openclaw-lark-multi-agent 1.6.0 → 1.7.0

package/README.md

@@ -626,3 +626,14 @@ This does not shorten the Gateway's execution limit. Unverified steer V2 and
 question adapters are not included in this release.
 
 Timing/API parameters and limitations: [foreground idle semantics](docs/foreground-idle-2026-09-11.md).
+
+### Independent Go Checker
+
+`/go <objective>` sets the goal, starts a dedicated tool-denied acceptance Checker,
+and submits the original objective once at a safely observed idle boundary. Initial
+and follow-up executor results use LMA’s durable body/attachment outbox with actual
+platform receipts; no extra execution message is required. `/go status`,
+`/go pause|resume|stop`, `/go model <provider/model>` control it. LMA's MessageStore
+owns objective, criteria, revision and completion, independent of native Goal APIs.
+Enable the included `lma-go` plugin first (operator-owned). Dynamic Checker binding
+is enforced before model admission. See [integration boundaries and local activation](docs/go-integration-boundaries.md).

package/README.zh-CN.md

@@ -530,3 +530,13 @@ MIT
 steer V2 与问答适配器。
 
 计时、API 参数及限制详见 [前台静默计时说明](docs/foreground-idle-2026-09-11.md)。
+
+### 独立 Go Checker
+
+`/go <目标>` 设定目标、创建专用验收 Checker，并在安全空闲边界首次提交原目标，
+无需再发一条执行消息。首次与自动跟进的执行结果统一通过 LMA 正文/附件持久化 outbox
+投递，实际飞书消息回执才成为验收证据；`/go status`、`/go pause|resume|stop`、
+`/go model <provider/model>` 控制监督。目标、验收条件、revision 和完成权由 LMA
+MessageStore 管理，不依赖或修改原生 Goal。需由操作者启用随仓库提供的 `lma-go`
+插件；动态绑定后真实禁止 Checker 全部工具。详见
+[能力边界和本机激活步骤](docs/go-integration-boundaries.md)。

package/dist/feishu-bot.d.ts

@@ -42,7 +42,18 @@ export declare class FeishuBot {
     private sendModelFooters;
     private replyStatusFooters;
     private sendStatusFooters;
+    /** Batch-scoped run-failure observers: steered inputs whose owning batch
+     * fails restore their durable fallback. Fired in processQueueInner's
+     * failure arms; dropped at each new batch top and on queue exit. */
+    private runFailureObservers;
+    /** Steered messages admitted into the CURRENT batch (per chat). Flipped to
+     * DONE when that batch completes successfully; cleared (unflipped) when the
+     * batch scope ends any other way. */
+    private admittedSteerAcks;
     /** Go / Go-Checker supervision controller (per-bot instance). */
+    private readonly goDeliveryReceipts;
+    private readonly goReceiptApis;
+    private installGoReceiptCapture;
     private goController;
     /** Per-chat durable outbox retry timer. */
     private deliveryRetryTimers;
@@ -123,6 +134,8 @@ export declare class FeishuBot {
      * Process queued messages for a chat: batch all unsynced messages and send to OpenClaw.
      * Loops until no more unsynced human messages remain.
      */
+    /** Fire and clear run-failure observers for a chat (isolated callbacks). */
+    private fireRunFailureObservers;
     private processQueue;
     private processQueueInner;
     private shouldHandleBridgeCommand;
@@ -211,6 +224,9 @@ export declare class FeishuBot {
     /** Bounded read-only diagnosis; known live tasks retain low-frequency observation. */
     private reconcileErrorNotices;
     private scheduleDeliveryRetry;
+    /** Both initial and CONTINUE results enter the same ordinary LMA outbox.
