botmux 3.7.1 → 3.8.0

package/dist/daemon.js

@@ -14,17 +14,17 @@ import { buildDashboardUrls } from './core/dashboard-url.js';
 import { resolveBotmuxDataDir } from './core/data-dir.js';
 import { reloadExactDaemonBotConfig } from './core/daemon-config-fence.js';
 import { writeHeartbeat } from './core/daemon-heartbeat.js';
-import { botmuxWrapperFiles } from './core/botmux-wrapper.js';
-import { evaluateOverload, formatOverloadAlert, buildOverloadAlertCard, buildOverloadRecoveredCard, initialOverloadCardState, DEFAULT_OVERLOAD_THRESHOLDS, INITIAL_OVERLOAD_STATE, } from './core/host-overload-alert.js';
+import { botmuxWrapperFiles, resolveBotmuxWrapperBinDir } from './core/botmux-wrapper.js';
+import { evaluateOverload, formatOverloadAlert, buildOverloadAlertCard, buildOverloadRecoveredCard, initialOverloadCardState, INITIAL_OVERLOAD_STATE, computeOverloadThresholds, isOverloadAlertTarget, } from './core/host-overload-alert.js';
 import { registerOverloadNonce } from './im/lark/overload-nonce.js';
 import { countHostOverload } from './im/lark/card-handler.js';
 import { startMaintenance, stopMaintenance } from './core/maintenance.js';
 import { selectCodexRuntimeUpdateTargets, startCliRuntimeUpdateMonitor, stopCliRuntimeUpdateMonitor, } from './core/cli-runtime-update.js';
 import { sendRestartReportIfPending } from './core/restart-report.js';
 import { statSync } from 'node:fs';
-import { addReaction, getChatMode, getChatNameAndMode, getMessageChatId, listChatMemberOpenIds, MessageWithdrawnError, replyMessage, resolveAllowedUsersWithMap, sendMessage, sendUserMessage, updateMessage } from './im/lark/client.js';
+import { addReaction, deleteMessage, getChatMode, getChatNameAndMode, getMessageChatId, listChatMemberOpenIds, MessageWithdrawnError, replyMessage, resolveAllowedUsersWithMap, sendMessage, sendUserMessage, updateMessage } from './im/lark/client.js';
 import { resolveGroupJoinPrompt, waitForAllowedUserInChat } from './core/auto-start.js';
-import { loadBotConfigAtIndex, loadBotConfigs, isManagedActivationStartingAtIndex, registerBot, getBot, getAllBots, getOwnerOpenId, findOncallChat, effectiveDefaultWorkingDir, effectiveBotDisplayName, resolveVcMeetingConsumerProfiles, setResolvedAllowedUsersRepublishHook, setAllowedUsersResolveRetryHook, } from './bot-registry.js';
+import { loadBotConfigAtIndex, loadBotConfigs, isManagedActivationStartingAtIndex, registerBot, getBot, getAllBots, getOwnerOpenId, findOncallChat, effectiveDefaultWorkingDir, effectiveBotDisplayName, resolveVcMeetingConsumerProfiles, setResolvedAllowedUsersRepublishHook, setAllowedUsersResolveRetryHook, vcMeetingAgentConfigActive, } from './bot-registry.js';
 import { setDisplayNameRefresher, findConfigField, applyConfigField } from './services/bot-config-store.js';
 import { resolveRegularGroupMode } from './services/chat-reply-mode-store.js';
 import { renameBotOnOpenPlatform, changeBotAvatarOnOpenPlatform } from './services/open-platform-rename.js';
@@ -34,6 +34,7 @@ import * as chatFirstSeenStore from './services/chat-first-seen-store.js';
 import { ensureDefaultOncallBound } from './services/oncall-store.js';
 import * as scheduleStore from './services/schedule-store.js';
 import { migrateSharedSchedulesAtStartup } from './services/schedule-split-migration.js';
+import { migrateOverloadAlertAtStartup } from './services/overload-alert-migration.js';
 import * as messageQueue from './services/message-queue.js';
 import { emitHookEvent, emitHookEventLocal, HOOK_EVENTS } from './services/hook-runner.js';
 import { setSessionLifecycleShutdown } from './services/session-lifecycle-hooks.js';
@@ -41,6 +42,7 @@ import { createImgNumberer, parseEventMessage, resolveNonsupportMessage, stripLe
 import { expandMergeForward } from './im/lark/merge-forward.js';
 import { bindResourcesToMessage, composeForwardFollowupContent, mergeMessageMentions } from './im/lark/forward-followup-content.js';
 import { buildQuoteHint } from './im/lark/quote-hint.js';
+import { buildTopicThreadContext } from './im/lark/topic-root-context.js';
 import { logger } from './utils/logger.js';
 import { applyAllowedUsersResolve } from './utils/allowed-users-apply.js';
 import { withFileLock, withFileLockSync } from './utils/file-lock.js';
@@ -52,8 +54,8 @@ import { scrubTmuxServerGlobalEnv } from './setup/ensure-tmux.js';
 import { entryNeedsContactResolve } from './setup/bot-config-editor.js';
 import { invalidWorkingDirs } from './utils/working-dir.js';
 import { validateWorkingDir } from './core/working-dir.js';
-import { activeSessionKey, sessionKey, sessionAnchorId, storedSessionAnchorId } from './core/types.js';
-import { buildTerminalUrl, setTerminalProxyPort, setTerminalExternalPort } from './core/terminal-url.js';
+import { activeSessionKey, sessionKey, sessionAnchorId, storedSessionAnchorId, larkTransportEnabled } from './core/types.js';
+import { setTerminalProxyPort, setTerminalExternalPort } from './core/terminal-url.js';
 import { startTerminalProxy } from './core/terminal-proxy.js';
 import * as scheduler from './core/scheduler.js';
 import { scanMultipleProjects } from './services/project-scanner.js';
@@ -62,8 +64,8 @@ import { isLocalCliOpenReady } from './services/local-cli-opener.js';
 import { RECEIVED_REACTION_EMOJI_TYPE, SUBSTITUTE_RECEIVED_REACTION_EMOJI_TYPE } from './core/pending-response.js';
 import { t as tr, localeForBot } from './i18n/index.js';
 import { createCliAdapterSync } from './adapters/cli/registry.js';
-import { initWorkerPool, setActiveSessionsRegistry, forkWorker, forkAdoptWorker, sendWorkerInput, killWorker, reapOrphanWorkers, scheduleCardPatch, setCurrentCliVersion, getCurrentCliVersion, CARD_POSTING_SENTINEL, parkStreamCard, closeSession as closeSessionHelper, ensureCliEnv, sweepGlobalBotmuxSkills, writableTerminalLinkFor, findActiveBySessionId, getDaemonBootId, } from './core/worker-pool.js';
-import { AbortDeadlineError, hasExactSafeJsonKeys, ipcRoute, isTrustedHostIpcRequest, JsonBodyTooLargeError, jsonRes, readJsonBody, runWithAbortDeadline, setBotName, setLarkAppId, startIpcServer, setBotRenamer, setBotAvatarChanger } from './core/dashboard-ipc-server.js';
+import { initWorkerPool, setActiveSessionsRegistry, forkWorker, forkAdoptWorker, sendWorkerInput, sendWorkerSessionInput, killWorker, reapOrphanWorkers, scheduleCardPatch, setCurrentCliVersion, getCurrentCliVersion, CARD_POSTING_SENTINEL, parkStreamCard, closeSession as closeSessionHelper, setActiveSessionIfActive, rollbackRejectedSessionAndGetWinner, ensureCliEnv, sweepGlobalBotmuxSkills, writableTerminalLinkFor, workerHasInitialized, sessionSupportsWebTerminal, readableTerminalUrlFor, findActiveBySessionId, getDaemonBootId, getDaemonStreamingCardUsageSnapshot, isSessionTransferring, } from './core/worker-pool.js';
+import { AbortDeadlineError, hasExactSafeJsonKeys, ipcRoute, isTrustedHostIpcRequest, JsonBodyTooLargeError, jsonRes, readJsonBody, runWithAbortDeadline, setBotName, setLarkAppId, startIpcServer, setBotRenamer, setBotAvatarChanger, armCoreOnlyReadinessGate, setCoreOnlyReady } from './core/dashboard-ipc-server.js';
 import { setDeviceIsolationDaemonIdentity } from './core/device-isolation-daemon.js';
 import { cancelSessionReadyAck, waitForSessionReadyAck, } from './core/session-ready-handshake.js';
 import { loadOrCreateDashboardSecret } from './dashboard/auth.js';
@@ -86,10 +88,12 @@ import { beginReplyTargetTurn, fallbackTurnId, isSubstituteTurn, resolveSessionR
 import { readDeferredTopicBinding } from './core/deferred-topic-binding.js';
 import { buildBotmuxLarkNativeSessionTitle, extractBotmuxLarkNativeSessionTitlePrompt, } from './core/session-title.js';
 import { settleDeferredScheduleRun } from './core/deferred-schedule-settlement.js';
+import { renderMessageListenerPrompt } from './services/message-listener.js';
 import { sweepOrphanSandboxes } from './adapters/backend/sandbox.js';
 import { TmuxBackend } from './adapters/backend/tmux-backend.js';
 import { HerdrBackend } from './adapters/backend/herdr-backend.js';
 import { ZellijBackend } from './adapters/backend/zellij-backend.js';
+import { ZmxBackend } from './adapters/backend/zmx-backend.js';
 import { sweepIdleWorkers, DEFAULT_MAX_LIVE_WORKERS } from './core/idle-worker-sweeper.js';
 import { getSessionPersistentBackendType, killPersistentBackendTarget, killPersistentSession, probePersistentBackendTarget, probePersistentSession, resolvePersistentBackendTarget, resolvePairedSpawnBackendType, } from './core/persistent-backend.js';
 import { handleCardAction, runAutoWorktreeCommit } from './im/lark/card-handler.js';
@@ -148,9 +152,9 @@ function republishResolvedAllowedUsers(larkAppId, resolved) {
     catch { /* best effort */ }
 }
 let vcMeetingTerminalReconciler;
-import { isBotMentioned, probeBotOpenId, startLarkEventDispatcher, markForwardFollowupsSessionsReady, writeBotInfoFile, canOperate, canRunDaemonCommand, evaluateTalk, grantCommandRestriction, isKnownPeerBot, checkRequiredScopes } from './im/lark/event-dispatcher.js';
-import { getDocSubscription, listAllDocSubscriptions, removeDocSubscription, setDocCommentPollCursor } from './services/doc-subs-store.js';
-import { BOT_REPLY_SENTINEL, subscribeDocFile, unsubscribeDocFile, addCommentReaction, hasBotSentinel, isBotAuthoredReply, listDocComments } from './im/lark/doc-comment.js';
+import { isBotMentioned, probeBotOpenId, startLarkEventDispatcher, markForwardFollowupsSessionsReady, writeBotInfoFile, canOperate, canRunDaemonCommand, evaluateTalk, evaluateBotTalk, evaluateAskAnswerTalk, grantCommandRestriction, isKnownPeerBot, checkRequiredScopes } from './im/lark/event-dispatcher.js';
+import { getDocSubscription, listAllDocSubscriptions, putDocSubscription, removeDocSubscription, setDocCommentPollCursor } from './services/doc-subs-store.js';
+import { BOT_REPLY_SENTINEL, subscribeDocFile, unsubscribeDocFile, addCommentReaction, removeCommentReaction, hasBotSentinel, isBotAuthoredReply, listDocComments } from './im/lark/doc-comment.js';
 import { learnFromMentions, resolveSender, flushIdentityCacheSync } from './im/lark/identity-cache.js';
 import { normalizeBrand } from './im/lark/lark-hosts.js';
 import { buildDocCommentTurnInput, buildDocWatchWarmupTurnInput } from './core/doc-comment-prompt.js';
@@ -158,7 +162,7 @@ import { advanceDocCommentCursor, docCommentRepliesAfterCursor, latestDocComment
 import { renderBufferedSenderBlock } from './core/session-manager.js';
 import { shutdownBackendDisposition } from './core/persistent-backend.js';
 import { evaluateVcMeetingConsumerIsolation } from './services/vc-meeting-consumer-isolation.js';
-import { markSessionActivity, announcePendingRepoSession, publishAttentionPatch, publishLastInputFromBotPatch, clearAgentAttention, } from './core/session-activity.js';
+import { markSessionActivity, announcePendingRepoSession, publishAttentionPatch, publishLastInputFromBotPatch, publishSessionMessagePreviewPatch, publishClosedSessionPatch, clearAgentAttention, } from './core/session-activity.js';
 import { emitSessionLifecycleHook } from './services/session-lifecycle-hooks.js';
 import { botAutoWorktreeEnabled } from './services/default-worktree.js';
 import { setCardDispatcher as setAskCardDispatcher, setCanTalkChecker as setAskCanTalkChecker, registerAsk as registerAskBroker, findPendingAskByAnchor, submitCustomReply, } from './core/ask-broker.js';
@@ -197,7 +201,7 @@ const VC_MEETING_DELIVERY_LEASE_SCAN_MS = 60_000;
 const VC_MEETING_RUNTIME_EXPIRY_ACK_TIMEOUT_MS = 3_000;
 const VC_MEETING_RUNTIME_EXPIRY_TEARDOWN_MS = 8_000;
 const VC_MEETING_RUNTIME_EXPIRY_REPROBE_MS = 5_000;
-const VC_MEETING_PERSISTENT_BACKENDS = ['tmux', 'herdr', 'zellij'];
+const VC_MEETING_PERSISTENT_BACKENDS = ['tmux', 'herdr', 'zellij', 'zmx'];
 function vcMeetingDeliveryStreamKey(scope) {
     return [scope.listenerAppId, scope.meetingId, scope.memberId, scope.memberEpoch].join('\u0000');
 }
@@ -268,7 +272,9 @@ function vcMeetingPersistentBackendAvailable(backendType) {
         return TmuxBackend.isAvailable();
     if (backendType === 'herdr')
         return HerdrBackend.isAvailable();
-    return ZellijBackend.isAvailable();
+    if (backendType === 'zellij')
+        return ZellijBackend.isAvailable();
+    return ZmxBackend.isAvailable();
 }
 let testOnlyVcMeetingBootBackingMissing;
 function vcMeetingBootBackingMissing(sessionId, destroy) {
@@ -289,7 +295,8 @@ function vcMeetingBootBackingMissing(sessionId, destroy) {
     const persistedBackend = liveBackend ?? persistedSession?.backendType;
     if (persistedBackend === 'pty')
         return true;
-    const backendTypes = persistedBackend === 'tmux' || persistedBackend === 'herdr' || persistedBackend === 'zellij'
+    const backendTypes = persistedBackend === 'tmux' || persistedBackend === 'herdr'
+        || persistedBackend === 'zellij' || persistedBackend === 'zmx'
         ? [persistedBackend]
         : VC_MEETING_PERSISTENT_BACKENDS.filter(vcMeetingPersistentBackendAvailable);
     let allMissing = true;
@@ -298,7 +305,7 @@ function vcMeetingBootBackingMissing(sessionId, destroy) {
         const name = target.sessionName;
         if (destroy) {
             try {
-                killPersistentBackendTarget(target);
+                killPersistentBackendTarget(target, sessionId);
             }
             catch (err) {
                 logger.warn(`[vc-delivery] boot recovery backing kill failed backend=${backendType} `
@@ -480,7 +487,7 @@ function createVcMeetingRuntimeLeaseRecovery(deps) {
             : persistentScope === 'unknown'
                 // An unavailable client binary cannot own/reach a live mux session on
                 // this host. Excluding it avoids permanent unknown fences on machines
-                // that only install one of the three supported backends.
+                // that only install one of the supported persistent backends.
                 ? VC_MEETING_PERSISTENT_BACKENDS.filter(deps.backendAvailable)
                 : [persistentScope];
         let allMissing = true;
@@ -489,7 +496,7 @@ function createVcMeetingRuntimeLeaseRecovery(deps) {
             const target = resolvePersistentBackendTarget(backendType, fence.receiverSessionId, persistedTarget);
             const name = target.sessionName;
             try {
-                deps.killPersistent(backendType, name, target);
+                deps.killPersistent(backendType, name, fence.receiverSessionId, target);
             }
             catch (err) {
                 deps.warn(`[vc-delivery] runtime lease backing kill failed backend=${backendType} `
@@ -721,7 +728,8 @@ const vcMeetingRuntimeLeaseRecovery = createVcMeetingRuntimeLeaseRecovery({
     resolveMissingPersistentScope(sessionId) {
         const persisted = sessionStore.getSession(sessionId);
         const backendType = persisted?.backendType;
-        if (backendType === 'tmux' || backendType === 'herdr' || backendType === 'zellij') {
+        if (backendType === 'tmux' || backendType === 'herdr'
+            || backendType === 'zellij' || backendType === 'zmx') {
             return backendType;
         }
         return backendType === 'pty' ? 'none' : 'unknown';
@@ -731,15 +739,144 @@ const vcMeetingRuntimeLeaseRecovery = createVcMeetingRuntimeLeaseRecovery({
             ?? sessionStore.getSession(sessionId)?.persistentBackendTarget;
     },
     backendAvailable: vcMeetingPersistentBackendAvailable,
-    killPersistent: (backendType, sessionName, target) => target
-        ? killPersistentBackendTarget(target)
-        : killPersistentSession(backendType, sessionName),
+    killPersistent: (backendType, sessionName, sessionId, target) => target
+        ? killPersistentBackendTarget(target, sessionId)
+        : killPersistentSession(backendType, sessionName, sessionId),
     probePersistent: (backendType, sessionName, target) => target
         ? probePersistentBackendTarget(target)
         : probePersistentSession(backendType, sessionName),
     warn: message => logger.warn(message),
     error: message => logger.error(message),
 });
+function captureRoutingGeneration(ds) {
+    return {
+        key: sessionKey(sessionAnchorId(ds), ds.larkAppId),
+        ds,
+        session: ds.session,
+    };
+}
+function isCurrentRoutingGeneration(generation) {
+    const { key, ds, session } = generation;
+    return session.status === 'active'
+        && ds.session === session
+        && sessionKey(sessionAnchorId(ds), ds.larkAppId) === key
+        && activeSessions.get(key) === ds;
+}
+function ensureCurrentRoutingGeneration(generation, phase) {
+    if (isCurrentRoutingGeneration(generation))
+        return;
+    throw new Error(`session routing generation changed during ${phase}`);
+}
+/** Register one freshly-created doc-native session without overwriting a
+ * concurrent winner. The rejected row is closed before the winner is returned,
+ * so its persisted record cannot survive as a ghost-active session. */
+async function registerDocSessionCandidate(key, candidate, rollback = rollbackRejectedSessionAndGetWinner) {
+    if (setActiveSessionIfActive(activeSessions, key, candidate))
+        return candidate;
+    return await rollback(activeSessions, key, candidate) ?? null;
+}
+function sameDocBindingRoute(a, b) {
+    return a.sessionAnchor === b.sessionAnchor
+        && a.sessionId === b.sessionId
+        && a.scope === b.scope
+        && a.chatId === b.chatId;
+}
+/**
+ * Move one subscription onto the authoritative route owned by `selected`.
+ *
+ * The store is re-read immediately before the synchronous write so cursor and
+ * metadata updates made from another event are retained. A newer explicit
+ * rebind is never overwritten: the only route change accepted since `sub` was
+ * read is the same selected route (the normal concurrent auto-create winner
+ * case). Mutating the caller's snapshot keeps the current comment turn on the
+ * same route as the persisted subscription.
