evolcore 0.0.35 → 0.0.36

package/dist/channels/aun.js

@@ -3,6 +3,7 @@ import { sanitizeMenuLogValue } from '../core/command/menu-protocol.js';
 import crypto from 'crypto';
 import { performance } from 'node:perf_hooks';
 import fs from 'fs';
+import { ownerResolver } from '../core/ownership/owner-resolver.js';
 import path from 'path';
 import os from 'os';
 import { logger, localTimestamp } from '../utils/logger.js';
@@ -10,9 +11,10 @@ import { LogWriter } from '../utils/log-writer.js';
 import { middleOutputModePolicy, resolveShowActivities, showActivitiesPolicy } from '../core/channel-loader.js';
 import { DEFAULT_FLUSH_DELAY_SECONDS } from '../types.js';
 import { resolvePaths, agentDir as agentDirPath, resolveRoot, channelStatePath } from '../paths.js';
+import { getAunRequestRegistry, MAX_AUN_VOLATILE_TTL_SECONDS } from '../core/message/aun-request-registry.js';
 import { saveToUploads, saveRelationAttachment, sanitizeFileName, bufferToInboundImage, safeFetch } from '../utils/media-cache.js';
 import { appendAidEvent } from '../utils/instance-registry.js';
-import { appendMessageLog, appendMessageLogStrict, buildOutboundEntry, buildInboundEntry, classifyAunPayloadForLog, findMessageLogOperationMessageId, hasMessageLogOperation } from '../core/message/message-log.js';
+import { appendMessageLog, appendMessageLogStrict, buildOutboundEntry, buildInboundEntry, classifyAunPayloadForLog, findLatestMessageLogOperation, findMessageLogOperationMessageId, hasMessageLogOperation } from '../core/message/message-log.js';
 import { createSendFileMarkerPattern } from '../core/message/file-markers.js';
 import { chatDirPath } from '../core/session/session-fs-store.js';
 import { readTopicLabel, readTopicStatus } from '../core/session/session-mapper.js';
@@ -21,6 +23,7 @@ import { appendAidLifecycle } from '../aun/aid/identity.js';
 import { getAidStore, loadClient, SLOT } from '../aun/aid/store.js';
 import { MAX_AUN_ATTACHMENT_SIZE, uploadBufferAndBuildPayload, uploadFileAndBuildPayload } from '../aun/msg/upload.js';
 import { loadAgent } from '../config-store.js';
+import { configuredOwnerList } from '../config/owner-config.js';
 import { resolveAgentLifecycle } from '../config/lifecycle.js';
 import { resolveEffective } from '../config/config-manager.js';
 import { isManagementRole } from '../config/builtin-roles.js';
@@ -42,6 +45,7 @@ import { bindPostBootstrapWelcomeOutboxSession, hasPendingPostBootstrapWelcomeOu
 import { hasMentionAll, mentionEntryAids, mentionEntryTargets, } from '../core/message/mention-schema.js';
 import { aunOutboundAttention, normalizeAunMentionEntries, parseAunAttention, withAunAttention, } from '../aun/msg/mention-schema.js';
 import { isDeliveryTarget, sameDeliveryTarget } from '../core/message/message-utils.js';
+import { isTopicThreadId } from '../core/thread/topic-id.js';
 import { sentReceipt, suppressedReceipt } from '../core/message/send-receipt.js';
 export const AUN_HANDOFF_MARKER_FIELD = '_evolcore_handoff_id';
 const AUN_INTERACTION_CARD_TTL_MS = 24 * 60 * 60 * 1000;
@@ -331,7 +335,7 @@ export function buildAunFilePayload(params) {
         text: `📎 ${params.filename} (${formatSize(params.size)})`,
         attachments: [params.attachment],
     };
-    if (params.context?.threadId)
+    if (isTopicThreadId(params.context?.threadId))
         payload.thread_id = params.context.threadId;
     if (params.context?.replyToMessageId)
         payload.ref_message_id = params.context.replyToMessageId;
@@ -469,6 +473,12 @@ export function classifyAunSendFailure(value, fallback = 'AUN send failed') {
     const retryByName = /(?:timeout|connection|rate.?limit|temporar(?:y|ily)|unavailable|network|socket)/i.test(details.name ?? '');
     const relayTargetMissing = text.includes('relay_target_not_found') || text.includes('relay target not found');
     const rpcHandlerTimeout = numericCode === -32004 && /rpc handler timeout/i.test(text);
+    // -32013 is otherwise permanent, but "client signature cert unavailable" is
+    // the gateway failing to resolve the signer's certificate while the local
+    // cert is valid and auth succeeded. It clears server-side, so keep the
+    // durable entry and retry until TTL (same idea as the SDK's transient
+    // "certificate not loaded").
