evolcore 0.0.11 → 0.0.13

package/dist/channels/aun.js

@@ -7,7 +7,7 @@ import { logger, localTimestamp } from '../utils/logger.js';
 import { LogWriter } from '../utils/log-writer.js';
 import { middleOutputModePolicy, resolveShowActivities, showActivitiesPolicy } from '../core/channel-loader.js';
 import { DEFAULT_FLUSH_DELAY_SECONDS } from '../types.js';
-import { resolvePaths, agentDir as agentDirPath, resolveRoot } from '../paths.js';
+import { resolvePaths, agentDir as agentDirPath, resolveRoot, channelStatePath } from '../paths.js';
 import { saveToUploads, sanitizeFileName, bufferToInboundImage, safeFetch } from '../utils/media-cache.js';
 import { appendAidEvent } from '../utils/instance-registry.js';
 import { appendMessageLog, appendMessageLogStrict, buildOutboundEntry, buildInboundEntry, classifyAunPayloadForLog, hasMessageLogOperation } from '../core/message/message-log.js';
@@ -21,7 +21,7 @@ import { loadAgent } from '../config-store.js';
 import { normalizeAgentLifecycle } from '../config/lifecycle.js';
 import { resolveEffective } from '../config/config-manager.js';
 import { isManagementRole } from '../config/builtin-roles.js';
-import { mentionModeToDispatch } from '../config/mention-mode.js';
+import { normalizeMentionMode } from '../config/mention-mode.js';
 import { getProcessStartTime } from '../utils/process-introspect.js';
 import * as outbox from '../aun/outbox.js';
 import { guessMime, formatSize } from '../utils/media-cache.js';
@@ -31,13 +31,36 @@ import { isHClassPath } from '../core/protected-paths.js';
 import { consumeAunCausation, registerAunCausation } from '../core/causation/aun-association.js';
 import { deriveCausation, normalizeCausation } from '../core/causation/context.js';
 import { recordCausationSpan } from '../core/causation/audit.js';
-import { isExplicitGroupId } from '../aun/group-identity.js';
 import { refreshAgentDisplayName, resolveAgentDisplayName } from '../aun/aid/agentmd.js';
 import { readInstalledEvolcoreVersion } from '../utils/evolcore-version.js';
-import { postBootstrapWelcomeOperationId, preparePostBootstrapWelcomeOutbox } from '../core/bootstrap-messages.js';
+import { bindPostBootstrapWelcomeOutboxSession, hasPendingPostBootstrapWelcomeOutbox, postBootstrapWelcomeOperationId, preparePostBootstrapWelcomeOutbox, } from '../core/bootstrap-messages.js';
+import { hasMentionAll, mentionEntryAids, mentionEntryTargets, } from '../core/message/mention-schema.js';
+import { normalizeAunMentionEntries, } from '../aun/msg/mention-schema.js';
+import { isDeliveryTarget, sameDeliveryTarget } from '../core/message/message-utils.js';
 export const AUN_HANDOFF_MARKER_FIELD = '_evolcore_handoff_id';
 const AUN_INTERACTION_CARD_TTL_MS = 24 * 60 * 60 * 1000;
+const AUN_INBOUND_DEDUP_TTL_MS = 7 * 24 * 60 * 60 * 1000;
 const IMAGE_MIME_TYPE = /^image\/[!#$%&'*+.^_`|~0-9A-Za-z-]+$/i;
+function requireEnvelopeDelivery(channelId, envelopeDelivery, nestedDelivery) {
+    if (!isDeliveryTarget(envelopeDelivery)) {
+        throw Object.assign(new Error(`AUN outbound envelope requires a top-level delivery route for channelId=${channelId}`), {
+            code: 'AUN_OUTBOUND_ROUTE_REQUIRED',
+        });
+    }
+    if (nestedDelivery !== undefined) {
+        if (!isDeliveryTarget(nestedDelivery) || !sameDeliveryTarget(envelopeDelivery, nestedDelivery)) {
+            throw Object.assign(new Error(`AUN outbound envelope has conflicting delivery routes for channelId=${channelId}`), {
+                code: 'AUN_OUTBOUND_ROUTE_MISMATCH',
+            });
+        }
+    }
+    if (envelopeDelivery.chatType === 'group' && envelopeDelivery.groupId !== channelId) {
+        throw Object.assign(new Error(`AUN group delivery does not match channelId=${channelId}`), {
+            code: 'AUN_OUTBOUND_ROUTE_MISMATCH',
+        });
+    }
+    return envelopeDelivery;
+}
 function normalizeImageMimeType(mimeType) {
     const normalized = mimeType?.split(';', 1)[0].trim().toLowerCase();
     if (!normalized)
@@ -131,6 +154,8 @@ export function aunOptsToInbound(opts, channel, channelType) {
         encrypted: opts.encrypted,
         protectedHeaders: opts.protectedHeaders,
         messageId: opts.messageId,
+        receivedAt: opts.receivedAt,
+        gatewaySeq: opts.gatewaySeq,
         causation: opts.causation,
         mentions: opts.mentions,
         mentionAids: opts.mentionAids,
@@ -139,7 +164,7 @@ export function aunOptsToInbound(opts, channel, channelType) {
         replyContext: opts.replyContext,
         source: opts.source,
         images: opts.images,
-        dispatchMode: opts.dispatchMode,
+        mentionMode: opts.mentionMode,
     };
 }
 function verifiedProtectedHeaders(msg, env) {
@@ -287,14 +312,36 @@ export class AUNChannel {
             throw e;
         }
     }
-    /** 判断 channelId 是否为群组 ID
-     *  - 新格式：group.{aidDomain}/{group_no|group_name}
-     *  - 数字群号：{group_no}.{aidDomain}（如 11117.example.com）
-     *  - 兼容旧格式：grp_xxx、g-xxx.agentid.pub
+    /** Resolve the authenticated transport route for an ordinary outbound send.
+     * The channel id is an address only; it is intentionally never used to infer
+     * whether the address is a group.
      */
-    /** 判断 channelId 是否群组 ID（public：plugin adapter 闭包需调用） */
-    isGroupId(id) {
-        return isExplicitGroupId(id);
+    requireDelivery(channelId, context, explicit) {
+        const supplied = explicit ?? context?.delivery;
+        if (supplied !== undefined && !isDeliveryTarget(supplied)) {
+            throw Object.assign(new Error(`AUN outbound send has an invalid delivery route for channelId=${channelId}`), {
+                code: 'AUN_OUTBOUND_ROUTE_REQUIRED',
+            });
+        }
+        if (!supplied) {
+            throw Object.assign(new Error(`AUN outbound send requires an explicit delivery route for channelId=${channelId}`), {
+                code: 'AUN_OUTBOUND_ROUTE_REQUIRED',
+            });
+        }
+        if (supplied.chatType === 'group' && supplied.groupId !== channelId) {
+            throw Object.assign(new Error(`AUN group delivery does not match channelId=${channelId}`), {
+                code: 'AUN_OUTBOUND_ROUTE_MISMATCH',
+            });
+        }
+        return supplied;
+    }
+    requirePersistedDelivery(channelId, delivery) {
+        // Persisted sends only trust the top-level route. In particular, old
+        // outbox entries cannot recover routing from their nested reply context.
+        return this.requireDelivery(channelId, undefined, delivery);
+    }
+    withDelivery(context, delivery) {
+        return { ...(context ?? {}), delivery };
     }
     getShortAid(aid) {
         if (!aid)
@@ -316,15 +363,19 @@ export class AUNChannel {
         const name = cached?.name;
         return name && name !== short ? `${short}(${name})` : short;
     }
-    notifyCardActionFailure(channelId, text, operatorId, threadId) {
+    notifyCardActionFailure(channelId, text, operatorId, threadId, delivery) {
         if (!channelId) {
             logger.warn(`${this.logPrefix()} Card action failure without channelId: ${text}`);
             return;
         }
-        const context = {};
+        if (!delivery) {
+            logger.warn(`${this.logPrefix()} Card action failure without trusted delivery route: ${text}`);
+            return;
+        }
+        const context = { delivery };
         if (threadId)
             context.threadId = threadId;
-        if (operatorId && this.isGroupId(channelId))
+        if (operatorId && delivery.chatType === 'group')
             context.peerId = operatorId;
         void this.sendMessage(channelId, text, context).catch((err) => {
             logger.error(`${this.logPrefix()} Failed to send card action error:`, err);
@@ -334,7 +385,7 @@ export class AUNChannel {
         logger.info(`${this.logPrefix()} ActionInteraction audit: behavior=${behavior ?? 'reply'} `
             + `cardId=${cardMessageId} interactionId=${interactionId} result=${result} textLength=${textLength}`);
     }
-    extractTextPayload(payload, channelId, senderAid) {
+    extractTextPayload(payload, channelId, senderAid, delivery) {
         if (typeof payload === 'string')
             return payload;
         if (payload && typeof payload === 'object') {
@@ -345,6 +396,7 @@ export class AUNChannel {
                 const cardMsgId = typeof obj.ref_message_id === 'string' ? obj.ref_message_id
                     : typeof obj.card_message_id === 'string' ? obj.card_message_id : '';
                 const cardInfo = cardMsgId ? this.cardMessageIdMap.get(cardMsgId) : undefined;
+                const cardDelivery = cardInfo?.delivery ?? delivery;
                 if (cardInfo) {
                     // compose 按钮由新版客户端在卡片内采集输入；旧版客户端可继续从主编辑器
                     // 采集。两者最终都回传 action_card_reply{behavior:"compose", text}。
@@ -369,25 +421,25 @@ export class AUNChannel {
                     // payloads omit senderAid.  A group channelId is only a conversation
                     // identifier and must never be treated as the clicking operator.
