dsh-kingdom 2.0.0 → 3.2.0

package/lib/core/owner-window.js

@@ -1,14 +1,16 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { realpathSync, statSync } from 'node:fs';
 import { isAbsolute, relative, sep } from 'node:path';
-import { bindRole, rebindSession, setExecutionProfile } from './binding.js';
+import { bindRole, bindSupervisorForTerritory, rebindSession, setExecutionProfile } from './binding.js';
 import { createTerritory, setTerritorySupervisor, updateTerritory } from './territory.js';
 import { setCapabilityCeiling } from '../capability/admin.js';
 import { isOwnerControlCapability, issueOwnerOperationCapability, revokeOwnerOperationCapability, ownerEventPayload, ownerInputHash, } from './owner-control.js';
 import { initializeKingdomFacts } from './kingdom.js';
 import { normalizeBudgetPolicyParameters, readBudgetPolicy, setBudgetPolicy } from './budget.js';
 import { adoptCollaborationPlan, listCollaborationPlans, readCollaborationPlan, normalizePlanAdoptionParameters } from './collaboration.js';
-export const OWNER_MUTATION_ACTIONS = ['init', 'territory.create', 'territory.update', 'territory.supervisor', 'role.bind', 'role.session', 'ceiling', 'execution-profile', 'budget.policy', 'plan.adopt'];
+import { DELIVERY_ACK_EVENT_TYPE, CHANGE_EVIDENCE_LABEL, DELIVERY_QUESTION_NOTE, DELIVERY_QUESTION_EVENT_TYPE, DELIVERY_QUESTION_TEXT_LIMIT, DELIVERY_REPLY_STATES, boundedQuestionText, classifyAcceptedDelivery, deliveryAcknowledgementView, deliveryChangeItemId, deliveryIdFor, deliveryQuestionEventId, deliveryQuestionThreadForItem, deliveryReviewerBindingId, deriveDeliveryItems, listDeliveryQuestionHistory, readDeliveryAcknowledgements, readDeliveryItemVersion, readDeliveryQuestionThread, readLatestReviewEvent, recordDeliveryAcknowledgement, recordDeliveryQuestion, redactDeliveryText, } from './delivery-ack.js';
+import { readAcceptedChangeEvidence, readChangeEntry, resolveChangeEvidenceForDelivery, } from './delivery-change.js';
+export const OWNER_MUTATION_ACTIONS = ['init', 'territory.create', 'territory.update', 'territory.supervisor', 'role.bind', 'role.session', 'ceiling', 'execution-profile', 'budget.policy', 'plan.adopt', 'delivery.item.ack', 'delivery.item.question'];
 export class OwnerOperationError extends Error {
     code;
     constructor(code, message) {
@@ -19,6 +21,37 @@ export class OwnerOperationError extends Error {
 }
 const MANAGED_ROLES = ['CHANCELLOR', 'SUPERVISOR', 'WORKER'];
 const clone = (value) => JSON.parse(JSON.stringify(value));
+/** 条目提问元数据：只计数与时间，不含任何正文。 */
+function ownerDeliveryItemQuestions(thread) {
+    const replied = thread.questions.filter(question => question.reply !== null);
+    const asked = thread.questions.map(question => question.askedAt).sort();
+    const answered = replied.map(question => question.reply.repliedAt).sort();
+    return {
+        threadId: thread.deliveryId + ':' + thread.itemId,
+        totalCount: thread.questions.length,
+        pendingCount: thread.pendingCount,
+        answeredCount: thread.answeredCount,
+        historyCount: thread.historyCount,
+        lastAskedAt: asked.length ? asked[asked.length - 1] : null,
+        lastRepliedAt: answered.length ? answered[answered.length - 1] : null,
+        latestReplyState: thread.questions.length ? thread.questions[thread.questions.length - 1].replyState : null,
+    };
+}
+/** 固定的可达性说明；界面与报告共用，避免两处措辞漂移。 */
+function classifyReplyStateNote(state) {
+    // `DELIVERY_REPLY_STATES` 是唯一状态清单：新增状态而忘记补说明时这里立刻失败，
+    // 而不是静默回退成一句含糊的通用文案。
+    if (!DELIVERY_REPLY_STATES.includes(state))
+        fail('DELIVERY_QUESTION_STATE_UNKNOWN', '未知的回复可达性状态。');
+    const notes = {
+        REPLY_ACCESSIBLE: '该问题仍由接受交付的主管负责：它仍是领地当前主理并持有 ACTIVE session，可读取并回复。',
+        REVIEWER_BINDING_MISSING: '接受该交付时记录的主管绑定已不存在或不再是主管，本条不可达；不会改投继任主管。',
+        REVIEWER_BINDING_RETIRED: '接受该交付的主管已退任，本条不可达；不会改投继任主管。',
+        REVIEWER_SESSION_CHANGED: '该主管当前没有可用的 ACTIVE session，本条暂时不可达。',
+        SUPERVISOR_REBOUND: '该领地已改由其他主管主理，本条仍归原接受主管，不可达；不会自动改投继任者。',
+    };
+    return notes[state];
+}
 function fail(code, message) { throw new OwnerOperationError(code, message); }
 function object(value, allowed, required = allowed) {
     if (!value || typeof value !== 'object' || Array.isArray(value)
@@ -88,10 +121,13 @@ function normalizeInput(raw) {
         }
         case 'territory.supervisor': {
             const p = object(outer.parameters, ['territory_id', 'supervisor_binding_id']);
-            return { action: 'territory.supervisor', parameters: { territory_id: string(p.territory_id, '领地 ID'), supervisor_binding_id: string(p.supervisor_binding_id, '主管绑定 ID') } };
+            // v3.2.0（Owner 2026-09-29 裁定）：管理窗口必须能表达"解除现任主理"。
+            // 显式 JSON null = 解除；缺失（undefined）仍然是输入错误，不会被当成解除。
+            const supervisorBindingId = p.supervisor_binding_id === null ? null : string(p.supervisor_binding_id, '主管绑定 ID');
+            return { action: 'territory.supervisor', parameters: { territory_id: string(p.territory_id, '领地 ID'), supervisor_binding_id: supervisorBindingId } };
         }
         case 'role.bind': {
-            const p = object(outer.parameters, ['role_type', 'role_name', 'session_id'], ['role_type', 'role_name']);
+            const p = object(outer.parameters, ['role_type', 'role_name', 'session_id', 'territory_id'], ['role_type', 'role_name']);
             if (!MANAGED_ROLES.includes(p.role_type))
                 fail('INVALID_ROLE', '仅支持宰相、主管和执行者。');
             const session = p.session_id === undefined || p.session_id === null ? null : string(p.session_id, 'Session ID');
@@ -99,7 +135,15 @@ function normalizeInput(raw) {
                 fail('WORKER_SESSION_UNSUPPORTED', '执行者 Session 由正常 governed 执行路径建立。');
             if (p.role_type !== 'WORKER' && session === null)
                 fail('TARGET_SESSION_REQUIRED', '主管和宰相必须选择已有真实 Session。');
-            return { action: 'role.bind', parameters: { role_type: p.role_type, role_name: string(p.role_name, '角色名称', 120), session_id: session } };
+            // v3.2.0（Owner 2026-09-28 口径）：领地与主管完全绑定——任命主管必须同时选领地。
+            // 非主管角色不隶属领地，携带 territory_id 一律拒绝（不静默忽略）。
+            const territoryId = p.territory_id === undefined || p.territory_id === null ? null : string(p.territory_id, '领地 ID');
+            if (p.role_type === 'SUPERVISOR' && territoryId === null)
+                fail('TERRITORY_REQUIRED', '任命主管必须同时选择它要主理的领地；主管不能没有领地。');
+            if (p.role_type !== 'SUPERVISOR' && territoryId !== null)
+                fail('TERRITORY_UNSUPPORTED', '只有主管在任命时指定领地；其它角色不隶属领地。');
+            return { action: 'role.bind', parameters: { role_type: p.role_type, role_name: string(p.role_name, '角色名称', 120), session_id: session,
+                    ...(territoryId === null ? {} : { territory_id: territoryId }) } };
         }
         case 'role.session': {
             const p = object(outer.parameters, ['binding_id', 'session_id']);
@@ -129,6 +173,39 @@ function normalizeInput(raw) {
             }
