openclaw-lark-multi-agent 1.8.13 → 1.8.15

package/dist/feishu-bot.js

@@ -4,10 +4,11 @@ import * as lark from "@larksuiteoapi/node-sdk";
 import { createRequire } from "module";
 import { persistBotModel } from "./config.js";
 import { getI18n, normalizeLocale } from "./i18n.js";
-import { InactiveRunObservation, AdmissionUnconfirmed } from "./openclaw-client.js";
+import { InactiveRunObservation, AdmissionUnconfirmed, CollectorStalledError } from "./openclaw-client.js";
 import { SessionWaitPaused, isWaitTimeout, normalizeSessionRuntimeStatus, formatSessionFooter, FOREGROUND_WAIT_MS } from "./session-status.js";
 import { SupersededObservation } from "./openclaw-client.js";
-import { LiveStatusController } from "./live-status.js";
+import { LiveStatusController, LiveStatusEffectRejectedError, LiveStatusEffectUnknownError } from "./live-status.js";
+import { QueuedPresentations } from "./queued-presentation.js";
 import { CompactProgressController } from "./compact-progress.js";
 import { GoController } from "./go-controller.js";
 import { errorIdentity } from "./terminal-errors.js";
@@ -17,6 +18,17 @@ import { basename, extname, join, resolve } from "path";
 import { getBridgeAttachmentsDir, getDataDir } from "./paths.js";
 import { buildFeishuCardElements } from "./markdown.js";
 import { discussionManager } from "./discussion-manager.js";
+/** Observation deadline, never a claim that the underlying SDK was cancelled. */
+export class SendDeadlineError extends Error {
+    chatId;
+    limit;
+    constructor(chatId, limit) {
+        super(`send deadline ${limit}ms exceeded for ${chatId.slice(-8)}`);
+        this.chatId = chatId;
+        this.limit = limit;
+        this.name = 'SendDeadlineError';
+    }
+}
 const nonemptyReceipt = (value) => typeof value === 'string' && !!value.trim();
 const require = createRequire(import.meta.url);
 const LMA_VERSION = require("../package.json").version;
@@ -151,18 +163,24 @@ export class FeishuBot {
      * fails restore their durable fallback. Fired in processQueueInner's
      * failure arms; dropped at each new batch top and on queue exit. */
     runFailureObservers = new Map();
-    /** Steered messages admitted into the CURRENT batch (per chat). Flipped to
-     * DONE when that batch completes successfully; cleared (unflipped) when the
-     * batch scope ends any other way. */
+    /** Ephemeral batch-scoped acceptance bookkeeping, not commitment evidence.
+     * Ending the batch only drops these handles; durable insertion custody stays
+     * accepted and must not inherit the root's DONE. */
     admittedSteerAcks = new Map();
-    /** Identity token of the CURRENT queue owner per chat. Steer acks carry
-     *  the token of the batch that admitted them; a completion path only flips
-     *  acks of its OWN batch, so a superseded inner can never DONE a newer
-     *  batch's steered inputs (2026-10-16 audit B9). */
+    /** Identity token of the CURRENT queue owner per chat. Acceptance bookkeeping
+     * carries its batch token so late old cleanup never takes a newer batch's
+     * handles (2026-10-16 audit B9); neither token proves input commitment. */
     queueRunTokens = new Map();
     /** Go / Go-Checker supervision controller (per-bot instance). */
     goDeliveryReceipts = new AsyncLocalStorage();
     goReceiptApis = new WeakSet();
+    sendEffectLeases = new AsyncLocalStorage();
+    /** A deadline releases the chat queue, NOT this exact operation's ownership. */
+    inFlightDeliveryWork = new Set();
+    assertSendEffectLease(chatId) {
+        if (this.sendEffectLeases.getStore()?.expired)
+            throw new SendDeadlineError(chatId, SEND_DEADLINE_MS);
+    }
     installGoReceiptCapture() {
         const docx = this.client.docx;
         const candidates = [
@@ -220,6 +238,7 @@ export class FeishuBot {
                             }
                         }
                         else {
+                            this.assertSendEffectLease(context?.chatId || '');
                             context?.effectGuard?.();
                             if (context)
                                 save('attempted');
@@ -302,6 +321,7 @@ export class FeishuBot {
     adminOpenId;
     locale;
     configPath;
+    queuedPresentations;
     static allBots = new Map();
     /** Chats where this bot app has actually received an event in this process. */
     static seenBotChats = new Map();
@@ -309,6 +329,8 @@ export class FeishuBot {
         this.config = config;
         this.openclawClient = openclawClient;
         this.store = store;
+        this.queuedPresentations = new QueuedPresentations(() => this.store, config.name, config.appId, (chat, replyTo) => ({ ...this.liveStatusCallbacks(chat, replyTo), warn: (message, err) => console.warn(`[${this.config.name}] ${message}:`, this.errorSummary(err)) }), chat => this.shouldUseLiveStatus(chat), chat => this.isEn(chat));
+        this.store.onClose(() => this.queuedPresentations.dispose());
         this.openclawClient.bindRecoveryStore?.(store);
         this.adminOpenId = adminOpenId || null;
         this.locale = normalizeLocale(config.locale);
@@ -504,22 +526,24 @@ export class FeishuBot {
                 if (sourceType !== "verbose_transcript" && (parsed.text.trim() || parsed.attachments.length > 0))
