evolcore 0.0.19 → 0.0.21

package/dist/channels/aun.js

@@ -11,7 +11,7 @@ import { DEFAULT_FLUSH_DELAY_SECONDS } from '../types.js';
 import { resolvePaths, agentDir as agentDirPath, resolveRoot, channelStatePath } from '../paths.js';
 import { saveToUploads, sanitizeFileName, bufferToInboundImage, safeFetch } from '../utils/media-cache.js';
 import { appendAidEvent } from '../utils/instance-registry.js';
-import { appendMessageLog, appendMessageLogStrict, buildOutboundEntry, buildInboundEntry, classifyAunPayloadForLog, hasMessageLogOperation } from '../core/message/message-log.js';
+import { appendMessageLog, appendMessageLogStrict, buildOutboundEntry, buildInboundEntry, classifyAunPayloadForLog, findMessageLogOperationMessageId, hasMessageLogOperation } from '../core/message/message-log.js';
 import { createSendFileMarkerPattern } from '../core/message/file-markers.js';
 import { chatDirPath } from '../core/session/session-fs-store.js';
 import { appendHintAdd, appendHintRemove, parseInjectRequest } from '../core/message/pending-hints.js';
@@ -19,7 +19,7 @@ import { appendAidLifecycle } from '../aun/aid/identity.js';
 import { enableFullGroupPullPagination, getAidStore, loadClient, SLOT } from '../aun/aid/store.js';
 import { MAX_AUN_ATTACHMENT_SIZE, uploadBufferAndBuildPayload, uploadFileAndBuildPayload } from '../aun/msg/upload.js';
 import { loadAgent } from '../config-store.js';
-import { normalizeAgentLifecycle } from '../config/lifecycle.js';
+import { resolveAgentLifecycle } from '../config/lifecycle.js';
 import { resolveEffective } from '../config/config-manager.js';
 import { isManagementRole } from '../config/builtin-roles.js';
 import { normalizeMentionMode } from '../config/mention-mode.js';
@@ -28,7 +28,7 @@ import * as outbox from '../aun/outbox.js';
 import { guessMime, formatSize } from '../utils/media-cache.js';
 import { formatPeerKey, PeerIdentityCache } from '../core/relation/peer-identity.js';
 import { getFirstStaticAgentOwner } from '../config/peer-role-resolver.js';
-import { isHClassPath } from '../core/protected-paths.js';
+import { isHClassPath } from '../core/permission/protected-paths.js';
 import { consumeAunCausation, registerAunCausation } from '../core/causation/aun-association.js';
 import { deriveCausation, normalizeCausation } from '../core/causation/context.js';
 import { recordCausationSpan } from '../core/causation/audit.js';
@@ -38,12 +38,17 @@ import { bindPostBootstrapWelcomeOutboxSession, hasPendingPostBootstrapWelcomeOu
 import { hasMentionAll, mentionEntryAids, mentionEntryTargets, } from '../core/message/mention-schema.js';
 import { normalizeAunMentionEntries, } from '../aun/msg/mention-schema.js';
 import { isDeliveryTarget, sameDeliveryTarget } from '../core/message/message-utils.js';
+import { sentReceipt, suppressedReceipt } from '../core/message/send-receipt.js';
 export const AUN_HANDOFF_MARKER_FIELD = '_evolcore_handoff_id';
 const AUN_INTERACTION_CARD_TTL_MS = 24 * 60 * 60 * 1000;
 const AUN_INBOUND_DEDUP_TTL_MS = 7 * 24 * 60 * 60 * 1000;
 const IMAGE_MIME_TYPE = /^image\/[!#$%&'*+.^_`|~0-9A-Za-z-]+$/i;
 const AUN_ATTACHMENT_DOWNLOAD_ATTEMPTS = 3;
 const AUN_ATTACHMENT_RETRY_DELAYS_MS = [250, 750];
+const AUN_SEND_LOG_TEXT_MAX_LENGTH = 60;
+export function formatAunSendLogText(text) {
+    return text.replace(/\s+/gu, ' ').trim().slice(0, AUN_SEND_LOG_TEXT_MAX_LENGTH);
+}
 function attachmentDownloadHost(url) {
     try {
         return new URL(url).host || '<unknown>';
@@ -195,6 +200,213 @@ export function buildAunFilePayload(params) {
     }
     return payload;
 }
+const AUN_PERMANENT_ERROR_CODES = new Set([
+    400, 401, 403, 404,
+    4000, 4001, 4010, 4030, 4040, 4090,
+    -32700, -32600, -32601, -32602,
+    -32001, -32002, -32003, -32004, -32005, -32008, -32009, -32011, -32013,
+    -32040, -32041, -32042, -32043, -32044, -32050, -32051,
+    -32100, -32101, -32102, -32103, -32104, -32105, -32150, -32152, -32153,
+    -32160, -32161, -32162, -32164, -32170, -32171, -32172, -32173, -32174, -32175,
+    -32176, -32177, -32178, -32179, -32185, -32186,
+    -32180, -32181, -32182, -32183, -32184,
+    -33001, -33004, -33005, -33006, -33007, -33008, -33009,
+    -33401, -33403, -33404, -33405,
+]);
+const AUN_RETRYABLE_ERROR_CODES = new Set([
+    429, 4290,
+    -32603,
+    -32010, -32029, -32429,
+    -32151, -32154, -32163,
+    -33402, -33406, -33407,
+]);
+const AUN_ACCEPTED_DISPATCH_STATUSES = new Set([
+    'debounced', 'dispatched', 'accepted', 'queued', 'queued_batch', 'broadcast', 'sent',
+]);
+const AUN_PERMANENT_STRING_CODES = new Set([
+    'invalid_params', 'invalid_param', 'invalid_request', 'permission_denied',
+    'unauthorized', 'authentication_failed', 'not_found', 'group_not_found',
+    'group_not_member', 'member_not_found', 'target_not_found', 'agent_not_found',
+    'recipient_not_found', 'invalid_argument', 'invalid_payload', 'forbidden',
+]);
+const AUN_RETRYABLE_STRING_CODES = new Set([
+    'network_error', 'connection_error', 'timeout', 'timed_out', 'rate_limited',
+    'too_many_requests', 'temporarily_unavailable', 'server_error', 'aun_not_connected',
+]);
+function errorRecord(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+function firstErrorField(candidates, keys, accept) {
+    for (const candidate of candidates) {
+        for (const key of keys) {
+            const value = candidate[key];
+            if (value !== undefined && value !== null && value !== '' && (!accept || accept(value)))
+                return value;
+        }
+    }
+    return undefined;
+}
+function aunErrorDetails(value, fallback = 'AUN send failed') {
+    const root = errorRecord(value);
+    const nested = root
+        ? [root.error, root.data, root.details, root.cause]
+            .map(errorRecord)
+            .filter((candidate) => !!candidate)
+        : [];
+    const candidates = root ? [root, ...nested] : [];
+    const rawMessage = firstErrorField(candidates, [
+        'message', 'error_message', 'errorMessage', 'error', 'reason', 'detail',
+    ], value => typeof value === 'string');
+    const message = typeof value === 'string'
+        ? value
+        : typeof rawMessage === 'string'
+            ? rawMessage
+            : value instanceof Error
+                ? value.message
+                : fallback;
+    const rawCode = firstErrorField(candidates, [
+        'code', 'error_code', 'errorCode', 'stringCode', 'string_code',
+    ], value => typeof value === 'string' || typeof value === 'number');
+    const rawStatus = firstErrorField(candidates, ['status', 'statusCode', 'http_status', 'httpStatus'], value => (typeof value === 'number' && Number.isFinite(value))
+        || (typeof value === 'string' && /^\d+$/.test(value)));
+    const status = typeof rawStatus === 'number'
+        ? rawStatus
+        : typeof rawStatus === 'string' && /^\d+$/.test(rawStatus)
+            ? Number(rawStatus)
+            : undefined;
+    const retryableCandidate = candidates.find(candidate => Object.prototype.hasOwnProperty.call(candidate, 'retryable'));
+    const retryable = retryableCandidate && typeof retryableCandidate.retryable === 'boolean'
+        ? retryableCandidate.retryable
+        : undefined;
+    const name = firstErrorField(candidates, ['name', 'type'], value => typeof value === 'string');
+    const messageStatus = message.match(/\b(?:HTTP\b[^\d]{0,40}|status(?:\s*code)?\s*[:=]?\s*)(\d{3})\b/i);
+    const dispatchStatus = root?.message_dispatch && typeof root.message_dispatch === 'object'
+        ? root.message_dispatch.status
+        : undefined;
+    return {
+        code: typeof rawCode === 'string' || typeof rawCode === 'number' ? rawCode : undefined,
+        message: message || fallback,
+        name: typeof name === 'string' ? name : undefined,
+        retryable,
+        status: status ?? (messageStatus ? Number(messageStatus[1]) : undefined),
+        dispatchStatus: typeof dispatchStatus === 'string' ? dispatchStatus.toLowerCase() : undefined,
+    };
+}
+function numericErrorCode(code) {
+    if (typeof code === 'number' && Number.isFinite(code))
+        return code;
+    if (typeof code === 'string' && /^-?\d+$/.test(code.trim()))
+        return Number(code);
+    return undefined;
+}
+function normalizedErrorCode(code) {
+    return code === undefined ? '' : String(code).trim().toLowerCase().replace(/[\s-]+/g, '_');
+}
+function shortErrorMessage(message) {
+    const compact = message.replace(/\s+/g, ' ').trim();
+    return compact.length > 500 ? `${compact.slice(0, 497)}...` : compact;
+}
+/**
+ * Classify a gateway response before it reaches the durable queue. Protocol
+ * and HTTP semantics take precedence; the SDK's `retryable` bit is used when
+ * no known code or explicit rejection already determines the outcome.
+ */
+export function classifyAunSendFailure(value, fallback = 'AUN send failed') {
+    const details = aunErrorDetails(value, fallback);
+    const numericCode = numericErrorCode(details.code);
+    const stringCode = normalizedErrorCode(details.code);
+    const text = `${details.name ?? ''} ${stringCode} ${details.message}`.toLowerCase();
+    const httpStatus = details.status
+        ?? (numericCode !== undefined && numericCode >= 100 && numericCode <= 599 ? numericCode : undefined);
+    const retryByName = /(?:timeout|connection|rate.?limit|temporar(?:y|ily)|unavailable|network|socket)/i.test(details.name ?? '');
+    const relayTargetMissing = text.includes('relay_target_not_found') || text.includes('relay target not found');
+    const rpcHandlerTimeout = numericCode === -32004 && /rpc handler timeout/i.test(text);
+    const groupStateCode = numericCode === -33002 || numericCode === -33003;
+    const groupClosed = groupStateCode && /\b(?:closed|dissolved|disbanded)\b|解散|已关闭/i.test(text);
+    const groupSuspended = groupStateCode && /\bsuspend(?:ed)?\b|暂停/i.test(text);
+    const transientHttpStatus = httpStatus === 408 || httpStatus === 425 || httpStatus === 429
+        || (httpStatus !== undefined && httpStatus >= 500 && httpStatus < 600);
+    const permanentHttpStatus = httpStatus !== undefined
+        && httpStatus >= 400 && httpStatus < 500
+        && !transientHttpStatus;
+    const permanentByText = !relayTargetMissing && /\b(?:group|peer|agent|recipient|target|member|object|task|stream)(?:[\s_-]+(?:id|aid))?[\s_-]*(?:not[\s_-]*found|does[\s_-]*not[\s_-]*exist)|不存在|group[_ -]?not[_ -]?found|not[_ -]?a[_ -]?member|(?:permission|access|role).*(?:denied|forbidden|拒绝|无权限)|(?:invalid|malformed|bad)\s*(?:argument|param|request)|unauthori[sz]ed|authentication failed|signature invalid/i.test(text);
+    const retryByText = /timeout|timed out|temporar|unavailable|overload|rate.?limit|too many requests|try again|not connected|connection|network|socket|econn|eai_again|etimedout|epipe|broken pipe|connection refused|connect timeout|fetch failed|dns|reset by peer|gateway service degraded|upstream/i.test(text);
+    const acceptedDispatch = details.dispatchStatus !== undefined
+        && AUN_ACCEPTED_DISPATCH_STATUSES.has(details.dispatchStatus);
+    const rejectedDispatch = details.dispatchStatus === 'failed'
+        || details.dispatchStatus === 'skipped';
+    const successfulHttpWithoutReceipt = httpStatus !== undefined
+        && httpStatus >= 200 && httpStatus < 300
+        && numericCode === undefined && !permanentByText && !retryByText;
+    const ambiguousAccepted = errorRecord(value)?.ok === true
+        && numericCode === undefined
+        && httpStatus === undefined
+        && !permanentByText
+        && !retryByText;
+    const ambiguousNoReceipt = (value === null || value === undefined)
+        && /no message[_ -]?id|no receipt|empty response|returned no/i.test(fallback);
+    const missingReceipt = /no message[_ -]?id|missing message[_ -]?id|no receipt|empty response|returned no/i.test(fallback);
+    const unconfirmedDelivery = missingReceipt
+        && (acceptedDispatch || ambiguousAccepted || ambiguousNoReceipt || successfulHttpWithoutReceipt);
+    let status;
+    if ((AUN_PERMANENT_ERROR_CODES.has(numericCode ?? Number.NaN) && !rpcHandlerTimeout)
+        || permanentByText
+        || AUN_PERMANENT_STRING_CODES.has(stringCode)
+        || rejectedDispatch
+        || groupClosed
+        || (groupStateCode && !groupSuspended)
+        || permanentHttpStatus) {
+        status = 'permanent';
+    }
+    else if (unconfirmedDelivery) {
+        // The RPC completed with a success-looking result but without the protocol
+        // receipt. Reissuing it could duplicate a message because AUN send calls
+        // do not carry our local outbox operation ID as an idempotency key.
