@ -1580,6 +2519,19 @@ targetScope, opts) {
     const ds = findActiveBySessionId(sessionId);
     if (!ds)
         return { ok: false, error: 'session_not_active' };
+    const sourceSession = ds.session;
+    const sourceLifecycleIdentity = JSON.stringify({
+        sessionId: sourceSession.sessionId,
+        cliId: sourceSession.cliId,
+        cliSessionId: sourceSession.cliSessionId,
+        backendType: sourceSession.backendType,
+        persistentBackendTarget: sourceSession.persistentBackendTarget,
+        riffParentTaskId: sourceSession.riffParentTaskId,
+        workingDir: sourceSession.workingDir,
+        adoptedFrom: sourceSession.adoptedFrom,
+        runtimeWorkingDir: ds.workingDir,
+        runtimeAdoptedFrom: ds.adoptedFrom,
+    });
     if (ds.session.vcMeetingReceiver)
         return { ok: false, error: 'vc_receiver_not_relayable' };
     // Anchor-based identity. A thread-scope session in the SAME chat (different
@@ -1591,6 +2543,48 @@ targetScope, opts) {
     const targetAnchor = targetScope === 'chat' ? targetChatId : targetRootMessageId;
     if (targetAnchor === sourceAnchor)
         return { ok: false, error: 'same_anchor' };
+    const sourceKey = sessionKey(sourceAnchor, ds.larkAppId);
+    const targetKey = sessionKey(targetAnchor, ds.larkAppId);
+    const validateSourceIdentity = () => {
+        if (ds.session.status !== 'active'
+            || ds.session !== sourceSession
+            || ds.session.sessionId !== sessionId
+            || JSON.stringify({
+                sessionId: ds.session.sessionId,
+                cliId: ds.session.cliId,
+                cliSessionId: ds.session.cliSessionId,
+                backendType: ds.session.backendType,
+                persistentBackendTarget: ds.session.persistentBackendTarget,
+                riffParentTaskId: ds.session.riffParentTaskId,
+                workingDir: ds.session.workingDir,
+                adoptedFrom: ds.session.adoptedFrom,
+                runtimeWorkingDir: ds.workingDir,
+                runtimeAdoptedFrom: ds.adoptedFrom,
+            }) !== sourceLifecycleIdentity
+            || activeSessionsRegistry?.get(sourceKey) !== ds) {
+            return { ok: false, error: 'session_not_active' };
+        }
+        return undefined;
+    };
+    const validateAfterAwait = () => {
+        const sourceError = validateSourceIdentity();
+        if (sourceError)
+            return sourceError;
+        if (currentDeviceIsolationFreezeLease()) {
+            return { ok: false, error: 'worker_busy' };
+        }
+        const targetOccupant = activeSessionsRegistry?.get(targetKey);
+        if (targetOccupant && targetOccupant !== ds) {
+            return { ok: false, error: 'target_chat_has_session' };
+        }
+        return undefined;
+    };
+    // The initial target scan below intentionally permits worker-less command
+    // scratches and closes them. At entry only validate source ownership; after
+    // those awaited closes the strict validator requires the target to be empty.
+    const initialStateError = validateSourceIdentity();
+    if (initialStateError)
+        return initialStateError;
     // pendingRepo: the user created a session via M0 but hasn't picked a repo
     // yet, so worker is null and the CLI has never run. Relaying produces an
     // empty new-chat session with no AI memory — refuse so the user finishes
@@ -1618,126 +2612,207 @@ targetScope, opts) {
     // leader had already abort+report 'busy', producing reports that
     // disagreed with reality. Cleaner contract: refuse on first miss, let
     // the user retry when the turn settles.
+    if (isSessionLifecycleInFlight(ds)) {
+        return { ok: false, error: 'worker_busy' };
+    }
     const st = ds.lastScreenStatus;
     if (ds.worker && !ds.worker.killed && st !== 'idle' && st !== 'limited') {
         return { ok: false, error: 'worker_busy' };
     }
-    // Existing-session guard: a session sharing the *target anchor* would
-    // collide on sessionKey(targetAnchor, larkAppId) after the rewrite, and
-    // Map.set would silently orphan the prior entry's worker. We split the
-    // collision predicate two ways:
-    //   - real session (worker !== null): refuse the transfer
-    //   - scratch session (worker === null): a daemon-command placeholder
-    //     (e.g. the /relay command itself created one when typed in this
-    //     chat); the slot is logically free, but the placeholder lingers in
-    //     the store with status='active'. Collect and close it so the post-
-    //     transfer Map.set doesn't silently overwrite it (which leaves the
-    //     scratch as a ghost-active on next daemon restart — exact bug we're
-    //     fixing).
-    // Anchor-based: chat-scope anchors on chatId, thread-scope on rootMessageId.
-    // Only a session at the target anchor collides — same-chat other-topic
-    // sessions have a different anchor and are fine (enables同群话题间搬运).
-    const scratchesToClose = [];
-    if (activeSessionsRegistry) {
-        for (const existing of activeSessionsRegistry.values()) {
-            if (existing === ds)
-                continue;
-            if (existing.larkAppId !== ds.larkAppId)
-                continue;
-            if (sessionAnchorId(existing) !== targetAnchor)
-                continue;
-            if (!existing.worker) {
-                scratchesToClose.push(existing.session.sessionId);
-                continue;
+    if (currentDeviceIsolationFreezeLease()) {
+        return { ok: false, error: 'worker_busy' };
+    }
+    const fkw = opts?.forkWorkerImpl ?? forkWorker;
+    const detach = opts?.detachWorkerImpl ?? detachWorkerForTransfer;
+    const transferGate = beginTransferInputGate(ds);
+    if (!transferGate)
+        return { ok: false, error: 'worker_busy' };
+    let uncertainRetiringWorker;
+    let sourceDetached = false;
+    let routingCommitted = false;
+    try {
+        // Existing-session guard: a session sharing the *target anchor* would
+        // collide on sessionKey(targetAnchor, larkAppId) after the rewrite, and
+        // Map.set would silently orphan the prior entry's worker. We split the
+        // collision predicate two ways:
+        //   - real session (worker !== null): refuse the transfer
+        //   - scratch session (worker === null): a daemon-command placeholder
+        //     (e.g. the /relay command itself created one when typed in this
+        //     chat); the slot is logically free, but the placeholder lingers in
+        //     the store with status='active'. Collect and close it so the post-
+        //     transfer Map.set doesn't silently overwrite it (which leaves the
+        //     scratch as a ghost-active on next daemon restart — exact bug we're
+        //     fixing).
+        // Anchor-based: chat-scope anchors on chatId, thread-scope on rootMessageId.
+        // Only a session at the target anchor collides — same-chat other-topic
+        // sessions have a different anchor and are fine (enables同群话题间搬运).
+        const scratchesToClose = [];
+        if (activeSessionsRegistry) {
+            for (const existing of activeSessionsRegistry.values()) {
+                if (existing === ds)
+                    continue;
+                if (existing.larkAppId !== ds.larkAppId)
+                    continue;
+                if (sessionAnchorId(existing) !== targetAnchor)
+                    continue;
+                if (isDisposableCommandScratch(existing)) {
+                    scratchesToClose.push(existing.session.sessionId);
+                    continue;
+                }
+                return { ok: false, error: 'target_chat_has_session' };
             }
-            return { ok: false, error: 'target_chat_has_session' };
         }
-    }
-    for (const sid of scratchesToClose) {
-        await closeSession(sid);
-    }
-    const fkw = opts?.forkWorkerImpl ?? forkWorker;
-    const kw = opts?.killWorkerImpl ?? killWorker;
-    const tagPrefix = sessionId.substring(0, 8);
-    const oldAnchor = sessionAnchorId(ds);
-    const oldChatId = ds.chatId;
-    // Freeze the source-chat streaming card BEFORE we kill the worker (and
-    // before we clear streamCardId below). The live card's action buttons
-    // (close / toggle / get write link) carry `session_id` in their value, so
-    // clicks AFTER relay still reach the now-relocated session — closing it,
-    // toggling its display mode, etc. — with feedback landing on the NEW
-    // card in the target chat. PATCH the source-chat card to an inert
-    // snapshot so the user sees clearly it's historical, and so the buttons
-    // are gone. Best-effort: on PATCH failure (card withdrawn, expired) we
-    // log and continue; the relay itself must not depend on this.
-    if (ds.streamCardId && ds.streamCardId !== CARD_POSTING_SENTINEL) {
+        for (const sid of scratchesToClose) {
+            await closeSession(sid);
+        }
+        const postScratchStateError = validateAfterAwait();
+        if (postScratchStateError)
+            return postScratchStateError;
+        const tagPrefix = sessionId.substring(0, 8);
+        const oldAnchor = sessionAnchorId(ds);
+        const oldChatId = ds.chatId;
+        // Detach only the worker/observer. Persistent backends and Riff keep the
+        // owned CLI/task alive so the replacement can reattach below. PTY cannot
+        // survive a worker exit and therefore retains its historical cold-resume.
+        const sourceWorker = ds.worker ?? undefined;
+        let detached;
         try {
-            const cliId = ds.session.cliId
-                ?? (() => { try {
-                    return getBot(ds.larkAppId).config.cliId;
-                }
-                catch {
-                    return undefined;
-                } })();
-            const frozenJson = buildRelayedFrozenCard(ds.currentTurnTitle || ds.session.title || '', cliId, ds.currentImageKey, localeForBot(ds.larkAppId));
-            await updateMessage(ds.larkAppId, ds.streamCardId, frozenJson);
+            detached = (await detach(ds)) !== false;
         }
-        catch (err) {
-            logger.warn(`[${tagPrefix}] freeze source-chat card failed: ${err instanceof Error ? err.message : err}`);
+        catch {
+            detached = false;
+        }
+        if (!detached) {
+            // The real detach timeout hard-retires the old worker before returning
+            // false. Even with no buffered user input, the unchanged source route
+            // therefore needs a cold reattach; otherwise an active session remains
+            // silently workerless until some later message happens to wake it.
+            transferGate.needsWorker = true;
+            if (sourceWorker
+                && sourceWorker.exitCode === null
+                && sourceWorker.signalCode === null) {
+                uncertainRetiringWorker = sourceWorker;
+            }
+            return { ok: false, error: 'worker_detach_timeout' };
+        }
+        sourceDetached = true;
+        const postDetachStateError = validateAfterAwait();
+        if (postDetachStateError)
+            return postDetachStateError;
+        // Build the source-card snapshot before clearing its runtime fields, but do
+        // not PATCH it until the routing commit is irreversible. Marking the card
+        // "relayed" before an awaited validation used to leave a false tombstone
+        // when a target collision/device freeze won that race.
+        let sourceCardFreeze;
+        if (ds.streamCardId && ds.streamCardId !== CARD_POSTING_SENTINEL) {
+            try {
+                const cliId = ds.session.cliId
+                    ?? (() => { try {
+                        return getBot(ds.larkAppId).config.cliId;
+                    }
+                    catch {
+                        return undefined;
+                    } })();
+                sourceCardFreeze = {
+                    cardId: ds.streamCardId,
+                    cardJson: buildRelayedFrozenCard(ds.currentTurnTitle || ds.session.title || '', cliId, ds.currentImageKey, localeForBot(ds.larkAppId)),
+                };
+            }
+            catch (err) {
+                logger.warn(`[${tagPrefix}] build source-chat frozen card failed: ${err instanceof Error ? err.message : err}`);
+            }
+        }
+        activeSessionsRegistry?.delete(sessionKey(oldAnchor, ds.larkAppId));
+        // Rewrite routing fields per the requested target scope.
+        //   chat-scope:   routes by chatId; `targetRootMessageId` (e.g. an M1 id) is
+        //                 stored on rootMessageId but is purely audit/UX.
+        //   thread-scope: routes by rootMessageId; `targetRootMessageId` IS the
+        //                 routing anchor (the Lark 话题 root) — replies reply_in_thread
+        //                 to it, and future inbound messages in that 话题 resolve to
+        //                 the same anchor.
+        ds.session.chatId = targetChatId;
+        ds.session.rootMessageId = targetRootMessageId;
+        ds.session.scope = targetScope;
+        ds.session.chatType = targetChatType;
+        ds.session.lastMessageAt = new Date().toISOString();
+        // Card state was pinned to the source chat — clear so the new worker posts
+        // a fresh card in the target chat instead of trying to PATCH a message that
+        // lives in another chat entirely (the source card was just frozen above).
+        ds.session.streamCardId = undefined;
+        ds.session.streamCardNonce = undefined;
+        ds.session.currentImageKey = undefined;
+        // Mirror onto runtime DaemonSession.
+        ds.chatId = targetChatId;
+        ds.chatType = targetChatType;
+        ds.scope = targetScope;
+        ds.streamCardId = undefined;
+        ds.streamCardNonce = undefined;
+        ds.currentImageKey = undefined;
+        sessionStore.updateSession(ds.session);
+        const newAnchor = sessionAnchorId(ds);
+        if (activeSessionsRegistry) {
+            if (!setActiveSessionIfActive(activeSessionsRegistry, sessionKey(newAnchor, ds.larkAppId), ds)) {
+                return { ok: false, error: 'session_not_active' };
+            }
+        }
+        routingCommitted = true;
+        dashboardEventBus.publish({
+            type: 'session.update',
+            body: {
+                sessionId,
+                patch: {
+                    chatId: targetChatId,
+                    rootMessageId: targetRootMessageId,
+                    scope: targetScope,
+                    chatType: targetChatType,
+                },
+            },
+        });
+        // Best-effort only, and deliberately after the routing commit: an awaited
+        // Lark PATCH must never make the source card claim a move that ultimately
+        // failed. Do not await network I/O after commit either: transfer completion
+        // and replacement startup must not reopen a target/close race window.