+     * No host proactive-send assumption, no fake platform receipt. */
+    private deliverGoExecutorResult;
     private dispatchPendingDeliveries;
     private hasFreeModeBot;
     private mentionedBotNames;

package/dist/feishu-bot.js

@@ -1,3 +1,4 @@
+import { AsyncLocalStorage } from "node:async_hooks";
 import * as lark from "@larksuiteoapi/node-sdk";
 import { createRequire } from "module";
 import { persistBotModel } from "./config.js";
@@ -8,6 +9,7 @@ import { LiveStatusController } from "./live-status.js";
 import { CompactProgressController } from "./compact-progress.js";
 import { GoController } from "./go-controller.js";
 import { errorIdentity } from "./terminal-errors.js";
+import { formatProviderError, safeErrorSummary } from "./provider-errors.js";
 import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "fs";
 import { basename, extname, join, resolve } from "path";
 import { getBridgeAttachmentsDir, getDataDir } from "./paths.js";
@@ -138,7 +140,96 @@ export class FeishuBot {
     sendModelFooters = new Map();
     replyStatusFooters = new Map();
     sendStatusFooters = new Map();
+    /** Batch-scoped run-failure observers: steered inputs whose owning batch
+     * fails restore their durable fallback. Fired in processQueueInner's
+     * failure arms; dropped at each new batch top and on queue exit. */
+    runFailureObservers = new Map();
+    /** Steered messages admitted into the CURRENT batch (per chat). Flipped to
+     * DONE when that batch completes successfully; cleared (unflipped) when the
+     * batch scope ends any other way. */
+    admittedSteerAcks = new Map();
     /** Go / Go-Checker supervision controller (per-bot instance). */
+    goDeliveryReceipts = new AsyncLocalStorage();
+    goReceiptApis = new WeakSet();
+    installGoReceiptCapture() {
+        const docx = this.client.docx;
+        const candidates = [
+            ...Array.from(new Set([this.client.im.message, this.client.im.v1?.message].filter(Boolean))).map(api => ({ api, operations: ["create", "reply"], visible: true })),
+            { api: this.client.im.file, operations: ["create"], visible: false },
+            { api: this.client.im.image, operations: ["create"], visible: false },
+            { api: docx?.document, operations: ["create", "convert"], visible: false },
+            { api: docx?.documentBlockDescendant, operations: ["create"], visible: false },
+        ];
+        for (const { api, operations, visible } of candidates) {
+            if (!api || this.goReceiptApis.has(api))
+                continue;
+            this.goReceiptApis.add(api);
+            for (const operation of operations) {
+                const original = api[operation]?.bind(api);
+                if (!original)
+                    continue;
+                api[operation] = async (params) => {
+                    const context = this.goDeliveryReceipts.getStore();
+                    const ordinal = context?.ordinals.get(context.stage) ?? 0;
+                    context?.ordinals.set(context.stage, ordinal + 1);
+                    const key = `outbox:${context?.outboxId}:${context?.stage}:${ordinal}`;
+                    const previous = context?.goId ? this.store.getGoDeliveryOperation(context.goId, key) : null;
+                    if (previous?.state === "rejected") {
+                        const failure = JSON.parse(previous.response_json);
+                        throw Object.assign(new Error(failure.message), { code: failure.code, response: { data: { code: failure.code, msg: failure.message } } });
+                    }
+                    if (context?.blocked || (previous && previous.state !== "accepted")) {
+                        // Carry a durable unknown fence across *all* fallback operations after
+                        // restart too, not merely the original failed card/attachment ordinal.
+                        if (context)
+                            context.blocked = true;
+                        throw new Error("Go delivery outcome unknown; original operation cannot be replayed");
+                    }
+                    let result;
+                    if (previous?.state === "accepted")
+                        result = JSON.parse(previous.response_json).result;
+                    else {
+                        if (context?.goId)
+                            this.store.recordGoDeliveryOperation(context.goId, key, "attempted");
+                        try {
+                            result = await original(params);
+                        }
+                        catch (err) {
+                            if (context?.goId) {
+                                const error = err;
+                                const code = error?.response?.data?.code ?? error?.data?.code ?? error?.code;
+                                const status = error?.response?.status;
+                                // A documented API rejection is not a lost response. Cache it so
+                                // deterministic card/text fallback can proceed without repeating it.
+                                if (Number.isFinite(Number(code)) && Number(code) > 0 || Number.isInteger(status) && status >= 400 && status < 500) {
+                                    this.store.recordGoDeliveryOperation(context.goId, key, "rejected", { code, message: error?.response?.data?.msg ?? error?.message ?? "platform rejected" });
+                                }
+                                else {
+                                    this.store.recordGoDeliveryOperation(context.goId, key, "unknown");
+                                    context.blocked = true;
+                                }
+                            }
+                            throw err;
+                        }
+                    }
+                    const id = result?.data?.message_id ?? result?.message_id;
+                    if (visible && context?.goId && !id) {
+                        this.store.recordGoDeliveryOperation(context.goId, key, "unknown");
+                        context.blocked = true;
+                        throw new Error("Missing actual Go platform message receipt");
+                    }
+                    if (context?.goId)
+                        this.store.recordGoDeliveryOperation(context.goId, key, "accepted", { result, payload: visible ? params.data : undefined, operation });
+                    if (visible && context && typeof id === "string" && id) {
+                        if (!context.receipts.some(r => r.messageId === id))
+                            context.receipts.push({ messageId: id, operation: previous?.state === "accepted" ? JSON.parse(previous.response_json).operation : operation, payload: previous?.state === "accepted" ? JSON.parse(previous.response_json).payload : params.data });
+                        context.onReceipt(); // Persist before the next chunk or attachment operation.