             return { action: 'execution-profile', parameters: { binding_id: string(p.binding_id, '绑定 ID'), profile } };
         }
+        case 'delivery.item.ack': {
+            const p = object(outer.parameters, ['task_id', 'delivery_id', 'item_id', 'content_hash', 'attempt_no', 'result_id']);
+            const attemptNo = p.attempt_no;
+            if (!Number.isSafeInteger(attemptNo) || attemptNo < 1 || attemptNo > 1_000_000) {
+                fail('INVALID_INPUT', '交付尝试次数必须是正整数。');
+            }
+            const contentHash = string(p.content_hash, '条目内容版本', 128);
+            if (!/^[0-9a-f]{64}$/u.test(contentHash))
+                fail('INVALID_INPUT', '条目内容版本必须是小写十六进制摘要。');
+            return { action: 'delivery.item.ack', parameters: {
+                    task_id: string(p.task_id, '任务 ID'), delivery_id: string(p.delivery_id, '交付 ID'),
+                    item_id: string(p.item_id, '条目 ID'), content_hash: contentHash,
+                    attempt_no: attemptNo, result_id: string(p.result_id, '结果 ID')
+                } };
+        }
+        case 'delivery.item.question': {
+            const p = object(outer.parameters, ['task_id', 'delivery_id', 'item_id', 'content_hash', 'attempt_no', 'result_id', 'question_text']);
+            const attemptNo = p.attempt_no;
+            if (!Number.isSafeInteger(attemptNo) || attemptNo < 1 || attemptNo > 1_000_000) {
+                fail('INVALID_INPUT', '交付尝试次数必须是正整数。');
+            }
+            const contentHash = string(p.content_hash, '条目内容版本', 128);
+            if (!/^[0-9a-f]{64}$/u.test(contentHash))
+                fail('INVALID_INPUT', '条目内容版本必须是小写十六进制摘要。');
+            // 与知悉同款的「非空、长度受限」文本校验；正文随后在 Core 里统一脱敏并限长，
+            // 因此事实里永远不保存未脱敏正文。
+            const questionText = string(p.question_text, '问题内容', DELIVERY_QUESTION_TEXT_LIMIT);
+            return { action: 'delivery.item.question', parameters: {
+                    task_id: string(p.task_id, '任务 ID'), delivery_id: string(p.delivery_id, '交付 ID'),
+                    item_id: string(p.item_id, '条目 ID'), content_hash: contentHash,
+                    attempt_no: attemptNo, result_id: string(p.result_id, '结果 ID'), question_text: questionText
+                } };
+        }
         default: return fail('INVALID_ACTION', '不支持该管理动作。');
     }
 }
@@ -222,7 +299,11 @@ export class OwnerDecisionController {
         const kingdomId = record.view.kingdomId;
         const bindings = kingdomId ? this.store.listBindings(kingdomId).filter(b => b.status === 'ACTIVE'
             && s.bindingIds.includes(b.binding_id) && s.roleTypes.includes(b.role_type)) : [];
-        return { territories: kingdomId ? this.store.listTerritories(kingdomId).filter(t => s.territoryIds.includes(t.territory_id))
+        // 目录与提交必须逐 action 同判据：只有**显式在授权范围内**的领地才列出。
+        // 不用 kingdomWide 放宽目录——否则会出现"清单里选得到、提交必被拒"
+        // （territory.update/delete/supervisor 的共享 territory() 只认 scope.territoryIds）。
+        return { territories: kingdomId ? this.store.listTerritories(kingdomId)
+                .filter(t => t.status !== 'DELETED' && s.territoryIds.includes(t.territory_id))
                 .map(t => ({ id: t.territory_id, name: t.name })) : [],
             bindings: bindings.map(b => ({ id: b.binding_id, roleType: b.role_type, roleName: b.role_name })),
             runtimeSessions: [...new Map(sessions.filter(item => s.targetSessionIds.includes(item.id))
@@ -230,27 +311,294 @@ export class OwnerDecisionController {
             workspaceRoots: [...s.workspaceRoots],
             plans: kingdomId && record.view.actions.includes('plan.adopt') ? listCollaborationPlans(this.store, kingdomId).filter(plan => {
                 try {
-                    this.context(record, { action: 'plan.adopt', parameters: { plan_id: plan.planId, version: plan.version, digest: plan.digest } });
+                    this.context(record, { action: 'plan.adopt', parameters: { plan_id: plan.planId, version: plan.version, digest: plan.digest } }, randomUUID());
                     return true;
                 }
                 catch {
                     return false;
                 }
-            }) : [] };
+            }) : [],
+            deliveryItems: kingdomId && (record.view.actions.includes('delivery.item.ack') || record.view.actions.includes('delivery.item.question'))
+                ? this.deliveryItems(record) : [],
+            deliveryQuestionHistory: kingdomId && record.view.actions.includes('delivery.item.question')
+                ? this.deliveryQuestionHistory(record) : [] };
+    }
+    /**
+     * 本次授权范围内的**已有提问记录**条目（只读历史入口）。
+     *
+     * 只读且不依赖有界交付目录：它按权威提问事实列出精确 task/item，再逐条用
+     * `deliveryScopeAllows` 过滤，因此不含跨领地条目；不在当前目录、当前无法重验的
+     * 旧问答也能在这里被发现。它不返回任何正文，也**不**进入新提问 prepare 的来源目录。
+     */
+    deliveryQuestionHistory(record) {
+        const kingdomId = record.view.kingdomId;
+        if (!kingdomId)
+            return [];
+        const choices = [];
+        for (const target of listDeliveryQuestionHistory(this.store, kingdomId)) {
+            const task = this.store.getTask(target.taskId);
+            if (!task)
+                continue;
+            const territory = this.store.getTerritoryById(task.territory_id);
+            if (!territory || territory.kingdom_id !== kingdomId || territory.status === 'DELETED')
+                continue;
+            if (!this.deliveryScopeAllows(record, territory))
+                continue;
+            choices.push({ taskId: target.taskId, taskTitle: redactDeliveryText(task.title), itemId: target.itemId,
+                itemLabel: target.itemLabel, lastAskedAt: target.lastAskedAt, questionCount: target.questionCount,
+                pendingCount: target.pendingCount, answeredCount: target.answeredCount, historyCount: target.historyCount,
+                unverifiableCount: target.unverifiableCount, latestItemVersion: target.latestItemVersion,
+                currentContentHash: target.currentContentHash });
+        }
+        return choices;
+    }
+    /**
+     * 交付知悉的授权范围判据。
+     *
+     * catalog 与 prepare/commit 必须共用同一判据：否则会出现「清单可见、
+     * 提交被拒」或「清单不可见、提交却可行」。`kingdomWide` 是 Owner 的最高
+     * 授权级别；其余情况要求任务所在领地在 `territoryIds` 内，或该领地由
+     * 授权 `bindingIds` 中的主管主理且本次授权声明了 SUPERVISOR 角色。
+     */
+    deliveryScopeAllows(record, territory) {
+        const scope = record.view.scope;
+        if (scope.kingdomWide)
+            return true;
+        if (!scope.territoryIds.length && !scope.bindingIds.length && !scope.roleTypes.length)
+            return false;
+        if (scope.territoryIds.includes(territory.territory_id))
+            return true;
+        return scope.roleTypes.includes('SUPERVISOR')
+            && !!territory.supervisor_binding_id
+            && scope.bindingIds.includes(territory.supervisor_binding_id);
+    }
+    /**
+     * 本次授权范围内的已确认交付条目。只有同一 Task/attempt 主管 ACCEPT 的交付才出现，
+     * Worker Claim 永远不会进入该清单。
+     */
+    deliveryItems(record) {
+        const kingdomId = record.view.kingdomId;
+        if (!kingdomId)
+            return [];