+        status = 'permanent';
+    }
+    else if (AUN_RETRYABLE_ERROR_CODES.has(numericCode ?? Number.NaN)
+        || transientHttpStatus
+        || rpcHandlerTimeout
+        || AUN_RETRYABLE_STRING_CODES.has(stringCode)
+        || retryByName
+        || relayTargetMissing
+        || groupSuspended
+        || retryByText) {
+        // Known transient protocol, HTTP, SDK-class and transport signals take
+        // precedence over the SDK's generic `retryable` default. Several SDK
+        // error classes default that flag to false even for connection failures.
+        status = 'retry';
+    }
+    else if (details.retryable === false) {
+        status = 'permanent';
+    }
+    else if (details.retryable === true) {
+        status = 'retry';
+    }
+    else {
+        // A response with no recognized transient signal is deterministic enough
+        // to stop retrying. This is deliberately fail-closed for durable sends.
+        status = 'permanent';
+    }
+    return {
+        status,
+        error: shortErrorMessage(details.message),
+        ...(details.code !== undefined
+            ? { code: details.code }
+            : details.status !== undefined
+                ? { code: details.status }
+                : missingReceipt
+                    ? { code: 'MISSING_MESSAGE_ID' }
+                    : {}),
+    };
+}
+function sentOutboxResult(messageId) {
+    return messageId
+        ? { status: 'sent', messageId }
+        : { status: 'permanent', error: 'AUN send completed without a remote message_id', code: 'MISSING_MESSAGE_ID' };
+}
 function setIfDefined(target, key, value) {
     if (value !== undefined)
         target[key] = value;
@@ -346,6 +558,35 @@ export class AUNChannel {
      * 统一的 RPC 调用包装：自动记录 OUT 发送、.ok 结果、.error 错误（含 trace + daemon.log 失败日志）。
      * 所有 client.call() 都应通过此方法调用，保证 aun-trace 里每个 OUT 调用都有"发+收/错"成对记录。
      */
+    callClient(method, params) {
+        return this.withOutboundSendGate(method, () => (this.client.call(method, params).then(value => value)));
+    }
+    withOutboundSendGate(method, run) {
+        if (!AUNChannel.OUTBOUND_SEND_METHODS.has(method))
+            return run();
+        return new Promise((resolve, reject) => {
+            this.outboundSendQueue.push({
+                run: run,
+                resolve: resolve,
+                reject,
+            });
+            this.pumpOutboundSendGate();
+        });
+    }
+    pumpOutboundSendGate() {
+        while (this.outboundSendActive < AUNChannel.OUTBOUND_SEND_CONCURRENCY
+            && this.outboundSendQueue.length > 0) {
+            const job = this.outboundSendQueue.shift();
+            this.outboundSendActive++;
+            Promise.resolve()
+                .then(job.run)
+                .then(job.resolve, job.reject)
+                .finally(() => {
+                this.outboundSendActive--;
+                this.pumpOutboundSendGate();
+            });
+        }
+    }
     async callAndTrace(method, params, opts) {
         this.trace('OUT', method, params);
         // RPC 往返计时：区分「网关慢」与「本地队列堵塞」。message.send/group.send 的
@@ -355,7 +596,7 @@ export class AUNChannel {
         // SLOW_RPC_WARN_MS 需明显低于 SDK 默认 10s 超时，以便在真正超时前提前告警。
         const SLOW_RPC_WARN_MS = 3000;
         try {
-            const result = await this.client.call(method, params);
+            const result = await this.callClient(method, params);
             const durationMs = Date.now() - rpcStart;
             if (!opts?.silentOk) {
                 const r = result;
@@ -1017,6 +1258,7 @@ export class AUNChannel {
      * the event handler boundary, before payload/slash/mention parsing.
      */
     inboundSeenMessages = new Map();
+    invalidInboundEnvelopeLastLogAt = 0;
     groupNameCache = new Map(); // groupId → 群显示名（进程内缓存，群名极少变）
     peerInfoCache = new Map();
     messageSeqMap = new Map(); // messageId → seq (for ack/diagnostics)
@@ -1077,6 +1319,16 @@ export class AUNChannel {
     aidState;
     aidStatsCollector;
     outboxInFlight = new Set();
+    /** Shared gateway-facing send limit for replies, activity, observer and thought messages. */
+    static OUTBOUND_SEND_METHODS = new Set([
+        'message.send',
+        'group.send',
+        'message.thought.put',
+        'group.thought.put',
+    ]);
+    static OUTBOUND_SEND_CONCURRENCY = 4;
+    outboundSendActive = 0;
+    outboundSendQueue = [];
     constructor(config) {
         this.config = config;
         this.agentDir = agentDirPath(config.aid);
@@ -1174,11 +1426,9 @@ export class AUNChannel {
         const aidName = this.config.aid;
         // encryptionSeed 由 getAidStore 内部解析（config / env / 'evol'）
         // Migration from ~/.aun is handled by ensureDataDirs() at startup with a marker file.
-        // Gateway discovery/cache is owned by the SDK. Do not do a blocking
-        // well-known probe here: it prevents the SDK from using its token-store
-        // gateway metadata cache when well-known is temporarily unavailable.
-        const configuredGateway = this.config.gatewayUrl || '';
-        logger.info(`${this.logPrefix()} Initializing: aid=${aidName}, gateway=${configuredGateway || '<sdk-discovery>'}, aun_path=${aunPath}`);
+        // Gateway discovery/cache is owned entirely by the SDK.
+        this.gatewayUrl = '';
+        logger.info(`${this.logPrefix()} Initializing: aid=${aidName}, gateway=<sdk-discovery>, aun_path=${aunPath}`);
         // 构造 AIDStore。daemon 使用独立 slot，CLI/netcheck 不能触碰业务入站游标。
         // encryptionSeed / rootCaPath 由 getAidStore 内部注入
         const store = await getAidStore({
@@ -1193,13 +1443,6 @@ export class AUNChannel {
         // A reconnect replaces the SDK client. Late events from the retired
         // instance must not mutate the new instance's health or message state.
         const isCurrentClient = () => this.client === client;
-        // fastaun gives a preset in-memory gateway precedence over its metadata
-        // cache and AID discovery. authenticate({ gateway }) is deliberately
-        // rejected by its public API, so set the documented client preset before
-        // authentication instead.
-        if (configuredGateway)
-            client._gatewayUrl = configuredGateway;
-        this.gatewayUrl = configuredGateway;
         // Register event handlers before connecting
         client.on('message.received', (data) => {
             if (!isCurrentClient())
@@ -1306,7 +1549,7 @@ export class AUNChannel {
             const auth = await client.authenticate();
             this.trace('OUT', 'auth.authenticate.ok', { aid: client.aid, gateway: auth?.gateway, hasToken: !!auth?.access_token });
             this.trace('IN', 'auth.result', { aid: client.aid, gateway: auth?.gateway, hasToken: !!auth?.access_token });
-            const resolvedGateway = String(auth?.gateway ?? this.gatewayUrl);
+            const resolvedGateway = typeof auth?.gateway === 'string' ? auth.gateway : '';
             this.gatewayUrl = resolvedGateway;
             logger.info(`${this.logPrefix()} Authenticated as ${client.aid ?? '?'}, gateway=${resolvedGateway}`);
         }
@@ -1393,22 +1636,11 @@ export class AUNChannel {
             if (hasMessageLogOperation(chatDir, operationId))
                 return true;
             const prepared = outbox.findByDedupeKey(aidName, operationId);
-            const initial = outbox.findByDedupeKey(aidName, bootstrapInitialMessageOperationId(aidName));
-            const initialDelivery = initial && outbox.isDeliveryForChannel(initial.delivery, owner)
-                ? initial.delivery
-                : undefined;
-            // During bootstrap completion the lifecycle is intentionally still
-            // non-active. Persisting the welcome must stay local and must not block
-            // on a best-effort group RPC before the lifecycle commit. If the initial
-            // bootstrap route is already known, preserve it; otherwise migration
-            // will resolve a group route after the channel is active.
-            const lifecycle = normalizeAgentLifecycle(agentConfig).lifecycle;
-            const ownerIsGroup = initialDelivery
-                ? initialDelivery.chatType === 'group'
-                : lifecycle === 'active' ? await this.isGroup(owner) : undefined;
-            const delivery = initialDelivery ?? (ownerIsGroup === true
-                ? { chatType: 'group', groupId: owner }
-                : { chatType: 'private' });
+            // Bootstrap welcomes target the configured personal Owner AID. They are
+            // not replies to an inbound group message, so their route is always
+            // private and must not be inferred with group.get_info.
+            const lifecycle = resolveAgentLifecycle(agentConfig);
+            const delivery = { chatType: 'private' };
             if (prepared
                 && prepared.channelId === owner
                 && isDeliveryTarget(prepared.delivery)
@@ -1452,6 +1684,7 @@ export class AUNChannel {
         return this.reconcilePostBootstrapWelcome();
     }
     async hasPendingPostBootstrapWelcome() {
+        this.repairBootstrapRoutes();
         const aid = this.config.aid.replace(/^@/, '');
         return hasPendingPostBootstrapWelcomeOutbox(aid);
     }
@@ -1467,6 +1700,7 @@ export class AUNChannel {
      * already-active agent from manufacturing another welcome message.
      */
     async reconcilePostBootstrapWelcome() {
+        this.repairBootstrapRoutes();
         const configuredAid = this.config.aid;
         const aid = configuredAid.startsWith('@') ? configuredAid.slice(1) : configuredAid;
         const operationId = postBootstrapWelcomeOperationId(aid);
@@ -1484,15 +1718,17 @@ export class AUNChannel {
             return false;
         }
         const agentConfig = loadAgent(aid);
-        if (!agentConfig || normalizeAgentLifecycle(agentConfig).lifecycle !== 'active') {
+        if (!agentConfig || resolveAgentLifecycle(agentConfig) !== 'active') {
             logger.info(`${this.logPrefix()} Post-bootstrap welcome prepared; waiting for lifecycle=active`);
             return true;
         }
         if (!this.connected || !this.client)
             return true;
-        const sent = await this.withOutboxInFlight(entry, () => this.deliverTextEntry(entry), false);
-        if (sent)
-            outbox.remove(aid, entry.id);
+        const sent = await this.withOutboxInFlight(entry, () => this.deliverTextEntry(entry), { status: 'retry', error: 'outbox send is already in flight' });
+        if (sent.status === 'sent')
+            this.removeDeliveredOutboxEntry(entry);
+        else if (sent.status === 'permanent')
+            this.markPermanentOutboxFailure(entry, sent);
         return true;
     }
     // ── Event handlers ──────────────────────────────────────────
@@ -1743,17 +1979,30 @@ export class AUNChannel {
         const msg = data;
         const receivedAt = Date.now();
         const receivedAtMono = performance.now();
-        // Claim before any payload extraction or command parsing. Retransmits may
-        // carry a new seq, but the application identity remains message_id.