+                    }
+                    return result;
+                };
+            }
+        }
+    }
     goController = null;
     /** Per-chat durable outbox retry timer. */
     deliveryRetryTimers = new Map();
@@ -176,6 +267,7 @@ export class FeishuBot {
             appSecret: config.appSecret,
             appType: lark.AppType.SelfBuild,
         });
+        this.installGoReceiptCapture();
         this.wsClient = new lark.WSClient({
             appId: config.appId,
             appSecret: config.appSecret,
@@ -194,14 +286,46 @@ export class FeishuBot {
             executorSessionKeyFor: (chatId) => this.getSessionKey(chatId),
             notify: (chatId, text) => this.sendOrdered(chatId, () => this.sendMessage(chatId, text)),
             reply: (messageId, text) => this.replyMessage(messageId, text),
+            deliverExecutorResult: (chatId, result, goId) => this.deliverGoExecutorResult(chatId, result, goId),
             log: (msg) => console.log(msg),
         });
+        const unobserveGo = this.openclawClient.observeGoEvidence?.(({ channel, payload }) => {
+            const event = payload;
+            const exactKey = event?.sessionKey;
+            const sessionId = event?.sessionId;
+            const runId = event?.runId;
+            // Never infer generation or run identity from a prefix or current-session lookup.
+            if (typeof exactKey !== "string" || typeof sessionId !== "string" || typeof runId !== "string")
+                return;
+            for (const job of this.store.listActiveGoJobs(this.config.name)) {
+                if (exactKey !== job.executorSessionKey && exactKey !== `agent:main:${job.executorSessionKey}`)
+                    continue;
+                if (sessionId !== job.executorSessionId)
+                    continue;
+                const sourceKey = `${channel}:${runId}:${event.message?.id ?? event.id ?? event.seq ?? "unidentified"}`;
+                if (sourceKey.endsWith(":unidentified"))
+                    continue;
+                const message = event.message;
+                const text = message?.role === "assistant" && Array.isArray(message.content)
+                    ? message.content.filter((part) => part.type === "text").map((part) => part.text ?? "").join("\n")
+                    : event.stream === "assistant" ? (event.data?.text ?? event.data?.delta ?? "") : "";
+                const terminal = event.stream === "lifecycle" && ["end", "error"].includes(event.data?.phase);
+                if (!text && !terminal && !event.attachments?.length)
+                    continue;
+                this.store.recordGoVisibleEvidence(job.id, sourceKey, { sessionId, runId, kind: channel,
+                    text, attachments: event.attachments ?? message?.attachments ?? [] });
+                if (terminal)
+                    this.goController?.notifyRunOutcome(job.chatId, "no_reply", sourceKey, "精确 run 终局状态更新；不等于投递/验收通过");
+            }
+        });
+        this.store.onClose(() => unobserveGo?.());
         // Recovery runs shortly after boot: verify executor session generations
         // for active Go jobs and re-arm pending checks.
         const recoverTimer = setTimeout(() => {
             void this.goController?.recoverOnStartup().catch((err) => console.warn(`[${config.name}] Go recovery failed:`, err.message));
         }, 5000);
         recoverTimer.unref?.();
+        this.store.onClose(() => { clearTimeout(recoverTimer); this.goController?.dispose(); });
     }
     async handleMessageRecalled(data) {
         console.log(`[${this.config.name}] Message recalled event:`, JSON.stringify(data));
@@ -296,7 +420,7 @@ export class FeishuBot {
         catch (err) {
             // Session/model setup is authoritative. Propagate policy/capability errors
             // so the queue can notify the user and never continue on the wrong model.
-            console.warn(`[${this.config.name}] ensureSession error:`, err.message);
+            console.warn(`[${this.config.name}] ensureSession error:`, safeErrorSummary(err));
             throw err;
         }
         this.initializedSessions.add(sessionKey);
@@ -304,6 +428,11 @@ export class FeishuBot {
         this.openclawClient.setVerboseTranscriptDelivery(sessionKey, this.store.getBotVerbose(this.config.name, chatId));
         await this.openclawClient.subscribeSession(sessionKey, async (text, meta) => {
             try {
+                // The Controller owns exact Go executor finals. Streams/proactive callbacks
+                // can race collection (including after a bridge restart); never let that
+                // second path create a second body/attachment outbox owner.