+        const ownerId = record.view.ownerId ?? '';
+        const items = [];
+        /**
+         * 与工作台「最近交付」对齐：按交付最近更新/被接受的时间排序。
+         *
+         * 主管 ACCEPT 会经 `transitionTask` 更新 `tasks.updated_at`，因此「旧建但最近
+         * 接受的交付」会排到工作台顶部；若这里仍按 `created_at` 截断，那条交付就会
+         * 在工作台可见、却在 Owner 目录之外，既无法知悉也无法看差异。只改排序键，
+         * 不新增第二套任务索引，也不改变条目上限语义。
+         */
+        const tasks = [...this.store.listTasks(kingdomId)].sort((a, b) => b.updated_at.localeCompare(a.updated_at) || b.task_id.localeCompare(a.task_id));
+        for (const task of tasks) {
+            if (items.length >= 200)
+                break;
+            if (task.status !== 'DONE')
+                continue;
+            const territory = this.store.getTerritoryById(task.territory_id);
+            if (!territory || territory.kingdom_id !== kingdomId || territory.status === 'DELETED')
+                continue;
+            if (!this.deliveryScopeAllows(record, territory))
+                continue;
+            const claim = this.store.latestWorkerResult(task.task_id);
+            if (!claim)
+                continue;
+            const review = readLatestReviewEvent(this.store, kingdomId, task.task_id);
+            const classification = classifyAcceptedDelivery(this.store, claim, review);
+            if (!classification)
+                continue;
+            const deliveryId = deliveryIdFor(task.task_id);
+            const acknowledgements = readDeliveryAcknowledgements(this.store, kingdomId, deliveryId);
+            const questions = readDeliveryQuestionThread(this.store, kingdomId, deliveryId);
+            for (const item of deriveDeliveryItems(task.task_id, claim, this.changeEvidenceFor(kingdomId, task.task_id))) {
+                const view = deliveryAcknowledgementView(acknowledgements, item, ownerId);
+                const thread = deliveryQuestionThreadForItem(questions, item.itemId, item.contentHash);
+                items.push({
+                    taskId: task.task_id,
+                    taskTitle: redactDeliveryText(task.title),
+                    deliveryId,
+                    attemptNo: claim.attempt_no,
+                    resultId: claim.result_id,
+                    itemId: item.itemId,
+                    contentHash: item.contentHash,
+                    layer: item.content.layer,
+                    label: item.content.label,
+                    detail: item.content.detail,
+                    changeKind: item.content.change.kind,
+                    changeNote: item.content.change.note,
+                    acknowledgementState: view.state,
+                    acknowledgedAt: view.acknowledgedAt,
+                    acceptanceEvidenceKind: classification.kind,
+                    acceptanceEvidenceExact: classification.evidence.exactResultBound,
+                    acceptanceEvidenceNote: classification.legacyNote,
+                    questions: thread ? ownerDeliveryItemQuestions(thread) : null,
+                });
+            }
+        }
+        return items;
+    }
+    /**
+     * 只读返回一条已确认交付条目的完整问答线程。
+     *
+     * 有效性要求与 `readDeliveryChange` 同款：窗口 ACTIVE、本次授权包含
+     * `delivery.item.question`、任务在授权范围内、该 task 确实存在写给它的问题记录。
+     * 版本关系按该精确 task/item **独立重验**（不受有界展示目录截断影响）：命中当前
+     * 派生版本即已验证当前版，命中的是旧版本即历史版；条目已无法从当前 ACCEPT/证据
+     * 重验（例如 CHANGE 证据丢失）时仍可按精确 itemId 读回，但整条标为无法重验，
+     * 不冒充当前版、也不可回复。任一不成立都失败，且不写任何事实、不自动知悉。
+     */
+    readDeliveryQuestions(handle, input) {
+        const record = this.active(handle);
+        const kingdomId = record.view.kingdomId;
+        if (!kingdomId)
+            fail('DELIVERY_NOT_CONFIRMED', '当前窗口没有可读取交付的王国。');
+        if (!record.view.actions.includes('delivery.item.question')) {
+            fail('ACTION_NOT_AUTHORIZED', '本次管理窗口未授权交付条目提问动作，不能读取问答正文。');
+        }
+        const task = this.store.getTask(string(input.taskId, '任务 ID'));
+        if (!task)
+            fail('SCOPE_DENIED', '任务不存在或不属于当前王国。');
+        const territory = this.store.getTerritoryById(task.territory_id);
+        if (!territory || territory.kingdom_id !== kingdomId || territory.status === 'DELETED')
+            fail('SCOPE_DENIED', '任务不属于当前王国。');
+        if (!this.deliveryScopeAllows(record, territory))
+            fail('SCOPE_DENIED', '该交付不在本次授权范围内。');
+        const itemId = string(input.itemId, '条目 ID');
+        // 版本真值必须逐 Task/条目精确重验，**不能**取自有界展示目录：展示目录会截断
+        // 较旧条目，若用它判断，真实仍是当前版的问题会被误标为无法重验。
+        const currentItem = readDeliveryItemVersion(this.store, kingdomId, task.task_id, itemId);
+        const thread = deliveryQuestionThreadForItem(readDeliveryQuestionThread(this.store, kingdomId, deliveryIdFor(task.task_id)), itemId, currentItem ? currentItem.contentHash : null);
+        // 条目无法重验、也没有任何提问记录时仍是「未知条目」，不能被读成一条空线程。
+        if (!thread && !currentItem)
+            fail('DELIVERY_ITEM_UNKNOWN', '该条目已无法从当前交付重验，也没有可读取的问答记录。');
+        if (!thread)
+            fail('DELIVERY_QUESTION_UNKNOWN', '该条目当前版本还没有提问记录。');
+        const review = readLatestReviewEvent(this.store, kingdomId, task.task_id);
+        const reviewerBindingId = deliveryReviewerBindingId(review);
+        return {
+            deliveryId: thread.deliveryId,
+            taskId: task.task_id,
+            taskTitle: redactDeliveryText(task.title),
+            itemId: thread.itemId,
+            itemLabel: currentItem ? currentItem.label : thread.itemLabel,
+            contentHash: currentItem ? currentItem.contentHash : null,
+            questions: thread.questions.map(question => ({
+                questionId: question.questionId,
+                questionText: question.questionText,
+                askedAt: question.askedAt,
+                ownerId: question.ownerId,
+                reviewerBindingId: question.reviewerBindingId,
+                replyState: question.replyState,
+                replyStateNote: classifyReplyStateNote(question.replyState),
+                itemVersion: question.itemVersion,
+                currentItemContentHash: question.currentItemContentHash,
+                reply: question.reply ? { replyText: question.reply.replyText, repliedAt: question.reply.repliedAt,
+                    responderBindingId: question.reply.responderBindingId } : null,
+            })),
+            answeredCount: thread.answeredCount,
+            pendingCount: thread.pendingCount,
+            historyCount: thread.historyCount,
+            unverifiableCount: thread.unverifiableCount,
+            note: reviewerBindingId ? DELIVERY_QUESTION_NOTE
+                : `${DELIVERY_QUESTION_NOTE} 另：该交付的接受事件没有记录主管绑定，无法确定接收者。`,
+        };
+    }
+    /**
+     * 已由主管在 ACCEPT 中显式选择、且本地 hash 重验通过的改动证据。
+     * 缺失、漂移或未确认时返回 null：调用方显示「不可定位」，不退回执行者自述。
+     */
+    changeEvidenceFor(kingdomId, taskId) {
+        const review = readLatestReviewEvent(this.store, kingdomId, taskId);
+        const ref = readAcceptedChangeEvidence(review);
+        return ref ? resolveChangeEvidenceForDelivery(undefined, ref) : null;
+    }
+    acceptedChangeRef(kingdomId, taskId) {
