evolcore 0.0.12 → 0.0.13

package/dist/channels/aun.js

@@ -7,7 +7,7 @@ import { logger, localTimestamp } from '../utils/logger.js';
 import { LogWriter } from '../utils/log-writer.js';
 import { middleOutputModePolicy, resolveShowActivities, showActivitiesPolicy } from '../core/channel-loader.js';
 import { DEFAULT_FLUSH_DELAY_SECONDS } from '../types.js';
-import { resolvePaths, agentDir as agentDirPath, resolveRoot } from '../paths.js';
+import { resolvePaths, agentDir as agentDirPath, resolveRoot, channelStatePath } from '../paths.js';
 import { saveToUploads, sanitizeFileName, bufferToInboundImage, safeFetch } from '../utils/media-cache.js';
 import { appendAidEvent } from '../utils/instance-registry.js';
 import { appendMessageLog, appendMessageLogStrict, buildOutboundEntry, buildInboundEntry, classifyAunPayloadForLog, hasMessageLogOperation } from '../core/message/message-log.js';
@@ -31,15 +31,36 @@ import { isHClassPath } from '../core/protected-paths.js';
 import { consumeAunCausation, registerAunCausation } from '../core/causation/aun-association.js';
 import { deriveCausation, normalizeCausation } from '../core/causation/context.js';
 import { recordCausationSpan } from '../core/causation/audit.js';
-import { isExplicitGroupId } from '../aun/group-identity.js';
 import { refreshAgentDisplayName, resolveAgentDisplayName } from '../aun/aid/agentmd.js';
 import { readInstalledEvolcoreVersion } from '../utils/evolcore-version.js';
 import { bindPostBootstrapWelcomeOutboxSession, hasPendingPostBootstrapWelcomeOutbox, postBootstrapWelcomeOperationId, preparePostBootstrapWelcomeOutbox, } from '../core/bootstrap-messages.js';
 import { hasMentionAll, mentionEntryAids, mentionEntryTargets, } from '../core/message/mention-schema.js';
 import { normalizeAunMentionEntries, } from '../aun/msg/mention-schema.js';
+import { isDeliveryTarget, sameDeliveryTarget } from '../core/message/message-utils.js';
 export const AUN_HANDOFF_MARKER_FIELD = '_evolcore_handoff_id';
 const AUN_INTERACTION_CARD_TTL_MS = 24 * 60 * 60 * 1000;
+const AUN_INBOUND_DEDUP_TTL_MS = 7 * 24 * 60 * 60 * 1000;
 const IMAGE_MIME_TYPE = /^image\/[!#$%&'*+.^_`|~0-9A-Za-z-]+$/i;
+function requireEnvelopeDelivery(channelId, envelopeDelivery, nestedDelivery) {
+    if (!isDeliveryTarget(envelopeDelivery)) {
+        throw Object.assign(new Error(`AUN outbound envelope requires a top-level delivery route for channelId=${channelId}`), {
+            code: 'AUN_OUTBOUND_ROUTE_REQUIRED',
+        });
+    }
+    if (nestedDelivery !== undefined) {
+        if (!isDeliveryTarget(nestedDelivery) || !sameDeliveryTarget(envelopeDelivery, nestedDelivery)) {
+            throw Object.assign(new Error(`AUN outbound envelope has conflicting delivery routes for channelId=${channelId}`), {
+                code: 'AUN_OUTBOUND_ROUTE_MISMATCH',
+            });
+        }
+    }
+    if (envelopeDelivery.chatType === 'group' && envelopeDelivery.groupId !== channelId) {
+        throw Object.assign(new Error(`AUN group delivery does not match channelId=${channelId}`), {
+            code: 'AUN_OUTBOUND_ROUTE_MISMATCH',
+        });
+    }
+    return envelopeDelivery;
+}
 function normalizeImageMimeType(mimeType) {
     const normalized = mimeType?.split(';', 1)[0].trim().toLowerCase();
     if (!normalized)
@@ -133,6 +154,8 @@ export function aunOptsToInbound(opts, channel, channelType) {
         encrypted: opts.encrypted,
         protectedHeaders: opts.protectedHeaders,
         messageId: opts.messageId,
+        receivedAt: opts.receivedAt,
+        gatewaySeq: opts.gatewaySeq,
         causation: opts.causation,
         mentions: opts.mentions,
         mentionAids: opts.mentionAids,
@@ -289,14 +312,36 @@ export class AUNChannel {
             throw e;
         }
     }
-    /** 判断 channelId 是否为群组 ID
-     *  - 新格式：group.{aidDomain}/{group_no|group_name}
-     *  - 数字群号：{group_no}.{aidDomain}（如 11117.example.com）
-     *  - 兼容旧格式：grp_xxx、g-xxx.agentid.pub
+    /** Resolve the authenticated transport route for an ordinary outbound send.
+     * The channel id is an address only; it is intentionally never used to infer
+     * whether the address is a group.
      */
-    /** 判断 channelId 是否群组 ID（public：plugin adapter 闭包需调用） */
-    isGroupId(id) {
-        return isExplicitGroupId(id);
+    requireDelivery(channelId, context, explicit) {
+        const supplied = explicit ?? context?.delivery;
+        if (supplied !== undefined && !isDeliveryTarget(supplied)) {
+            throw Object.assign(new Error(`AUN outbound send has an invalid delivery route for channelId=${channelId}`), {
+                code: 'AUN_OUTBOUND_ROUTE_REQUIRED',
+            });
+        }
+        if (!supplied) {
+            throw Object.assign(new Error(`AUN outbound send requires an explicit delivery route for channelId=${channelId}`), {
+                code: 'AUN_OUTBOUND_ROUTE_REQUIRED',
+            });
+        }
+        if (supplied.chatType === 'group' && supplied.groupId !== channelId) {
+            throw Object.assign(new Error(`AUN group delivery does not match channelId=${channelId}`), {
+                code: 'AUN_OUTBOUND_ROUTE_MISMATCH',
+            });
+        }
+        return supplied;
+    }
+    requirePersistedDelivery(channelId, delivery) {
+        // Persisted sends only trust the top-level route. In particular, old
+        // outbox entries cannot recover routing from their nested reply context.
+        return this.requireDelivery(channelId, undefined, delivery);
+    }
+    withDelivery(context, delivery) {
+        return { ...(context ?? {}), delivery };
     }
     getShortAid(aid) {
         if (!aid)
@@ -318,15 +363,19 @@ export class AUNChannel {
         const name = cached?.name;
         return name && name !== short ? `${short}(${name})` : short;
     }
-    notifyCardActionFailure(channelId, text, operatorId, threadId) {
+    notifyCardActionFailure(channelId, text, operatorId, threadId, delivery) {
         if (!channelId) {
             logger.warn(`${this.logPrefix()} Card action failure without channelId: ${text}`);
             return;
         }
-        const context = {};
+        if (!delivery) {
+            logger.warn(`${this.logPrefix()} Card action failure without trusted delivery route: ${text}`);
+            return;
+        }
+        const context = { delivery };
         if (threadId)
             context.threadId = threadId;
-        if (operatorId && this.isGroupId(channelId))
+        if (operatorId && delivery.chatType === 'group')
             context.peerId = operatorId;
         void this.sendMessage(channelId, text, context).catch((err) => {
             logger.error(`${this.logPrefix()} Failed to send card action error:`, err);
@@ -336,7 +385,7 @@ export class AUNChannel {
         logger.info(`${this.logPrefix()} ActionInteraction audit: behavior=${behavior ?? 'reply'} `
             + `cardId=${cardMessageId} interactionId=${interactionId} result=${result} textLength=${textLength}`);
     }
-    extractTextPayload(payload, channelId, senderAid) {
+    extractTextPayload(payload, channelId, senderAid, delivery) {
         if (typeof payload === 'string')
             return payload;
         if (payload && typeof payload === 'object') {
@@ -347,6 +396,7 @@ export class AUNChannel {
                 const cardMsgId = typeof obj.ref_message_id === 'string' ? obj.ref_message_id
                     : typeof obj.card_message_id === 'string' ? obj.card_message_id : '';
                 const cardInfo = cardMsgId ? this.cardMessageIdMap.get(cardMsgId) : undefined;
+                const cardDelivery = cardInfo?.delivery ?? delivery;
                 if (cardInfo) {
                     // compose 按钮由新版客户端在卡片内采集输入；旧版客户端可继续从主编辑器
                     // 采集。两者最终都回传 action_card_reply{behavior:"compose", text}。
@@ -371,25 +421,25 @@ export class AUNChannel {
                     // payloads omit senderAid.  A group channelId is only a conversation
                     // identifier and must never be treated as the clicking operator.