                     const cardClickerAid = senderAid
-                        || (channelId && !this.isGroupId(channelId) ? channelId : '')
+                        || (cardDelivery?.chatType === 'private' && channelId ? channelId : '')
                         || '';
                     if (cardInfo.isCommandCard) {
                         // CommandCard：action_value 是完整 slash 命令，构造伪入站消息。
                         // 先完成点击者鉴权，再消费 mapping；否则群成员的一次误点会让发起者
                         // 无法继续操作同一张卡片。
-                        const chatType = channelId ? (this.isGroupId(channelId) ? 'group' : 'private') : 'private';
+                        const chatType = cardDelivery?.chatType ?? 'private';
                         if (this.messageHandler && actionValue.startsWith('/')) {
                             // Initiator 校验：仅群聊需要（私聊信道一对一，点击者恒为对端 = initiator）。
                             // 身份只信认证信封提取的 cardClickerAid，非 payload 自报。
                             if (chatType === 'group' && !cardClickerAid) {
                                 logger.info(`${this.logPrefix()} CommandCard rejected: missing authenticated clicker mid=${cardMsgId}`);
-                                this.notifyCardActionFailure(channelId, '⚠️ 无法验证卡片操作者身份', undefined, threadId);
+                                this.notifyCardActionFailure(channelId, '⚠️ 无法验证卡片操作者身份', undefined, threadId, cardDelivery);
                                 return '';
                             }
                             if (chatType === 'group' && cardInfo.initiatorAid
                                 && cardClickerAid !== cardInfo.initiatorAid) {
                                 logger.info(`${this.logPrefix()} CommandCard rejected: clicker=${cardClickerAid} initiator=${cardInfo.initiatorAid} mid=${cardMsgId}`);
-                                this.notifyCardActionFailure(channelId, '⚠️ 仅卡片发起者可操作', cardClickerAid, threadId);
+                                this.notifyCardActionFailure(channelId, '⚠️ 仅卡片发起者可操作', cardClickerAid, threadId, cardDelivery);
                                 return '';
                             }
                             // 已通过鉴权并即将进入处理流程；此时才消费 mapping，避免非发起者
@@ -406,28 +458,28 @@ export class AUNChannel {
                             })).catch((err) => {
                                 logger.error(`${this.logPrefix()} CommandCard handler failed: action=${actionValue} mid=${cardMsgId}`, err);
                                 const message = err instanceof Error && err.message ? err.message : String(err || '未知错误');
-                                this.notifyCardActionFailure(channelId, `❌ 操作失败: ${message}`, cardClickerAid, threadId);
+                                this.notifyCardActionFailure(channelId, `❌ 操作失败: ${message}`, cardClickerAid, threadId, cardDelivery);
                             });
                         }
                         else if (!this.messageHandler) {
-                            this.notifyCardActionFailure(channelId, '❌ 操作失败：命令处理器未就绪', cardClickerAid, threadId);
+                            this.notifyCardActionFailure(channelId, '❌ 操作失败：命令处理器未就绪', cardClickerAid, threadId, cardDelivery);
                         }
                         else {
-                            this.notifyCardActionFailure(channelId, '❌ 操作失败：无效的卡片命令', cardClickerAid, threadId);
+                            this.notifyCardActionFailure(channelId, '❌ 操作失败：无效的卡片命令', cardClickerAid, threadId, cardDelivery);
                         }
                     }
                     else {
                         // ActionInteraction：后端明确接受后才消费 mapping。撤权、过期或
                         // 重复点击返回 false 时保持 fail-closed，并提示用户卡片已失效。
-                        if (channelId && this.isGroupId(channelId) && !cardClickerAid) {
+                        if (cardDelivery?.chatType === 'group' && !cardClickerAid) {
                             this.auditActionCardInteraction(behaviorRaw, cardMsgId, cardInfo.requestId, 'rejected_unauthenticated', text.length);
-                            this.notifyCardActionFailure(channelId, '⚠️ 无法验证卡片操作者身份', undefined, threadId);
+                            this.notifyCardActionFailure(channelId, '⚠️ 无法验证卡片操作者身份', undefined, threadId, cardDelivery);
                             return '';
                         }
-                        if (channelId && this.isGroupId(channelId) && cardInfo.initiatorAid
+                        if (cardDelivery?.chatType === 'group' && cardInfo.initiatorAid
                             && cardClickerAid !== cardInfo.initiatorAid) {
                             this.auditActionCardInteraction(behaviorRaw, cardMsgId, cardInfo.requestId, 'rejected_non_initiator', text.length);
-                            this.notifyCardActionFailure(channelId, '⚠️ 仅卡片发起者可操作', cardClickerAid, threadId);
+                            this.notifyCardActionFailure(channelId, '⚠️ 仅卡片发起者可操作', cardClickerAid, threadId, cardDelivery);
                             return '';
                         }
                         // Compose reply 入参校验：text 必须非空且未超长。
@@ -437,19 +489,19 @@ export class AUNChannel {
                             const MAX_COMPOSE_TEXT_LENGTH = 64 * 1024; // 64K 字符
                             if (!trimmedText) {
                                 this.auditActionCardInteraction(behaviorRaw, cardMsgId, cardInfo.requestId, 'rejected_empty', text.length);
-                                this.notifyCardActionFailure(channelId, '⚠️ 输入内容不能为空，请重新输入', cardClickerAid, threadId);
+                                this.notifyCardActionFailure(channelId, '⚠️ 输入内容不能为空，请重新输入', cardClickerAid, threadId, cardDelivery);
                                 return '';
                             }
                             if (text.length > MAX_COMPOSE_TEXT_LENGTH) {
                                 this.auditActionCardInteraction(behaviorRaw, cardMsgId, cardInfo.requestId, 'rejected_too_long', text.length);
-                                this.notifyCardActionFailure(channelId, `⚠️ 输入内容过长（${text.length} 字符，限制 ${MAX_COMPOSE_TEXT_LENGTH}），请缩短后重试`, cardClickerAid, threadId);
+                                this.notifyCardActionFailure(channelId, `⚠️ 输入内容过长（${text.length} 字符，限制 ${MAX_COMPOSE_TEXT_LENGTH}），请缩短后重试`, cardClickerAid, threadId, cardDelivery);
                                 return '';
                             }
                         }
                         if (this.interactionCallback) {
                             if (this.interactionActionsInFlight.has(cardMsgId)) {
                                 this.auditActionCardInteraction(behaviorRaw, cardMsgId, cardInfo.requestId, 'rejected_in_flight', text.length);
-                                this.notifyCardActionFailure(channelId, '⏳ 操作正在处理，请勿重复点击', cardClickerAid, threadId);
+                                this.notifyCardActionFailure(channelId, '⏳ 操作正在处理，请勿重复点击', cardClickerAid, threadId, cardDelivery);
                                 return '';
                             }
                             this.interactionActionsInFlight.add(cardMsgId);
@@ -482,7 +534,7 @@ export class AUNChannel {
                                     // captured the message id before the callback returned.
                                     this.forgetInteractionCard(cardMsgId, cardInfo.requestId);
                                 }
-                                this.notifyCardActionFailure(channelId, '⚠️ 卡片已失效，请重新发起', cardClickerAid, threadId);
+                                this.notifyCardActionFailure(channelId, '⚠️ 卡片已失效，请重新发起', cardClickerAid, threadId, cardDelivery);
                             };
                             try {
                                 const result = this.interactionCallback(response);
@@ -491,7 +543,7 @@ export class AUNChannel {
                                         this.interactionActionsInFlight.delete(cardMsgId);
                                         this.auditActionCardInteraction(behaviorRaw, cardMsgId, cardInfo.requestId, 'callback_error', text.length);
                                         logger.error(`${this.logPrefix()} ActionInteraction callback failed: request=${cardInfo.requestId}`, err);
-                                        this.notifyCardActionFailure(channelId, '❌ 操作失败，请稍后重试', cardClickerAid, threadId);
+                                        this.notifyCardActionFailure(channelId, '❌ 操作失败，请稍后重试', cardClickerAid, threadId, cardDelivery);
                                     });
                                 }
                                 else {
@@ -502,19 +554,19 @@ export class AUNChannel {
                                 this.interactionActionsInFlight.delete(cardMsgId);
                                 this.auditActionCardInteraction(behaviorRaw, cardMsgId, cardInfo.requestId, 'callback_error', text.length);
                                 logger.error(`${this.logPrefix()} ActionInteraction callback failed: request=${cardInfo.requestId}`, err);
-                                this.notifyCardActionFailure(channelId, '❌ 操作失败，请稍后重试', cardClickerAid, threadId);
+                                this.notifyCardActionFailure(channelId, '❌ 操作失败，请稍后重试', cardClickerAid, threadId, cardDelivery);
                             }
                         }
                         else {
                             this.auditActionCardInteraction(behaviorRaw, cardMsgId, cardInfo.requestId, 'handler_unavailable', text.length);
-                            this.notifyCardActionFailure(channelId, '❌ 操作失败：交互处理器未就绪', cardClickerAid, threadId);
+                            this.notifyCardActionFailure(channelId, '❌ 操作失败：交互处理器未就绪', cardClickerAid, threadId, cardDelivery);
                         }
                     }
                 }
                 else if (this.ownedCardMsgIds.has(cardMsgId)) {
                     // 本 agent 发出的卡片，但 entry 已过期（24h TTL）
                     logger.debug(`${this.logPrefix()} action_card_reply expired: cardMsgId=${cardMsgId}`);
-                    this.notifyCardActionFailure(channelId, '⚠️ 卡片已失效，请重新发起');
+                    this.notifyCardActionFailure(channelId, '⚠️ 卡片已失效，请重新发起', undefined, undefined, delivery);
                 }
                 else {
                     // 非本 agent 发出的卡片（broadcast 模式下其他 agent 的卡）→ 静默忽略
@@ -698,24 +750,20 @@ export class AUNChannel {
             .replace(/[ \t]+/g, ' ')
             .trim();
     }
-    extractMentionAids(mentions) {
-        const aids = [];
-        for (const m of mentions) {
-            if (typeof m === 'string')
-                aids.push(m);
-            else if (m && typeof m === 'object' && typeof m.aid === 'string')
-                aids.push(m.aid);
+    parsePayloadMentionsOrReject(payload, context, messageId, seq) {
+        const raw = payload && typeof payload === 'object' && !Array.isArray(payload)
+            ? payload.mentions
+            : undefined;
+        try {
+            return normalizeAunMentionEntries(raw);
         }
-        return aids;
-    }
-    hasMentionAll(mentions) {
-        for (const m of mentions) {
-            if (m === 'all')
-                return true;
-            if (m && typeof m === 'object' && m.scope === 'all')
-                return true;
+        catch (error) {
+            this.acknowledgeImmediately(messageId, seq);
+            const detail = error instanceof Error ? error.message : String(error);
+            const code = error?.code ?? 'INVALID_MENTION_SCHEMA';
+            logger.error(`${this.logPrefix()} Dropped ${context}: invalid payload.mentions (${detail}) code=${code} mid=${messageId}`);
+            return undefined;
         }
-        return false;
     }
     /** 从正文提取 @aid（AID 格式：至少三段域名），用于出站填充 payload.mentions */
     static MENTION_AID_RE = /@([a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?){2,})/g;
@@ -731,6 +779,19 @@ export class AUNChannel {
         }
         return out;
     }
+    /**
+     * Convert the AUN text mention notation into the canonical wire entries.
+     * `@all` is intentionally represented by its scope discriminator instead
+     * of being treated as an AID.
+     */
+    extractMentionEntriesFromText(text) {
+        const entries = [];
+        if (this.hasExplicitMention(text, 'all'))
+            entries.push({ scope: 'all' });
+        for (const aid of this.extractMentionAidsFromText(text))
+            entries.push({ aid });
+        return entries;
+    }
     /** Sanitize a raw topicName from untrusted payload: trim, strip control chars, enforce length. */
     sanitizeTopicName(raw) {
         if (typeof raw !== 'string')
@@ -740,8 +801,13 @@ export class AUNChannel {
             return sanitized;
         return undefined;
     }
-    buildGroupReplyContext(threadId, senderAid, encrypted, messageId, chatmode, topicName) {
-        const replyContext = { metadata: { encrypted, chatmode } };
+    buildGroupReplyContext(threadId, senderAid, encrypted, messageId, chatmode, topicName, groupId) {
+        if (!groupId)
+            throw new Error('buildGroupReplyContext requires groupId');
+        const replyContext = {
+            metadata: { encrypted, chatmode },
+            delivery: { chatType: 'group', groupId },
+        };
         if (threadId)
             replyContext.threadId = threadId;
         replyContext.peerId = senderAid;
@@ -755,6 +821,108 @@ export class AUNChannel {
         }
         return replyContext;
     }
+    buildPrivateReplyContext(threadId, senderAid, encrypted, messageId, chatmode, topicName, refMessageId) {
+        const replyContext = {
+            metadata: { encrypted, chatmode, refMessageId },
+            delivery: { chatType: 'private' },
+            peerId: senderAid,
+        };
+        if (threadId)
+            replyContext.threadId = threadId;
+        if (messageId)
+            replyContext.replyToMessageId = messageId;
+        if (topicName && threadId)
+            replyContext.metadata.topicName = topicName;
+        return replyContext;
+    }
+    claimInboundMessage(kind, messageId, seq) {
+        if (!messageId)
+            return true;
+        // Channel instance names are commonly reused across agents (the default
+        // is simply `aun`). Include the receiving AID so a server-scoped
+        // message_id cannot suppress an unrelated delivery in another channel.
+        const namespace = `${this.config.aid}:${this.config.channelName ?? 'aun'}:aun:${kind}`;
+        const dedupeKey = JSON.stringify([namespace, messageId]);
+        const existing = this.inboundSeenMessages.get(dedupeKey);
+        if (existing) {
+            if (seq !== undefined && existing.seq !== undefined && seq !== existing.seq) {
+                logger.warn(`${this.logPrefix()} Duplicate message_id with conflicting seq: namespace=${namespace} mid=${messageId} firstSeq=${existing.seq} duplicateSeq=${seq}`);
+            }
+            else {
+                logger.debug(`${this.logPrefix()} Duplicate inbound message dropped: namespace=${namespace} mid=${messageId} seq=${seq ?? 'unknown'}`);
+            }
+            this.acknowledgeImmediately(messageId, seq);
+            return false;
+        }
+        this.inboundSeenMessages.set(dedupeKey, { seenAt: Date.now(), seq });
+        if (seq !== undefined)
+            this.messageSeqMap.set(messageId, seq);
+        this.appendInboundDedupe(dedupeKey, messageId, kind, seq);
+        setTimeout(() => this.inboundSeenMessages.delete(dedupeKey), AUN_INBOUND_DEDUP_TTL_MS);
+        return true;
+    }
+    inboundDedupeFile() {
+        const channelName = this.config.channelName ?? 'aun';
+        return channelStatePath(channelName, 'dedup', 'aun', `${encodeURIComponent(this.config.aid)}.jsonl`);
+    }
+    loadInboundDedupe() {
+        const file = this.inboundDedupeFile();
+        const cutoff = Date.now() - AUN_INBOUND_DEDUP_TTL_MS;
+        let lines;
+        try {
+            lines = fs.readFileSync(file, 'utf8').split('\n').filter(Boolean);
+        }
+        catch {
+            return;
+        }
+        let needsRewrite = false;
+        for (const line of lines) {
+            try {
+                const entry = JSON.parse(line);
+                if (typeof entry.key !== 'string' || typeof entry.seenAt !== 'number' || !Number.isFinite(entry.seenAt) || entry.seenAt <= cutoff) {
+                    needsRewrite = true;
+                    continue;
+                }
+                this.inboundSeenMessages.set(entry.key, {
+                    seenAt: entry.seenAt,
+                    seq: typeof entry.seq === 'number' && Number.isFinite(entry.seq) ? entry.seq : undefined,
+                });
+            }
+            catch {
+                needsRewrite = true;
+            }
+        }
+        if (needsRewrite)
+            this.rewriteInboundDedupe();
+    }
+    appendInboundDedupe(key, messageId, kind, seq) {
+        try {
+            const file = this.inboundDedupeFile();
+            fs.mkdirSync(path.dirname(file), { recursive: true });
+            fs.appendFileSync(file, JSON.stringify({ key, messageId, kind, seenAt: Date.now(), seq }) + '\n');
+        }
+        catch (error) {
+            logger.warn(`${this.logPrefix()} Failed to persist inbound dedup: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    rewriteInboundDedupe() {
+        const cutoff = Date.now() - AUN_INBOUND_DEDUP_TTL_MS;
+        for (const [key, value] of this.inboundSeenMessages) {
+            if (value.seenAt <= cutoff)
+                this.inboundSeenMessages.delete(key);
+        }
+        try {
+            const file = this.inboundDedupeFile();
+            fs.mkdirSync(path.dirname(file), { recursive: true });
+            const tmp = `${file}.tmp-${process.pid}-${Date.now()}`;
+            const lines = [...this.inboundSeenMessages].map(([key, value]) => JSON.stringify({ key, seenAt: value.seenAt, seq: value.seq }));
+            fs.writeFileSync(tmp, lines.length > 0 ? `${lines.join('\n')}\n` : '');
+            fs.renameSync(tmp, file);
+        }
+        catch (error) {
+            logger.warn(`${this.logPrefix()} Failed to compact inbound dedup: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
     acknowledgeImmediately(messageId, _seq) {
         // SDK internally manages seq tracking and ack — do not call message.ack RPC directly,
         // as it corrupts the SDK's seqTracker state and breaks V2 e2ee message pull.