+ */
+function persistDocBindingToSession(sub, larkAppId, selected, deps = {}) {
+    const dataDir = deps.dataDir ?? config.session.dataDir;
+    const read = deps.read ?? getDocSubscription;
+    const write = deps.write ?? putDocSubscription;
+    const current = read(dataDir, larkAppId, sub.fileToken);
+    if (!current) {
+        throw new Error(`document subscription was removed during routing: ${sub.fileToken.slice(0, 12)}`);
+    }
+    const selectedRoute = {
+        sessionAnchor: sessionAnchorId(selected),
+        sessionId: selected.session.sessionId,
+        scope: selected.scope,
+        chatId: selected.chatId,
+    };
+    const currentTargetsSelected = current.sessionAnchor === selectedRoute.sessionAnchor
+        && current.sessionId === selectedRoute.sessionId
+        && current.scope === selectedRoute.scope
+        && current.chatId === selectedRoute.chatId;
+    if (!sameDocBindingRoute(current, sub) && !currentTargetsSelected) {
+        throw new Error(`document subscription was rebound during routing: ${sub.fileToken.slice(0, 12)}`);
+    }
+    const rebound = { ...current, ...selectedRoute };
+    write(dataDir, larkAppId, rebound);
+    Object.assign(sub, rebound);
+}
+/** Persist the route selected by registration. A candidate that won the CAS
+ * is now daemon-owned, so a failed subscription write must close only that
+ * exact occupant. A rejected candidate must never close the concurrent
+ * winner whose route it received from registerDocSessionCandidate(). */
+async function persistSelectedDocBinding(routingKey, sub, larkAppId, selected, candidate, persist = persistDocBindingToSession, rollback = closeSessionHelper) {
+    try {
+        persist(sub, larkAppId, selected);
+    }
+    catch (err) {
+        if (selected === candidate && activeSessions.get(routingKey) === candidate) {
+            try {
+                await rollback(candidate.session.sessionId);
+            }
+            catch (rollbackErr) {
+                logger.error(`[doc-comment] failed to roll back auto-created session ` +
+                    `${candidate.session.sessionId.slice(0, 8)} after binding error: ` +
+                    `${rollbackErr instanceof Error ? rollbackErr.message : String(rollbackErr)}`);
+            }
+            finally {
+                // closeSessionHelper removes this synchronously in production. Keep a
+                // final identity guard for injected/test rollback failures so no newer
+                // route owner can be evicted.
+                if (activeSessions.get(routingKey) === candidate)
+                    activeSessions.delete(routingKey);
+                candidate.session.status = 'closed';
+                candidate.session.closedAt ??= new Date().toISOString();
+            }
+        }
+        throw err;
+    }
+}
+function ownsCurrentRoute(ds, larkAppId) {
+    return ds.larkAppId === larkAppId
+        && ds.session.status === 'active'
+        && activeSessions.get(sessionKey(sessionAnchorId(ds), larkAppId)) === ds;
+}
+/** Resolve a binding without ever handing a stale anchor's replacement the
+ * comment. If the subscribed session was relayed, find it by stable sessionId
+ * and lazily migrate the subscription to its new authoritative route. */
+function resolveBoundDocSession(sub, larkAppId, persist = persistDocBindingToSession) {
+    const direct = activeSessions.get(sessionKey(sub.sessionAnchor, larkAppId));
+    if (direct
+        && ownsCurrentRoute(direct, larkAppId)
+        && (!sub.sessionId || direct.session.sessionId === sub.sessionId)) {
+        return direct;
+    }
+    if (!sub.sessionId)
+        return undefined;
+    const relocated = [...new Set(activeSessions.values())].find(candidate => candidate.session.sessionId === sub.sessionId
+        && ownsCurrentRoute(candidate, larkAppId));
+    if (!relocated)
+        return undefined;
+    persist(sub, larkAppId, relocated);
+    return relocated;
+}
+export const __testOnly_captureRoutingGeneration = captureRoutingGeneration;
+export const __testOnly_isCurrentRoutingGeneration = isCurrentRoutingGeneration;
+export const __testOnly_registerDocSessionCandidate = registerDocSessionCandidate;
+export const __testOnly_persistDocBindingToSession = persistDocBindingToSession;
+export const __testOnly_persistSelectedDocBinding = persistSelectedDocBinding;
+export const __testOnly_resolveBoundDocSession = resolveBoundDocSession;
 let vcMeetingOutputTextSenderForTest;
 let vcMeetingTextOutputAvailableForTest;
 const vcMeetingSessions = new Map();
@@ -1900,6 +2037,24 @@ async function sessionReply(anchor, content, msgType = 'text', larkAppId, turnId
     const appId = larkAppId ?? ds?.larkAppId ?? getAllBots()[0]?.config.larkAppId;
     if (!appId)
         throw new Error('No bot configured');
+    // Central Lark-transport gate (fail-closed): a core-only (apiOnly) bot or an
+    // HTTP virtual session (http_async_* / http_wait_*) has no real Feishu chat.
+    // Auxiliary worker UI is already suppressed at its source (worker-pool
+    // managedAuxUiSuppressed) and HTTP final_output is intercepted upstream in
+    // deliverFinalOutput, so this path is normally unreachable for such sessions;
+    // this is a defense-in-depth backstop. Return '' (NOT the synthetic anchor) —
+    // an empty message id reads as "nothing posted" to every caller that stores
+    // the result as a card id, so the falsy-guarded scheduleCardPatch/updateMessage
+    // never fire on a synthetic id. Returning `anchor` would be a latent bug: it
+    // would be stored as streamCardId and a later PATCH would dial Feishu.
+    const transportAllowed = larkTransportEnabled({
+        chatId: ds?.chatId ?? anchor,
+        apiOnly: getBot(appId).config.apiOnly,
+    });
+    if (!transportAllowed) {
+        logger.debug(`[lark-transport] suppressed reply for no-transport session (app=${appId} anchor=${anchor.substring(0, 16)})`);
+        return '';
+    }
     const hookContext = ds ? {
         sessionId: ds.session.sessionId,
         scope: ds.scope,
@@ -2016,12 +2171,22 @@ async function notifyQuotaExhausted(larkAppId, anchor, senderOpenId, limit) {
         logger.warn(`[quota:${larkAppId}] quota exhausted notify failed: ${err}`);
     }
 }
-export async function enforceMessageQuotaForCliInput(larkAppId, chatId, senderOpenId, messageId, anchor, senderUnionId, memberUnionId, chatType) {
+export async function enforceMessageQuotaForCliInput(larkAppId, chatId, senderOpenId, messageId, anchor, senderUnionId, memberUnionId, chatType, botSender, opts) {
+    if (opts?.listenerAuthorized)
+        return true;
     // senderUnionId（bot-locked）让 evaluateTalk 认出跨部署团队 peer bot（teamBot 腿）；
     // memberUnionId（可为真人 union）走 teamMember 腿——否则外部闸门/群闸门放进来的
     // 团队 bot 或团队成员消息会在这里复查处被静默丢弃（#332 端到端断点，人腿同理）。
     // chatType 同理：不传的话，p2pOpen 放行的私聊消息会在这道复查里被丢掉（同一个断点）。
-    const ev = evaluateTalk(larkAppId, chatId, senderOpenId, senderUnionId, memberUnionId, chatType);
+    //
+    // botSender：这条消息的发送方是飞书盖章的 bot（sender_type ∈ app|bot，或 cross-ref
+    // 认识的自家 peer）。命中时必须与 dispatcher 的外层闸用**同一个谓词** evaluateBotTalk，
+    // 否则「团队拉群 + sender 没带 union_id」这条路径会外层放行、这里静默丢弃——比弹卡
+    // 更糟：owner 以为授权生效了，消息凭空消失（#332 同款断点的最后一截）。
+    // 不传（人的路径）→ 原样走 evaluateTalk，语义不变。
+    const ev = botSender
+        ? evaluateBotTalk(larkAppId, chatId, senderOpenId, senderUnionId)
+        : evaluateTalk(larkAppId, chatId, senderOpenId, senderUnionId, memberUnionId, chatType);
     if (!ev.allowed) {
         logger.debug(`[quota:${larkAppId}] dropping message ${messageId.substring(0, 12)} from non-allowed sender ${senderOpenId?.substring(0, 12) ?? '?'}`);
         return false;
@@ -2039,8 +2204,18 @@ export async function enforceMessageQuotaForCliInput(larkAppId, chatId, senderOp
         return false;
     let quota;
     try {
-        const def = getBot(larkAppId).config.messageQuota?.defaultLimit;
-        quota = await consumeQuota(larkAppId, ev.quotaKey, def);
+        // oncall ∩ chatGrant 交集的额度决策**全部收口进 consumeQuota 的同一把锁**，杜绝跨 await
+        // 用陈旧 ev 决策：
+        //   • explicitGrantOverride（live 显式授权）→ 不兜 default（undefined）。
+        //   • expiredGrantCleanup（观察到过期 chatGrant）→ 透传给 consumeQuota，锁内以**当前 expiry**
+        //     为权威：当前 expiry<=now → 原子清「成员+quota+expiry」并回落 default；当前无/未来 expiry
+        //     → grant live（成员在→不兜 default 按现有/不限；成员已清→回落 default）。
+        //   • 其余 oncall（非成员）→ 兜 default。
+        // 传入的 def 是「拟回落值」；是否真用由 consumeQuota 锁内定夺（有 expiredGrant 时以 CAS 为准）。
+        const def = ev.reason === 'oncall' && !ev.explicitGrantOverride
+            ? getBot(larkAppId).config.messageQuota?.defaultLimit
+            : undefined;
+        quota = await consumeQuota(larkAppId, ev.quotaKey, def, ev.expiredGrantCleanup);
     }
     catch (err) {
         logger.warn(`[quota:${larkAppId}] consume failed; dropping message ${messageId.substring(0, 12)}: ${err}`);
@@ -2099,21 +2274,32 @@ function getPidFile() {
     return join(config.session.dataDir, name);
 }
 /** Path to the wrapper bin directory — injected into worker PATH so CLIs
- *  can call `botmux send` / `botmux schedule` without a global npm install. */
-const BOTMUX_BIN_DIR = join(homedir(), '.botmux', 'bin');
+ *  can call `botmux send` / `botmux schedule` without a global npm install.
+ *  Single source of truth: resolveBotmuxWrapperBinDir (core-only → dedicated
+ *  `<SESSION_DATA_DIR>/bin`, never the shared `~/.botmux/bin`, so a same-HOME
+ *  fleet's wrapper/PATH is not clobbered and left unrestored on exit — codex P1).
+ *  Every consumer (worker-pool fork PATH, worker.ts child-env, tmux pane scripts)
+ *  MUST resolve the SAME dir. */
+const BOTMUX_BIN_DIR = resolveBotmuxWrapperBinDir(process.env);
 function writePidFile() {
     const dir = config.session.dataDir;
     if (!existsSync(dir)) {
         mkdirSync(dir, { recursive: true });
     }
     atomicWriteFileSync(getPidFile(), String(process.pid));
-    // Write breadcrumb so CLI tools (botmux list/delete) can find the active data dir
-    const breadcrumb = join(homedir(), '.botmux', '.data-dir');
-    try {
-        mkdirSync(join(homedir(), '.botmux'), { recursive: true });
-        atomicWriteFileSync(breadcrumb, config.session.dataDir);
+    // Write breadcrumb so CLI tools (botmux list/delete) can find the active data dir.
+    // SKIP in core-only (codex P1): the global `~/.botmux/.data-dir` is a shared-HOME
+    // signpost for bare-shell CLIs; a core-only service must not rewrite it to point
+    // a same-HOME host operator at the core-only store. Core-only's own workers get
+    // the data dir via the frozen SESSION_DATA_DIR env, not this breadcrumb.
+    if (process.env.BOTMUX_CORE_ONLY !== '1') {
+        const breadcrumb = join(homedir(), '.botmux', '.data-dir');
+        try {
+            mkdirSync(join(homedir(), '.botmux'), { recursive: true });
+            atomicWriteFileSync(breadcrumb, config.session.dataDir);
+        }
+        catch { /* best effort */ }
     }
-    catch { /* best effort */ }
     // Write a thin wrapper script so `botmux` is always in PATH for CLI sessions,
     // regardless of whether the package was installed globally.  The wrapper
     // points at THIS daemon's dist/cli.js, so it's always the same version.
@@ -2548,7 +2734,7 @@ async function recoverV3DistillationProposalsForBot(larkAppId) {
     }
 }
 async function handleV3SavedWorkflowCommandIfAny(invocation) {
-    const { content, anchor, replyRootId, messageId, chatId, chatType, larkAppId, initiatorOpenId, teamTrustUnionId, memberUnionId, } = invocation;
+    const { content, anchor, replyRootId, messageId, chatId, chatType, larkAppId, initiatorOpenId, teamTrustUnionId, memberUnionId, botSender, } = invocation;
     const command = parseV3SavedWorkflowCommand(content);
     if (!command)
         return false;
@@ -2585,7 +2771,7 @@ async function handleV3SavedWorkflowCommandIfAny(invocation) {
     const operatorCanOperate = canOperate(larkAppId, chatId, initiatorOpenId, teamTrustUnionId);
     const policy = await authorizeV3SavedWorkflowInvocation(command, {
         canPublishGlobal: () => operatorCanOperate,
-        consumeMessageQuotaOnce: () => enforceMessageQuotaForCliInput(larkAppId, chatId, initiatorOpenId, targets.quotaMessageId, targets.replyAnchor, teamTrustUnionId, memberUnionId, chatType),
+        consumeMessageQuotaOnce: () => enforceMessageQuotaForCliInput(larkAppId, chatId, initiatorOpenId, targets.quotaMessageId, targets.replyAnchor, teamTrustUnionId, memberUnionId, chatType, botSender),
     });
     if (!policy.ok) {
         if (policy.reason === 'global_requires_operate') {
@@ -2693,12 +2879,12 @@ function beginNewTurn(ds, title) {
     ds.streamingCardForced = undefined;
     const previousUsageLimit = ds.usageLimit;
     const previousStatus = ds.lastScreenStatus === 'limited' && previousUsageLimit ? 'limited' : 'idle';
-    if (ds.streamCardId && ds.workerPort) {
-        const readUrl = buildTerminalUrl(ds);
+    if (ds.streamCardId && workerHasInitialized(ds)) {
+        const readUrl = readableTerminalUrlFor(ds);
         const dsBotCfg = getBot(ds.larkAppId).config;
         const prevTitle = ds.currentTurnTitle || ds.session.title || getCliDisplayName(dsBotCfg.cliId);
         const prevMode = ds.displayMode ?? 'hidden';
-        const frozenCard = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, prevTitle, ds.lastScreenContent ?? '', previousStatus, dsBotCfg.cliId, prevMode, ds.streamCardNonce, ds.currentImageKey, !!ds.adoptedFrom, false, localeForBot(ds.larkAppId), previousUsageLimit, writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: dsBotCfg.cliId }));
+        const frozenCard = buildStreamingCard(ds.session.sessionId, sessionAnchorId(ds), readUrl, prevTitle, ds.lastScreenContent ?? '', previousStatus, dsBotCfg.cliId, prevMode, ds.streamCardNonce, ds.currentImageKey, !!ds.adoptedFrom, false, localeForBot(ds.larkAppId), previousUsageLimit, writableTerminalLinkFor(ds), isLocalCliOpenReady(ds, { cliId: dsBotCfg.cliId }), getDaemonStreamingCardUsageSnapshot(ds, dsBotCfg.cliId, { fresh: true }));
         scheduleCardPatch(ds, frozenCard);
         if (ds.streamCardNonce && ds.streamCardId !== CARD_POSTING_SENTINEL) {
             if (!ds.frozenCards)
@@ -2735,6 +2921,8 @@ function isSessionlessCommandInvocation(cmd, content) {
     return !docWatchCommandNeedsSession(content);
 }
 async function prewarmDocCommentSession(ds, sub) {
+    const generation = captureRoutingGeneration(ds);
+    ensureCurrentRoutingGeneration(generation, 'prewarm:start');
     const bot = getBot(ds.larkAppId);
     const botCfg = bot.config;
     const loc = localeForBot(ds.larkAppId);
@@ -2748,6 +2936,7 @@ async function prewarmDocCommentSession(ds, sub) {
     const title = `[Doc Watch] ${sub.fileToken.slice(0, 12)}`;
     const turnId = `doc-watch-${Date.now()}-${sub.fileToken.slice(0, 8)}`;
     const sender = sub.ownerOpenId ? await resolveSender(ds.larkAppId, sub.ownerOpenId, 'user') : undefined;
+    ensureCurrentRoutingGeneration(generation, 'prewarm:sender');
     beginNewTurn(ds, title);
     ds.lastMessageAt = Date.now();
     ds.session.lastMessageAt = new Date(ds.lastMessageAt).toISOString();
@@ -3059,6 +3248,92 @@ async function deliverCodexNotifierEvent(larkAppId, event) {
         codexNotifierDeliveries.delete(deliveryKey);
     }
 }
+/**
+ * P1 revalidation for the Codex-notifier「继续处理」takeover. After the dynamic
+ * import + AbortSignal await inside adoptCodexNotifierEvent, a concurrent path may
+ * have moved the ground: a `/relay` transfer opened its input gate (the starter
+ * would then fail-closed with a bare `return` our no-op sessionReply swallows,
+ * and the outer handler would render a bogus green「已接管」over a half-rewritten
+ * session), or the session was /close'd / swapped / re-created under this key.
+ * Returns true when the takeover MUST abort before mutating any state — so the
+ * caller can throw with zero side effects and no buffered input dropped.
+ */
+function notifierAdoptStaleOrTransferring(ds, sessions, activeKey, genSessionId) {
+    return (sessions.get(activeKey) !== ds
+        || ds.session.sessionId !== genSessionId
+        || ds.session.status !== 'active'
+        || isSessionTransferring(ds));
+}
+/**
+ * P2 predicate: would clearPendingRepoStateForNotifierAdopt drop user input that
+ * was accepted but not yet delivered to the CLI? Two DISTINCT windows with
+ * different gating — do NOT collapse them:
+ *
+ *  (1) repo-select pending buffer — ONLY meaningful while pendingRepo===true.
+ *      pendingPrompt / pendingCodexAppText / pendingAttachments / pendingFollowUps
+ *      are the message stashed for the deferred post-repo-selection fork. But the
+ *      pinned/defaultWorkingDir immediate-launch path (daemon.ts ~16031/17325)
+ *      ALSO seeds these same mirror fields, then forks and clears only
+ *      pendingTurnId (~16097/17387) — leaving pendingPrompt/etc behind on an
+ *      already-delivered session with pendingRepo=false. Gating on pendingRepo
+ *      here is what stops us from warning "message not delivered, resend" about
+ *      a prompt the worker already ran (which would make the user re-run a
+ *      non-idempotent command).
+ *
+ *  (2) just-committed launch window — INDEPENDENT of pendingRepo. commitRepoSelection
+ *      set pendingRepo=false and forked, but pendingRawInput / pendingFollowUpInput
+ *      still wait on the new worker's prompt_ready to actually send. These are the
+ *      only fields that legitimately represent undelivered input while
+ *      pendingRepo=false, so they are checked unconditionally. (The immediate-launch
+ *      path never populates them — it forks with the prompt as a direct argument.)
+ */
+function notifierAdoptWouldDropInput(ds) {
+    const repoSelectBuffered = ds.pendingRepo === true && ((ds.pendingPrompt?.trim().length ?? 0) > 0
+        || (ds.pendingFollowUps?.length ?? 0) > 0
+        || (ds.pendingAttachments?.length ?? 0) > 0
+        || (ds.pendingCodexAppText?.trim().length ?? 0) > 0);
+    // Undelivered regardless of pendingRepo (awaiting prompt_ready on a forked worker).