+                if (meta?.runId && meta?.sessionId && this.store.ownsGoExecutorRun(this.config.name, chatId, meta.sessionKey || "", meta.sessionId, meta.runId))
+                    return;
                 let provenance = meta?.error;
                 if (!provenance && meta?.genericErrorCandidate && meta.runId && meta.sessionKey) {
                     provenance = this.store.getErrorNotice(this.config.name, chatId, errorIdentity(meta.sessionKey, meta.runId))?.provenance;
@@ -828,8 +957,16 @@ export class FeishuBot {
                         || (routing.hasTargetedMention ? routing.isCurrentBotMentioned : groupBotCount === 1);
                     if (goRoutedForMe) {
                         const goArgs = cleanText.trim().split(/\s+/).slice(1).join(" ").trim();
-                        await this.goController?.handleGoCommand(chatId, messageId, goArgs);
-                        markCommandSynced();
+                        try {
+                            const control = /^(?:status|pause|resume|stop|model)(?:\s|$)/i.test(goArgs) || !goArgs;
+                            if (!control)
+                                await this.ensureSession(chatId);
+                            await this.goController?.handleGoCommand(chatId, messageId, goArgs);
+                        }
+                        finally {
+                            markCommandSynced();
+                            this.goController?.onCommandSettled(chatId);
+                        }
                         return;
                     }
                 }
@@ -1021,6 +1158,7 @@ export class FeishuBot {
             if (!this.shouldRespond(chatType, message, isBot, chatId, routing))
                 return;
             if (!isBot && insertedId > 0) {
+                this.goController?.onHumanInput(chatId);
                 this.store.markPendingTrigger(this.config.name, chatId, insertedId);
             }
             // Track this message for reaction status updates
@@ -1078,17 +1216,68 @@ export class FeishuBot {
                 });
                 const steer = await this.openclawClient.steer(sessionKeyForSteer, steerWrapped, cleanText).catch(() => ({ status: "unavailable" }));
                 if (steer.status === "steered") {
+                    // OpenClaw 2026.9.9 no longer mirrors plugin-injected user messages as
+                    // session.message events, so the transcript-consumption observer may
+                    // never fire. Custody transfers to the active run at admission: clear
+                    // the durable trigger now (prevents the duplicate re-send after this
+                    // run ends) and arm an abnormal-end fallback that restores it.
+                    if (insertedId > 0) {
+                        // Consumption can land before admission returns (fast mirror) or
+                        // never (2026.9.9 removed mirrors); either way the message belongs
+                        // to this batch for the Get -> DONE flip.
+                        const steerAckList = this.admittedSteerAcks.get(chatId) || [];
+                        steerAckList.push({ messageId, insertedId });
+                        this.admittedSteerAcks.set(chatId, steerAckList);
+                    }
                     if (insertedId > 0 && !consumedBeforeAck) {
+                        const steerStopEpoch = this.stopEpoch.get(chatId) || 0;
+                        this.store.clearPendingTrigger(this.config.name, chatId, insertedId);
                         this.pendingSteerCleanups.set(insertedId, () => {
                             stopWatchingConsumption();
                             if ("cancelPending" in steer)
                                 steer.cancelPending?.();
                         });
+                        // The owning batch's failure restores the durable fallback. The
+                        // queue promise itself never rejects (processQueueInner isolates
+                        // errors), so failures are observed via runFailureObservers.
+                        const observers = this.runFailureObservers.get(chatId) || [];
+                        observers.push(() => {
+                            if (consumedBeforeAck)
+                                return;
+                            // A /stop during the run must not resurrect stopped input.
+                            if ((this.stopEpoch.get(chatId) || 0) !== steerStopEpoch)
+                                return;
+                            this.store.markPendingTrigger(this.config.name, chatId, insertedId);
+                            // The restored input takes the ordinary queue path: drop its
+                            // admitted-steer ack so only the new batch's DONE applies.
+                            this.admittedSteerAcks.set(chatId, (this.admittedSteerAcks.get(chatId) || []).filter((a) => a.insertedId !== insertedId));
+                            console.log(`[${this.config.name}] steer fallback restored after failed run for ${chatId.slice(-8)}: "${cleanText.substring(0, 40)}..."`);
+                            // Deferred: the current queue run is still active here; a fresh
+                            // drain must start after its finally releases the chat.
+                            setTimeout(() => { void this.processQueue(chatId).catch(() => { }); }, 0).unref?.();
+                        });
+                        this.runFailureObservers.set(chatId, observers);
+                        const owner = this.queueRuns.get(chatId);
+                        if (owner) {
+                            void owner.then(() => {
+                                // Queue ended without a batch failure: the steered input was
+                                // admitted into its batch; release the provisional correlation.