+    const signatureCertUnavailable = numericCode === -32013 && /signature cert(?:ificate)? unavailable/i.test(text);
     const groupStateCode = numericCode === -33002 || numericCode === -33003;
     const groupClosed = groupStateCode && /\b(?:closed|dissolved|disbanded)\b|解散|已关闭/i.test(text);
     const groupSuspended = groupStateCode && /\bsuspend(?:ed)?\b|暂停/i.test(text);
@@ -497,7 +507,7 @@ export function classifyAunSendFailure(value, fallback = 'AUN send failed') {
     const unconfirmedDelivery = missingReceipt
         && (acceptedDispatch || ambiguousAccepted || ambiguousNoReceipt || successfulHttpWithoutReceipt);
     let status;
-    if ((AUN_PERMANENT_ERROR_CODES.has(numericCode ?? Number.NaN) && !rpcHandlerTimeout)
+    if ((AUN_PERMANENT_ERROR_CODES.has(numericCode ?? Number.NaN) && !rpcHandlerTimeout && !signatureCertUnavailable)
         || permanentByText
         || AUN_PERMANENT_STRING_CODES.has(stringCode)
         || rejectedDispatch
@@ -515,6 +525,7 @@ export function classifyAunSendFailure(value, fallback = 'AUN send failed') {
     else if (AUN_RETRYABLE_ERROR_CODES.has(numericCode ?? Number.NaN)
         || transientHttpStatus
         || rpcHandlerTimeout
+        || signatureCertUnavailable
         || AUN_RETRYABLE_STRING_CODES.has(stringCode)
         || retryByName
         || relayTargetMissing
@@ -680,7 +691,7 @@ export class AUNChannel {
     traceWriter = null;
     eventBus = null;
     queuedHandler = null;
-    /** `topic-renamed` 消费器，由 runtime 注入（见 setThreadRenameHandler）。 */
+    /** `topic.renamed` 事件消费器，由 runtime 注入（见 setThreadRenameHandler）。 */
     threadRenameHandler = null;
     groupInviteHandler;
     groupInviteConnectedHandler;
@@ -1412,19 +1423,33 @@ export class AUNChannel {
         return undefined;
     }
     /**
-     * 处理对端 `topic-renamed` 通知：校验字段后交给注入的改名消费器落索引，
+     * 处理对端 `event/topic.renamed` 通知：校验字段后交给注入的改名消费器落索引，
      * 成功后发 `thread:renamed` 让前端刷新。全程不进入 Agent 消息队列。
      * 通知是尽力而为的，任何失败只记日志，不影响后续消息处理。
      */
     applyInboundTopicRename(params) {
         const payload = params.payload && typeof params.payload === 'object' ? params.payload : null;
-        const threadId = typeof payload?.threadId === 'string' ? payload.threadId : undefined;
-        const name = this.sanitizeTopicName(payload?.topicName);
-        const nameUpdatedAt = typeof payload?.nameUpdatedAt === 'number' && Number.isFinite(payload.nameUpdatedAt)
-            ? payload.nameUpdatedAt : undefined;
+        const data = payload?.data && typeof payload.data === 'object'
+            ? payload.data : undefined;
+        // 未知 schema 只忽略业务应用，不能按聊天文本处理。
+        if (data?.schema_version !== 1) {
+            logger.debug(`${this.logPrefix()} topic.renamed ignored: schema_version=${String(data?.schema_version)}`);
+            return;
+        }
+        if (payload?.occurred_at !== undefined && data?.name_updated_at !== undefined
+            && payload.occurred_at !== data.name_updated_at) {
+            logger.debug(`${this.logPrefix()} topic.renamed ignored: occurred_at does not match name_updated_at`);
+            return;
+        }
+        const threadId = typeof payload?.thread_id === 'string' ? payload.thread_id.trim() || undefined : undefined;
+        const name = this.sanitizeTopicName(data?.name);
+        const nameUpdatedAt = typeof data?.name_updated_at === 'number' && Number.isFinite(data.name_updated_at)
+            ? data.name_updated_at : undefined;
         const applier = this.threadRenameHandler;
+        // 主话题与话题的改名是同一套逻辑，区别只在 id 形态：主话题 id（`main:<a>:<b>`）
+        // 由 applyRemoteRename 落到主会话上，不进话题索引。
         if (!applier || !threadId || !name || nameUpdatedAt === undefined || !params.peer) {
-            logger.debug(`${this.logPrefix()} topic-renamed ignored: peer=${params.peer || '<none>'} thread=${threadId || '<none>'} hasName=${!!name}`);
+            logger.debug(`${this.logPrefix()} topic.renamed ignored: peer=${params.peer || '<none>'} thread=${threadId || '<none>'} hasName=${!!name}`);
             return;
         }
         void applier({
@@ -1432,7 +1457,7 @@ export class AUNChannel {
             threadId, name, nameUpdatedAt,
         }).then(result => {
             if (!result.applied) {
-                logger.debug(`${this.logPrefix()} topic-renamed not applied (${result.reason ?? 'unknown'}): thread=${threadId}`);
+                logger.debug(`${this.logPrefix()} topic.renamed not applied (${result.reason ?? 'unknown'}): thread=${threadId}`);
                 return;
             }
             this.eventBus?.publish?.({
@@ -1444,9 +1469,9 @@ export class AUNChannel {
                 nameUpdatedAt,
                 by: params.senderAid ?? '',
             });
-            logger.info(`${this.logPrefix()} topic-renamed applied: thread=${threadId} name=${JSON.stringify(name)}`);
+            logger.info(`${this.logPrefix()} topic.renamed applied: thread=${threadId} name=${JSON.stringify(name)}`);
         }).catch(error => {
-            logger.warn(`${this.logPrefix()} topic-renamed failed: ${error instanceof Error ? error.message : String(error)}`);
+            logger.warn(`${this.logPrefix()} topic.renamed failed: ${error instanceof Error ? error.message : String(error)}`);
         });
     }
     buildGroupReplyContext(threadId, senderAid, encrypted, messageId, chatmode, topicName, groupId, label, topicStatus) {
@@ -1793,6 +1818,7 @@ export class AUNChannel {
         this.observerGroupMemberFetches.clear();
         // Clean up existing client if any
         if (this.client) {
+            ownerResolver.detachClient(this.config.aid, this.client);
             this.trace('OUT', 'client.close', { reason: 'initClient' });
             try {
                 await this.client.close();
@@ -1830,6 +1856,15 @@ export class AUNChannel {
         this.store = store;
         const client = await loadClient(store, aidName);
         this.client = client;
+        const localConfig = loadAgent(aidName);
+        ownerResolver.setAgentConfiguredOwners(aidName, configuredOwnerList(localConfig));
+        ownerResolver.attachClient(aidName, client);
+        try {
+            await this.config.onClientReady?.(client);
+        }
+        catch (error) {
+            logger.warn(`${this.logPrefix()} client-ready hook failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
         // A reconnect replaces the SDK client. Late events from the retired
         // instance must not mutate the new instance's health or message state.