+    const undeliveredLaunchInput = (ds.pendingRawInput?.trim().length ?? 0) > 0
+        || (ds.pendingFollowUpInput?.cliInput?.trim().length ?? 0) > 0;
+    return repoSelectBuffered || undeliveredLaunchInput;
+}
+/**
+ * Fully retire an in-memory repo-select placeholder when the Codex-notifier
+ * 「继续处理」callback takes over the DM session. The legacy inline clear only
+ * reset six fields and left `repoCardMessageId`, `pendingFollowUps`,
+ * `pendingRepoCommitInFlight`, `worktreeCreating`, attachments, mentions, raw
+ * input, etc. behind — a stale repo-card click or a late auto-worktree
+ * completion could then act on the just-adopted session. Clear the whole
+ * pending-repo surface so no residue survives the takeover. Buffered/undelivered
+ * user input (repo-select buffer AND the pendingRawInput/pendingFollowUpInput a
+ * just-committed session is still waiting to send on prompt_ready) is dropped
+ * here — the drop is terminal (never rolled back, since concurrent background
+ * tasks may already have observed pendingRepo=false); the caller tells the user
+ * their input was cancelled on both the success and failure card.
+ */
+function clearPendingRepoStateForNotifierAdopt(ds) {
+    ds.pendingRepo = false;
+    ds.pendingRepoCommitInFlight = false;
+    ds.worktreeCreating = false;
+    ds.repoCardMessageId = undefined;
+    ds.pendingPrompt = undefined;
+    ds.pendingTurnId = undefined;
+    ds.pendingRawInput = undefined;
+    ds.pendingRawTurnId = undefined;
+    ds.pendingFollowUpInput = undefined;
+    ds.pendingAttachments = undefined;
+    ds.pendingMentions = undefined;
+    ds.pendingSubstituteTrigger = undefined;
+    ds.pendingSubstituteControlCard = undefined;
+    ds.pendingSender = undefined;
+    ds.pendingFollowUps = undefined;
+    ds.pendingFollowUpTurnId = undefined;
+    ds.pendingCodexAppText = undefined;
+    ds.pendingCodexAppApplicationContext = undefined;
+    ds.pendingCodexAppMessageContext = undefined;
+    ds.pendingCodexAppFollowUps = undefined;
+    ds.pendingCodexAppFollowUpContexts = undefined;
+}
 async function adoptCodexNotifierEvent(larkAppId, event, cardMessageId, ownerOpenId, signal, deadlineAt) {
     signal.throwIfAborted();
     const chatId = await getMessageChatId(larkAppId, cardMessageId, {
@@ -3103,9 +3378,40 @@ async function adoptCodexNotifierEvent(larkAppId, event, cardMessageId, ownerOpe
             workingDir: event.cwd,
             ownerOpenId,
         };
-        activeSessions.set(activeKey, ds);
-    }
+        if (!setActiveSessionIfActive(activeSessions, activeKey, ds)) {
+            await closeSessionHelper(session.sessionId);
+            throw new Error('通知所在会话路由被一条待处理的持久会话占用');
+        }
+    }
+    // Transfer guard OUTSIDE the launch branch. If the session is already on the
+    // target thread with a live worker, the branch below is skipped entirely —
+    // but a concurrent /relay could still be moving this session's routing away.
+    // Returning a green「已接管，可继续」while the route is migrating is a lie.
+    // Fail-closed here first (a freshly-created ds has no transfer gate, so this
+    // is a no-op for the new-session path); the launch branch keeps its own
+    // post-await revalidation for the drift that can open during its awaits.
+    if (isSessionTransferring(ds)) {
+        throw new Error('该会话正在转移，暂时无法接管；请转移完成后在完成通知卡上重试');
+    }
+    let bufferedInputDropped = false;
+    // Snapshot the session identity BEFORE the throwable/deadline-bound awaits
+    // below. If the session is closed, swapped, or re-created under this active
+    // key while we await, the post-await revalidation must detect the drift.
+    const adoptGenSessionId = ds.session.sessionId;
     if (ds.session.cliSessionId !== event.threadId || !ds.worker || ds.worker.killed) {
+        // Do the two throwable, deadline-sensitive steps FIRST, before mutating any
+        // session/pending state: the dynamic import and the 2.2s AbortSignal check.
+        // If either fails here nothing has been touched, so no rollback is needed
+        // and the buffered repo-select input is left intact for a retry.
+        const { startCodexAppThreadSession } = await import('./core/command-handler.js');
+        signal.throwIfAborted();
+        // Re-validate AFTER the awaits and BEFORE mutating anything (see
+        // notifierAdoptStaleOrTransferring): a concurrent /relay transfer or a
+        // /close/swap/re-create under this key must fail the takeover explicitly
+        // rather than half-rewrite the session and report a bogus green success.
+        if (notifierAdoptStaleOrTransferring(ds, activeSessions, activeKey, adoptGenSessionId)) {
+            throw new Error('该会话正在转移或已变更，无法接管；请稍后在完成通知卡上重试');
+        }
         // 接管原生 Codex App 线程时固定为纯 codex-app 启动，不能继承通知 Bot 的
         // wrapper/model；这些配置针对普通 CLI，会错误包装 app-server runner。
         ds.session.cliId = 'codex-app';
@@ -3114,12 +3420,27 @@ async function adoptCodexNotifierEvent(larkAppId, event, cardMessageId, ownerOpe
         delete ds.session.model;
         ds.session.agentFrozen = true;
         sessionStore.updateSession(ds.session);
-        ds.pendingRepo = false;
-        ds.pendingPrompt = undefined;
-        ds.pendingTurnId = undefined;
-        ds.pendingCodexAppText = undefined;
-        ds.pendingCodexAppApplicationContext = undefined;
-        ds.pendingCodexAppMessageContext = undefined;
+        // 默认 flat DM(p2pMode=chat)下这条按钮回调复用同一私聊的现有会话。若该会话
+        // 恰好停在「待选仓库」挂起态且已缓冲一条尚未提交的输入，接管会消费掉
+        // pendingRepo(#669 的守卫要求接管前 pendingRepo 必须为 false)。旧逻辑只清了
+        // 部分字段并静默丢弃缓冲输入。这里完整清空全部 pending 状态(否则残留的
+        // repoCardMessageId/pendingFollowUps/worktreeCreating 等会让旧选仓卡二次点击、
+        // 迟到 auto-worktree 完成误操作已接管会话——见 runAutoWorktreeCommit 的
+        // pendingRepo 护栏),并记录「缓冲输入已丢弃」以便如实告知用户。
+        //
+        // 不做 pending 快照回滚:clear 之后 startCodexAppThreadSession 的 async guard
+        // 会让出微任务,迟到 auto-worktree / 正在 prepare 的 commit 可能已观察到
+        // pendingRepo=false 而正常结束并在 finally 清掉 in-flight 标志;此时若把
+        // pendingRepo=true/worktreeCreating=true 快照复活,后台任务已不在,会话会永久
+        // 卡在「正在创建/提交」。因此丢弃一旦发布即为终态——用「取消并请重发」的显式
+        // 语义告知用户,而非假装能恢复。
+        // 判断是否有「已收下但尚未真正送达 CLI」的用户输入会被下面的 clear 抹掉
+        // (见 notifierAdoptWouldDropInput:repo-select 镜像字段只在 pendingRepo===true
+        // 计入——立即启动路径也播种这些字段但已 fork 送达,不能误判;pendingRawInput/
+        // pendingFollowUpInput 独立于 pendingRepo,覆盖选仓刚提交等 prompt_ready 的启动窗)。
+        // 有则记录已丢弃,如实告知用户。
+        bufferedInputDropped = notifierAdoptWouldDropInput(ds);
+        clearPendingRepoStateForNotifierAdopt(ds);
         // 完成事件已经携带恢复所需的原生 threadId/cwd。按钮回调不再额外启动一次
         // app-server 做非必要的元数据刷新，避免子进程把飞书回调拖过截止时间。
         const target = {
@@ -3129,19 +3450,36 @@ async function adoptCodexNotifierEvent(larkAppId, event, cardMessageId, ownerOpe
             cwd: event.cwd,
             status: event.status,
         };
-        const { startCodexAppThreadSession } = await import('./core/command-handler.js');
-        signal.throwIfAborted();
-        await startCodexNotifierAdoptionSession(startCodexAppThreadSession, target, ds, {
-            activeSessions,
-            sessionReply,
-            getActiveCount,
-            lastRepoScan,
-        }, larkAppId, cardMessageId);
+        try {
+            await startCodexNotifierAdoptionSession(startCodexAppThreadSession, target, ds, {
+                activeSessions,
+                sessionReply,
+                getActiveCount,
+                lastRepoScan,
+            }, larkAppId, cardMessageId);
+        }
+        catch (err) {
+            // 接管失败/超时:pending 已清空且不回滚(见上)。若曾丢弃过缓冲/未送达输入,把「已取消、
+            // 请重发」前置到抛给外层的错误里——外层用它渲染失败卡,用户就不会以为原消息还
+            // 在队列里等着(否则失败卡只说"接管失败请重试",缓冲却已没了=静默丢失)。
+            if (bufferedInputDropped) {
+                const detail = err instanceof Error ? err.message : String(err);
+                throw new Error(`你此前发送但尚未送达的消息已取消，请在接管成功后重新发送。（接管未完成：${detail}）`);
+            }
+            throw err;
+        }
     }
-    return buildCodexNotifierResultCard('已接管 Codex App 任务', scope === 'chat'
+    const baseAdoptNotice = scope === 'chat'
         ? '现在可以直接在当前私聊继续发送指令；需要操作终端时，请点击会话卡内的「获取操作链接」。'
-        : '请在本卡片的话题中继续发送指令；需要操作终端时，请点击话题会话卡内的「获取操作链接」。', 'green');
-}
+        : '请在本卡片的话题中继续发送指令；需要操作终端时，请点击话题会话卡内的「获取操作链接」。';
+    return buildCodexNotifierResultCard('已接管 Codex App 任务', bufferedInputDropped
+        ? `⚠️ 你此前发送但尚未送达的消息未随本次接管发送，请重新发送一次。\n\n${baseAdoptNotice}`
+        : baseAdoptNotice, 'green');
+}
+export const __testOnly_notifierAdoptStaleOrTransferring = notifierAdoptStaleOrTransferring;
+export const __testOnly_notifierAdoptWouldDropInput = notifierAdoptWouldDropInput;
+export const __testOnly_clearPendingRepoStateForNotifierAdopt = clearPendingRepoStateForNotifierAdopt;
+export const __testOnly_adoptCodexNotifierEvent = adoptCodexNotifierEvent;
 const handleCodexNotifierCardAction = createCodexNotifierCardActionHandler({
     getExpectedOwnerOpenId: larkAppId => getOwnerOpenId(larkAppId) ?? resolvePrimaryOwnerOpenId(larkAppId),
     getEventRecord: (larkAppId, eventId) => codexNotifierStore(larkAppId).get(eventId),
@@ -3599,6 +3937,18 @@ ipcRoute('POST', '/api/asks', async (req, res) => {
             detail: 'meeting receiver asks are not an idempotent managed action',
         });
     }
+    // No-transport session (apiOnly bot or HTTP virtual chat): `botmux ask` posts
+    // an interactive Lark card and blocks the turn on a human click — impossible
+    // without a real Feishu chat. Fail fast with `unsupported` instead of letting
+    // it fall into the Lark dispatcher and hang the agent on a card that can never
+    // render. (Structured HTTP awaiting_input is a separate, future capability.)
+    if (askSession && !larkTransportEnabled({ chatId: askSession.chatId, apiOnly: getBot(askSession.larkAppId).config.apiOnly })) {
+        return jsonRes(res, 400, {
+            ok: false,
+            error: 'unsupported',
+            detail: 'botmux ask requires a Feishu chat; this session has no Lark transport (apiOnly / HTTP virtual session)',
+        });
+    }
     // 谁能答复 = 谁能在该 chat 跟 bot 说话（canTalk）。鉴权在 broker 点击时按注入的
     // canTalkChecker 判定（见下方 setAskCanTalkChecker），daemon 这里不再预解析 approver。
     // chatType 随 ask 一起记下：p2pOpen 的 bot 在私聊里提问时，答复权靠这一腿才判得出
@@ -3645,7 +3995,12 @@ ipcRoute('POST', '/api/asks', async (req, res) => {
                 else {
                     navKeys = computeCocoPickerKeys(parsed.questions, result.answers).navKeys;
                 }
-                cocoDs.worker.send({ type: 'coco_drive_picker', navKeys, needsReviewSubmit, comment });
+                sendWorkerSessionInput(cocoDs, {
+                    type: 'coco_drive_picker',
+                    navKeys,
+                    needsReviewSubmit,
+                    comment,
+                });
                 logger.info(`[${cocoDs.session.sessionId.slice(0, 8)}] CoCo picker drive: ${navKeys.length} keys, review=${needsReviewSubmit}, comment=${comment ? 'yes' : 'no'}`);
             }
             catch (err) {
@@ -4365,8 +4720,15 @@ ipcRoute('POST', '/api/vc-meetings/consumer-catch-up', async (req, res) => {
     }
 });
 function effectiveVcMeetingAgentConfig(larkAppId) {
-    const cfg = getBot(larkAppId)?.config.vcMeetingAgent;
-    return cfg?.enabled === true ? cfg : undefined;
+    // Delegate to the pure predicate (bot-registry) so the apiOnly fail-close and the
+    // enabled check live in ONE tested place. apiOnly (core-only) bots have no Feishu
+    // connection — a VC listener drives `lark-cli vc +meeting-events --as bot`, which
+    // breaks the zero-Feishu-network contract. This accessor gates every VC entry
+    // (config read / event fetch / sync) INCLUDING the boot-time
+    // `restoreVcMeetingRuntimeSessionsForBot`, whose call site sits OUTSIDE the
+    // `!cfg.apiOnly` boot block — so a migrated bots.json (normal VC bot flipped to
+    // apiOnly, stale runtime record on disk) can no longer re-spawn lark-cli at boot.
+    return vcMeetingAgentConfigActive(getBot(larkAppId)?.config);
 }
 function configuredVcMeetingListenerChatId(cfg) {
     return cfg.listenerChatId ?? cfg.notificationChatId;
@@ -12365,6 +12727,21 @@ function resolveBotDefaultWorkingDir(larkAppId) {
  * both honor the defaultOncall auto-bind the same way.
  */
 async function resolvePinnedWorkingDir(ctx) {
+    if (ctx.listenerWorkingDir) {
+        const resolved = expandHome(ctx.listenerWorkingDir);
+        try {
+            if (statSync(resolved).isDirectory()) {
+                return {
+                    pinnedWorkingDir: resolved,
+                    oncallEntry: undefined,
+                    inheritedFrom: null,
+                    pinnedFromBotDefault: false,
+                };
+            }
+        }
+        catch { /* fall through to normal resolution */ }
+        logger.warn(`[message-listener:${ctx.larkAppId}] listener workingDir invalid (${resolved}); falling back to normal resolution`);
+    }
     let oncallEntry = findOncallChat(ctx.larkAppId, ctx.chatId);
     if (!oncallEntry) {
         oncallEntry = await maybeAutoBindDefaultOncall(ctx.larkAppId, ctx.chatId, ctx.chatType);
@@ -12438,6 +12815,7 @@ async function replyInvalidWorkingDirs(anchor, larkAppId, ds) {
     ds.pendingRepo = false;
     activeSessions.delete(sessionKey(anchor, larkAppId));
     sessionStore.closeSession(ds.session.sessionId);
+    publishClosedSessionPatch(ds.session.sessionId, ds.session.closedAt ? Date.parse(ds.session.closedAt) : undefined);
     const msg = tr('cmd.repo.working_dir_not_exist', {
         dirs: invalid.map(d => `\`${d}\``).join(', '),
     }, localeForBot(larkAppId));
@@ -12448,9 +12826,51 @@ async function replyInvalidWorkingDirs(anchor, larkAppId, ds) {
 function isInitialSessionPassthrough(larkAppId, cmd) {
     return resolveAdapterDefaultPassthroughCommands(larkAppId).includes(cmd);
 }
+/** Preserve the established mid-session passthrough semantics when a cold-start
+ * scratch loses its registration race to a concurrently-created real session. */
+function deliverPassthroughToExistingSession(ds, cmd, commandContent, anchor, larkAppId, turn) {
+    if ((ds.worker && !ds.worker.killed) || isSessionTransferring(ds)) {
+        // Passthrough commands bypass the normal message-forwarding block, so bind
+        // the accepted Lark turn before the worker rotates its marker at the PTY
+        // write boundary. This helper also covers a cold-start registration race.
+        ds.session.quoteTargetId = turn.messageId;
+        ds.session.quoteTargetSenderOpenId = turn.senderOpenId;
+        ds.session.quoteTargetSenderIsBot = turn.senderIsBot;
+        const substituteReplyMode = turn.substitute
+            ? (getBot(larkAppId).config.substituteMode?.replyMode ?? 'thread')
+            : 'thread';
+        beginReplyTargetTurn(ds, turn.replyRootId, turn.messageId, new Date().toISOString(), {
+            quoteOnly: substituteReplyMode === 'quote',
+            substitute: turn.substitute,
+        });
+        if (turn.senderOpenId && ds.session.lastCallerOpenId !== turn.senderOpenId) {
+            ds.session.lastCallerOpenId = turn.senderOpenId;
+        }
+        sessionStore.updateSession(ds.session);
+        // Compatibility note (empty-start opening): a raw passthrough is a
+        // LITERAL CLI command — its contract is that the CLI sees exactly the
+        // bytes the user typed, never a botmux XML envelope. So it deliberately
+        // does NOT consume `Session.initialUserTurnPending`: wrapping `/model`
+        // in `<user_message>` would break the literal contract, and silently
+        // clearing the marker would lose the opening for the next real turn.
+        // `/model` on an empty-started session therefore stays literal and the
+        // FOLLOWING business message still opens as a new topic.