@@ -771,10 +939,16 @@ export class AUNChannel {
     _aid;
     _selfName; // 本地 agent.md 中的 name，首次 connect 时读取
     _chatId = ''; // aid:device_id:slot_id — 多实例回声过滤
-    seenMessages = new Map();
+    /**
+     * Inbound application dedupe. The AUN SDK may redeliver the same message
+     * with a different transport sequence, so message_id is the identity and
+     * seq is only retained for ACK/conflict diagnostics. Claiming happens at
+     * the event handler boundary, before payload/slash/mention parsing.
+     */
+    inboundSeenMessages = new Map();
     groupNameCache = new Map(); // groupId → 群显示名（进程内缓存，群名极少变）
     peerInfoCache = new Map();
-    messageSeqMap = new Map(); // messageId → seq (for ack)
+    messageSeqMap = new Map(); // messageId → seq (for ack/diagnostics)
     sentCount = new Map(); // channelId → 已发消息计数（用于判断最终回复）
     peerE2ee = new Map();
     static E2EE_PROBE_TTL = 10 * 60 * 1000; // 10min
@@ -789,7 +963,7 @@ export class AUNChannel {
     interactionCardMessageIds = new Map();
     /** 撤权可能先于 outbox 卡片投递完成；迟到卡片注册后立即撤回。 */
     invalidatedInteractions = new Map();
-    dispatchModeResolver;
+    mentionModeResolver;
     static PROACTIVE_ALLOW_TYPES = new Set([
         'text', 'quote', 'image', 'video', 'voice', 'file', 'json',
         'merge', 'link', 'location', 'personal_card',
@@ -798,6 +972,10 @@ export class AUNChannel {
     static INJECT_REQUEST_TYPE = 'observer.inject';
     /** 绑定请求类型（Evol App → 控制 AID）：快速路径，绕过白名单透传原始 payload JSON 给 bridge。 */
     static BIND_REQUEST_TYPE = 'bind.request';
+    /** 联系人申请本人状态查询：在普通消息准入前交给 bridge，身份只取认证信封。 */
+    static CONTACT_REQUEST_QUERY_TYPE = 'contact.request.query';
+    /** App 联系人申请提交：结构化控制请求，不是 slash command。 */
+    static CONTACT_REQUEST_SUBMIT_TYPE = 'contact.request.submit';
     // Reconnect state
     // SDK 自己跑无限指数退避（1s → 5min）；TS 层只在 SDK 够不到的两类场景下接管：
     //  1. flap：短命 connected 反复出现（SDK 不记忆跨轮 base delay，会从 1s 重新开始）
@@ -829,6 +1007,7 @@ export class AUNChannel {
     constructor(config) {
         this.config = config;
         this.agentDir = agentDirPath(config.aid);
+        this.loadInboundDedupe();
         if (config.aunTrace) {
             this.traceWriter = new LogWriter({
                 baseName: 'aun',
@@ -926,7 +1105,7 @@ export class AUNChannel {
         // gateway metadata cache when well-known is temporarily unavailable.
         const configuredGateway = this.config.gatewayUrl || '';
         logger.info(`${this.logPrefix()} Initializing: aid=${aidName}, gateway=${configuredGateway || '<sdk-discovery>'}, aun_path=${aunPath}`);
-        // 构造 AIDStore（slot=evolcore daemon，与 cli/netcheck 共享 evolcore 隔离键）
+        // 构造 AIDStore。daemon 使用独立 slot，CLI/netcheck 不能触碰业务入站游标。
         // encryptionSeed / rootCaPath 由 getAidStore 内部注入
         const store = await getAidStore({
             slotId: SLOT.daemon,
@@ -979,7 +1158,7 @@ export class AUNChannel {
                     for (const id of ids) {
                         if (typeof id === 'string') {
                             logger.info(`${this.logPrefix()} Message recalled: ${id}`);
-                            this.recallHandler?.(id);
+                            this.recallHandler?.(id, this._aid || this.config.aid);
                         }
                     }
                 }
@@ -1011,7 +1190,7 @@ export class AUNChannel {
                         for (const id of ids) {
                             if (typeof id === 'string') {
                                 logger.info(`${this.logPrefix()} Group message recalled: group=${env.group_id ?? ''} mid=${id}`);
-                                this.recallHandler?.(id);
+                                this.recallHandler?.(id, this._aid || this.config.aid);
                             }
                         }
                     }
@@ -1049,7 +1228,7 @@ export class AUNChannel {
             });
             this.trace('OUT', 'client.connect', { gateway: this.gatewayUrl, extra_info: extraInfo });
             await client.connect({
-                // connection_kind 默认 long；slot 已由 AID 携带（evolcore daemon）
+                // connection_kind 默认 long；slot 已由 AID 携带（evolcore-daemon）
                 // extra_info：互踢诊断名片（0.4.3 公开 connect 已支持透传）
                 extra_info: extraInfo,
                 // max_attempts=0 = 无限重试（与 Go/Python 对齐），交由 SDK 自己跑指数退避
@@ -1109,7 +1288,9 @@ export class AUNChannel {
             }
             const operationId = postBootstrapWelcomeOperationId(aidName);
             const chatDir = chatDirPath(resolvePaths().sessionsDir, 'aun', owner, aidName);
-            if (hasMessageLogOperation(chatDir, operationId) || outbox.findByDedupeKey(aidName, operationId)) {
+            const prepared = outbox.findByDedupeKey(aidName, operationId);
+            if (hasMessageLogOperation(chatDir, operationId)
+                || (prepared?.delivery?.chatType === 'private' && prepared.channelId === owner)) {
                 return true;
             }
             const ownerAidClean = owner.startsWith('@') ? owner.slice(1) : owner;
@@ -1138,6 +1319,14 @@ export class AUNChannel {
             return false;
         return this.reconcilePostBootstrapWelcome();
     }
+    async hasPendingPostBootstrapWelcome() {
+        const aid = this.config.aid.replace(/^@/, '');
+        return hasPendingPostBootstrapWelcomeOutbox(aid);
+    }
+    async bindPostBootstrapWelcomeToSession(sessionId) {
+        const aid = this.config.aid.replace(/^@/, '');
+        return bindPostBootstrapWelcomeOutboxSession(aid, sessionId);
+    }
     /**
      * Resume delivery of an already prepared completion welcome.
      *
@@ -1157,6 +1346,11 @@ export class AUNChannel {
             const chatDir = chatDirPath(resolvePaths().sessionsDir, 'aun', owner, aid);
             return hasMessageLogOperation(chatDir, operationId);
         }
+        if (entry.delivery?.chatType !== 'private') {
+            logger.warn(`${this.logPrefix()} Discarding unrouted legacy post-bootstrap welcome: id=${entry.id}`);
+            outbox.remove(aid, entry.id);
+            return false;
+        }
         const agentConfig = loadAgent(aid);
         if (!agentConfig || normalizeAgentLifecycle(agentConfig).lifecycle !== 'active') {
             logger.info(`${this.logPrefix()} Post-bootstrap welcome prepared; waiting for lifecycle=active`);
@@ -1180,7 +1374,7 @@ export class AUNChannel {
      * @param channelId 下载归属（私聊 fromAid / 群聊 groupId）
      * @param preCollected 已收集的附件（群聊路径会提前 collect，避免重复）
      */
-    async processAttachments(payload, baseText, channelId, preCollected) {
+    async processAttachments(payload, baseText, channelId, preCollected, delivery) {
         const rawAttachments = preCollected ?? this.collectAllAttachments(payload);
         const images = [];
         let finalText = baseText;
@@ -1189,7 +1383,7 @@ export class AUNChannel {
         }
         const fileParts = [];
         for (const att of rawAttachments) {
-            const filePath = await this.downloadAttachment(att, channelId);
+            const filePath = await this.downloadAttachment(att, channelId, delivery);
             if (!filePath)
                 continue;
             const name = sanitizeFileName(att.filename || att.object_key?.split('/').pop() || 'file');
@@ -1221,8 +1415,11 @@ export class AUNChannel {
         logger.info(`${this.logPrefix()} [attachments] count=${rawAttachments.length} images=${images.length} files=${fileParts.length}`);
         return { finalText, images };
     }
-    async downloadAttachment(att, channelId) {
-        const ownerAid = att.owner_aid || (!this.isGroupId(channelId) ? channelId : '') || this._aid || '';
+    async downloadAttachment(att, channelId, delivery) {
+        const ownerAid = att.owner_aid
+            || (delivery?.chatType === 'private' ? channelId : '')
+            || this._aid
+            || '';
         const objectKey = att.object_key;
         if (!objectKey) {
             logger.warn(`${this.logPrefix()} Attachment missing object_key, skipping`);
@@ -1394,17 +1591,27 @@ export class AUNChannel {
         if (!data || typeof data !== 'object')
             return;
         const msg = data;
+        const receivedAt = Date.now();
+        // Claim before any payload extraction or command parsing. Retransmits may
+        // carry a new seq, but the application identity remains message_id.
+        const messageId = typeof msg.message_id === 'string' ? msg.message_id : '';
+        const seq = typeof msg.seq === 'number' ? msg.seq : undefined;
+        if (!this.claimInboundMessage('private', messageId, seq))
+            return;
         // SDK 0.5.* 移除了顶层 from/to/group_id/encrypted 等别名，统一从 msg.envelope.* 读取。
         // message_id / seq / payload / same_* 等仍是顶层独立字段，不在 envelope 内。
         const env = (msg.envelope && typeof msg.envelope === 'object') ? msg.envelope : {};
         const protectedHeaders = verifiedProtectedHeaders(msg, env);
         const fromAid = env.from ?? '';
         const payload = msg.payload ?? '';
+        const mentions = this.parsePayloadMentionsOrReject(payload, 'p2p.inbound', messageId, seq);
+        if (!mentions)
+            return;
         const causationRef = payload && typeof payload === 'object' && typeof payload._evolcore_causation_ref === 'string'
             ? payload._evolcore_causation_ref
             : undefined;
         const logDescriptor = classifyAunPayloadForLog(payload);
-        const text = this.extractTextPayload(payload, fromAid, fromAid);
+        const text = this.extractTextPayload(payload, fromAid, fromAid, { chatType: 'private' });
         const threadId = typeof payload === 'object' && payload !== null ? payload.thread_id : undefined;
         const refMessageId = typeof payload === 'object' && payload !== null && typeof payload.ref_message_id === 'string'
             ? payload.ref_message_id
@@ -1413,15 +1620,19 @@ export class AUNChannel {
         const topicName = (typeof payload === 'object' && payload !== null)
             ? this.sanitizeTopicName(payload.topicName)
             : undefined;
-        const messageId = msg.message_id ?? '';
         const causation = consumeAunCausation(causationRef || messageId, fromAid, this._aid || this.config.aid)
             ?? (causationRef ? consumeAunCausation(messageId, fromAid, this._aid || this.config.aid) : undefined);
-        const seq = msg.seq;
+        const inboundType = (payload && typeof payload === 'object') ? payload.type : undefined;
+        // 终态错误只作为展示信号，不能进入 Agent，也不能被 observer 再次传播。
+        if (inboundType === 'error') {
+            this.acknowledgeImmediately(messageId, seq);
+            logger.info(`${this.logPrefix()} P2P dropped terminal error: from=${fromAid || 'unknown'} mid=${messageId}`);
+            return;
+        }
         // Observer forward (inbound)：在所有过滤之前转发原始明文 payload。
         // forwardInbound 内部排除 self-echo 与 from-owner。
         // 显式排除 observer.inject：它是 owner 对本 agent 的控制消息，不应镜像给观察者
         // （即便日后 from-owner 排除规则调整，也不会泄漏）。
-        const inboundType = (payload && typeof payload === 'object') ? payload.type : undefined;
         if (inboundType !== AUNChannel.INJECT_REQUEST_TYPE) {
             this.forwardInbound(msg);
         }
@@ -1437,13 +1648,16 @@ export class AUNChannel {
         const msgEncrypted = !!env.encrypted;
         if (!msgEncrypted)
             this.plaintextRecv++;
-        // Detect @mentions
-        const mentions = [];
-        if (this._aid && text.includes(`@${this._aid}`)) {
-            mentions.push(this._aid);
+        // Preserve structured mentions for the shared inbound message model.