+        return readAcceptedChangeEvidence(readLatestReviewEvent(this.store, kingdomId, taskId));
+    }
+    /**
+     * 只读返回一条已确认改动条目的有界详情。
+     *
+     * 有效性要求：窗口 ACTIVE、**本次授权动作包含 `delivery.item.ack`**、任务在本次
+     * 授权范围内、该 task 确实存在一条主管 ACCEPT 绑定的改动证据、evidence id 与
+     * entry id 精确匹配、该条目仍需出现在当前有效交付目录中，且本地 hash 重验通过。
+     * 任一不成立都失败，且不写任何事实、不产生知悉。
+     *
+     * 只检查 ACTIVE + Territory scope 是不够的：同一领地的另一个管理窗口若没有该
+     * 动作授权，就不能凭 id 读取差异正文。这里与 `catalog` 使用同一动作判据，
+     * 不默认放行（也不新增只读动作）。
+     */
+    readDeliveryChange(handle, input) {
+        const record = this.active(handle);
+        const kingdomId = record.view.kingdomId;
+        if (!kingdomId)
+            fail('DELIVERY_NOT_CONFIRMED', '当前窗口没有可读取交付的王国。');
+        if (!record.view.actions.includes('delivery.item.ack')) {
+            fail('ACTION_NOT_AUTHORIZED', '本次管理窗口未授权交付条目知悉动作，不能读取改动证据正文。');
+        }
+        const task = this.store.getTask(string(input.taskId, '任务 ID'));
+        if (!task)
+            fail('SCOPE_DENIED', '任务不存在或不属于当前王国。');
+        const territory = this.store.getTerritoryById(task.territory_id);
+        if (!territory || territory.kingdom_id !== kingdomId || territory.status === 'DELETED')
+            fail('SCOPE_DENIED', '任务不属于当前王国。');
+        if (!this.deliveryScopeAllows(record, territory))
+            fail('SCOPE_DENIED', '该交付不在本次授权范围内。');
+        const ref = this.acceptedChangeRef(kingdomId, task.task_id);
+        const evidenceId = string(input.evidenceId, '证据 ID', 128);
+        const entryId = string(input.entryId, '改动条目 ID', 128);
+        if (!ref || ref.evidenceId !== evidenceId || !ref.entryIds.includes(entryId)) {
+            fail('CHANGE_EVIDENCE_UNVERIFIED', '该改动引用不是本 Task 已由主管确认的证据，拒绝读取。');
+        }
+        // 必须仍属于当前有效交付目录：历史 ACCEPT 引用、已漂移证据或已不存在的条目
+        // 都不能单独开放正文。
+        const currentItem = this.deliveryItems(record).find(item => item.taskId === task.task_id
+            && item.changeKind === 'REPO_RELATIVE_VERIFIED'
+            && deliveryChangeItemId(item.deliveryId, entryId) === item.itemId);
+        if (!currentItem) {
+            fail('CHANGE_EVIDENCE_UNVERIFIED', '该改动条目不在当前有效交付目录内，拒绝读取。');
+        }
+        const opened = readChangeEntry(undefined, ref, entryId);
+        if (!opened.ok)
+            fail('CHANGE_EVIDENCE_UNVERIFIED', opened.reason);
+        const entry = opened.entry;
+        return {
+            kind: 'SUPERVISOR_CONFIRMED_BOUNDED_WINDOW',
+            label: CHANGE_EVIDENCE_LABEL,
+            evidenceId: ref.evidenceId,
+            entryId: entry.entryId,
+            taskId: task.task_id,
+            taskTitle: redactDeliveryText(task.title),
+            attemptNo: ref.attemptNo,
+            status: entry.status,
+            repoPath: entry.repoPath,
+            revision: `evidence:${ref.evidenceId}`,
+            repoVcs: opened.manifest.repo.vcs,
+            repoHead: opened.manifest.repo.head,
+            coverageComplete: opened.manifest.coverage.complete,
+            coverageReasons: opened.manifest.coverage.reasons.slice(0, 16),
+            labels: entry.labels.slice(0, 16),
+            note: entry.note,
+            hunks: entry.hunks.slice(0, 200).map(hunk => ({ kind: hunk.kind, beforeLine: hunk.beforeLine, afterLine: hunk.afterLine, text: hunk.text })),
+        };
     }
     async prepare(handle, raw, options = {}) {
         const record = this.active(handle);
         if (record.preparations.size >= 128)
             fail('PREPARATION_LIMIT', '当前窗口准备次数已达上限，请重新激活。');
         const input = normalizeInput(raw);
-        const context = this.context(record, input);
+        // 操作编号必须在预览与提交之间保持同一个：提问事实的身份以一次 Owner operation
+        // 为界（同一编号重放幂等、不同编号即使文本相同也是两条独立事实），因此它先于
+        // 预览计算生成，并同时用于指纹上下文与最终预览。
+        const operationId = randomUUID();
+        const context = this.context(record, input, operationId);
         await this.validate(record, input, options.signal);
         this.active(handle);
-        const checked = this.context(record, input);
+        const checked = this.context(record, input, operationId);
         if (checked.fingerprint !== context.fingerprint)
             fail('PREVIEW_STALE', '校验期间相关事实已改变，请重新预览。');
         const createdAt = new Date(this.now()).toISOString();
-        const preview = { prepareId: randomUUID(), operationId: randomUUID(), decisionId: record.view.decisionId,
+        const preview = { prepareId: randomUUID(), operationId, decisionId: record.view.decisionId,
             action: input.action, summary: checked.summary, changes: this.changes(input, checked),
             affected: { territoryIds: checked.territoryIds, bindingIds: checked.bindingIds }, createdAt, expiresAt: record.view.expiresAt };
         record.preparations.set(preview.prepareId, { input: clone(input), inputHash: ownerInputHash(input), fingerprint: checked.fingerprint, preview });
@@ -416,7 +764,7 @@ export class OwnerDecisionController {
         if (!result || result.ok !== true)
             fail(result?.ok === false ? result.code : 'VALIDATION_UNAVAILABLE', result?.ok === false ? result.message : '运行环境未提供有效校验结果。');
     }
-    context(record, input) {
+    context(record, input, operationId) {
         this.assertActive(record);
         if (!record.view.actions.includes(input.action))
             fail('SCOPE_DENIED', '该动作未获本次授权。');
@@ -474,6 +822,113 @@ export class OwnerDecisionController {
             facts.push(related.map(t => t.territory_id).sort());
         };
         switch (input.action) {
+            case 'delivery.item.ack': {
+                const p = input.parameters;
+                const task = this.store.getTask(p.task_id);
+                if (!task)
+                    fail('SCOPE_DENIED', '任务不存在或不属于当前王国。');
+                const taskTerritory = this.store.getTerritoryById(task.territory_id);
+                if (!taskTerritory || taskTerritory.kingdom_id !== kingdomId || taskTerritory.status === 'DELETED') {
+                    fail('SCOPE_DENIED', '任务不属于当前王国。');
+                }
+                // 与 catalog 共用同一范围判据；知悉不改配置或责任，因此这里只登记领地事实，
+                // 不要求领地直接列在 territoryIds 中，也不参与 guardUnsettled。
+                if (!this.deliveryScopeAllows(record, taskTerritory))
+                    fail('SCOPE_DENIED', '该交付不在本次授权范围内。');
+                territories.add(task.territory_id);
+                facts.push(taskTerritory);
+                const claim = this.store.latestWorkerResult(p.task_id);
+                const review = readLatestReviewEvent(this.store, kingdomId, p.task_id);
+                const classification = classifyAcceptedDelivery(this.store, claim, review);
+                if (!claim || !classification) {
+                    fail('DELIVERY_NOT_CONFIRMED', '该交付尚未由同一 Task/attempt 的主管 ACCEPT 确认，不能记录知悉。');
+                }
+                if (claim.attempt_no !== p.attempt_no || claim.result_id !== p.result_id) {
+                    fail('DELIVERY_VERSION_STALE', '交付的已接受版本已变化，请重新打开清单。');
+                }
+                // 接受证据强度进入 fingerprint：确认依据从强证据降为历史弱证据（或反之）时，