+        beginNewTurn(ds, commandContent);
+        sendWorkerSessionInput(ds, {
+            type: 'raw_input',
+            content: commandContent,
+            turnId: turn.messageId,
+        });
+        markSessionActivity(ds);
+        logger.info(`[${anchor.substring(0, 12)}] Passthrough ${cmd} → worker`);
+        return;
+    }
+    void sessionReply(anchor, tr('daemon.cmd_needs_active_cli', { cmd }, localeForBot(larkAppId)), 'text', larkAppId);
+}
+export const __testOnly_deliverPassthroughToExistingSession = deliverPassthroughToExistingSession;
 async function startInitialPassthroughSession(args) {
-    const { larkAppId, chatId, chatType, scope, anchor, messageId, replyRootId, parsed, commandContent, senderOpenId, senderUnionId, memberUnionId, ownerOpenId, ownerUnionId, creatorOpenId, } = args;
-    if (!await enforceMessageQuotaForCliInput(larkAppId, chatId, senderOpenId, messageId, anchor, senderUnionId, memberUnionId, chatType)) {
+    const { larkAppId, chatId, chatType, scope, anchor, messageId, replyRootId, parsed, cmd, commandContent, senderOpenId, substitute, senderUnionId, memberUnionId, ownerOpenId, ownerUnionId, creatorOpenId, botSender, } = args;
+    if (!await enforceMessageQuotaForCliInput(larkAppId, chatId, senderOpenId, messageId, anchor, senderUnionId, memberUnionId, chatType, botSender)) {
         return;
     }
     const botCfg = getBot(larkAppId).config;
@@ -12516,7 +12936,25 @@ async function startInitialPassthroughSession(args) {
     }
     beginReplyTargetTurn(ds, replyRootId, messageId);
     sessionStore.updateSession(ds.session);
-    activeSessions.set(sessionKey(anchor, larkAppId), ds);
+    const creationKey = sessionKey(anchor, larkAppId);
+    if (!setActiveSessionIfActive(activeSessions, creationKey, ds)) {
+        const winner = await rollbackRejectedSessionAndGetWinner(activeSessions, creationKey, ds);
+        if (winner) {
+            logger.info(`[${session.sessionId.substring(0, 8)}] Initial passthrough registration lost to ` +
+                `${winner.session.sessionId.substring(0, 8)}; handing ${cmd} to routing winner`);
+            deliverPassthroughToExistingSession(winner, cmd, commandContent, anchor, larkAppId, {
+                messageId,
+                replyRootId,
+                senderOpenId,
+                senderIsBot: parsed.senderType === 'app' || parsed.senderType === 'bot',
+                substitute,
+            });
+        }
+        else {
+            void sessionReply(anchor, tr('daemon.cmd_needs_active_cli', { cmd }, localeForBot(larkAppId)), 'text', larkAppId);
+        }
+        return;
+    }
     if (pinnedWorkingDir && autoWt) {
         if (await replyInvalidWorkingDirs(anchor, larkAppId, ds))
             return;
@@ -12574,7 +13012,7 @@ function mergeVcMeetingApplicationContext(existing, incoming) {
     return `${[...new Set(lines)].join('\n')}\n`;
 }
 async function handleNewTopic(data, ctx) {
-    const { chatId, messageId, chatType, larkAppId, replyRootId, substituteTrigger } = ctx;
+    const { chatId, messageId, chatType, larkAppId, replyRootId, substituteTrigger, messageListener } = ctx;
     // scope/anchor are mutable here: `/t` / `/topic` may flip a 普通群 chat-scope
     // routing into thread-scope so the bot's first reply seeds a Lark thread.
     let scope = ctx.scope;
@@ -12645,8 +13083,18 @@ async function handleNewTopic(data, ctx) {
     // operate），破坏「人绝不继承 bot 信任」的边界。旧联邦 team-bots 表结构上只收
     // bot（学习入口限 bot sender），这里对齐同一不变量。senderUnionId 本身保持原义
     //（人类会话的 ownerUnionId 还靠它）。
-    const teamTrustUnionId = (data.sender?.sender_type === 'app' || data.sender?.sender_type === 'bot') ? senderUnionId : undefined;
+    // 飞书盖章的 bot 发送方。既锁 union 信任腿（下面的 teamTrustUnionId），也决定
+    // talk 复查走哪个谓词（evaluateBotTalk vs evaluateTalk）——两者必须同源，见
+    // enforceMessageQuotaForCliInput 的 botSender 说明。
+    const isBotSenderType = data.sender?.sender_type === 'app' || data.sender?.sender_type === 'bot';
+    const teamTrustUnionId = isBotSenderType ? senderUnionId : undefined;
     const botCfg = getBot(larkAppId).config;
+    const listenerPrompt = messageListener ? renderMessageListenerPrompt(messageListener) : undefined;
+    if (listenerPrompt) {
+        content = listenerPrompt;
+        parsed.content = listenerPrompt;
+        cmdContent = listenerPrompt;
+    }
     logger.info(`New session: "${content.substring(0, 60)}" (scope=${scope}, anchor=${anchor.substring(0, 12)}, resources: ${resources.length}, active: ${getActiveCount()}, messageId: ${messageId}, chatId: ${chatId})`);
     emitHookEvent('topic.new', {
         larkAppId,
@@ -12673,6 +13121,7 @@ async function handleNewTopic(data, ctx) {
         initiatorOpenId: senderOpenId,
         teamTrustUnionId,
         memberUnionId: senderUnionId,
+        botSender: isBotSenderType,
     })) {
         return;
     }
@@ -12754,10 +13203,13 @@ async function handleNewTopic(data, ctx) {
                     messageId,
                     replyRootId,
                     parsed,
+                    cmd,
                     commandContent,
                     senderOpenId,
+                    substitute: !!substituteTrigger,
                     senderUnionId: teamTrustUnionId,
                     memberUnionId: senderUnionId, // 原始 union（人腿），不锁 bot
+                    botSender: isBotSenderType,
                     // New-topic senders are humans here (mirrors the normal new-topic
                     // spawn path, which assigns ownership unconditionally too).
                     ownerOpenId: senderOpenId,
@@ -12777,7 +13229,7 @@ async function handleNewTopic(data, ctx) {
             // which left a hole once per-chat grants flow through canTalk.
             // canRunDaemonCommand = canOperate ∪（cmd ∈ canTalkDaemonCommands && canTalk）：
             // bot 可通过名单把选定命令（如 /status）降到 canTalk；未配置时与 canOperate 全等。
-            if (!canRunDaemonCommand(larkAppId, chatId, senderOpenId, teamTrustUnionId, cmd, senderUnionId, chatType)) {
+            if (!canRunDaemonCommand(larkAppId, chatId, senderOpenId, teamTrustUnionId, cmd, senderUnionId, chatType, isBotSenderType)) {
                 await sessionReply(anchor, tr('daemon.cmd_allowed_users_only', { cmd }, localeForBot(larkAppId)), 'text', larkAppId);
                 return;
             }
@@ -12836,7 +13288,7 @@ async function handleNewTopic(data, ctx) {
                 cmdPending = { pendingRepo: true, pendingPrompt: '', workingDir: pinnedWorkingDir };
             }
             sessionStore.updateSession(session);
-            activeSessions.set(sessionKey(anchor, larkAppId), {
+            const commandDs = {
                 session,
                 worker: null,
                 workerPort: null,
@@ -12851,13 +13303,23 @@ async function handleNewTopic(data, ctx) {
                 hasHistory: false,
                 ownerOpenId: senderOpenId,
                 ...cmdPending,
-            });
+            };
+            const commandKey = sessionKey(anchor, larkAppId);
+            if (!setActiveSessionIfActive(activeSessions, commandKey, commandDs)) {
+                const winner = await rollbackRejectedSessionAndGetWinner(activeSessions, commandKey, commandDs);
+                if (!winner)
+                    return;
+                logger.info(`[${session.sessionId.substring(0, 8)}] Daemon-command registration lost to ` +
+                    `${winner.session.sessionId.substring(0, 8)}; handing ${cmd} to routing winner`);
+            }
             // Pass mention-stripped content so /command argument parsing works.
             await handleCommand(cmd, anchor, { ...parsed, content: commandContent }, commandDeps, larkAppId);
             return;
         }
     }
-    if (!await enforceMessageQuotaForCliInput(larkAppId, chatId, senderOpenId, messageId, anchor, teamTrustUnionId, senderUnionId, chatType)) {
+    if (!await enforceMessageQuotaForCliInput(larkAppId, chatId, senderOpenId, messageId, anchor, teamTrustUnionId, senderUnionId, chatType, isBotSenderType, {
+        listenerAuthorized: !!messageListener,
+    })) {
         return;
     }
     // Download attachments
@@ -12879,9 +13341,21 @@ async function handleNewTopic(data, ctx) {
     const codexAppQuoteContext = ctx.forwardSeedData
         ? ''
         : buildQuoteHint(parsed, scope, anchor, localeForBot(larkAppId));
-    const codexAppMessageContext = codexAppQuoteContext + (workflowGrillPrompt ?? '');
     const codexAppApplicationContext = vcMeetingApplicationContext(ctx);
-    const promptContent = codexAppQuoteContext + codexAppApplicationContext + content;
+    // 普通群「对已有消息发起话题再 @」：入站是话题内回复（root_id 指向另一条更早
+    // 的话题根消息），bot 从未留存该话题历史，且正文里没有任何信号表明存在话题根+
+    // 前情。首轮注入一行 hint（非全文、零网络请求），提示 CLI 可用 `botmux history`
+    // 按需拉取话题历史（对齐 quote hint 的「提示+按需」模式，避免无条件全量预取+
+    // 下载所有历史附件+长话题只取最旧 50 条且把 50 当精确总数的问题）。gate 已证明
+    // 这是话题回复，无需再发网络探测。coalesced forward 已自带上下文不注入。仅首轮
+    // — 后续 handleThreadReply 回合 CLI 已在首轮拿到该 hint，不重复注入。
+    const topicThreadContext = (parsed.rootId && parsed.rootId !== parsed.messageId && !ctx.forwardSeedData)
+        ? buildTopicThreadContext(localeForBot(larkAppId))
+        : '';
+    // 话题 hint 同样前置到 codex-app 结构化 sidecar lane（与 quote hint 一致双 lane
+    // 下发），否则 codex-app（clean input）bot 走 sidecar 时会静默丢掉该 hint。
+    const codexAppMessageContext = topicThreadContext + codexAppQuoteContext + (workflowGrillPrompt ?? '');
+    const promptContent = topicThreadContext + codexAppQuoteContext + codexAppApplicationContext + content;
     // Resolve sender identity for <sender> tag injection. The first call to
     // resolveSender for an unseen open_id may await contact.v3.user.get with a
     // short budget; subsequent calls hit the cache and are sync-fast.
@@ -12891,7 +13365,14 @@ async function handleNewTopic(data, ctx) {
     // Pin the working dir via the layered oncall / inherit / default lookup
     // (auto-binds a defaultOncall chat as a side effect). Shared with the
     // first-message `/repo` command branch so both paths stay consistent.
-    const { pinnedWorkingDir, oncallEntry, inheritedFrom, pinnedFromBotDefault } = await resolvePinnedWorkingDir({ scope, anchor, chatId, chatType, larkAppId });
+    const { pinnedWorkingDir, oncallEntry, inheritedFrom, pinnedFromBotDefault } = await resolvePinnedWorkingDir({
+        scope,
+        anchor,
+        chatId,
+        chatType,
+        larkAppId,
+        listenerWorkingDir: messageListener?.workingDir,
+    });
     // Auto-worktree: register PENDING (router buffers concurrent msgs, no force-fork)
     // and build the worktree off the critical path (willAutoWorktree / runAutoWorktreeCommit).
     const autoWt = willAutoWorktree(larkAppId, pinnedWorkingDir, pinnedFromBotDefault);
@@ -12905,7 +13386,8 @@ async function handleNewTopic(data, ctx) {
     // For chat-scope, rootMessageId stores the seed message_id (audit only);
     // routing keys off chatId via sessionAnchorId(), so any value works.
     const rootIdForStore = scope === 'thread' ? anchor : messageId;
-    const session = sessionStore.createSession(chatId, rootIdForStore, parsed.content.substring(0, 50), chatType);
+    const initialTurnTitle = (messageListener?.replyCardTitle ?? (ctx.forwardSeedData ? followupContent : content)).substring(0, 50);
+    const session = sessionStore.createSession(chatId, rootIdForStore, initialTurnTitle, chatType);
     const now = Date.now();
     setDirectChatDisplayNameFromSender(session, chatType, newTopicSender);
     const groupChatName = await groupChatNamePromise;
@@ -12960,7 +13442,7 @@ async function handleNewTopic(data, ctx) {
         pendingSubstituteControlCard: shouldSendSubstituteControlCard,
         pendingSender: newTopicSender,
         ownerOpenId: senderOpenId,
-        currentTurnTitle: (ctx.forwardSeedData ? followupContent : content).substring(0, 50),
+        currentTurnTitle: initialTurnTitle,
         workingDir: pinnedWorkingDir,
     };
     if (pinnedWorkingDir) {
@@ -12972,7 +13454,24 @@ async function handleNewTopic(data, ctx) {
         : 'thread';
     beginReplyTargetTurn(ds, replyRootId, messageId, new Date().toISOString(), { quoteOnly: substituteReplyMode === 'quote', substitute: !!substituteTrigger });
     sessionStore.updateSession(ds.session);
-    activeSessions.set(sessionKey(anchor, larkAppId), ds);
+    const creationKey = sessionKey(anchor, larkAppId);
+    if (!setActiveSessionIfActive(activeSessions, creationKey, ds)) {
+        const winner = await rollbackRejectedSessionAndGetWinner(activeSessions, creationKey, ds);
+        if (winner) {
+            logger.info(`[${session.sessionId.substring(0, 8)}] New-topic registration lost to ` +
+                `${winner.session.sessionId.substring(0, 8)}; handing message to routing winner`);
+            await handleThreadReply(data, { ...ctx, scope, anchor }, {
+                parsed,
+                resources,
+                attachments,
+                quotaChecked: true,
+                queueAlreadyAppended: true,
+                senderResolved: true,
+                sender: newTopicSender,
+            });
+        }
+        return;
+    }
     // Auto-worktree: session is registered PENDING; build the worktree off the
     // critical path, then commitRepoSelection pins it + forks (folding in any
     // messages buffered during creation). detach → return immediately.
@@ -13034,6 +13533,74 @@ async function handleNewTopic(data, ctx) {
 // for the same chat (reconnect replay / double-delivery) can't both spawn —
 // claimed synchronously before the first await, released in `finally` (FR-13).
 const autoStartJoinInFlight = new Set();
+// A join candidate becomes visible in activeSessions before its seed/reply
+// target and synchronous bootstrap are ready. Inbound turns for that exact
+// routing key must wait; otherwise they can re-fork the worker-null session and
+// then be replaced by the join handler's own fork. Deferred pendingRepo /
+// auto-worktree paths release after publishing their stable buffered state.
+const AUTO_START_JOIN_READY_MAX_WAIT_MS = 5_000;
+let testOnlyAutoStartJoinReadyMaxWaitMs;
+const autoStartJoinReadyBySessionKey = new Map();
+function beginAutoStartJoinReadyBarrier(routingKey, onCancel) {
+    let resolveReady;
+    const ready = new Promise((resolve) => {
+        resolveReady = resolve;
+    });
+    let settled = false;
+    let barrier;
+    const settle = () => {
+        if (settled)
+            return;
+        settled = true;
+        resolveReady();
+        if (autoStartJoinReadyBySessionKey.get(routingKey) === barrier) {
+            autoStartJoinReadyBySessionKey.delete(routingKey);
+        }
+    };
+    const cancel = () => {
+        if (settled)
+            return;
+        barrier.cancelled = true;
+        try {
+            onCancel();
+        }
+        catch (err) {
+            logger.warn(`[auto-start:入群] bootstrap timeout cleanup failed for ${routingKey}: ${err}`);
+        }
+        finally {
+            settle();
+        }
+    };
+    barrier = { ready, cancelled: false, settle, cancel };
+    autoStartJoinReadyBySessionKey.set(routingKey, barrier);
+    return barrier;
+}
+async function waitForAutoStartJoinReady(larkAppId, anchor) {
+    const routingKey = sessionKey(anchor, larkAppId);
+    while (true) {
+        const barrier = autoStartJoinReadyBySessionKey.get(routingKey);
+        if (!barrier)
+            return;
+        const maxWaitMs = testOnlyAutoStartJoinReadyMaxWaitMs ?? AUTO_START_JOIN_READY_MAX_WAIT_MS;
+        let timer;
+        const outcome = await Promise.race([
+            barrier.ready.then(() => 'ready'),
+            new Promise((resolve) => {
+                timer = setTimeout(() => resolve('timeout'), maxWaitMs);
+            }),
+        ]);
+        if (timer)
+            clearTimeout(timer);
+        if (outcome === 'timeout' && autoStartJoinReadyBySessionKey.get(routingKey) === barrier) {
+            logger.warn(`[auto-start:入群] bootstrap exceeded ${maxWaitMs}ms for ${anchor.substring(0, 12)}; ` +
+                `yielding registration to the waiting turn`);
+            barrier.cancel();
+        }
+    }
+}
+export function __testOnly_setAutoStartJoinReadyMaxWaitMs(value) {
+    testOnlyAutoStartJoinReadyMaxWaitMs = value;
+}
 // 主动开工 — 场景①: `${appId}:${chatId}` → the activeSessions key of the
 // auto-started join session. Needed because in a 话题群 the session is keyed at
 // the seed message id (not chatId), so a plain `activeSessions.has(chatId)`
@@ -13102,6 +13669,7 @@ async function handleBotAdded(chatId, operatorOpenId, larkAppId) {
     if (priorAnchorKey)
         groupJoinAnchorByChat.delete(chatLiveKey); // stale entry, will re-register below
     autoStartJoinInFlight.add(lockKey);
+    let joinReady;
     try {
         // D7 gate: an allowedUser must be a member of the chat. Alarm/oncall
         // platforms (e.g. Nexus) create the chat, add bots first and the human
@@ -13156,9 +13724,8 @@ async function handleBotAdded(chatId, operatorOpenId, larkAppId) {
             logger.info(`[auto-start:入群] ${chatId.substring(0, 12)} 锚点已有会话，跳过`);
             return;
         }
-        const sharedReplyRootId = mode === 'group' && resolveRegularGroupMode(larkAppId, chatId) === 'shared'
-            ? await sendMessage(larkAppId, chatId, tr('daemon.auto_start_join_seed', undefined, localeForBot(larkAppId)), 'text')
-            : undefined;
+        const needsSharedReply = mode === 'group'
+            && resolveRegularGroupMode(larkAppId, chatId) === 'shared';
         const { pinnedWorkingDir, pinnedFromBotDefault } = await resolvePinnedWorkingDir({ scope, anchor, chatId, chatType, larkAppId });
         const autoWt = willAutoWorktree(larkAppId, pinnedWorkingDir, pinnedFromBotDefault);
         refreshCliVersion(botCfg.cliId, botCfg.cliPathOverride);
@@ -13192,13 +13759,103 @@ async function handleBotAdded(chatId, operatorOpenId, larkAppId) {
             ownerOpenId: operatorOpenId,
             currentTurnTitle: title,
             workingDir: pinnedWorkingDir,
-            pendingTurnId: sharedReplyRootId,
+            pendingTurnId: undefined,
         };
-        if (sharedReplyRootId) {
+        if (!setActiveSessionIfActive(activeSessions, dsKey, ds)) {
+            await closeSessionHelper(session.sessionId);
+            return;
+        }
+        const joinBootstrapExternallyTakenOver = () => (activeSessions.get(dsKey) !== ds
+            || ds.session.status !== 'active'
+            || !!(ds.worker && !ds.worker.killed));
+        const joinBootstrapWasTakenOver = () => {
+            const takenOver = (joinReady?.cancelled === true
+                || joinBootstrapExternallyTakenOver());
+            if (takenOver && ds.worker && !ds.worker.killed) {
+                logger.warn(`[auto-start:入群] ${chatId.substring(0, 12)} bootstrap 期间会话已由其它入口启动，让位且不再 refork`);
+            }
+            return takenOver;
+        };
+        // Publish the barrier only after this candidate wins registration. There is
+        // no await between the CAS and this write, so a turn can never observe the
+        // worker-null session without also observing the barrier. Publishing earlier
+        // would unnecessarily stall real messages during membership retry and
+        // mode/working-dir discovery, where their own session may safely win.
+        joinReady = beginAutoStartJoinReadyBarrier(dsKey, () => {
+            // Scheduler/dashboard/trigger paths do not wait on the inbound-message
+            // barrier and may legitimately start this exact ds while join bootstrap
+            // is awaiting Lark/network I/O. Once that happens, timeout cancellation
+            // must yield to the new worker instead of closing its active turn.
+            if (joinBootstrapExternallyTakenOver()) {
+                logger.warn(`[auto-start:入群] ${chatId.substring(0, 12)} bootstrap timeout 时会话已被接管，跳过候选回收`);
+                return;
+            }
+            // A user turn waited longer than the serializer's normal safety cap.
+            // Relinquish this half-bootstrapped registration instead of letting the
+            // turn fall back to the old "refork now, then get killed by late join"
+            // behavior. closeSessionHelper completes map/status/store mutation before
+            // its first await; the late best-effort cleanup must not hold the turn.