+        // Text scanning remains only a rendering fallback and is not promoted to
+        // a structured @all decision.
+        if (mentions.length === 0 && this._aid && text.includes(`@${this._aid}`)) {
+            // Private channels historically exposed a self mention even when the
+            // sender omitted payload.mentions; keep that compatibility signal.
+            mentions.push({ aid: this._aid });
         }
         // Process attachments (顶层 + 嵌套在 merge.items / quote.quote 中的)
-        const { finalText, images: inboundImages } = await this.processAttachments(payload, text, fromAid);
+        const { finalText, images: inboundImages } = await this.processAttachments(payload, text, fromAid, undefined, { chatType: 'private' });
         // 私聊 channelId = 对端 AID（不再读 payload.chat_id 含 device 三段式）
         // device_id 仅 SDK 内部多实例去重用，evolcore session 层面跨端共享会话
         const chatId = fromAid;
@@ -1459,22 +1673,26 @@ export class AUNChannel {
         logger.info(`${this.logPrefix()} P2P dispatch decision: mid=${messageId} from=${shortAid}(${displayName}) peerType=${peerIdentity.type} payloadType=${p2pPayloadType} chatId=${chatId} encrypt=${msgEncrypted} textPreview=${JSON.stringify(text.slice(0, 80))}`);
         // action_card_reply 已在 extractTextPayload 中消费，不分发给 agent
         if (p2pPayloadType === 'action_card_reply') {
-            this.appendInboundPayloadJsonl(chatId, fromAid, messageId, msgEncrypted, false, logDescriptor, threadId);
+            this.appendInboundPayloadJsonl(chatId, fromAid, messageId, msgEncrypted, false, logDescriptor, threadId, receivedAt, seq);
             return;
         }
-        // menu.* 协议：自定义消息快速路径，需要原始 payload JSON 传递给 bridge
-        if (p2pPayloadType.startsWith('menu.')) {
+        // menu.* 与联系人本人状态查询：需要原始 payload JSON 传递给 bridge。
+        if (p2pPayloadType.startsWith('menu.')
+            || p2pPayloadType === AUNChannel.CONTACT_REQUEST_QUERY_TYPE
+            || p2pPayloadType === AUNChannel.CONTACT_REQUEST_SUBMIT_TYPE) {
             this.acknowledgeImmediately(messageId, seq);
-            this.appendInboundPayloadJsonl(chatId, fromAid, messageId, msgEncrypted, false, logDescriptor, threadId);
+            this.appendInboundPayloadJsonl(chatId, fromAid, messageId, msgEncrypted, false, logDescriptor, threadId, receivedAt, seq);
             this.dispatchMessage({
                 channelId: chatId, userId: fromAid,
                 text: JSON.stringify(payload),
-                chatType: 'private', messageId, seq,
+                chatType: 'private', messageId, seq, receivedAt, gatewaySeq: seq,
                 peerName: displayName || undefined,
                 peerType: peerIdentity.type,
                 encrypted: msgEncrypted,
                 protectedHeaders,
-                replyContext: this.buildGroupReplyContext(threadId, fromAid, msgEncrypted, messageId),
+                mentions,
+                mentionAids: mentionEntryAids(mentions),
+                replyContext: this.buildPrivateReplyContext(threadId, fromAid, msgEncrypted, messageId),
                 msgType: logDescriptor.msgType,
                 payloadType: logDescriptor.payloadType,
                 payloadSummary: logDescriptor.payloadSummary,
@@ -1494,14 +1712,16 @@ export class AUNChannel {
         // 透传 encrypted：bind.response 须与请求的加密/明文对称（见 onMessage 处理）。
         if (p2pPayloadType === AUNChannel.BIND_REQUEST_TYPE) {
             this.acknowledgeImmediately(messageId, seq);
-            this.appendInboundPayloadJsonl(chatId, fromAid, messageId, msgEncrypted, false, logDescriptor, threadId);
+            this.appendInboundPayloadJsonl(chatId, fromAid, messageId, msgEncrypted, false, logDescriptor, threadId, receivedAt, seq);
             this.dispatchMessage({
                 channelId: chatId, userId: fromAid,
                 text: JSON.stringify(payload),
-                chatType: 'private', messageId, seq,
+                chatType: 'private', messageId, seq, receivedAt, gatewaySeq: seq,
                 peerName: displayName || undefined,
                 peerType: peerIdentity.type,
                 encrypted: msgEncrypted,
+                mentions,
+                mentionAids: mentionEntryAids(mentions),
                 msgType: logDescriptor.msgType,
                 payloadType: logDescriptor.payloadType,
                 payloadSummary: logDescriptor.payloadSummary,
@@ -1512,7 +1732,7 @@ export class AUNChannel {
         // payload 类型白名单：信号类消息（status / event / thought 等）不进 Agent
         if (p2pPayloadType && !AUNChannel.PROACTIVE_ALLOW_TYPES.has(p2pPayloadType)) {
             this.acknowledgeImmediately(messageId, seq);
-            this.appendInboundPayloadJsonl(chatId, fromAid, messageId, msgEncrypted, false, logDescriptor, threadId);
+            this.appendInboundPayloadJsonl(chatId, fromAid, messageId, msgEncrypted, false, logDescriptor, threadId, receivedAt, seq);
             logger.info(`${this.logPrefix()} P2P dropped (type deny): type=${p2pPayloadType} from=${shortAid}(${displayName}) mid=${messageId}`);
             return;
         }
@@ -1521,24 +1741,15 @@ export class AUNChannel {
         appendAidEvent({ ts: Date.now(), iso: new Date().toISOString(), event: 'message_in', aid: this.config.aid, from: fromAid, msgId: messageId, kind: 'text', len: finalText.length });
         const isSystemP2P = p2pPayloadType === 'event';
         this.aidStatsCollector?.recordInbound(this.config.aid, fromAid, Buffer.byteLength(finalText, 'utf-8'), finalText, isSystemP2P, msgEncrypted, msgChatmode, isSystemP2P ? 'notify' : 'send');
-        const replyContext = { metadata: { encrypted: msgEncrypted, chatmode: msgChatmode, refMessageId } };
-        if (threadId)
-            replyContext.threadId = threadId;
-        replyContext.peerId = fromAid;
-        if (messageId)
-            replyContext.replyToMessageId = messageId;
-        // 协议 v2.4 §6.4/§12.1: 话题会话创建时传入 topicName
-        if (topicName && threadId) {
-            if (!replyContext.metadata)
-                replyContext.metadata = {};
-            replyContext.metadata.topicName = topicName;
-        }
+        const replyContext = this.buildPrivateReplyContext(threadId, fromAid, msgEncrypted, messageId, msgChatmode, topicName, refMessageId);
         this.dispatchMessage({
             channelId: chatId,
             userId: fromAid,
             text: finalText,
             chatType: 'private',
             messageId,
+            receivedAt,
+            gatewaySeq: seq,
             causation,
             seq,
             threadId,
@@ -1561,28 +1772,39 @@ export class AUNChannel {
         if (!data || typeof data !== 'object')
             return;
         const msg = data;
+        const receivedAt = Date.now();
+        // Deduplicate at the adapter boundary, before mention/slash routing.
+        const messageId = typeof msg.message_id === 'string' ? msg.message_id : '';
+        const seq = typeof msg.seq === 'number' ? msg.seq : undefined;
+        if (!this.claimInboundMessage('group', messageId, seq))
+            return;
         // SDK 0.5.* 移除了顶层 from/sender_aid/group_id/encrypted 等别名，统一从 msg.envelope.* 读取。
-        // message_id / seq / payload / same_* / dispatch_mode 等仍是顶层独立字段，不在 envelope 内。
+        // message_id / seq / payload / same_* / mention_mode 等仍是顶层独立字段，不在 envelope 内。
         const env = (msg.envelope && typeof msg.envelope === 'object') ? msg.envelope : {};
         const protectedHeaders = verifiedProtectedHeaders(msg, env);
         const groupId = env.group_id ?? '';
         const senderAid = env.from ?? '';
         const payload = msg.payload ?? '';
+        const payloadMentionEntries = this.parsePayloadMentionsOrReject(payload, 'group.inbound', messageId, seq);
+        if (!payloadMentionEntries)
+            return;
+        const payloadMentionAids = mentionEntryAids(payloadMentionEntries);
         const logDescriptor = classifyAunPayloadForLog(payload);
-        const text = this.extractTextPayload(payload, groupId, senderAid);
+        const text = this.extractTextPayload(payload, groupId, senderAid, { chatType: 'group', groupId });
         const threadId = typeof payload === 'object' && payload !== null ? payload.thread_id : undefined;
         const topicName = (typeof payload === 'object' && payload !== null)
             ? this.sanitizeTopicName(payload.topicName)
             : undefined;
-        const messageId = msg.message_id ?? '';
-        const seq = msg.seq;
+        const inboundType = (payload && typeof payload === 'object') ? payload.type : undefined;
+        // 终态错误只作为展示信号，不能进入 Agent，也不能被 observer 再次传播。
+        if (inboundType === 'error') {
+            this.acknowledgeImmediately(messageId, seq);
+            logger.info(`${this.logPrefix()} Group dropped terminal error: group=${groupId || 'unknown'} sender=${senderAid || 'unknown'} mid=${messageId}`);
+            return;
+        }
         // Observer forward (inbound)：群聊消息在所有过滤之前转发原始明文 payload。
         // forwardInbound 内部排除 self-echo 与 from-owner。
         this.forwardInbound(msg);
-        // Extract structured mentions from payload (e.g. payload.mentions: ["evolai.agentid.pub"])
-        const payloadMentions = Array.isArray(payload?.mentions)
-            ? payload.mentions.filter((m) => typeof m === 'string')
-            : [];
         logger.debug(`${this.logPrefix()}[DIAG-GRP] full_msg=${JSON.stringify(msg).substring(0, 500)}`);
         if (!groupId || !senderAid) {
             this.acknowledgeImmediately(messageId, seq);
@@ -1624,7 +1846,7 @@ export class AUNChannel {
                     peerName: displayName,
                     peerType: peerInfo?.type || 'unknown',
                     seq,
-                    replyContext: this.buildGroupReplyContext(threadId, senderAid, msgEncryptedFast, messageId, msgChatmodeFast, topicName),
+                    replyContext: this.buildGroupReplyContext(threadId, senderAid, msgEncryptedFast, messageId, msgChatmodeFast, topicName, groupId),
                     createdAt,
                 });
                 return;
@@ -1634,7 +1856,7 @@ export class AUNChannel {
         {
             const payloadType = (payload && typeof payload === 'object') ? payload.type ?? '' : '';
             if (payloadType === 'action_card_reply') {
-                this.appendInboundPayloadJsonl(groupId, senderAid, messageId, !!env.encrypted, true, logDescriptor, threadId);
+                this.appendInboundPayloadJsonl(groupId, senderAid, messageId, !!env.encrypted, true, logDescriptor, threadId, receivedAt, seq);
                 return;
             }
         }
@@ -1647,14 +1869,18 @@ export class AUNChannel {
             if (payloadType.startsWith('menu.')) {
                 const menuEncrypted = !!env.encrypted;
                 this.acknowledgeImmediately(messageId, seq);
-                this.appendInboundPayloadJsonl(groupId, senderAid, messageId, menuEncrypted, true, logDescriptor, threadId);
+                this.appendInboundPayloadJsonl(groupId, senderAid, messageId, menuEncrypted, true, logDescriptor, threadId, receivedAt, seq);
                 this.dispatchMessage({
                     channelId: groupId, userId: senderAid,
                     text: JSON.stringify(payload),
-                    chatType: 'group', messageId, seq, groupId,
+                    chatType: 'group', messageId, seq, receivedAt, gatewaySeq: seq, groupId,
                     encrypted: menuEncrypted,
                     protectedHeaders,
-                    replyContext: this.buildGroupReplyContext(threadId, senderAid, menuEncrypted, messageId, payloadObj?.chatmode, topicName),
+                    mentions: payloadMentionEntries,
+                    mentionAids: payloadMentionAids,
+                    isMentioned: hasMentionAll(payloadMentionEntries)
+                        || (!!this._aid && mentionEntryTargets(payloadMentionEntries).includes(this._aid)),
+                    replyContext: this.buildGroupReplyContext(threadId, senderAid, menuEncrypted, messageId, payloadObj?.chatmode, topicName, groupId),
                     msgType: logDescriptor.msgType,
                     payloadType: logDescriptor.payloadType,
                     payloadSummary: logDescriptor.payloadSummary,
@@ -1664,7 +1890,7 @@ export class AUNChannel {
             }
             if (payloadType && !AUNChannel.PROACTIVE_ALLOW_TYPES.has(payloadType)) {
                 this.acknowledgeImmediately(messageId, seq);
-                this.appendInboundPayloadJsonl(groupId, senderAid, messageId, !!env.encrypted, true, logDescriptor, threadId);
+                this.appendInboundPayloadJsonl(groupId, senderAid, messageId, !!env.encrypted, true, logDescriptor, threadId, receivedAt, seq);