+        // Validate the authenticated envelope before any payload extraction or
+        // command parsing. Retransmits may carry a new seq, but the application
+        // identity remains message_id.
         const messageId = typeof msg.message_id === 'string' ? msg.message_id : '';
         const seq = typeof msg.seq === 'number' ? msg.seq : undefined;
-        if (!this.claimInboundMessage('private', messageId, seq))
-            return;
         // SDK 0.5.* 移除了顶层 from/to/group_id/encrypted 等别名，统一从 msg.envelope.* 读取。
         // message_id / seq / payload / same_* 等仍是顶层独立字段，不在 envelope 内。
         const env = (msg.envelope && typeof msg.envelope === 'object') ? msg.envelope : {};
+        const fromAid = typeof env.from === 'string' ? env.from.trim() : '';
+        if (!messageId || !fromAid) {
+            this.acknowledgeImmediately(messageId, seq);
+            const now = Date.now();
+            if (now - this.invalidInboundEnvelopeLastLogAt >= 60_000) {
+                this.invalidInboundEnvelopeLastLogAt = now;
+                logger.warn(`${this.logPrefix()} Dropped private inbound: invalid envelope code=INVALID_INBOUND_ENVELOPE mid=${messageId || 'unknown'} from=${fromAid || 'unknown'}`);
+            }
+            else {
+                logger.debug(`${this.logPrefix()} Dropped private inbound: invalid envelope (suppressed duplicate) mid=${messageId || 'unknown'}`);
+            }
+            return;
+        }
+        if (!this.claimInboundMessage('private', messageId, seq))
+            return;
         const protectedHeaders = verifiedProtectedHeaders(msg, env);
-        const fromAid = env.from ?? '';
         const payload = msg.payload ?? '';
         const mentions = this.parsePayloadMentionsOrReject(payload, 'p2p.inbound', messageId, seq);
         if (!mentions)
@@ -2319,7 +2568,7 @@ export class AUNChannel {
     setObserverConfigResolver(fn) {
         this.observerConfigResolver = fn;
     }
-    /** 读取 observable 开关 + owners；无 resolver（如未接入 daemon）时视为关闭。 */
+    /** 读取 observable 开关 + owners；未接入 daemon 时没有 owning Agent，保持关闭。 */
     getObserverConfig() {
         return this.observerConfigResolver?.() ?? { observable: false, owners: [] };
     }
@@ -2869,8 +3118,31 @@ export class AUNChannel {
             this.outboxInFlight.delete(entry.id);
         }
     }
+    markPermanentOutboxFailure(entry, result) {
+        const error = result.error ?? 'permanent send failure';
+        const terminated = outbox.markTerminal(this.config.aid, entry.id, { error, code: result.code }, entry);
+        if (terminated) {
+            logger.error(`${this.logPrefix()} Permanent AUN delivery failure; outbox entry terminated: id=${entry.id} channel=${entry.channelId} code=${result.code ?? 'unknown'} error=${error}`);
+        }
+        else {
+            logger.warn(`${this.logPrefix()} Ignored stale permanent delivery result after outbox route changed: id=${entry.id} submittedChannel=${entry.channelId}`);
+        }
+    }
+    removeDeliveredOutboxEntry(entry) {
+        const messageId = entry.deliveryReceipt?.messageId;
+        const finalized = messageId
+            ? outbox.markDelivered(this.config.aid, entry.id, messageId, entry)
+            : outbox.removeIfRouteMatches(this.config.aid, entry);
+        if (!finalized) {
+            logger.warn(`${this.logPrefix()} Preserved outbox entry whose route changed while delivery was in flight: id=${entry.id} submittedChannel=${entry.channelId}`);
+        }
+    }
     messageIdFromSendResult(result) {
-        return result?.message?.message_id ?? result?.message_id ?? null;
+        const nested = result?.message?.message_id;
+        if (typeof nested === 'string' && nested.trim())
+            return nested;
+        const direct = result?.message_id;
+        return typeof direct === 'string' && direct.trim() ? direct : null;
     }
     /**
      * An AUN send result is only a gateway transport result. It is not a
@@ -2893,7 +3165,7 @@ export class AUNChannel {
         return `aun_status=${receipt.status ?? 'unknown'} seq=${receipt.seq ?? 'unknown'} delivery_mode=${receipt.deliveryMode ?? 'unknown'} gateway_timestamp=${receipt.timestamp ?? 'unknown'}`;
     }
     logAunSendAccepted(method, target, messageId, encrypt, result, text) {
-        const preview = text === undefined ? '' : ` text=${text.slice(0, 60)}`;
+        const preview = text === undefined ? '' : ` text=${formatAunSendLogText(text)}`;
         logger.info(`${this.logPrefix()} ${method} accepted by AUN: target=${target} mid=${messageId} encrypt=${encrypt} ${this.receiptLogFields(result)}${preview}`);
     }
     stripUndefinedDeep(value) {
@@ -3104,8 +3376,8 @@ export class AUNChannel {
         }
         messageIds.add(messageId);
         const now = Date.now();
-        const mapTtl = action.expiresAt && action.expiresAt > now
-            ? action.expiresAt - now
+        const mapTtl = typeof action.expiresAt === 'number' && Number.isFinite(action.expiresAt)
+            ? Math.max(0, action.expiresAt - now)
             : AUN_INTERACTION_CARD_TTL_MS;
         const mapTimer = setTimeout(() => {
             this.cardMessageIdMap.delete(messageId);
@@ -3140,10 +3412,11 @@ export class AUNChannel {
             const detail = error instanceof Error ? error.message : String(error);
             const code = error?.code ?? 'INVALID_MENTION_SCHEMA';
             logger.error(`${this.logPrefix()} Dropped durable AUN payload: invalid payload.mentions (${detail}) code=${code} channel=${channelId}`);
-            return { ok: false, discarded: true };
+            return { ok: false, status: 'permanent', error: detail, code };
+        }
+        if (!this.client || !this.connected) {
+            return { ok: false, status: 'retry', error: 'AUN channel is not connected', code: 'AUN_NOT_CONNECTED' };
         }
-        if (!this.client || !this.connected)
-            return { ok: false };
         const isGroup = delivery.chatType === 'group';
         const targetAid = channelId;
         const encryptTarget = isGroup ? channelId : targetAid;
@@ -3167,14 +3440,15 @@ export class AUNChannel {
             params.to = targetAid;
         const callOnce = async (sendParams, fallback) => {
             const result = fallback
-                ? await this.client.call(method, sendParams)
+                ? await this.callClient(method, sendParams)
                 : await this.callAndTrace(method, sendParams);
             const mid = this.messageIdFromSendResult(result);
             if (!mid) {
-                logger.warn(`${this.logPrefix()} ${method}${fallback ? ' fallback' : ''} (${label}) returned no message_id: ${JSON.stringify(result)}`);
-                return { ok: false, result, encrypt: !!sendParams.encrypt };
+                const failure = classifyAunSendFailure(result, `${method} (${label}) returned no message_id`);
+                logger.warn(`${this.logPrefix()} ${method}${fallback ? ' fallback' : ''} (${label}) returned no message_id: ${JSON.stringify(result)}; disposition=${failure.status}`);
+                return { ok: false, status: failure.status, error: failure.error, code: failure.code, result, encrypt: !!sendParams.encrypt };
             }
-            return { ok: true, messageId: mid, result, encrypt: !!sendParams.encrypt };
+            return { ok: true, status: 'sent', messageId: mid, result, encrypt: !!sendParams.encrypt };
         };
         try {
             return await callOnce(params, false);
@@ -3187,18 +3461,22 @@ export class AUNChannel {
                 try {
                     this.trace('OUT', `${method}.${label}.fallback`, fallbackParams);
                     const sent = await callOnce(fallbackParams, true);
-                    this.trace('OUT', `${method}.${label}.fallback.${sent.ok ? 'ok' : 'missing_id'}`, { message_id: sent.messageId });
+                    this.trace('OUT', `${method}.${label}.fallback.${sent.ok ? 'ok' : 'missing_id'}`, sent.ok
+                        ? { message_id: sent.messageId }
+                        : { disposition: sent.status, code: sent.code });
                     return sent;
                 }
                 catch (e2) {
                     this.trace('OUT', `${method}.${label}.fallback.error`, { channelId, error: String(e2) });
-                    logger.error(`${this.logPrefix()} Plaintext ${label} fallback also failed to ${channelId}: ${e2}`);
-                    return { ok: false };
+                    const failure = classifyAunSendFailure(e2, `${method} plaintext fallback failed`);
+                    logger.error(`${this.logPrefix()} Plaintext ${label} fallback also failed to ${channelId}: ${failure.error}; disposition=${failure.status}`);
+                    return { ok: false, status: failure.status, error: failure.error, code: failure.code };
                 }
             }
             this.trace('OUT', `${method}.${label}.error`, { channelId, error: String(e) });
-            logger.error(`${this.logPrefix()} ${label} send failed to ${channelId}: ${e}`);
-            return { ok: false };
+            const failure = classifyAunSendFailure(e, `${method} failed`);
+            logger.error(`${this.logPrefix()} ${label} send failed to ${channelId}: ${failure.error}; disposition=${failure.status}${failure.code === undefined ? '' : ` code=${failure.code}`}`);
+            return { ok: false, status: failure.status, error: failure.error, code: failure.code };
         }
     }
     recordDurableOutbound(channelId, payload, messageId, encrypt, context, isGroup, contentKind, logText, result, statsContext) {
@@ -3251,31 +3529,81 @@ export class AUNChannel {
         // turn malformed `mentions: [undefined]` into an apparently valid `[]`.
         const finalPayload = this.normalizeAunPayloadMentions(this.applyReplyContextToPayload(validatedPayload, context));
         const logText = opts.logText ?? this.payloadLogText(finalPayload, opts.contentKind);
-        const entry = outbox.enqueue(this.config.aid, {
-            channelId,
-            delivery,
-            type: 'payload',
-            contentKind: opts.contentKind,
-            payload: finalPayload,
-            context,
-            logText,
-            ttl: opts.ttl,
-            postSend: opts.postSend,
-        });
-        logger.debug(`${this.logPrefix()} Outbox enqueued payload: id=${entry.id} kind=${opts.contentKind} channel=${channelId} text=${logText.slice(0, 40)}`);
+        const expiresAt = opts.postSend?.type === 'register_interaction_card'
+            ? opts.postSend.expiresAt
+            : undefined;
+        if (typeof expiresAt === 'number' && Number.isFinite(expiresAt) && expiresAt <= Date.now()) {
+            return {
+                status: 'permanent',
+                error: 'interaction card has expired',
+                code: 'INTERACTION_EXPIRED',
+            };
+        }
+        const remainingTtl = typeof expiresAt === 'number' && Number.isFinite(expiresAt)
+            ? Math.max(0, expiresAt - Date.now())
+            : undefined;
+        const requestedTtl = opts.ttl ?? outbox.defaultTtl(opts.queue);
+        const ttl = remainingTtl === undefined ? opts.ttl : Math.min(requestedTtl, remainingTtl);
+        let entry;
+        try {
+            entry = outbox.enqueue(this.config.aid, {
+                queue: opts.queue,
+                channelId,
+                delivery,
+                type: 'payload',
+                contentKind: opts.contentKind,
+                payload: finalPayload,
+                context,
+                logText,
+                ttl,
+                postSend: opts.postSend,
+            });
+        }
+        catch (error) {
+            // Queue saturation is a caller-visible failure. Keep route/schema
+            // validation errors as exceptions so their existing fail-closed path is
+            // preserved, but expose OUTBOX_FULL as a structured send result.