+        if (sourceCardFreeze) {
+            void updateMessage(ds.larkAppId, sourceCardFreeze.cardId, sourceCardFreeze.cardJson)
+                .catch((err) => {
+                logger.warn(`[${tagPrefix}] freeze source-chat card failed: ${err instanceof Error ? err.message : err}`);
+            });
+        }
+        // forkWorker with resume=true — TmuxBackend.spawn detects the surviving
+        // `bmx-<sessionId>` session and re-attaches instead of creating a new one.
+        if (ds.session.status === 'active'
+            && (!activeSessionsRegistry
+                || activeSessionsRegistry.get(sessionKey(newAnchor, ds.larkAppId)) === ds)) {
+            try {
+                forkTransferReplacement(ds, fkw);
+            }
+            catch (err) {
+                // Routing is already committed. A replacement-spawn failure is an
+                // availability problem, not a failed move; keep the gate so the next
+                // input can retry on the target route without falsifying the result.
+                transferGate.needsWorker = true;
+                logger.error(`[${tagPrefix}] replacement worker fork failed after transfer commit: `
+                    + `${err instanceof Error ? err.message : String(err)}`);
+            }
         }
+        logger.info(`[${tagPrefix}] transferred ${oldChatId} → ${targetChatId} ` +
+            `(anchor ${oldAnchor.substring(0, 8)} → ${newAnchor.substring(0, 8)})`);
+        return { ok: true };
     }
-    // Detach worker — TmuxBackend.kill() does NOT destroy the tmux session, so
-    // the CLI process and its rolling jsonl continue running.
-    kw(ds);
-    activeSessionsRegistry?.delete(sessionKey(oldAnchor, ds.larkAppId));
-    // Rewrite routing fields per the requested target scope.
-    //   chat-scope:   routes by chatId; `targetRootMessageId` (e.g. an M1 id) is
-    //                 stored on rootMessageId but is purely audit/UX.
-    //   thread-scope: routes by rootMessageId; `targetRootMessageId` IS the
-    //                 routing anchor (the Lark 话题 root) — replies reply_in_thread
-    //                 to it, and future inbound messages in that 话题 resolve to
-    //                 the same anchor.
-    ds.session.chatId = targetChatId;
-    ds.session.rootMessageId = targetRootMessageId;
-    ds.session.scope = targetScope;
-    ds.session.chatType = targetChatType;
-    ds.session.lastMessageAt = new Date().toISOString();
-    // Card state was pinned to the source chat — clear so the new worker posts
-    // a fresh card in the target chat instead of trying to PATCH a message that
-    // lives in another chat entirely (the source card was just frozen above).
-    ds.session.streamCardId = undefined;
-    ds.session.streamCardNonce = undefined;
-    ds.session.currentImageKey = undefined;
-    // Mirror onto runtime DaemonSession.
-    ds.chatId = targetChatId;
-    ds.chatType = targetChatType;
-    ds.scope = targetScope;
-    ds.streamCardId = undefined;
-    ds.streamCardNonce = undefined;
-    ds.currentImageKey = undefined;
-    sessionStore.updateSession(ds.session);
-    const newAnchor = sessionAnchorId(ds);
-    if (activeSessionsRegistry) {
-        await setActiveSessionSafe(activeSessionsRegistry, sessionKey(newAnchor, ds.larkAppId), ds);
+    finally {
+        if (sourceDetached
+            && !routingCommitted
+            && ds.session.status === 'active'
+            && (!activeSessionsRegistry
+                || activeSessionsRegistry.get(sourceKey) === ds)) {
+            // A target/device/lifecycle race after a successful detach leaves the
+            // routing on the source. Reattach even when no user input happened
+            // during the critical section; otherwise the active session silently
+            // remains workerless until a later message arrives.
+            transferGate.needsWorker = true;
+        }
+        releaseTransferInputGate(ds, transferGate, fkw, uncertainRetiringWorker);
     }
-    dashboardEventBus.publish({
-        type: 'session.update',
-        body: {
-            sessionId,
-            patch: {
-                chatId: targetChatId,
-                rootMessageId: targetRootMessageId,
-                scope: targetScope,
-                chatType: targetChatType,
-            },
-        },
-    });
-    // forkWorker with resume=true — TmuxBackend.spawn detects the surviving
-    // `bmx-<sessionId>` session and re-attaches instead of creating a new one.
-    fkw(ds, '', /*resume*/ true);
-    logger.info(`[${tagPrefix}] transferred ${oldChatId} → ${targetChatId} ` +
-        `(anchor ${oldAnchor.substring(0, 8)} → ${newAnchor.substring(0, 8)})`);
-    return { ok: true };
 }
 // ─── Fork worker ────────────────────────────────────────────────────────────
 /** True if `p` resolves (via realpath) to the user's home dir. Used to exclude
@@ -1752,6 +2827,18 @@ function resolvesToHome(p) {
         return p === homedir();
     }
 }
+function canForkRegisteredSession(ds) {
+    const key = activeSessionKey(ds);
+    const registered = activeSessionsRegistry ? activeSessionsRegistry.get(key) : ds;
+    if (ds.session.status === 'active' && registered === ds)
+        return true;
+    if (activeSessionsRegistry && ds.session.status !== 'active' && registered === ds) {
+        activeSessionsRegistry.delete(key);
+    }
+    logger.warn(`[${tag(ds)}] Refusing to fork a closed or superseded session ` +
+        `(status=${ds.session.status}, registered=${registered === ds})`);
+    return false;
+}
 function codexAppInputForSession(ds, input, turnId) {
     if (!input)
         return undefined;
@@ -1767,7 +2854,8 @@ function codexAppInputForSession(ds, input, turnId) {
  * clean-input gate at message acceptance time. This freezes the sidecar onto
  * the IPC item, so later config flips do not mutate an already queued turn. */
 export function sendWorkerInput(ds, payload, turnId, opts = {}) {
-    if (!ds.worker || ds.worker.killed)
+    const transferGate = transferInputGates.get(ds);
+    if ((!ds.worker || ds.worker.killed) && !transferGate)
         return false;
     const normalized = typeof payload === 'string' ? { content: payload } : payload;
     const codexAppInput = codexAppInputForSession(ds, normalized.codexAppInput, turnId);
@@ -1791,7 +2879,7 @@ export function sendWorkerInput(ds, payload, turnId, opts = {}) {
         }
     }
     const vcMeetingImTurnOrigin = resolveVcMeetingImTurnOrigin(ds.session, turnId);
-    ds.worker.send({
+    const message = {
         type: 'message',
         content: normalized.content,
         ...(codexAppInput ? { codexAppInput } : {}),
@@ -1802,10 +2890,41 @@ export function sendWorkerInput(ds, payload, turnId, opts = {}) {
         ...(vcMeetingImTurnOrigin
             ? { vcMeetingImTurnOrigin }
             : {}),
-    });
-    return true;
+    };
+    return sendWorkerSessionInput(ds, message);
 }
 export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
+    const gatedPrompt = typeof promptInput === 'string' ? { content: promptInput } : promptInput;
+    const transferGate = transferInputGates.get(ds);
+    if (transferGate && !transferReplacementForkBypass.has(ds)) {
+        if (gatedPrompt.content !== '') {
+            const gatedTurnId = typeof resumeOrTurnId === 'string'
+                ? resumeOrTurnId
+                : typeof resumeOrTurnId === 'object' && resumeOrTurnId !== null
+                    ? resumeOrTurnId.turnId
+                    : undefined;
+            const gatedDispatchAttempt = typeof resumeOrTurnId === 'object' && resumeOrTurnId !== null
+                ? resumeOrTurnId.dispatchAttempt
+                : undefined;
+            sendWorkerInput(ds, promptInput, gatedTurnId, {
+                ...(gatedDispatchAttempt !== undefined
+                    ? { dispatchAttempt: gatedDispatchAttempt }
+                    : {}),
+            });
+        }
+        else {
+            transferGate.needsWorker = true;
+        }
+        logger.info(`[${tag(ds)}] Deferred ${gatedPrompt.content === '' ? 'empty ' : ''}worker refork behind routing transfer`);
+        if (transferGate.released && transferGate.forkWorkerImpl) {
+            queueMicrotask(() => {
+                if (transferInputGates.get(ds) === transferGate) {
+                    releaseTransferInputGate(ds, transferGate, transferGate.forkWorkerImpl);
+                }
+            });
+        }
+        return;
+    }
     // Device enrollment briefly freezes every daemon before the one-way host
     // marker is installed and legacy local CLIs are torn down. Do this before
     // ANY session mutation or child fork. One deferred spawn per logical session
@@ -1819,6 +2938,8 @@ export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
         logger.info(`[${tag(ds)}] worker spawn deferred during device credential activation`);
         return;
     }
+    if (!canForkRegisteredSession(ds))
+        return;
     const cb = requireCallbacks();
     const bot = getBot(ds.larkAppId);
     const botCfg = bot.config;
@@ -1838,6 +2959,7 @@ export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
     const workerPath = join(__dirname, '..', 'worker.js');
     const t = tag(ds);
     ds.localProcessAttestation = undefined;
+    ds.workerReady = false;
     let resume = false;
     let initTurnId;
     let initDispatchAttempt;
@@ -1921,16 +3043,19 @@ export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
     const workerGeneration = reserveWorkerGeneration(ds);
     // Guard against double-fork: if a worker is already running, kill it first
     if (ds.worker && !ds.worker.killed) {
-        logger.warn(`[${t}] Worker already running (pid: ${ds.worker.pid}), killing before re-fork`);
+        const replacedWorker = ds.worker;
+        logger.warn(`[${t}] Worker already running (pid: ${replacedWorker.pid}), killing before re-fork`);
+        trackLifecycleRetirement(ds, replacedWorker);
         try {
-            ds.worker.send({ type: 'close' });
+            replacedWorker.send({ type: 'close' });
         }
         catch { /* ignore */ }
         try {
-            ds.worker.kill();
+            replacedWorker.kill();
         }
         catch { /* ignore */ }
         ds.worker = null;
+        ds.workerReady = false;
         ds.workerPort = null;
         ds.workerToken = null;
         ds.workerViewToken = null;
@@ -1991,9 +3116,12 @@ export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
     const familyAdapter = createCliAdapterSync(agentCfg.cliId, agentCfg.cliPathOverride);
     if (familyAdapter.claudeStateJsonPath)
         ensureClaudeFolderTrust(cwd, familyAdapter.claudeStateJsonPath);
-    // Prepend ~/.botmux/bin to PATH so CLIs can call `botmux send` etc.
-    // The wrapper script there is written by the daemon at startup.
-    const botmuxBinDir = join(homedir(), '.botmux', 'bin');
+    // Prepend the botmux wrapper bin dir to PATH so CLIs can call `botmux send` etc.
+    // Single source of truth (resolveBotmuxWrapperBinDir): core-only → dedicated
+    // `<SESSION_DATA_DIR>/bin` (not the shared ~/.botmux/bin), matching where the
+    // daemon WROTE the wrapper — else the worker PATH would miss it or a same-HOME
+    // fleet wrapper would shadow it (codex P1).
+    const botmuxBinDir = resolveBotmuxWrapperBinDir(process.env);
     const pathWithBotmux = prependBotmuxBin(botmuxBinDir, process.env.PATH);
     const forkEnv = workerForkEnv(process.env);
     const worker = fork(workerPath, [], {
@@ -2008,7 +3136,11 @@ export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
             SESSION_DATA_DIR: config.session.dataDir,
             BOTMUX_SESSION_ID: ds.session.sessionId,
             LARK_APP_ID: botCfg.larkAppId,
-            LARK_APP_SECRET: botCfg.larkAppSecret,
+            // Withhold the real secret from the worker's own CLI env for a no-transport
+            // session (apiOnly bot or HTTP virtual chat). SEPARATE leak from the
+            // init-message larkAppSecret — the spawned CLI env carries it directly from
+            // botCfg. Empty it here too so no secret reaches the worker/sandbox.
+            LARK_APP_SECRET: larkTransportEnabled({ chatId: ds.chatId, apiOnly: botCfg.apiOnly }) ? botCfg.larkAppSecret : '',
         },
     });
     const startupState = {
@@ -2076,6 +3208,7 @@ export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
         wrapperCli: agentCfg.wrapperCli,
         launchShell: botCfg.launchShell,
         model: agentCfg.model,
+        reasoningEffort: agentCfg.reasoningEffort,
         disableCliBypass: botCfg.disableCliBypass === true,
         codexRpcInput: botCfg.codexRpcInput === true || config.codexRpcInputDefault,
         // Startup commands run on every fresh spawn (incl. resume) so session-only
@@ -2096,7 +3229,16 @@ export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
         // Per-bot local read isolation (enforced worker-side; the worker gates it).
         // Sibling data needs no app-id enumeration: per-bot dirs are denied wholesale
         // and per-bot session files by filename pattern (see buildV2DenyPaths).
-        readIsolation: botCfg.readIsolation === true,
+        // HARD credential boundary for a no-transport session (apiOnly bot OR HTTP
+        // virtual chat): force read isolation so the CLI physically cannot read the
+        // full bots.json / sibling BOT_HOME / send-cred / lark-cli store — a model
+        // that deletes/forges the ancestry marker or bypasses the CLI still cannot
+        // build ANY (sibling) Lark client. The pid-marker gate is only friendly
+        // early-reject; THIS is the fail-closed boundary. Reuses the existing unified
+        // fs-policy (mac+Linux fail-closed); a backend that can't isolate locally
+        // refuses to spawn rather than leak creds.