+            const closing = closeSessionHelper(session.sessionId);
+            if (activeSessions.get(dsKey) === ds)
+                activeSessions.delete(dsKey);
+            void closing.catch((err) => {
+                logger.warn(`[auto-start:入群] timeout close failed for ${session.sessionId.substring(0, 8)}: ${err}`);
+            });
+        });
+        const rollbackRegisteredJoinSession = async () => {
+            // closeSession transitions the row before its first await, but this
+            // handler owns a caller-supplied registry too. Drop only our identity so
+            // slow best-effort cleanup cannot block a retry or erase a replacement.
+            const closing = closeSessionHelper(session.sessionId);
+            if (activeSessions.get(dsKey) === ds)
+                activeSessions.delete(dsKey);
+            await closing;
+        };
+        // Shared-mode seed/reply authority is externally visible. Publish it only
+        // after this candidate owns the routing key; a CAS loser must leave no
+        // orphaned "joined" topic and must not silently consume the first prompt.
+        let sharedReplyRootId;
+        const withdrawSharedReplySeed = () => {
+            if (!sharedReplyRootId)
+                return;
+            const messageId = sharedReplyRootId;
+            sharedReplyRootId = undefined;
+            void deleteMessage(larkAppId, messageId);
+        };
+        const armSharedReplyTarget = () => {
+            if (!sharedReplyRootId)
+                return;
+            ds.pendingTurnId = sharedReplyRootId;
             beginReplyTargetTurn(ds, sharedReplyRootId, sharedReplyRootId, new Date(now).toISOString());
             sessionStore.updateSession(ds.session);
+        };
+        if (needsSharedReply) {
+            try {
+                sharedReplyRootId = await sendMessage(larkAppId, chatId, tr('daemon.auto_start_join_seed', undefined, localeForBot(larkAppId)), 'text');
+            }
+            catch (err) {
+                logger.warn(`[auto-start:入群] ${chatId.substring(0, 12)} shared seed 发送失败：${err?.message ?? err}`);
+                await rollbackRegisteredJoinSession();
+                return;
+            }
+            if (joinReady.cancelled) {
+                // The send may have reached Lark even though its response exceeded the
+                // local wait cap. Best-effort withdraw the now-ownerless shared seed.
+                withdrawSharedReplySeed();
+                return;
+            }
+            if (activeSessions.get(dsKey) !== ds || ds.session.status !== 'active') {
+                logger.warn(`[auto-start:入群] ${chatId.substring(0, 12)} shared seed 返回时会话已被替换，停止首轮`);
+                withdrawSharedReplySeed();
+                await rollbackRegisteredJoinSession();
+                return;
+            }
+            if (ds.worker && !ds.worker.killed) {
+                withdrawSharedReplySeed();
+                logger.warn(`[auto-start:入群] ${chatId.substring(0, 12)} shared seed 返回时会话已由其它入口启动，让位`);
+                return;
+            }
         }
-        activeSessions.set(dsKey, ds);
         // Register the anchor so a later duplicate bot.added for this chat is deduped
         // even in 话题群 (where dsKey is the seed id, not chatId).
         groupJoinAnchorByChat.set(chatLiveKey, dsKey);
@@ -13206,18 +13863,32 @@ async function handleBotAdded(chatId, operatorOpenId, larkAppId) {
         const buildPrompt = async () => buildNewTopicCliInput(promptBody, session.sessionId, botCfg.cliId, botCfg.cliPathOverride, undefined, undefined, await getAvailableBots(larkAppId, chatId), undefined, { name: selfBot.botName, openId: selfBot.botOpenId }, localeForBot(larkAppId), undefined, { larkAppId, chatId, whiteboardId: ds.session.whiteboardId, codexAppText });
         // Auto-worktree: register PENDING, build worktree off-path, commit+fork later.
         if (pinnedWorkingDir && autoWt) {
-            if (await replyInvalidWorkingDirs(anchor, larkAppId, ds))
+            if (await replyInvalidWorkingDirs(anchor, larkAppId, ds) || joinBootstrapWasTakenOver()) {
+                withdrawSharedReplySeed();
                 return;
+            }
+            armSharedReplyTarget();
             startAutoWorktreePending(ds, { anchor, baseDir: pinnedWorkingDir, title, prompt: promptBody, operatorOpenId });
             return;
         }
         // Pinned working dir → spawn immediately.
         if (pinnedWorkingDir) {
-            if (await replyInvalidWorkingDirs(anchor, larkAppId, ds))
+            if (await replyInvalidWorkingDirs(anchor, larkAppId, ds) || joinBootstrapWasTakenOver()) {
+                withdrawSharedReplySeed();
                 return;
+            }
             ensureSessionWhiteboard(ds);
             const prompt = await buildPrompt();
+            if (joinBootstrapWasTakenOver()) {
+                withdrawSharedReplySeed();
+                return;
+            }
             await noteTurnReceived(ds, anchor, promptBody);
+            if (joinBootstrapWasTakenOver()) {
+                withdrawSharedReplySeed();
+                return;
+            }
+            armSharedReplyTarget();
             rememberLastCliInput(ds, promptBody, prompt);
             forkWorker(ds, prompt, sharedReplyRootId ? { turnId: sharedReplyRootId } : false);
             ds.pendingTurnId = undefined;
@@ -13225,14 +13896,30 @@ async function handleBotAdded(chatId, operatorOpenId, larkAppId) {
             return;
         }
         // No default dir → degrade to repo-selection card (D6 / FR-4).
-        if (await replyInvalidWorkingDirs(anchor, larkAppId, ds))
+        if (await replyInvalidWorkingDirs(anchor, larkAppId, ds) || joinBootstrapWasTakenOver()) {
+            withdrawSharedReplySeed();
             return;
+        }
         const scanDirs = getProjectScanDirs(ds).filter(d => existsSync(d));
         const projects = scanDirs.length > 0 ? scanMultipleProjects(scanDirs, 3, repoPickerScanOptions()) : [];
         if (projects.length > 0) {
             lastRepoScan.set(chatId, projects);
             const cardJson = buildRepoSelectCard(projects, getSessionWorkingDir(ds), anchor, localeForBot(larkAppId), getBot(larkAppId).config.worktreeMultiPicker);
-            ds.repoCardMessageId = await sessionReply(anchor, cardJson, 'interactive', larkAppId);
+            // The repo card itself belongs under the shared join seed. Arm the target
+            // immediately before its single network await; pendingRepo already makes
+            // this a stable buffered state for normal inbound/scheduler paths.
+            armSharedReplyTarget();
+            const repoCardMessageId = await sessionReply(anchor, cardJson, 'interactive', larkAppId);
+            if (joinBootstrapWasTakenOver()) {
+                void deleteMessage(larkAppId, repoCardMessageId);
+                // If another entry actually started this same ds, its output still owns
+                // the shared seed we just armed. Preserve that root; closed/replaced
+                // candidates may withdraw it.
+                if (!ds.worker || ds.worker.killed)
+                    withdrawSharedReplySeed();
+                return;
+            }
+            ds.repoCardMessageId = repoCardMessageId;
             announcePendingRepoSession(ds);
             logger.info(`[auto-start:入群] ${chatId.substring(0, 12)} 无默认目录，弹 repo 选择卡（${projects.length} 个项目）`);
         }
@@ -13240,7 +13927,16 @@ async function handleBotAdded(chatId, operatorOpenId, larkAppId) {
             ds.pendingRepo = false;
             ensureSessionWhiteboard(ds);
             const prompt = await buildPrompt();
+            if (joinBootstrapWasTakenOver()) {
+                withdrawSharedReplySeed();
+                return;
+            }
             await noteTurnReceived(ds, anchor, promptBody);
+            if (joinBootstrapWasTakenOver()) {
+                withdrawSharedReplySeed();
+                return;
+            }
+            armSharedReplyTarget();
             rememberLastCliInput(ds, promptBody, prompt);
             forkWorker(ds, prompt, sharedReplyRootId ? { turnId: sharedReplyRootId } : false);
             ds.pendingTurnId = undefined;
@@ -13248,6 +13944,7 @@ async function handleBotAdded(chatId, operatorOpenId, larkAppId) {
         }
     }
     finally {
+        joinReady?.settle();
         autoStartJoinInFlight.delete(lockKey);
     }
 }
@@ -13287,16 +13984,21 @@ function lookupForeignBotName(senderOpenId, larkAppId) {
     catch { /* */ }
     return 'Bot';
 }
-async function handleThreadReply(data, ctx) {
+async function handleThreadReply(data, ctx, prepared) {
     const { chatId: ctxChatId, chatType: ctxChatType, scope, anchor, larkAppId, replyRootId, substituteTrigger } = ctx;
-    await resolveNonsupportMessage(data, larkAppId);
-    const { parsed, resources } = parseEventMessage(data);
+    await waitForAutoStartJoinReady(larkAppId, anchor);
+    if (!prepared)
+        await resolveNonsupportMessage(data, larkAppId);
+    const parsedResult = prepared ?? parseEventMessage(data);
+    const parsed = parsedResult.parsed;
+    const resources = parsedResult.resources;
     // Expand merge_forward: fetch sub-messages and collect their resources
-    if (parsed.msgType === 'merge_forward') {
+    if (!prepared && parsed.msgType === 'merge_forward') {
         const { extraResources } = await expandMergeForward(larkAppId, parsed.messageId, parsed);
         resources.push(...extraResources);
     }
-    learnFromMentions(larkAppId, parsed.mentions);
+    if (!prepared)
+        learnFromMentions(larkAppId, parsed.mentions);
     // Foreign bot @mention prefix: when sender is another botmux bot，把内容包成
     // [来自 X 的 @mention]\n<原文> 喂给 worker，让 CLI 知道这是另一个 bot 发的——
     // 不是用户直接发的——后续不需要按"对话用户"的方式处理。signal-file 路径
@@ -13330,33 +14032,35 @@ async function handleThreadReply(data, ctx) {
         + parsed.content;
     let promptContent = initialPromptContent;
     let rewrittenCodexAppMessageContext;
-    const existingHookSession = activeSessions.get(sessionKey(anchor, larkAppId));
-    emitHookEvent('thread.reply', {
-        larkAppId,
-        chatId: ctxChatId,
-        chatType: ctxChatType,
-        scope,
-        anchor,
-        messageId: parsed.messageId,
-        rootId: parsed.rootId,
-        parentId: parsed.parentId,
-        senderOpenId: senderOpenIdForPrefix,
-        senderType: parsed.senderType,
-        msgType: parsed.msgType,
-        sessionId: existingHookSession?.session.sessionId,
-        content: parsed.content,
-    });
-    if (isForeignBot) {
-        logger.info(`[${larkAppId}] foreign-bot @mention prefix attached: sender=${senderOpenIdForPrefix?.substring(0, 12)} ` +
-            `senderType=${parsed.senderType} via=${isBotSenderType ? 'sender_type' : 'cross-ref'}`);
+    if (!prepared) {
+        const existingHookSession = activeSessions.get(sessionKey(anchor, larkAppId));
+        emitHookEvent('thread.reply', {
+            larkAppId,
+            chatId: ctxChatId,
+            chatType: ctxChatType,
+            scope,
+            anchor,
+            messageId: parsed.messageId,
+            rootId: parsed.rootId,
+            parentId: parsed.parentId,
+            senderOpenId: senderOpenIdForPrefix,
+            senderType: parsed.senderType,
+            msgType: parsed.msgType,
+            sessionId: existingHookSession?.session.sessionId,
+            content: parsed.content,
+        });
+        if (isForeignBot) {
+            logger.info(`[${larkAppId}] foreign-bot @mention prefix attached: sender=${senderOpenIdForPrefix?.substring(0, 12)} ` +
+                `senderType=${parsed.senderType} via=${isBotSenderType ? 'sender_type' : 'cross-ref'}`);
+        }
     }
     // resolveSender is deferred until we know the message actually needs prompt
     // injection. callback URLs, daemon commands, and "other bot owns this
     // anchor" all return early; routing them through resolveSender first would
     // tack the 800ms budget onto paths that never see the sender tag. Use the
     // helper below at every actual injection point.
-    let threadSenderCached;
-    let threadSenderResolved = false;
+    let threadSenderCached = prepared?.sender;
+    let threadSenderResolved = prepared?.senderResolved ?? false;
     const getThreadSender = async () => {
         if (threadSenderResolved)
             return threadSenderCached;
@@ -13428,6 +14132,7 @@ async function handleThreadReply(data, ctx) {
         initiatorOpenId: threadSenderOpenId,
         teamTrustUnionId: threadTeamTrustUnionId,
         memberUnionId: threadSenderUnionId,
+        botSender: isBotSenderType || isForeignBot,
     })) {
         return;
     }
@@ -13497,10 +14202,13 @@ async function handleThreadReply(data, ctx) {
                     messageId: parsed.messageId,
                     replyRootId,
                     parsed,
+                    cmd,
                     commandContent,
                     senderOpenId: threadSenderOpenId,
+                    substitute: !!substituteTrigger,
                     senderUnionId: threadTeamTrustUnionId,
                     memberUnionId: threadSenderUnionId, // 原始 union（人腿），不锁 bot
+                    botSender: isBotSenderType || isForeignBot,
                     // Bot-started cold starts get no human owner (mirrors the auto-create
                     // path) — see the ownership note on startInitialPassthroughSession.
                     ownerOpenId: isForeignBot ? undefined : threadSenderOpenId,
@@ -13517,48 +14225,17 @@ async function handleThreadReply(data, ctx) {
             // 拉起）。TODO（后续产品决策）：是否把 CLI passthrough 也纳入 canOperate，
             // 收紧到与 daemon 命令同档；这会同时改变真人 oncall 成员的现有行为，应单独评估。
             const ds = existingDs;
-            if (ds?.worker && !ds.worker.killed) {
-                // Passthrough commands bypass the normal message-forwarding block
-                // below, so bind this accepted Lark turn here before the worker rotates
-                // its marker at the actual PTY write boundary.
-                ds.session.quoteTargetId = parsed.messageId;
-                ds.session.quoteTargetSenderOpenId = threadSenderOpenId;
-                ds.session.quoteTargetSenderIsBot = isForeignBot;
-                const substituteReplyMode = substituteTrigger
-                    ? (getBot(larkAppId).config.substituteMode?.replyMode ?? 'thread')
-                    : 'thread';
-                beginReplyTargetTurn(ds, replyRootId, parsed.messageId, new Date().toISOString(), {
-                    quoteOnly: substituteReplyMode === 'quote',
+            if (ds) {
+                deliverPassthroughToExistingSession(ds, cmd, commandContent, anchor, larkAppId, {
+                    messageId: parsed.messageId,
+                    replyRootId,
+                    senderOpenId: threadSenderOpenId,
+                    senderIsBot: isForeignBot,
                     substitute: !!substituteTrigger,
                 });
-                if (threadSenderOpenId && ds.session.lastCallerOpenId !== threadSenderOpenId) {
-                    ds.session.lastCallerOpenId = threadSenderOpenId;
-                }
-                sessionStore.updateSession(ds.session);
-                // Mark a new turn so the CLI's response to /model, /clear, /compact, etc.
-                // shows up as a fresh streaming card instead of silently PATCH-ing the
-                // previous turn's card.
-                //
-                // Compatibility note (empty-start opening): a raw passthrough is a
-                // LITERAL CLI command — its contract is that the CLI sees exactly the
-                // bytes the user typed, never a botmux XML envelope. So it deliberately
-                // does NOT consume `Session.initialUserTurnPending`: wrapping `/model`
-                // in `<user_message>` would break the literal contract, and silently
-                // clearing the marker would lose the opening for the next real turn.
-                // `/model` on an empty-started session therefore stays literal and the
-                // FOLLOWING business message still opens as a new topic.
-                beginNewTurn(ds, commandContent);
-                ds.worker.send({
-                    type: 'raw_input',
-                    content: commandContent,
-                    turnId: parsed.messageId,
-                });
-                markSessionActivity(ds);
-                logger.info(`[${anchor.substring(0, 12)}] Passthrough ${cmd} → worker`);
-            }
-            else {
-                sessionReply(anchor, tr('daemon.cmd_needs_active_cli', { cmd }, localeForBot(larkAppId)), 'text', larkAppId);
             }
+            else
+                void sessionReply(anchor, tr('daemon.cmd_needs_active_cli', { cmd }, localeForBot(larkAppId)), 'text', larkAppId);
             return;
         }
         if (DAEMON_COMMANDS.has(cmd)) {
@@ -13576,7 +14253,7 @@ async function handleThreadReply(data, ctx) {
             // (see spawn-path gate above). Denies chat-granted users management commands.
             // canRunDaemonCommand：canTalkDaemonCommands 名单内的命令降到 canTalk，
             // 与 new-topic 路径的统一闸同款（未配置时与 canOperate 全等）。
-            if (!canRunDaemonCommand(larkAppId, effectiveThreadChatId, threadSenderOpenId, threadTeamTrustUnionId, cmd, threadSenderUnionId, ctxChatType)) {
+            if (!canRunDaemonCommand(larkAppId, effectiveThreadChatId, threadSenderOpenId, threadTeamTrustUnionId, cmd, threadSenderUnionId, ctxChatType, isBotSenderType || isForeignBot)) {
                 sessionReply(anchor, tr('daemon.cmd_allowed_users_only', { cmd }, localeForBot(larkAppId)), 'text', larkAppId);
                 return;
             }
@@ -13611,7 +14288,7 @@ async function handleThreadReply(data, ctx) {
                     cmdPending = { pendingRepo: true, pendingPrompt: '', workingDir: pinnedWorkingDir };
                 }
                 sessionStore.updateSession(session);
-                activeSessions.set(sessionKey(anchor, larkAppId), {
+                const threadCommandDs = {
                     session,
                     worker: null,
                     workerPort: null,
@@ -13626,7 +14303,15 @@ async function handleThreadReply(data, ctx) {
                     hasHistory: false,
                     ownerOpenId: threadSenderOpenId,
                     ...cmdPending,
-                });
+                };
+                const commandKey = sessionKey(anchor, larkAppId);
+                if (!setActiveSessionIfActive(activeSessions, commandKey, threadCommandDs)) {
+                    const winner = await rollbackRejectedSessionAndGetWinner(activeSessions, commandKey, threadCommandDs);
+                    if (!winner)
+                        return;
+                    logger.info(`[${session.sessionId.substring(0, 8)}] Thread daemon-command registration lost to ` +
+                        `${winner.session.sessionId.substring(0, 8)}; handing ${cmd} to routing winner`);
+                }
             }
             // Pass mention-stripped content so /command argument parsing works.
             // chatId lets session-less handlers (e.g. /group) reach the chat roster.
@@ -13658,6 +14343,16 @@ async function handleThreadReply(data, ctx) {
                     askId: pendingAsk.askId,
                     by: threadSenderOpenId,
                     text: askReplyText,
+                    // Actor context so the broker's talk check uses the same predicate as
+                    // the dispatcher gate / quota recheck: a bot text-reply → evaluateBotTalk
+                    // (covers team-拉群 with no union_id), a platform teamMember human →
+                    // evaluateTalk's teamMember union leg. Omitting it (card clicks) degrades
+                    // to the plain evaluateTalk(openId, chatType).