+                                stopWatchingConsumption();
+                                this.pendingSteerCleanups.delete(insertedId);
+                            }).catch(() => { });
+                        }
                     }
+                    // Custody transferred: acknowledge on Feishu immediately.
+                    void this.removeReaction(messageId, "Typing").catch(() => { });
+                    void this.addReaction(messageId, "Get").catch(() => { });
+                    const acks = this.pendingAckMessages.get(chatId) || [];
+                    for (const a of acks)
+                        if (a.messageId === messageId)
+                            a.emoji = "Get";
+                    this.pendingAckMessages.set(chatId, acks);
                     // The plugin confirmed queueing into the existing embedded run. Keep
-                    // that run's original delivery target and retain the durable trigger
-                    // until session.message proves this specific input was consumed.
-                    console.log(`[${this.config.name}] Agent busy for ${chatId.slice(-8)}, plugin steer accepted (awaiting transcript consumption): "${cleanText.substring(0, 50)}..."`);
+                    // that run's original delivery target.
+                    console.log(`[${this.config.name}] Agent busy for ${chatId.slice(-8)}, plugin steer accepted (custody transferred to active run): "${cleanText.substring(0, 50)}..."`);
                     return;
                 }
                 // Plugin missing/no active run/rejected: keep the durable trigger for
@@ -1120,7 +1309,7 @@ export class FeishuBot {
             await this.processQueue(chatId);
         }
         catch (err) {
-            console.error(`[${this.config.name}] Error:`, err);
+            console.error(`[${this.config.name}] Error:`, safeErrorSummary(err));
         }
     }
     shouldUseLiveStatus(chatId, isNativeCommandTrigger = false) {
@@ -1228,6 +1417,19 @@ export class FeishuBot {
      * Process queued messages for a chat: batch all unsynced messages and send to OpenClaw.
      * Loops until no more unsynced human messages remain.
      */
+    /** Fire and clear run-failure observers for a chat (isolated callbacks). */
+    fireRunFailureObservers(chatId) {
+        const obs = this.runFailureObservers.get(chatId);
+        if (!obs || obs.length === 0)
+            return;
+        this.runFailureObservers.delete(chatId);
+        for (const cb of obs) {
+            try {
+                cb();
+            }
+            catch { /* observer failures are isolated */ }
+        }
+    }
     async processQueue(chatId) {
         const existing = this.queueRuns.get(chatId);
         if (existing) {
@@ -1236,12 +1438,18 @@ export class FeishuBot {
         }
         const run = this.processQueueInner(chatId).finally(() => {
             this.queueRuns.delete(chatId);
+            this.runFailureObservers.delete(chatId);
+            this.admittedSteerAcks.delete(chatId);
         });
         this.queueRuns.set(chatId, run);
         return run;
     }
     async processQueueInner(chatId) {
         while (true) {
+            // A fresh batch starts: steered inputs admitted into the PREVIOUS batch
+            // completed with it (consumed or not); their failure observers are stale.
+            this.runFailureObservers.delete(chatId);
+            this.admittedSteerAcks.delete(chatId);
             const pendingMessages = this.store.getPendingTriggerMessages(this.config.name, chatId);
             const pendingTriggerIds = this.store.getPendingTriggerIds(this.config.name, chatId);
             // Only proceed if there are pending human messages that should actively trigger this bot.
@@ -1398,7 +1606,7 @@ export class FeishuBot {
                 // busy marker, report the actionable error, and retire only this batch
                 // so the chat cannot remain wedged indefinitely.
                 this.busyChats.set(chatId, 0);
-                const errorText = this.formatUserVisibleError(err);
+                const errorText = this.formatUserVisibleError(err, chatId);
                 if (lastHuman.messageId) {
                     await this.enqueueAndDispatchDelivery(chatId, "provider_error", `trigger:${triggerId}:session-setup-error`, errorText, [], lastHuman.messageId, `trigger:${triggerId}:session-setup-error`).catch(() => { });
                 }
@@ -1421,6 +1629,8 @@ export class FeishuBot {
                     ack.emoji = "Get";
                 }
             }
+            let foregroundRunId;
+            const foregroundSessionId = this.store.getActiveGoJob(this.config.name, chatId)?.executorSessionId;
             let runAcceptedByOpenClaw = false;
             let liveStatus;
             try {
@@ -1476,6 +1686,7 @@ export class FeishuBot {
                             markSubmittedBatch("send-attempt");
                         },
                         onSubmitted: (runId) => {
+                            foregroundRunId = runId;
                             runAcceptedByOpenClaw = true;
                             const target = this.activeDeliveryTargets.get(chatId);
                             if (target?.triggerId === triggerId) {
@@ -1627,7 +1838,7 @@ export class FeishuBot {
                             // Keep live status and final answer as separate messages. The final
                             // answer is created at completion time so it remains at the bottom
                             // even when the user inserted more messages during the run.