+            if (error?.code !== 'OUTBOX_FULL')
+                throw error;
+            return {
+                status: 'permanent',
+                error: error instanceof Error ? error.message : String(error),
+                code: 'OUTBOX_FULL',
+            };
+        }
+        logger.debug(`${this.logPrefix()} Outbox enqueued payload: id=${entry.id} queue=${opts.queue ?? 'default'} kind=${opts.contentKind} channel=${channelId} text=${logText.slice(0, 40)}`);
         if (!this.connected || !this.client) {
             logger.warn(`${this.logPrefix()} Not connected, payload queued in outbox (id=${entry.id}, kind=${opts.contentKind}). Triggering reconnect.`);
             if (!this.reconnectTimer && !this.client) {
                 this.initClient().catch(e => logger.error(`${this.logPrefix()} Reconnect from sendContentPayload failed: ${e}`));
             }
-            return { queued: true };
+            return {
+                queued: true,
+                outboxId: entry.id,
+                error: 'AUN channel is not connected',
+                code: 'AUN_NOT_CONNECTED',
+            };
         }
-        const result = await this.withOutboxInFlight(entry, () => this.deliverPayloadEntry(entry), { ok: false });
+        const result = await this.withOutboxInFlight(entry, () => this.deliverPayloadEntry(entry), { ok: false, status: 'retry', error: 'outbox send is already in flight' });
         if (result.ok) {
-            outbox.remove(this.config.aid, entry.id);
+            this.removeDeliveredOutboxEntry(entry);
             return { messageId: result.messageId };
         }
-        return { queued: true };
+        if (result.status === 'permanent' || result.status === 'failed') {
+            this.markPermanentOutboxFailure(entry, result);
+            return {
+                status: 'permanent',
+                outboxId: entry.id,
+                ...(result.error !== undefined ? { error: result.error } : {}),
+                ...(result.code !== undefined ? { code: result.code } : {}),
+            };
+        }
+        return {
+            queued: true,
+            outboxId: entry.id,
+            ...(result.error !== undefined ? { error: result.error } : {}),
+            ...(result.code !== undefined ? { code: result.code } : {}),
+        };
     }
     buildTaskPayloadBase(envelope, context) {
         const base = {};
@@ -3393,16 +3721,22 @@ export class AUNChannel {
         };
     }
     async sendReliableStructured(channelId, payload, context, logText) {
-        await this.sendContentPayload(channelId, payload, {
+        const result = await this.sendContentPayload(channelId, payload, {
             contentKind: 'custom',
             context,
             logText: logText ?? this.payloadLogText(payload, 'custom'),
         });
+        if (result.status === 'permanent' || result.status === 'failed') {
+            throw Object.assign(new Error(result.error ?? 'AUN structured send failed'), {
+                code: result.code ?? 'AUN_SEND_FAILED',
+                outboxId: result.outboxId,
+            });
+        }
     }
     async sendMessage(channelId, text, context) {
         if (!text?.trim()) {
             logger.warn(`${this.logPrefix()} Attempted to send empty message, skipping`);
-            return;
+            return { status: 'failed', error: 'message text is empty', code: 'EMPTY_MESSAGE' };
         }
         const delivery = this.requireDelivery(channelId, context);
         const routedContext = this.withDelivery(context, delivery);
@@ -3440,13 +3774,14 @@ export class AUNChannel {
             : undefined;
         if (operationId) {
             const chatDir = chatDirPath(resolvePaths().sessionsDir, 'aun', channelId, this.config.aid);
-            if (hasMessageLogOperation(chatDir, operationId)) {
+            const completedMessageId = findMessageLogOperationMessageId(chatDir, operationId);
+            if (completedMessageId) {
                 const duplicate = outbox.findByDedupeKey(this.config.aid, operationId);
                 if (duplicate) {
                     outbox.remove(this.config.aid, duplicate.id);
                     logger.info(`${this.logPrefix()} Removed stale outbox entry for completed operation: ${operationId}`);
                 }
-                return;
+                return { status: 'sent', messageId: completedMessageId };
             }
         }
         // Write-ahead: persist to outbox before attempting send
@@ -3462,6 +3797,20 @@ export class AUNChannel {
                 ? routedContext.metadata.outboxTtl
                 : undefined,
         });
+        if (entry.deliveryResult?.messageId || entry.deliveryReceipt?.messageId) {
+            const messageId = entry.deliveryResult?.messageId ?? entry.deliveryReceipt.messageId;
+            logger.info(`${this.logPrefix()} Reusing completed durable operation: operation=${operationId ?? '<none>'} entry=${entry.id} mid=${messageId}`);
+            return { status: 'sent', messageId };
+        }
+        if (entry.terminal) {
+            logger.warn(`${this.logPrefix()} Skipping previously terminated durable operation: operation=${operationId ?? '<none>'} entry=${entry.id} code=${entry.lastErrorCode ?? 'unknown'}`);
+            return {
+                status: 'failed',
+                outboxId: entry.id,
+                error: entry.lastError ?? entry.terminal.error,
+                ...(entry.lastErrorCode !== undefined ? { code: entry.lastErrorCode } : {}),
+            };
+        }
         logger.debug(`${this.logPrefix()} Outbox enqueued: id=${entry.id} channel=${channelId} text=${finalText.slice(0, 40)}`);
         // 积压深度告警：outbox 待发条目累积说明发送速度跟不上，回复将出现明显延迟。
         const backlog = outbox.pendingCount(this.config.aid);
@@ -3473,13 +3822,40 @@ export class AUNChannel {
             if (!this.reconnectTimer && !this.client) {
                 this.initClient().catch(e => logger.error(`${this.logPrefix()} Reconnect from sendMessage failed: ${e}`));
             }
-            return;
+            return { status: 'queued', outboxId: entry.id, error: 'AUN channel is not connected', code: 'AUN_NOT_CONNECTED' };
         }
         // Attempt immediate delivery
-        const ok = await this.withOutboxInFlight(entry, () => this.deliverTextEntry(entry), false);
-        if (ok) {
-            outbox.remove(this.config.aid, entry.id);
+        const result = await this.withOutboxInFlight(entry, () => this.deliverTextEntry(entry), { status: 'retry', error: 'outbox send is already in flight' });
+        if (result.status === 'sent') {
+            const messageId = result.messageId ?? entry.deliveryReceipt?.messageId;
+            if (!messageId) {
+                const error = 'AUN send completed without a remote message_id';
+                this.markPermanentOutboxFailure(entry, { error, code: 'MISSING_MESSAGE_ID' });
+                return { status: 'failed', outboxId: entry.id, error, code: 'MISSING_MESSAGE_ID' };
+            }
+            this.removeDeliveredOutboxEntry(entry);
+            return { status: 'sent', messageId };
+        }
+        else if (result.status === 'permanent') {
+            this.markPermanentOutboxFailure(entry, result);
+            return {
+                status: 'failed',
+                outboxId: entry.id,
+                error: result.error ?? 'permanent AUN send failure',
+                ...(result.code !== undefined ? { code: result.code } : {}),
+            };
+        }
+        // A gateway receipt may already have been checkpointed even if local
+        // post-send bookkeeping needs a retry. Remote acceptance still wins.
+        if (entry.deliveryReceipt?.messageId) {
+            return { status: 'sent', messageId: entry.deliveryReceipt.messageId };
         }
+        return {
+            status: 'queued',
+            outboxId: entry.id,
+            ...(result.error !== undefined ? { error: result.error } : {}),
+            ...(result.code !== undefined ? { code: result.code } : {}),
+        };
     }
     /** Daemon-side transport for `ec msg send` running inside an agent task. */
     async sendDaemonMsg(args) {
@@ -3724,7 +4100,7 @@ export class AUNChannel {
                         ttl: 300_000,
                     };
                     const ok = await this.deliverTextEntry(echoEntry);
-                    if (!ok) {
+                    if (ok.status !== 'sent' && ok.status !== 'permanent') {
                         outbox.enqueue(this.config.aid, {
                             channelId,
                             delivery,
@@ -3733,7 +4109,7 @@ export class AUNChannel {
                             context: this.withDelivery(echo.context, delivery),
                         });
                     }
-                    logger.info(`${this.logPrefix()} [Echo] long echo trace delivered=${ok} to ${channelId} (agent ${agentDuration}ms)`);
+                    logger.info(`${this.logPrefix()} [Echo] long echo trace status=${ok.status} code=${ok.code ?? 'none'} to=${channelId} agentDurationMs=${agentDuration}`);
                 }
                 else {
                     outbox.enqueue(this.config.aid, {
@@ -3751,6 +4127,10 @@ export class AUNChannel {
     }
     async deliverTextEntry(entry) {
         const channelId = entry.channelId;
+        if (typeof entry.text !== 'string' || !entry.text.trim()) {
+            logger.warn(`${this.logPrefix()} deliverTextEntry: missing or empty text (outbox id=${entry.id})`);
+            return { status: 'permanent', error: 'durable text is missing or empty', code: 'MISSING_TEXT' };
+        }
         const finalText = entry.text;
         const delivery = this.requirePersistedDelivery(channelId, entry.delivery);
         const context = this.withDelivery(entry.context, delivery);
@@ -3758,14 +4138,16 @@ export class AUNChannel {
             || (typeof context?.metadata?.operationId === 'string' ? context.metadata.operationId : undefined);
         if (operationId) {
             const chatDir = chatDirPath(resolvePaths().sessionsDir, 'aun', channelId, this.config.aid);
-            if (hasMessageLogOperation(chatDir, operationId)) {
+            const completedMessageId = findMessageLogOperationMessageId(chatDir, operationId);
+            if (completedMessageId) {
                 logger.info(`${this.logPrefix()} Durable operation already logged; skipping duplicate send: ${operationId}`);
-                return true;
+                return sentOutboxResult(completedMessageId);
             }
             if (operationId === postBootstrapWelcomeOperationId(this.config.aid)) {
                 const agentConfig = loadAgent(this.config.aid);
-                if (!agentConfig || normalizeAgentLifecycle(agentConfig).lifecycle !== 'active')
-                    return false;
+                if (!agentConfig || resolveAgentLifecycle(agentConfig) !== 'active') {
+                    return { status: 'retry', error: 'post-bootstrap welcome is waiting for active lifecycle', code: 'BOOTSTRAP_NOT_ACTIVE' };
+                }
             }
         }
         // 从 context.metadata.source 读取 source，默认为 'daemon'
@@ -3796,7 +4178,7 @@ export class AUNChannel {
         logger.info(`${this.logPrefix()} deliverTextEntry: channelId=${channelId} thread_id=${payload.thread_id ?? 'none'} task_id=${payload.task_id ?? 'none'} chatmode=${payload.chatmode ?? 'none'} source=${source} textLen=${finalText.length}`);
         const isGroup = delivery.chatType === 'group';
         const targetAid = channelId;
-        if (operationId && entry.deliveryReceipt) {
+        if (entry.deliveryReceipt) {
             this.appendOutboundJsonl(channelId, {
                 ...classifyAunPayloadForLog(payload),
                 msgId: entry.deliveryReceipt.messageId,
@@ -3806,7 +4188,7 @@ export class AUNChannel {
                 source,
                 transport: entry.deliveryReceipt.transport,
             });
-            return true;
+            return sentOutboxResult(entry.deliveryReceipt.messageId);
         }
         const encryptTarget = isGroup ? channelId : targetAid;
         const encrypt = context?.metadata?.encrypted != null
@@ -3815,22 +4197,27 @@ export class AUNChannel {
         const params = { payload, encrypt };
         if (context?.metadata?.persistRequired === true)
             params.persist_required = true;
+        let acceptedMessageId;
         try {
             if (isGroup) {
                 params.group_id = channelId;
                 const result = await this.callAndTrace('group.send', params);
-                const mid = result?.message?.message_id ?? result?.message_id ?? null;
+                const mid = this.messageIdFromSendResult(result);
                 if (!mid) {
-                    const dispatchStatus = result?.message_dispatch?.status;
-                    if (dispatchStatus === 'debounced' || dispatchStatus === 'dispatched') {
-                        logger.warn(`${this.logPrefix()} group.send returned ${dispatchStatus} without message_id; keeping outbox entry: group=${channelId} encrypt=${encrypt} text=${finalText.slice(0, 60)}`);
+                    const failure = classifyAunSendFailure(result, 'group.send returned no message_id');
+                    const dispatchStatus = typeof result?.message_dispatch?.status === 'string'
+                        ? result.message_dispatch.status.toLowerCase()
+                        : undefined;
+                    if (dispatchStatus && AUN_ACCEPTED_DISPATCH_STATUSES.has(dispatchStatus)) {
+                        logger.warn(`${this.logPrefix()} group.send returned ${dispatchStatus} without message_id: disposition=${failure.status} code=${failure.code ?? 'unknown'} group=${channelId}`);
                     }
                     else {
-                        logger.warn(`${this.logPrefix()} group.send returned no message_id: ${JSON.stringify(result)}`);
+                        logger.warn(`${this.logPrefix()} group.send returned no message_id: disposition=${failure.status} code=${failure.code ?? 'unknown'} group=${channelId} dispatch=${dispatchStatus ?? 'unknown'}`);
                     }
-                    return false;
+                    return failure;
                 }
                 else {
+                    acceptedMessageId = mid;
                     this.logAunSendAccepted('group.send', channelId, mid, encrypt, result, finalText);
                     this.checkpointTextDelivery(entry, mid, encrypt, result);
                     appendAidEvent({ ts: Date.now(), iso: new Date().toISOString(), event: 'message_out', aid: this.config.aid, to: channelId, msgId: mid, kind: 'text', len: finalText.length, groupId: channelId });
@@ -3847,34 +4234,41 @@ export class AUNChannel {
             else {
                 params.to = targetAid;
                 const result = await this.callAndTrace('message.send', params);
-                if (!result || !result.message_id) {
+                const mid = this.messageIdFromSendResult(result);
+                if (!mid) {
                     logger.warn(`${this.logPrefix()} message.send returned no message_id: ${JSON.stringify(result)}`);
-                    return false;
+                    return classifyAunSendFailure(result, 'message.send returned no message_id');
                 }
                 else {
-                    this.logAunSendAccepted('message.send', this.peerLabel(targetAid), result.message_id, encrypt, result, finalText);
-                    this.checkpointTextDelivery(entry, result.message_id, encrypt, result);
+                    acceptedMessageId = mid;