                 logger.info(`${this.logPrefix()} Group dropped (type deny): type=${payloadType} group=${groupId} sender=${senderAid} mid=${messageId}`);
                 return;
             }
@@ -1673,17 +1899,17 @@ export class AUNChannel {
         const msgEncrypted = !!env.encrypted;
         if (!msgEncrypted)
             this.plaintextRecv++;
-        // dispatch_mode: 本地设置优先，fallback 到服务器参数
-        const serverDispatchMode = msg.dispatch_mode ?? payload?.dispatch_mode ?? 'mention';
-        const localDispatchMode = this.dispatchModeResolver
-            ? await this.dispatchModeResolver(groupId).catch(() => undefined)
-            : undefined;
-        const dispatchMode = localDispatchMode || serverDispatchMode;
-        const mentionedSelf = this._aid
-            ? (this.hasExplicitMention(text, this._aid) || payloadMentions.includes(this._aid))
-            : false;
-        // @all 仅认结构化 mentions（payload.mentions），不扫描正文 — 避免引述性 "@all" 误判
-        const mentionedAll = payloadMentions.includes('all');
+        // mention_mode 是唯一的服务端群 @ 策略字段；缺失/非法时使用协议内置默认 disabled。
+        const serverMentionMode = normalizeMentionMode(msg.mention_mode)
+            ?? normalizeMentionMode(payload?.mention_mode)
+            ?? 'disabled';
+        const localMentionMode = normalizeMentionMode(this.mentionModeResolver
+            ? await this.mentionModeResolver(groupId).catch(() => undefined)
+            : undefined);
+        const mentionMode = localMentionMode ?? serverMentionMode;
+        const mentionedSelf = !!this._aid && mentionEntryTargets(payloadMentionEntries).includes(this._aid);
+        // @all 仅认结构化 mentions（payload.mentions），不扫描正文，避免引述性 "@all" 误判。
+        const mentionedAll = hasMentionAll(payloadMentionEntries);
         // Echo 机制优先于 mention 过滤：消息第一行包含 echo 时触发
         // 包含 [EvolCore.xxx] trace 说明已被本系统处理过，是回声的回声，丢弃防止链式爆炸
         const firstLineGroup = text.split('\n')[0] || '';
@@ -1705,7 +1931,7 @@ export class AUNChannel {
             this.pendingEchoMessages.set(messageId, {
                 text: echoText,
                 channelId: groupId,
-                context: this.buildGroupReplyContext(undefined, senderAid, msgEncrypted, messageId, msgChatmodeEcho, undefined),
+                context: this.buildGroupReplyContext(undefined, senderAid, msgEncrypted, messageId, msgChatmodeEcho, undefined, groupId),
                 receiveTs: Date.now(),
             });
             // 继续走正常 Agent 流程（下面的代码会 dispatch）
@@ -1718,16 +1944,17 @@ export class AUNChannel {
         }
         else {
             // 非 echo 消息：mention 标记（不再过滤，交给响应模式决定）
-            // 命令豁免 broadcast：slash 命令在任何 dispatchMode 下都强制走 mention 语义，
+            // slash 命令在任何 mentionMode 下都强制走 mention-only 语义
             // 即必须 @ 本 agent（或 @all）才处理，避免广播群里一条命令被全部 agent 各自执行。
-            const enforceMention = dispatchMode === 'mention' || isCommandMsg;
+            const enforceMention = mentionMode === 'mention-only' || isCommandMsg;
             const isMentioned = mentionedSelf || mentionedAll;
             // 过滤逻辑下移到响应层：这里只标记，不过滤
             // 但为了保持现有行为兼容（避免大量未 @ 消息涌入），暂时保留过滤
             // TODO: Phase 6 实施 selective-response 模式后，移除此过滤，只保留 isMentioned 标记
             if (enforceMention && !isMentioned && !isOwnHandoff) {
                 this.acknowledgeImmediately(messageId, seq);
-                logger.info(`${this.logPrefix()} Group dropped: unmentioned (group=${groupId} sender=${senderAid} mid=${messageId} mode=${dispatchMode} isCommand=${isCommandMsg} textPreview=${JSON.stringify(text.slice(0, 80))})`);
+                this.appendInboundPayloadJsonl(groupId, senderAid, messageId, msgEncrypted, true, logDescriptor, threadId, receivedAt, seq);
+                logger.info(`${this.logPrefix()} Group dropped: unmentioned (group=${groupId} sender=${senderAid} mid=${messageId} mentionMode=${mentionMode} isCommand=${isCommandMsg} textPreview=${JSON.stringify(text.slice(0, 80))})`);
                 return;
             }
         }
@@ -1745,11 +1972,9 @@ export class AUNChannel {
             logger.debug(`${this.logPrefix()} Group dropped: empty text and no attachments (group=${groupId} sender=${senderAid} mid=${messageId})`);
             return;
         }
-        const mentions = mentionedAll
-            ? ['all']
-            : mentionedSelf && this._aid ? [this._aid] : [];
+        const mentions = payloadMentionEntries;
         // Process attachments
-        const { finalText, images: inboundImages } = await this.processAttachments(payload, strippedText, groupId, rawAttachments);
+        const { finalText, images: inboundImages } = await this.processAttachments(payload, strippedText, groupId, rawAttachments, { chatType: 'group', groupId });
         const selfAgentDir = path.join(resolvePaths().agentsDir, this.config.aid);
         const peerIdentity = await PeerIdentityCache.resolve('aun', senderAid, selfAgentDir, this.store, false);
         const shortAid = this.getShortAid(senderAid);
@@ -1758,27 +1983,27 @@ export class AUNChannel {
         const payloadType = (payload && typeof payload === 'object') ? payload.type ?? '' : '';
         const textMentionSelf = this._aid ? this.hasExplicitMention(text, this._aid) : false;
         const textMentionAll = this.hasExplicitMention(text, 'all');
-        const structMentionSelf = this._aid ? payloadMentions.includes(this._aid) : false;
-        const structMentionAll = payloadMentions.includes('all');
+        const structMentionSelf = this._aid ? payloadMentionAids.includes(this._aid) : false;
+        const structMentionAll = mentionedAll;
         const reason = isOwnHandoff
             ? 'handoff.self'
             : mentionedAll
                 ? 'mention.all(struct)'
                 : mentionedSelf
                     ? (structMentionSelf ? 'mention.self(struct)' : 'mention.self(text)')
-                    : `${dispatchMode}.no-mention`;
-        logger.info(`${this.logPrefix()} Group dispatch decision: mid=${messageId} group=${groupId} sender=${shortAid}(${displayName}) peerType=${peerIdentity.type} payloadType=${payloadType} dispatchMode=${dispatchMode} reason=${reason} structMentions=${JSON.stringify(payloadMentions)} textMentionSelf=${textMentionSelf} textMentionAll=${textMentionAll} structMentionSelf=${structMentionSelf} structMentionAll=${structMentionAll} encrypt=${msgEncrypted} textPreview=${JSON.stringify(text.slice(0, 80))}`);
+                    : `${mentionMode}.no-mention`;
+        logger.info(`${this.logPrefix()} Group mention decision: mid=${messageId} group=${groupId} sender=${shortAid}(${displayName}) peerType=${peerIdentity.type} payloadType=${payloadType} mentionMode=${mentionMode} reason=${reason} structMentions=${JSON.stringify(payloadMentionEntries)} textMentionSelf=${textMentionSelf} textMentionAll=${textMentionAll} structMentionSelf=${structMentionSelf} structMentionAll=${structMentionAll} encrypt=${msgEncrypted} textPreview=${JSON.stringify(text.slice(0, 80))}`);
         // action_card_reply 已在 extractTextPayload 中消费，不分发给 agent
         if (payloadType === 'action_card_reply')
             return;
         const msgChatmode = (payload && typeof payload === 'object') ? payload.chatmode : undefined;
-        logger.info(`${this.logPrefix()} Group dispatched: group=${groupId} sender=${shortAid}(${displayName}) mode=${dispatchMode} mid=${messageId} chatmode=${msgChatmode ?? 'none'} text=${finalText.slice(0, 60)}`);
+        logger.info(`${this.logPrefix()} Group dispatched: group=${groupId} sender=${shortAid}(${displayName}) mentionMode=${mentionMode} mid=${messageId} chatmode=${msgChatmode ?? 'none'} text=${finalText.slice(0, 60)}`);
         appendAidEvent({ ts: Date.now(), iso: new Date().toISOString(), event: 'message_in', aid: this.config.aid, from: senderAid, msgId: messageId, kind: 'text', len: finalText.length, groupId });
         this.aidStatsCollector?.recordInbound(this.config.aid, senderAid, Buffer.byteLength(finalText, 'utf-8'), finalText, payloadType === 'event', msgEncrypted, msgChatmode, payloadType === 'event' ? 'notify' : 'send');
         // 渲染用完整 @ 列表：结构化 payload.mentions + 正文 @aid 兜底，去重（含 self / "all"）。
         // 与上面用于过滤/回复的精简 mentions 独立——这份不丢任何被 @ 的 AID。
         const renderMentionAids = Array.from(new Set([
-            ...payloadMentions,
+            ...payloadMentionAids,
             ...this.extractMentionAidsFromText(text),
         ]));
         this.dispatchMessage({
@@ -1793,6 +2018,8 @@ export class AUNChannel {
             text: finalText,
             chatType: 'group',
             messageId,
+            receivedAt,
+            gatewaySeq: seq,
             seq,
             threadId,
             mentions,
@@ -1800,8 +2027,8 @@ export class AUNChannel {
             isMentioned: isOwnHandoff || mentionedSelf || mentionedAll,
             source: isOwnHandoff ? 'handoff' : undefined,
             encrypted: msgEncrypted,
-            replyContext: this.buildGroupReplyContext(threadId, senderAid, msgEncrypted, messageId, msgChatmode, topicName),
-            dispatchMode: serverDispatchMode,
+            replyContext: this.buildGroupReplyContext(threadId, senderAid, msgEncrypted, messageId, msgChatmode, topicName, groupId),
+            mentionMode: serverMentionMode,
             images: inboundImages.length > 0 ? inboundImages : undefined,
             msgType: logDescriptor.msgType,
             payloadType: logDescriptor.payloadType,
@@ -1810,17 +2037,22 @@ export class AUNChannel {
         });
     }
     dispatchMessage(event) {
-        // Dedup
-        if (event.messageId) {
-            if (this.seenMessages.has(event.messageId))
-                return;
-            this.seenMessages.set(event.messageId, Date.now());
-            setTimeout(() => this.seenMessages.delete(event.messageId), 5 * 60 * 1000);
-            // Track seq for acknowledge
-            if (event.seq != null) {
-                this.messageSeqMap.set(event.messageId, event.seq);
-            }
-        }
+        const authenticatedDelivery = event.chatType === 'group'
+            ? { chatType: 'group', groupId: event.groupId ?? event.channelId }
+            : { chatType: 'private' };
+        const suppliedDelivery = event.replyContext?.delivery;
+        const suppliedMatches = suppliedDelivery?.chatType === 'private'
+            ? authenticatedDelivery.chatType === 'private'
+            : suppliedDelivery?.chatType === 'group'
+                && authenticatedDelivery.chatType === 'group'
+                && suppliedDelivery.groupId === authenticatedDelivery.groupId;
+        const delivery = suppliedDelivery && suppliedMatches ? suppliedDelivery : authenticatedDelivery;
+        if (suppliedDelivery && delivery !== suppliedDelivery) {
+            logger.warn(`${this.logPrefix()} Ignoring mismatched inbound reply route: channel=${event.channelId} chatType=${event.chatType}`);
+        }
+        // Inbound events are claimed in handleIncomingPrivateMessage / GroupMessage
+        // before parsing. Keeping dedupe there prevents duplicate slash commands
+        // from reaching routing and mention policy code.
         // Echo 机制：消息第一行包含 "echo"（不区分大小写）且原始内容 ≤10 字符时，直接回声
         // 包含 [EvolCore.xxx] trace 说明已被本系统处理过，是回声的回声，丢弃防止链式爆炸
         const firstLine = event.text.split('\n')[0] || '';
@@ -1845,20 +2077,24 @@ export class AUNChannel {
             this.pendingEchoMessages.set(event.messageId, {
                 text: echoText,
                 channelId: event.channelId,
-                context: event.replyContext ? { metadata: event.replyContext.metadata } : undefined,
+                context: {
+                    ...(event.replyContext?.metadata ? { metadata: event.replyContext.metadata } : {}),
+                    delivery,
+                },
                 receiveTs: Date.now(),
             });
             logger.info(`${this.logPrefix()} [Echo] long echo stored: mid=${event.messageId} channelId=${event.channelId}`);
         }
         if (!this.messageHandler)
             return;
-        const mentionObjects = event.mentions?.map(aid => ({ userId: aid }));
-        // Use caller-supplied replyContext (group path builds mentionUserIds);
-        // fall back to simple threadId-only context for private messages
-        let replyContext = event.replyContext;
-        if (!replyContext && event.threadId) {
-            replyContext = { threadId: event.threadId };
-        }
+        // Preserve the caller-supplied context (group paths add mention fields),
+        // but always attach the route derived from this authenticated event when
+        // a synthetic/test event omitted it. Never infer the route from the AID.