+        readIsolation: botCfg.readIsolation === true
+            || !larkTransportEnabled({ chatId: ds.chatId, apiOnly: botCfg.apiOnly }),
         readDenyExtraPaths: botCfg.readDenyExtraPaths ?? [],
         // Identifies THIS daemon lifetime. Stamped onto isolated panes so the worker
         // can tell a suspend→resume reattach (same boot id, still isolated) from a
@@ -2125,7 +3267,20 @@ export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
         ownerOpenId: ds.ownerOpenId,
         webPort: ds.session.webPort,
         larkAppId: botCfg.larkAppId,
-        larkAppSecret: botCfg.larkAppSecret,
+        // Freeze on the session transport capability: a no-transport session
+        // (apiOnly bot OR HTTP virtual chat) must not even RECEIVE the real secret —
+        // withholding it removes the capability rather than gating a tamperable flag
+        // the sandboxed agent could flip. The worker then physically cannot dial
+        // Feishu (uploader/cred-write are also skipped downstream on the same test).
+        larkAppSecret: larkTransportEnabled({ chatId: ds.chatId, apiOnly: botCfg.apiOnly }) ? botCfg.larkAppSecret : '',
+        apiOnly: botCfg.apiOnly,
+        // Freeze the ACTUAL loaded bots-config path (getLoadedConfigPath) so a
+        // no-transport worker's fs-policy denies it from a HOST-owned fact, not a
+        // guess off BOTS_CONFIG env (which the agent could see/forge). When it lives
+        // outside every botmux authority root, buildFsPolicy fails the spawn closed
+        // rather than silently masking an arbitrary parent dir (codex P1). Omitted
+        // from forkAdoptWorker below — its observe branch returns before fs-policy.
+        loadedBotsConfigPath: getLoadedConfigPath(),
         brand: normalizeBrand(botCfg.brand),
         botName: bot.botName,
         botOpenId: bot.botOpenId,
@@ -2141,6 +3296,16 @@ export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
         ...(ds.session.runnerBuildId ? { persistedRunnerBuildId: ds.session.runnerBuildId } : {}),
         ...(restartAttemptId ? { restartAttemptId } : {}),
     };
+    // A persisted port from an older ZMX implementation must never revive the
+    // removed Web TUI or get forwarded as a preferred listen port. The worker
+    // will signal lifecycle readiness with port=0 instead.
+    if (!backendSupportsWebTerminal(initMsg.backendType)) {
+        initMsg.webPort = undefined;
+        if (ds.session.webPort !== undefined) {
+            ds.session.webPort = undefined;
+            sessionStore.updateSession(ds.session);
+        }
+    }
     worker.send(initMsg);
     ds.initConfig = initMsg;
     // Stamp cliId on the persisted session so the dashboard can show a CLI badge
@@ -2230,6 +3395,50 @@ export function invalidateStuckWarning(ds, reason) {
     logger.debug(`[${t}] invalidateStuckWarning (${reason}): turn=${ds.stuckWarningTurnId ?? 'none'} nonce=${ds.stuckWarningNonce ?? 'none'}`);
     clearStuckWarningAuthority(ds);
 }
+function hasTuiPromptAuthority(ds) {
+    return ds.tuiPromptCardId !== undefined
+        || ds.tuiPromptOptions !== undefined
+        || ds.tuiPromptMultiSelect !== undefined
+        || ds.tuiToggledIndices !== undefined
+        || !!ds.tuiPromptProcessing;
+}
+/**
+ * Drop every daemon-side marker owned by one interactive TUI prompt. The
+ * processing flag and option metadata are part of the same authority as the
+ * card ID: retaining any subset lets a dead generation block or mutate the
+ * next prompt.
+ */
+function clearTuiPromptAuthority(ds) {
+    ds.tuiPromptCardId = undefined;
+    ds.tuiPromptOptions = undefined;
+    ds.tuiPromptMultiSelect = undefined;
+    ds.tuiToggledIndices = undefined;
+    ds.tuiPromptProcessing = false;
+}
+/**
+ * Retire an outstanding TUI prompt when its worker/CLI lifetime ends. A worker
+ * can die after receiving a card click but before acknowledging backend
+ * delivery; resolving the card and clearing all authority here prevents that
+ * narrow window from permanently occupying the session's prompt slot.
+ */
+function invalidateTuiPrompt(ds, reason, outcome = 'failed') {
+    if (!hasTuiPromptAuthority(ds))
+        return;
+    const t = tag(ds);
+    if (ds.tuiPromptCardId) {
+        const locDs = localeForBot(ds.larkAppId);
+        const cliId = ds.session.cliId ?? ds.initConfig?.cliId;
+        const terminalCard = outcome === 'resolved'
+            ? buildTuiPromptResolvedCard(tr('card.action.tui_done', undefined, locDs), locDs)
+            : buildTuiPromptFailedCard(tr('worker.tui_submit_failed', {
+                cliName: cliId ? getCliDisplayName(cliId) : 'CLI',
+            }, locDs), locDs);
+        updateMessage(ds.larkAppId, ds.tuiPromptCardId, terminalCard).catch(err => logger.debug(`[${t}] Failed to update terminal TUI prompt card (${reason}): ${err}`));
+    }
+    logger.debug(`[${t}] invalidateTuiPrompt (${reason}): card=${ds.tuiPromptCardId ?? 'none'}`);
+    clearTuiPromptAuthority(ds);
+    publishAttentionPatch(ds);
+}
 function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureNotified: false }, reservedWorkerGeneration) {
     const cb = requireCallbacks();
     const t = tag(ds);
@@ -2239,11 +3448,25 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
         || ds.session.workerGeneration !== workerGeneration) {
         throw new Error('worker generation reservation changed before IPC setup');
     }
+    const handlerSession = ds.session;
+    const handlerAnchor = sessionAnchorId(ds);
+    const handlerLarkAppId = ds.larkAppId;
+    const ownsWorkerSession = () => ds.worker === worker
+        && ds.workerGeneration === workerGeneration
+        && ds.session.workerGeneration === workerGeneration
+        && ds.session === handlerSession
+        && ds.session.status === 'active'
+        && ds.larkAppId === handlerLarkAppId
+        && sessionAnchorId(ds) === handlerAnchor
+        && (!activeSessionsRegistry
+            || activeSessionsRegistry.get(sessionKey(handlerAnchor, handlerLarkAppId)) === ds);
+    const ownsLifecycleMutation = () => ownsWorkerSession() && !isSessionTransferring(ds);
     // A new worker generation is starting. As a backstop, invalidate any
     // stuck-warning card posted by the previous generation — explicit kill/suspend/
     // exit paths should already have done this, but fork/refork/takeover paths
     // can leave a stale card that would otherwise inject keys into the new CLI.
     invalidateStuckWarning(ds, 'new_worker_generation');
+    invalidateTuiPrompt(ds, 'new_worker_generation');
     // Managed turn authority is issued by one concrete worker lifetime. A
     // replacement must advertise a fresh capability before daemon-mediated
     // exits may use it; carrying the old value across a restore/refork would
@@ -2270,6 +3493,15 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
     /** Auxiliary worker UI is never an authorized output channel for a dedicated
      * VC receiver. Dashboard/audit state is still updated before these guards. */
     const managedAuxUiSuppressed = (turnId, dispatchAttempt) => {
+        // No-transport session (apiOnly bot or HTTP virtual chat): there is no real
+        // Feishu chat to render a card/reaction into. Suppress ALL auxiliary UI at
+        // the single source every aux-UI handler funnels through — this is the
+        // authoritative fix, NOT a fake "success" message id from sessionReply (a
+        // synthetic id would get stored as streamCardId and later scheduleCardPatch
+        // → updateMessage would still dial Feishu). Dashboard/web-terminal state is
+        // still updated before these guards, so the terminal view is unaffected.
+        if (!larkTransportEnabled({ chatId: ds.chatId, apiOnly: getBot(ds.larkAppId).config.apiOnly }))
+            return true;
         if (isSilentScheduledTurn(ds, turnId))
             return true;
         if (ds.session.vcMeetingReceiver)
@@ -2335,6 +3567,14 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
     const isAdopt = !!ds.adoptedFrom;
     const showTakeover = false;
     worker.on('message', async (msg) => {
+        // Every IPC message is scoped to the child generation that emitted it.
+        // A replaced worker can drain queued messages after the new child has been
+        // installed; never let those stale events mutate the replacement's cards,
+        // tokens, readiness, transcript metadata, or durable turn state.
+        if (ds.worker !== worker) {
+            logger.debug(`[${t}] Ignored stale worker message: ${msg.type}`);
+            return;
+        }
         const effectiveCliId = sessionCliId(ds, botCfg);
         switch (msg.type) {
             case 'persistent_backend_target': {
@@ -2354,6 +3594,9 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                 }
                 if (recordDispatchInputCommit(ds.session, msg.turnId, workerGeneration)) {
                     sessionStore.updateSession(ds.session);
+                    if (msg.turnId.startsWith('mlrp_turn_')) {
+                        markMessageListenerRunPreviewRunning(msg.turnId);
+                    }
                 }
                 else {
                     logger.warn(`[${t}] Ignored unbound input commit turn=${msg.turnId.slice(0, 16)}`);
@@ -2373,8 +3616,6 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                 // unlike .botmux-cli-pids it cannot be forged or deleted by the CLI.
                 // Bind it to the daemon's current worker generation so a late message
                 // from a replaced worker never attests the replacement process.
-                if (ds.worker !== worker)
-                    break;
                 ds.localProcessAttestation = {
                     backendType: msg.backendType,
                     credentialIsolated: msg.credentialIsolated,
@@ -2387,33 +3628,56 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                 break;
             }
             case 'ready': {
+                if (!ownsLifecycleMutation()) {
+                    logger.warn(`[${t}] Ignored ready from stale/transferring worker generation`);
+                    break;
+                }
                 startupState.ready = true;
-                ds.workerPort = msg.port;
-                ds.workerToken = msg.token;
-                ds.workerViewToken = msg.viewToken ?? null;
-                // Persist port so it can be reused after daemon restart
-                ds.session.webPort = msg.port;
+                ds.workerReady = true;
+                // Treat `ready` as a full state boundary for the usage refresh: clear
+                // any timer inherited from a PRIOR worker generation up front, so the
+                // managed/replyAlreadySent/disabled/recovery/sentinel early-breaks below
+                // never keep a dead generation's interval alive. The authorized arm is
+                // re-established after a successful card reuse / fresh POST (below). This
+                // is the third arm point — without it, an auto-restart mid-`working`
+                // (claude_exit rc<=3 → workerReady=false → tick self-clears) would reuse
+                // the old card on ready then never re-arm, because the first post-restart
+                // screen_update is working→working (statusChanged=false → early break).
+                clearUsageRefreshTimer(ds);
+                const webPort = Number.isInteger(msg.port) && msg.port > 0 ? msg.port : null;
+                ds.workerPort = webPort;
+                ds.workerToken = webPort ? msg.token : null;
+                ds.workerViewToken = webPort ? (msg.viewToken ?? null) : null;
+                // Persist a real port only. port=0 is the explicit ready-without-Web-
+                // Terminal sentinel used by backends whose output is not raw ANSI.
+                ds.session.webPort = webPort ?? undefined;
                 // Dashboard「复现命令」：worker 上报本次冷启的近似复现命令。只存内存字段、
                 // 绝不落盘（含凭证）；warm reattach 时 worker 不重算，故为空——这是有意的
                 // （reattach 不代表本次新算命令真的执行了）。worker 每次 ready 会重报。
                 ds.spawnCommand = msg.spawnCommand;
                 sessionStore.updateSession(ds.session);
-                const readOnlyUrl = buildTerminalUrl(ds);
-                const writeUrl = buildTerminalUrl(ds, { write: true });
-                logger.info(`[${t}] Worker ready, terminal at ${readOnlyUrl.replace(/\?.*$/, '?viewToken=[redacted]')}`);
+                const readOnlyUrl = readableTerminalUrlFor(ds);
+                if (readOnlyUrl) {
+                    logger.info(`[${t}] Worker ready, terminal at ${readOnlyUrl.replace(/\?.*$/, '?viewToken=[redacted]')}`);
+                }
+                else {
+                    logger.info(`[${t}] Worker ready (Web Terminal unavailable for this backend)`);
+                }
                 if (ds.usageLimit) {
                     ds.lastScreenStatus = 'limited';
                     armUsageLimitRetryTimer(ds);
                 }
-                // Dashboard: surface the new xterm port so the live terminal link works.
+                // Dashboard: surface the xterm port, or explicitly clear it for a
+                // ready backend with no Web Terminal capability.
                 dashboardEventBus.publish({
                     type: 'session.update',
                     body: {
                         sessionId: ds.session.sessionId,
-                        patch: { webPort: msg.port },
+                        patch: { webPort },
                     },
                 });
-                // Substitute-mode control card: DM owner(s) a writable terminal + manage buttons.
+                // Substitute-mode control card: DM owner(s) writable-terminal controls
+                // when supported, or manage-only controls for no-Web backends.
                 // Consumed before any early break below so avatar-style (card-off) sessions
                 // still deliver the owner control card.
                 if (ds.pendingSubstituteControlCard) {
@@ -2478,8 +3742,10 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                         // undefined and fall back to 'starting' (unchanged behavior).
                         const initStatus = ds.usageLimit ? 'limited' : (ds.lastScreenStatus ?? 'starting');
                         const localCliReadyAtBuild = isLocalCliOpenReady(ds, { cliId: effectiveCliId });
-                        const streamCardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readOnlyUrl, initTitle, ds.lastScreenContent ?? '', initStatus, effectiveCliId, ds.displayMode ?? 'hidden', ds.streamCardNonce, ds.currentImageKey, isAdopt, showTakeover, loc, initStatus === 'limited' ? ds.usageLimit : undefined, writableTerminalLinkFor(ds), localCliReadyAtBuild);
+                        const streamCardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readOnlyUrl, initTitle, ds.lastScreenContent ?? '', initStatus, effectiveCliId, ds.displayMode ?? 'hidden', ds.streamCardNonce, ds.currentImageKey, isAdopt, showTakeover, loc, initStatus === 'limited' ? ds.usageLimit : undefined, writableTerminalLinkFor(ds), localCliReadyAtBuild, getDaemonStreamingCardUsageSnapshot(ds, effectiveCliId));
                         await updateMessage(ds.larkAppId, restoredCardId, streamCardJson);
+                        if (!ownsLifecycleMutation())
+                            break;
                         // Worker IPC handlers may run while the direct restore PATCH is in
                         // flight. Re-queue readiness after it completes so an older
                         // not-ready payload can never overwrite the cli_session_id PATCH.