+                    this.logAunSendAccepted('message.send', this.peerLabel(targetAid), mid, encrypt, result, finalText);
+                    this.checkpointTextDelivery(entry, mid, encrypt, result);
                     const causation = normalizeCausation(context?.metadata?.causation);
                     if (causation) {
-                        registerAunCausation(result.message_id, this.config.aid, targetAid, causation);
+                        registerAunCausation(mid, this.config.aid, targetAid, causation);
                         recordCausationSpan(causation, 'message.outbound', {
                             status: 'completed',
-                            refs: { messageId: result.message_id, taskId: context?.metadata?.taskId },
+                            refs: { messageId: mid, taskId: context?.metadata?.taskId },
                         });
                     }
-                    appendAidEvent({ ts: Date.now(), iso: new Date().toISOString(), event: 'message_out', aid: this.config.aid, to: targetAid, msgId: result.message_id, kind: 'text', len: finalText.length });
+                    appendAidEvent({ ts: Date.now(), iso: new Date().toISOString(), event: 'message_out', aid: this.config.aid, to: targetAid, msgId: mid, kind: 'text', len: finalText.length });
                     this.aidStatsCollector?.recordOutbound(this.config.aid, targetAid, Buffer.byteLength(finalText, 'utf-8'), finalText, false, encrypt, context?.metadata?.chatmode, 'send');
                     this.appendOutboundJsonl(targetAid, {
-                        ...classifyAunPayloadForLog(payload), msgId: result.message_id, encrypt, context, isGroup: false, source,
+                        ...classifyAunPayloadForLog(payload), msgId: mid, encrypt, context, isGroup: false, source,
                         transport: this.sendReceiptFromResult(result),
                     });
                     // Observer forward: outbound (private) — 原样转发 SDK SendResult（含 envelope + payload）
                     this.forwardOutbound(result);
                 }
             }
-            return true;
+            return sentOutboxResult(acceptedMessageId);
         }
         catch (e) {
+            if (entry.deliveryReceipt) {
+                const error = e instanceof Error ? e.message : String(e);
+                logger.error(`${this.logPrefix()} AUN accepted the durable text but local post-send processing failed; retaining receipt for recovery: id=${entry.id} error=${error}`);
+                return { status: 'retry', error, code: 'OUTBOX_POST_SEND_FAILED' };
+            }
             if (encrypt && e instanceof E2EEError) {
                 this.peerE2ee.set(encryptTarget, { ok: false, ts: Date.now() });
                 logger.warn(`${this.logPrefix()} E2EE send failed to ${channelId}, retrying plaintext: ${e}`);
@@ -3882,13 +4276,17 @@ export class AUNChannel {
                 try {
                     if (isGroup) {
                         this.trace('OUT', 'group.send.fallback', params);
-                        const result = await this.client.call('group.send', params);
+                        const result = await this.callClient('group.send', params);
                         const mid = this.messageIdFromSendResult(result);
-                        this.trace('OUT', 'group.send.fallback.ok', { message_id: mid });
                         if (!mid) {
+                            const resultRecord = errorRecord(result);
+                            const dispatch = errorRecord(resultRecord?.message_dispatch)?.status;
+                            this.trace('OUT', 'group.send.fallback.missing_id', { dispatch });
                             logger.warn(`${this.logPrefix()} group.send fallback returned no message_id: ${JSON.stringify(result)}`);
-                            return false;
+                            return classifyAunSendFailure(result, 'group.send plaintext fallback returned no message_id');
                         }
+                        acceptedMessageId = mid;
+                        this.trace('OUT', 'group.send.fallback.ok', { message_id: mid });
                         this.checkpointTextDelivery(entry, mid, false, result);
                         appendAidEvent({ ts: Date.now(), iso: new Date().toISOString(), event: 'message_out', aid: this.config.aid, to: channelId, msgId: mid, kind: 'text', len: finalText.length, groupId: channelId });
                         const statsContext = await this.groupStatsContext(channelId);
@@ -3901,13 +4299,15 @@ export class AUNChannel {
                     }
                     else {
                         this.trace('OUT', 'message.send.fallback', params);
-                        const result = await this.client.call('message.send', params);
-                        const mid = result?.message_id;
-                        this.trace('OUT', 'message.send.fallback.ok', { message_id: mid });
-                        if (!result || !mid) {
+                        const result = await this.callClient('message.send', params);
+                        const mid = this.messageIdFromSendResult(result);
+                        if (!mid) {
+                            this.trace('OUT', 'message.send.fallback.missing_id', {});
                             logger.warn(`${this.logPrefix()} message.send fallback returned no message_id: ${JSON.stringify(result)}`);
-                            return false;
+                            return classifyAunSendFailure(result, 'message.send plaintext fallback returned no message_id');
                         }
+                        acceptedMessageId = mid;
+                        this.trace('OUT', 'message.send.fallback.ok', { message_id: mid });
                         this.checkpointTextDelivery(entry, mid, false, result);
                         const causation = normalizeCausation(context?.metadata?.causation);
                         if (causation) {
@@ -3925,31 +4325,49 @@ export class AUNChannel {
                         });
                         this.forwardOutbound(result);
                     }
-                    return true;
+                    return sentOutboxResult(acceptedMessageId);
                 }
                 catch (e2) {
+                    if (entry.deliveryReceipt) {
+                        const error = e2 instanceof Error ? e2.message : String(e2);
+                        logger.error(`${this.logPrefix()} AUN accepted the plaintext fallback but local post-send processing failed; retaining receipt for recovery: id=${entry.id} error=${error}`);
+                        return { status: 'retry', error, code: 'OUTBOX_POST_SEND_FAILED' };
+                    }
                     this.trace('OUT', 'send.fallback.error', { channelId, error: String(e2) });
                     logger.error(`${this.logPrefix()} Plaintext fallback also failed to ${channelId}: ${e2}`);
-                    return false;
+                    return classifyAunSendFailure(e2, `plaintext send fallback failed to ${channelId}`);
                 }
             }
             else {
                 this.trace('OUT', 'send.error', { channelId, error: String(e) });
                 logger.error(`${this.logPrefix()} Send failed to ${channelId} (outbox id=${entry.id}): ${e}`);
-                return false;
+                return classifyAunSendFailure(e, `send failed to ${channelId}`);
             }
         }
     }
     checkpointTextDelivery(entry, messageId, encrypt, result) {
-        if (!entry.dedupeKey)
-            return;
-        entry.deliveryReceipt = {
+        this.checkpointDurableDelivery(entry, messageId, encrypt, result);
+    }
+    checkpointDurableDelivery(entry, messageId, encrypt, result) {
+        const submittedRoute = {
+            id: entry.id,
+            channelId: entry.channelId,
+            delivery: entry.delivery,
+            queue: entry.queue,
+        };
+        const receipt = {
             messageId,
             encrypt,
             transport: this.sendReceiptFromResult(result),
         };
-        if (!outbox.replace(this.config.aid, entry)) {
-            logger.warn(`${this.logPrefix()} Failed to checkpoint durable operation receipt: ${entry.dedupeKey}`);
+        const replaced = outbox.updateDeliveryReceiptIfRouteMatches(this.config.aid, submittedRoute, receipt);
+        if (replaced === 'replaced') {
+            entry.deliveryReceipt = receipt;
+            return true;
+        }
+        else {
+            logger.warn(`${this.logPrefix()} Did not checkpoint durable delivery receipt: entry=${entry.id} operation=${entry.dedupeKey ?? 'none'} reason=${replaced}`);
+            return false;
         }
     }
     async deliverPayloadEntry(entry) {
@@ -3958,32 +4376,85 @@ export class AUNChannel {
             : undefined;
         if (interactionId && this.invalidatedInteractions.has(interactionId)) {
             logger.info(`${this.logPrefix()} Discarded invalidated interaction from durable outbox: request=${interactionId} entry=${entry.id}`);
-            return { ok: true };
+            return { ok: true, status: 'sent' };
+        }
+        const interactionExpiresAt = entry.postSend?.type === 'register_interaction_card'
+            ? entry.postSend.expiresAt
+            : undefined;
+        if (typeof interactionExpiresAt === 'number'
+            && Number.isFinite(interactionExpiresAt)
+            && interactionExpiresAt <= Date.now()) {
+            logger.info(`${this.logPrefix()} Discarded expired interaction from durable outbox: request=${interactionId ?? '<unknown>'} entry=${entry.id}`);
+            return {
+                ok: false,
+                status: 'permanent',
+                error: 'interaction card has expired',
+                code: 'INTERACTION_EXPIRED',
+            };
         }
         const channelId = entry.channelId;
         const payload = entry.payload;
         if (!payload) {
             logger.warn(`${this.logPrefix()} deliverPayloadEntry: missing payload (outbox id=${entry.id})`);
-            return { ok: true };
+            return { ok: false, status: 'permanent', error: 'durable payload is missing', code: 'MISSING_PAYLOAD' };
         }
         const contentKind = entry.contentKind;
         const logText = entry.logText ?? this.payloadLogText(payload, contentKind);
         const delivery = this.requirePersistedDelivery(channelId, entry.delivery);
         const context = this.withDelivery(entry.context, delivery);
         logger.info(`${this.logPrefix()} deliverPayloadEntry: id=${entry.id} kind=${contentKind ?? payload.type ?? 'payload'} channelId=${channelId} thread_id=${payload.thread_id ?? 'none'} task_id=${payload.task_id ?? 'none'} textLen=${logText.length}`);
-        const sent = await this.sendAunPayload(channelId, payload, context, `${contentKind ?? payload.type ?? 'payload'}`);
-        if (sent.discarded) {
-            logger.warn(`${this.logPrefix()} Removed malformed durable payload from outbox: id=${entry.id} channel=${channelId}`);
-            return { ok: true, discarded: true };
+        const isGroup = delivery.chatType === 'group';
+        const source = context?.metadata?.source ?? 'daemon';
+        if (entry.deliveryReceipt) {
+            try {
+                this.appendOutboundJsonl(channelId, {
+                    ...classifyAunPayloadForLog(payload),
+                    msgId: entry.deliveryReceipt.messageId,
+                    encrypt: entry.deliveryReceipt.encrypt,
+                    context,
+                    isGroup,
+                    source,
+                    transport: entry.deliveryReceipt.transport,
+                });
+                this.runPostSend(entry, entry.deliveryReceipt.messageId);
+                return {
+                    ok: true,
+                    status: 'sent',
+                    messageId: entry.deliveryReceipt.messageId,
+                    encrypt: entry.deliveryReceipt.encrypt,
+                };
+            }
+            catch (error) {
+                const detail = error instanceof Error ? error.message : String(error);
+                logger.error(`${this.logPrefix()} Failed to recover local post-send state from durable payload receipt: id=${entry.id} error=${detail}`);
+                return { ok: false, status: 'retry', error: detail, code: 'OUTBOX_POST_SEND_FAILED' };
+            }
         }
+        const sent = await this.sendAunPayload(channelId, payload, context, `${contentKind ?? payload.type ?? 'payload'}`);
         if (!sent.ok || !sent.messageId)
             return sent;
-        const isGroup = delivery.chatType === 'group';
-        const statsContext = isGroup ? await this.groupStatsContext(channelId) : undefined;
-        this.logAunSendAccepted(isGroup ? 'group.send' : 'message.send', isGroup ? channelId : this.peerLabel(channelId), sent.messageId, !!sent.encrypt, sent.result, logText);
-        this.recordDurableOutbound(channelId, payload, sent.messageId, !!sent.encrypt, context, isGroup, contentKind, logText, sent.result, statsContext);
-        this.runPostSend(entry, sent.messageId);
-        return sent;
+        try {
+            this.checkpointDurableDelivery(entry, sent.messageId, !!sent.encrypt, sent.result);
+        }
+        catch (error) {
+            const detail = error instanceof Error ? error.message : String(error);
+            logger.error(`${this.logPrefix()} AUN accepted the durable payload but its receipt could not be persisted: id=${entry.id} mid=${sent.messageId} error=${detail}`);
+            return { ok: false, status: 'permanent', error: detail, code: 'OUTBOX_RECEIPT_CHECKPOINT_FAILED' };
+        }
+        try {
+            const statsContext = isGroup ? await this.groupStatsContext(channelId) : undefined;
+            this.logAunSendAccepted(isGroup ? 'group.send' : 'message.send', isGroup ? channelId : this.peerLabel(channelId), sent.messageId, !!sent.encrypt, sent.result, logText);
+            this.recordDurableOutbound(channelId, payload, sent.messageId, !!sent.encrypt, context, isGroup, contentKind, logText, sent.result, statsContext);
+            this.runPostSend(entry, sent.messageId);
+            return sent;
+        }
+        catch (error) {
+            const detail = error instanceof Error ? error.message : String(error);
+            logger.error(`${this.logPrefix()} AUN accepted the durable payload but local post-send processing failed: id=${entry.id} mid=${sent.messageId} error=${detail}`);
+            return entry.deliveryReceipt
+                ? { ok: false, status: 'retry', error: detail, code: 'OUTBOX_POST_SEND_FAILED' }
+                : { ok: false, status: 'permanent', error: detail, code: 'OUTBOX_POST_SEND_UNCHECKPOINTED' };
+        }
     }
     /** 有效会话正文写入 messages.jsonl（message.send/group.send 成功后调用）。 */
     appendOutboundJsonl(channelId, descriptor) {
@@ -4127,16 +4598,22 @@ export class AUNChannel {
             logger.debug(`${this.logPrefix()} thought.put failed to ${channelId}: ${err?.name}(${err?.code})=${err?.message}`);
         }
     }
-    /** 发送结构化 AUN payload；transient 协议载荷不写本地 messages.jsonl。 */
-    async sendStructured(channelId, payload, context) {
+    /** Send a transient structured payload and preserve the gateway disposition. */
+    async sendStructuredResult(channelId, payload, context) {
         const delivery = this.requireDelivery(channelId, context);
         context = this.withDelivery(context, delivery);
         // Validate before checking connection state so malformed producer payloads
         // are reported deterministically instead of being hidden by a disconnect.