+                    actor: {
+                        botSender: isBotSenderType || isForeignBot,
+                        senderUnionId: threadTeamTrustUnionId,
+                        memberUnionId: threadSenderUnionId,
+                    },
                 });
                 if (outcome === 'accepted') {
                     logger.info(`[${anchor.substring(0, 12)}] ask custom reply accepted from ${threadSenderOpenId.substring(0, 12)}`);
@@ -13688,7 +14383,7 @@ async function handleThreadReply(data, ctx) {
         }
     }
     const quotaSenderOpenId = threadSenderOpenId;
-    if (!await enforceMessageQuotaForCliInput(larkAppId, ctxChatId ?? data?.message?.chat_id, quotaSenderOpenId, parsed.messageId, anchor, threadTeamTrustUnionId, threadSenderUnionId, ctxChatType)) {
+    if (!prepared?.quotaChecked && !await enforceMessageQuotaForCliInput(larkAppId, ctxChatId ?? data?.message?.chat_id, quotaSenderOpenId, parsed.messageId, anchor, threadTeamTrustUnionId, threadSenderUnionId, ctxChatType, isBotSenderType || isForeignBot)) {
         return;
     }
     // When a command path rewrites the model prompt (for example /workflow),
@@ -13700,12 +14395,19 @@ async function handleThreadReply(data, ctx) {
     const codexAppApplicationContext = initialCodexAppApplicationContext;
     // Download attachments
     const effectiveAppId = ds?.larkAppId ?? larkAppId;
-    const { attachments, needLogin } = await downloadResources(effectiveAppId, parsed.messageId, resources);
-    if (attachments.length > 0) {
-        parsed.attachments = attachments;
+    let attachments;
+    if (prepared) {
+        attachments = prepared.attachments;
     }
-    if (needLogin) {
-        sessionReply(anchor, tr('daemon.download_failed_need_login', undefined, localeForBot(effectiveAppId)), 'text', effectiveAppId);
+    else {
+        const downloaded = await downloadResources(effectiveAppId, parsed.messageId, resources);
+        attachments = downloaded.attachments;
+        if (attachments.length > 0) {
+            parsed.attachments = attachments;
+        }
+        if (downloaded.needLogin) {
+            sessionReply(anchor, tr('daemon.download_failed_need_login', undefined, localeForBot(effectiveAppId)), 'text', effectiveAppId);
+        }
     }
     // Update last message time + last caller (used by `botmux send` to address
     // reply cards to whoever triggered this turn — matters in oncall groups
@@ -13837,7 +14539,10 @@ async function handleThreadReply(data, ctx) {
     }
     // Route to file queue (keyed by anchor: rootMessageId for thread, chatId for chat)
     messageQueue.ensureQueue(anchor);
-    messageQueue.appendMessage(anchor, parsed);
+    if (!prepared?.queueAlreadyAppended)
+        messageQueue.appendMessage(anchor, parsed);
+    if (ds)
+        publishSessionMessagePreviewPatch(ds);
     if (!ds) {
         // No active session at this anchor — auto-create. This branch is mostly a
         // safety net; the dispatcher routes here only when isSessionOwner() returns
@@ -13942,7 +14647,24 @@ async function handleThreadReply(data, ctx) {
             : 'thread';
         beginReplyTargetTurn(newDs, replyRootId, parsed.messageId, new Date().toISOString(), { quoteOnly: substituteReplyMode === 'quote', substitute: !!substituteTrigger });
         sessionStore.updateSession(newDs.session);
-        activeSessions.set(sessionKey(anchor, larkAppId), newDs);
+        const creationKey = sessionKey(anchor, larkAppId);
+        if (!setActiveSessionIfActive(activeSessions, creationKey, newDs)) {
+            const winner = await rollbackRejectedSessionAndGetWinner(activeSessions, creationKey, newDs);
+            if (winner) {
+                logger.info(`[${session.sessionId.substring(0, 8)}] Reply auto-create registration lost to ` +
+                    `${winner.session.sessionId.substring(0, 8)}; handing message to routing winner`);
+                await handleThreadReply(data, ctx, {
+                    parsed,
+                    resources,
+                    attachments,
+                    quotaChecked: true,
+                    queueAlreadyAppended: true,
+                    senderResolved: true,
+                    sender: autoCreateSender,
+                });
+            }
+            return;
+        }
         // Auto-worktree: register PENDING, build worktree off-path, commit+fork later.
         if (pinnedWorkingDir && autoWt) {
             if (await replyInvalidWorkingDirs(anchor, larkAppId, newDs))
@@ -14241,20 +14963,27 @@ async function handleThreadReply(data, ctx) {
  *   2) bot 的 defaultWorkingDir / workingDir 配置
  *   3) fallback 到 ~
  *
- * 创建后立即 fork worker 并把评论内容作为首轮输入。
- * 返回创建好的 DaemonSession（已加入 activeSessions），失败返回 null。
+ * 本函数只同步建立 session skeleton 并竞争 routing ownership；不解析评论
+ * 作者、不写 per-turn target、也不 fork。胜出的 authoritative
+ * handleDocComment delivery owner 统一完成这些动作。
+ * 返回胜出的 DaemonSession（已加入 activeSessions），失败返回 null。
  */
 async function autoCreateDocSession(sub, larkAppId, ctx) {
     const botCfg = getBot(larkAppId).config;
+    const virtualChatId = `doc:${sub.fileToken}`;
+    const virtualAnchor = virtualChatId;
+    const routingKey = sessionKey(virtualAnchor, larkAppId);
+    const existing = activeSessions.get(routingKey);
+    if (existing?.session.status === 'active' && ownsCurrentRoute(existing, larkAppId)) {
+        persistDocBindingToSession(sub, larkAppId, existing);
+        return existing;
+    }
     // 解析 workingDir：订阅时指定的 > bot 配置 defaultWorkingDir > bot 配置 workingDir > ~
     const workingDir = sub.workingDir
         ?? effectiveDefaultWorkingDir(botCfg)
         ?? botCfg.workingDir
         ?? '~';
-    const sender = ctx.authorOpenId ? await resolveSender(larkAppId, ctx.authorOpenId, 'user') : undefined;
     const title = `[Doc] ${sub.fileToken.slice(0, 8)}: ${ctx.text.slice(0, 40)}`;
-    const virtualChatId = `doc:${sub.fileToken}`;
-    const virtualAnchor = sub.sessionAnchor;
     const now = Date.now();
     const session = sessionStore.createSession(virtualChatId, virtualAnchor, title, 'group');
     session.larkAppId = larkAppId;
@@ -14281,36 +15010,57 @@ async function autoCreateDocSession(sub, larkAppId, ctx) {
         ownerOpenId: ctx.authorOpenId || sub.ownerOpenId,
         currentTurnTitle: ctx.text.substring(0, 50),
     };
-    // 记录本轮回评论落点
-    const turnId = ctx.replyId || ctx.commentId;
-    (ds.docCommentTurns ??= new Map()).set(turnId, {
-        fileToken: sub.fileToken,
-        fileType: sub.fileType,
-        commentId: ctx.commentId,
-        replyToOpenId: ctx.authorOpenId,
-        replyToName: sender?.name,
-        replyId: ctx.replyId,
-        reactionId: undefined, // 由调用方在加 reaction 后回填
-    });
-    const docTarget = {
-        fileToken: sub.fileToken,
-        fileType: sub.fileType,
-        commentId: ctx.commentId,
-        replyToName: sender?.name,
-        replyToOpenId: ctx.authorOpenId,
-        turnId,
-        replyId: ctx.replyId,
-    };
-    (ds.session.docCommentTargets ??= {})[turnId] = docTarget;
-    try {
-        sessionStore.updateSession(ds.session);
+    const selected = await registerDocSessionCandidate(routingKey, ds);
+    if (!selected) {
+        logger.warn(`[doc-comment] auto-create registration lost without an active winner file=${sub.fileToken.slice(0, 12)}`);
+        return null;
+    }
+    await persistSelectedDocBinding(routingKey, sub, larkAppId, selected, ds);
+    if (selected !== ds) {
+        logger.info(`[doc-comment] auto-create ${session.sessionId.slice(0, 8)} lost to ` +
+            `${selected.session.sessionId.slice(0, 8)}; handing comment to routing winner`);
+        return selected;
     }
-    catch { /* best-effort */ }
-    activeSessions.set(sessionKey(virtualAnchor, larkAppId), ds);
-    // 不在这里 forkWorker —— handleDocComment 会统一处理（它会检查 worker 状态、
-    // 加 reaction、设 docCommentTurns、然后 fork 或 send）。这里只建好 session 骨架。
+    // 不在这里 forkWorker —— handleDocComment 会统一处理 reaction、per-turn
+    // 回复落点及 fork/send。这里只建好 session skeleton。
     logger.info(`[doc-comment] auto-created session for file=${sub.fileToken.slice(0, 12)} (wd=${workingDir}, cli=${botCfg.cliId})`);
-    return ds;
+    return selected;
+}
+/**
+ * One authoritative delivery result per document-comment turn. Event delivery
+ * and the --all poller can observe the same reply concurrently; followers must
+ * await the owner's real result rather than treating an in-flight claim as a
+ * success and advancing the poll cursor past a later failure.
+ */
+const handledDocCommentTurns = new BoundedMap(5_000);
+async function runClaimedDocCommentTurn(claimKey, work, onOwnerFailure) {
+    const existing = handledDocCommentTurns.get(claimKey);
+    if (existing)
+        return await existing;
+    let resolveClaim;
+    const claim = new Promise((resolve) => { resolveClaim = resolve; });
+    handledDocCommentTurns.set(claimKey, claim);
+    try {
+        await work();
+        resolveClaim(true);
+        return true;
+    }
+    catch (err) {
+        try {
+            await onOwnerFailure?.(err);
+        }
+        finally {
+            if (handledDocCommentTurns.get(claimKey) === claim) {
+                handledDocCommentTurns.delete(claimKey);
+            }
+            resolveClaim(false);
+        }
+        throw err;
+    }
+}
+export const __testOnly_runClaimedDocCommentTurn = runClaimedDocCommentTurn;
+export function __testOnly_resetDocCommentClaims() {
+    handledDocCommentTurns.clear();
 }
 /**
  * 文档评论入口（/watch-comment / /subscribe-lark-doc）：一条命中绑定的文档评论喂进会话。
@@ -14327,85 +15077,143 @@ async function handleDocComment(ctx) {
     const { larkAppId, sub, commentId, text } = ctx;
     const turnId = ctx.replyId || commentId;
     const claimKey = `${larkAppId}:${sub.fileToken}:${turnId}`;
-    if (handledDocCommentTurns.has(claimKey)) {
-        logger.info(`[doc-comment] duplicate turn skipped file=${sub.fileToken.slice(0, 12)} turn=${turnId.slice(0, 12)}`);
-        return true; // 已处理过，算成功（让 poller 推进游标）
-    }
-    const loc = localeForBot(larkAppId);
-    let ds = activeSessions.get(sessionKey(sub.sessionAnchor, larkAppId));
-    if (!ds) {
-        // 无活跃 session → 自动为该文档创建一个（用虚拟 anchor = doc:{fileToken}）
-        logger.info(`[doc-comment] no active session for anchor=${sub.sessionAnchor.slice(0, 12)}; auto-creating for file=${sub.fileToken.slice(0, 12)}`);
-        ds = await autoCreateDocSession(sub, larkAppId, ctx);
-        if (!ds) {
-            // auto-create 失败：不设 claim（允许后续重试），返回 false 让 poller 不推进游标
-            logger.warn(`[doc-comment] auto-create session failed for file=${sub.fileToken.slice(0, 12)}; will retry comment ${commentId.slice(0, 12)}`);
-            return false;
+    const userReplyId = ctx.replyId;
+    let reactionId;
+    let deliveryDs;
+    let deliverySession;
+    const targetMatchesThisTurn = (target) => !!target
+        && target.fileToken === sub.fileToken
+        && target.fileType === sub.fileType
+        && target.commentId === commentId
+        && target.replyId === userReplyId;
+    const cleanupFailedDelivery = async () => {
+        if (deliveryDs) {
+            const runtimeTarget = deliveryDs.docCommentTurns?.get(turnId);
+            if (targetMatchesThisTurn(runtimeTarget)) {
+                deliveryDs.docCommentTurns?.delete(turnId);
+            }
         }
-    }
-    // ds 确认有效后才设 claim——auto-create 失败时不占坑，允许重试。
-    handledDocCommentTurns.set(claimKey, Date.now());
+        let removedPersistedTarget = false;
+        if (deliverySession) {
+            const persistedTarget = deliverySession.docCommentTargets?.[turnId];
+            if (targetMatchesThisTurn(persistedTarget)) {
+                delete deliverySession.docCommentTargets?.[turnId];
+                removedPersistedTarget = true;
+            }
+        }
+        if (removedPersistedTarget && deliverySession) {
+            try {
+                // Persist only the exact object still owned by this bot store. A stale
+                // continuation must not reinsert a displaced/cross-file Session row.
+                if (sessionStore.getOwnedSession(deliverySession.sessionId) === deliverySession) {
+                    sessionStore.updateSession(deliverySession);
+                }
+            }
+            catch (persistErr) {
+                logger.debug(`[doc-comment] failed to persist aborted target cleanup ` +
+                    `file=${sub.fileToken.slice(0, 12)} turn=${turnId.slice(0, 12)}: ` +
+                    `${persistErr instanceof Error ? persistErr.message : String(persistErr)}`);
+            }
+        }
+        if (reactionId && userReplyId) {
+            try {
+                await removeCommentReaction(larkAppId, { fileToken: sub.fileToken, fileType: sub.fileType }, commentId, userReplyId, reactionId);
+            }
+            catch (reactionErr) {
+                logger.debug(`[doc-comment] failed to remove Typing after aborted delivery ` +
+                    `file=${sub.fileToken.slice(0, 12)} turn=${turnId.slice(0, 12)}: ` +
+                    `${reactionErr instanceof Error ? reactionErr.message : String(reactionErr)}`);
+            }
+        }
+    };
     try {
-        // 给用户的回复加 "Typing" reaction，让评论者知道 bot 正在处理。
-        const userReplyId = ctx.replyId;
-        let reactionId;
-        if (userReplyId) {
-            reactionId = await addCommentReaction(larkAppId, { fileToken: sub.fileToken, fileType: sub.fileType }, commentId, userReplyId, 'Typing');
-        }
-        const sender = ctx.authorOpenId ? await resolveSender(larkAppId, ctx.authorOpenId, 'user') : undefined;
-        const authorName = sender?.name || ctx.authorOpenId?.slice(0, 8) || '?';
-        const dsBotCfg = getBot(ds.larkAppId).config;
-        const promptInput = {
-            fileToken: sub.fileToken,
-            fileType: sub.fileType,
-            question: text,
-            author: authorName,
-            selectedText: ctx.selectedText,
-            priorReplies: ctx.priorReplies?.map(reply => ({
-                author: reply.authorOpenId?.slice(0, 12),
-                text: reply.text,
-            })),
-            projectDir: ds.workingDir ?? sub.workingDir,
-            brand: normalizeBrand(dsBotCfg.brand),
-            locale: loc,
-        };
-        // 记录本轮回评论的落点。两条路都要覆盖：
-        //   • ds.docCommentTurns（内存，按 turnId）→ deliverFinalOutput「兜底」分流用
-        //   • session.docCommentTargets（磁盘，per-turn map）→ `botmux send`「主回复」分流用
-        //     （botmux send 跑在独立子进程，只能从磁盘读会话态；per-turn 避免并发评论串线）
-        (ds.docCommentTurns ??= new Map()).set(turnId, {
-            fileToken: sub.fileToken,
-            fileType: sub.fileType,
-            commentId,
-            replyToOpenId: ctx.authorOpenId,
-            replyToName: sender?.name,
-            replyId: userReplyId,
-            reactionId,
-        });
-        const docTarget = { fileToken: sub.fileToken, fileType: sub.fileType, commentId, replyToName: sender?.name, replyToOpenId: ctx.authorOpenId, turnId, replyId: userReplyId, reactionId };
-        const selfBot = getBot(ds.larkAppId);
-        if (ds.worker && !ds.worker.killed) {
-            const isBridge = !!ds.adoptedFrom;
-            if (!isBridge)
-                ensureSessionWhiteboard(ds);
-            const { promptContent, cliInput } = buildDocCommentTurnInput({
-                ds,
-                promptInput,
-                botCliId: dsBotCfg.cliId,
-                botCliPathOverride: dsBotCfg.cliPathOverride,
-                botIdentity: { name: selfBot.botName, openId: selfBot.botOpenId },
-                sender,
-                mode: 'live',
+        const duplicate = handledDocCommentTurns.has(claimKey);
+        if (duplicate) {
+            logger.info(`[doc-comment] duplicate turn awaiting owner file=${sub.fileToken.slice(0, 12)} turn=${turnId.slice(0, 12)}`);
+        }
+        return await runClaimedDocCommentTurn(claimKey, async () => {
+            const loc = localeForBot(larkAppId);
+            let ds = resolveBoundDocSession(sub, larkAppId);
+            if (!ds) {
+                // 无活跃 session → 自动为该文档创建一个（用虚拟 anchor = doc:{fileToken}）
+                logger.info(`[doc-comment] no active session for anchor=${sub.sessionAnchor.slice(0, 12)}; auto-creating for file=${sub.fileToken.slice(0, 12)}`);
+                ds = await autoCreateDocSession(sub, larkAppId, ctx);
+                if (!ds) {
+                    throw new Error(`auto-create session failed for ${sub.fileToken.slice(0, 12)}`);
+                }
+            }
+            deliveryDs = ds;
+            const generation = captureRoutingGeneration(ds);
+            deliverySession = generation.session;
+            ensureCurrentRoutingGeneration(generation, 'comment:start');
+            // 给用户的回复加 "Typing" reaction，让评论者知道 bot 正在处理。
+            if (userReplyId) {
+                reactionId = await addCommentReaction(larkAppId, { fileToken: sub.fileToken, fileType: sub.fileType }, commentId, userReplyId, 'Typing');
+            }
+            ensureCurrentRoutingGeneration(generation, 'comment:reaction');
+            const sender = ctx.authorOpenId ? await resolveSender(larkAppId, ctx.authorOpenId, 'user') : undefined;
+            ensureCurrentRoutingGeneration(generation, 'comment:sender');
+            const authorName = sender?.name || ctx.authorOpenId?.slice(0, 8) || '?';
+            const dsBotCfg = getBot(ds.larkAppId).config;
+            const promptInput = {
+                fileToken: sub.fileToken,
+                fileType: sub.fileType,
+                question: text,
+                author: authorName,
+                selectedText: ctx.selectedText,
+                priorReplies: ctx.priorReplies?.map(reply => ({
+                    author: reply.authorOpenId?.slice(0, 12),
+                    text: reply.text,
+                })),
+                projectDir: ds.workingDir ?? sub.workingDir,
+                brand: normalizeBrand(dsBotCfg.brand),
+                locale: loc,
+            };
+            // 记录本轮回评论的落点。两条路都要覆盖：
+            //   • ds.docCommentTurns（内存，按 turnId）→ deliverFinalOutput「兜底」分流用
+            //   • session.docCommentTargets（磁盘，per-turn map）→ `botmux send`「主回复」分流用
+            //     （botmux send 跑在独立子进程，只能从磁盘读会话态；per-turn 避免并发评论串线）
+            (ds.docCommentTurns ??= new Map()).set(turnId, {
+                fileToken: sub.fileToken,
+                fileType: sub.fileType,
+                commentId,
+                replyToOpenId: ctx.authorOpenId,
+                replyToName: sender?.name,
+                replyId: userReplyId,
+                reactionId,
             });
-            beginNewTurn(ds, text);
-            (ds.session.docCommentTargets ??= {})[turnId] = docTarget; // per-turn map，不覆盖其他并发轮
-            sessionStore.updateSession(ds.session); // 先落盘，botmux send 子进程才读得到落点
-            await noteTurnReceived(ds, commentId, text, sender, turnId);
-            rememberLastCliInput(ds, promptContent, cliInput);
-            sendWorkerInput(ds, cliInput, turnId);
-            logger.info(`[${tag(ds)}] doc-comment turn injected (turn ${turnId.slice(0, 8)})`);
-        }
-        else {
+            const docTarget = { fileToken: sub.fileToken, fileType: sub.fileType, commentId, replyToName: sender?.name, replyToOpenId: ctx.authorOpenId, turnId, replyId: userReplyId, reactionId };
+            const selfBot = getBot(ds.larkAppId);
+            if (ds.worker && !ds.worker.killed) {
+                const targetWorker = ds.worker;
+                const isBridge = !!ds.adoptedFrom;
+                if (!isBridge)
+                    ensureSessionWhiteboard(ds);
+                const { promptContent, cliInput } = buildDocCommentTurnInput({
+                    ds,
+                    promptInput,
+                    botCliId: dsBotCfg.cliId,
+                    botCliPathOverride: dsBotCfg.cliPathOverride,
+                    botIdentity: { name: selfBot.botName, openId: selfBot.botOpenId },
+                    sender,
+                    mode: 'live',
+                });
+                beginNewTurn(ds, text);
+                (ds.session.docCommentTargets ??= {})[turnId] = docTarget; // per-turn map，不覆盖其他并发轮
+                // rememberLastCliInput persists both the exact comment target and the
+                // structured sidecar before any worker-visible delivery can occur.