@@ -2494,9 +3760,16 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                         // thread on each restart.
                         recallFrozenCards(ds);
                         logger.info(`[${t}] Reused existing streaming card ${restoredCardId.substring(0, 12)} after worker (re)start`);
+                        // Auto-restart recovery: if the reused card is a still-`working`
+                        // turn, re-arm the periodic usage refresh here. The first
+                        // post-restart screen_update is typically working→working
+                        // (statusChanged=false) and would break before the arm choke point.
+                        syncUsageRefreshTimer(ds);
                         break;
                     }
                     catch (err) {
+                        if (!ownsLifecycleMutation())
+                            break;
                         // PATCH failed (withdrawn, expired, etc.) — fall through to POST a fresh card.
                         logger.info(`[${t}] Failed to reuse existing streaming card (${err instanceof Error ? err.message : err}), posting new one`);
                         ds.streamCardId = undefined;
@@ -2525,8 +3798,13 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                     // from before the kill+fork — using it avoids a blank flash
                     // before the first screen_update lands. Fresh worker spawn
                     // has lastScreenContent undefined → '' (unchanged).
-                    ds.lastScreenContent ?? '', initStatus, effectiveCliId, ds.displayMode ?? 'hidden', ds.streamCardNonce, ds.currentImageKey, isAdopt, showTakeover, loc, initStatus === 'limited' ? ds.usageLimit : undefined, writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: effectiveCliId }));
-                    ds.streamCardId = await scopedReply(streamCardJson, 'interactive', msg.turnId);
+                    ds.lastScreenContent ?? '', initStatus, effectiveCliId, ds.displayMode ?? 'hidden', ds.streamCardNonce, ds.currentImageKey, isAdopt, showTakeover, loc, initStatus === 'limited' ? ds.usageLimit : undefined, writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: effectiveCliId }), getDaemonStreamingCardUsageSnapshot(ds, effectiveCliId));
+                    const postedCardId = await scopedReply(streamCardJson, 'interactive', msg.turnId);
+                    if (!ownsLifecycleMutation()) {
+                        void deleteMessage(ds.larkAppId, postedCardId).catch(() => { });
+                        break;
+                    }
+                    ds.streamCardId = postedCardId;
                     // This card IS the current turn's live card — clear the new-turn flag
                     // so subsequent screen_updates PATCH it (starting → working) instead of
                     // POSTing a second card. Without this, a re-fork that happens while
@@ -2545,8 +3823,14 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                     recallFrozenCards(ds);
                     flushPendingLocalCliOpenReadinessPatch(ds);
                     flushPendingRiffUrlPatch(ds);
+                    // Fresh ready POST: if this turn is already `working` (e.g. relay
+                    // resume where the CLI kept running), arm here — same authorized arm
+                    // point as the reuse branch, now that streamCardId is the real id.
+                    syncUsageRefreshTimer(ds);
                 }
                 catch (err) {
+                    if (!ownsLifecycleMutation())
+                        break;
                     if (err instanceof MessageWithdrawnError) {
                         logger.warn(`[${t}] Root message withdrawn, closing stale session`);
                         killWorker(ds);
@@ -2563,6 +3847,10 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                         const localCliReadyAtBuild = isLocalCliOpenReady(ds, { cliId: effectiveCliId });
                         const cardJson = buildSessionCard(ds.session.sessionId, sessionAnchorId(ds), readOnlyUrl, ds.session.title || getCliDisplayName(effectiveCliId), effectiveCliId, undefined, !!ds.adoptedFrom, loc, localCliReadyAtBuild);
                         const fallbackCardId = await scopedReply(cardJson, 'interactive', msg.turnId);
+                        if (!ownsLifecycleMutation()) {
+                            void deleteMessage(ds.larkAppId, fallbackCardId).catch(() => { });
+                            break;
+                        }
                         if (!localCliReadyAtBuild && isLocalCliOpenEnabled()
                             && isLocalCliOpenReady(ds, { cliId: effectiveCliId })) {
                             const readyCardJson = buildSessionCard(ds.session.sessionId, sessionAnchorId(ds), readOnlyUrl, ds.session.title || getCliDisplayName(effectiveCliId), effectiveCliId, undefined, !!ds.adoptedFrom, loc, true);
@@ -2575,6 +3863,8 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                         }
                     }
                     catch (fallbackErr) {
+                        if (!ownsLifecycleMutation())
+                            break;
                         if (fallbackErr instanceof MessageWithdrawnError) {
                             logger.warn(`[${t}] Root message withdrawn, closing stale session`);
                             killWorker(ds);
@@ -2616,7 +3906,7 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                     const followUpCodexAppInput = followUp?.codexAppInputGateFrozen
                         ? followUp.codexAppInput
                         : codexAppInputForSession(ds, followUp?.codexAppInput);
-                    ds.worker.send({
+                    sendWorkerSessionInput(ds, {
                         type: 'raw_input',
                         content: rawInput,
                         ...(rawTurnId ? { turnId: rawTurnId } : {}),
@@ -2633,6 +3923,7 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                 }
                 // CLI reached its prompt — any previously posted stuck warning is stale.
                 invalidateStuckWarning(ds, 'prompt_ready');
+                invalidateTuiPrompt(ds, 'prompt_ready', 'resolved');
                 break;
             }
             case 'runner_build_ready': {
@@ -2692,24 +3983,32 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                 break;
             }
             case 'screen_update': {
-                // Wait for `ready` (workerPort) before any card work — the read link
-                // is the LOCAL log terminal for every backend including riff
-                // (Web终端=日志页), so a port-less POST would render
-                // `http://host:undefined`. riff's early markPromptReady screen_update
-                // simply drops here; the `ready` handler posts the initial card with
-                // the real port, and riffAccessUrl rides the pending-patch flow.
-                if (!ds.workerPort)
+                if (!ownsLifecycleMutation())
+                    break;
+                // Wait for worker init, independently of Web Terminal availability.
+                // ZMX intentionally reports ready with port=0, but its plain-history
+                // screenshots and idle/status transitions must keep flowing.
+                if (!startupState.ready && !workerHasInitialized(ds))
                     break;
                 const prevStatus = ds.lastScreenStatus;
                 updateUsageLimitState(ds, msg.usageLimit);
                 ds.lastScreenContent = msg.content;
                 ds.lastScreenStatus = (msg.usageLimit ?? ds.usageLimit) ? 'limited' : msg.status;
+                // State-boundary clear: the moment we leave `working` (→ idle/limited),
+                // stop the periodic usage refresh immediately — BEFORE the aux-UI /
+                // card-disabled / recovery early-breaks below, which would otherwise
+                // skip the arm/clear choke point and leave the interval running until it
+                // self-corrects or the worker is killed. Arm stays gated below (needs a
+                // live card + UI gates); only the clear needs to be unconditional here.
+                if (ds.lastScreenStatus !== 'working')
+                    clearUsageRefreshTimer(ds);
                 // Dashboard: publish a patch only when status truly transitioned, so
                 // SSE clients reflect real state changes (starting → working → idle)
                 // without flooding on every PTY tick. The screen analyzer is the
                 // upstream debouncer — by the time we get here, status flips are
                 // already coarse-grained.
                 if (prevStatus !== ds.lastScreenStatus) {
+                    const dashboardRow = composeRowFromActive(ds);
                     dashboardEventBus.publish({
                         type: 'session.update',
                         body: {
@@ -2717,7 +4016,14 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                             patch: {
                                 status: ds.lastScreenStatus,
                                 lastMessageAt: ds.lastMessageAt,
-                                tokenUsage: composeRowFromActive(ds).tokenUsage,
+                                tokenUsage: dashboardRow.tokenUsage,
+                                previewUserText: dashboardRow.previewUserText,
+                                previewBotText: dashboardRow.previewBotText,
+                                previewUserFullText: dashboardRow.previewUserFullText,
+                                previewBotFullText: dashboardRow.previewBotFullText,
+                                previewUserAt: dashboardRow.previewUserAt,
+                                previewBotAt: dashboardRow.previewBotAt,
+                                previewBotState: dashboardRow.previewBotState,
                             },
                         },
                     });
@@ -2725,12 +4031,18 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                         source: 'screen_update',
                         content: msg.content,
                     });
-                    // Usage ledger + turn reactions: idle/limited edges are turn
-                    // boundaries. Append the token delta, and flip this turn's pending ✋
-                    // reactions to ✅ (best-effort, never blocks the status pipeline).
+                    // Usage ledger: any settle-to-idle/limited edge records the delta.
+                    // Turn reactions are stricter — only flip ✋→✅ after a real busy
+                    // period (working/analyzing). Cold-start starting→idle (or the first
+                    // prompt-ready before the turn has gone working) must NOT DONE a
+                    // message that is still about to be / just being processed. Grok
+                    // card-off sessions hit this when the ready-gate settle fired idle
+                    // ~seconds after GoGoGo while the CLI was still running the prompt.
                     if (ds.lastScreenStatus === 'idle' || ds.lastScreenStatus === 'limited') {
                         recordUsageForDaemonSession(ds);
-                        void finishTurnReactions(ds);
+                        if (prevStatus === 'working' || prevStatus === 'analyzing') {
+                            void finishTurnReactions(ds);
+                        }
                     }
                     if (ds.lastScreenStatus === 'idle'
                         && msg.turnId
@@ -2746,20 +4058,26 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                         queueMicrotask(cb.enforceLiveSessionCap);
                     }
                 }
-                if (managedAuxUiSuppressed(msg.turnId, msg.dispatchAttempt))
+                if (managedAuxUiSuppressed(msg.turnId, msg.dispatchAttempt)) {
+                    clearUsageRefreshTimer(ds);
                     break;
+                }
                 // Bot opted out of the streaming card — dashboard SSE above already got
                 // the status patch; just don't touch any Lark card. Turn-exact: a
                 // substitute turn's screen updates stay card-less even after a queued
                 // normal turn overwrote currentReplyTarget (and vice versa).
-                if (streamingCardDisabled(ds, msg.turnId))
+                if (streamingCardDisabled(ds, msg.turnId)) {
+                    clearUsageRefreshTimer(ds);
                     break;
+                }
                 // Restart recovery: a restored worker may emit screen updates as the CLI
                 // redraws on resume. Stay silent (no post/patch) until the first real
                 // user turn clears the flag. Dashboard SSE above still reflects status.
-                if (ds.suppressRecoveryCard)
+                if (ds.suppressRecoveryCard) {
+                    clearUsageRefreshTimer(ds);
                     break;
-                const readUrl = buildTerminalUrl(ds);
+                }
+                const readUrl = readableTerminalUrlFor(ds);
                 const turnTitle = ds.currentTurnTitle || ds.session.title || getCliDisplayName(effectiveCliId);
                 const mode = ds.displayMode ?? 'hidden';
                 if (ds.streamCardPending || !ds.streamCardId) {
@@ -2774,13 +4092,17 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                     // New turn → image_key from previous turn no longer valid
                     if (isNewTurn)
                         ds.currentImageKey = undefined;
-                    const cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, turnTitle, isNewTurn ? '' : msg.content, ds.lastScreenStatus, effectiveCliId, mode, ds.streamCardNonce, ds.currentImageKey, isAdopt, showTakeover, loc, cardUsageLimit(ds), writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: effectiveCliId }));
+                    const cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, turnTitle, isNewTurn ? '' : msg.content, ds.lastScreenStatus, effectiveCliId, mode, ds.streamCardNonce, ds.currentImageKey, isAdopt, showTakeover, loc, cardUsageLimit(ds), writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: effectiveCliId }), getDaemonStreamingCardUsageSnapshot(ds, effectiveCliId));
                     // Mark POST in-flight so subsequent screen_updates are dropped,
                     // not POSTed as duplicate cards.
                     ds.streamCardPending = false;
                     ds.streamCardId = CARD_POSTING_SENTINEL;
                     scopedReply(cardJson, 'interactive', msg.turnId)
                         .then(msgId => {
+                        if (!ownsLifecycleMutation()) {
+                            void deleteMessage(ds.larkAppId, msgId).catch(() => { });
+                            return;
+                        }
                         ds.streamCardId = msgId;
                         persistStreamCardState(ds);
                         // New card live — recall any cards parked by previous turns
@@ -2791,8 +4113,15 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                         recallFrozenCards(ds);
                         flushPendingLocalCliOpenReadinessPatch(ds);
                         flushPendingRiffUrlPatch(ds);
+                        // New-turn POST is the FIRST working screen_update of the turn —
+                        // the else (same-turn PATCH) branch never runs for it, so arm the
+                        // periodic usage refresh here (once the real card id exists, not
+                        // the POSTING sentinel). syncUsageRefreshTimer re-checks state.