-                            await this.enqueueAndDispatchDelivery(chatId, "assistant_visible", this.deliverySourceId("visible", `${triggerId}|${(shouldReply ? visibleReply : "").trim()}|${JSON.stringify(parsedReply.attachments)}`), shouldReply ? visibleReply : "", parsedReply.attachments, lastHuman.messageId, `trigger:${triggerId}`, this.config.model);
+                            await this.enqueueAndDispatchDelivery(chatId, "assistant_visible", this.deliverySourceId("visible", `${triggerId}|${(shouldReply ? visibleReply : "").trim()}|${JSON.stringify(parsedReply.attachments)}`), shouldReply ? visibleReply : "", parsedReply.attachments, lastHuman.messageId, `trigger:${triggerId}`, this.config.model, foregroundRunId && foregroundSessionId ? { runId: foregroundRunId, sessionKey, sessionId: foregroundSessionId, final: true } : undefined);
                             await liveStatus?.complete();
                             // Mark every merged trigger as delivered so retries/restarts do
                             // not re-process any of them.
@@ -1637,7 +1848,7 @@ export class FeishuBot {
                             void this.maybeAlertHighContext(chatId);
                             // Go supervision: record the delivered final reply as evidence and
                             // arm a debounced checker round (busy gates apply inside).
-                            this.goController?.notifyRunOutcome(chatId, "assistant_reply", `trigger:${triggerId}`, shouldReply ? visibleReply : "(仅附件回复)");
+                            // Actual body/attachment receipts are recorded by dispatchPendingDeliveries.
                         }
                         catch (err) {
                             // enqueueAndDispatchDelivery already sent a user-visible delivery
@@ -1713,6 +1924,18 @@ export class FeishuBot {
                     }
                 }
                 this.pendingAckMessages.set(chatId, remainingAcks);
+                // Steered messages admitted into THIS batch were consumed with it:
+                // flip their Get → DONE alongside the batch's own triggers.
+                const admittedSteers = this.admittedSteerAcks.get(chatId) || [];
+                if (admittedSteers.length > 0) {
+                    this.admittedSteerAcks.delete(chatId);
+                    for (const s of admittedSteers) {
+                        await this.removeReaction(s.messageId, "Get").catch(() => { });
+                        await this.addReaction(s.messageId, "DONE").catch(() => { });
+                    }
+                    const acksAfter = this.pendingAckMessages.get(chatId) || [];
+                    this.pendingAckMessages.set(chatId, acksAfter.filter((a) => !admittedSteers.some((s) => a.messageId === s.messageId)));
+                }
             }
             catch (err) {
                 let pause = err instanceof SessionWaitPaused ? err : undefined;
@@ -1740,6 +1963,7 @@ export class FeishuBot {
                     break;
                 }
                 if (err instanceof InactiveRunObservation) {
+                    this.fireRunFailureObservers(chatId);
                     await liveStatus?.pauseForUnconfirmedResult(err.message).catch(() => { });
                     if (!liveStatus?.id && lastHuman.messageId)
                         await this.replyMessage(lastHuman.messageId, `ℹ️ ${err.message}`).catch(() => { });
@@ -1753,6 +1977,7 @@ export class FeishuBot {
                     break;
                 }
                 if (err instanceof UnhealthySessionError) {
+                    this.fireRunFailureObservers(chatId);
                     // stopForUnhealthySession already warned the user; mark the live
                     // status as interrupted. The user can send another message to retry
                     // without being forced through /reset.
@@ -1760,8 +1985,9 @@ export class FeishuBot {
                     console.warn(`[${this.config.name}] processQueue stopped because session became unhealthy: ${err.status}`);
                     break;
                 }
-                console.error(`[${this.config.name}] processQueue error:`, err);
-                const errorText = this.formatUserVisibleError(err);
+                console.error(`[${this.config.name}] processQueue error:`, safeErrorSummary(err));
+                this.fireRunFailureObservers(chatId);
+                const errorText = this.formatUserVisibleError(err, chatId);
                 if (lastHuman.messageId) {
                     // Error message goes through the normal delivery path; the live status
                     // is a separate message that we mark interrupted afterwards.