                     const cardClickerAid = senderAid
-                        || (channelId && !this.isGroupId(channelId) ? channelId : '')
+                        || (cardDelivery?.chatType === 'private' && channelId ? channelId : '')
                         || '';
                     if (cardInfo.isCommandCard) {
                         // CommandCard：action_value 是完整 slash 命令，构造伪入站消息。
                         // 先完成点击者鉴权，再消费 mapping；否则群成员的一次误点会让发起者
                         // 无法继续操作同一张卡片。
-                        const chatType = channelId ? (this.isGroupId(channelId) ? 'group' : 'private') : 'private';
+                        const chatType = cardDelivery?.chatType ?? 'private';
                         if (this.messageHandler && actionValue.startsWith('/')) {
                             // Initiator 校验：仅群聊需要（私聊信道一对一，点击者恒为对端 = initiator）。
                             // 身份只信认证信封提取的 cardClickerAid，非 payload 自报。
                             if (chatType === 'group' && !cardClickerAid) {
                                 logger.info(`${this.logPrefix()} CommandCard rejected: missing authenticated clicker mid=${cardMsgId}`);
-                                this.notifyCardActionFailure(channelId, '⚠️ 无法验证卡片操作者身份', undefined, threadId);
+                                this.notifyCardActionFailure(channelId, '⚠️ 无法验证卡片操作者身份', undefined, threadId, cardDelivery);
                                 return '';
                             }
                             if (chatType === 'group' && cardInfo.initiatorAid
                                 && cardClickerAid !== cardInfo.initiatorAid) {
                                 logger.info(`${this.logPrefix()} CommandCard rejected: clicker=${cardClickerAid} initiator=${cardInfo.initiatorAid} mid=${cardMsgId}`);
-                                this.notifyCardActionFailure(channelId, '⚠️ 仅卡片发起者可操作', cardClickerAid, threadId);
+                                this.notifyCardActionFailure(channelId, '⚠️ 仅卡片发起者可操作', cardClickerAid, threadId, cardDelivery);
                                 return '';
                             }
                             // 已通过鉴权并即将进入处理流程；此时才消费 mapping，避免非发起者
@@ -408,28 +458,28 @@ export class AUNChannel {
                             })).catch((err) => {
                                 logger.error(`${this.logPrefix()} CommandCard handler failed: action=${actionValue} mid=${cardMsgId}`, err);
                                 const message = err instanceof Error && err.message ? err.message : String(err || '未知错误');
-                                this.notifyCardActionFailure(channelId, `❌ 操作失败: ${message}`, cardClickerAid, threadId);
+                                this.notifyCardActionFailure(channelId, `❌ 操作失败: ${message}`, cardClickerAid, threadId, cardDelivery);
                             });
                         }
                         else if (!this.messageHandler) {
-                            this.notifyCardActionFailure(channelId, '❌ 操作失败：命令处理器未就绪', cardClickerAid, threadId);
+                            this.notifyCardActionFailure(channelId, '❌ 操作失败：命令处理器未就绪', cardClickerAid, threadId, cardDelivery);
                         }
                         else {
-                            this.notifyCardActionFailure(channelId, '❌ 操作失败：无效的卡片命令', cardClickerAid, threadId);
+                            this.notifyCardActionFailure(channelId, '❌ 操作失败：无效的卡片命令', cardClickerAid, threadId, cardDelivery);
                         }
                     }
                     else {
                         // ActionInteraction：后端明确接受后才消费 mapping。撤权、过期或
                         // 重复点击返回 false 时保持 fail-closed，并提示用户卡片已失效。
-                        if (channelId && this.isGroupId(channelId) && !cardClickerAid) {
+                        if (cardDelivery?.chatType === 'group' && !cardClickerAid) {
                             this.auditActionCardInteraction(behaviorRaw, cardMsgId, cardInfo.requestId, 'rejected_unauthenticated', text.length);
-                            this.notifyCardActionFailure(channelId, '⚠️ 无法验证卡片操作者身份', undefined, threadId);
+                            this.notifyCardActionFailure(channelId, '⚠️ 无法验证卡片操作者身份', undefined, threadId, cardDelivery);
                             return '';
                         }
-                        if (channelId && this.isGroupId(channelId) && cardInfo.initiatorAid
+                        if (cardDelivery?.chatType === 'group' && cardInfo.initiatorAid
                             && cardClickerAid !== cardInfo.initiatorAid) {
                             this.auditActionCardInteraction(behaviorRaw, cardMsgId, cardInfo.requestId, 'rejected_non_initiator', text.length);
-                            this.notifyCardActionFailure(channelId, '⚠️ 仅卡片发起者可操作', cardClickerAid, threadId);
+                            this.notifyCardActionFailure(channelId, '⚠️ 仅卡片发起者可操作', cardClickerAid, threadId, cardDelivery);
                             return '';
                         }
                         // Compose reply 入参校验：text 必须非空且未超长。
@@ -439,19 +489,19 @@ export class AUNChannel {
                             const MAX_COMPOSE_TEXT_LENGTH = 64 * 1024; // 64K 字符
                             if (!trimmedText) {
                                 this.auditActionCardInteraction(behaviorRaw, cardMsgId, cardInfo.requestId, 'rejected_empty', text.length);
-                                this.notifyCardActionFailure(channelId, '⚠️ 输入内容不能为空，请重新输入', cardClickerAid, threadId);
+                                this.notifyCardActionFailure(channelId, '⚠️ 输入内容不能为空，请重新输入', cardClickerAid, threadId, cardDelivery);
                                 return '';
                             }
                             if (text.length > MAX_COMPOSE_TEXT_LENGTH) {
                                 this.auditActionCardInteraction(behaviorRaw, cardMsgId, cardInfo.requestId, 'rejected_too_long', text.length);
-                                this.notifyCardActionFailure(channelId, `⚠️ 输入内容过长（${text.length} 字符，限制 ${MAX_COMPOSE_TEXT_LENGTH}），请缩短后重试`, cardClickerAid, threadId);
+                                this.notifyCardActionFailure(channelId, `⚠️ 输入内容过长（${text.length} 字符，限制 ${MAX_COMPOSE_TEXT_LENGTH}），请缩短后重试`, cardClickerAid, threadId, cardDelivery);
                                 return '';
                             }
                         }
                         if (this.interactionCallback) {
                             if (this.interactionActionsInFlight.has(cardMsgId)) {
                                 this.auditActionCardInteraction(behaviorRaw, cardMsgId, cardInfo.requestId, 'rejected_in_flight', text.length);
-                                this.notifyCardActionFailure(channelId, '⏳ 操作正在处理，请勿重复点击', cardClickerAid, threadId);
+                                this.notifyCardActionFailure(channelId, '⏳ 操作正在处理，请勿重复点击', cardClickerAid, threadId, cardDelivery);
                                 return '';
                             }
                             this.interactionActionsInFlight.add(cardMsgId);
@@ -484,7 +534,7 @@ export class AUNChannel {
                                     // captured the message id before the callback returned.
                                     this.forgetInteractionCard(cardMsgId, cardInfo.requestId);
                                 }
-                                this.notifyCardActionFailure(channelId, '⚠️ 卡片已失效，请重新发起', cardClickerAid, threadId);
+                                this.notifyCardActionFailure(channelId, '⚠️ 卡片已失效，请重新发起', cardClickerAid, threadId, cardDelivery);
                             };
                             try {
                                 const result = this.interactionCallback(response);
@@ -493,7 +543,7 @@ export class AUNChannel {
                                         this.interactionActionsInFlight.delete(cardMsgId);
                                         this.auditActionCardInteraction(behaviorRaw, cardMsgId, cardInfo.requestId, 'callback_error', text.length);
                                         logger.error(`${this.logPrefix()} ActionInteraction callback failed: request=${cardInfo.requestId}`, err);
-                                        this.notifyCardActionFailure(channelId, '❌ 操作失败，请稍后重试', cardClickerAid, threadId);
+                                        this.notifyCardActionFailure(channelId, '❌ 操作失败，请稍后重试', cardClickerAid, threadId, cardDelivery);
                                     });
                                 }
                                 else {
@@ -504,19 +554,19 @@ export class AUNChannel {
                                 this.interactionActionsInFlight.delete(cardMsgId);
                                 this.auditActionCardInteraction(behaviorRaw, cardMsgId, cardInfo.requestId, 'callback_error', text.length);
                                 logger.error(`${this.logPrefix()} ActionInteraction callback failed: request=${cardInfo.requestId}`, err);
-                                this.notifyCardActionFailure(channelId, '❌ 操作失败，请稍后重试', cardClickerAid, threadId);
+                                this.notifyCardActionFailure(channelId, '❌ 操作失败，请稍后重试', cardClickerAid, threadId, cardDelivery);
                             }
                         }
                         else {
                             this.auditActionCardInteraction(behaviorRaw, cardMsgId, cardInfo.requestId, 'handler_unavailable', text.length);
-                            this.notifyCardActionFailure(channelId, '❌ 操作失败：交互处理器未就绪', cardClickerAid, threadId);
+                            this.notifyCardActionFailure(channelId, '❌ 操作失败：交互处理器未就绪', cardClickerAid, threadId, cardDelivery);
                         }
                     }
                 }
                 else if (this.ownedCardMsgIds.has(cardMsgId)) {
                     // 本 agent 发出的卡片，但 entry 已过期（24h TTL）
                     logger.debug(`${this.logPrefix()} action_card_reply expired: cardMsgId=${cardMsgId}`);
-                    this.notifyCardActionFailure(channelId, '⚠️ 卡片已失效，请重新发起');
+                    this.notifyCardActionFailure(channelId, '⚠️ 卡片已失效，请重新发起', undefined, undefined, delivery);
                 }
                 else {
                     // 非本 agent 发出的卡片（broadcast 模式下其他 agent 的卡）→ 静默忽略
@@ -751,8 +801,13 @@ export class AUNChannel {
             return sanitized;
         return undefined;
     }
-    buildGroupReplyContext(threadId, senderAid, encrypted, messageId, chatmode, topicName) {