+                        syncUsageRefreshTimer(ds);
                     })
                         .catch(err => {
+                        if (!ownsLifecycleMutation())
+                            return;
                         if (err instanceof MessageWithdrawnError) {
                             logger.warn(`[${t}] Root message withdrawn, closing stale session`);
                             killWorker(ds);
@@ -2811,8 +4140,17 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                     const statusChanged = prevStatus !== ds.lastScreenStatus;
                     if (!statusChanged)
                         break;
-                    const cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, turnTitle, msg.content, ds.lastScreenStatus, effectiveCliId, mode, ds.streamCardNonce, ds.currentImageKey, isAdopt, showTakeover, loc, cardUsageLimit(ds), writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: effectiveCliId }));
+                    const cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, turnTitle, msg.content, ds.lastScreenStatus, effectiveCliId, mode, ds.streamCardNonce, ds.currentImageKey, isAdopt, showTakeover, loc, cardUsageLimit(ds), writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: effectiveCliId }), 
+                    // Turn end (→ idle) reads the exact latest usage; intra-turn status
+                    // ticks ride the throttle. See getDaemonStreamingCardUsageSnapshot.
+                    getDaemonStreamingCardUsageSnapshot(ds, effectiveCliId, {
+                        fresh: ds.lastScreenStatus === 'idle',
+                    }));
                     scheduleCardPatch(ds, cardJson, msg.turnId);
+                    // Keep the live usage climbing during a long working phase; stop once
+                    // the turn settles (idle/limited). State-boundary invariant — one
+                    // choke point re-evaluates arm/clear after this status assignment.
+                    syncUsageRefreshTimer(ds);
                 }
                 break;
             }
@@ -2831,29 +4169,40 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                     content: ds.lastScreenContent ?? '',
                 });
                 persistStreamCardState(ds);
-                if (managedAuxUiSuppressed(msg.turnId, msg.dispatchAttempt))
+                // screenshot_uploaded never ARMS the usage refresh — screen_update owns
+                // the authorized arm. Here we only tear it down: unconditionally on
+                // leaving `working`, and on a managed/silent turn (below) that must not
+                // keep a group-visible card ticking. Arming here would let a 12s tick
+                // re-render the prior visible card with THIS managed/hidden turn's
+                // content — the same leak class as substitute-turn card suppression.
+                if (ds.lastScreenStatus !== 'working')
+                    clearUsageRefreshTimer(ds);
+                if (managedAuxUiSuppressed(msg.turnId, msg.dispatchAttempt)) {
+                    clearUsageRefreshTimer(ds);
                     break;
+                }
                 if ((ds.displayMode ?? 'hidden') !== 'screenshot')
                     break;
-                if (!ds.streamCardId || ds.streamCardId === CARD_POSTING_SENTINEL || !ds.workerPort)
+                if (!ds.streamCardId || ds.streamCardId === CARD_POSTING_SENTINEL || !workerHasInitialized(ds))
                     break;
-                const readUrl = buildTerminalUrl(ds);
+                const readUrl = readableTerminalUrlFor(ds);
                 const turnTitle = ds.currentTurnTitle || ds.session.title || getCliDisplayName(effectiveCliId);
-                const cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, turnTitle, ds.lastScreenContent ?? '', ds.lastScreenStatus, effectiveCliId, 'screenshot', ds.streamCardNonce, ds.currentImageKey, isAdopt, showTakeover, loc, cardUsageLimit(ds), writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: effectiveCliId }));
+                const cardJson = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, turnTitle, ds.lastScreenContent ?? '', ds.lastScreenStatus, effectiveCliId, 'screenshot', ds.streamCardNonce, ds.currentImageKey, isAdopt, showTakeover, loc, cardUsageLimit(ds), writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: effectiveCliId }), getDaemonStreamingCardUsageSnapshot(ds, effectiveCliId, { fresh: ds.lastScreenStatus === 'idle' }));
                 scheduleCardPatch(ds, cardJson);
                 break;
             }
             case 'tui_prompt': {
                 // AI detected an interactive TUI prompt — post card to thread
-                // Dedup: if a card is already posted for this session, skip
-                if (ds.tuiPromptCardId) {
+                if (!ownsLifecycleMutation()) {
+                    logger.info(`[${t}] Ignored TUI prompt from stale worker generation`);
+                    break;
+                }
+                // Dedup across both posted and in-flight/cardless prompt state.
+                if (hasTuiPromptAuthority(ds)) {
                     logger.debug(`[${t}] TUI prompt card already posted, skipping duplicate`);
                     break;
                 }
                 logger.info(`[${t}] TUI prompt detected: ${msg.description}${msg.multiSelect ? ' (multi-select)' : ''}`);
-                ds.tuiPromptOptions = msg.options;
-                ds.tuiPromptMultiSelect = msg.multiSelect;
-                ds.tuiToggledIndices = [];
                 emitSessionLifecycleHook(ds, 'session.requires_attention', {
                     reason: 'tui_prompt',
                     description: msg.description,
@@ -2871,35 +4220,119 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                 // would temporarily overwrite a user-issued /rename until refresh.
                 ds.currentTurnTitle = msg.description;
                 if (managedAuxUiSuppressed(msg.turnId, msg.dispatchAttempt)) {
-                    logger.info(`[${t}] Managed/silent turn — TUI prompt kept in dashboard/audit only`);
+                    logger.info(`[${t}] Managed/silent turn — TUI prompt kept in lifecycle audit only`);
+                    break;
+                }
+                // Document-native sessions have no Lark chat/thread destination. Keep
+                // the lifecycle audit/title above, but never send a card to their
+                // internal `doc:<token>` routing anchor.
+                if (isDocNativeSession(ds)) {
+                    logger.info(`[${t}] Doc-native session — suppressing TUI prompt card`);
                     break;
                 }
+                // The array identity acts as this prompt's in-memory ownership token.
+                // Clearing/replacing the prompt changes it, so a late card POST cannot
+                // reclaim authority after prompt_ready, worker exit, or replacement.
+                // Cardless silent/document prompts deliberately never occupy this slot.
+                const promptOptions = msg.options;
+                ds.tuiPromptOptions = promptOptions;
+                ds.tuiPromptMultiSelect = msg.multiSelect;
+                ds.tuiToggledIndices = [];
+                ds.tuiPromptProcessing = false;
                 try {
                     const cardJson = buildTuiPromptCard(sessionAnchorId(ds), ds.session.sessionId, msg.description, msg.options, msg.multiSelect, undefined, loc);
                     const cardMsgId = await scopedReply(cardJson, 'interactive', msg.turnId);
+                    const stillOwnsLifecycle = ownsLifecycleMutation();
+                    if (!stillOwnsLifecycle || ds.tuiPromptOptions !== promptOptions) {
+                        const terminalCard = stillOwnsLifecycle
+                            ? buildTuiPromptResolvedCard(tr('card.action.tui_done', undefined, loc), loc)
+                            : buildTuiPromptFailedCard(tr('worker.tui_submit_failed', {
+                                cliName: getCliDisplayName(effectiveCliId),
+                            }, loc), loc);
+                        updateMessage(handlerLarkAppId, cardMsgId, terminalCard).catch(err => logger.debug(`[${t}] Failed to resolve late TUI prompt card: ${err}`));
+                        break;
+                    }
                     ds.tuiPromptCardId = cardMsgId;
                     publishAttentionPatch(ds);
                 }
                 catch (err) {
                     logger.warn(`[${t}] Failed to post TUI prompt card: ${err}`);
+                    if (ownsLifecycleMutation() && ds.tuiPromptOptions === promptOptions) {
+                        clearTuiPromptAuthority(ds);
+                        publishAttentionPatch(ds);
+                    }
                 }
                 break;
             }
             case 'tui_prompt_resolved': {
+                if (ds.worker !== worker
+                    || ds.workerGeneration !== workerGeneration
+                    || ds.session.workerGeneration !== workerGeneration) {
+                    logger.info(`[${t}] Ignored TUI resolved ACK from stale worker generation`);
+                    break;
+                }
                 // TUI prompt is no longer showing — update card if it exists
                 logger.info(`[${t}] TUI prompt resolved${msg.selectedText ? `: ${msg.selectedText}` : ''}`);
+                if (msg.cardMessageId && ds.tuiPromptCardId !== msg.cardMessageId) {
+                    logger.info(`[${t}] Ignored stale TUI resolved ACK for ${msg.cardMessageId} ` +
+                        `(active=${ds.tuiPromptCardId ?? 'none'})`);
+                    break;
+                }
+                const hadAuthority = hasTuiPromptAuthority(ds);
                 if (managedAuxUiSuppressed(msg.turnId, msg.dispatchAttempt)) {
-                    ds.tuiPromptCardId = undefined;
-                    ds.tuiPromptOptions = undefined;
+                    clearTuiPromptAuthority(ds);
+                    if (hadAuthority)
+                        publishAttentionPatch(ds);
                     break;
                 }
                 if (ds.tuiPromptCardId) {
                     const resolvedCard = buildTuiPromptResolvedCard(msg.selectedText ?? tr('card.action.tui_done', undefined, loc), loc);
                     updateMessage(ds.larkAppId, ds.tuiPromptCardId, resolvedCard).catch(err => logger.debug(`[${t}] Failed to update TUI prompt card: ${err}`));
-                    ds.tuiPromptCardId = undefined;
-                    ds.tuiPromptOptions = undefined;
+                }
+                clearTuiPromptAuthority(ds);
+                if (hadAuthority)
                     publishAttentionPatch(ds);
+                break;
+            }
+            case 'tui_prompt_submit_failed': {
+                if (ds.worker !== worker
+                    || ds.workerGeneration !== workerGeneration
+                    || ds.session.workerGeneration !== workerGeneration)
+                    break;
+                const matchesTuiCard = !!msg.cardMessageId
+                    && ds.tuiPromptCardId === msg.cardMessageId;
+                const matchesStuckCard = msg.stuckNonce !== undefined
+                    && ds.stuckWarningNonce === msg.stuckNonce
+                    && !!ds.stuckWarningCardId;
+                if (!matchesTuiCard && !matchesStuckCard) {
+                    logger.info(`[${t}] Ignored stale TUI submit failure ` +
+                        `(card=${msg.cardMessageId ?? 'none'}, stuckNonce=${msg.stuckNonce ?? 'none'})`);
+                    break;
+                }
+                const failureText = tr('worker.tui_submit_failed', {
+                    cliName: getCliDisplayName(effectiveCliId),
+                }, loc);
+                if (!managedAuxUiSuppressed(msg.turnId, msg.dispatchAttempt)) {
+                    const failedCard = buildTuiPromptFailedCard(failureText, loc);
+                    const failedCardId = matchesTuiCard
+                        ? ds.tuiPromptCardId
+                        : ds.stuckWarningCardId;
+                    if (failedCardId) {
+                        updateMessage(ds.larkAppId, failedCardId, failedCard).catch(err => logger.debug(`[${t}] Failed to update TUI failure card: ${err}`));
+                    }
+                    try {
+                        await scopedReply(failureText, 'text', msg.turnId);
+                    }
+                    catch (err) {
+                        logger.error(`[${t}] Failed to deliver TUI submit failure: ${err.message}`);
+                    }
+                }
+                if (matchesTuiCard) {
+                    clearTuiPromptAuthority(ds);
                 }
+                if (matchesStuckCard)
+                    clearStuckWarningAuthority(ds);
+                publishAttentionPatch(ds);
                 break;
             }
             case 'stuck_warning': {
@@ -3037,7 +4470,8 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                 // CLI-generation authority must not outlive the concrete worker/CLI
                 // pair that issued it. A delayed message from a replaced Node worker
                 // must neither clear nor restart the replacement generation.
-                if (ds.worker !== worker) {
+                const workerSession = ds.session;
+                if (ds.worker !== worker || ds.workerGeneration !== workerGeneration) {
                     logger.warn(`[${t}] Ignored claude_exit from stale worker generation`);
                     break;
                 }
@@ -3046,6 +4480,7 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                 // card before any replacement worker can be attached; otherwise a late
                 // click could inject its keys into the replacement CLI.
                 invalidateStuckWarning(ds, 'claude_exit');
+                invalidateTuiPrompt(ds, 'claude_exit');
                 logger.info(`[${t}] ${getCliDisplayName(effectiveCliId)} exited (code: ${msg.code}, signal: ${msg.signal})`);
                 ds.hasHistory = true;
                 try {
@@ -3059,15 +4494,26 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                 catch (err) {
                     logger.error(`[${t}] Failed to reconcile CLI exit generation ${workerGeneration}: ${err.message}`);
                 }
+                // onCliExit may persist/reconcile durable state and therefore yield.
+                // A transfer, repo replacement, or worker replacement that won during
+                // that await owns all later lifecycle decisions. Never restart/kill its
+                // new worker from this stale CLI-exit continuation.
+                if (ds.worker !== worker
+                    || ds.workerGeneration !== workerGeneration
+                    || ds.session !== workerSession
+                    || isSessionTransferring(ds)) {
+                    logger.warn(`[${t}] Suppressed stale claude_exit lifecycle continuation`);
+                    break;
+                }
                 const suppressExitUi = managedAuxUiSuppressed(msg.turnId, msg.dispatchAttempt);
                 // Do NOT auto-restart in adopt mode — there's nothing to restart
                 if (ds.adoptedFrom) {
                     logger.info(`[${t}] Adopted session ended`);
                     // Freeze the streaming card
-                    if (!suppressExitUi && ds.streamCardId && (ds.workerPort || ds.riffAccessUrl)) {
-                        const readUrl = buildTerminalUrl(ds);
+                    if (!suppressExitUi && ds.streamCardId && workerHasInitialized(ds)) {
+                        const readUrl = readableTerminalUrlFor(ds);
                         const turnTitle = ds.currentTurnTitle || ds.session.title || getCliDisplayName(effectiveCliId);
-                        const frozenCard = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, turnTitle, ds.lastScreenContent ?? '', 'idle', effectiveCliId, ds.displayMode ?? 'hidden', ds.streamCardNonce, ds.currentImageKey, isAdopt, showTakeover, loc, undefined, writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: effectiveCliId }));
+                        const frozenCard = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, turnTitle, ds.lastScreenContent ?? '', 'idle', effectiveCliId, ds.displayMode ?? 'hidden', ds.streamCardNonce, ds.currentImageKey, isAdopt, showTakeover, loc, undefined, writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: effectiveCliId }), getDaemonStreamingCardUsageSnapshot(ds, effectiveCliId, { fresh: true }));
                         scheduleCardPatch(ds, frozenCard);
                     }
                     killWorker(ds);
@@ -3096,13 +4542,13 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                 if (rc.count > 3) {
                     logger.warn(`[${t}] ${getCliDisplayName(effectiveCliId)} crashed ${rc.count} times in 1 min, not auto-restarting`);
                     const keepDiagnosticWorker = !!msg.canParkDiagnostic && !!ds.worker && !ds.worker.killed;
-                    // Freeze the last streaming card so it doesn't stay at "working" forever.