+                // 预览必须失效，Owner 不能在不知情的情况下按旧预览提交。
+                facts.push(claim, review, classification.kind, classification.evidence);
+                const deliveryId = deliveryIdFor(p.task_id);
+                if (deliveryId !== p.delivery_id)
+                    fail('DELIVERY_VERSION_STALE', '交付标识与当前已接受版本不一致。');
+                const derived = deriveDeliveryItems(p.task_id, claim, this.changeEvidenceFor(kingdomId, p.task_id));
+                const item = derived.find(candidate => candidate.itemId === p.item_id);
+                if (!item)
+                    fail('DELIVERY_ITEM_UNKNOWN', '该条目不在当前交付清单中。');
+                if (item.contentHash !== p.content_hash) {
+                    fail('DELIVERY_ITEM_VERSION_STALE', '该条目内容版本已变化，请重新打开清单后再知悉。');
+                }
+                facts.push(item.contentHash);
+                const ownerId = this.store.getDefaultKingdom()?.owner_id ?? '';
+                const acknowledgements = readDeliveryAcknowledgements(this.store, kingdomId, deliveryId);
+                const view = deliveryAcknowledgementView(acknowledgements, item, ownerId);
+                if (view.acknowledged)
+                    fail('DELIVERY_ITEM_ALREADY_ACKNOWLEDGED', '该条目当前版本已由 Owner 知悉；重复知悉不会新增记录。');
+                facts.push(acknowledgements);
+                before = view.acknowledgedAt;
+                after = JSON.stringify({ deliveryId, itemId: item.itemId, contentHash: item.contentHash, attemptNo: claim.attempt_no,
+                    acceptanceEvidenceKind: classification.kind, acceptanceEvidenceExact: classification.evidence.exactResultBound });
+                summary = `记下已知悉「${item.content.label}」当前版本（不代表理解、质量认可、Task 完成或发布授权）`;
+                break;
+            }
+            case 'delivery.item.question': {
+                const p = input.parameters;
+                const task = this.store.getTask(p.task_id);
+                if (!task)
+                    fail('SCOPE_DENIED', '任务不存在或不属于当前王国。');
+                const taskTerritory = this.store.getTerritoryById(task.territory_id);
+                if (!taskTerritory || taskTerritory.kingdom_id !== kingdomId || taskTerritory.status === 'DELETED') {
+                    fail('SCOPE_DENIED', '任务不属于当前王国。');
+                }
+                if (!this.deliveryScopeAllows(record, taskTerritory))
+                    fail('SCOPE_DENIED', '该交付不在本次授权范围内。');
+                territories.add(task.territory_id);
+                facts.push(taskTerritory);
+                const claim = this.store.latestWorkerResult(p.task_id);
+                const review = readLatestReviewEvent(this.store, kingdomId, p.task_id);
+                const classification = classifyAcceptedDelivery(this.store, claim, review);
+                if (!claim || !classification) {
+                    fail('DELIVERY_NOT_CONFIRMED', '该交付尚未由同一 Task/attempt 的主管 ACCEPT 确认，不能提问。');
+                }
+                if (claim.attempt_no !== p.attempt_no || claim.result_id !== p.result_id) {
+                    fail('DELIVERY_VERSION_STALE', '交付的已接受版本已变化，请重新打开清单。');
+                }
+                facts.push(claim, review, classification.kind, classification.evidence);
+                const deliveryId = deliveryIdFor(p.task_id);
+                if (deliveryId !== p.delivery_id)
+                    fail('DELIVERY_VERSION_STALE', '交付标识与当前已接受版本不一致。');
+                // 接收者在写入前就固定：接受事件没有可核对的主管绑定时直接拒绝，而不是先写问题再猜接收者。
+                const reviewerBindingId = deliveryReviewerBindingId(review);
+                if (!reviewerBindingId) {
+                    fail('DELIVERY_ACCEPT_REVIEWER_UNKNOWN', '接受事件没有记录主管绑定，无法确定本问题的接收者。');
+                }
+                facts.push(reviewerBindingId);
+                const derived = deriveDeliveryItems(p.task_id, claim, this.changeEvidenceFor(kingdomId, p.task_id));
+                const item = derived.find(candidate => candidate.itemId === p.item_id);
+                if (!item)
+                    fail('DELIVERY_ITEM_UNKNOWN', '该条目不在当前交付清单中。');
+                if (item.contentHash !== p.content_hash) {
+                    fail('DELIVERY_ITEM_VERSION_STALE', '该条目内容版本已变化，请重新打开清单后再提问。');
+                }
+                facts.push(item.contentHash);
+                const questionText = boundedQuestionText(p.question_text, DELIVERY_QUESTION_TEXT_LIMIT);
+                if (!questionText)
+                    fail('INVALID_INPUT', '问题内容必须是非空、长度受限的文本。');
+                // 幂等只以**本次 Owner operation** 为界：同一 operationId 重放命中同一事件 ID，
+                // 才会被判为「不会新增第二条事实」；不同 operation 即使条目与文本都相同，也各自
+                // 形成独立问题。绝不按正文去重，否则新操作的提问会被历史同文问题吞掉。
+                const operationEventId = deliveryQuestionEventId({ kingdomId: kingdomId, deliveryId, itemId: item.itemId,
+                    contentHash: item.contentHash, operationId });
+                const duplicate = this.store.getEventById(operationEventId) !== null;
+                const thread = deliveryQuestionThreadForItem(readDeliveryQuestionThread(this.store, kingdomId, deliveryId), item.itemId, item.contentHash);
+                facts.push(thread?.questions.map(question => [question.questionId, question.reply?.eventId ?? null]).sort() ?? null);
+                before = thread ? `${thread.questions.length} 条提问（${thread.pendingCount} 待回复 / ${thread.answeredCount} 已回复）` : null;
+                after = JSON.stringify({ deliveryId, itemId: item.itemId, contentHash: item.contentHash, attemptNo: claim.attempt_no,
+                    reviewerBindingId, questionText, duplicate });
+                summary = `就「${item.content.label}」当前版本向接受该交付的主管提一个具体问题（记录为一条对话事实，不是知悉，也不改变任务状态）`;
+                break;
+            }
             case 'plan.adopt': {
                 const p = input.parameters, plan = readCollaborationPlan(this.store, kingdomId, p.plan_id);
                 if (!plan || plan.version !== p.version || plan.digest !== p.digest || plan.state !== 'PROPOSED')
@@ -536,7 +991,25 @@ export class OwnerDecisionController {
                 break;
             }
             case 'territory.supervisor': {
-                const p = input.parameters, row = territory(p.territory_id), supervisor = binding(p.supervisor_binding_id);
+                const p = input.parameters, row = territory(p.territory_id);
+                if (p.supervisor_binding_id === null) {
+                    // v3.2.0：解除现任主理。1:1 之下"把主理换到别处"必须先走这一步。
+                    // 旧责任关系仍作为相关事实登记：它的 session 参与未结算工作守卫（不允许在在途工作时解除责任）。
+                    if (row.supervisor_binding_id) {
+                        const previous = this.store.getBindingById(row.supervisor_binding_id);
+                        if (previous && previous.kingdom_id !== kingdomId)
+                            fail('RELATED_BINDING_UNAVAILABLE', '旧主管引用不属于当前王国，无法安全修改责任。');
+                        facts.push({ previousSupervisor: previous, previousSupervisorId: row.supervisor_binding_id });
+                        bindings.add(row.supervisor_binding_id);
+                        if (previous?.session_id)