-        const replyContext = { metadata: { encrypted, chatmode } };
+    buildGroupReplyContext(threadId, senderAid, encrypted, messageId, chatmode, topicName, groupId) {
+        if (!groupId)
+            throw new Error('buildGroupReplyContext requires groupId');
+        const replyContext = {
+            metadata: { encrypted, chatmode },
+            delivery: { chatType: 'group', groupId },
+        };
         if (threadId)
             replyContext.threadId = threadId;
         replyContext.peerId = senderAid;
@@ -766,6 +821,20 @@ export class AUNChannel {
         }
         return replyContext;
     }
+    buildPrivateReplyContext(threadId, senderAid, encrypted, messageId, chatmode, topicName, refMessageId) {
+        const replyContext = {
+            metadata: { encrypted, chatmode, refMessageId },
+            delivery: { chatType: 'private' },
+            peerId: senderAid,
+        };
+        if (threadId)
+            replyContext.threadId = threadId;
+        if (messageId)
+            replyContext.replyToMessageId = messageId;
+        if (topicName && threadId)
+            replyContext.metadata.topicName = topicName;
+        return replyContext;
+    }
     claimInboundMessage(kind, messageId, seq) {
         if (!messageId)
             return true;
@@ -788,9 +857,72 @@ export class AUNChannel {
         this.inboundSeenMessages.set(dedupeKey, { seenAt: Date.now(), seq });
         if (seq !== undefined)
             this.messageSeqMap.set(messageId, seq);
-        setTimeout(() => this.inboundSeenMessages.delete(dedupeKey), 5 * 60 * 1000);
+        this.appendInboundDedupe(dedupeKey, messageId, kind, seq);
+        setTimeout(() => this.inboundSeenMessages.delete(dedupeKey), AUN_INBOUND_DEDUP_TTL_MS);
         return true;
     }
+    inboundDedupeFile() {
+        const channelName = this.config.channelName ?? 'aun';
+        return channelStatePath(channelName, 'dedup', 'aun', `${encodeURIComponent(this.config.aid)}.jsonl`);
+    }
+    loadInboundDedupe() {
+        const file = this.inboundDedupeFile();
+        const cutoff = Date.now() - AUN_INBOUND_DEDUP_TTL_MS;
+        let lines;
+        try {
+            lines = fs.readFileSync(file, 'utf8').split('\n').filter(Boolean);
+        }
+        catch {
+            return;
+        }
+        let needsRewrite = false;
+        for (const line of lines) {
+            try {
+                const entry = JSON.parse(line);
+                if (typeof entry.key !== 'string' || typeof entry.seenAt !== 'number' || !Number.isFinite(entry.seenAt) || entry.seenAt <= cutoff) {
+                    needsRewrite = true;
+                    continue;
+                }
+                this.inboundSeenMessages.set(entry.key, {
+                    seenAt: entry.seenAt,
+                    seq: typeof entry.seq === 'number' && Number.isFinite(entry.seq) ? entry.seq : undefined,
+                });
+            }
+            catch {
+                needsRewrite = true;
+            }
+        }
+        if (needsRewrite)
+            this.rewriteInboundDedupe();
+    }
+    appendInboundDedupe(key, messageId, kind, seq) {
+        try {
+            const file = this.inboundDedupeFile();
+            fs.mkdirSync(path.dirname(file), { recursive: true });
+            fs.appendFileSync(file, JSON.stringify({ key, messageId, kind, seenAt: Date.now(), seq }) + '\n');
+        }
+        catch (error) {
+            logger.warn(`${this.logPrefix()} Failed to persist inbound dedup: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    rewriteInboundDedupe() {
+        const cutoff = Date.now() - AUN_INBOUND_DEDUP_TTL_MS;
+        for (const [key, value] of this.inboundSeenMessages) {
+            if (value.seenAt <= cutoff)
+                this.inboundSeenMessages.delete(key);
+        }
+        try {
+            const file = this.inboundDedupeFile();
+            fs.mkdirSync(path.dirname(file), { recursive: true });
+            const tmp = `${file}.tmp-${process.pid}-${Date.now()}`;
+            const lines = [...this.inboundSeenMessages].map(([key, value]) => JSON.stringify({ key, seenAt: value.seenAt, seq: value.seq }));
+            fs.writeFileSync(tmp, lines.length > 0 ? `${lines.join('\n')}\n` : '');
+            fs.renameSync(tmp, file);
+        }
+        catch (error) {
+            logger.warn(`${this.logPrefix()} Failed to compact inbound dedup: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
     acknowledgeImmediately(messageId, _seq) {
         // SDK internally manages seq tracking and ack — do not call message.ack RPC directly,
         // as it corrupts the SDK's seqTracker state and breaks V2 e2ee message pull.
@@ -875,6 +1007,7 @@ export class AUNChannel {
     constructor(config) {
         this.config = config;
         this.agentDir = agentDirPath(config.aid);
+        this.loadInboundDedupe();
         if (config.aunTrace) {
             this.traceWriter = new LogWriter({
                 baseName: 'aun',
@@ -972,7 +1105,7 @@ export class AUNChannel {
         // gateway metadata cache when well-known is temporarily unavailable.
         const configuredGateway = this.config.gatewayUrl || '';
         logger.info(`${this.logPrefix()} Initializing: aid=${aidName}, gateway=${configuredGateway || '<sdk-discovery>'}, aun_path=${aunPath}`);
-        // 构造 AIDStore（slot=evolcore daemon，与 cli/netcheck 共享 evolcore 隔离键）
+        // 构造 AIDStore。daemon 使用独立 slot，CLI/netcheck 不能触碰业务入站游标。
         // encryptionSeed / rootCaPath 由 getAidStore 内部注入
         const store = await getAidStore({
             slotId: SLOT.daemon,
@@ -1025,7 +1158,7 @@ export class AUNChannel {
                     for (const id of ids) {
                         if (typeof id === 'string') {
                             logger.info(`${this.logPrefix()} Message recalled: ${id}`);
-                            this.recallHandler?.(id);
+                            this.recallHandler?.(id, this._aid || this.config.aid);
                         }
                     }
                 }
@@ -1057,7 +1190,7 @@ export class AUNChannel {
                         for (const id of ids) {
                             if (typeof id === 'string') {
                                 logger.info(`${this.logPrefix()} Group message recalled: group=${env.group_id ?? ''} mid=${id}`);
-                                this.recallHandler?.(id);
+                                this.recallHandler?.(id, this._aid || this.config.aid);
                             }
                         }
                     }
@@ -1095,7 +1228,7 @@ export class AUNChannel {
             });
             this.trace('OUT', 'client.connect', { gateway: this.gatewayUrl, extra_info: extraInfo });
             await client.connect({
-                // connection_kind 默认 long；slot 已由 AID 携带（evolcore daemon）
+                // connection_kind 默认 long；slot 已由 AID 携带（evolcore-daemon）
                 // extra_info：互踢诊断名片（0.4.3 公开 connect 已支持透传）
                 extra_info: extraInfo,
                 // max_attempts=0 = 无限重试（与 Go/Python 对齐），交由 SDK 自己跑指数退避
@@ -1155,7 +1288,9 @@ export class AUNChannel {
             }
             const operationId = postBootstrapWelcomeOperationId(aidName);
             const chatDir = chatDirPath(resolvePaths().sessionsDir, 'aun', owner, aidName);
-            if (hasMessageLogOperation(chatDir, operationId) || outbox.findByDedupeKey(aidName, operationId)) {
+            const prepared = outbox.findByDedupeKey(aidName, operationId);
+            if (hasMessageLogOperation(chatDir, operationId)
+                || (prepared?.delivery?.chatType === 'private' && prepared.channelId === owner)) {
                 return true;
             }
             const ownerAidClean = owner.startsWith('@') ? owner.slice(1) : owner;
@@ -1211,6 +1346,11 @@ export class AUNChannel {
             const chatDir = chatDirPath(resolvePaths().sessionsDir, 'aun', owner, aid);
             return hasMessageLogOperation(chatDir, operationId);
         }
+        if (entry.delivery?.chatType !== 'private') {
+            logger.warn(`${this.logPrefix()} Discarding unrouted legacy post-bootstrap welcome: id=${entry.id}`);
+            outbox.remove(aid, entry.id);
+            return false;
+        }
         const agentConfig = loadAgent(aid);
         if (!agentConfig || normalizeAgentLifecycle(agentConfig).lifecycle !== 'active') {
             logger.info(`${this.logPrefix()} Post-bootstrap welcome prepared; waiting for lifecycle=active`);
@@ -1234,7 +1374,7 @@ export class AUNChannel {
      * @param channelId 下载归属（私聊 fromAid / 群聊 groupId）
      * @param preCollected 已收集的附件（群聊路径会提前 collect，避免重复）
      */
-    async processAttachments(payload, baseText, channelId, preCollected) {
+    async processAttachments(payload, baseText, channelId, preCollected, delivery) {
         const rawAttachments = preCollected ?? this.collectAllAttachments(payload);
         const images = [];
         let finalText = baseText;
@@ -1243,7 +1383,7 @@ export class AUNChannel {
         }
         const fileParts = [];
         for (const att of rawAttachments) {
-            const filePath = await this.downloadAttachment(att, channelId);
+            const filePath = await this.downloadAttachment(att, channelId, delivery);
             if (!filePath)
                 continue;
             const name = sanitizeFileName(att.filename || att.object_key?.split('/').pop() || 'file');
@@ -1275,8 +1415,11 @@ export class AUNChannel {
         logger.info(`${this.logPrefix()} [attachments] count=${rawAttachments.length} images=${images.length} files=${fileParts.length}`);
         return { finalText, images };
     }
-    async downloadAttachment(att, channelId) {
-        const ownerAid = att.owner_aid || (!this.isGroupId(channelId) ? channelId : '') || this._aid || '';
+    async downloadAttachment(att, channelId, delivery) {
+        const ownerAid = att.owner_aid
+            || (delivery?.chatType === 'private' ? channelId : '')
+            || this._aid
+            || '';
         const objectKey = att.object_key;
         if (!objectKey) {
             logger.warn(`${this.logPrefix()} Attachment missing object_key, skipping`);
@@ -1448,6 +1591,7 @@ export class AUNChannel {
         if (!data || typeof data !== 'object')
             return;
         const msg = data;
+        const receivedAt = Date.now();
         // Claim before any payload extraction or command parsing. Retransmits may
         // carry a new seq, but the application identity remains message_id.