-                    // 读链接严格要求 workerPort（riffAccessUrl 是写能力且 worker 退出后不清，
-                    // 用它放行会构造 host:undefined 的坏读链接）。
-                    if (!suppressExitUi && ds.streamCardId && ds.workerPort) {
-                        const readUrl = buildTerminalUrl(ds);
+                    // Freeze the last streaming card so it doesn't stay at "working"
+                    // forever. Backends without a Web Terminal pass an empty read URL;
+                    // the card keeps snapshot/manage controls and omits terminal links.
+                    if (!suppressExitUi && ds.streamCardId && workerHasInitialized(ds)) {
+                        const readUrl = readableTerminalUrlFor(ds);
                         const turnTitle = ds.currentTurnTitle || ds.session.title || getCliDisplayName(effectiveCliId);
-                        const frozenCard = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, turnTitle, ds.lastScreenContent ?? '', 'idle', effectiveCliId, ds.displayMode ?? 'hidden', ds.streamCardNonce, ds.currentImageKey, isAdopt, showTakeover, loc, undefined, writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: effectiveCliId }));
+                        const frozenCard = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, turnTitle, ds.lastScreenContent ?? '', 'idle', effectiveCliId, ds.displayMode ?? 'hidden', ds.streamCardNonce, ds.currentImageKey, isAdopt, showTakeover, loc, undefined, writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: effectiveCliId }), getDaemonStreamingCardUsageSnapshot(ds, effectiveCliId, { fresh: true }));
                         scheduleCardPatch(ds, frozenCard);
                     }
                     if (keepDiagnosticWorker) {
@@ -3111,9 +4557,14 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                         // don't pay for it). Keep its web server alive so the existing
                         // terminal URL can show the startup failure; the next user message
                         // tells that same worker to destroy the diagnostic shell and retry.
+                        ds.workerReady = false;
                         ds.worker.send({ type: 'park_diagnostic' });
                         restartCounts.delete(key);
                         ds.lastScreenStatus = 'idle';
+                        // Diagnostic park keeps the worker alive (no killWorker here), so the
+                        // periodic usage refresh must be stopped explicitly on this
+                        // working→idle boundary — the else branch's killWorker already does.
+                        clearUsageRefreshTimer(ds);
                         // Survive a daemon restart: mark this as a lazy cold-resume so
                         // restore keeps the session active (re-spawns the CLI on the next
                         // message) instead of zombie-closing it when the real bmx-<sid> is
@@ -3140,7 +4591,7 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                             await scopedReply(parts.join('\n\n'), 'text', undefined);
                         }
                         catch (replyErr) {
-                            if (replyErr instanceof MessageWithdrawnError) {
+                            if (replyErr instanceof MessageWithdrawnError && ownsLifecycleMutation()) {
                                 logger.warn(`[${t}] Root message withdrawn, closing stale session`);
                                 cb.closeSession(ds);
                             }
@@ -3148,10 +4599,13 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                     }
                     break;
                 }
-                // Auto-restart CLI within the same worker
+                // Auto-restart CLI within the same worker. 捎带最新 per-bot env：崩溃
+                // 往往正是旧 env 配的错（如过期 token / 失效 proxy），用户改完 env 后
+                // 下一轮 auto-restart 直接用新值恢复，不必再手工 /close。
                 if (ds.worker && !ds.worker.killed) {
                     logger.info(`[${t}] Auto-restarting ${getCliDisplayName(effectiveCliId)}...`);
-                    ds.worker.send({ type: 'restart' });
+                    ds.workerReady = false;
+                    ds.worker.send({ type: 'restart', env: latestPerBotEnvForRestart(ds) });
                 }
                 break;
             }
@@ -3260,6 +4714,15 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                 sourceSessionIds.add(msg.sourceSessionId);
                 break;
             }
+            case 'explicit_reply_observed': {
+                if (msg.turnId.startsWith('mlrp_turn_')) {
+                    markMessageListenerRunPreviewReplied(msg.turnId, {
+                        sessionId: ds.session.sessionId,
+                        replyMessageId: msg.messageId,
+                    });
+                }
+                break;
+            }
             case 'user_notify': {
                 logger.warn(`[${t}] Worker user_notify: ${msg.message}`);
                 emitSessionLifecycleHook(ds, 'session.requires_attention', {
@@ -3321,6 +4784,12 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                     // never let a projection/store failure crash the worker IPC loop.
                     logger.error(`[${t}] Failed to persist turn_terminal for ${msg.turnId.substring(0, 8)}: ${err.message}`);
                 }
+                if (msg.turnId.startsWith('mlrp_turn_') && msg.status !== 'completed') {
+                    markMessageListenerRunPreviewFailed(msg.turnId, {
+                        sessionId: msg.sessionId,
+                        error: msg.errorCode ?? msg.status,
+                    });
+                }
                 try {
                     await cb.onDeferredScheduleTurnSettled?.(ds, { turnId: msg.turnId, source: 'terminal' });
                 }
@@ -3399,6 +4868,10 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                 ds.managedTurnOrigin = undefined;
                 break;
             }
+            case 'session_close_ready': {
+                resolveCloseFence(msg.sessionId, workerGeneration);
+                break;
+            }
             case 'final_output': {
                 // Adopt-bridge: worker harvested the assistant turn from Claude Code's
                 // transcript JSONL and forwarded it to us. Dedup with a session-scoped
@@ -3436,7 +4909,10 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                     if (ds.lastScreenStatus === 'limited')
                         ds.lastScreenStatus = 'idle';
                 }
-                deliverFinalOutput(ds, msg, t, 0);
+                if (msg.turnId.startsWith('mlrp_turn_')) {
+                    markMessageListenerRunPreviewRunning(msg.turnId);
+                }
+                deliverFinalOutput(ds, msg, t, 0, ownsLifecycleMutation);
                 break;
             }
             case 'adopt_preamble': {
@@ -3466,6 +4942,7 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                     locale: localeForBot(ds.larkAppId),
                     workingDir: ds.workingDir,
                     localHomeLinkMode: daemonCardLocalHomeLinkMode(ds),
+                    usage: getDaemonReplyCardUsageSnapshot(ds, effectiveCliId),
                 });
                 scopedReply(cardJson, 'interactive', msg.turnId).catch((err) => {
                     logger.warn(`[${t}] Failed to deliver adopt_preamble to Lark: ${err.message}`);
@@ -3475,12 +4952,15 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
         }
     });
     worker.on('exit', (code, signal) => {
+        const transferRetirement = transferRetiringWorkers.has(worker);
+        transferRetiringWorkers.delete(worker);
+        clearLifecycleRetirement(ds, worker);
         logger.info(`[${t}] Worker process exited (code: ${code})`);
         // Last-resort startup guard: syntax/import crashes and abrupt exits can
         // happen before the worker sends either ready or a structured error.  Do
         // not leave the originating Lark message unanswered. Intentional close /
         // replacement kills are excluded to avoid noisy false alarms.
-        if (!startupState.ready && !startupState.failureNotified && !worker.killed && ds.session.status !== 'closed') {
+        if (!transferRetirement && !startupState.ready && !startupState.failureNotified && !worker.killed && ds.session.status !== 'closed') {
             const reason = tr('worker.start_exited_early', { code: code ?? 'null' }, loc);
             // Carry the frozen init attribution so an abrupt pre-ready exit of a
             // durable VC delivery is fenced to the receipt/lease chain, not replied
@@ -3494,11 +4974,16 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
         if (ds.worker === worker) {
             restartCoordinator.failSession(ds.session.sessionId);
             ds.worker = null;
+            ds.workerReady = false;
             ds.workerPort = null;
+            // Dead worker generation — stop the periodic usage refresh immediately
+            // instead of waiting a tick for it to self-clear on !workerHasInitialized.
+            clearUsageRefreshTimer(ds);
             ds.managedTurnOrigin = undefined;
             // This worker generation is gone. Invalidate any stuck-warning card it
             // posted so a late click cannot inject keys into a replacement worker.
             invalidateStuckWarning(ds, 'worker_exit');
+            invalidateTuiPrompt(ds, 'worker_exit');
             // Fence this lifetime before a polling dispatcher can observe its last
             // ACK. Keeping the old receipt is useful audit evidence, but the
             // persisted current generation advances immediately so it cannot count
@@ -3510,24 +4995,29 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
             ds.session.pid = undefined;
             sessionStore.updateSession(ds.session);
         }
-        try {
-            const notified = cb.onWorkerExit?.(ds, {
-                sessionId: ds.session.sessionId,
-                workerGeneration,
-                code,
-                signal,
-            });
-            void Promise.resolve(notified).catch((err) => {
+        if (!transferRetirement) {
+            try {
+                const notified = cb.onWorkerExit?.(ds, {
+                    sessionId: ds.session.sessionId,
+                    workerGeneration,
+                    code,
+                    signal,
+                });
+                void Promise.resolve(notified).catch((err) => {
+                    logger.error(`[${t}] Failed to reconcile worker exit generation ${workerGeneration}: ${err.message}`);
+                });
+            }
+            catch (err) {
                 logger.error(`[${t}] Failed to reconcile worker exit generation ${workerGeneration}: ${err.message}`);
-            });
+            }
         }
-        catch (err) {
-            logger.error(`[${t}] Failed to reconcile worker exit generation ${workerGeneration}: ${err.message}`);
+        else {
+            logger.info(`[${t}] Suppressed external worker-exit effects for routing transfer`);
         }
         // Notify dashboard, but only once per session lifecycle. The
         // dashboard-driven `closeSession()` path also publishes; whichever
         // fires first wins, the other's emit is suppressed.
-        if (!ds.exitEventEmitted) {
+        if (!transferRetirement && !ds.exitEventEmitted) {
             ds.exitEventEmitted = true;
             dashboardEventBus.publish({
                 type: 'session.exited',
@@ -3577,7 +5067,8 @@ function shouldDropMismatchedHermesFinalOutput(ds, msg, t) {
 /**
  * Turn-end half of the two-phase turn reactions (auto-on for card-off sessions,
  * i.e. streaming card disabled). The 冲! "received" reactions are added per-message at the daemon
- * acceptance point (`noteTurnReceived`); when the worker next returns to idle we
+ * acceptance point (`noteTurnReceived`); the screen_update handler calls this
+ * only on working|analyzing → idle|limited (not cold-start starting→idle), to
  * flip every pending ✋ on this session to ✅ DONE and clear the list. When
  * silentTurnReactions is enabled after a ✋ has already landed, we only remove
  * that received reaction and do not add DONE. Binding the start to the message
@@ -3623,7 +5114,10 @@ async function finishTurnReactions(ds) {
  *  daemon owns retries on transient failures. After 3 attempts we log
  *  and give up — the user's answer is lost; better than leaking memory
  *  via an unbounded retry loop. */
-function deliverFinalOutput(ds, msg, t, attempt) {
+function deliverFinalOutput(ds, msg, t, attempt, stillCurrent = () => true, frozenUsage) {
+    if (!stillCurrent())
+        return;
+    let cardUsage = frozenUsage;
     const managedReceiver = !!ds.session.vcMeetingReceiver;
     // Wait Mode / HTTP Sync Override:
     // If this turn is being waited for by an HTTP webhook request, intercept the
@@ -3643,10 +5137,12 @@ function deliverFinalOutput(ds, msg, t, attempt) {
         asyncResult.status = 'completed';
         asyncResult.content = msg.content;
         asyncResult.completedAt = completedAt;
+        if (msg.usage)
+            asyncResult.usage = msg.usage;
         // Durably persist the outcome so trigger-result can rebuild `completed`
-        // (with content) after a daemon restart drops the in-memory Map. Stamp the
-        // owning bot for cross-bot isolation.
-        asyncTriggerStore.recordCompleted(ds.session.sessionId, msg.turnId, msg.content, completedAt, ds.larkAppId);
+        // (with content + usage) after a daemon restart drops the in-memory Map.
+        // Stamp the owning bot for cross-bot isolation.
+        asyncTriggerStore.recordCompleted(ds.session.sessionId, msg.turnId, msg.content, completedAt, ds.larkAppId, msg.usage);
         ds.lastBridgeEmittedUuid = finalOutputDedupeKey(ds, msg);
         logger.info(`[${t}] Captured final_output for Async HTTP request (turn ${msg.turnId.substring(0, 8)})`);
         return;
@@ -3657,6 +5153,8 @@ function deliverFinalOutput(ds, msg, t, attempt) {
         ? { ...opts, sourceSessionId: ds.session.sessionId }
         : opts);
     setTimeout(async () => {
+        if (!stillCurrent())
+            return;
         // Guard: if the user closed the session (or it was torn down for any
         // other reason) between attempts, don't post a stale final answer to
         // a closed thread.