+                rememberLastCliInput(ds, promptContent, cliInput);
+                await noteTurnReceived(ds, commentId, text, sender, turnId);
+                ensureCurrentRoutingGeneration(generation, 'comment:live-note');
+                if (ds.worker !== targetWorker || targetWorker.killed) {
+                    throw new Error('worker generation changed during comment:live-note');
+                }
+                if (!sendWorkerInput(ds, cliInput, turnId)) {
+                    throw new Error('worker became unavailable during comment:live-send');
+                }
+                logger.info(`[${tag(ds)}] doc-comment turn injected (turn ${turnId.slice(0, 8)})`);
+                return;
+            }
             // Worker 挂起 / 已退出 —— resume 重 fork（与 handleThreadReply 同路）。
             logger.info(`[${tag(ds)}] Worker not running for doc-comment, re-forking...`);
             if (ds.usageLimitRetryTimer) {
@@ -14434,33 +15242,26 @@ async function handleDocComment(ctx) {
                 mode: 'refork',
             });
             (ds.session.docCommentTargets ??= {})[turnId] = docTarget; // per-turn map，不覆盖其他并发轮
-            await noteTurnReceived(ds, commentId, text, sender, turnId);
             rememberLastCliInput(ds, promptContent, wrappedInput);
+            await noteTurnReceived(ds, commentId, text, sender, turnId);
+            ensureCurrentRoutingGeneration(generation, 'comment:refork-note');
+            if (ds.worker && !ds.worker.killed) {
+                throw new Error('worker became active during comment:refork-note');
+            }
             sessionStore.updateSession(ds.session);
-            // Same adopt re-fork routing as handleThreadReply: an adopt session whose
-            // bridge worker exited must come back through forkAdoptWorker (observe +
-            // bridge), never forkWorker. buildDocCommentTurnInput(mode:'refork')
-            // delegates to buildReforkCliInput, which already bridge-formats the content
-            // when ds.adoptedFrom is set, so the doc-comment turn reaches the observed
-            // pane without a <user_message> wrapper.
             if (ds.adoptedFrom) {
                 forkAdoptWorker(ds, { prompt: wrappedInput.content, turnId });
             }
             else {
                 forkWorker(ds, wrappedInput, { resume: ds.hasHistory, turnId });
             }
-        }
-        return true;
+        }, cleanupFailedDelivery);
     }
     catch (err) {
-        // 投递失败：清理 claim 允许重试，返回 false 让 poller 不推进游标。
-        handledDocCommentTurns.delete(claimKey);
         logger.warn(`[doc-comment] delivery failed, claim released for retry file=${sub.fileToken.slice(0, 12)} turn=${turnId.slice(0, 12)} err=${err instanceof Error ? err.message : String(err)}`);
         return false;
     }
 }
-/** 同一条评论可能同时被长连接通知和 --all 轮询看到；daemon 内统一去重。 */
-const handledDocCommentTurns = new BoundedMap(5_000);
 let docCommentPollRunning = false;
 /**
  * `/watch-comment --all` 的应用身份增量轮询。
@@ -14561,7 +15362,7 @@ async function restoreDocSubscriptions(_sessions) {
             //   • 有 sessionId 且其会话 status==='closed' → 真的关了 → 退订 + 删表
             //   • 会话不存在（被清理）→ 同上
             //   • 会话 active / 缺 sessionId（老订阅，无从判定）→ 保留 + 重订阅（保守，不误删）
-            const stored = sub.sessionId ? sessionStore.getSession(sub.sessionId) : undefined;
+            const stored = sub.sessionId ? sessionStore.getOwnedSession(sub.sessionId) : undefined;
             const definitelyClosed = sub.sessionId && (!stored || stored.status === 'closed');
             if (definitelyClosed) {
                 if (sub.managedBy !== 'watch-comment')
@@ -14599,14 +15400,6 @@ function resolvePrimaryOwnerOpenId(larkAppId) {
         return undefined;
     }
 }
-/** Parse a positive float env override, falling back to `dflt` when unset/invalid. */
-function envFloat(name, dflt) {
-    const raw = process.env[name];
-    if (raw === undefined || raw.trim() === '')
-        return dflt;
-    const n = Number(raw);
-    return Number.isFinite(n) && n >= 0 ? n : dflt;
-}
 /**
  * Host-overload thresholds, seeded from module defaults and overridable via env
  * so an operator can tune sensitivity without a code change:
@@ -14618,37 +15411,24 @@ function envFloat(name, dflt) {
  * but are inert (reading passes swap=undefined).
  */
 function resolveOverloadThresholds() {
-    const cpuCount = Math.max(1, cpus().length || 1);
-    const enterLoadRatio = envFloat('BOTMUX_OVERLOAD_ENTER_LOAD_RATIO', DEFAULT_OVERLOAD_THRESHOLDS.enterLoadRatio);
-    let exitLoadRatio = envFloat('BOTMUX_OVERLOAD_EXIT_LOAD_RATIO', DEFAULT_OVERLOAD_THRESHOLDS.exitLoadRatio);
-    const enterMemUsedFrac = envFloat('BOTMUX_OVERLOAD_ENTER_MEM_FRAC', DEFAULT_OVERLOAD_THRESHOLDS.enterMemUsedFrac);
-    let exitMemUsedFrac = envFloat('BOTMUX_OVERLOAD_EXIT_MEM_FRAC', DEFAULT_OVERLOAD_THRESHOLDS.exitMemUsedFrac);
-    // Hysteresis only works when the recover line sits STRICTLY below the enter
-    // line. Clamping a misconfigured exit down to *equal* enter is not enough: at
-    // enter == exit the enter test (mem `>=`) and the recover test (mem `<=`) both
-    // fire at the exact threshold, so a reading pinned there flaps entered/
-    // recovered every tick. Force a small gap below enter (5%) and warn.
-    const HYSTERESIS_MARGIN = 0.95; // exit = 95% of enter when misconfigured
-    if (exitLoadRatio >= enterLoadRatio) {
-        const clamped = enterLoadRatio * HYSTERESIS_MARGIN;
-        logger.warn(`[overload] BOTMUX_OVERLOAD_EXIT_LOAD_RATIO (${exitLoadRatio}) >= ENTER (${enterLoadRatio}); clamping exit to ${clamped}`);
-        exitLoadRatio = clamped;
-    }
-    if (exitMemUsedFrac >= enterMemUsedFrac) {
-        const clamped = enterMemUsedFrac * HYSTERESIS_MARGIN;
-        logger.warn(`[overload] BOTMUX_OVERLOAD_EXIT_MEM_FRAC (${exitMemUsedFrac}) >= ENTER (${enterMemUsedFrac}); clamping exit to ${clamped}`);
-        exitMemUsedFrac = clamped;
-    }
-    return {
-        cpuCount,
-        enterLoadRatio,
-        exitLoadRatio,
-        enterMemUsedFrac,
-        exitMemUsedFrac,
-        enterSwapUsedFrac: DEFAULT_OVERLOAD_THRESHOLDS.enterSwapUsedFrac,
-        exitSwapUsedFrac: DEFAULT_OVERLOAD_THRESHOLDS.exitSwapUsedFrac,
-        minReAlertMs: envFloat('BOTMUX_OVERLOAD_MIN_REALERT_MS', DEFAULT_OVERLOAD_THRESHOLDS.minReAlertMs),
-    };
+    // Enter thresholds priority (env > global config > default) + hysteresis-safe
+    // exit derivation live in the pure computeOverloadThresholds() so they can be
+    // unit-tested without importing this side-effectful module. We only gather the
+    // impure inputs (CPU count, persisted config, env strings) here.
+    const cfg = readGlobalConfig().hostOverloadAlert ?? {};
+    return computeOverloadThresholds({
+        cpuCount: cpus().length || 1,
+        configEnterLoadRatio: cfg.enterLoadRatio,
+        configEnterMemUsedFrac: cfg.enterMemUsedFrac,
+        env: {
+            enterLoadRatio: process.env.BOTMUX_OVERLOAD_ENTER_LOAD_RATIO,
+            exitLoadRatio: process.env.BOTMUX_OVERLOAD_EXIT_LOAD_RATIO,
+            enterMemUsedFrac: process.env.BOTMUX_OVERLOAD_ENTER_MEM_FRAC,
+            exitMemUsedFrac: process.env.BOTMUX_OVERLOAD_EXIT_MEM_FRAC,
+            minReAlertMs: process.env.BOTMUX_OVERLOAD_MIN_REALERT_MS,
+        },
+        warn: (message) => logger.warn(message),
+    });
 }
 /**
  * Machine-wide de-dup for the host-overload alert. load/mem are host-wide, so if
@@ -14763,7 +15543,12 @@ export async function startDaemon(botIndex) {
     // sandboxReadonlyPaths / readDenyExtraPaths → sandbox + sandboxPaths) BEFORE
     // loading, so the parsed configs below already carry the new model. Writes
     // new fields, keeps old ones (downgrade = zero-op), backs up once. Idempotent.
-    await migrateSandboxConfigAtStartup();
+    // SKIP in core-only (codex P1-2): this reads + backs-up + rewrites the on-disk
+    // fleet bots.json. A headless core-only service must never touch an ambient
+    // host fleet config — its identity is a synthesized in-memory apiOnly bot.
+    if (process.env.BOTMUX_CORE_ONLY !== '1') {
+        await migrateSandboxConfigAtStartup();
+    }
     // Load the assigned bot (one daemon per bot)
     let botConfigs = loadBotConfigs();
     const idx = botIndex ?? 0;
@@ -14910,18 +15695,34 @@ export async function startDaemon(botIndex) {
     // running in a separate node process) so dashboard event bus stays in sync.
     scheduleStore.setScheduleScope(cfg.larkAppId);
     migrateSharedSchedulesAtStartup(botConfigs.map(b => b.larkAppId), botConfigs[0]?.larkAppId ?? cfg.larkAppId);
+    void migrateOverloadAlertAtStartup(botConfigs.map(b => ({ larkAppId: b.larkAppId, apiOnly: b.apiOnly })));
     scheduleStore.startExternalWriteWatcher();
     logger.info(`Bot ${idx}/${botConfigs.length}: ${cfg.larkAppId} (cli: ${cfg.cliId})`);
     setAskCardDispatcher(createLarkAskCardDispatcher());
     // Honour the bot's canTalk gate for `botmux ask` answers: a clicker who may
     // address the bot in this chat may answer an implicit-approver ask.
-    setAskCanTalkChecker((appId, chatId, openId, chatType) => evaluateTalk(appId, chatId, openId, undefined, undefined, chatType).allowed);
+    //
+    // 分派逻辑在 evaluateAskAnswerTalk（生产共用真源）：actor 透传时（文字作答路径）
+    // bot → evaluateBotTalk、人 → evaluateTalk 的完整模型（teamMember 走 memberUnionId
+    // 腿）；不传 actor（卡片点击路径，飞书 card-action 回调无 sender union/bot 标记）→
+    // 退化为纯 evaluateTalk(openId, chatType)，与改动前语义一致。三条分派由
+    // test/ask-answer-talk-dispatch.test.ts 直接咬住。
+    setAskCanTalkChecker((appId, chatId, openId, chatType, actor) => evaluateAskAnswerTalk(appId, chatId, openId, chatType, actor));
     writePidFile();
     const memoryDiagnostics = startMemoryDiagnostics();
     // Publish self-descriptor for the dashboard registry. The dashboard sibling
     // process discovers running daemons by scanning <resolvedDataDir>/dashboard-daemons/
     // and watching for mtime updates (heartbeat) / file removal (shutdown).
-    const ipcPort = config.dashboard.ipcBasePort + idx;
+    //
+    // Core-only (in-sandbox, single service): riff's task-runner is handed ONE
+    // fixed port and dials 127.0.0.1:<port> directly, so the port must be exactly
+    // BOTMUX_API_PORT and must NOT drift via the fleet's upward EADDRINUSE probe —
+    // a silent drift would leave the client dialing a dead port. Fleet daemons
+    // keep the ipcBasePort+idx scheme + probe (a port race must not crash boot).
+    const coreOnlyApiPort = process.env.BOTMUX_CORE_ONLY === '1'
+        ? Number(process.env.BOTMUX_API_PORT) || 0
+        : 0;
+    const ipcPort = coreOnlyApiPort || config.dashboard.ipcBasePort + idx;
     // Worker/CLI descendants use this only to reach the current daemon's
     // agent-facing, live-origin-gated endpoints. Internal control endpoints use
     // a separate daemon-to-daemon credential and never trust this port marker.
@@ -14968,55 +15769,61 @@ export async function startDaemon(botIndex) {
         }
     };
     setDisplayNameRefresher(refreshBotNameState);
-    // 机器人真·改名（dashboard 档案头 ✎）：开放平台自动化改飞书应用名并发布新版本
-    // （群内显示名跟随已发布版本，见 services/open-platform-rename.ts）。成功后同步
-    // 内存 botName / bots-info 名册 / descriptor，并清掉冗余的 displayName 别名——
-    // 飞书名已经是新名，保持单一事实来源。
-    setBotRenamer(async (newName) => {
-        const r = await renameBotOnOpenPlatform(cfg.larkAppId, newName, cfg.brand);
-        if (!r.ok)
-            return r;
-        const bot = getBot(cfg.larkAppId);
-        bot.botName = newName;
-        const spec = findConfigField('displayName');
-        if (spec && bot.config.displayName) {
-            // applyConfigField 的 displayName 钩子会顺带触发 refreshBotNameState。
-            await applyConfigField(cfg.larkAppId, spec, null);
-        }
-        else {
-            refreshBotNameState();
-        }
-        try {
-            writeBotInfoFile(config.session.dataDir);
-        }
-        catch { /* best effort */ }
-        return r;
-    });
-    // 机器人真·改头像（dashboard 档案头头像入口）：开放平台自动化换飞书应用头像并
-    // 发布新版本（群内头像跟随已发布版本，同 rename）。成功后用上传返回的 url
-    // 同步内存 botAvatarUrl / descriptor / bots-info 让 dashboard 立即换图——该 url
-    // 是飞书 CDN 上的持久资源，与 /bot/v3/info 的 canonical avatar_url 指向同一张图，
-    // 会一直沿用到下次 daemon 重启时 probeBotOpenId 重新拉取（probe 在 botOpenId
-    // 已知时不会重复请求，进程内没有周期性刷新）。
-    setBotAvatarChanger(async (image) => {
-        const r = await changeBotAvatarOnOpenPlatform(cfg.larkAppId, image, cfg.brand);
-        if (!r.ok)
+    // apiOnly (core-only) bots have no Feishu app to rename / re-avatar. These
+    // handlers drive the open-platform console (browser web-session, NOT
+    // getBotClient — so the bot-level gate can't catch them); skip registering
+    // them entirely so the dashboard profile actions are inert for a core-only bot.
+    if (!cfg.apiOnly) {
+        // 机器人真·改名（dashboard 档案头 ✎）：开放平台自动化改飞书应用名并发布新版本
+        // （群内显示名跟随已发布版本，见 services/open-platform-rename.ts）。成功后同步
+        // 内存 botName / bots-info 名册 / descriptor，并清掉冗余的 displayName 别名——
+        // 飞书名已经是新名，保持单一事实来源。
+        setBotRenamer(async (newName) => {
+            const r = await renameBotOnOpenPlatform(cfg.larkAppId, newName, cfg.brand);
+            if (!r.ok)
+                return r;
+            const bot = getBot(cfg.larkAppId);
+            bot.botName = newName;
+            const spec = findConfigField('displayName');
+            if (spec && bot.config.displayName) {
+                // applyConfigField 的 displayName 钩子会顺带触发 refreshBotNameState。
+                await applyConfigField(cfg.larkAppId, spec, null);
+            }
+            else {
+                refreshBotNameState();
+            }
+            try {
+                writeBotInfoFile(config.session.dataDir);
+            }
+            catch { /* best effort */ }
             return r;
-        const bot = getBot(cfg.larkAppId);
-        bot.botAvatarUrl = r.avatarUrl;
-        if (desc.botAvatarUrl !== r.avatarUrl) {
-            desc.botAvatarUrl = r.avatarUrl;
+        });
+        // 机器人真·改头像（dashboard 档案头头像入口）：开放平台自动化换飞书应用头像并
+        // 发布新版本（群内头像跟随已发布版本，同 rename）。成功后用上传返回的 url
+        // 同步内存 botAvatarUrl / descriptor / bots-info 让 dashboard 立即换图——该 url
+        // 是飞书 CDN 上的持久资源，与 /bot/v3/info 的 canonical avatar_url 指向同一张图，
+        // 会一直沿用到下次 daemon 重启时 probeBotOpenId 重新拉取（probe 在 botOpenId
+        // 已知时不会重复请求，进程内没有周期性刷新）。
+        setBotAvatarChanger(async (image) => {
+            const r = await changeBotAvatarOnOpenPlatform(cfg.larkAppId, image, cfg.brand);
+            if (!r.ok)
+                return r;
+            const bot = getBot(cfg.larkAppId);
+            bot.botAvatarUrl = r.avatarUrl;
+            if (desc.botAvatarUrl !== r.avatarUrl) {
+                desc.botAvatarUrl = r.avatarUrl;
+                try {
+                    writeDaemonDescriptor(desc);
+                }
+                catch { /* best effort */ }
+            }
             try {
-                writeDaemonDescriptor(desc);
+                writeBotInfoFile(config.session.dataDir);
             }
             catch { /* best effort */ }
-        }
-        try {
-            writeBotInfoFile(config.session.dataDir);
-        }
-        catch { /* best effort */ }
-        return r;
-    });
+            return r;
+        });
+    } // end !cfg.apiOnly (open-platform rename/avatar handlers)
     // One cap implementation shared by event-driven checks (process start / idle
     // edge) and the 60s safety-net timer below. Each daemon owns exactly one
     // bot's activeSessions map, so the configured limit is per bot.
@@ -15112,10 +15919,27 @@ export async function startDaemon(botIndex) {
     // host-only shared secret on every daemon IPC route except the tiny
     // capability-gated receiver/readiness apertures in dashboard-ipc-server.
     loadOrCreateDashboardSecret(join(homedir(), '.botmux', '.dashboard-secret'));
+    const coreOnly = process.env.BOTMUX_CORE_ONLY === '1';
+    // Core-only keeps the trusted-host HMAC ON (codex P1: authRequired:false opened
+    // ALL 96 IPC routes — a co-resident model turn could read/perturb sessions,
+    // scheduler, mutations). Instead we allowlist ONLY the tight riff-facing routes
+    // (routeIsCoreOnlyPublic: /api/trigger + /api/sessions/:id/{trigger-result,insight}
+    // + the always-public /healthz) as no-HMAC; every other route still requires it.