+        const replyContext = {
+            ...(event.replyContext ?? {}),
+            delivery,
+            ...(event.threadId && !event.replyContext?.threadId ? { threadId: event.threadId } : {}),
+        };
         this.messageHandler({
             channelId: event.channelId || '',
             channelType: 'aun',
@@ -1875,14 +2111,16 @@ export class AUNChannel {
             encrypted: event.encrypted,
             protectedHeaders: event.protectedHeaders,
             messageId: event.messageId,
+            receivedAt: event.receivedAt,
+            gatewaySeq: event.gatewaySeq ?? event.seq,
             causation: event.causation,
             threadId: event.threadId,
-            mentions: mentionObjects,
+            mentions: event.mentions,
             mentionAids: event.mentionAids,
             isMentioned: event.isMentioned, // ← 新增：传递 isMentioned 标记
             replyContext,
             source: event.source,
-            dispatchMode: event.dispatchMode,
+            mentionMode: event.mentionMode,
             images: event.images,
             msgType: event.msgType,
             payloadType: event.payloadType,
@@ -1892,7 +2130,7 @@ export class AUNChannel {
             logger.error(`${this.logPrefix()} Message handler error:`, err);
         });
     }
-    appendInboundPayloadJsonl(channelId, fromAid, msgId, encrypt, isGroup, descriptor, threadId) {
+    appendInboundPayloadJsonl(channelId, fromAid, msgId, encrypt, isGroup, descriptor, threadId, receivedAt, gatewaySeq) {
         try {
             const chatDir = chatDirPath(resolvePaths().sessionsDir, 'aun', channelId, this.config.aid);
             appendMessageLog(chatDir, buildInboundEntry({
@@ -1907,6 +2145,9 @@ export class AUNChannel {
                 msgType: descriptor.msgType,
                 payloadType: descriptor.payloadType,
                 payloadSummary: descriptor.payloadSummary,
+                timestamp: receivedAt,
+                receivedAt,
+                gatewaySeq,
             }));
         }
         catch (e) {
@@ -2110,7 +2351,14 @@ export class AUNChannel {
         }
         const replyTarget = event.channelId;
         // 不传 peerId,避免 sendMessage 在头部追加 @peer
-        const context = { threadId: event.threadId, metadata: event.replyContext?.metadata };
+        const authenticatedDelivery = event.chatType === 'group'
+            ? { chatType: 'group', groupId: event.channelId }
+            : { chatType: 'private' };
+        const context = {
+            threadId: event.threadId,
+            metadata: event.replyContext?.metadata,
+            delivery: authenticatedDelivery,
+        };
         const sendStart = Date.now();
         this.isEchoSending = true;
         this.sendMessage(replyTarget, echoText, context).then(() => {
@@ -2421,8 +2669,8 @@ export class AUNChannel {
     onMessage(handler) {
         this.messageHandler = handler;
     }
-    setDispatchModeResolver(resolver) {
-        this.dispatchModeResolver = resolver;
+    setMentionModeResolver(resolver) {
+        this.mentionModeResolver = resolver;
     }
     onRecall(handler) {
         this.recallHandler = handler;
@@ -2511,19 +2759,38 @@ export class AUNChannel {
             finalPayload.chatmode = context.metadata.chatmode;
         return finalPayload;
     }
+    /**
+     * Validate the AUN-specific structured field before it crosses the durable
+     * send boundary. Return a copy when mentions are present so callers do not
+     * retain an unvalidated array reference.
+     */
+    normalizeAunPayloadMentions(payload) {
+        if (!payload || typeof payload !== 'object' || Array.isArray(payload))
+            return payload;
+        if (!Object.prototype.hasOwnProperty.call(payload, 'mentions'))
+            return payload;
+        return {
+            ...payload,
+            mentions: normalizeAunMentionEntries(payload.mentions),
+        };
+    }
     rememberInvalidatedInteraction(interactionId, reason) {
         this.invalidatedInteractions.set(interactionId, reason);
         const timer = setTimeout(() => this.invalidatedInteractions.delete(interactionId), 24 * 60 * 60 * 1000);
         timer.unref?.();
     }
-    async recallInteractionCard(messageId, channelId) {
+    async recallInteractionCard(messageId, channelId, delivery) {
         if (!this.client || !this.connected)
             return false;
         try {
-            const isGroup = channelId ? this.isGroupId(channelId) : false;
+            if (!channelId || !delivery) {
+                logger.warn(`${this.logPrefix()} Cannot recall interaction card without trusted delivery route: mid=${messageId}`);
+                return false;
+            }
+            const isGroup = delivery.chatType === 'group';
             const method = isGroup ? 'group.recall' : 'message.recall';
             const params = isGroup
-                ? { group_id: channelId, message_ids: [messageId] }
+                ? { group_id: delivery.groupId, message_ids: [messageId] }
                 : { message_ids: [messageId] };
             await this.callAndTrace(method, params, { silentError: true });
             return true;
@@ -2546,9 +2813,10 @@ export class AUNChannel {
         }
         const messageIds = [...(this.interactionCardMessageIds.get(interactionId) ?? [])];
         for (const messageId of messageIds) {
-            const channelId = this.cardMessageIdMap.get(messageId)?.channelId;
+            const card = this.cardMessageIdMap.get(messageId);
+            const channelId = card?.channelId;
             this.forgetInteractionCard(messageId, interactionId);
-            await this.recallInteractionCard(messageId, channelId);
+            await this.recallInteractionCard(messageId, channelId, card?.delivery);
         }
     }
     forgetInteractionCard(messageId, interactionId) {
@@ -2558,7 +2826,7 @@ export class AUNChannel {
         if (ids && ids.size === 0)
             this.interactionCardMessageIds.delete(interactionId);
     }
-    registerCardPostSend(messageId, action, channelId) {
+    registerCardPostSend(messageId, action, channelId, delivery) {
         if (action.type !== 'register_interaction_card')
             return;
         this.cardMessageIdMap.set(messageId, {
@@ -2566,6 +2834,7 @@ export class AUNChannel {
             isCommandCard: action.isCommandCard,
             initiatorAid: action.initiatorAid,
             channelId,
+            delivery: delivery ?? action.delivery,
         });
         this.ownedCardMsgIds.add(messageId);
         let messageIds = this.interactionCardMessageIds.get(action.requestId);
@@ -2591,20 +2860,31 @@ export class AUNChannel {
         const invalidationReason = this.invalidatedInteractions.get(action.requestId);
         if (invalidationReason) {
             this.cardMessageIdMap.delete(messageId);
-            void this.recallInteractionCard(messageId, channelId);
+            void this.recallInteractionCard(messageId, channelId, delivery ?? action.delivery);
         }
     }
     runPostSend(entry, messageId) {
         if (!entry.postSend)
             return;
         if (entry.postSend.type === 'register_interaction_card') {
-            this.registerCardPostSend(messageId, entry.postSend, entry.channelId);
+            this.registerCardPostSend(messageId, entry.postSend, entry.channelId, entry.delivery);
         }
     }
     async sendAunPayload(channelId, payload, context, label) {
+        const delivery = this.requireDelivery(channelId, context);
+        let normalizedPayload;
+        try {
+            normalizedPayload = this.normalizeAunPayloadMentions(payload);
+        }
+        catch (error) {
+            const detail = error instanceof Error ? error.message : String(error);
+            const code = error?.code ?? 'INVALID_MENTION_SCHEMA';
+            logger.error(`${this.logPrefix()} Dropped durable AUN payload: invalid payload.mentions (${detail}) code=${code} channel=${channelId}`);
+            return { ok: false, discarded: true };
+        }
         if (!this.client || !this.connected)
             return { ok: false };
-        const isGroup = this.isGroupId(channelId);
+        const isGroup = delivery.chatType === 'group';
         const targetAid = channelId;
         const encryptTarget = isGroup ? channelId : targetAid;
         const encrypt = context?.metadata?.encrypted != null
@@ -2616,13 +2896,13 @@ export class AUNChannel {
         if (causationRef && causation)
             registerAunCausation(causationRef, this.config.aid, targetAid, causation);
         const payloadWithCausationRef = causationRef
-            ? { ...payload, _evolcore_causation_ref: causationRef }
-            : payload;
+            ? { ...normalizedPayload, _evolcore_causation_ref: causationRef }
+            : normalizedPayload;
         // Truncate payload if too large (AUN SDK limit: 1MB)
         const truncatedPayload = this.truncatePayloadIfNeeded(payloadWithCausationRef, label);
         const params = { payload: truncatedPayload, encrypt };
         if (isGroup)
-            params.group_id = channelId;
+            params.group_id = delivery.groupId;
         else
             params.to = targetAid;
         const callOnce = async (sendParams, fallback) => {
@@ -2692,6 +2972,11 @@ export class AUNChannel {
         this.forwardOutbound(result);
     }
     async sendContentPayload(channelId, payload, opts) {
+        const delivery = this.requireDelivery(channelId, opts.context);
+        const context = this.withDelivery(opts.context, delivery);
+        // Validate the caller's raw mentions before any early-return policy (such
+        // as a cancelled interaction) can hide a malformed wire payload.
+        const validatedPayload = this.normalizeAunPayloadMentions(payload);
         const interactionId = opts.postSend?.type === 'register_interaction_card'
             ? opts.postSend.requestId
             : undefined;
@@ -2699,14 +2984,20 @@ export class AUNChannel {
             logger.info(`${this.logPrefix()} Dropped invalidated interaction before durable enqueue: request=${interactionId}`);
             return {};
         }
-        const finalPayload = this.applyReplyContextToPayload(payload, opts.context);
+        // Validate before write-ahead enqueue. Invalid AUN payloads must not be
+        // hidden in the outbox and emitted later after a reconnect.
+        // Validate the caller's raw mentions before deep-cleaning: that helper
+        // intentionally removes undefined array elements, which would otherwise
+        // turn malformed `mentions: [undefined]` into an apparently valid `[]`.
+        const finalPayload = this.normalizeAunPayloadMentions(this.applyReplyContextToPayload(validatedPayload, context));
         const logText = opts.logText ?? this.payloadLogText(finalPayload, opts.contentKind);
         const entry = outbox.enqueue(this.config.aid, {
             channelId,
+            delivery,
             type: 'payload',
             contentKind: opts.contentKind,
             payload: finalPayload,
-            context: opts.context,
+            context,
             logText,
             ttl: opts.ttl,
             postSend: opts.postSend,
@@ -2853,19 +3144,39 @@ export class AUNChannel {
             logger.warn(`${this.logPrefix()} Attempted to send empty message, skipping`);
             return;
         }
+        const delivery = this.requireDelivery(channelId, context);
+        const routedContext = this.withDelivery(context, delivery);
         // 长 echo: agent 首次回复前先发 echo trace（echo 自身发送时跳过）
         if (!this.isEchoSending) {
-            await this.flushPendingEcho(channelId);
+            await this.flushPendingEcho(channelId, delivery);
         }
         let finalText = text;
         this.sentCount.set(channelId, (this.sentCount.get(channelId) || 0) + 1);
-        if (this.isGroupId(channelId) && context?.peerId) {
-            if (!finalText.includes(`@${context.peerId}`)) {
-                finalText = `@${context.peerId} ` + finalText;
+        if (delivery.chatType === 'group') {
+            const requestedMentions = Array.from(new Set((context?.mentionUserIds ?? [])
+                .filter((id) => typeof id === 'string' && id.trim().length > 0)
+                .map(id => id.trim())));
+            // AUN's textual representation gives @all precedence over individual
+            // targets, matching the cross-channel mention contract.