         const messageId = typeof msg.message_id === 'string' ? msg.message_id : '';
@@ -1467,7 +1611,7 @@ export class AUNChannel {
             ? payload._evolcore_causation_ref
             : undefined;
         const logDescriptor = classifyAunPayloadForLog(payload);
-        const text = this.extractTextPayload(payload, fromAid, fromAid);
+        const text = this.extractTextPayload(payload, fromAid, fromAid, { chatType: 'private' });
         const threadId = typeof payload === 'object' && payload !== null ? payload.thread_id : undefined;
         const refMessageId = typeof payload === 'object' && payload !== null && typeof payload.ref_message_id === 'string'
             ? payload.ref_message_id
@@ -1513,7 +1657,7 @@ export class AUNChannel {
             mentions.push({ aid: this._aid });
         }
         // Process attachments (顶层 + 嵌套在 merge.items / quote.quote 中的)
-        const { finalText, images: inboundImages } = await this.processAttachments(payload, text, fromAid);
+        const { finalText, images: inboundImages } = await this.processAttachments(payload, text, fromAid, undefined, { chatType: 'private' });
         // 私聊 channelId = 对端 AID（不再读 payload.chat_id 含 device 三段式）
         // device_id 仅 SDK 内部多实例去重用，evolcore session 层面跨端共享会话
         const chatId = fromAid;
@@ -1529,7 +1673,7 @@ export class AUNChannel {
         logger.info(`${this.logPrefix()} P2P dispatch decision: mid=${messageId} from=${shortAid}(${displayName}) peerType=${peerIdentity.type} payloadType=${p2pPayloadType} chatId=${chatId} encrypt=${msgEncrypted} textPreview=${JSON.stringify(text.slice(0, 80))}`);
         // action_card_reply 已在 extractTextPayload 中消费，不分发给 agent
         if (p2pPayloadType === 'action_card_reply') {
-            this.appendInboundPayloadJsonl(chatId, fromAid, messageId, msgEncrypted, false, logDescriptor, threadId);
+            this.appendInboundPayloadJsonl(chatId, fromAid, messageId, msgEncrypted, false, logDescriptor, threadId, receivedAt, seq);
             return;
         }
         // menu.* 与联系人本人状态查询：需要原始 payload JSON 传递给 bridge。
@@ -1537,18 +1681,18 @@ export class AUNChannel {
             || p2pPayloadType === AUNChannel.CONTACT_REQUEST_QUERY_TYPE
             || p2pPayloadType === AUNChannel.CONTACT_REQUEST_SUBMIT_TYPE) {
             this.acknowledgeImmediately(messageId, seq);
-            this.appendInboundPayloadJsonl(chatId, fromAid, messageId, msgEncrypted, false, logDescriptor, threadId);
+            this.appendInboundPayloadJsonl(chatId, fromAid, messageId, msgEncrypted, false, logDescriptor, threadId, receivedAt, seq);
             this.dispatchMessage({
                 channelId: chatId, userId: fromAid,
                 text: JSON.stringify(payload),
-                chatType: 'private', messageId, seq,
+                chatType: 'private', messageId, seq, receivedAt, gatewaySeq: seq,
                 peerName: displayName || undefined,
                 peerType: peerIdentity.type,
                 encrypted: msgEncrypted,
                 protectedHeaders,
                 mentions,
                 mentionAids: mentionEntryAids(mentions),
-                replyContext: this.buildGroupReplyContext(threadId, fromAid, msgEncrypted, messageId),
+                replyContext: this.buildPrivateReplyContext(threadId, fromAid, msgEncrypted, messageId),
                 msgType: logDescriptor.msgType,
                 payloadType: logDescriptor.payloadType,
                 payloadSummary: logDescriptor.payloadSummary,
@@ -1568,11 +1712,11 @@ export class AUNChannel {
         // 透传 encrypted：bind.response 须与请求的加密/明文对称（见 onMessage 处理）。
         if (p2pPayloadType === AUNChannel.BIND_REQUEST_TYPE) {
             this.acknowledgeImmediately(messageId, seq);
-            this.appendInboundPayloadJsonl(chatId, fromAid, messageId, msgEncrypted, false, logDescriptor, threadId);
+            this.appendInboundPayloadJsonl(chatId, fromAid, messageId, msgEncrypted, false, logDescriptor, threadId, receivedAt, seq);
             this.dispatchMessage({
                 channelId: chatId, userId: fromAid,
                 text: JSON.stringify(payload),
-                chatType: 'private', messageId, seq,
+                chatType: 'private', messageId, seq, receivedAt, gatewaySeq: seq,
                 peerName: displayName || undefined,
                 peerType: peerIdentity.type,
                 encrypted: msgEncrypted,
@@ -1588,7 +1732,7 @@ export class AUNChannel {
         // payload 类型白名单：信号类消息（status / event / thought 等）不进 Agent
         if (p2pPayloadType && !AUNChannel.PROACTIVE_ALLOW_TYPES.has(p2pPayloadType)) {
             this.acknowledgeImmediately(messageId, seq);
-            this.appendInboundPayloadJsonl(chatId, fromAid, messageId, msgEncrypted, false, logDescriptor, threadId);
+            this.appendInboundPayloadJsonl(chatId, fromAid, messageId, msgEncrypted, false, logDescriptor, threadId, receivedAt, seq);
             logger.info(`${this.logPrefix()} P2P dropped (type deny): type=${p2pPayloadType} from=${shortAid}(${displayName}) mid=${messageId}`);
             return;
         }
@@ -1597,24 +1741,15 @@ export class AUNChannel {
         appendAidEvent({ ts: Date.now(), iso: new Date().toISOString(), event: 'message_in', aid: this.config.aid, from: fromAid, msgId: messageId, kind: 'text', len: finalText.length });
         const isSystemP2P = p2pPayloadType === 'event';
         this.aidStatsCollector?.recordInbound(this.config.aid, fromAid, Buffer.byteLength(finalText, 'utf-8'), finalText, isSystemP2P, msgEncrypted, msgChatmode, isSystemP2P ? 'notify' : 'send');
-        const replyContext = { metadata: { encrypted: msgEncrypted, chatmode: msgChatmode, refMessageId } };
-        if (threadId)
-            replyContext.threadId = threadId;
-        replyContext.peerId = fromAid;
-        if (messageId)
-            replyContext.replyToMessageId = messageId;
-        // 协议 v2.4 §6.4/§12.1: 话题会话创建时传入 topicName
-        if (topicName && threadId) {
-            if (!replyContext.metadata)
-                replyContext.metadata = {};
-            replyContext.metadata.topicName = topicName;
-        }
+        const replyContext = this.buildPrivateReplyContext(threadId, fromAid, msgEncrypted, messageId, msgChatmode, topicName, refMessageId);
         this.dispatchMessage({
             channelId: chatId,
             userId: fromAid,
             text: finalText,
             chatType: 'private',
             messageId,
+            receivedAt,
+            gatewaySeq: seq,
             causation,
             seq,
             threadId,
@@ -1637,6 +1772,7 @@ export class AUNChannel {
         if (!data || typeof data !== 'object')
             return;
         const msg = data;
+        const receivedAt = Date.now();
         // Deduplicate at the adapter boundary, before mention/slash routing.