@@ -2020,25 +2246,10 @@ export class FeishuBot {
         const key = triggerId ? `trigger:${triggerId}:wait-paused` : `wait-paused:${notice.snapshot.checkedAt}`;
         await this.enqueueAndDispatchDelivery(chatId, "wait_paused", key, notice.message, [], messageId, key, this.config.model);
     }
-    formatUserVisibleError(err) {
+    formatUserVisibleError(err, chatId) {
         if (err instanceof SessionWaitPaused)
             return err.message;
-        const raw = err instanceof Error ? err.message : String(err);
-        let reason = raw.replace(/\s+/g, " ").trim();
-        if (/quota/i.test(reason) || /exceeded/i.test(reason)) {
-            const reset = reason.match(/reset at ([^.;]+)/i)?.[1];
-            reason = reset ? `模型/供应商额度已用尽，重置时间：${reset}` : "模型/供应商额度已用尽，请稍后重试或切换模型";
-        }
-        else if (/timeout/i.test(reason)) {
-            reason = "模型响应超时，请稍后重试";
-        }
-        else if (/schema|tool payload|rejected/i.test(reason)) {
-            reason = "模型供应商拒绝了请求格式或工具参数，需要调整模型/工具调用";
-        }
-        else if (reason.length > 220) {
-            reason = reason.slice(0, 220) + "...";
-        }
-        return `⚠️ ${this.config.name} 这次没有完成回复。\n原因：${reason}`;
+        return formatProviderError(err, this.config.name, this.config.model, this.chatLocale(chatId));
     }
     isBridgeControlReply(text) {
         const t = text.trim();
@@ -2536,7 +2747,7 @@ export class FeishuBot {
                     replyToMessageId: replyToMessageId || "",
                     deliveryMode: "send",
                     targetMessageId: "",
-                    deliveryMetaJson: "{}",
+                    deliveryMetaJson,
                 });
             }
             // Dispatch recovery/correction/supplement rows together in creation order.
@@ -2562,6 +2773,11 @@ export class FeishuBot {
         catch {
             verdict = { state: "pending", reason: "inspection_unavailable" };
         }
+        // Presentation only: leave exact-run finality, stop suppression and durable
+        // outbox keys owned by the existing verdict; no retry/model fallback here.
+        if (verdict.state === "terminal" && verdict.reason === "ordinary_gateway_error") {
+            verdict = { ...verdict, text: this.formatUserVisibleError(record.provenance.detail, record.chatId) };
+        }
         // A stop or final may have arrived during the read-only lookup.
         const latest = this.store.getErrorNotice(this.config.name, record.chatId, record.noticeId);
         if (latest?.provenance.userStop) {
@@ -2679,18 +2895,56 @@ export class FeishuBot {
         timer.unref?.();
         this.deliveryRetryTimers.set(chatId, timer);
     }
+    /** Both initial and CONTINUE results enter the same ordinary LMA outbox.
+     * No host proactive-send assumption, no fake platform receipt. */
+    async deliverGoExecutorResult(chatId, result, goId) {
+        const source = `go-run:${result.sessionId}:${result.runId}`;
+        if (result.disposition === "silent" || result.disposition === "empty") {
+            this.goController?.notifyExactRunOutcome(goId, "no_reply", source, result.disposition === "silent" ? "精确执行 run 已终局：NO_REPLY（无用户可见正文）" : "精确执行 run 已终局：terminalReply.empty（真无正文，非未确认）", result.sessionId, result.runId);
+            return;
+        }
+        const failure = result.disposition === "error";
+        const parsed = this.extractBridgeAttachments(failure ? `⚠️ Go 执行运行已确认终局错误\n原因：${result.error || "unknown"}` : result.text);
+        if (parsed.text.trim() === "NO_REPLY")
+            parsed.text = "";
+        if (!parsed.text.trim() && !parsed.attachments.length) {
+            this.goController?.notifyExactRunOutcome(goId, "no_reply", source, "精确执行 run 已终局，但解析后无正文/附件", result.sessionId, result.runId);
+            return;
+        }
+        await this.enqueueAndDispatchDelivery(chatId, failure ? "go_executor_error" : "assistant_visible", source, parsed.text.trim(), parsed.attachments, undefined, source, this.config.model, { sessionKey: result.sessionKey, sessionId: result.sessionId, runId: result.runId, final: true, goJobId: goId });
+        // Pending/rejected/unknown platform responses must not be mistaken for
+        // visible evidence. The outbox retains its own safe receipt recovery path.