+            const textMentionsAll = this.hasExplicitMention(finalText, 'all');
+            const mentionTargets = requestedMentions.includes('all') || textMentionsAll
+                ? ['all']
+                : requestedMentions;
+            if (mentionTargets.length > 0) {
+                for (const target of mentionTargets.reverse()) {
+                    if (!this.hasExplicitMention(finalText, target)) {
+                        finalText = `@${target} ` + finalText;
+                    }
+                }
+            }
+            else if (context?.peerId && !context.suppressPeerMention && !textMentionsAll) {
+                if (!this.hasExplicitMention(finalText, context.peerId)) {
+                    finalText = `@${context.peerId} ` + finalText;
+                }
             }
         }
-        const operationId = typeof context?.metadata?.operationId === 'string'
-            ? context.metadata.operationId
+        const operationId = typeof routedContext.metadata?.operationId === 'string'
+            ? routedContext.metadata.operationId
             : undefined;
         if (operationId) {
             const chatDir = chatDirPath(resolvePaths().sessionsDir, 'aun', channelId, this.config.aid);
@@ -2875,13 +3186,14 @@ export class AUNChannel {
         // Write-ahead: persist to outbox before attempting send
         const entry = outbox.enqueue(this.config.aid, {
             channelId,
+            delivery,
             dedupeKey: operationId,
-            critical: context?.metadata?.criticalDelivery === true,
+            critical: routedContext.metadata?.criticalDelivery === true,
             type: 'text',
             text: finalText,
-            context,
-            ttl: typeof context?.metadata?.outboxTtl === 'number'
-                ? context.metadata.outboxTtl
+            context: routedContext,
+            ttl: typeof routedContext.metadata?.outboxTtl === 'number'
+                ? routedContext.metadata.outboxTtl
                 : undefined,
         });
         logger.debug(`${this.logPrefix()} Outbox enqueued: id=${entry.id} channel=${channelId} text=${finalText.slice(0, 40)}`);
@@ -2905,16 +3217,27 @@ export class AUNChannel {
     }
     /** Daemon-side transport for `ec msg send` running inside an agent task. */
     async sendDaemonMsg(args) {
-        if (!this.connected || !this.client) {
-            return { ok: false, error: 'AUN channel is not connected', code: 'AUN_NOT_CONNECTED' };
-        }
-        if (!args.to || this.isGroupId(args.to)) {
-            return { ok: false, error: 'aun-msg-send only supports private AID targets', code: 'UNSUPPORTED_TARGET' };
+        if (!args.to) {
+            return { ok: false, error: 'aun-msg-send requires a private target', code: 'UNSUPPORTED_TARGET' };
         }
         if (!args.payload || typeof args.payload !== 'object' || Array.isArray(args.payload)) {
             return { ok: false, error: 'payload must be an object', code: 'INVALID_PAYLOAD' };
         }
-        const finalPayload = this.stripUndefinedDeep({ ...args.payload });
+        let finalPayload;
+        try {
+            const validatedPayload = this.normalizeAunPayloadMentions(args.payload);
+            finalPayload = this.stripUndefinedDeep(validatedPayload);
+        }
+        catch (e) {
+            return {
+                ok: false,
+                error: e?.message || String(e),
+                code: e?.code,
+            };
+        }
+        if (!this.connected || !this.client) {
+            return { ok: false, error: 'AUN channel is not connected', code: 'AUN_NOT_CONNECTED' };
+        }
         const info = await this.fetchPeerInfo(args.to);
         const chatmode = info.type === 'human' ? 'interactive' : 'proactive';
         if (!finalPayload.chatmode)
@@ -3019,20 +3342,34 @@ export class AUNChannel {
     }
     /** Daemon-side transport for `ec group send` running inside an agent task. */
     async sendDaemonGroupMsg(args) {
-        if (!this.connected || !this.client) {
-            return { ok: false, error: 'AUN channel is not connected', code: 'AUN_NOT_CONNECTED' };
-        }
-        if (!args.groupId || !this.isGroupId(args.groupId)) {
-            return { ok: false, error: 'aun-msg-send requires a valid group target', code: 'UNSUPPORTED_TARGET' };
+        if (!args.groupId) {
+            return { ok: false, error: 'aun group send requires a group target', code: 'UNSUPPORTED_TARGET' };
         }
         if (!args.payload || typeof args.payload !== 'object' || Array.isArray(args.payload)) {
             return { ok: false, error: 'payload must be an object', code: 'INVALID_PAYLOAD' };
         }
-        const finalPayload = this.stripUndefinedDeep({ ...args.payload });
-        if (args.mentions?.length)
-            finalPayload.mentions = args.mentions;
-        const encrypt = args.encrypt ?? this.shouldEncrypt(args.groupId);
         try {
+            // Validate before deep-cleaning so undefined entries cannot be silently
+            // removed from a malformed mentions array.
+            const validatedPayload = this.normalizeAunPayloadMentions(args.payload);
+            const finalPayload = this.stripUndefinedDeep(validatedPayload);
+            const payloadMentions = Object.prototype.hasOwnProperty.call(finalPayload, 'mentions')
+                ? normalizeAunMentionEntries(finalPayload.mentions)
+                : undefined;
+            if (args.mentions !== undefined) {
+                const normalizedMentions = normalizeAunMentionEntries(args.mentions);
+                if (normalizedMentions.length > 0)
+                    finalPayload.mentions = normalizedMentions;
+                else if (payloadMentions !== undefined)
+                    finalPayload.mentions = payloadMentions;
+            }
+            else if (payloadMentions !== undefined) {
+                finalPayload.mentions = payloadMentions;
+            }
+            if (!this.connected || !this.client) {
+                return { ok: false, error: 'AUN channel is not connected', code: 'AUN_NOT_CONNECTED' };
+            }
+            const encrypt = args.encrypt ?? this.shouldEncrypt(args.groupId);
             const result = await this.callAndTrace('group.send', {
                 group_id: args.groupId,
                 payload: this.truncatePayloadIfNeeded(finalPayload, 'group-send-ipc'),
@@ -3090,7 +3427,7 @@ export class AUNChannel {
             return { ok: false, error: e?.message || String(e), code: e?.code };
         }
     }
-    async flushPendingEcho(channelId) {
+    async flushPendingEcho(channelId, delivery) {
         // 查找该 channelId 是否有 pending echo（长 echo 等待 agent 首次回复）
         for (const [key, echo] of this.pendingEchoMessages) {
             if (echo.channelId === channelId) {
@@ -3114,18 +3451,32 @@ export class AUNChannel {
                         ts: Date.now(),
                         aid: this.config.aid,
                         channelId,
+                        delivery,
                         type: 'text',
                         text: echoText,
+                        context: this.withDelivery(echo.context, delivery),
                         ttl: 300_000,
                     };
                     const ok = await this.deliverTextEntry(echoEntry);
                     if (!ok) {
-                        outbox.enqueue(this.config.aid, { channelId, type: 'text', text: echoText });
+                        outbox.enqueue(this.config.aid, {
+                            channelId,
+                            delivery,
+                            type: 'text',
+                            text: echoText,
+                            context: this.withDelivery(echo.context, delivery),
+                        });
                     }
                     logger.info(`${this.logPrefix()} [Echo] long echo trace delivered=${ok} to ${channelId} (agent ${agentDuration}ms)`);
                 }
                 else {
-                    outbox.enqueue(this.config.aid, { channelId, type: 'text', text: echoText });
+                    outbox.enqueue(this.config.aid, {
+                        channelId,
+                        delivery,
+                        type: 'text',
+                        text: echoText,
+                        context: this.withDelivery(echo.context, delivery),
+                    });
                     logger.warn(`${this.logPrefix()} [Echo] not connected, echo trace queued in outbox`);
                 }
                 break;
@@ -3135,7 +3486,8 @@ export class AUNChannel {
     async deliverTextEntry(entry) {
         const channelId = entry.channelId;
         const finalText = entry.text;
-        const context = entry.context;
+        const delivery = this.requirePersistedDelivery(channelId, entry.delivery);
+        const context = this.withDelivery(entry.context, delivery);
         const operationId = entry.dedupeKey
             || (typeof context?.metadata?.operationId === 'string' ? context.metadata.operationId : undefined);
         if (operationId) {
@@ -3153,8 +3505,8 @@ export class AUNChannel {
         // 从 context.metadata.source 读取 source，默认为 'daemon'
         const source = context?.metadata?.source ?? 'daemon';
         const payload = { type: 'text', text: finalText };
-        if (this.isGroupId(channelId)) {
-            const extracted = this.extractMentionAidsFromText(finalText);
+        if (delivery.chatType === 'group') {
+            const extracted = this.extractMentionEntriesFromText(finalText);
             if (extracted.length > 0)
                 payload.mentions = extracted;
         }
@@ -3167,7 +3519,7 @@ export class AUNChannel {
         if (context?.metadata?.chatmode)
             payload.chatmode = context.metadata.chatmode;
         const causation = normalizeCausation(context?.metadata?.causation);
-        const causationRef = !this.isGroupId(channelId) && causation
+        const causationRef = delivery.chatType !== 'group' && causation
             ? `caus_${crypto.randomUUID().replace(/-/g, '')}`
             : undefined;
         if (causationRef && causation) {
@@ -3176,7 +3528,7 @@ export class AUNChannel {
         }
         // 诊断日志：记录 payload 构造结果（含 task_id / thread_id / chatmode）
         logger.info(`${this.logPrefix()} deliverTextEntry: channelId=${channelId} thread_id=${payload.thread_id ?? 'none'} task_id=${payload.task_id ?? 'none'} chatmode=${payload.chatmode ?? 'none'} source=${source} textLen=${finalText.length}`);
-        const isGroup = this.isGroupId(channelId);
+        const isGroup = delivery.chatType === 'group';
         const targetAid = channelId;
         if (operationId && entry.deliveryReceipt) {
             this.appendOutboundJsonl(channelId, {
@@ -3350,12 +3702,17 @@ export class AUNChannel {
         }
         const contentKind = entry.contentKind;
         const logText = entry.logText ?? this.payloadLogText(payload, contentKind);
-        const context = entry.context;
+        const delivery = this.requirePersistedDelivery(channelId, entry.delivery);
+        const context = this.withDelivery(entry.context, delivery);
         logger.info(`${this.logPrefix()} deliverPayloadEntry: id=${entry.id} kind=${contentKind ?? payload.type ?? 'payload'} channelId=${channelId} thread_id=${payload.thread_id ?? 'none'} task_id=${payload.task_id ?? 'none'} textLen=${logText.length}`);
         const sent = await this.sendAunPayload(channelId, payload, context, `${contentKind ?? payload.type ?? 'payload'}`);
+        if (sent.discarded) {
+            logger.warn(`${this.logPrefix()} Removed malformed durable payload from outbox: id=${entry.id} channel=${channelId}`);
+            return { ok: true, discarded: true };
+        }
         if (!sent.ok || !sent.messageId)
             return sent;
-        const isGroup = this.isGroupId(channelId);
+        const isGroup = delivery.chatType === 'group';
         const statsContext = isGroup ? await this.groupStatsContext(channelId) : undefined;
         this.logAunSendAccepted(isGroup ? 'group.send' : 'message.send', isGroup ? channelId : this.peerLabel(channelId), sent.messageId, !!sent.encrypt, sent.result, logText);
         this.recordDurableOutbound(channelId, payload, sent.messageId, !!sent.encrypt, context, isGroup, contentKind, logText, sent.result, statsContext);
@@ -3415,13 +3772,16 @@ export class AUNChannel {
      * 存储键：group_id/peer_aid + sender_aid + context.type + context.id
      */
     async sendThought(channelId, taskId, payload, context) {
-        if (!this.connected || !this.client)
-            return;
         if (!taskId)
             return;
+        const delivery = this.requireDelivery(channelId, context);
+        context = this.withDelivery(context, delivery);
+        const validatedPayload = this.normalizeAunPayloadMentions(payload);
+        const finalPayload = this.normalizeAunPayloadMentions(this.stripUndefinedDeep(validatedPayload));
+        if (!this.connected || !this.client)
+            return;
         // 私聊 channelId = 对端 AID（不含 device_id）
         const targetId = channelId;
-        const finalPayload = this.stripUndefinedDeep(payload);
         const encrypt = context?.metadata?.encrypted != null
             ? !!(context.metadata.encrypted)
             : this.shouldEncrypt(targetId);
@@ -3460,8 +3820,8 @@ export class AUNChannel {
             else {
                 thoughtText = this.activityLogText(finalPayload);
             }
-            if (this.isGroupId(channelId)) {
-                params.group_id = targetId;
+            if (delivery.chatType === 'group') {
+                params.group_id = delivery.groupId;
                 const putRes = await this.callAndTrace('group.thought.put', params);
                 const tid = putRes?.thought_id;
                 logger.info(`${this.logPrefix()} thought.put ok group=${targetId} task=${taskId} stage=${stage} encrypt=${encrypt} tid=${tid ?? '?'}`);
@@ -3491,15 +3851,20 @@ export class AUNChannel {
     }
     /** 发送结构化 AUN payload；transient 协议载荷不写本地 messages.jsonl。 */
     async sendStructured(channelId, payload, context) {
+        const delivery = this.requireDelivery(channelId, context);
+        context = this.withDelivery(context, delivery);
+        // Validate before checking connection state so malformed producer payloads
+        // are reported deterministically instead of being hidden by a disconnect.