         const messageId = typeof msg.message_id === 'string' ? msg.message_id : '';
         const seq = typeof msg.seq === 'number' ? msg.seq : undefined;
@@ -1654,7 +1790,7 @@ export class AUNChannel {
             return;
         const payloadMentionAids = mentionEntryAids(payloadMentionEntries);
         const logDescriptor = classifyAunPayloadForLog(payload);
-        const text = this.extractTextPayload(payload, groupId, senderAid);
+        const text = this.extractTextPayload(payload, groupId, senderAid, { chatType: 'group', groupId });
         const threadId = typeof payload === 'object' && payload !== null ? payload.thread_id : undefined;
         const topicName = (typeof payload === 'object' && payload !== null)
             ? this.sanitizeTopicName(payload.topicName)
@@ -1710,7 +1846,7 @@ export class AUNChannel {
                     peerName: displayName,
                     peerType: peerInfo?.type || 'unknown',
                     seq,
-                    replyContext: this.buildGroupReplyContext(threadId, senderAid, msgEncryptedFast, messageId, msgChatmodeFast, topicName),
+                    replyContext: this.buildGroupReplyContext(threadId, senderAid, msgEncryptedFast, messageId, msgChatmodeFast, topicName, groupId),
                     createdAt,
                 });
                 return;
@@ -1720,7 +1856,7 @@ export class AUNChannel {
         {
             const payloadType = (payload && typeof payload === 'object') ? payload.type ?? '' : '';
             if (payloadType === 'action_card_reply') {
-                this.appendInboundPayloadJsonl(groupId, senderAid, messageId, !!env.encrypted, true, logDescriptor, threadId);
+                this.appendInboundPayloadJsonl(groupId, senderAid, messageId, !!env.encrypted, true, logDescriptor, threadId, receivedAt, seq);
                 return;
             }
         }
@@ -1733,18 +1869,18 @@ export class AUNChannel {
             if (payloadType.startsWith('menu.')) {
                 const menuEncrypted = !!env.encrypted;
                 this.acknowledgeImmediately(messageId, seq);
-                this.appendInboundPayloadJsonl(groupId, senderAid, messageId, menuEncrypted, true, logDescriptor, threadId);
+                this.appendInboundPayloadJsonl(groupId, senderAid, messageId, menuEncrypted, true, logDescriptor, threadId, receivedAt, seq);
                 this.dispatchMessage({
                     channelId: groupId, userId: senderAid,
                     text: JSON.stringify(payload),
-                    chatType: 'group', messageId, seq, groupId,
+                    chatType: 'group', messageId, seq, receivedAt, gatewaySeq: seq, groupId,
                     encrypted: menuEncrypted,
                     protectedHeaders,
                     mentions: payloadMentionEntries,
                     mentionAids: payloadMentionAids,
                     isMentioned: hasMentionAll(payloadMentionEntries)
                         || (!!this._aid && mentionEntryTargets(payloadMentionEntries).includes(this._aid)),
-                    replyContext: this.buildGroupReplyContext(threadId, senderAid, menuEncrypted, messageId, payloadObj?.chatmode, topicName),
+                    replyContext: this.buildGroupReplyContext(threadId, senderAid, menuEncrypted, messageId, payloadObj?.chatmode, topicName, groupId),
                     msgType: logDescriptor.msgType,
                     payloadType: logDescriptor.payloadType,
                     payloadSummary: logDescriptor.payloadSummary,
@@ -1754,7 +1890,7 @@ export class AUNChannel {
             }
             if (payloadType && !AUNChannel.PROACTIVE_ALLOW_TYPES.has(payloadType)) {
                 this.acknowledgeImmediately(messageId, seq);
-                this.appendInboundPayloadJsonl(groupId, senderAid, messageId, !!env.encrypted, true, logDescriptor, threadId);
+                this.appendInboundPayloadJsonl(groupId, senderAid, messageId, !!env.encrypted, true, logDescriptor, threadId, receivedAt, seq);
                 logger.info(`${this.logPrefix()} Group dropped (type deny): type=${payloadType} group=${groupId} sender=${senderAid} mid=${messageId}`);
                 return;
             }
@@ -1795,7 +1931,7 @@ export class AUNChannel {
             this.pendingEchoMessages.set(messageId, {
                 text: echoText,
                 channelId: groupId,
-                context: this.buildGroupReplyContext(undefined, senderAid, msgEncrypted, messageId, msgChatmodeEcho, undefined),
+                context: this.buildGroupReplyContext(undefined, senderAid, msgEncrypted, messageId, msgChatmodeEcho, undefined, groupId),
                 receiveTs: Date.now(),
             });
             // 继续走正常 Agent 流程（下面的代码会 dispatch）
@@ -1817,7 +1953,7 @@ export class AUNChannel {
             // TODO: Phase 6 实施 selective-response 模式后，移除此过滤，只保留 isMentioned 标记
             if (enforceMention && !isMentioned && !isOwnHandoff) {
                 this.acknowledgeImmediately(messageId, seq);
-                this.appendInboundPayloadJsonl(groupId, senderAid, messageId, msgEncrypted, true, logDescriptor, threadId);
+                this.appendInboundPayloadJsonl(groupId, senderAid, messageId, msgEncrypted, true, logDescriptor, threadId, receivedAt, seq);
                 logger.info(`${this.logPrefix()} Group dropped: unmentioned (group=${groupId} sender=${senderAid} mid=${messageId} mentionMode=${mentionMode} isCommand=${isCommandMsg} textPreview=${JSON.stringify(text.slice(0, 80))})`);
                 return;
             }
@@ -1838,7 +1974,7 @@ export class AUNChannel {
         }
         const mentions = payloadMentionEntries;
         // Process attachments
-        const { finalText, images: inboundImages } = await this.processAttachments(payload, strippedText, groupId, rawAttachments);
+        const { finalText, images: inboundImages } = await this.processAttachments(payload, strippedText, groupId, rawAttachments, { chatType: 'group', groupId });
         const selfAgentDir = path.join(resolvePaths().agentsDir, this.config.aid);
         const peerIdentity = await PeerIdentityCache.resolve('aun', senderAid, selfAgentDir, this.store, false);
         const shortAid = this.getShortAid(senderAid);
@@ -1882,6 +2018,8 @@ export class AUNChannel {
             text: finalText,
             chatType: 'group',
             messageId,
+            receivedAt,
+            gatewaySeq: seq,
             seq,
             threadId,
             mentions,
@@ -1889,7 +2027,7 @@ export class AUNChannel {
             isMentioned: isOwnHandoff || mentionedSelf || mentionedAll,
             source: isOwnHandoff ? 'handoff' : undefined,
             encrypted: msgEncrypted,
-            replyContext: this.buildGroupReplyContext(threadId, senderAid, msgEncrypted, messageId, msgChatmode, topicName),
+            replyContext: this.buildGroupReplyContext(threadId, senderAid, msgEncrypted, messageId, msgChatmode, topicName, groupId),
             mentionMode: serverMentionMode,
             images: inboundImages.length > 0 ? inboundImages : undefined,
             msgType: logDescriptor.msgType,
@@ -1899,6 +2037,19 @@ export class AUNChannel {
         });
     }
     dispatchMessage(event) {
+        const authenticatedDelivery = event.chatType === 'group'
+            ? { chatType: 'group', groupId: event.groupId ?? event.channelId }
+            : { chatType: 'private' };
+        const suppliedDelivery = event.replyContext?.delivery;
+        const suppliedMatches = suppliedDelivery?.chatType === 'private'
+            ? authenticatedDelivery.chatType === 'private'
+            : suppliedDelivery?.chatType === 'group'
+                && authenticatedDelivery.chatType === 'group'
+                && suppliedDelivery.groupId === authenticatedDelivery.groupId;
+        const delivery = suppliedDelivery && suppliedMatches ? suppliedDelivery : authenticatedDelivery;
+        if (suppliedDelivery && delivery !== suppliedDelivery) {
+            logger.warn(`${this.logPrefix()} Ignoring mismatched inbound reply route: channel=${event.channelId} chatType=${event.chatType}`);
+        }
         // Inbound events are claimed in handleIncomingPrivateMessage / GroupMessage
         // before parsing. Keeping dedupe there prevents duplicate slash commands
         // from reaching routing and mention policy code.
@@ -1926,19 +2077,24 @@ export class AUNChannel {
             this.pendingEchoMessages.set(event.messageId, {
                 text: echoText,
                 channelId: event.channelId,
-                context: event.replyContext ? { metadata: event.replyContext.metadata } : undefined,
+                context: {
+                    ...(event.replyContext?.metadata ? { metadata: event.replyContext.metadata } : {}),
+                    delivery,
+                },
                 receiveTs: Date.now(),
             });
             logger.info(`${this.logPrefix()} [Echo] long echo stored: mid=${event.messageId} channelId=${event.channelId}`);
         }
         if (!this.messageHandler)
             return;
-        // Use caller-supplied replyContext (group path builds mentionUserIds);
-        // fall back to simple threadId-only context for private messages
-        let replyContext = event.replyContext;
-        if (!replyContext && event.threadId) {
-            replyContext = { threadId: event.threadId };
-        }
+        // Preserve the caller-supplied context (group paths add mention fields),
+        // but always attach the route derived from this authenticated event when
+        // a synthetic/test event omitted it. Never infer the route from the AID.