         const isCurrentClient = () => this.client === client;
@@ -2099,12 +2134,13 @@ export class AUNChannel {
                 logger.warn(`${this.logPrefix()} agent config not found for ${aidName}, skipping welcome message`);
                 return false;
             }
-            const owners = Array.from(new Set(agentConfig.owners ?? []));
+            await ownerResolver.refresh(aidName);
+            const owners = ownerResolver.owners(aidName);
             if (owners.length === 0) {
                 logger.info(`${this.logPrefix()} No owner configured, skipping post-bootstrap welcome message`);
                 return false;
             }
-            this.repairBootstrapRoutes();
+            await this.repairBootstrapRoutes();
             // Bootstrap welcomes target the configured personal Owner AID. They are
             // not replies to an inbound group message, so their route is always
             // private and must not be inferred with group.get_info.
@@ -2156,7 +2192,7 @@ export class AUNChannel {
         return this.reconcilePostBootstrapWelcome();
     }
     async hasPendingPostBootstrapWelcome() {
-        this.repairBootstrapRoutes();
+        await this.repairBootstrapRoutes();
         const aid = this.config.aid.replace(/^@/, '');
         return hasPendingPostBootstrapWelcomeOutbox(aid);
     }
@@ -2189,12 +2225,13 @@ export class AUNChannel {
      * already-active agent from manufacturing another welcome message.
      */
     async reconcilePostBootstrapWelcome() {
-        this.repairBootstrapRoutes();
+        await this.repairBootstrapRoutes();
         const configuredAid = this.config.aid;
         const aid = configuredAid.startsWith('@') ? configuredAid.slice(1) : configuredAid;
         const entries = findPostBootstrapWelcomeOutbox(aid);
         const agentConfig = loadAgent(aid);
-        const owners = agentConfig?.owners ?? [];
+        await ownerResolver.refresh(aid);
+        const owners = ownerResolver.owners(aid);
         if (entries.length === 0)
             return postBootstrapWelcomeStatus(aid, owners);
         if (!agentConfig || resolveAgentLifecycle(agentConfig) !== 'active') {
@@ -2499,6 +2536,18 @@ export class AUNChannel {
             return;
         const protectedHeaders = verifiedProtectedHeaders(msg, env);
         const payload = msg.payload ?? '';
+        const responseRecord = getAunRequestRegistry().resolveIncoming({
+            selfAid: this._aid || this.config.aid,
+            fromAid,
+            messageId,
+            payload,
+        });
+        if (responseRecord) {
+            logger.info(`${this.logPrefix()} AUN request response matched: request_id=${responseRecord.requestId} mid=${messageId}`);
+            const responseLog = classifyAunPayloadForLog(payload);
+            this.appendInboundPayloadJsonl(fromAid, fromAid, messageId, !!env.encrypted, false, responseLog, undefined, receivedAt, seq);
+            return;
+        }
         if (this.managedMenuClient.accept(fromAid, payload, !!env.encrypted)) {
             return;
         }
@@ -2577,8 +2626,8 @@ export class AUNChannel {
         if (p2pPayloadType === 'text') {
             import('../utils/msg-diag.js').then(m => m.diagLog('aun_in', { aid: this.config.aid, from: fromAid, to: this.config.aid, msgId: messageId, text })).catch(() => { });
         }
-        // topic-renamed：对端话题改名通知。只更新本端话题索引，不进 Agent 队列。
-        if (p2pPayloadType === 'topic-renamed') {
+        // event.topic.renamed：对端话题改名通知。只更新本端话题索引，不进 Agent 队列。
+        if (p2pPayloadType === 'event' && payload?.event === 'topic.renamed') {
             this.applyInboundTopicRename({
                 payload, selfAid: this.config.aid, peer: fromAid, peerKind: 'private',
                 senderAid: fromAid,
@@ -2657,7 +2706,7 @@ export class AUNChannel {
         // payload 类型白名单：信号类消息（status / event / thought 等）不进 Agent
         if (p2pPayloadType && !AUNChannel.PROACTIVE_ALLOW_TYPES.has(p2pPayloadType)) {
             this.appendInboundPayloadJsonl(chatId, fromAid, messageId, msgEncrypted, false, logDescriptor, threadId, receivedAt, seq);
-            logger.info(`${this.logPrefix()} P2P dropped (type deny): type=${p2pPayloadType} from=${shortAid}(${displayName}) mid=${messageId}`);
+            logger.info(`${this.logPrefix()} P2P retained in generic inbound event stream (not Agent chat): type=${p2pPayloadType} from=${shortAid}(${displayName}) mid=${messageId}`);
             return;
         }
         const msgChatmode = (payload && typeof payload === 'object') ? payload.chatmode : undefined;
@@ -2711,13 +2760,23 @@ export class AUNChannel {
         const groupId = env.group_id ?? '';
         const senderAid = env.from ?? '';
         const payload = msg.payload ?? '';
+        const responseRecord = getAunRequestRegistry().resolveIncoming({
+            selfAid: this._aid || this.config.aid,
+            fromAid: senderAid,
+            messageId,
+            payload,
+        });
+        if (responseRecord) {
+            logger.info(`${this.logPrefix()} AUN group request response matched: request_id=${responseRecord.requestId} mid=${messageId}`);
+            return;
+        }
         const inboundType = (payload && typeof payload === 'object') ? payload.type : undefined;
         if (inboundType === 'observer.forward' || (typeof inboundType === 'string' && inboundType.startsWith('observer.inject'))) {
             logger.debug(`${this.logPrefix()} Group dropped observer control envelope: mid=${messageId}`);