+                            sessions.add(previous.session_id);
+                    }
+                    before = row.supervisor_binding_id;
+                    after = null;
+                    summary = '解除领地现任主理（该领地随即 fail-closed，直到指派新的）';
+                    break;
+                }
+                const supervisor = binding(p.supervisor_binding_id);
                 if (supervisor.role_type !== 'SUPERVISOR')
                     fail('INVALID_ROLE', '目标必须是活跃主管。');
                 if (row.supervisor_binding_id) {
@@ -550,6 +1023,22 @@ export class OwnerDecisionController {
                     bindings.add(row.supervisor_binding_id);
                     if (previous?.session_id)
                         sessions.add(previous.session_id);
+                    // v3.2.0（Owner D2）：在任主理不静默替换——先解除再指派。判据与 core 的
+                    // applyTerritorySupervisor 完全对齐：只有"当前指针仍指向**在任 ACTIVE** 席位"才算冲突；
+                    // 指向已退任席位的悬挂引用可直接改派（修复），不再出现 GUI 比 direct Slash 更严的分叉。
+                    if (previous && previous.status === 'ACTIVE' && previous.binding_id !== supervisor.binding_id) {
+                        fail('TERRITORY_ALREADY_SUPERVISED', `领地「${row.name}」已有在任主理（${previous.role_name}）；请先解除现有主理，再指派新的。`);
+                    }
+                }
+                // v3.2.0（Owner 1:1 裁定）：一个主管席位只主理一个领地。与 core 同判据（排除本次目标领地、
+                // 排除 DELETED 领地），在预览阶段就给出准确原因，而不是等到提交才回滚。
+                const otherTerritory = this.store.listTerritories(kingdomId)
+                    .find(item => item.status !== 'DELETED' && item.territory_id !== row.territory_id
+                    && item.supervisor_binding_id === supervisor.binding_id) ?? null;
+                if (otherTerritory) {
+                    facts.push(otherTerritory);
+                    territories.add(otherTerritory.territory_id);
+                    fail('SUPERVISOR_ALREADY_ATTACHED', `主管 ${supervisor.role_name} 已隶属领地「${otherTerritory.name}」；一个主管席位只能主理一个领地，请先解除原领地的主理。`);
                 }
                 before = row.supervisor_binding_id;
                 after = supervisor.binding_id;
@@ -566,10 +1055,39 @@ export class OwnerDecisionController {
                     if (existing)
                         fail('ROLE_ALREADY_BOUND', '宰相席位已有活跃绑定。');
                 }
+                if (p.role_type === 'SUPERVISOR') {
+                    // v3.2.0：主管必须同时落到一个领地上；预览阶段就证明「领地在授权范围内」且「当前无其他主理」，
+                    // 不让人类在提交后才发现冲突。
+                    if (!p.territory_id)
+                        fail('TERRITORY_REQUIRED', '任命主管必须指定领地。');
+                    // 与共享 territory() 助手、以及 catalog.territories 同一判据：领地必须显式在本次授权范围内。
+                    // 这里刻意**不**用 kingdomWide 放宽——否则目录可见性与提交判定会分叉（3.2.0 审计 r1 的 DV5 缺陷）。
+                    if (!scope.territoryIds.includes(p.territory_id))
+                        fail('SCOPE_DENIED', '领地不在授权范围内或不可用。');
+                    const row = this.store.getTerritoryById(p.territory_id);
+                    if (!row || row.kingdom_id !== kingdomId || row.status === 'DELETED')
+                        fail('SCOPE_DENIED', '领地不在授权范围内或不可用。');
+                    territories.add(row.territory_id);
+                    facts.push(row);
+                    if (row.supervisor_binding_id) {
+                        const current = this.store.getBindingById(row.supervisor_binding_id);
+                        facts.push({ previousSupervisor: current, previousSupervisorId: row.supervisor_binding_id });
+                        if (current?.session_id)
+                            sessions.add(current.session_id);
+                        // 与 core 的 applyTerritorySupervisor 同判据：只有在任 ACTIVE 主理才算冲突，
+                        // 指向已退任席位的悬挂引用属于修复（可直接改派），两条入口结论必须一致。
+                        if (current && current.status === 'ACTIVE') {
+                            fail('TERRITORY_ALREADY_SUPERVISED', `领地「${row.name}」已有在任主理（${current.role_name}）；请先解除现有主理（territory.supervisor 传 null），再指派新的。`);
+                        }
+                    }
+                    after = JSON.stringify({ roleType: p.role_type, territoryId: row.territory_id, territoryName: row.name });
+                }
+                else {
+                    after = JSON.stringify(p);
+                }
                 if (p.session_id)
                     targetSession(p.session_id, null);
-                after = JSON.stringify(p);
-                summary = '任命角色';
+                summary = p.role_type === 'SUPERVISOR' ? '任命主管并同时指定其领地（席位与主理同一事务原子写入）' : '任命角色';
                 break;
             }
             case 'role.session': {
@@ -604,11 +1122,16 @@ export class OwnerDecisionController {
         }
         const context = { territoryIds: [...territories].sort(), bindingIds: [...bindings].sort(), sessionIds: [...sessions].sort(),
             fingerprint: ownerInputHash(facts), before, after, summary };
-        if (kingdomId && input.action !== 'territory.update' && input.action !== 'territory.create' && input.action !== 'budget.policy' && input.action !== 'plan.adopt')
+        // `delivery.item.ack` 只追加 Owner 知悉事实，不改配置与责任，因此不受
+        // 同领地不相关未结算执行/Lease/Dispatch 阻断。
+        if (kingdomId && input.action !== 'territory.update' && input.action !== 'territory.create' && input.action !== 'budget.policy' && input.action !== 'plan.adopt' && input.action !== 'delivery.item.ack' && input.action !== 'delivery.item.question')
             this.guardUnsettled(kingdomId, input.action === 'ceiling', context);
         return context;
     }
     guardUnsettled(kingdomId, all, context) {
+        // 3.2.0 审计 r1 更正：本守卫只覆盖 **Owner 管理窗口** 这条路径。
+        // direct Slash / core 的 role.bind 与 territory.supervisor 没有等价守卫（3.1.0 既有语义），
+        // 因此文档不得声称"旧主管的未结算执行一定会拦截改派"。
         const affected = (territoryId, bindingId, sessionId) => all
             || !!territoryId && context.territoryIds.includes(territoryId)
             || !!bindingId && context.bindingIds.includes(bindingId)
@@ -669,10 +1192,20 @@ export class OwnerDecisionController {
             }
             case 'territory.supervisor': {
                 const describe = (id) => id ? `${this.store.getBindingById(id)?.role_name ?? '主管'}（${id}）` : null;
-                return [change('主理主管', describe(context.before), describe(context.after))];
+                return [change('主理主管', describe(context.before), describe(context.after)),
+                    ...(input.parameters.supervisor_binding_id === null
+                        ? [change('解除后', null, '该领地无主理：任何 Supervisor 都不能治理该领地（fail-closed），直到指派新的。')]
+                        : [])];
+            }
+            case 'role.bind': {
+                const after = context.after ? JSON.parse(context.after) : null;
+                const scope = input.parameters.role_type === 'SUPERVISOR'
+                    ? [change('主理领地', null, after?.territoryName && after.territoryId ? `${after.territoryName}（${after.territoryId}）` : null),
+                        change('写入方式', null, '主管席位与领地主理在同一事务内原子写入；任一步不合法则整体回滚，不会留下没有领地的主管。')]
+                    : [];