+    // Arm the readiness gate BEFORE the bind (codex P1): between listen() and a
+    // later arm there'd be a window where the port answers unarmed and a trigger
+    // could slip past the 503 barrier. Armed-first means the very first accepted
+    // connection already sees the not-ready gate.
+    if (coreOnly)
+        armCoreOnlyReadinessGate();
     const ipcHandle = await startIpcServer({
         port: ipcPort,
         host: '127.0.0.1',
         authRequired: true,
+        coreOnlyPublicRoutes: coreOnly,
+        // Fleet: probe upward so a port race can't crash boot. Core-only: BIND-OR-FAIL
+        // on the exact BOTMUX_API_PORT — riff was handed that port and the service must
+        // never silently drift to another (client would dial a dead port).
+        ...(coreOnly ? { maxProbe: 0 } : {}),
     });
     // startIpcServer probes upward on EADDRINUSE (e.g. a second botmux instance on
     // this host already holds ipcBasePort+idx), so the bound port may differ from
@@ -15124,19 +15948,30 @@ export async function startDaemon(botIndex) {
     desc.ipcPort = ipcHandle.port;
     process.env.BOTMUX_DAEMON_IPC_PORT = String(ipcHandle.port);
     logger.info(`[dashboard-ipc] listening on 127.0.0.1:${ipcHandle.port} (bot ${idx})`);
+    // NOTE: the core-only ready line + readiness release (setCoreOnlyReady) are
+    // emitted LATER, AFTER restoreActiveSessions completes — until then BOTH
+    // /healthz AND the public control routes (trigger/result/insight) return 503,
+    // so riff never triggers into a racing durable restore (codex P1).
     // Single reverse-proxy port that fronts every session's web terminal under
     // /s/{sessionId}, so dev-machine users forward one port (proxyBasePort+idx)
     // instead of one per topic. Bound on the public host so `ssh -L` can reach it.
     const proxyPort = config.web.proxyBasePort + idx;
+    // Core-only (codex P1-4): the web terminal proxy + worker web ports default to
+    // config.web.host (0.0.0.0). In riff's sandbox the whole surface must stay
+    // loopback — an in-sandbox headless service has no reason to expose terminals
+    // on all interfaces. Force 127.0.0.1 so nothing but the local task-runner can
+    // reach it (the IPC server is already 127.0.0.1-bound above).
+    const terminalProxyHost = coreOnly ? '127.0.0.1' : config.web.host;
     let terminalProxy = null;
     try {
         terminalProxy = await startTerminalProxy({
             port: proxyPort,
-            host: config.web.host,
+            host: terminalProxyHost,
             resolvePort: (sessionId) => {
                 for (const ds of activeSessions.values()) {
-                    if (ds.session.sessionId === sessionId && ds.workerPort)
+                    if (ds.session.sessionId === sessionId && sessionSupportsWebTerminal(ds) && ds.workerPort) {
                         return ds.workerPort;
+                    }
                 }
                 return undefined;
             },
@@ -15154,7 +15989,7 @@ export async function startDaemon(botIndex) {
         // falls back to the worker's own port so links stay reachable if the port
         // was taken (e.g. EADDRINUSE).
         setTerminalProxyPort(terminalProxy.port);
-        logger.info(`[terminal-proxy] listening on ${config.web.host}:${terminalProxy.port} (bot ${idx}) — session terminals at /s/{sessionId}`);
+        logger.info(`[terminal-proxy] listening on ${terminalProxyHost}:${terminalProxy.port} (bot ${idx}) — session terminals at /s/{sessionId}`);
     }
     catch (err) {
         logger.error(`[terminal-proxy] failed to bind port ${proxyPort} — falling back to direct worker ports for terminal links: ${err.message}`);
@@ -15201,8 +16036,11 @@ export async function startDaemon(botIndex) {
         const cfg = bot.config;
         // Refresh CLI version per bot's cliId
         refreshCliVersion(cfg.cliId, cfg.cliPathOverride);
-        // Resolve allowed users per bot
-        if ((bot.config.allowedUsers?.length ?? 0) > 0 || bot.resolvedAllowedUsers.length > 0) {
+        // Resolve allowed users per bot. Skipped for apiOnly (core-only) bots:
+        // their HTTP control-API triggers authenticate via the dashboard token, not
+        // allowedUsers, and resolving email/union_id entries would call the Feishu
+        // contact API — a network round-trip a no-Feishu bot must never make.
+        if (!cfg.apiOnly && ((bot.config.allowedUsers?.length ?? 0) > 0 || bot.resolvedAllowedUsers.length > 0)) {
             // 含邮箱或 union_id(on_) 都要重解析成本 app 的 open_id —— 否则 canTalk/canOperate
             // 拿 sender 的 ou_ 对不上 on_，owner 会被自己的 bot 锁死（PR#72）。
             // literal ou_ 也走 best-effort 校验，用于诊断把其他 app 视角 open_id
@@ -15277,45 +16115,61 @@ export async function startDaemon(botIndex) {
             catch { /* best effort */ }
         }
         checkAllowedChatGroupsConfig(bot);
-        // Probe bot open_id and persist to bots-info.json. When the friendly
-        // botName comes back from /bot/v3/info, refresh the dashboard descriptor
-        // so the registry shows "Claude" / "Codex" instead of the raw app id.
-        // A custom displayName (bots.json) beats the probed Lark name — the probe
-        // must not overwrite a rename seeded at startup.
-        probeBotOpenId(cfg.larkAppId).then(() => {
-            writeBotInfoFile(config.session.dataDir);
-            const probedName = cfg.displayName ?? bot.botName;
-            const probedAvatar = bot.botAvatarUrl;
-            let descChanged = false;
-            if (probedName && probedName !== desc.botName) {
-                desc.botName = probedName;
-                descChanged = true;
-            }
-            if (probedAvatar && probedAvatar !== desc.botAvatarUrl) {
-                desc.botAvatarUrl = probedAvatar;
-                descChanged = true;
-            }
-            if (descChanged) {
-                try {
-                    writeDaemonDescriptor(desc);
+        // apiOnly (core-only) bots never connect to Feishu: skip the open_id probe,
+        // the required-scope check, and the WSClient event subscription. They are
+        // driven purely over the HTTP control API (trigger → spawn → trigger-result),
+        // whose async path early-returns in deliverFinalOutput before any Feishu send.
+        // Seed a synthetic identity so downstream reads (worker botOpenId, dashboard
+        // roster) get a stable non-undefined value instead of the never-probed one.
+        if (cfg.apiOnly) {
+            bot.botOpenId ||= `bot_${cfg.larkAppId}`;
+            bot.botName ||= cfg.displayName ?? cfg.larkAppId;
+            logger.info(`[api-only] ${cfg.larkAppId} 以 core-only 模式启动：跳过飞书 open_id 探测 / scope 校验 / WSClient 订阅，仅 HTTP 控制 API 驱动`);
+        }
+        else {
+            // Probe bot open_id and persist to bots-info.json. When the friendly
+            // botName comes back from /bot/v3/info, refresh the dashboard descriptor
+            // so the registry shows "Claude" / "Codex" instead of the raw app id.
+            // A custom displayName (bots.json) beats the probed Lark name — the probe
+            // must not overwrite a rename seeded at startup.
+            probeBotOpenId(cfg.larkAppId).then(() => {
+                writeBotInfoFile(config.session.dataDir);
+                const probedName = cfg.displayName ?? bot.botName;
+                const probedAvatar = bot.botAvatarUrl;
+                let descChanged = false;
+                if (probedName && probedName !== desc.botName) {
+                    desc.botName = probedName;
+                    descChanged = true;
                 }
-                catch { /* best effort */ }
-            }
-            // SessionRow.botName 同步换成友好名——否则 dashboard 会话行一直显示
-            // 启动时 seed 的 larkAppId（web 端有注册表映射兜底，这里是根因修复）。
-            if (probedName)
-                setBotName(probedName);
-        }).catch(err => {
-            // Probe runs in background and is retried by the periodic heartbeat;
-            // a single failure here is not actionable. Surface as debug only.
-            logger.debug(`[${cfg.larkAppId}] Bot open_id probe failed (will retry): ${err.message}`);
-        });
+                if (probedAvatar && probedAvatar !== desc.botAvatarUrl) {
+                    desc.botAvatarUrl = probedAvatar;
+                    descChanged = true;
+                }
+                if (descChanged) {
+                    try {
+                        writeDaemonDescriptor(desc);
+                    }
+                    catch { /* best effort */ }
+                }
+                // SessionRow.botName 同步换成友好名——否则 dashboard 会话行一直显示
+                // 启动时 seed 的 larkAppId（web 端有注册表映射兜底，这里是根因修复）。
+                if (probedName)
+                    setBotName(probedName);
+            }).catch(err => {
+                // Probe runs in background and is retried by the periodic heartbeat;
+                // a single failure here is not actionable. Surface as debug only.
+                logger.debug(`[${cfg.larkAppId}] Bot open_id probe failed (will retry): ${err.message}`);
+            });
+        } // end !cfg.apiOnly (open_id probe)
         // Required-scope check: 启动后 best-effort 校验
         // im:message.group_at_msg.include_bot:readonly。缺失会 logger.error +
         // 私信 allowedUsers[0]。校验异步，跑失败不影响 daemon。
-        checkRequiredScopes(cfg.larkAppId).catch(err => {
-            logger.debug(`[${cfg.larkAppId}] required-scope check failed: ${err?.message ?? err}`);
-        });
+        // apiOnly 无飞书连接 → 无 scope 概念，跳过。
+        if (!cfg.apiOnly) {
+            checkRequiredScopes(cfg.larkAppId).catch(err => {
+                logger.debug(`[${cfg.larkAppId}] required-scope check failed: ${err?.message ?? err}`);
+            });
+        }
         // 主动开工 — 场景①: the bot.added event can't be self-verified via API, and
         // if it isn't subscribed the handler simply never fires (no runtime signal).
         // Surface a startup breadcrumb whenever the toggle is on so a misconfigured
@@ -15351,7 +16205,11 @@ export async function startDaemon(botIndex) {
         };
         // 存起来供授权成功后重放消息用（replayGrantedMessage → replayMessageEvent）。
         botHandlers.set(cfg.larkAppId, botEventHandlers);
-        startLarkEventDispatcher(cfg.larkAppId, cfg.larkAppSecret, botEventHandlers, normalizeBrand(cfg.brand));
+        // apiOnly bots never subscribe to Feishu events → no WSClient. This is the
+        // core decoupling: the daemon serves the HTTP control API only.
+        if (!cfg.apiOnly) {
+            startLarkEventDispatcher(cfg.larkAppId, cfg.larkAppSecret, botEventHandlers, normalizeBrand(cfg.brand));
+        }
         // A distillation command is durably prepared before its model run/card
         // delivery. Resume active prepared/proposed allocations after a daemon
         // crash; deterministic Lark UUIDs suppress duplicate cards in the
@@ -15453,16 +16311,22 @@ export async function startDaemon(botIndex) {
     catch (err) {
         logger.warn(`[skills] post-restore global sweep failed: ${err instanceof Error ? err.message : String(err)}`);
     }
-    // 文档订阅恢复：重启后订阅可能已失效，给仍活跃的会话重订阅；会话没恢复
-    // （已关/丢失）的订阅则退订 + 清表，避免「命中订阅但无会话」的孤儿。
-    await restoreDocSubscriptions(activeSessions);
-    // `drive.notice.comment_add_v1` 只可靠推送 @Bot 通知；--all 通过应用身份轮询
-    // 评论列表补齐普通评论。先立即建/续基线，之后每 5 秒增量检查。
-    const docCommentPollTimer = setInterval(() => {
+    // 文档订阅恢复 + 评论轮询：都是主动调飞书文档 API 的路径。apiOnly（core-only）
+    // bot 从不连飞书，且其合成身份不会有真实文档订阅——整块跳过，否则非 pristine
+    // dataDir 上的遗留订阅会让「无飞书连接」的 bot 每 5 秒主动打飞书。
+    let docCommentPollTimer;
+    if (!cfg.apiOnly) {
+        // 文档订阅恢复：重启后订阅可能已失效，给仍活跃的会话重订阅；会话没恢复
+        // （已关/丢失）的订阅则退订 + 清表，避免「命中订阅但无会话」的孤儿。
+        await restoreDocSubscriptions(activeSessions);
+        // `drive.notice.comment_add_v1` 只可靠推送 @Bot 通知；--all 通过应用身份轮询
+        // 评论列表补齐普通评论。先立即建/续基线，之后每 5 秒增量检查。
+        docCommentPollTimer = setInterval(() => {
+            void pollWatchedDocComments(cfg.larkAppId);
+        }, 5_000);
+        docCommentPollTimer.unref?.();
         void pollWatchedDocComments(cfg.larkAppId);
-    }, 5_000);
-    docCommentPollTimer.unref?.();
-    void pollWatchedDocComments(cfg.larkAppId);
+    }
     // Sweep orphan sandbox trees left by a previous run's crash/kill: any
     // <dataDir>/sandboxes/<sid> whose session is no longer active gets its
     // deny-mask mountpoints reclaimed and its dirs removed.
@@ -15529,8 +16393,12 @@ export async function startDaemon(botIndex) {
     const maintenanceHeartbeat = setInterval(writeBusyHeartbeat, 15_000);
     maintenanceHeartbeat.unref?.();
     // Auto-update / auto-restart and the restart-report DM run only on the
-    // primary daemon (bot-0) — a restart is host-wide.
-    if (idx === 0) {
+    // primary daemon (bot-0) — a restart is host-wide. NEVER in core-only (codex
+    // P1): a headless in-sandbox service synthesizes its single bot at idx=0, but
+    // it must NOT own host-wide fleet maintenance — auto-update could rewrite the
+    // global botmux install and a detached `botmux restart` would tear down the
+    // real fleet. Core-only manages only its own single process.
+    if (idx === 0 && !coreOnly) {
         startMaintenance();
         startCliRuntimeUpdateMonitor({
             dataDir: config.session.dataDir,
@@ -15555,34 +16423,33 @@ export async function startDaemon(botIndex) {
             });
         }, 5_000).unref?.();
     }
-    // Host-overload watcher. Enabled per-bot via the `overloadAlert` config toggle
-    // (dashboard → Groups & Bots → bot card), NOT hardcoded to the primary daemon:
-    // any one bot can be designated the machine's alerter. load/mem are host-wide,
-    // so if more than one bot has it on, a cross-process file lock keyed on the
-    // overload episode ensures the machine only DMs once per edge (whichever bot's
-    // daemon wins the lock speaks). Reads os.loadavg()[2] + mem every 30s; on a
-    // healthy→overloaded or overloaded→healthy edge it DMs that bot's owner.
-    // Hysteresis + a min re-alert window (see host-overload-alert.ts) keep a load
-    // hovering near the line from spamming. Set BOTMUX_OVERLOAD_ALERT=0 to force
-    // the whole feature off regardless of per-bot config.
+    // Host-overload watcher. Machine-level: enabled via the GLOBAL config
+    // `hostOverloadAlert` (dashboard → Global Settings), which names one "notifier
+    // bot". ONLY that bot's own daemon samples + advances the state machine + DMs
+    // (it runs on this host, so no cross-daemon delivery queue is needed) — other
+    // daemons no-op and keep their state cleared. load/mem are host-wide; the
+    // cross-process episode lock is kept purely as a belt-and-suspenders guard
+    // (e.g. a stale duplicate daemon for the same bot). Reads os.loadavg()[2] +
+    // mem every 30s; on a healthy→overloaded or overloaded→healthy edge it DMs the
+    // notifier bot's admin. Hysteresis + a min re-alert window (see
+    // host-overload-alert.ts) keep a load near the line from spamming. Set
+    // BOTMUX_OVERLOAD_ALERT=0 to force the whole feature off regardless of config.
     if (process.env.BOTMUX_OVERLOAD_ALERT !== '0') {
-        const overloadThresholds = resolveOverloadThresholds();
         let overloadState = INITIAL_OVERLOAD_STATE;
         const overloadTimer = setInterval(() => {
             void (async () => {
                 try {
-                    // Per-bot热开关：关了就不采样，但 timer 常驻，用户在 web 打开后下个 tick 即生效。
-                    let enabled = false;
-                    try {
-                        enabled = getBot(cfg.larkAppId).config.overloadAlert === true;
-                    }
-                    catch {
-                        enabled = false;
-                    }
-                    if (!enabled) {
+                    // Global hot switch + target gating: only the selected notifier bot's
+                    // daemon samples. When disabled, or the target is another bot / unset,
+                    // reset local state so a later re-enable starts clean (no stale edge).
+                    const alertCfg = readGlobalConfig().hostOverloadAlert ?? {};
+                    if (!isOverloadAlertTarget(alertCfg, { larkAppId: cfg.larkAppId, apiOnly: cfg.apiOnly })) {
                         overloadState = INITIAL_OVERLOAD_STATE;
                         return;
                     }
+                    // Re-read thresholds each tick so live config edits (enter load/mem)
+                    // take effect on the next sample without a restart.
+                    const overloadThresholds = resolveOverloadThresholds();
                     const reading = {
                         load15: loadavg()[2] ?? 0,
                         memTotalBytes: totalmem(),
@@ -15592,11 +16459,11 @@ export async function startDaemon(botIndex) {
                     overloadState = nextState;
                     if (!action)
                         return;
-                    // Machine-wide de-dup: multiple bots may have the toggle on, but the
-                    // host is one machine. Claim a short-lived episode lock so only one bot
-                    // DMs per edge. Losing the claim = another bot already alerted this edge.
+                    // Belt-and-suspenders de-dup: normally only the target daemon reaches
+                    // here, but a stale duplicate daemon for the same bot could double-fire.
+                    // Claim a short-lived episode lock so the host DMs once per edge.
                     if (!claimOverloadEpisode(action.kind)) {
-                        logger.info(`[overload] ${action.kind} edge already claimed by a sibling bot; skipping DM (${cfg.larkAppId})`);
+                        logger.info(`[overload] ${action.kind} edge already claimed; skipping DM (${cfg.larkAppId})`);
                         return;
                     }
                     const ownerOpenId = resolvePrimaryOwnerOpenId(cfg.larkAppId);
@@ -15713,7 +16580,7 @@ export async function startDaemon(botIndex) {
                 // detach-preserve a "herdr" session whose real pane is tmux (freeze-once).
                 // undefined (frozen pty, or unresolvable legacy) → non-persistent → killWorker.
                 if (shutdownBackendDisposition(ds) === 'detach') {
-                    // Persistent backends (tmux / herdr / zellij): just kill the worker process —
+                    // Persistent backends (tmux / herdr / zellij / zmx): just kill the worker process —
                     // the multiplexer session survives for re-attach. The worker's SIGTERM
                     // handler calls backend.kill(), which only DETACHES. Going through
                     // killWorker() instead would send {type:'close'} → destroySession() →
@@ -15776,5 +16643,16 @@ export async function startDaemon(botIndex) {
         flushIdentityCacheSync();
     });
     logger.info('Daemon is running. Press Ctrl+C to stop.');
+    if (coreOnly) {
+        // Readiness barrier release (codex P1-3): restoreActiveSessions + v3 attach +
+        // scheduler + signal handlers are all wired now, so the HTTP surface is safe
+        // to drive. Flip /healthz → 200 THEN print the machine-parseable ready line.
+        // riff's launcher waits for either signal before pointing its client here, so
+        // a trigger can't race a durable restore (transient not_found / re-fire).
+        // Exact ready-line text is a locked contract (regex ^\[core-only\] listening on ).
+        setCoreOnlyReady();
+        // eslint-disable-next-line no-console
+        console.log(`[core-only] listening on 127.0.0.1:${ipcHandle.port} (bot ${cfg.larkAppId}, cli ${cfg.cliId})`);
+    }
 }
 //# sourceMappingURL=daemon.js.map