             return;
         }
-        // topic-renamed：群内话题改名通知。只更新本端索引，不进 Agent 队列。
-        if (inboundType === 'topic-renamed') {
+        // event.topic.renamed：群内话题改名通知。只更新本端索引，不进 Agent 队列。
+        if (inboundType === 'event' && payload?.event === 'topic.renamed') {
             this.applyInboundTopicRename({
                 payload, selfAid: this.config.aid, peer: groupId || senderAid, peerKind: 'group',
                 senderAid,
@@ -2806,7 +2865,7 @@ export class AUNChannel {
             }
             if (payloadType && !AUNChannel.PROACTIVE_ALLOW_TYPES.has(payloadType)) {
                 this.appendInboundPayloadJsonl(groupId, senderAid, messageId, !!env.encrypted, true, logDescriptor, threadId, receivedAt, seq);
-                logger.info(`${this.logPrefix()} Group dropped (type deny): type=${payloadType} group=${groupId} sender=${senderAid} mid=${messageId}`);
+                logger.info(`${this.logPrefix()} Group payload retained in generic inbound event stream (not Agent chat): type=${payloadType} group=${groupId} sender=${senderAid} mid=${messageId}`);
                 return;
             }
         }
@@ -3271,7 +3330,7 @@ export class AUNChannel {
      * result 为 SDK message.send / group.send 的 SendResult（已 attach envelope + payload）。
      * 若对端本身是 owner，排除该 owner（不把"回复 A"转发给 A 自己）。
      */
-    forwardOutbound(result) {
+    forwardOutbound(result, outboundDebug) {
         if (!this.connected || !this.client)
             return Promise.resolve();
         const outboundType = payloadTypeForObserver(result);
@@ -3292,13 +3351,13 @@ export class AUNChannel {
         if (candidateOwners.length === 0)
             return Promise.resolve();
         if (typeof env.group_id !== 'string' || !env.group_id.trim()) {
-            this.emitForward('outbound', result, candidateOwners);
+            this.emitForward('outbound', result, candidateOwners, outboundDebug);
             return Promise.resolve();
         }
         return this.observerRecipients(candidateOwners, env)
             .then(recipientOwners => {
             if (recipientOwners.length > 0)
-                this.emitForward('outbound', result, recipientOwners);
+                this.emitForward('outbound', result, recipientOwners, outboundDebug);
         })
             .catch(error => logger.debug(`${this.logPrefix()} observer outbound recipient lookup failed: ${error}`));
     }
@@ -3306,14 +3365,17 @@ export class AUNChannel {
      * 实际投递 observer.forward 给每个 owner，使用 daemon 的全局 AUN 默认加密设置。
      * original 为 SDK 给到的原始对象（入站回调 data / 出站 SendResult），整体透传，
      * 不挑字段、不改字段——SDK 加任何字段都会自动一并转发给 owner。
+     * outboundDebug 是出站时的 payload.debug，SDK SendResult 里没有，需要从调用方透传。
      */
-    emitForward(direction, original, owners) {
+    emitForward(direction, original, owners, outboundDebug) {
         const forwardPayload = {
             type: 'observer.forward',
             direction,
             agent_aid: this.config.aid,
             original,
         };
+        if (outboundDebug)
+            forwardPayload.debug = outboundDebug;
         const encrypt = this.shouldEncrypt('observer.forward');
         for (const ownerAid of owners) {
             this.callAndTrace('message.send', { to: ownerAid, payload: forwardPayload, encrypt }, { lane: 'observer' })
@@ -3341,7 +3403,7 @@ export class AUNChannel {
         const payload = {
             type: 'observer.inject.status', id: hintId,
             target: { channel_id: target.channelId, chat_type: target.chatType,
-                ...(target.threadId ? { thread_id: target.threadId } : {}) },
+                ...(isTopicThreadId(target.threadId) ? { thread_id: target.threadId } : {}) },
             data: {
                 status,
                 hint_id: hintId,
@@ -3371,7 +3433,7 @@ export class AUNChannel {
         const requestAction = req.kind === 'reject' ? req.action : req.kind;
         const requestHintId = req.kind === 'add' ? req.id : 'targetId' in req ? req.targetId : undefined;
         const requestTarget = 'channelId' in req && req.channelId
-            ? { channel_id: req.channelId, chat_type: req.chatType ?? 'private', ...(req.threadId ? { thread_id: req.threadId } : {}) }
+            ? { channel_id: req.channelId, chat_type: req.chatType ?? 'private', ...(isTopicThreadId(req.threadId) ? { thread_id: req.threadId } : {}) }
             : undefined;
         const ackData = (status, hintId) => ({
             status,
@@ -3793,6 +3855,7 @@ export class AUNChannel {
         }
         // Force close SDK client，中断它内部的重连循环
         if (this.client) {
+            ownerResolver.detachClient(this.config.aid, this.client);
             this.trace('OUT', 'client.close', { reason: `takeover_${reason}` });
             this.client.close().catch(() => { });
             this.client = null;
@@ -3817,6 +3880,7 @@ export class AUNChannel {
                 if (gen !== this.reconnectGeneration) {
                     logger.info(`${this.logPrefix()} TS-layer reconnect (${reason}) succeeded but generation stale, closing stale client`);
                     if (this.client) {
+                        ownerResolver.detachClient(this.config.aid, this.client);
                         this.client.close().catch(() => { });
                         this.client = null;
                     }
@@ -3835,7 +3899,7 @@ export class AUNChannel {
     }
     // ── Public API (same interface as before) ───────────────────