+        const replyContext = {
+            ...(event.replyContext ?? {}),
+            delivery,
+            ...(event.threadId && !event.replyContext?.threadId ? { threadId: event.threadId } : {}),
+        };
         this.messageHandler({
             channelId: event.channelId || '',
             channelType: 'aun',
@@ -1955,6 +2111,8 @@ export class AUNChannel {
             encrypted: event.encrypted,
             protectedHeaders: event.protectedHeaders,
             messageId: event.messageId,
+            receivedAt: event.receivedAt,
+            gatewaySeq: event.gatewaySeq ?? event.seq,
             causation: event.causation,
             threadId: event.threadId,
             mentions: event.mentions,
@@ -1972,7 +2130,7 @@ export class AUNChannel {
             logger.error(`${this.logPrefix()} Message handler error:`, err);
         });
     }
-    appendInboundPayloadJsonl(channelId, fromAid, msgId, encrypt, isGroup, descriptor, threadId) {
+    appendInboundPayloadJsonl(channelId, fromAid, msgId, encrypt, isGroup, descriptor, threadId, receivedAt, gatewaySeq) {
         try {
             const chatDir = chatDirPath(resolvePaths().sessionsDir, 'aun', channelId, this.config.aid);
             appendMessageLog(chatDir, buildInboundEntry({
@@ -1987,6 +2145,9 @@ export class AUNChannel {
                 msgType: descriptor.msgType,
                 payloadType: descriptor.payloadType,
                 payloadSummary: descriptor.payloadSummary,
+                timestamp: receivedAt,
+                receivedAt,
+                gatewaySeq,
             }));
         }
         catch (e) {
@@ -2190,7 +2351,14 @@ export class AUNChannel {
         }
         const replyTarget = event.channelId;
         // 不传 peerId,避免 sendMessage 在头部追加 @peer
-        const context = { threadId: event.threadId, metadata: event.replyContext?.metadata };
+        const authenticatedDelivery = event.chatType === 'group'
+            ? { chatType: 'group', groupId: event.channelId }
+            : { chatType: 'private' };
+        const context = {
+            threadId: event.threadId,
+            metadata: event.replyContext?.metadata,
+            delivery: authenticatedDelivery,
+        };
         const sendStart = Date.now();
         this.isEchoSending = true;
         this.sendMessage(replyTarget, echoText, context).then(() => {
@@ -2611,14 +2779,18 @@ export class AUNChannel {
         const timer = setTimeout(() => this.invalidatedInteractions.delete(interactionId), 24 * 60 * 60 * 1000);
         timer.unref?.();
     }
-    async recallInteractionCard(messageId, channelId) {
+    async recallInteractionCard(messageId, channelId, delivery) {
         if (!this.client || !this.connected)
             return false;
         try {
-            const isGroup = channelId ? this.isGroupId(channelId) : false;
+            if (!channelId || !delivery) {
+                logger.warn(`${this.logPrefix()} Cannot recall interaction card without trusted delivery route: mid=${messageId}`);
+                return false;
+            }
+            const isGroup = delivery.chatType === 'group';
             const method = isGroup ? 'group.recall' : 'message.recall';
             const params = isGroup
-                ? { group_id: channelId, message_ids: [messageId] }
+                ? { group_id: delivery.groupId, message_ids: [messageId] }
                 : { message_ids: [messageId] };
             await this.callAndTrace(method, params, { silentError: true });
             return true;
@@ -2641,9 +2813,10 @@ export class AUNChannel {
         }
         const messageIds = [...(this.interactionCardMessageIds.get(interactionId) ?? [])];
         for (const messageId of messageIds) {
-            const channelId = this.cardMessageIdMap.get(messageId)?.channelId;
+            const card = this.cardMessageIdMap.get(messageId);
+            const channelId = card?.channelId;
             this.forgetInteractionCard(messageId, interactionId);
-            await this.recallInteractionCard(messageId, channelId);
+            await this.recallInteractionCard(messageId, channelId, card?.delivery);
         }
     }
     forgetInteractionCard(messageId, interactionId) {
@@ -2653,7 +2826,7 @@ export class AUNChannel {
         if (ids && ids.size === 0)
             this.interactionCardMessageIds.delete(interactionId);
     }
-    registerCardPostSend(messageId, action, channelId) {
+    registerCardPostSend(messageId, action, channelId, delivery) {
         if (action.type !== 'register_interaction_card')
             return;
         this.cardMessageIdMap.set(messageId, {
@@ -2661,6 +2834,7 @@ export class AUNChannel {
             isCommandCard: action.isCommandCard,
             initiatorAid: action.initiatorAid,
             channelId,
+            delivery: delivery ?? action.delivery,
         });
         this.ownedCardMsgIds.add(messageId);
         let messageIds = this.interactionCardMessageIds.get(action.requestId);
@@ -2686,17 +2860,18 @@ export class AUNChannel {
         const invalidationReason = this.invalidatedInteractions.get(action.requestId);
         if (invalidationReason) {
             this.cardMessageIdMap.delete(messageId);
-            void this.recallInteractionCard(messageId, channelId);
+            void this.recallInteractionCard(messageId, channelId, delivery ?? action.delivery);
         }
     }
     runPostSend(entry, messageId) {
         if (!entry.postSend)
             return;
         if (entry.postSend.type === 'register_interaction_card') {
-            this.registerCardPostSend(messageId, entry.postSend, entry.channelId);
+            this.registerCardPostSend(messageId, entry.postSend, entry.channelId, entry.delivery);
         }
     }
     async sendAunPayload(channelId, payload, context, label) {
+        const delivery = this.requireDelivery(channelId, context);
         let normalizedPayload;
         try {
             normalizedPayload = this.normalizeAunPayloadMentions(payload);
@@ -2709,7 +2884,7 @@ export class AUNChannel {
         }
         if (!this.client || !this.connected)
             return { ok: false };
-        const isGroup = this.isGroupId(channelId);
+        const isGroup = delivery.chatType === 'group';
         const targetAid = channelId;
         const encryptTarget = isGroup ? channelId : targetAid;
         const encrypt = context?.metadata?.encrypted != null
@@ -2727,7 +2902,7 @@ export class AUNChannel {
         const truncatedPayload = this.truncatePayloadIfNeeded(payloadWithCausationRef, label);
         const params = { payload: truncatedPayload, encrypt };
         if (isGroup)
-            params.group_id = channelId;
+            params.group_id = delivery.groupId;
         else
             params.to = targetAid;
         const callOnce = async (sendParams, fallback) => {
@@ -2797,6 +2972,8 @@ export class AUNChannel {
         this.forwardOutbound(result);
     }
     async sendContentPayload(channelId, payload, opts) {
+        const delivery = this.requireDelivery(channelId, opts.context);
+        const context = this.withDelivery(opts.context, delivery);
         // Validate the caller's raw mentions before any early-return policy (such
         // as a cancelled interaction) can hide a malformed wire payload.
         const validatedPayload = this.normalizeAunPayloadMentions(payload);
@@ -2812,14 +2989,15 @@ export class AUNChannel {
         // Validate the caller's raw mentions before deep-cleaning: that helper
         // intentionally removes undefined array elements, which would otherwise
         // turn malformed `mentions: [undefined]` into an apparently valid `[]`.
-        const finalPayload = this.normalizeAunPayloadMentions(this.applyReplyContextToPayload(validatedPayload, opts.context));
+        const finalPayload = this.normalizeAunPayloadMentions(this.applyReplyContextToPayload(validatedPayload, context));
         const logText = opts.logText ?? this.payloadLogText(finalPayload, opts.contentKind);
         const entry = outbox.enqueue(this.config.aid, {
             channelId,
+            delivery,
             type: 'payload',
             contentKind: opts.contentKind,
             payload: finalPayload,
-            context: opts.context,
+            context,
             logText,
             ttl: opts.ttl,
             postSend: opts.postSend,
@@ -2966,13 +3144,15 @@ export class AUNChannel {
             logger.warn(`${this.logPrefix()} Attempted to send empty message, skipping`);
             return;
         }
+        const delivery = this.requireDelivery(channelId, context);
+        const routedContext = this.withDelivery(context, delivery);
         // 长 echo: agent 首次回复前先发 echo trace（echo 自身发送时跳过）
         if (!this.isEchoSending) {
-            await this.flushPendingEcho(channelId);
+            await this.flushPendingEcho(channelId, delivery);
         }
         let finalText = text;
         this.sentCount.set(channelId, (this.sentCount.get(channelId) || 0) + 1);
-        if (this.isGroupId(channelId)) {
+        if (delivery.chatType === 'group') {
             const requestedMentions = Array.from(new Set((context?.mentionUserIds ?? [])
                 .filter((id) => typeof id === 'string' && id.trim().length > 0)
                 .map(id => id.trim())));
@@ -2995,8 +3175,8 @@ export class AUNChannel {
                 }
             }
         }
-        const operationId = typeof context?.metadata?.operationId === 'string'
-            ? context.metadata.operationId
+        const operationId = typeof routedContext.metadata?.operationId === 'string'
+            ? routedContext.metadata.operationId
             : undefined;
         if (operationId) {