+                return [change('角色身份', null, { CHANCELLOR: '宰相', SUPERVISOR: '主管', WORKER: '执行者' }[input.parameters.role_type]),
+                    change('角色名称', null, input.parameters.role_name), change('目标 Session', null, input.parameters.session_id), ...scope];
             }
-            case 'role.bind': return [change('角色身份', null, { CHANCELLOR: '宰相', SUPERVISOR: '主管', WORKER: '执行者' }[input.parameters.role_type]),
-                change('角色名称', null, input.parameters.role_name), change('目标 Session', null, input.parameters.session_id)];
             case 'role.session': return [change('角色 Session', context.before, context.after)];
             case 'ceiling': {
                 const before = context.before ? JSON.parse(context.before) : {};
@@ -688,11 +1221,51 @@ export class OwnerDecisionController {
                 const after = input.parameters.profile;
                 return [change('请求的 Provider', before?.provider, after?.provider), change('请求的模型', before?.model, after?.model)];
             }
+            case 'delivery.item.ack': {
+                const after = JSON.parse(context.after);
+                const task = this.store.getTask(input.parameters.task_id);
+                const item = deriveDeliveryItems(input.parameters.task_id, this.store.latestWorkerResult(input.parameters.task_id), this.changeEvidenceFor(this.store.getDefaultKingdom()?.kingdom_id ?? '', input.parameters.task_id))
+                    .find(candidate => candidate.itemId === after.itemId);
+                return [change('任务', null, task?.title),
+                    change('已接受尝试', null, String(after.attemptNo)),
+                    change('条目', null, item ? `${item.content.label}` : after.itemId),
+                    change('条目内容', null, item?.content.detail),
+                    change('内容版本', null, after.contentHash),
+                    change('改动定位', null, item ? `${item.content.change.kind}${item.content.change.evidenceLabel ? ` · ${item.content.change.evidenceLabel}` : ''} · ${item.content.change.note}` : null),
+                    change('接受证据强度', null, after.acceptanceEvidenceExact
+                        ? 'EXACT_RESULT_BOUND：TASK_ACCEPTED 锁定了本次结果 ID 与内容摘要，且两者都与当前呈报一致。'
+                        : '历史接受证据较弱（LEGACY_ATTEMPT_ONLY）：该 Task/attempt 的 TASK_ACCEPTED 是 v1.0.0 旧格式，只有尝试编号，缺少被审查结果 ID 与内容摘要；本条按真实事件字段与同 Task/attempt 的唯一 WorkerResult 判定，不是 exact result-bound 证据。知悉仍只表示已知悉该条当前版本，不代表理解、质量认可、人类验收、Task DONE 或发布授权。'),
+                    change('Owner 知悉时间（本窗口提交后）', null, '提交时记录'),
+                    change('不改动的状态', null, '任务状态、主管审查、正式 Owner acceptance 与发布状态均不变')];
+            }
+            case 'delivery.item.question': {
+                const after = JSON.parse(context.after);
+                const task = this.store.getTask(input.parameters.task_id);
+                const item = deriveDeliveryItems(input.parameters.task_id, this.store.latestWorkerResult(input.parameters.task_id), this.changeEvidenceFor(this.store.getDefaultKingdom()?.kingdom_id ?? '', input.parameters.task_id))
+                    .find(candidate => candidate.itemId === after.itemId);
+                const reviewer = this.store.getBindingById(after.reviewerBindingId);
+                const territory = this.store.getTerritoryById(task?.territory_id ?? '');
+                return [change('任务', null, task?.title),
+                    change('已接受尝试', null, String(after.attemptNo)),
+                    change('条目', null, item ? item.content.label : after.itemId),
+                    change('条目内容', null, item?.content.detail),
+                    change('内容版本', null, after.contentHash),
+                    change('接收者（接受该交付的主管）', null, reviewer ? `${reviewer.role_name}（${reviewer.binding_id}）` : after.reviewerBindingId),
+                    change('该领地当前主理主管', null, territory?.supervisor_binding_id ?? '未指派'),
+                    change('本次提交', null, after.duplicate
+                        ? '该条目当前版本的同一问题已有记录：不会新增第二条事实，也不会改变任何状态。'
+                        : '新增一条 Owner 提问事实；接收者仍是接受该交付的主管，当前未被读取前只显示「待领取」。'),
+                    change('问题的准确保留范围', null, after.duplicate
+                        ? '与既有记录一致，不重复写入。'
+                        : '只写入提问事实本身；不自动通知、不自动派发、不自动唤醒任何 Agent。'),
+                    change('不改动的状态', null, '任务状态、主管审查、知悉、正式 Owner acceptance 与发布状态均不变；提问不是知悉。'),
+                    change('回复', null, '由接受该交付的主管在其 session-bound Agent Tool 中回复；Owner 不代答，其他主管不能代答。')];
+            }
         }
     }
     async apply(handle, record, preparation, signal) {
         this.active(handle);
-        const context = this.context(record, preparation.input);
+        const context = this.context(record, preparation.input, preparation.preview.operationId);
         if (context.fingerprint !== preparation.fingerprint)
             fail('PREVIEW_STALE', '相关对象已变化，请重新预览。');
         await this.validate(record, preparation.input, signal);
@@ -701,7 +1274,7 @@ export class OwnerDecisionController {
             fail('REQUEST_ABORTED', '请求已取消。');
         const result = this.store.withImmediateTransaction(() => {
             this.active(handle);
-            const current = this.context(record, preparation.input);
+            const current = this.context(record, preparation.input, preparation.preview.operationId);
             if (current.fingerprint !== preparation.fingerprint || ownerInputHash(preparation.input) !== preparation.inputHash)
                 fail('PREVIEW_STALE', '相关事实或准备内容已变化，请重新预览。');
             const source = { source_channel: 'LOCAL_OWNER_GUI', authorization_source: 'LOCAL_DIRECT_SLASH',
@@ -753,6 +1326,8 @@ export class OwnerDecisionController {
             }
         };
         let message, eventType;
+        /** 本次是否真的追加了一条新业务事实；幂等重试时没有新事件，不能按「事件数恰好 1」判定失败。 */
+        let appendedBusinessFact = true;
         switch (input.action) {
             case 'plan.adopt':
                 message = run({ kingdomId, ...input.parameters }, adoptCollaborationPlan);
@@ -782,7 +1357,10 @@ export class OwnerDecisionController {
             }
             case 'role.bind': {
                 const p = input.parameters;
-                message = run({ kingdomId, roleType: p.role_type, roleName: p.role_name, sessionId: p.session_id }, bindRole);
+                // v3.2.0：主管走原子通道（建席位 + 设主理同一事务）；其它角色保持原路径。
+                message = p.role_type === 'SUPERVISOR'
+                    ? run({ kingdomId, roleType: p.role_type, roleName: p.role_name, sessionId: p.session_id, territoryId: p.territory_id }, bindSupervisorForTerritory)
+                    : run({ kingdomId, roleType: p.role_type, roleName: p.role_name, sessionId: p.session_id }, bindRole);
                 eventType = 'ROLE_BOUND';
                 break;
             }
@@ -802,11 +1380,108 @@ export class OwnerDecisionController {
                 message = '请求的执行配置已保存；这不代表模型已实际运行成功。';
                 eventType = 'EXECUTION_PROFILE_UPDATED';
                 break;
+            case 'delivery.item.ack': {
+                const claim = this.store.latestWorkerResult(input.parameters.task_id);