     /**
-     * 对端发来的话题改名通知（`topic-renamed`）。由 runtime 注入，交给
+     * 对端发来的话题改名通知（`event/topic.renamed`）。由 runtime 注入，交给
      * ThreadService.applyRemoteRename 落本地索引；不进入 Agent 消息队列。
      */
     setThreadRenameHandler(handler) {
@@ -3972,7 +4036,8 @@ export class AUNChannel {
         const finalPayload = this.stripUndefinedDeep(withAunAttention({ ...payload }, context?.attention));
         if (finalPayload.thread_id === '')
             delete finalPayload.thread_id;
-        if (context?.threadId && !finalPayload.thread_id)
+        // 主话题 id（main:<a>:<b>）是本端身份，不上线；主话题的线上形态就是不带该字段。
+        if (isTopicThreadId(context?.threadId) && !finalPayload.thread_id)
             finalPayload.thread_id = context.threadId;
         if (context?.replyToMessageId && !finalPayload.ref_message_id)
             finalPayload.ref_message_id = context.replyToMessageId;
@@ -4125,6 +4190,79 @@ export class AUNChannel {
             await this.recallInteractionCard(messageId, channelId, card?.delivery);
         }
     }
+    restoreInteraction(envelope, interaction, receipt) {
+        if (interaction.kind.kind !== 'action')
+            return undefined;
+        const channelId = envelope.channelId;
+        const delivery = this.requireDelivery(channelId, envelope.replyContext, envelope.delivery);
+        const operationId = envelope.operationId ?? envelope.taskId;
+        const entries = outbox.findInteractionCards(this.config.aid, interaction.id).filter(entry => entry.channelId === channelId && isDeliveryTarget(entry.delivery)
+            && sameDeliveryTarget(entry.delivery, delivery));
+        const messageIds = new Set();
+        if (receipt?.status === 'sent' && receipt.operationId === operationId) {
+            for (const message of receipt.messages) {
+                if (message.messageId?.trim())
+                    messageIds.add(message.messageId);
+            }
+            if (receipt.messageId?.trim())
+                messageIds.add(receipt.messageId);
+        }
+        const chatDir = chatDirPath(resolvePaths().sessionsDir, 'aun', channelId, this.config.aid);
+        const loggedMessageId = findMessageLogOperationMessageId(chatDir, operationId)
+            ?? findLatestMessageLogOperation(chatDir, `${interaction.id}-`)?.messageId;
+        if (loggedMessageId)
+            messageIds.add(loggedMessageId);
+        for (const entry of entries) {
+            const messageId = entry.deliveryReceipt?.messageId ?? entry.deliveryResult?.messageId;
+            if (messageId?.trim())
+                messageIds.add(messageId);
+        }
+        if (messageIds.size > 0) {
+            for (const messageId of messageIds) {
+                this.registerCardPostSend(messageId, {
+                    type: 'register_interaction_card', requestId: interaction.id,
+                    isCommandCard: false, initiatorAid: interaction.initiatorId,
+                    expiresAt: interaction.expiresAt, delivery,
+                }, channelId, delivery, envelope.replyContext);
+            }
+            return sentReceipt(envelope, [...messageIds], envelope.replyContext?.threadId);
+        }
+        const pendingEntry = entries.find(entry => !entry.terminal && !entry.deliveryResult
+            && !entry.deliveryReceipt);
+        if (pendingEntry) {
+            const state = outbox.deliveryState(this.config.aid, pendingEntry.id);
+            if (state.status === 'queued') {
+                return {
+                    status: 'queued', operationId, messages: [], outboxId: pendingEntry.id,
+                };
+            }
+            if (state.status === 'failed') {
+                return {
+                    status: 'failed', operationId, messages: [], outboxId: pendingEntry.id,
+                    error: state.error, code: state.code,
+                };
+            }
+        }
+        const failedEntry = entries.find(entry => entry.terminal);
+        if (failedEntry?.terminal) {
+            return {
+                status: 'failed', operationId, messages: [], outboxId: failedEntry.id,
+                error: failedEntry.terminal.error, code: failedEntry.terminal.code,
+            };
+        }
+        if (receipt?.status === 'queued') {
+            const state = outbox.deliveryState(this.config.aid, receipt.outboxId);
+            if (state.status === 'queued')
+                return receipt;
+            if (state.status === 'failed') {
+                return {
+                    status: 'failed', operationId, messages: [], outboxId: receipt.outboxId,
+                    error: state.error, code: state.code,
+                };
+            }
+        }
+        return undefined;
+    }
     forgetInteractionCard(messageId, interactionId) {
         this.cardMessageIdMap.delete(messageId);
         const ids = this.interactionCardMessageIds.get(interactionId);
@@ -4225,7 +4363,7 @@ export class AUNChannel {
         const truncatedPayload = this.truncatePayloadIfNeeded(payloadWithCausationRef, label);
         const params = { payload: truncatedPayload, encrypt };
         const isMenuPayload = typeof truncatedPayload.type === 'string' && truncatedPayload.type.startsWith('menu.');
-        if (!isGroup && truncatedPayload.type === 'menu.response')
+        if (!isGroup && ['menu.response', 'menu.event'].includes(truncatedPayload.type))
             params.to_device_id = context?.toDeviceId;
         if (isMenuPayload && typeof context?.metadata?.menuClientSdkVersion === 'string') {