             const chatDir = chatDirPath(resolvePaths().sessionsDir, 'aun', channelId, this.config.aid);
@@ -3006,13 +3186,14 @@ export class AUNChannel {
         // Write-ahead: persist to outbox before attempting send
         const entry = outbox.enqueue(this.config.aid, {
             channelId,
+            delivery,
             dedupeKey: operationId,
-            critical: context?.metadata?.criticalDelivery === true,
+            critical: routedContext.metadata?.criticalDelivery === true,
             type: 'text',
             text: finalText,
-            context,
-            ttl: typeof context?.metadata?.outboxTtl === 'number'
-                ? context.metadata.outboxTtl
+            context: routedContext,
+            ttl: typeof routedContext.metadata?.outboxTtl === 'number'
+                ? routedContext.metadata.outboxTtl
                 : undefined,
         });
         logger.debug(`${this.logPrefix()} Outbox enqueued: id=${entry.id} channel=${channelId} text=${finalText.slice(0, 40)}`);
@@ -3036,8 +3217,8 @@ export class AUNChannel {
     }
     /** Daemon-side transport for `ec msg send` running inside an agent task. */
     async sendDaemonMsg(args) {
-        if (!args.to || this.isGroupId(args.to)) {
-            return { ok: false, error: 'aun-msg-send only supports private AID targets', code: 'UNSUPPORTED_TARGET' };
+        if (!args.to) {
+            return { ok: false, error: 'aun-msg-send requires a private target', code: 'UNSUPPORTED_TARGET' };
         }
         if (!args.payload || typeof args.payload !== 'object' || Array.isArray(args.payload)) {
             return { ok: false, error: 'payload must be an object', code: 'INVALID_PAYLOAD' };
@@ -3161,8 +3342,8 @@ export class AUNChannel {
     }
     /** Daemon-side transport for `ec group send` running inside an agent task. */
     async sendDaemonGroupMsg(args) {
-        if (!args.groupId || !this.isGroupId(args.groupId)) {
-            return { ok: false, error: 'aun-msg-send requires a valid group target', code: 'UNSUPPORTED_TARGET' };
+        if (!args.groupId) {
+            return { ok: false, error: 'aun group send requires a group target', code: 'UNSUPPORTED_TARGET' };
         }
         if (!args.payload || typeof args.payload !== 'object' || Array.isArray(args.payload)) {
             return { ok: false, error: 'payload must be an object', code: 'INVALID_PAYLOAD' };
@@ -3246,7 +3427,7 @@ export class AUNChannel {
             return { ok: false, error: e?.message || String(e), code: e?.code };
         }
     }
-    async flushPendingEcho(channelId) {
+    async flushPendingEcho(channelId, delivery) {
         // 查找该 channelId 是否有 pending echo（长 echo 等待 agent 首次回复）
         for (const [key, echo] of this.pendingEchoMessages) {
             if (echo.channelId === channelId) {
@@ -3270,18 +3451,32 @@ export class AUNChannel {
                         ts: Date.now(),
                         aid: this.config.aid,
                         channelId,
+                        delivery,
                         type: 'text',
                         text: echoText,
+                        context: this.withDelivery(echo.context, delivery),
                         ttl: 300_000,
                     };
                     const ok = await this.deliverTextEntry(echoEntry);
                     if (!ok) {
-                        outbox.enqueue(this.config.aid, { channelId, type: 'text', text: echoText });
+                        outbox.enqueue(this.config.aid, {
+                            channelId,
+                            delivery,
+                            type: 'text',
+                            text: echoText,
+                            context: this.withDelivery(echo.context, delivery),
+                        });
                     }
                     logger.info(`${this.logPrefix()} [Echo] long echo trace delivered=${ok} to ${channelId} (agent ${agentDuration}ms)`);
                 }
                 else {
-                    outbox.enqueue(this.config.aid, { channelId, type: 'text', text: echoText });
+                    outbox.enqueue(this.config.aid, {
+                        channelId,
+                        delivery,
+                        type: 'text',
+                        text: echoText,
+                        context: this.withDelivery(echo.context, delivery),
+                    });
                     logger.warn(`${this.logPrefix()} [Echo] not connected, echo trace queued in outbox`);
                 }
                 break;
@@ -3291,7 +3486,8 @@ export class AUNChannel {
     async deliverTextEntry(entry) {
         const channelId = entry.channelId;
         const finalText = entry.text;
-        const context = entry.context;
+        const delivery = this.requirePersistedDelivery(channelId, entry.delivery);
+        const context = this.withDelivery(entry.context, delivery);
         const operationId = entry.dedupeKey
             || (typeof context?.metadata?.operationId === 'string' ? context.metadata.operationId : undefined);
         if (operationId) {
@@ -3309,7 +3505,7 @@ export class AUNChannel {
         // 从 context.metadata.source 读取 source，默认为 'daemon'
         const source = context?.metadata?.source ?? 'daemon';
         const payload = { type: 'text', text: finalText };
-        if (this.isGroupId(channelId)) {
+        if (delivery.chatType === 'group') {
             const extracted = this.extractMentionEntriesFromText(finalText);
             if (extracted.length > 0)
                 payload.mentions = extracted;
@@ -3323,7 +3519,7 @@ export class AUNChannel {
         if (context?.metadata?.chatmode)
             payload.chatmode = context.metadata.chatmode;
         const causation = normalizeCausation(context?.metadata?.causation);
-        const causationRef = !this.isGroupId(channelId) && causation
+        const causationRef = delivery.chatType !== 'group' && causation
             ? `caus_${crypto.randomUUID().replace(/-/g, '')}`
             : undefined;
         if (causationRef && causation) {
@@ -3332,7 +3528,7 @@ export class AUNChannel {
         }
         // 诊断日志：记录 payload 构造结果（含 task_id / thread_id / chatmode）
         logger.info(`${this.logPrefix()} deliverTextEntry: channelId=${channelId} thread_id=${payload.thread_id ?? 'none'} task_id=${payload.task_id ?? 'none'} chatmode=${payload.chatmode ?? 'none'} source=${source} textLen=${finalText.length}`);
-        const isGroup = this.isGroupId(channelId);
+        const isGroup = delivery.chatType === 'group';
         const targetAid = channelId;
         if (operationId && entry.deliveryReceipt) {
             this.appendOutboundJsonl(channelId, {
@@ -3506,7 +3702,8 @@ export class AUNChannel {
         }
         const contentKind = entry.contentKind;
         const logText = entry.logText ?? this.payloadLogText(payload, contentKind);
-        const context = entry.context;
+        const delivery = this.requirePersistedDelivery(channelId, entry.delivery);
+        const context = this.withDelivery(entry.context, delivery);
         logger.info(`${this.logPrefix()} deliverPayloadEntry: id=${entry.id} kind=${contentKind ?? payload.type ?? 'payload'} channelId=${channelId} thread_id=${payload.thread_id ?? 'none'} task_id=${payload.task_id ?? 'none'} textLen=${logText.length}`);
         const sent = await this.sendAunPayload(channelId, payload, context, `${contentKind ?? payload.type ?? 'payload'}`);
         if (sent.discarded) {
@@ -3515,7 +3712,7 @@ export class AUNChannel {
         }
         if (!sent.ok || !sent.messageId)
             return sent;
-        const isGroup = this.isGroupId(channelId);
+        const isGroup = delivery.chatType === 'group';
         const statsContext = isGroup ? await this.groupStatsContext(channelId) : undefined;
         this.logAunSendAccepted(isGroup ? 'group.send' : 'message.send', isGroup ? channelId : this.peerLabel(channelId), sent.messageId, !!sent.encrypt, sent.result, logText);
         this.recordDurableOutbound(channelId, payload, sent.messageId, !!sent.encrypt, context, isGroup, contentKind, logText, sent.result, statsContext);
@@ -3577,6 +3774,8 @@ export class AUNChannel {
     async sendThought(channelId, taskId, payload, context) {
         if (!taskId)
             return;
+        const delivery = this.requireDelivery(channelId, context);
+        context = this.withDelivery(context, delivery);
         const validatedPayload = this.normalizeAunPayloadMentions(payload);
         const finalPayload = this.normalizeAunPayloadMentions(this.stripUndefinedDeep(validatedPayload));
         if (!this.connected || !this.client)
@@ -3621,8 +3820,8 @@ export class AUNChannel {
             else {
                 thoughtText = this.activityLogText(finalPayload);
             }
-            if (this.isGroupId(channelId)) {
-                params.group_id = targetId;
+            if (delivery.chatType === 'group') {
+                params.group_id = delivery.groupId;
                 const putRes = await this.callAndTrace('group.thought.put', params);
                 const tid = putRes?.thought_id;
                 logger.info(`${this.logPrefix()} thought.put ok group=${targetId} task=${taskId} stage=${stage} encrypt=${encrypt} tid=${tid ?? '?'}`);
@@ -3652,13 +3851,15 @@ export class AUNChannel {
     }
     /** 发送结构化 AUN payload；transient 协议载荷不写本地 messages.jsonl。 */
     async sendStructured(channelId, payload, context) {
+        const delivery = this.requireDelivery(channelId, context);
+        context = this.withDelivery(context, delivery);
         // Validate before checking connection state so malformed producer payloads
         // are reported deterministically instead of being hidden by a disconnect.