         const validatedPayload = this.normalizeAunPayloadMentions(payload);
         const finalPayload = this.stripUndefinedDeep(validatedPayload);
-        if (!this.connected || !this.client)
-            return null;
+        if (!this.connected || !this.client) {
+            return {
+                ok: false,
+                status: 'retry',
+                error: 'AUN channel is not connected',
+                code: 'AUN_NOT_CONNECTED',
+            };
+        }
         const isGroup = delivery.chatType === 'group';
         const targetAid = channelId;
         const encryptTarget = isGroup ? channelId : targetAid;
@@ -4165,27 +4642,54 @@ export class AUNChannel {
             if (isGroup) {
                 params.group_id = delivery.groupId;
                 const result = await this.callAndTrace('group.send', params);
-                const mid = result?.message?.message_id ?? result?.message_id ?? null;
+                const mid = this.messageIdFromSendResult(result);
+                if (!mid) {
+                    const failure = classifyAunSendFailure(result, 'group.send returned no message_id');
+                    logger.warn(`${this.logPrefix()} group.send (${payload.type}) returned no message_id; disposition=${failure.status}`);
+                    return { ok: false, ...failure };
+                }
                 logger.info(`${this.logPrefix()} group.send (${payload.type}) ok: group=${channelId} mid=${mid} encrypt=${encrypt}`);
                 if (!isMenuPayload)
                     this.forwardOutbound(result);
-                return mid;
+                return { ok: true, messageId: mid };
             }
             else {
                 params.to = targetAid;
                 const result = await this.callAndTrace('message.send', params);
-                logger.info(`${this.logPrefix()} message.send (${payload.type}) ok: to=${this.peerLabel(targetAid)} mid=${result?.message_id} encrypt=${encrypt}`);
+                const mid = this.messageIdFromSendResult(result);
+                if (!mid) {
+                    const failure = classifyAunSendFailure(result, 'message.send returned no message_id');
+                    logger.warn(`${this.logPrefix()} message.send (${payload.type}) returned no message_id; disposition=${failure.status}`);
+                    return { ok: false, ...failure };
+                }
+                logger.info(`${this.logPrefix()} message.send (${payload.type}) ok: to=${this.peerLabel(targetAid)} mid=${mid} encrypt=${encrypt}`);
                 if (!isMenuPayload)
                     this.forwardOutbound(result);
-                return result?.message_id ?? null;
+                return { ok: true, messageId: mid };
             }
         }
         catch (e) {
-            const err = e;
-            logger.warn(`${this.logPrefix()} sendStructured failed (${payload.type}) to ${channelId}: ${err?.name}(${err?.code})=${err?.message}`);
-            return null;
+            const failure = classifyAunSendFailure(e, `structured send failed to ${channelId}`);
+            logger.warn(`${this.logPrefix()} sendStructured failed (${payload.type}) to ${channelId}: disposition=${failure.status} code=${failure.code ?? 'unknown'} error=${failure.error}`);
+            return { ok: false, ...failure };
         }
     }
+    /** Compatibility API for optional transient payloads. */
+    async sendStructured(channelId, payload, context) {
+        const result = await this.sendStructuredResult(channelId, payload, context);
+        return result.ok ? result.messageId : null;
+    }
+    /** Strict API for callers that must not report a failed transport as sent. */
+    async sendStructuredOrThrow(channelId, payload, context) {
+        const result = await this.sendStructuredResult(channelId, payload, context);
+        if (result.ok)
+            return result.messageId;
+        throw Object.assign(new Error(result.error), {
+            name: 'AUNSendError',
+            code: result.code ?? 'AUN_SEND_FAILED',
+            retryable: result.status === 'retry',
+        });
+    }
     async sendFile(channelId, filePath, context) {
         const delivery = this.requireDelivery(channelId, context);
         context = this.withDelivery(context, delivery);
@@ -4208,7 +4712,9 @@ export class AUNChannel {
             channelId,
             delivery,
             type: 'file',
+            contentKind: 'file',
             filePath: absPath,
+            logText: `📎 ${path.basename(absPath)} (${formatSize(stat.size)})`,
             context,
         });
         logger.debug(`${this.logPrefix()} Outbox enqueued file: id=${entry.id} channel=${channelId} file=${absPath}`);
@@ -4219,9 +4725,12 @@ export class AUNChannel {
             }
             return;
         }
-        const ok = await this.withOutboxInFlight(entry, () => this.deliverFileEntry(entry), false);
-        if (ok) {
-            outbox.remove(this.config.aid, entry.id);
+        const result = await this.withOutboxInFlight(entry, () => this.deliverFileEntry(entry), { status: 'retry', error: 'outbox send is already in flight' });
+        if (result.status === 'sent') {
+            this.removeDeliveredOutboxEntry(entry);
+        }
+        else if (result.status === 'permanent') {
+            this.markPermanentOutboxFailure(entry, result);
         }
     }
     async sendImage(channelId, data, mimeType, alt, context) {
@@ -4263,9 +4772,11 @@ export class AUNChannel {
             }
             return;
         }
-        const ok = await this.withOutboxInFlight(entry, () => this.deliverImageEntry(entry), false);
-        if (ok)
-            outbox.remove(this.config.aid, entry.id);
+        const result = await this.withOutboxInFlight(entry, () => this.deliverImageEntry(entry), { status: 'retry', error: 'outbox send is already in flight' });
+        if (result.status === 'sent')
+            this.removeDeliveredOutboxEntry(entry);
+        else if (result.status === 'permanent')
+            this.markPermanentOutboxFailure(entry, result);
     }
     async buildUploadedImagePayload(data, mimeType, alt) {
         if (!this.connected || !this.client) {
@@ -4305,7 +4816,7 @@ export class AUNChannel {
         const image = entry.image;
         if (!image || typeof image.dataBase64 !== 'string') {
             logger.warn(`${this.logPrefix()} deliverImageEntry: missing image data (outbox id=${entry.id})`);
-            return true;
+            return { status: 'permanent', error: 'durable image data is missing', code: 'MISSING_IMAGE_DATA' };
         }
         const delivery = this.requirePersistedDelivery(entry.channelId, entry.delivery);
         entry.delivery = delivery;
@@ -4313,43 +4824,75 @@ export class AUNChannel {
         const data = Buffer.from(image.dataBase64, 'base64');
         if (data.length === 0) {
             logger.warn(`${this.logPrefix()} deliverImageEntry: invalid image data (outbox id=${entry.id})`);
-            return true;
+            return { status: 'permanent', error: 'durable image data is invalid', code: 'INVALID_IMAGE_DATA' };
         }
-        const imagePayload = await this.buildUploadedImagePayload(data, image.mimeType, image.alt);
-        entry.type = 'payload';
-        entry.contentKind = 'image';
-        entry.payload = this.applyReplyContextToPayload(imagePayload, entry.context);
-        entry.logText ??= image.alt ? `[image] ${image.alt}` : '[image]';
-        delete entry.image;
-        // Persist the attachment reference before message.send. A failed send then
-        // retries the compact wire payload without re-uploading the same image.
-        let payloadEntry = entry;
-        if (!outbox.replace(this.config.aid, entry)) {
-            payloadEntry = outbox.enqueue(this.config.aid, {
+        try {
+            const imagePayload = await this.buildUploadedImagePayload(data, image.mimeType, image.alt);
+            entry.type = 'payload';
+            entry.contentKind = 'image';
+            entry.payload = this.applyReplyContextToPayload(imagePayload, entry.context);
+            entry.logText ??= image.alt ? `[image] ${image.alt}` : '[image]';
+            delete entry.image;
+            // Persist the attachment reference before message.send. A failed send then
+            // retries the compact wire payload without re-uploading the same image.
+            const submittedRoute = {
+                id: entry.id,
                 channelId: entry.channelId,
                 delivery,
-                type: 'payload',
-                contentKind: 'image',
-                payload: entry.payload,
-                context: entry.context,
-                logText: entry.logText,
-                ttl: entry.ttl,
-            });
+            };
+            const replaced = outbox.replaceIfRouteMatches(this.config.aid, submittedRoute, entry);
+            if (replaced === 'route-changed') {
+                logger.warn(`${this.logPrefix()} Image route changed during upload; preserving original outbox entry for the corrected route: id=${entry.id}`);
+                return { status: 'retry', error: 'image delivery route changed during upload', code: 'OUTBOX_ROUTE_CHANGED' };
+            }
+            if (replaced === 'missing') {
+                logger.warn(`${this.logPrefix()} Image outbox entry disappeared during upload; skipping send: id=${entry.id}`);
+                return { status: 'permanent', error: 'image outbox entry disappeared during upload', code: 'OUTBOX_ENTRY_MISSING' };
+            }
+            const sent = await this.deliverPayloadEntry(entry);
+            return sent.ok ? sentOutboxResult(sent.messageId) : sent;
         }
-        const sent = await this.deliverPayloadEntry(payloadEntry);
-        if (sent.ok && payloadEntry.id !== entry.id) {
-            outbox.remove(this.config.aid, payloadEntry.id);
+        catch (error) {
+            const failure = classifyAunSendFailure(error, 'image upload or send failed');
+            logger.error(`${this.logPrefix()} Image delivery failed (outbox id=${entry.id}): ${failure.error}; disposition=${failure.status}`);
+            return failure;
         }
-        return sent.ok;
     }
     async deliverFileEntry(entry) {
         const channelId = entry.channelId;
+        if (typeof entry.filePath !== 'string' || !entry.filePath.trim()) {
+            logger.warn(`${this.logPrefix()} deliverFileEntry: missing file path (outbox id=${entry.id})`);
+            return { status: 'permanent', error: 'durable file path is missing', code: 'MISSING_FILE_PATH' };
+        }
         const absPath = entry.filePath;
         const delivery = this.requirePersistedDelivery(channelId, entry.delivery);
         const context = this.withDelivery(entry.context, delivery);
+        const isGroup = delivery.chatType === 'group';
+        const source = context?.metadata?.source ?? 'daemon';
+        if (entry.deliveryReceipt) {
+            const filename = path.basename(absPath);
+            const logText = entry.logText ?? `[file] ${filename}`;
+            try {
+                this.appendOutboundJsonl(channelId, {
+                    ...classifyAunPayloadForLog({ type: 'file', text: logText }),
+                    msgId: entry.deliveryReceipt.messageId,
+                    encrypt: entry.deliveryReceipt.encrypt,
+                    context,
+                    isGroup,
+                    source,
+                    transport: entry.deliveryReceipt.transport,
+                });
+                return sentOutboxResult(entry.deliveryReceipt.messageId);
+            }
+            catch (error) {
+                const detail = error instanceof Error ? error.message : String(error);
+                logger.error(`${this.logPrefix()} Failed to recover local file post-send state from durable receipt: id=${entry.id} error=${detail}`);
+                return { status: 'retry', error: detail, code: 'OUTBOX_POST_SEND_FAILED' };
+            }
+        }
         if (!fs.existsSync(absPath)) {
             logger.warn(`${this.logPrefix()} deliverFileEntry: file gone: ${absPath}`);
-            return true; // remove from outbox, file no longer exists
+            return { status: 'permanent', error: 'file no longer exists', code: 'FILE_NOT_FOUND' };
         }
         const filename = path.basename(absPath);
         const fileData = fs.readFileSync(absPath);
@@ -4404,7 +4947,6 @@ export class AUNChannel {
                 attachment,
                 context,
             });
-            const isGroup = delivery.chatType === 'group';
             const fileTargetAid = channelId;
             const encryptTarget = isGroup ? channelId : fileTargetAid;
             const encrypt = context?.metadata?.encrypted != null
@@ -4417,26 +4959,26 @@ export class AUNChannel {
                 if (isGroup) {
                     params.group_id = delivery.groupId;
                     this.trace('OUT', 'group.send.file', params);
-                    const result = await this.client.call('group.send', params);
+                    const result = await this.callClient('group.send', params);
                     sendResult = result;
-                    const fileMid = result?.message?.message_id ?? result?.message_id;
+                    const fileMid = this.messageIdFromSendResult(result);
                     sentMid = fileMid ?? null;
                     this.trace('OUT', 'group.send.file.ok', { message_id: fileMid });
                     if (!fileMid) {
                         logger.warn(`${this.logPrefix()} group.send.file returned no message_id: ${JSON.stringify(result)}`);
-                        return false;
+                        return classifyAunSendFailure(result, 'group.send.file returned no message_id');
                     }
                 }
                 else {
                     params.to = fileTargetAid;