             params.menu_client_sdk_version = context.metadata.menuClientSdkVersion;
@@ -4419,7 +4557,7 @@ export class AUNChannel {
             base.agent_name = envelope.agentName;
         if (envelope.chatmode)
             base.chatmode = envelope.chatmode;
-        if (context?.threadId)
+        if (isTopicThreadId(context?.threadId))
             base.thread_id = context.threadId;
         if (context?.peerId)
             base.initiator = context.peerId;
@@ -4670,11 +4808,17 @@ export class AUNChannel {
             return { ok: false, error: 'payload must be an object', code: 'INVALID_PAYLOAD' };
         }
         let finalPayload;
+        const preserveRawPayload = args.rawPayload === true;
         try {
-            const validatedPayload = this.normalizeAunPayloadMentions(args.payload);
+            const validatedPayload = preserveRawPayload ? { ...args.payload } : this.normalizeAunPayloadMentions(args.payload);
             finalPayload = this.stripUndefinedDeep(validatedPayload);
-            if (finalPayload.thread_id === '')
+            if (!preserveRawPayload && finalPayload.thread_id === '')
                 delete finalPayload.thread_id;
+            // Ability call 省略 sent_at 时由 transport 在实际发送前补当前毫秒时间戳，Caller 无需自行取时间
+            if (preserveRawPayload && finalPayload.type === 'ability' && finalPayload.role === 'call'
+                && finalPayload.sent_at === undefined) {
+                finalPayload.sent_at = Date.now();
+            }
         }
         catch (e) {
             return {
@@ -4686,38 +4830,60 @@ export class AUNChannel {
         if (!this.connected || !this.client) {
             return { ok: false, error: 'AUN channel is not connected', code: 'AUN_NOT_CONNECTED' };
         }
-        const info = await this.fetchPeerInfo(args.to);
-        // 与 p2p 发送路径共用同一判定：非人类 → proactive；人类需 owner/admin 才 interactive。
-        const { chatmodeForPeerIdentity } = await import('../core/message/peer-mode.js');
-        let peerRole = null;
-        try {
-            const { resolvePeerRoleDetail } = await import('../config/peer-role-resolver.js');
-            peerRole = resolvePeerRoleDetail({
-                selfAid: this.config.aid,
-                channelKey: `aun#${this.config.aid}#main`,
-                channelType: 'aun',
-                chatType: 'private',
-                actorId: args.to,
-                conversationId: args.to,
-                peerType: info.type ?? undefined,
-            }).effectiveRole;
-        }
-        catch { /* 角色解析失败按未知处理 */ }
-        const chatmode = chatmodeForPeerIdentity({ isMachine: info.type !== 'human', type: info.type ?? undefined }, peerRole);
-        if (!finalPayload.chatmode)
+        if (args.ttl !== undefined && (!Number.isInteger(args.ttl) || args.ttl < 1 || args.ttl > MAX_AUN_VOLATILE_TTL_SECONDS)) {
+            return {
+                ok: false,
+                error: `volatile AUN ttl must be an integer from 1 through ${MAX_AUN_VOLATILE_TTL_SECONDS} seconds`,
+                code: 'INVALID_REQUEST_TTL',
+            };
+        }
+        if (preserveRawPayload && jsonUtf8Size(finalPayload) > AUN_MAX_PAYLOAD_SIZE) {
+            return {
+                ok: false,
+                error: `raw payload exceeds the ${AUN_MAX_PAYLOAD_SIZE} byte AUN payload limit`,
+                code: 'PAYLOAD_TOO_LARGE',
+            };
+        }
+        // Raw payload delivery (ability calls) is an application-level envelope:
+        // peer metadata is neither needed nor safe to inject into it.
+        const info = preserveRawPayload ? undefined : await this.fetchPeerInfo(args.to);
+        let chatmode;
+        if (info) {
+            // 与 p2p 发送路径共用同一判定：非人类 → proactive；人类需 owner/admin 才 interactive。
+            const { chatmodeForPeerIdentity } = await import('../core/message/peer-mode.js');
+            let peerRole = null;
+            try {
+                const { resolvePeerRoleDetail } = await import('../config/peer-role-resolver.js');
+                peerRole = resolvePeerRoleDetail({
+                    selfAid: this.config.aid,
+                    channelKey: `aun#${this.config.aid}#main`,
+                    channelType: 'aun',
+                    chatType: 'private',
+                    actorId: args.to,
+                    conversationId: args.to,
+                    peerType: info.type ?? undefined,
+                }).effectiveRole;
+            }
+            catch { /* 角色解析失败按未知处理 */ }
+            chatmode = chatmodeForPeerIdentity({ isMachine: info.type !== 'human', type: info.type ?? undefined }, peerRole);
+        }
+        if (chatmode && !finalPayload.chatmode)
             finalPayload.chatmode = chatmode;
-        const parentCausation = normalizeCausation(args.causation);
+        const parentCausation = preserveRawPayload ? undefined : normalizeCausation(args.causation);
         const outboundCausation = parentCausation ? deriveCausation(parentCausation) : undefined;
         const causationRef = outboundCausation ? `caus_${crypto.randomUUID().replace(/-/g, '')}` : undefined;
         if (causationRef && outboundCausation) {
             finalPayload._evolcore_causation_ref = causationRef;
             registerAunCausation(causationRef, this.config.aid, args.to, outboundCausation);
         }
+        if (args.debug)
+            finalPayload.debug = { ...args.debug, sentAt: localTimestamp() };
         const encrypt = args.encrypt ?? this.shouldEncrypt(args.to);