@@ -3667,31 +5165,44 @@ function deliverFinalOutput(ds, msg, t, attempt) {
         try {
             // 文档评论入口分流：本轮若来自飞书文档评论（/watch-comment / /subscribe-lark-doc），把正文
             // 发表为文档评论（而非飞书卡片），状态卡/占位卡仍留在飞书会话起点。
-            const docTurn = managedReceiver ? undefined : ds.docCommentTurns?.get(msg.turnId);
+            const docTurn = managedReceiver ? undefined : resolveDocCommentTarget(ds, msg.turnId);
             if (docTurn) {
                 // 嵌套回复到用户那条评论 thread（已挂在其下，无需再 ↪ 前缀）。这是兜底路径
                 // （模型没显式 botmux send），默认 @ 回原评论人，仅首块加。
                 const chunks = chunkCommentText(msg.content);
                 for (let i = 0; i < chunks.length; i++) {
+                    if (!stillCurrent())
+                        return;
                     await replyToDocComment(ds.larkAppId, { fileToken: docTurn.fileToken, fileType: docTurn.fileType }, docTurn.commentId, chunks[i], i === 0 ? docTurn.replyToOpenId : undefined);
+                    if (!stillCurrent())
+                        return;
                 }
-                // 清理 "Typing" reaction（bot 已回复完毕）。
+                // The user-visible reply is committed. Consume the route and dedupe
+                // marker BEFORE best-effort reaction cleanup: a missing/expired
+                // reaction must never retry and duplicate the document comment.
+                consumeDocCommentTurn(ds, msg.turnId);
+                ds.lastBridgeEmittedUuid = finalOutputDedupeKey(ds, msg);
                 if (docTurn.reactionId && docTurn.replyId) {
-                    await removeCommentReaction(ds.larkAppId, { fileToken: docTurn.fileToken, fileType: docTurn.fileType }, docTurn.commentId, docTurn.replyId, docTurn.reactionId);
-                }
-                ds.docCommentTurns?.delete(msg.turnId);
-                // 同步清理磁盘上的 per-turn 落点，避免 session 文件堆积。
-                if (ds.session.docCommentTargets && ds.session.docCommentTargets[msg.turnId]) {
-                    delete ds.session.docCommentTargets[msg.turnId];
                     try {
-                        sessionStore.updateSession(ds.session);
+                        await removeCommentReaction(ds.larkAppId, { fileToken: docTurn.fileToken, fileType: docTurn.fileType }, docTurn.commentId, docTurn.replyId, docTurn.reactionId);
+                    }
+                    catch (err) {
+                        logger.debug(`[doc-comment] failed to remove completed reaction ${docTurn.reactionId}: ${err?.message ?? err}`);
                     }
-                    catch { /* best-effort */ }
                 }
-                ds.lastBridgeEmittedUuid = finalOutputDedupeKey(ds, msg);
                 logger.info(`[${t}] doc-comment final_output → posted ${chunks.length} comment(s) on file=${docTurn.fileToken.slice(0, 12)} (turn ${msg.turnId.substring(0, 8)})`);
                 return;
             }
+            // A doc-native session has a virtual `doc:<token>` chat anchor, not a
+            // Feishu chat/thread. If its per-turn target is missing or corrupt there
+            // is no safe fallback destination; suppress instead of trying to post an
+            // interactive card to the virtual id.
+            if (isDocNativeSession(ds)) {
+                ds.lastBridgeEmittedUuid = finalOutputDedupeKey(ds, msg);
+                logger.error(`[${t}] Suppressed doc-native final_output without comment target ` +
+                    `(turn ${msg.turnId.substring(0, 8)})`);
+                return;
+            }
             // Wrap the model's reply in the same card chrome `botmux send` uses
             // (schema 2.0 + footer with botmux link + 发送给 owner) so a turn
             // delivered via this fallback path looks identical in the Lark thread
@@ -3794,6 +5305,7 @@ function deliverFinalOutput(ds, msg, t, attempt) {
                 : imOrigin?.replyTargetSenderOpenId
                     ?? daemonCardFooterRecipientOpenId(ds, effectiveCliId);
             const localHomeLinkMode = daemonCardLocalHomeLinkMode(ds);
+            cardUsage ??= getDaemonReplyCardUsageSnapshot(ds, effectiveCliId);
             const cardJson = msg.kind === 'local-turn' || msg.kind === 'local-turn-headless'
                 ? buildContextualReplyCard({
                     title: msg.kind === 'local-turn-headless'
@@ -3807,8 +5319,9 @@ function deliverFinalOutput(ds, msg, t, attempt) {
                     locale: localeForBot(ds.larkAppId),
                     workingDir: ds.workingDir,
                     localHomeLinkMode,
+                    usage: cardUsage,
                 })
-                : buildMarkdownCard(safeAssistantText, recipientOpenId, renderBrandTemplate(resolveBrandLabel(ds.larkAppId), ds.workingDir), localeForBot(ds.larkAppId), ds.workingDir, localHomeLinkMode);
+                : buildMarkdownCard(safeAssistantText, recipientOpenId, renderBrandTemplate(resolveBrandLabel(ds.larkAppId), ds.workingDir), localeForBot(ds.larkAppId), ds.workingDir, localHomeLinkMode, cardUsage);
             const proposedOutput = {
                 targetChatId: ds.chatId,
                 ...(imOrigin ? { quoteTargetId: imOrigin.larkMessageId } : {}),
@@ -3897,7 +5410,15 @@ function deliverFinalOutput(ds, msg, t, attempt) {
                         : {}),
                 }
                 : undefined);
+            if (!stillCurrent())
+                return;
             recordPrimaryOutput(messageId);
+            if (msg.turnId.startsWith('mlrp_turn_')) {
+                markMessageListenerRunPreviewReplied(msg.turnId, {
+                    sessionId: ds.session.sessionId,
+                    replyMessageId: messageId,
+                });
+            }
             if (preparedListenerReply?.kind === 'send' || preparedListenerReply?.kind === 'succeeded') {
                 finishVcMeetingImReply(config.session.dataDir, preparedListenerReply.ref, messageId);
             }
@@ -3905,6 +5426,8 @@ function deliverFinalOutput(ds, msg, t, attempt) {
             logger.info(`[${t}] Bridge final_output forwarded (turn ${msg.turnId.substring(0, 8)}, ${msg.content.length} chars, kind=${msg.kind ?? 'bridge'}, attempt ${attempt + 1})`);
         }
         catch (err) {
+            if (!stillCurrent())
+                return;
             if (err instanceof MessageWithdrawnError) {
                 // Root message gone — no point retrying. Mark as emitted so any
                 // duplicate IPC is correctly deduped, and tear the session down.
@@ -3916,12 +5439,18 @@ function deliverFinalOutput(ds, msg, t, attempt) {
             const next = attempt + 1;
             if (next >= FINAL_OUTPUT_RETRY_BACKOFF_MS.length) {
                 logger.error(`[${t}] Bridge final_output gave up after ${next} attempts (turn ${msg.turnId.substring(0, 8)}): ${err.message}`);
+                if (msg.turnId.startsWith('mlrp_turn_')) {
+                    markMessageListenerRunPreviewFailed(msg.turnId, {
+                        sessionId: ds.session.sessionId,
+                        error: err.message,
+                    });
+                }
                 // Don't commit the dedup marker — leave room for any future
                 // retransmit (e.g. daemon restart that re-fires the IPC).
                 return;
             }
             logger.warn(`[${t}] Bridge final_output attempt ${next} failed (${err.message}); retrying in ${FINAL_OUTPUT_RETRY_BACKOFF_MS[next]}ms`);
-            deliverFinalOutput(ds, msg, t, next);
+            deliverFinalOutput(ds, msg, t, next, stillCurrent, cardUsage);
         }
     }, FINAL_OUTPUT_RETRY_BACKOFF_MS[attempt] ?? 0);
 }
@@ -3929,6 +5458,7 @@ function deliverFinalOutput(ds, msg, t, attempt) {
  *  fork. Intentionally underscored to discourage non-test callers. */
 export const __testOnly_deliverFinalOutput = deliverFinalOutput;
 export const __testOnly_setupWorkerHandlers = setupWorkerHandlers;
+export const __testOnly_reserveWorkerGeneration = reserveWorkerGeneration;
 export const __testOnly_finishTurnReactions = finishTurnReactions;
 export const __testOnly_finalOutputDedupeKey = finalOutputDedupeKey;
 // ─── Fork adopt worker ──────────────────────────────────────────────────────
@@ -3952,6 +5482,10 @@ function reserveWorkerGeneration(ds) {
             ds.session.workerGeneration = previousSessionGeneration;
         throw error;
     }
+    // Reservation is the first durable proof that the previous generation has
+    // lost authority. Clear its TUI slot before any environment check, adapter
+    // creation, or fork can throw and strand a clicked card in "processing".
+    invalidateTuiPrompt(ds, 'reserve_worker_generation');
     return workerGeneration;
 }
 /**
@@ -3975,10 +5509,25 @@ function reserveWorkerGeneration(ds) {
 export function adoptSandboxBlocked(botCfg, session) {
     return botCfg.sandbox === true
         || botCfg.readIsolation === true
+        // A core-only (apiOnly) bot — or a session on a synthetic HTTP virtual chat —
+        // must NOT adopt-observe a pre-existing external CLI: that CLI runs fully
+        // unisolated (the adopt observe branch returns before any fs-policy build),
+        // so it could read this host's bots.json / sibling creds on behalf of a
+        // no-transport turn. Convert to cold-start instead (same as sandbox adopt).
+        || botCfg.apiOnly === true
+        || (typeof session?.chatId === 'string'
+            && (session.chatId.startsWith('http_async_') || session.chatId.startsWith('http_wait_')))
         || session?.sandbox === true
         || sandboxEnabled();
 }
 export function forkAdoptWorker(ds, opts) {
+    if (isSessionTransferring(ds)) {
+        logger.warn(`[${tag(ds)}] Adopt worker fork refused during routing transfer`);
+        return;
+    }
+    if (!canForkRegisteredSession(ds))
+        return;
+    ds.workerReady = false;
     const cb = requireCallbacks();
     const workerPath = join(__dirname, '..', 'worker.js');
     const t = tag(ds);
@@ -4018,16 +5567,19 @@ export function forkAdoptWorker(ds, opts) {
     const workerGeneration = reserveWorkerGeneration(ds);
     // Guard against double-fork
     if (ds.worker && !ds.worker.killed) {
+        const replacedWorker = ds.worker;
         logger.warn(`[${t}] Worker already running, killing before adopt-fork`);
+        trackLifecycleRetirement(ds, replacedWorker);
         try {
-            ds.worker.send({ type: 'close' });
+            replacedWorker.send({ type: 'close' });
         }
         catch { }
         try {
-            ds.worker.kill();
+            replacedWorker.kill();
         }
         catch { }
         ds.worker = null;
+        ds.workerReady = false;
         ds.workerPort = null;
         ds.workerToken = null;
         ds.workerViewToken = null;
@@ -4050,7 +5602,9 @@ export function forkAdoptWorker(ds, opts) {
             CLAUDECODE: undefined,
             BOTMUX: '1',
             LARK_APP_ID: botCfg.larkAppId,
-            LARK_APP_SECRET: botCfg.larkAppSecret,
+            // Withhold the real secret from the adopt worker's CLI env for a
+            // no-transport session — same rationale as forkWorker above.
+            LARK_APP_SECRET: larkTransportEnabled({ chatId: ds.chatId, apiOnly: botCfg.apiOnly }) ? botCfg.larkAppSecret : '',
         },
     });
     const startupState = { ready: false, failureNotified: false };
@@ -4169,7 +5723,13 @@ export function forkAdoptWorker(ds, opts) {
         ownerOpenId: ds.ownerOpenId,
         webPort: ds.session.webPort,
         larkAppId: botCfg.larkAppId,
-        larkAppSecret: botCfg.larkAppSecret,
+        // Freeze on the session transport capability: a no-transport session
+        // (apiOnly bot OR HTTP virtual chat) must not even RECEIVE the real secret —
+        // withholding it removes the capability rather than gating a tamperable flag
+        // the sandboxed agent could flip. The worker then physically cannot dial
+        // Feishu (uploader/cred-write are also skipped downstream on the same test).
+        larkAppSecret: larkTransportEnabled({ chatId: ds.chatId, apiOnly: botCfg.apiOnly }) ? botCfg.larkAppSecret : '',
+        apiOnly: botCfg.apiOnly,
         brand: normalizeBrand(botCfg.brand),
         botName: bot.botName,
         botOpenId: bot.botOpenId,
@@ -4340,8 +5900,15 @@ export function reapOrphanWorkers(opts = {}) {
     return reaped;
 }
 // ─── Kill stale PIDs ────────────────────────────────────────────────────────
-export function killStalePids(activeSessions_) {
+export function killStalePids(activeSessions_, runtimeSessions) {
+    // Startup restore runs concurrently with the already-live dispatcher. A
+    // message may create/register a fresh worker for a snapshot row before this
+    // stale-process sweep starts. Treat the runtime registry as authoritative:
+    // never signal the PID of any logical session that is already registered.
+    const runtimeSessionIds = new Set(runtimeSessions ? [...runtimeSessions.values()].map(ds => ds.session.sessionId) : []);
     for (const session of activeSessions_) {
+        if (runtimeSessionIds.has(session.sessionId))
+            continue;
         if (!session.pid)
             continue;
         try {
@@ -4363,15 +5930,84 @@ export function killStalePids(activeSessions_) {
             // Process doesn't exist, nothing to clean up
         }
     }
-    cleanupPersistentBackendSessions('tmux', activeSessions_);
-    cleanupPersistentBackendSessions('herdr', activeSessions_);
+    cleanupPersistentBackendSessions('tmux', activeSessions_, runtimeSessions);
+    cleanupPersistentBackendSessions('herdr', activeSessions_, runtimeSessions);
+    cleanupPersistentBackendSessions('zmx', activeSessions_, runtimeSessions);
+}
+/**
+ * Sweep dead CLI-pid marker files out of `.botmux-cli-pids/`. Each marker is
+ * named for the PID that wrote it; when that PID is gone the file is a landmine —
+ * the kernel eventually recycles the number onto an unrelated process, and a
+ * `botmux send` climbing its ancestry can then read a since-exited session's
+ * marker and route the message into the WRONG bot's session. (Fix A already
+ * rejects such a marker at read time by verifying procStart / the env session
+ * id; this GC removes the file so the collision can't even be attempted, and
+ * keeps the directory from growing without bound — graceful worker exit unlinks
+ * its own marker, but SIGKILL / crash / force-kill do not.)