+        if (this.store.getDeliveryByKey(this.config.name, chatId, source)?.status !== "delivered")
+            throw new Error("Go executor outbox delivery pending/unconfirmed");
+    }
     async dispatchPendingDeliveries(chatId, replyToMessageId) {
+        this.installGoReceiptCapture();
         let retryScheduled = false;
         while (true) {
             const pending = this.store.getPendingDeliveries(chatId, this.config.name, 50);
             if (pending.length === 0)
                 break;
             for (const item of pending) {
-                await this.sendOrdered(chatId, async () => {
+                const ownerId = JSON.parse(item.deliveryMetaJson || "{}").provenance?.goJobId;
+                const deliveryJob = ownerId ? this.store.getGoJobById(ownerId) : this.store.getActiveGoJob(this.config.name, chatId);
+                const receipts = [
+                    ...(deliveryJob ? this.store.listGoVisibleEvidence(deliveryJob.id).find(e => e.sourceKey === `outbox:${item.id}`)?.receipt?.messages ?? [] : []),
+                ];
+                await this.sendOrdered(chatId, () => this.goDeliveryReceipts.run({ receipts, goId: deliveryJob?.id, outboxId: item.id, stage: "body", ordinals: new Map(), onReceipt: () => {
+                        if (deliveryJob)
+                            this.store.recordGoDeliveryReceipt(deliveryJob.id, `outbox:${item.id}`, { messages: receipts, partial: true });
+                    } }, async () => {
                     if (!item.id || !this.store.claimDelivery(item.id))
                         return;
                     let failureStage = "text";
                     try {
+                        const job = deliveryJob;
+                        const provenance = JSON.parse(item.deliveryMetaJson || "{}").provenance;
+                        const goSource = `outbox:${item.id}`;
+                        const eligible = job && ["assistant_visible", "verbose_transcript", "run_error", "provider_error", "delayed_error", "proactive", "go_executor_error"].some(k => item.sourceType.startsWith(k));
+                        if (eligible)
+                            this.store.recordGoVisibleEvidence(job.id, goSource, { sessionId: provenance?.sessionId ?? "",
+                                runId: provenance?.runId ?? "", kind: item.sourceType, text: item.content, attachments: JSON.parse(item.attachmentsJson || "[]") });
                         const attachments = JSON.parse(item.attachmentsJson || "[]");
                         // Final text is always sent as a NEW message. Never patch it into the
                         // older live-status card: user messages inserted during the run must
@@ -2763,6 +3017,9 @@ export class FeishuBot {
                         failureStage = "attachment";
                         const cursor = Math.max(0, item.attachmentCursor || 0);
                         for (let i = cursor; i < attachments.length; i++) {
+                            const context = this.goDeliveryReceipts.getStore();
+                            if (context)
+                                context.stage = `attachment:${i}`;
                             await this.sendBridgeAttachment(chatId, attachments[i]);
                             this.store.markDeliveryAttachmentCursor(item.id, i + 1);
                         }
@@ -2777,9 +3034,23 @@ export class FeishuBot {
                             await this.patchLiveStatusDoneSummary(item.targetMessageId, meta, chatId);
                             this.store.markDeliveryCleanupPending(item.id, false);
                         }
+                        if (eligible && receipts.length) {
+                            this.store.recordGoDeliveryReceipt(job.id, goSource, { messages: receipts, outboxId: item.id });
+                            if (provenance?.runId && provenance?.sessionId === job.executorSessionId) {
+                                const kind = ["run_error", "provider_error", "delayed_error", "go_executor_error"].some(k => item.sourceType.startsWith(k)) ? "run_error" : "assistant_reply";
+                                const evidence = JSON.stringify({ text: item.content, attachments, receipt: receipts });
+                                if (ownerId)
+                                    this.goController?.notifyExactRunOutcome(job.id, kind, goSource, evidence, provenance.sessionId, provenance.runId);
+                                else
+                                    this.goController?.notifyRunOutcome(chatId, kind, goSource, evidence);
+                            }
+                        }
                         this.store.markDeliveryDelivered(item.id);
                     }
                     catch (err) {
+                        const activeJob = deliveryJob;
+                        if (activeJob && receipts.length)
+                            this.store.recordGoDeliveryReceipt(activeJob.id, `outbox:${item.id}`, { messages: receipts, partial: true });
                         if (this.isOutOfChatError(err))
                             this.markCurrentBotUnavailable(chatId, err);
                         const willRetry = this.store.retryDelivery(item.id, DELIVERY_MAX_ATTEMPTS);
@@ -2813,7 +3084,7 @@ export class FeishuBot {
                             console.warn(`[${this.config.name}] Failed to notify terminal delivery error:`, this.errorSummary(notifyErr));
                         }
                     }
-                });
+                }));
             }
             // Drain subsequent pages immediately after successful batches. If any row
             // was returned to pending, honor its backoff timer instead of hot-looping.