         const sendParams = {
             to: args.to,
-            payload: this.truncatePayloadIfNeeded(finalPayload, 'msg-send-ipc'),
+            payload: preserveRawPayload ? finalPayload : this.truncatePayloadIfNeeded(finalPayload, 'msg-send-ipc'),
             encrypt,
+            ...(args.ttl !== undefined ? { ttl: args.ttl } : {}),
         };
         try {
             const result = await this.callAndTrace('message.send', sendParams);
@@ -4733,7 +4899,7 @@ export class AUNChannel {
                     refs: { messageId, sessionId: args.log?.sessionId },
                 });
             }
-            this.forwardOutbound(result);
+            this.forwardOutbound(result, args.debug);
             let logWritten = false;
             if (args.log?.content !== undefined) {
                 const classified = classifyAunPayloadForLog(finalPayload);
@@ -4831,6 +4997,8 @@ export class AUNChannel {
             if (!this.connected || !this.client) {
                 return { ok: false, error: 'AUN channel is not connected', code: 'AUN_NOT_CONNECTED' };
             }
+            if (args.debug)
+                finalPayload.debug = { ...args.debug, sentAt: localTimestamp() };
             const encrypt = args.encrypt ?? this.shouldEncrypt(args.groupId);
             const result = await this.callAndTrace('group.send', {
                 group_id: args.groupId,
@@ -4842,7 +5010,7 @@ export class AUNChannel {
                 return { ok: false, error: `group.send returned no message_id: ${JSON.stringify(result)}`, code: 'MISSING_MESSAGE_ID' };
             }
             this.logAunSendAccepted('group.send', args.groupId, messageId, encrypt, result);
-            this.forwardOutbound(result);
+            this.forwardOutbound(result, args.debug);
             let logWritten = false;
             if (args.log?.content !== undefined) {
                 const classified = classifyAunPayloadForLog(finalPayload);
@@ -5000,7 +5168,7 @@ export class AUNChannel {
             if (extracted.length > 0)
                 payload.mentions = extracted;
         }
-        if (context?.threadId)
+        if (isTopicThreadId(context?.threadId))
             payload.thread_id = context.threadId;
         if (context?.replyToMessageId)
             payload.ref_message_id = context.replyToMessageId;
@@ -5021,6 +5189,10 @@ export class AUNChannel {
         // 诊断日志：记录 payload 构造结果（含 task_id / thread_id / chatmode）
         logger.info(`${this.logPrefix()} deliverTextEntry: channelId=${channelId} thread_id=${payload.thread_id ?? 'none'} task_id=${payload.task_id ?? 'none'} chatmode=${payload.chatmode ?? 'none'} source=${source} textLen=${finalText.length}`);
         import('../utils/msg-diag.js').then(m => m.diagLog('aun_out', { aid: this.config.aid, from: this.config.aid, to: channelId, msgId: payload.task_id ?? '', taskId: payload.task_id, text: finalText })).catch(() => { });
+        // aun_out 是发送前打点；send_ok 只在网关返回 message_id 后记录，两者差值即发送失败次数
+        const diagSendOk = (mid) => {
+            import('../utils/msg-diag.js').then(m => m.diagLog('send_ok', { aid: this.config.aid, from: this.config.aid, to: channelId, msgId: mid, taskId: payload.task_id, text: finalText })).catch(() => { });
+        };
         const isGroup = delivery.chatType === 'group';
         const targetAid = channelId;
         if (entry.deliveryReceipt) {
@@ -5073,7 +5245,7 @@ export class AUNChannel {
                         transport: this.sendReceiptFromResult(result),
                     });
                     // Observer forward: outbound (group) — 原样转发 SDK SendResult（含 envelope + payload）
-                    this.forwardOutbound(result);
+                    this.forwardOutbound(result, payload.debug);
                 }
             }
             else {
@@ -5106,6 +5278,8 @@ export class AUNChannel {
                     this.forwardOutbound(result);
                 }
             }
+            if (acceptedMessageId)
+                diagSendOk(acceptedMessageId);
             return sentOutboxResult(acceptedMessageId);
         }
         catch (e) {
@@ -5170,6 +5344,8 @@ export class AUNChannel {
                         });
                         this.forwardOutbound(result);
                     }
+                    if (acceptedMessageId)
+                        diagSendOk(acceptedMessageId);
                     return sentOutboxResult(acceptedMessageId);
                 }
                 catch (e2) {
@@ -5326,7 +5502,8 @@ export class AUNChannel {
                 from: selfAID,
                 to: channelId,
                 sessionId: context?.sessionId,
-                threadId: context?.threadId || null,
+                // 日志用本地话题身份（含主话题规范 id），线上报文仍不带主话题字段。
+                threadId: context?.localTopicId ?? (isTopicThreadId(context?.threadId) ? context.threadId : null),
                 chatType: isGroup ? 'group' : 'private',
                 groupId: isGroup ? channelId : null,
                 msgId,
@@ -5382,7 +5559,7 @@ export class AUNChannel {
             : finalPayload;
         if (payloadWithChatmode.thread_id === '')
             delete payloadWithChatmode.thread_id;
-        if (context?.threadId && !payloadWithChatmode.thread_id)
+        if (isTopicThreadId(context?.threadId) && !payloadWithChatmode.thread_id)
             payloadWithChatmode.thread_id = context.threadId;
         // Same diagnostic dictionary as text payloads (sessionId/agentSessionId/model).