+                if (!claim)
+                    fail('DELIVERY_NOT_CONFIRMED', '交付对应的结果不存在。');
+                const review = readLatestReviewEvent(this.store, kingdomId, input.parameters.task_id);
+                const existing = readDeliveryAcknowledgements(this.store, kingdomId, input.parameters.delivery_id);
+                const already = existing.some(ack => ack.itemId === input.parameters.item_id && ack.contentHash === input.parameters.content_hash
+                    && ack.ownerId === record.view.ownerId);
+                if (!already) {
+                    const classification = classifyAcceptedDelivery(this.store, claim, review);
+                    if (!classification)
+                        fail('DELIVERY_NOT_CONFIRMED', '交付尚未由主管 ACCEPT 确认。');
+                    const changeEvidence = this.changeEvidenceFor(kingdomId, input.parameters.task_id);
+                    const item = deriveDeliveryItems(input.parameters.task_id, claim, changeEvidence).find(candidate => candidate.itemId === input.parameters.item_id);
+                    if (!item || item.contentHash !== input.parameters.content_hash)
+                        fail('DELIVERY_ITEM_VERSION_STALE', '条目内容版本已变化。');
+                    recordDeliveryAcknowledgement(this.store, {
+                        kingdomId,
+                        deliveryId: input.parameters.delivery_id,
+                        itemId: input.parameters.item_id,
+                        contentHash: input.parameters.content_hash,
+                        taskId: input.parameters.task_id,
+                        attemptNo: input.parameters.attempt_no,
+                        resultId: input.parameters.result_id,
+                        ownerId: record.view.ownerId,
+                        ownerBindingId: this.store.getBindingByRole(kingdomId, 'OWNER')?.binding_id ?? null,
+                        itemLabel: item.content.label,
+                        acknowledgedAt: new Date(this.now()).toISOString(),
+                        attribution: { ...source },
+                        changeEvidence,
+                    });
+                }
+                message = already
+                    ? '该条目当前版本的 Owner 知悉记录已存在；未新增第二条事实。知悉不改变任务、审查与发布状态。'
+                    : '已记下 Owner 已知悉该条当前版本；这不代表理解、质量认可、Task DONE、正式验收或发布授权，也未改变任务、审查与发布状态。';
+                eventType = DELIVERY_ACK_EVENT_TYPE;
+                break;
+            }
+            case 'delivery.item.question': {
+                const claim = this.store.latestWorkerResult(input.parameters.task_id);
+                if (!claim)
+                    fail('DELIVERY_NOT_CONFIRMED', '交付对应的结果不存在。');
+                const review = readLatestReviewEvent(this.store, kingdomId, input.parameters.task_id);
+                // 责任归属必须在事务内重算：预览时的接受主管身份、条目版本或领地改绑都可能已变化。
+                const reviewerBindingId = deliveryReviewerBindingId(review);
+                if (!reviewerBindingId)
+                    fail('DELIVERY_ACCEPT_REVIEWER_UNKNOWN', '接受事件没有记录主管绑定，无法确定本问题的接收者。');
+                // CHANGE 条目只由「主管在 ACCEPT 中显式选择、且本地 hash 重验通过」的改动证据派生：
+                // 预览、事务内校验与写入端必须复用**同一份**已重验证据，写入端才可能重算出同一
+                // itemId/contentHash，而不是必报 DELIVERY_ITEM_UNKNOWN。
+                const changeEvidence = this.changeEvidenceFor(kingdomId, input.parameters.task_id);
+                const item = deriveDeliveryItems(input.parameters.task_id, claim, changeEvidence)
+                    .find(candidate => candidate.itemId === input.parameters.item_id);
+                if (!item || item.contentHash !== input.parameters.content_hash)
+                    fail('DELIVERY_ITEM_VERSION_STALE', '条目内容版本已变化。');
+                const questionText = boundedQuestionText(input.parameters.question_text, DELIVERY_QUESTION_TEXT_LIMIT);
+                if (!questionText)
+                    fail('INVALID_INPUT', '问题内容必须是非空、长度受限的文本。');
+                const operationId = source.operation_id;
+                if (!operationId)
+                    fail('OPERATION_MISMATCH', '本次管理操作没有操作编号，拒绝写入提问事实。');
+                // 提问身份属于产生它的这次 Owner operation：同一编号重放由写入端的幂等分支核对
+                // 并原样返回既有事实；不同编号即使文本相同也各自形成独立问题。这里不再按正文去重，
+                // 「没有新事件」也不等于操作失败。
+                const recorded = recordDeliveryQuestion(this.store, {
+                    kingdomId,
+                    deliveryId: input.parameters.delivery_id,
+                    taskId: input.parameters.task_id,
+                    itemId: input.parameters.item_id,
+                    itemLabel: item.content.label,
+                    contentHash: input.parameters.content_hash,
+                    attemptNo: input.parameters.attempt_no,
+                    resultId: input.parameters.result_id,
+                    ownerId: record.view.ownerId,
+                    ownerBindingId: this.store.getBindingByRole(kingdomId, 'OWNER')?.binding_id ?? null,
+                    operationId,
+                    questionText,
+                    askedAt: new Date(this.now()).toISOString(),
+                    changeEvidence,
+                    attribution: { ...source },
+                });
+                appendedBusinessFact = recorded.created;
+                message = recorded.created
+                    ? `已记录 Owner 就该条目当前版本提出的问题，接收者为接受该交付的主管。当前只显示「待领取」：在主管实际读取前不声称已通知或已阅读；这不代表知悉、验收或任务完成，也不改变任务、审查与发布状态。`
+                    : '同一 Owner 操作重放：既有提问记录与本次引用一致，未新增第二条事实，也未改变任何状态。';
+                eventType = DELIVERY_QUESTION_EVENT_TYPE;
+                break;
+            }
         }
         const events = this.store.listEventsSince(kingdomId, beforeSeq, 20);
         const business = events.filter(event => event.event_type === eventType && event.actor_role === 'OWNER' && event.actor_id === record.view.ownerId
             && JSON.parse(event.payload_json).operation_id === source.operation_id);
-        if (business.length !== 1 || !business[0].target_id || !['kingdom', 'territory', 'binding', 'collaboration-plan'].includes(business[0].target_type ?? '')) {
+        // 幂等提问没有新增事件：此时只核对既有事实仍指向同一条交付，不要求事件数为 1。
+        if (!appendedBusinessFact && input.action === 'delivery.item.question') {
+            const existing = readDeliveryQuestionThread(this.store, kingdomId, input.parameters.delivery_id);
+            const matches = existing?.questions.some(question => question.itemId === input.parameters.item_id
+                && question.contentHash === input.parameters.content_hash) ?? false;
+            if (!matches)
+                fail('MUTATION_NOT_APPLIED', '既有提问事实与本次引用不一致，事务已回滚。');
+            return { target: { type: 'delivery', id: input.parameters.delivery_id }, message };
+        }
+        if (business.length !== 1 || !business[0].target_id || !['kingdom', 'territory', 'binding', 'collaboration-plan', 'delivery'].includes(business[0].target_type ?? '')) {
             fail('MUTATION_NOT_APPLIED', 'Core 未产生准确业务事实，事务已回滚。');
         }
         return { target: { type: business[0].target_type, id: business[0].target_id }, message };