                     this.trace('OUT', 'message.send.file', params);
-                    const result = await this.client.call('message.send', params);
+                    const result = await this.callClient('message.send', params);
                     sendResult = result;
-                    sentMid = result?.message_id ?? null;
+                    sentMid = this.messageIdFromSendResult(result);
                     this.trace('OUT', 'message.send.file.ok', { message_id: sentMid });
-                    if (!result || !sentMid) {
+                    if (!sentMid) {
                         logger.warn(`${this.logPrefix()} message.send.file returned no message_id: ${JSON.stringify(result)}`);
-                        return false;
+                        return classifyAunSendFailure(result, 'message.send.file returned no message_id');
                     }
                 }
             }
@@ -4451,25 +4993,25 @@ export class AUNChannel {
                     params.encrypt = false;
                     if (isGroup) {
                         this.trace('OUT', 'group.send.file.fallback', params);
-                        const result = await this.client.call('group.send', params);
+                        const result = await this.callClient('group.send', params);
                         sendResult = result;
-                        const fbMid = result?.message?.message_id ?? result?.message_id;
+                        const fbMid = this.messageIdFromSendResult(result);
                         sentMid = fbMid ?? null;
                         this.trace('OUT', 'group.send.file.fallback.ok', { message_id: fbMid });
                         if (!fbMid) {
                             logger.warn(`${this.logPrefix()} group.send.file fallback returned no message_id: ${JSON.stringify(result)}`);
-                            return false;
+                            return classifyAunSendFailure(result, 'group.send.file plaintext fallback returned no message_id');
                         }
                     }
                     else {
                         this.trace('OUT', 'message.send.file.fallback', params);
-                        const result = await this.client.call('message.send', params);
+                        const result = await this.callClient('message.send', params);
                         sendResult = result;
-                        sentMid = result?.message_id ?? null;
+                        sentMid = this.messageIdFromSendResult(result);
                         this.trace('OUT', 'message.send.file.fallback.ok', { message_id: sentMid });
-                        if (!result || !sentMid) {
+                        if (!sentMid) {
                             logger.warn(`${this.logPrefix()} message.send.file fallback returned no message_id: ${JSON.stringify(result)}`);
-                            return false;
+                            return classifyAunSendFailure(result, 'message.send.file plaintext fallback returned no message_id');
                         }
                     }
                 }
@@ -4477,26 +5019,40 @@ export class AUNChannel {
                     throw sendErr;
                 }
             }
-            logger.info(`${this.logPrefix()} File sent: ${filename} (${formatSize(stat.size)}) → ${channelId}`);
-            if (sentMid) {
-                const fileText = filePayload.text;
-                appendAidEvent({ ts: Date.now(), iso: new Date().toISOString(), event: 'message_out', aid: this.config.aid, to: channelId, msgId: sentMid, kind: 'file', len: fileText.length, ...(isGroup && { groupId: channelId }) });
-                const statsContext = isGroup ? await this.groupStatsContext(channelId) : undefined;
-                this.aidStatsCollector?.recordOutbound(this.config.aid, channelId, Buffer.byteLength(fileText, 'utf-8'), fileText, false, !!params.encrypt, context?.metadata?.chatmode, 'send', statsContext);
-                const source = context?.metadata?.source ?? 'daemon';
-                this.appendOutboundJsonl(channelId, {
-                    ...classifyAunPayloadForLog(filePayload), msgId: sentMid, encrypt: !!params.encrypt,
-                    context, isGroup, source,
-                });
+            if (!sentMid) {
+                return { status: 'permanent', error: 'file send returned no message_id', code: 'MISSING_MESSAGE_ID' };
+            }
+            try {
+                this.checkpointDurableDelivery(entry, sentMid, !!params.encrypt, sendResult);
+            }
+            catch (error) {
+                const detail = error instanceof Error ? error.message : String(error);
+                logger.error(`${this.logPrefix()} AUN accepted the durable file but its receipt could not be persisted: id=${entry.id} mid=${sentMid} error=${detail}`);
+                return { status: 'permanent', error: detail, code: 'OUTBOX_RECEIPT_CHECKPOINT_FAILED' };
             }
+            logger.info(`${this.logPrefix()} File sent: ${filename} (${formatSize(stat.size)}) → ${channelId}`);
+            const fileText = filePayload.text;
+            appendAidEvent({ ts: Date.now(), iso: new Date().toISOString(), event: 'message_out', aid: this.config.aid, to: channelId, msgId: sentMid, kind: 'file', len: fileText.length, ...(isGroup && { groupId: channelId }) });
+            const statsContext = isGroup ? await this.groupStatsContext(channelId) : undefined;
+            this.aidStatsCollector?.recordOutbound(this.config.aid, channelId, Buffer.byteLength(fileText, 'utf-8'), fileText, false, !!params.encrypt, context?.metadata?.chatmode, 'send', statsContext);
+            this.appendOutboundJsonl(channelId, {
+                ...classifyAunPayloadForLog(filePayload), msgId: sentMid, encrypt: !!params.encrypt,
+                context, isGroup, source, transport: this.sendReceiptFromResult(sendResult),
+            });
             if (sendResult)
                 this.forwardOutbound(sendResult);
-            return true;
+            return sentOutboxResult(sentMid);
         }
         catch (e) {
+            if (entry.deliveryReceipt) {
+                const detail = e instanceof Error ? e.message : String(e);
+                logger.error(`${this.logPrefix()} AUN accepted the durable file but local post-send processing failed; retaining receipt for recovery: id=${entry.id} error=${detail}`);
+                return { status: 'retry', error: detail, code: 'OUTBOX_POST_SEND_FAILED' };
+            }
             this.trace('OUT', 'sendFile.error', { channelId, filePath: absPath, error: String(e) });
-            logger.error(`${this.logPrefix()} sendFile failed for ${channelId} (outbox id=${entry.id}): ${e}`);
-            return false;
+            const failure = classifyAunSendFailure(e, `sendFile failed for ${channelId}`);
+            logger.error(`${this.logPrefix()} sendFile failed for ${channelId} (outbox id=${entry.id}): ${failure.error}; disposition=${failure.status}`);
+            return failure;
         }
     }
     // ── Outbox drain ───────────────────────────────────────────
@@ -4505,7 +5061,7 @@ export class AUNChannel {
         if (this.outboxTimer)
             return;
         this.outboxTimer = setInterval(() => {
-            if (this.connected && this.client && outbox.hasPending(this.config.aid)) {
+            if (this.connected && this.client && (outbox.hasPending(this.config.aid) || outbox.hasPending(this.config.aid, 'activity'))) {
                 this.drainOutbox();
             }
         }, 30_000);
@@ -4519,58 +5075,86 @@ export class AUNChannel {
     async drainOutbox() {
         if (!this.connected || !this.client)
             return;
-        await this.migrateLegacyBootstrapRoutes();
-        if (!outbox.hasPending(this.config.aid))
-            return;
-        logger.info(`${this.logPrefix()} Draining outbox...`);
-        const result = await outbox.drain(this.config.aid, async (entry) => {
-            if (!isDeliveryTarget(entry.delivery)) {
-                logger.warn(`${this.logPrefix()} Discarding legacy/malformed outbox entry without a trusted delivery route: id=${entry.id} channel=${entry.channelId}`);
-                return true;
-            }
-            if (entry.type === 'text') {
-                return this.withOutboxInFlight(entry, () => this.deliverTextEntry(entry), false);
-            }
-            else if (entry.type === 'file') {
-                return this.withOutboxInFlight(entry, () => this.deliverFileEntry(entry), false);
-            }
-            else if (entry.type === 'image') {
-                return this.withOutboxInFlight(entry, () => this.deliverImageEntry(entry), false);
-            }
-            else if (entry.type === 'payload') {
-                const sent = await this.withOutboxInFlight(entry, () => this.deliverPayloadEntry(entry), { ok: false });
-                return sent.ok;
+        this.repairBootstrapRoutes();
+        const drainQueue = async (queue) => {
+            if (!outbox.hasPending(this.config.aid, queue))
+                return;
+            logger.info(`${this.logPrefix()} Draining ${queue} outbox...`);
+            const result = await outbox.drain(this.config.aid, async (entry) => {
+                if (!isDeliveryTarget(entry.delivery)) {
+                    logger.warn(`${this.logPrefix()} Discarding legacy/malformed outbox entry without a trusted delivery route: id=${entry.id} channel=${entry.channelId}`);
+                    return {
+                        status: 'permanent',
+                        error: 'outbox entry has no valid delivery route',
+                        code: 'AUN_OUTBOUND_ROUTE_REQUIRED',
+                    };
+                }
+                if (entry.type === 'text') {
+                    return this.withOutboxInFlight(entry, () => this.deliverTextEntry(entry), { status: 'retry', error: 'outbox send is already in flight' });
+                }
+                else if (entry.type === 'file') {
+                    return this.withOutboxInFlight(entry, () => this.deliverFileEntry(entry), { status: 'retry', error: 'outbox send is already in flight' });
+                }
+                else if (entry.type === 'image') {
+                    return this.withOutboxInFlight(entry, () => this.deliverImageEntry(entry), { status: 'retry', error: 'outbox send is already in flight' });
+                }
+                else if (entry.type === 'payload') {
+                    const sent = await this.withOutboxInFlight(entry, () => this.deliverPayloadEntry(entry), { ok: false, status: 'retry', error: 'outbox send is already in flight' });
+                    return sent.ok
+                        ? { status: 'sent', ...(sent.messageId ? { messageId: sent.messageId } : {}) }
+                        : sent;
+                }
+                return { status: 'permanent', error: `unsupported outbox entry type: ${entry.type}`, code: 'UNSUPPORTED_OUTBOX_TYPE' };
+            }, queue);
+            if (result.sent > 0 || result.expired > 0 || result.permanent) {
+                logger.info(`${this.logPrefix()} ${queue} outbox drained: sent=${result.sent} expired=${result.expired} failed=${result.failed} permanent=${result.permanent ?? 0}`);
             }
-            return true; // unknown type, discard
-        });
-        if (result.sent > 0 || result.expired > 0) {
-            logger.info(`${this.logPrefix()} Outbox drained: sent=${result.sent} expired=${result.expired} failed=${result.failed}`);
-        }
+        };
+        await drainQueue('default');
+        await drainQueue('activity');
     }
-    /** Repair pre-route bootstrap entries once the AUN group endpoint is available. */
-    async migrateLegacyBootstrapRoutes() {
+    /** Repair bootstrap outbox entries to the configured personal Owner route. */
+    repairBootstrapRoutes() {
+        const aid = this.config.aid.replace(/^@/, '');
+        const owner = getFirstStaticAgentOwner(aid);
+        if (!owner)
+            return;
         const operationIds = new Set([
-            bootstrapInitialMessageOperationId(this.config.aid),
-            postBootstrapWelcomeOperationId(this.config.aid),
+            bootstrapInitialMessageOperationId(aid),
+            postBootstrapWelcomeOperationId(aid),
         ]);
-        const entries = outbox.load(this.config.aid).filter(entry => typeof entry.dedupeKey === 'string'
-            && operationIds.has(entry.dedupeKey)
-            && entry.channelId
-            && entry.delivery?.chatType === 'private');
+        const entries = [...operationIds]
+            .map(operationId => outbox.findByDedupeKey(aid, operationId, { includeTerminal: true }))
+            .filter((entry) => !!entry?.channelId);
         for (const entry of entries) {
-            const group = await this.isGroup(entry.channelId);
-            if (group !== true)
+            const delivery = { chatType: 'private' };
+            const nestedDelivery = entry.context?.delivery;
+            const routeAlreadyPrivate = entry.channelId === owner
+                && entry.delivery?.chatType === 'private'
+                && (nestedDelivery === undefined || nestedDelivery?.chatType === 'private');
+            if (routeAlreadyPrivate)
                 continue;
-            const delivery = { chatType: 'group', groupId: entry.channelId };
-            if (!outbox.replace(this.config.aid, {
+            const repaired = {
                 ...entry,
+                channelId: owner,
                 delivery,
                 context: entry.context
                     ? { ...entry.context, delivery }
                     : entry.context,
-            }))
+            };
+            // A receipt is scoped to the original transport target. Never treat a
+            // send accepted for a stale group/private address as proof that the
+            // corrected Owner route was delivered.