+ *
+ * Cross-daemon safe: with many daemons sharing one data dir, a DEAD pid cannot
+ * belong to any live daemon's session, so unlinking its marker never races a
+ * peer. A live pid's marker is always left untouched. The tiny window where a
+ * PID is recycled between the liveness probe and unlink is benign — the new
+ * owner rewrites its marker on the next turn, and Fix A makes a briefly-missing
+ * marker fall back to the correct env id, never to a wrong session.
+ *
+ * `isPidAlive` is injectable so tests are deterministic regardless of what PIDs
+ * the host has actually allocated (picking a "surely-dead" literal is unsafe —
+ * it can be below pid_max and collide with a live process on a busy runner).
+ * Production uses `process.kill(pid, 0)`: a signal-0 probe that never kills.
+ * Conservative on every ambiguity — only a definitively-dead PID is swept.
+ */
+export function defaultPidLiveness(pid) {
+    try {
+        process.kill(pid, 0); // signal 0 = liveness probe, never kills
+        return true; // alive → owned by some (possibly peer) daemon
+    }
+    catch (err) {
+        if (err?.code === 'ESRCH')
+            return false; // no such process → dead
+        return true; // EPERM (alive, not ours) or unknown error → keep, never guess
+    }
+}
+export function sweepDeadPidMarkers(dataDir = config.session.dataDir, isPidAlive = defaultPidLiveness) {
+    const markersDir = join(dataDir, '.botmux-cli-pids');
+    let entries;
+    try {
+        entries = readdirSync(markersDir);
+    }
+    catch {
+        return 0;
+    } // dir absent (fresh install) → nothing to sweep
+    let removed = 0;
+    for (const name of entries) {
+        const pid = Number(name);
+        if (!Number.isInteger(pid) || pid <= 1)
+            continue; // ignore non-pid files
+        if (isPidAlive(pid))
+            continue; // keep live (incl. peer daemons)
+        try {
+            unlinkSync(join(markersDir, name));
+            removed++;
+        }
+        catch { /* raced with another sweeper or the owner — fine */ }
+    }
+    if (removed > 0)
+        logger.info(`Swept ${removed} dead CLI-pid marker(s) from ${markersDir}`);
+    return removed;
 }
-function cleanupPersistentBackendSessions(backendType, activeSessions_) {
+function cleanupPersistentBackendSessions(backendType, activeSessions_, runtimeSessions) {
+    const storedSessions = sessionStore.listSessions();
+    const runtimeSessionRows = runtimeSessions
+        ? [...runtimeSessions.values()].map(ds => ds.session)
+        : [];
     const anyBackend = getAllBots().some(b => (b.config.backendType ?? config.daemon.backendType) === backendType)
-        || config.daemon.backendType === backendType;
+        || config.daemon.backendType === backendType
+        || activeSessions_.some(s => s.backendType === backendType)
+        || runtimeSessionRows.some(s => s.backendType === backendType)
+        || storedSessions.some(s => s.backendType === backendType);
     if (!anyBackend)
         return;
-    const backend = backendType === 'tmux' ? TmuxBackend : HerdrBackend;
+    const backend = backendType === 'tmux' ? TmuxBackend : backendType === 'zmx' ? ZmxBackend : HerdrBackend;
     const multiBot = getAllBots().length > 1;
     const cliIdFile = join(config.session.dataDir, backendType === 'tmux' ? 'last-cli-id' : `last-cli-id-${backendType}`);
     let lastCliId;
@@ -4380,30 +6016,161 @@ function cleanupPersistentBackendSessions(backendType, activeSessions_) {
     }
     catch { /* first run */ }
     const currentCliId = config.daemon.cliId;
+    const belongsToBackend = (session) => session.backendType === backendType ||
+        (session.backendType === undefined && backendType === 'tmux');
+    const activeNames = new Set([...activeSessions_, ...runtimeSessionRows]
+        .filter(belongsToBackend)
+        .map(s => backend.sessionName(s.sessionId)));
+    const runtimeNames = new Set(runtimeSessionRows.filter(belongsToBackend).map(s => backend.sessionName(s.sessionId)));
+    const ownedSessions = [
+        ...storedSessions.filter(belongsToBackend),
+        ...activeSessions_.filter(belongsToBackend),
+    ];
+    const ownedIdsByName = new Map();
+    for (const session of ownedSessions) {
+        const name = backend.sessionName(session.sessionId);
+        const ids = ownedIdsByName.get(name) ?? new Set();
+        ids.add(session.sessionId);
+        ownedIdsByName.set(name, ids);
+    }
+    const ownedNames = new Set(ownedIdsByName.keys());
+    const exactHerdrTarget = (session) => {
+        const target = session.persistentBackendTarget;
+        if (target?.backendType !== 'herdr')
+            return undefined;
+        const sessionName = target.sessionName.trim();
+        const agentName = target.agentName?.trim();
+        if (!sessionName || !agentName)
+            return undefined;
+        return { sessionName, agentName };
+    };
+    const exactHerdrTargetKey = (target) => JSON.stringify([target.sessionName, target.agentName]);
+    const managedExactHerdrTargets = new Map();
+    const adoptedExactHerdrTargetKeys = new Set();
+    const activeExactHerdrTargetKeys = new Set();
+    const runtimeExactHerdrTargetKeys = new Set();
+    if (backendType === 'herdr') {
+        // An adopted target is user-owned even if a corrupt/legacy managed row
+        // happens to point at the same host+agent. Treat any such row as a veto.
+        for (const session of [...storedSessions, ...activeSessions_, ...runtimeSessionRows]) {
+            const target = exactHerdrTarget(session);
+            if (!target)
+                continue;
+            const key = exactHerdrTargetKey(target);
+            if (session.adoptedFrom)
+                adoptedExactHerdrTargetKeys.add(key);
+        }
+        // The restore snapshot is the liveness authority for this sweep. Protect
+        // every exact active target, including adopted targets and duplicate rows.
+        for (const session of activeSessions_) {
+            const target = exactHerdrTarget(session);
+            if (target)
+                activeExactHerdrTargetKeys.add(exactHerdrTargetKey(target));
+        }
+        // Dispatcher/IPC are already live while startup restore runs. A newly
+        // registered runtime row belongs to the current daemon/current CLI and is
+        // authoritative over the stale store snapshot in both ordinary and global
+        // CLI-change cleanup.
+        for (const session of runtimeSessionRows) {
+            const target = exactHerdrTarget(session);
+            if (target)
+                runtimeExactHerdrTargetKeys.add(exactHerdrTargetKey(target));
+        }
+        // Only an explicit persisted agent target proves ownership inside a shared
+        // host. Never derive an agent from the session id, and never treat a
+        // host-only target as permission to stop the surrounding Herdr session.
+        for (const session of ownedSessions) {
+            if (session.adoptedFrom || session.queued)
+                continue;
+            const target = exactHerdrTarget(session);
+            if (!target)
+                continue;
+            // Herdr's host is machine-wide. A historical short name
+            // (`botmux-<sid8>`) is not enough authority for opportunistic startup
+            // deletion: another daemon/data root can own the colliding live pane.
+            // Require both the strong 128-bit-era format and the deterministic
+            // binding to this complete session id. Legacy targets remain fully
+            // supported for reattach and explicit user-requested close.
+            if (!isStrongManagedHerdrAgentName(target.agentName)
+                || target.agentName !== managedHerdrAgentName(session.sessionId, config.session.dataDir))
+                continue;
+            managedExactHerdrTargets.set(exactHerdrTargetKey(target), target);
+        }
+    }
+    const killManagedExactHerdrTargets = (preserveActive) => {
+        if (backendType !== 'herdr')
+            return;
+        const agentNamesBySession = new Map();
+        for (const [key, target] of managedExactHerdrTargets) {
+            if (adoptedExactHerdrTargetKeys.has(key))
+                continue;
+            if (runtimeExactHerdrTargetKeys.has(key))
+                continue;
+            if (preserveActive && activeExactHerdrTargetKeys.has(key))
+                continue;
+            const agentNames = agentNamesBySession.get(target.sessionName) ?? new Set();
+            agentNames.add(target.agentName);
+            agentNamesBySession.set(target.sessionName, agentNames);
+        }
+        // Batch by host: one `agent list` per distinct positively-owned host, then
+        // close only matching live panes. Historical rows that are already gone
+        // therefore add no subprocess calls, and duplicate targets collapse.
+        for (const [sessionName, agentNames] of agentNamesBySession) {
+            logger.info(`Killing orphaned herdr agent(s) in ${sessionName}: ${[...agentNames].join(', ')}`);
+            HerdrBackend.killAgents(sessionName, agentNames);
+        }
+    };
+    const killOwnedBackendSession = (name, exactSessionId) => {
+        if (backendType !== 'zmx') {
+            backend.killSession(name);
+            return;
+        }
+        const candidates = exactSessionId
+            ? new Set([exactSessionId])
+            : ownedIdsByName.get(name);
+        if (!candidates || candidates.size !== 1) {
+            logger.warn(`Refusing ambiguous name-only ZMX cleanup for ${name}; ` +
+                `matching stored session ids=${candidates?.size ?? 0}`);
+            return;
+        }
+        try {
+            ZmxBackend.killManagedSession(name, [...candidates][0]);
+        }
+        catch (err) {
+            logger.warn(`Refusing unsafe ZMX cleanup for ${name}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    };
     if (!multiBot && lastCliId && lastCliId !== currentCliId) {
         logger.info(`CLI_ID changed (${lastCliId} → ${currentCliId}), killing all ${backendType} sessions`);
         // Legacy per-topic hosts are still enumerable by bmx-* name.
         for (const name of backend.listBotmuxSessions()) {
-            backend.killSession(name);
-        }
-        // Machine-wide Herdr agents are not separate bmx-* sessions. Tear down
-        // each persisted managed target precisely so a CLI switch cannot reattach
-        // the old executable, while never stopping the shared `botmux` host or an
-        // explicitly adopted user pane.
-        for (const target of managedTargetsForCliChange(backendType, activeSessions_)) {
-            killPersistentBackendTarget(target);
+            // A dispatcher-created runtime session already runs the current CLI.
+            // Never let the stale last-cli marker tear it down during restore.
+            if (runtimeNames.has(name))
+                continue;
+            // ZMX_DIR is a user-wide namespace and bmx-* is deterministic, not an
+            // ownership credential. Another checkout/data root can legitimately own
+            // a bmx-* daemon, so never kill a name absent from this bot's store/map.
+            if (backendType === 'zmx' && !ownedNames.has(name))
+                continue;
+            killOwnedBackendSession(name);
         }
+        // Machine-wide Herdr agents are not separate bmx-* sessions. Include
+        // persisted inactive rows as well as the active restore snapshot so a CLI
+        // switch cannot leave an old executable behind.
+        killManagedExactHerdrTargets(false);
     }
     else {
-        const activeNames = new Set(activeSessions_.map(s => backend.sessionName(s.sessionId)));
-        const ownedNames = new Set(sessionStore.listSessions().map(s => backend.sessionName(s.sessionId)));
         for (const name of backend.listBotmuxSessions()) {
             if (ownedNames.has(name) && !activeNames.has(name)) {
                 logger.info(`Killing orphaned ${backendType} session: ${name}`);
-                backend.killSession(name);
+                killOwnedBackendSession(name);
             }
         }
+        killManagedExactHerdrTargets(true);
         for (const session of activeSessions_) {
+            if (!belongsToBackend(session))
+                continue;
             const sessionCliId = session.cliId;
             if (!sessionCliId || !session.larkAppId)
                 continue;
@@ -4416,11 +6183,31 @@ function cleanupPersistentBackendSessions(backendType, activeSessions_) {
             }
             if (botCliId && sessionCliId !== botCliId) {
                 const target = resolvePersistentBackendTarget(backendType, session.sessionId, session.persistentBackendTarget);
+                const runtimeOwnsTarget = target.backendType === 'herdr' && target.agentName
+                    ? runtimeExactHerdrTargetKeys.has(exactHerdrTargetKey({
+                        sessionName: target.sessionName,
+                        agentName: target.agentName,
+                    }))
+                    : runtimeNames.has(target.sessionName);
+                if (runtimeOwnsTarget)
+                    continue;
                 const label = target.backendType === 'herdr' && target.agentName
                     ? `${target.sessionName}/${target.agentName}`
                     : target.sessionName;
                 logger.info(`CLI mismatch for ${session.sessionId.substring(0, 8)} (session=${sessionCliId}, bot=${botCliId}), killing ${backendType} ${label}`);
-                killPersistentBackendTarget(target);
+                try {
+                    killPersistentBackendTarget(target, session.sessionId);
+                }
+                catch (err) {
+                    // This sweep runs before restore has registered any persisted rows.
+                    // One inconclusive identity-verified teardown (notably ZMX) must not
+                    // abort restoration for every unrelated session. Keep this row active
+                    // and let closeActiveSessionIfCliMismatch() retry it through the
+                    // per-session fail-closed path later in the restore pass.
+                    logger.warn(`CLI mismatch cleanup deferred for ${session.sessionId.substring(0, 8)} `
+                        + `(${backendType} ${label}): ${err instanceof Error ? err.message : String(err)}`);
+                    continue;
+                }
             }
         }
     }