         const validatedPayload = this.normalizeAunPayloadMentions(payload);
         const finalPayload = this.stripUndefinedDeep(validatedPayload);
         if (!this.connected || !this.client)
             return null;
-        const isGroup = this.isGroupId(channelId);
+        const isGroup = delivery.chatType === 'group';
         const targetAid = channelId;
         const encryptTarget = isGroup ? channelId : targetAid;
         const encrypt = context?.metadata?.encrypted != null
@@ -3684,7 +3885,7 @@ export class AUNChannel {
         }
         try {
             if (isGroup) {
-                params.group_id = channelId;
+                params.group_id = delivery.groupId;
                 const result = await this.callAndTrace('group.send', params);
                 const mid = result?.message?.message_id ?? result?.message_id ?? null;
                 logger.info(`${this.logPrefix()} group.send (${payload.type}) ok: group=${channelId} mid=${mid} encrypt=${encrypt}`);
@@ -3708,6 +3909,8 @@ export class AUNChannel {
         }
     }
     async sendFile(channelId, filePath, context) {
+        const delivery = this.requireDelivery(channelId, context);
+        context = this.withDelivery(context, delivery);
         const absPath = path.resolve(filePath);
         if (!fs.existsSync(absPath)) {
             logger.warn(`${this.logPrefix()} sendFile: file not found: ${absPath}`);
@@ -3725,6 +3928,7 @@ export class AUNChannel {
         // Write-ahead: persist to outbox
         const entry = outbox.enqueue(this.config.aid, {
             channelId,
+            delivery,
             type: 'file',
             filePath: absPath,
             context,
@@ -3743,6 +3947,8 @@ export class AUNChannel {
         }
     }
     async sendImage(channelId, data, mimeType, alt, context) {
+        const delivery = this.requireDelivery(channelId, context);
+        context = this.withDelivery(context, delivery);
         if (!Buffer.isBuffer(data)) {
             throw new Error('result.image data must be a Buffer');
         }
@@ -3764,6 +3970,7 @@ export class AUNChannel {
         const logText = alt ? `[image] ${alt}` : '[image]';
         const entry = outbox.enqueue(this.config.aid, {
             channelId,
+            delivery,
             type: 'image',
             contentKind: 'image',
             image: { dataBase64: data.toString('base64'), mimeType: normalizedMimeType, alt },
@@ -3822,6 +4029,9 @@ export class AUNChannel {
             logger.warn(`${this.logPrefix()} deliverImageEntry: missing image data (outbox id=${entry.id})`);
             return true;
         }
+        const delivery = this.requirePersistedDelivery(entry.channelId, entry.delivery);
+        entry.delivery = delivery;
+        entry.context = this.withDelivery(entry.context, delivery);
         const data = Buffer.from(image.dataBase64, 'base64');
         if (data.length === 0) {
             logger.warn(`${this.logPrefix()} deliverImageEntry: invalid image data (outbox id=${entry.id})`);
@@ -3839,6 +4049,7 @@ export class AUNChannel {
         if (!outbox.replace(this.config.aid, entry)) {
             payloadEntry = outbox.enqueue(this.config.aid, {
                 channelId: entry.channelId,
+                delivery,
                 type: 'payload',
                 contentKind: 'image',
                 payload: entry.payload,
@@ -3856,7 +4067,8 @@ export class AUNChannel {
     async deliverFileEntry(entry) {
         const channelId = entry.channelId;
         const absPath = entry.filePath;
-        const context = entry.context;
+        const delivery = this.requirePersistedDelivery(channelId, entry.delivery);
+        const context = this.withDelivery(entry.context, delivery);
         if (!fs.existsSync(absPath)) {
             logger.warn(`${this.logPrefix()} deliverFileEntry: file gone: ${absPath}`);
             return true; // remove from outbox, file no longer exists
@@ -3914,7 +4126,7 @@ export class AUNChannel {
                 attachment,
                 context,
             });
-            const isGroup = this.isGroupId(channelId);
+            const isGroup = delivery.chatType === 'group';
             const fileTargetAid = channelId;
             const encryptTarget = isGroup ? channelId : fileTargetAid;
             const encrypt = context?.metadata?.encrypted != null
@@ -3925,7 +4137,7 @@ export class AUNChannel {
             let sentMid = null;
             try {
                 if (isGroup) {
-                    params.group_id = channelId;
+                    params.group_id = delivery.groupId;
                     this.trace('OUT', 'group.send.file', params);
                     const result = await this.client.call('group.send', params);
                     sendResult = result;
@@ -4033,6 +4245,10 @@ export class AUNChannel {
             return;
         logger.info(`${this.logPrefix()} Draining outbox...`);
         const result = await outbox.drain(this.config.aid, async (entry) => {
+            if (!isDeliveryTarget(entry.delivery)) {
+                logger.warn(`${this.logPrefix()} Discarding legacy/malformed outbox entry without a trusted delivery route: id=${entry.id} channel=${entry.channelId}`);
+                return true;
+            }
             if (entry.type === 'text') {
                 return this.withOutboxInFlight(entry, () => this.deliverTextEntry(entry), false);
             }
@@ -4058,11 +4274,23 @@ export class AUNChannel {
         this.messageSeqMap.delete(messageId);
     }
     sendProcessingStatus(channelId, status, sessionId, taskId, context, extraMeta) {
+        let delivery;
+        try {
+            delivery = this.requireDelivery(channelId, context);
+        }
+        catch (error) {
+            logger.warn(`${this.logPrefix()} task.${status} notify skipped without trusted delivery route: channel=${channelId} task=${taskId} error=${error instanceof Error ? error.message : String(error)}`);
+            return;
+        }
+        context = this.withDelivery(context, delivery);
         if (status === 'start')
             this.sentCount.delete(channelId); // 新任务开始，重置计数
         if (!this.client || !this.connected)
             return;
-        const severity = status === 'error' || status === 'timeout' ? 'error' : 'info';
+        const requestedSeverity = extraMeta?.severity;
+        const severity = requestedSeverity === 'warn'
+            ? 'warn'
+            : status === 'error' || status === 'timeout' ? 'error' : 'info';
         const stateMap = {
             start: 'started',
             done: 'completed',
@@ -4081,7 +4309,10 @@ export class AUNChannel {
             severity,
             terminal: ['done', 'interrupted', 'error', 'timeout'].includes(status),
         };
-        const metadata = extraMeta ? this.stripUndefinedDeep(extraMeta) : undefined;
+        const metadataInput = extraMeta ? { ...extraMeta } : undefined;
+        if (metadataInput)
+            delete metadataInput.severity;
+        const metadata = metadataInput ? this.stripUndefinedDeep(metadataInput) : undefined;
         if (metadata && Object.keys(metadata).length > 0)
             statusPayload.metadata = metadata;
         if (context?.threadId)
@@ -4093,8 +4324,8 @@ export class AUNChannel {
         if (context?.replyToMessageId)
             statusPayload.ref_message_id = context.replyToMessageId;
         const notifyOptions = { ttlMs: 60_000 };
-        if (this.isGroupId(channelId))
-            notifyOptions.groupId = channelId;
+        if (delivery.chatType === 'group')
+            notifyOptions.groupId = delivery.groupId;
         else
             notifyOptions.to = channelId;
         this.trace('OUT', 'notify.task_status', {
@@ -4115,7 +4346,7 @@ export class AUNChannel {
         }).catch(() => { });
         this.aidStatsCollector?.recordOutbound(this.config.aid, channelId, JSON.stringify(statusPayload).length, undefined, true, undefined, undefined, 'notify');
         // 群聊显示 group id 简称，P2P 显示 peer label；从 context.metadata 读取 chatmode
-        const targetLabel = this.isGroupId(channelId) ? channelId : this.peerLabel(channelId);
+        const targetLabel = delivery.chatType === 'group' ? delivery.groupId : this.peerLabel(channelId);
         const chatmode = context?.metadata?.chatmode ?? '?';
         const initiator = statusPayload.initiator ?? '';
         const refMsgId = statusPayload.ref_message_id ?? '';
@@ -4127,8 +4358,6 @@ export class AUNChannel {
             logger.info(logTaskStatus);
     }
     async sendCustomPayload(channelId, payload, context) {
-        if (!this.client || !this.connected)
-            return;
         // SDK 0.3.0 E2EE requires payload to be an object
         let payloadObj;
         try {
@@ -4362,21 +4591,25 @@ export class AUNChannelPlugin {
             channelKey: inst.name, // channelName 实际上就是 channelKey
             capabilities: { file: true, image: true, interaction: true, markdown: true, thought: true, status: true, thread: true, authenticatedApproval: true },
             send: async (envelope, payload) => {
+                const channelId = envelope?.channelId;
+                const delivery = requireEnvelopeDelivery(channelId, envelope?.delivery, envelope?.replyContext?.delivery);
                 const parentCausation = normalizeCausation(envelope.causation ?? envelope.replyContext?.metadata?.causation);
                 const outboundCausation = parentCausation ? deriveCausation(parentCausation) : undefined;
                 const replyCtx = outboundCausation
                     ? {
                         ...(envelope.replyContext ?? {}),
+                        delivery,
                         metadata: { ...(envelope.replyContext?.metadata ?? {}), causation: outboundCausation },
                     }
-                    : envelope.replyContext;
+                    : (envelope.replyContext || envelope.delivery)
+                        ? { ...(envelope.replyContext ?? {}), delivery }
+                        : undefined;
                 if (outboundCausation) {
                     recordCausationSpan(outboundCausation, 'message.outbound', {
                         status: 'started',
                         refs: { taskId: envelope.taskId, sessionId: envelope.sessionId },
                     });
                 }
-                const channelId = envelope.channelId;
                 const taskBase = () => channel.buildTaskPayloadBase(envelope, replyCtx);
                 switch (payload.kind) {
                     case 'result.text':
@@ -4505,7 +4738,7 @@ export class AUNChannelPlugin {
                                 aunCard.text = action.body;
                                 setIfDefined(aunCard, 'format', action.bodyFormat);
                             }
-                            if (req.initiatorId && channel.isGroupId(channelId))
+                            if (req.initiatorId && replyCtx?.delivery?.chatType === 'group')
                                 aunCard.initiator = req.initiatorId;
                             if (replyCtx?.threadId)
                                 aunCard.thread_id = replyCtx.threadId;
@@ -4518,6 +4751,7 @@ export class AUNChannelPlugin {
                                     requestId: req.id,
                                     isCommandCard: false,
                                     initiatorAid: req.initiatorId,
+                                    delivery: replyCtx?.delivery,
                                     expiresAt: Date.now() + cardTtlMs,
                                 },
                             });
@@ -4542,7 +4776,7 @@ export class AUNChannelPlugin {
                                 aunCard.text = card.body;
                                 setIfDefined(aunCard, 'format', card.bodyFormat);
                             }
-                            if (req.initiatorId && channel.isGroupId(channelId))
+                            if (req.initiatorId && replyCtx?.delivery?.chatType === 'group')
                                 aunCard.initiator = req.initiatorId;
                             if (replyCtx?.threadId)
                                 aunCard.thread_id = replyCtx.threadId;
@@ -4555,6 +4789,7 @@ export class AUNChannelPlugin {
                                     requestId: req.id,
                                     isCommandCard: true,
                                     initiatorAid: req.initiatorId,
+                                    delivery: replyCtx?.delivery,
                                     expiresAt: Date.now() + cardTtlMs,
                                 },
                             });