+            if (entry.channelId !== owner || entry.delivery?.chatType !== 'private') {
+                delete repaired.deliveryReceipt;
+            }
+            delete repaired.terminal;
+            delete repaired.lastError;
+            delete repaired.lastErrorCode;
+            delete repaired.attempts;
+            if (outbox.replaceIfRouteMatches(aid, entry, repaired) !== 'replaced')
                 continue;
-            logger.warn(`${this.logPrefix()} Migrated legacy bootstrap outbox route to group.send: entry=${entry.id} group=${entry.channelId}`);
+            logger.warn(`${this.logPrefix()} Repaired bootstrap outbox route to private Owner delivery: entry=${entry.id} owner=${owner}`);
         }
     }
     acknowledge(messageId) {
@@ -4673,7 +5257,7 @@ export class AUNChannel {
         catch {
             payloadObj = { text: payload };
         }
-        await this.sendStructured(channelId, payloadObj, context);
+        await this.sendStructuredOrThrow(channelId, payloadObj, context);
     }
     async disconnect() {
         this.intentionalDisconnect = true;
@@ -4839,18 +5423,6 @@ export class AUNChannel {
             return undefined; // 不写缓存，下次仍可重试
         }
     }
-    /** Query the authoritative group endpoint without guessing from an AID string. */
-    async isGroup(groupId) {
-        if (!groupId || !this.client)
-            return undefined;
-        try {
-            const result = await this.callAndTrace('group.get_info', { group_id: groupId });
-            return !!(result?.group || result?.group_id || result?.groupId);
-        }
-        catch {
-            return undefined;
-        }
-    }
     /** 统计关系键继续使用群 ID，仅为智能体预览补充可读群名。 */
     async groupStatsContext(groupId) {
         return {
@@ -4895,7 +5467,6 @@ export class AUNChannelPlugin {
         const channel = new AUNChannel({
             aid,
             keystorePath: inst.keystorePath,
-            gatewayUrl: inst.gatewayUrl,
             defaultEncrypt: ctx.aunDefaultEncrypt,
             accessToken: inst.accessToken,
             flushDelay: inst.flushDelay,
@@ -4914,6 +5485,13 @@ export class AUNChannelPlugin {
                 const delivery = requireEnvelopeDelivery(channelId, envelope?.delivery, envelope?.replyContext?.delivery);
                 const parentCausation = normalizeCausation(envelope.causation ?? envelope.replyContext?.metadata?.causation);
                 const outboundCausation = parentCausation ? deriveCausation(parentCausation) : undefined;
+                const operationId = envelope.operationId ?? envelope.taskId;
+                // A task can emit multiple independent intermediate text chunks. Keep
+                // the task operation ID in the receipt, but do not use it as the
+                // durable-send dedupe key for each non-final chunk.
+                const dedupeOperationId = payload.kind === 'result.text' && payload.isFinal === false
+                    ? undefined
+                    : operationId;
                 const replyCtx = outboundCausation
                     ? {
                         ...(envelope.replyContext ?? {}),
@@ -4934,11 +5512,61 @@ export class AUNChannelPlugin {
                     case 'result.text':
                     case 'command.result':
                     case 'command.error': {
-                        const sendCtx = { ...(replyCtx ?? {}) };
+                        const sendCtx = {
+                            ...(replyCtx ?? {}),
+                            metadata: {
+                                ...Object.fromEntries(Object.entries(replyCtx?.metadata ?? {})
+                                    .filter(([key]) => key !== 'operationId')),
+                                ...(dedupeOperationId ? { operationId: dedupeOperationId } : {}),
+                            },
+                        };
                         if (payload.kind === 'result.text' && payload.isFinal)
                             sendCtx.title = '✅ 最终回复:';
-                        await channel.sendMessage(channelId, payload.text, sendCtx);
-                        return;
+                        let result;
+                        try {
+                            result = await channel.sendMessage(channelId, payload.text, sendCtx);
+                        }
+                        catch (error) {
+                            if (error?.code !== 'OUTBOX_FULL')
+                                throw error;
+                            return {
+                                status: 'failed',
+                                operationId,
+                                messages: [],
+                                error: error instanceof Error ? error.message : String(error),
+                                code: 'OUTBOX_FULL',
+                            };
+                        }
+                        if (result.status === 'sent') {
+                            return {
+                                status: 'sent',
+                                operationId,
+                                messageId: result.messageId,
+                                messages: [{
+                                        messageId: result.messageId,
+                                        partIndex: 0,
+                                        ...(sendCtx.threadId ? { threadId: sendCtx.threadId } : {}),
+                                    }],
+                            };
+                        }
+                        if (result.status === 'queued') {
+                            return {
+                                status: 'queued',
+                                operationId,
+                                messages: [],
+                                outboxId: result.outboxId,
+                                ...(result.error !== undefined ? { error: result.error } : {}),
+                                ...(result.code !== undefined ? { code: result.code } : {}),
+                            };
+                        }
+                        return {
+                            status: 'failed',
+                            operationId,
+                            messages: [],
+                            ...(result.outboxId !== undefined ? { outboxId: result.outboxId } : {}),
+                            error: result.error,
+                            ...(result.code !== undefined ? { code: result.code } : {}),
+                        };
                     }
                     case 'system.notice': {
                         const noticePayload = {
@@ -4991,6 +5619,9 @@ export class AUNChannelPlugin {
                     }
                     case 'activity.batch': {
                         const items = Array.isArray(payload.items) ? payload.items : [];
+                        const messageIds = [];
+                        let queuedResult;
+                        let failedResult;
                         for (const item of items) {
                             if (item?.kind === 'progress') {
                                 const metadata = { activityType: 'progress' };
@@ -5006,10 +5637,51 @@ export class AUNChannelPlugin {
                                 await channel.sendThought(channelId, envelope.taskId, aunPayload, replyCtx);
                             }
                             else {
-                                await channel.sendReliableStructured(channelId, aunPayload, replyCtx, channel.activityLogText(item));
+                                const result = await channel.sendContentPayload(channelId, aunPayload, {
+                                    queue: 'activity',
+                                    contentKind: 'custom',
+                                    context: replyCtx,
+                                    logText: channel.activityLogText(item),
+                                });
+                                if (result.status === 'permanent' || result.status === 'failed')
+                                    failedResult ??= result;
+                                else if (result.status === 'retry' || result.status === 'queued' || result.queued)
+                                    queuedResult ??= result;
+                                else if (result.messageId)
+                                    messageIds.push(result.messageId);
                             }
                         }
-                        return;
+                        if (failedResult) {
+                            return {
+                                status: 'failed',
+                                operationId,
+                                messages: [],
+                                ...(failedResult.outboxId !== undefined ? { outboxId: failedResult.outboxId } : {}),
+                                error: failedResult.error ?? 'AUN activity delivery failed',
+                                ...(failedResult.code !== undefined ? { code: failedResult.code } : {}),
+                            };
+                        }
+                        if (queuedResult) {
+                            return queuedResult.outboxId
+                                ? {
+                                    status: 'queued',
+                                    operationId,
+                                    messages: [],
+                                    outboxId: queuedResult.outboxId,
+                                    ...(queuedResult.error !== undefined ? { error: queuedResult.error } : {}),
+                                    ...(queuedResult.code !== undefined ? { code: queuedResult.code } : {}),
+                                }
+                                : {
+                                    status: 'failed',
+                                    operationId,
+                                    messages: [],
+                                    error: 'queued activity is missing its outbox id',
+                                    code: 'MISSING_OUTBOX_ID',
+                                };
+                        }
+                        if (messageIds.length > 0)
+                            return sentReceipt(envelope, messageIds, replyCtx?.threadId);
+                        return suppressedReceipt(envelope, 'empty_activity');
                     }
                     case 'status.progress':
                         channel.sendProcessingStatus(channelId, 'progress', envelope.sessionId ?? envelope.taskId, envelope.taskId, replyCtx, payload.metadata);
@@ -5038,6 +5710,44 @@ export class AUNChannelPlugin {
                     case 'interaction': {
                         const req = payload.interaction;
                         const cardTtlMs = AUN_INTERACTION_CARD_TTL_MS;
+                        const cardExpiresAt = typeof req.expiresAt === 'number' && Number.isFinite(req.expiresAt)
+                            ? req.expiresAt
+                            : Date.now() + cardTtlMs;
+                        const toInteractionReceipt = (result) => {
+                            if ((result.status === undefined || result.status === 'sent') && result.messageId) {
+                                return sentReceipt(envelope, [result.messageId], replyCtx?.threadId);
+                            }
+                            if (result.status === 'retry' || result.status === 'queued' || result.queued) {
+                                if (!result.outboxId) {
+                                    return {
+                                        status: 'failed',
+                                        operationId,
+                                        messages: [],
+                                        error: 'queued interaction is missing its outbox id',
+                                        code: 'MISSING_OUTBOX_ID',
+                                    };
+                                }
+                                return {
+                                    status: 'queued',
+                                    operationId,
+                                    messages: [],
+                                    outboxId: result.outboxId,
+                                    ...(result.error !== undefined ? { error: result.error } : {}),
+                                    ...(result.code !== undefined ? { code: result.code } : {}),
+                                };
+                            }
+                            if (result.status === 'permanent' || result.status === 'failed') {
+                                return {
+                                    status: 'failed',
+                                    operationId,
+                                    messages: [],
+                                    ...(result.outboxId !== undefined ? { outboxId: result.outboxId } : {}),
+                                    error: result.error ?? 'AUN interaction delivery failed',
+                                    ...(result.code !== undefined ? { code: result.code } : {}),
+                                };
+                            }
+                            return suppressedReceipt(envelope, 'interaction_not_sent');
+                        };
                         if (req.kind.kind === 'action') {
                             const action = req.kind;
                             const aunCard = {
@@ -5061,7 +5771,7 @@ export class AUNChannelPlugin {
                                 aunCard.initiator = req.initiatorId;
                             if (replyCtx?.threadId)
                                 aunCard.thread_id = replyCtx.threadId;
-                            await channel.sendContentPayload(channelId, aunCard, {
+                            const result = await channel.sendContentPayload(channelId, aunCard, {
                                 contentKind: 'card',
                                 context: replyCtx,
                                 logText: action.title ? `[card] ${action.title}` : '[card]',
@@ -5071,9 +5781,10 @@ export class AUNChannelPlugin {
                                     isCommandCard: false,
                                     initiatorAid: req.initiatorId,
                                     delivery: replyCtx?.delivery,
-                                    expiresAt: Date.now() + cardTtlMs,
+                                    expiresAt: cardExpiresAt,
                                 },
                             });
+                            return toInteractionReceipt(result);
                         }
                         else if (req.kind.kind === 'command-card') {
                             const card = req.kind;
@@ -5099,7 +5810,7 @@ export class AUNChannelPlugin {
                                 aunCard.initiator = req.initiatorId;
                             if (replyCtx?.threadId)
                                 aunCard.thread_id = replyCtx.threadId;
-                            await channel.sendContentPayload(channelId, aunCard, {
+                            const result = await channel.sendContentPayload(channelId, aunCard, {
                                 contentKind: 'card',
                                 context: replyCtx,
                                 logText: card.title ? `[card] ${card.title}` : '[card]',
@@ -5109,14 +5820,35 @@ export class AUNChannelPlugin {
                                     isCommandCard: true,
                                     initiatorAid: req.initiatorId,
                                     delivery: replyCtx?.delivery,
-                                    expiresAt: Date.now() + cardTtlMs,
+                                    expiresAt: cardExpiresAt,
                                 },
                             });
+                            return toInteractionReceipt(result);
                         }
                         else if (payload.fallbackText) {
-                            await channel.sendMessage(channelId, payload.fallbackText, replyCtx);
+                            const result = await channel.sendMessage(channelId, payload.fallbackText, replyCtx);
+                            if (result.status === 'sent')
+                                return sentReceipt(envelope, [result.messageId], replyCtx?.threadId);
+                            if (result.status === 'queued') {
+                                return {
+                                    status: 'queued',
+                                    operationId,
+                                    messages: [],
+                                    outboxId: result.outboxId,
+                                    ...(result.error !== undefined ? { error: result.error } : {}),
+                                    ...(result.code !== undefined ? { code: result.code } : {}),
+                                };
+                            }
+                            return {
+                                status: 'failed',
+                                operationId,
+                                messages: [],
+                                ...(result.outboxId !== undefined ? { outboxId: result.outboxId } : {}),
+                                error: result.error,
+                                ...(result.code !== undefined ? { code: result.code } : {}),
+                            };
                         }
-                        return;
+                        return suppressedReceipt(envelope, 'empty_interaction');
                     }
                     case 'custom': {
                         const text = typeof payload.payload === 'string' ? payload.payload : JSON.stringify(payload.payload);
@@ -5133,7 +5865,6 @@ export class AUNChannelPlugin {
             uploadAgentMd: (content) => channel.uploadAgentMd(content),
             downloadAgentMd: (aid) => channel.downloadAgentMd(aid),
             getGroupName: (groupId) => channel.getGroupName(groupId),
-            isGroup: (groupId) => channel.isGroup(groupId),
             getGroupMemberRole: (groupId, aid) => channel.getGroupMemberRole(groupId, aid),
             _selfAid: () => channel.getStatus().aid,
             _selfName: () => channel.getSelfName(),
@@ -5160,7 +5891,7 @@ export class AUNChannelPlugin {
             registerBridge(bridge, channelType) {
                 bridge.register(adapter.channelName, (handler) => channel.onMessage(async (opts) => {
                     handler(aunOptsToInbound(opts, adapter.channelName, channelType));
-                }), (channelId, text, replyContext) => channel.sendMessage(channelId, text, replyContext), adapter, channelType);
+                }), async (channelId, text, replyContext) => { await channel.sendMessage(channelId, text, replyContext); }, adapter, channelType);
             },
             registerHooks(hookCtx) {
                 channel.setEventBus(hookCtx.eventBus);