+        const validatedPayload = this.normalizeAunPayloadMentions(payload);
+        const finalPayload = this.stripUndefinedDeep(validatedPayload);
         if (!this.connected || !this.client)
             return null;
-        const isGroup = this.isGroupId(channelId);
+        const isGroup = delivery.chatType === 'group';
         const targetAid = channelId;
         const encryptTarget = isGroup ? channelId : targetAid;
         const encrypt = context?.metadata?.encrypted != null
             ? !!(context.metadata.encrypted)
             : this.shouldEncrypt(encryptTarget);
-        const finalPayload = this.stripUndefinedDeep({ ...payload });
         if (context?.threadId && !finalPayload.thread_id)
             finalPayload.thread_id = context.threadId;
         if (context?.replyToMessageId && !finalPayload.ref_message_id)
@@ -3520,7 +3885,7 @@ export class AUNChannel {
         }
         try {
             if (isGroup) {
-                params.group_id = channelId;
+                params.group_id = delivery.groupId;
                 const result = await this.callAndTrace('group.send', params);
                 const mid = result?.message?.message_id ?? result?.message_id ?? null;
                 logger.info(`${this.logPrefix()} group.send (${payload.type}) ok: group=${channelId} mid=${mid} encrypt=${encrypt}`);
@@ -3544,6 +3909,8 @@ export class AUNChannel {
         }
     }
     async sendFile(channelId, filePath, context) {
+        const delivery = this.requireDelivery(channelId, context);
+        context = this.withDelivery(context, delivery);
         const absPath = path.resolve(filePath);
         if (!fs.existsSync(absPath)) {
             logger.warn(`${this.logPrefix()} sendFile: file not found: ${absPath}`);
@@ -3561,6 +3928,7 @@ export class AUNChannel {
         // Write-ahead: persist to outbox
         const entry = outbox.enqueue(this.config.aid, {
             channelId,
+            delivery,
             type: 'file',
             filePath: absPath,
             context,
@@ -3579,6 +3947,8 @@ export class AUNChannel {
         }
     }
     async sendImage(channelId, data, mimeType, alt, context) {
+        const delivery = this.requireDelivery(channelId, context);
+        context = this.withDelivery(context, delivery);
         if (!Buffer.isBuffer(data)) {
             throw new Error('result.image data must be a Buffer');
         }
@@ -3600,6 +3970,7 @@ export class AUNChannel {
         const logText = alt ? `[image] ${alt}` : '[image]';
         const entry = outbox.enqueue(this.config.aid, {
             channelId,
+            delivery,
             type: 'image',
             contentKind: 'image',
             image: { dataBase64: data.toString('base64'), mimeType: normalizedMimeType, alt },
@@ -3658,6 +4029,9 @@ export class AUNChannel {
             logger.warn(`${this.logPrefix()} deliverImageEntry: missing image data (outbox id=${entry.id})`);
             return true;
         }
+        const delivery = this.requirePersistedDelivery(entry.channelId, entry.delivery);
+        entry.delivery = delivery;
+        entry.context = this.withDelivery(entry.context, delivery);
         const data = Buffer.from(image.dataBase64, 'base64');
         if (data.length === 0) {
             logger.warn(`${this.logPrefix()} deliverImageEntry: invalid image data (outbox id=${entry.id})`);
@@ -3675,6 +4049,7 @@ export class AUNChannel {
         if (!outbox.replace(this.config.aid, entry)) {
             payloadEntry = outbox.enqueue(this.config.aid, {
                 channelId: entry.channelId,
+                delivery,
                 type: 'payload',
                 contentKind: 'image',
                 payload: entry.payload,
@@ -3692,7 +4067,8 @@ export class AUNChannel {
     async deliverFileEntry(entry) {
         const channelId = entry.channelId;
         const absPath = entry.filePath;
-        const context = entry.context;
+        const delivery = this.requirePersistedDelivery(channelId, entry.delivery);
+        const context = this.withDelivery(entry.context, delivery);
         if (!fs.existsSync(absPath)) {
             logger.warn(`${this.logPrefix()} deliverFileEntry: file gone: ${absPath}`);
             return true; // remove from outbox, file no longer exists
@@ -3750,7 +4126,7 @@ export class AUNChannel {
                 attachment,
                 context,
             });
-            const isGroup = this.isGroupId(channelId);
+            const isGroup = delivery.chatType === 'group';
             const fileTargetAid = channelId;
             const encryptTarget = isGroup ? channelId : fileTargetAid;
             const encrypt = context?.metadata?.encrypted != null
@@ -3761,7 +4137,7 @@ export class AUNChannel {
             let sentMid = null;
             try {
                 if (isGroup) {
-                    params.group_id = channelId;
+                    params.group_id = delivery.groupId;
                     this.trace('OUT', 'group.send.file', params);
                     const result = await this.client.call('group.send', params);
                     sendResult = result;
@@ -3869,6 +4245,10 @@ export class AUNChannel {
             return;
         logger.info(`${this.logPrefix()} Draining outbox...`);
         const result = await outbox.drain(this.config.aid, async (entry) => {
+            if (!isDeliveryTarget(entry.delivery)) {
+                logger.warn(`${this.logPrefix()} Discarding legacy/malformed outbox entry without a trusted delivery route: id=${entry.id} channel=${entry.channelId}`);
+                return true;
+            }
             if (entry.type === 'text') {
                 return this.withOutboxInFlight(entry, () => this.deliverTextEntry(entry), false);
             }
@@ -3894,11 +4274,23 @@ export class AUNChannel {
         this.messageSeqMap.delete(messageId);
     }
     sendProcessingStatus(channelId, status, sessionId, taskId, context, extraMeta) {
+        let delivery;
+        try {
+            delivery = this.requireDelivery(channelId, context);
+        }
+        catch (error) {
+            logger.warn(`${this.logPrefix()} task.${status} notify skipped without trusted delivery route: channel=${channelId} task=${taskId} error=${error instanceof Error ? error.message : String(error)}`);
+            return;
+        }
+        context = this.withDelivery(context, delivery);
         if (status === 'start')
             this.sentCount.delete(channelId); // 新任务开始，重置计数
         if (!this.client || !this.connected)
             return;
-        const severity = status === 'error' || status === 'timeout' ? 'error' : 'info';
+        const requestedSeverity = extraMeta?.severity;
+        const severity = requestedSeverity === 'warn'
+            ? 'warn'
+            : status === 'error' || status === 'timeout' ? 'error' : 'info';
         const stateMap = {
             start: 'started',
             done: 'completed',
@@ -3917,7 +4309,10 @@ export class AUNChannel {
             severity,
             terminal: ['done', 'interrupted', 'error', 'timeout'].includes(status),
         };
-        const metadata = extraMeta ? this.stripUndefinedDeep(extraMeta) : undefined;
+        const metadataInput = extraMeta ? { ...extraMeta } : undefined;
+        if (metadataInput)
+            delete metadataInput.severity;
+        const metadata = metadataInput ? this.stripUndefinedDeep(metadataInput) : undefined;
         if (metadata && Object.keys(metadata).length > 0)
             statusPayload.metadata = metadata;
         if (context?.threadId)
@@ -3929,8 +4324,8 @@ export class AUNChannel {
         if (context?.replyToMessageId)
             statusPayload.ref_message_id = context.replyToMessageId;
         const notifyOptions = { ttlMs: 60_000 };
-        if (this.isGroupId(channelId))
-            notifyOptions.groupId = channelId;
+        if (delivery.chatType === 'group')
+            notifyOptions.groupId = delivery.groupId;
         else
             notifyOptions.to = channelId;
         this.trace('OUT', 'notify.task_status', {
@@ -3951,7 +4346,7 @@ export class AUNChannel {
         }).catch(() => { });
         this.aidStatsCollector?.recordOutbound(this.config.aid, channelId, JSON.stringify(statusPayload).length, undefined, true, undefined, undefined, 'notify');
         // 群聊显示 group id 简称，P2P 显示 peer label；从 context.metadata 读取 chatmode
-        const targetLabel = this.isGroupId(channelId) ? channelId : this.peerLabel(channelId);
+        const targetLabel = delivery.chatType === 'group' ? delivery.groupId : this.peerLabel(channelId);
         const chatmode = context?.metadata?.chatmode ?? '?';
         const initiator = statusPayload.initiator ?? '';
         const refMsgId = statusPayload.ref_message_id ?? '';
@@ -3963,8 +4358,6 @@ export class AUNChannel {
             logger.info(logTaskStatus);
     }
     async sendCustomPayload(channelId, payload, context) {
-        if (!this.client || !this.connected)
-            return;
         // SDK 0.3.0 E2EE requires payload to be an object
         let payloadObj;
         try {
@@ -4198,21 +4591,25 @@ export class AUNChannelPlugin {
             channelKey: inst.name, // channelName 实际上就是 channelKey
             capabilities: { file: true, image: true, interaction: true, markdown: true, thought: true, status: true, thread: true, authenticatedApproval: true },
             send: async (envelope, payload) => {
+                const channelId = envelope?.channelId;
+                const delivery = requireEnvelopeDelivery(channelId, envelope?.delivery, envelope?.replyContext?.delivery);
                 const parentCausation = normalizeCausation(envelope.causation ?? envelope.replyContext?.metadata?.causation);
                 const outboundCausation = parentCausation ? deriveCausation(parentCausation) : undefined;
                 const replyCtx = outboundCausation
                     ? {
                         ...(envelope.replyContext ?? {}),
+                        delivery,
                         metadata: { ...(envelope.replyContext?.metadata ?? {}), causation: outboundCausation },
                     }
-                    : envelope.replyContext;
+                    : (envelope.replyContext || envelope.delivery)
+                        ? { ...(envelope.replyContext ?? {}), delivery }
+                        : undefined;
                 if (outboundCausation) {
                     recordCausationSpan(outboundCausation, 'message.outbound', {
                         status: 'started',
                         refs: { taskId: envelope.taskId, sessionId: envelope.sessionId },
                     });
                 }
-                const channelId = envelope.channelId;
                 const taskBase = () => channel.buildTaskPayloadBase(envelope, replyCtx);
                 switch (payload.kind) {
                     case 'result.text':
@@ -4236,11 +4633,30 @@ export class AUNChannelPlugin {
                         return;
                     }
                     case 'system.error': {
-                        await channel.sendMessage(channelId, payload.text, replyCtx);
+                        const errorPayload = {
+                            type: 'error',
+                            ...taskBase(),
+                            subtype: payload.subtype,
+                            text: payload.text,
+                            message: payload.text,
+                            user_message: payload.text,
+                            recoverable: payload.recoverable === true,
+                            terminal: payload.recoverable !== true,
+                        };
+                        await channel.sendReliableStructured(channelId, errorPayload, { ...(replyCtx ?? {}), suppressPeerMention: true }, payload.text);
                         return;
                     }
                     case 'result.error': {
-                        await channel.sendMessage(channelId, payload.text, replyCtx);
+                        const errorPayload = {
+                            type: 'error',
+                            ...taskBase(),
+                            reason: payload.reason,
+                            text: payload.text,
+                            message: payload.text,
+                            user_message: payload.text,
+                            terminal: true,
+                        };
+                        await channel.sendReliableStructured(channelId, errorPayload, { ...(replyCtx ?? {}), suppressPeerMention: true }, payload.text);
                         return;
                     }
                     case 'result.file': {
@@ -4322,7 +4738,7 @@ export class AUNChannelPlugin {
                                 aunCard.text = action.body;
                                 setIfDefined(aunCard, 'format', action.bodyFormat);
                             }
-                            if (req.initiatorId && channel.isGroupId(channelId))
+                            if (req.initiatorId && replyCtx?.delivery?.chatType === 'group')
                                 aunCard.initiator = req.initiatorId;
                             if (replyCtx?.threadId)
                                 aunCard.thread_id = replyCtx.threadId;
@@ -4335,6 +4751,7 @@ export class AUNChannelPlugin {
                                     requestId: req.id,
                                     isCommandCard: false,
                                     initiatorAid: req.initiatorId,
+                                    delivery: replyCtx?.delivery,
                                     expiresAt: Date.now() + cardTtlMs,
                                 },
                             });
@@ -4359,7 +4776,7 @@ export class AUNChannelPlugin {
                                 aunCard.text = card.body;
                                 setIfDefined(aunCard, 'format', card.bodyFormat);
                             }
-                            if (req.initiatorId && channel.isGroupId(channelId))
+                            if (req.initiatorId && replyCtx?.delivery?.chatType === 'group')
                                 aunCard.initiator = req.initiatorId;
                             if (replyCtx?.threadId)
                                 aunCard.thread_id = replyCtx.threadId;
@@ -4372,6 +4789,7 @@ export class AUNChannelPlugin {
                                     requestId: req.id,
                                     isCommandCard: true,
                                     initiatorAid: req.initiatorId,
+                                    delivery: replyCtx?.delivery,
                                     expiresAt: Date.now() + cardTtlMs,
                                 },
                             });
@@ -4438,15 +4856,12 @@ export class AUNChannelPlugin {
                         });
                     });
                 }
-                if (typeof channel.setDispatchModeResolver === 'function') {
-                    channel.setDispatchModeResolver(async (channelId) => {
-                        // 配置层用 mentionMode（mention-only/disabled），翻译成 AUN 协议
-                        // dispatch_mode（mention/broadcast）；未设值返回 undefined，回退服务端下发值。
-                        const mentionMode = resolveEffective({
+                if (typeof channel.setMentionModeResolver === 'function') {
+                    channel.setMentionModeResolver(async (channelId) => {
+                        return resolveEffective({
                             self: aid,
                             peerKey: formatPeerKey('aun', channelId),
                         }, { cache: true }).mentionMode;
-                        return mentionModeToDispatch(mentionMode);
                     });
                 }
             },