         if (context?.debug)
@@ -5484,13 +5661,14 @@ export class AUNChannel {
             : this.shouldEncrypt(encryptTarget);
         if (finalPayload.thread_id === '')
             delete finalPayload.thread_id;
-        if (context?.threadId && !finalPayload.thread_id)
+        // 主话题 id（main:<a>:<b>）是本端身份，不上线；主话题的线上形态就是不带该字段。
+        if (isTopicThreadId(context?.threadId) && !finalPayload.thread_id)
             finalPayload.thread_id = context.threadId;
         if (context?.replyToMessageId && !finalPayload.ref_message_id)
             finalPayload.ref_message_id = context.replyToMessageId;
         const isMenuPayload = typeof finalPayload.type === 'string' && finalPayload.type.startsWith('menu.');
         const params = { payload: finalPayload, encrypt };
-        if (!isGroup && finalPayload.type === 'menu.response')
+        if (!isGroup && ['menu.response', 'menu.event'].includes(finalPayload.type))
             params.to_device_id = context?.toDeviceId;
         if (isMenuPayload && typeof context?.metadata?.menuClientSdkVersion === 'string') {
             params.menu_client_sdk_version = context.metadata.menuClientSdkVersion;
@@ -5932,7 +6110,7 @@ export class AUNChannel {
     async drainOutbox() {
         if (!this.connected || !this.client)
             return;
-        this.repairBootstrapRoutes();
+        await this.repairBootstrapRoutes();
         const drainQueue = async (queue) => {
             if (!outbox.hasPending(this.config.aid, queue))
                 return;
@@ -5975,9 +6153,10 @@ export class AUNChannel {
         await drainQueue('activity');
     }
     /** Repair bootstrap outbox entries to the configured personal Owner route. */
-    repairBootstrapRoutes() {
+    async repairBootstrapRoutes() {
         const aid = this.config.aid.replace(/^@/, '');
-        const owners = Array.from(new Set(loadAgent(aid)?.owners ?? []));
+        await ownerResolver.refresh(aid);
+        const owners = ownerResolver.owners(aid);
         const entries = [
             ...outbox.findByDedupePrefix(aid, bootstrapInitialMessageOperationPrefix(aid), { includeTerminal: true }),
             ...findPostBootstrapWelcomeOutbox(aid, { includeTerminal: true }),
@@ -6074,7 +6253,7 @@ export class AUNChannel {
         const metadata = metadataInput ? this.stripUndefinedDeep(metadataInput) : undefined;
         if (metadata && Object.keys(metadata).length > 0)
             statusPayload.metadata = metadata;
-        if (context?.threadId)
+        if (isTopicThreadId(context?.threadId))
             statusPayload.thread_id = context.threadId;
         if (context?.peerId)
             statusPayload.initiator = context.peerId;
@@ -6149,6 +6328,8 @@ export class AUNChannel {
         await this.sendStructuredOrThrow(channelId, payloadObj, context);
     }
     async disconnect() {
+        if (this.client)
+            ownerResolver.detachClient(this.config.aid, this.client);
         this.managedMenuClient.close();
         this.intentionalDisconnect = true;
         if (this.reconnectTimer) {
@@ -6717,6 +6898,7 @@ export class AUNChannelPlugin {
                             return suppressedReceipt(envelope, 'interaction_not_sent');
                         };
                         if (req.kind.kind === 'action') {
+                            const isAsyncQuestion = /^aq-[a-f0-9]{40}$/.test(req.id);
                             const action = req.kind;
                             const aunCard = withAunAttention({
                                 type: 'action_card',
@@ -6737,12 +6919,16 @@ export class AUNChannelPlugin {
                             }
                             if (req.initiatorId && replyCtx?.delivery?.chatType === 'group')
                                 aunCard.initiator = req.initiatorId;
-                            if (replyCtx?.threadId)
+                            if (isTopicThreadId(replyCtx?.threadId))
                                 aunCard.thread_id = replyCtx.threadId;
+                            const cardReplyContext = isAsyncQuestion
+                                ? { ...replyCtx, metadata: { ...replyCtx?.metadata, operationId } }
+                                : replyCtx;
                             const result = await channel.sendContentPayload(channelId, aunCard, {
                                 contentKind: 'card',
-                                context: replyCtx,
-                                dedupeKey: req.id.startsWith('gir-') ? operationId : undefined,
+                                context: cardReplyContext,
+                                dedupeKey: req.id.startsWith('gir-') || isAsyncQuestion ? operationId : undefined,
+                                ttl: isAsyncQuestion ? Math.max(0, cardExpiresAt - Date.now()) : undefined,
                                 logText: action.title ? `[card] ${action.title}` : '[card]',
                                 postSend: {
                                     type: 'register_interaction_card',
@@ -6777,7 +6963,7 @@ export class AUNChannelPlugin {
                             }
                             if (req.initiatorId && replyCtx?.delivery?.chatType === 'group')
                                 aunCard.initiator = req.initiatorId;
-                            if (replyCtx?.threadId)
+                            if (isTopicThreadId(replyCtx?.threadId))
                                 aunCard.thread_id = replyCtx.threadId;
                             const result = await channel.sendContentPayload(channelId, aunCard, {
                                 contentKind: 'card',
@@ -6831,6 +7017,7 @@ export class AUNChannelPlugin {
             acknowledge: (messageId) => { channel.acknowledge(messageId); return Promise.resolve(); },
             onInteraction: (cb) => { channel.interactionCallback = cb; },
             invalidateInteraction: (interactionId, reason) => channel.invalidateInteraction(interactionId, reason),
+            restoreInteraction: (envelope, interaction, receipt) => channel.restoreInteraction(envelope, interaction, receipt),
             uploadAgentMd: (content) => channel.uploadAgentMd(content),
             downloadAgentMd: (aid) => channel.downloadAgentMd(aid),
             getGroupName: (groupId) => channel.getGroupName(groupId),