                     this.cancelDelayedFailure(chatId);
                 const persistedTarget = meta?.runId ? this.store.getDeliveryRunTarget(this.config.name, chatId, meta.runId) : null;
-                const runTarget = meta?.runId ? this.deliveryTargetsByRun.get(this.deliveryRunTargetKey(chatId, meta.runId)) || (persistedTarget ? { ...persistedTarget, token: Symbol(meta.runId) } : undefined) : undefined;
+                const runTarget = meta?.runId ? this.deliveryTargetsByRun.get(this.deliveryRunTargetKey(chatId, meta.runId)) || (persistedTarget && persistedTarget.stopGeneration === this.stopGeneration(chatId) ? { ...persistedTarget, liveStatus: this.presentation(() => this.queuedPresentations.forRun(chatId, meta.runId)), token: Symbol(meta.runId) } : undefined) : undefined;
                 const candidateTarget = this.activeDeliveryTargets.get(chatId);
-                const activeTarget = runTarget || (candidateTarget && (!candidateTarget.runId || !meta?.runId || candidateTarget.runId === meta.runId)
+                const activeTarget = runTarget || (candidateTarget && !!candidateTarget.runId && !!meta?.runId && candidateTarget.runId === meta.runId
                     ? candidateTarget
                     : undefined);
                 try {
-                    await this.enqueueAndDispatchDelivery(chatId, sourceType, this.deliverySourceId(sourceType === "verbose_transcript" ? "verbose" : "proactive", `${Date.now()}:${Math.random()}:${parsed.text.trim()}|${JSON.stringify(parsed.attachments)}`), parsed.text.trim(), parsed.attachments, activeTarget?.messageId, activeTarget ? `trigger:${activeTarget.triggerId}` : undefined, sourceType === "verbose_transcript" ? undefined : this.config.model, meta);
-                    if (sourceType !== "verbose_transcript" && (parsed.text.trim() || parsed.attachments.length > 0)) {
-                        await activeTarget?.liveStatus?.complete().catch(() => { });
+                    const outcome = await this.enqueueAndDispatchDelivery(chatId, sourceType, this.deliverySourceId(sourceType === "verbose_transcript" ? "verbose" : "proactive", `${Date.now()}:${Math.random()}:${parsed.text.trim()}|${JSON.stringify(parsed.attachments)}`), parsed.text.trim(), parsed.attachments, activeTarget?.messageId, activeTarget ? `trigger:${activeTarget.triggerId}` : undefined, sourceType === "verbose_transcript" ? undefined : this.config.model, meta);
+                    if (outcome.state === "delivered" && sourceType !== "verbose_transcript" && (parsed.text.trim() || parsed.attachments.length > 0)) {
+                        await (meta?.runId ? this.presentation(() => this.queuedPresentations.forTarget(chatId, meta.runId, activeTarget?.liveStatus)) : undefined)?.complete().catch(() => { });
+                        if (meta?.runId)
+                            await this.queuedPresentations.settleRun(chatId, meta.runId).catch(() => { });
                         if (meta?.runId && runTarget)
                             this.releaseRunDeliveryTargetAfter(chatId, meta.runId, 30_000);
                     }
                 }
                 catch (err) {
-                    if (sourceType !== "verbose_transcript")
-                        await activeTarget?.liveStatus?.fail().catch(() => { });
+                    if (sourceType !== "verbose_transcript" && meta?.runId)
+                        await this.presentation(() => this.queuedPresentations.forTarget(chatId, meta.runId, activeTarget?.liveStatus))?.fail().catch(() => { });
                     throw err;
                 }
             }
@@ -529,10 +553,13 @@ export class FeishuBot {
         }, async (meta) => {
             if (!meta.runId || this.store.isStoppedObservation(`agent:main:${sessionKey.replace(/^agent:[^:]+:/, '')}`, meta.runId))
                 return;
+            if (this.store.hasUnconfirmedRunDelivery(this.config.name, chatId, meta.runId))
+                return;
             this.store.settleRunReactionIntents(this.config.name, chatId, meta.runId);
             void this.reconcileReactions(chatId).catch(() => { });
             const target = this.deliveryTargetsByRun.get(this.deliveryRunTargetKey(chatId, meta.runId));
-            await target?.liveStatus?.complete().catch(() => { });
+            await (target?.liveStatus || this.presentation(() => this.queuedPresentations.forRun(chatId, meta.runId)))?.complete().catch(() => { });
+            await this.queuedPresentations.settleRun(chatId, meta.runId).catch(() => { });
             this.releaseRunDeliveryTargetAfter(chatId, meta.runId, 30_000);
         });
         // Subscribe to tool events for verbose mode
@@ -1225,6 +1252,10 @@ export class FeishuBot {
             if (!isBot && insertedId > 0) {
                 this.goController?.onHumanInput(chatId);
                 this.store.markPendingTrigger(this.config.name, chatId, insertedId);
+                // No health/setup/model/history await precedes this honest local receipt.
+                // UI custody cannot reserve dispatch or claim Gateway/model acceptance.
+                const presentationRoot = this.queueOwners.get(chatId)?.runId || this.store.getDispatchCustody(this.config.name, chatId)?.runId;
+                this.presentation(() => this.queuedPresentations.receive(chatId, insertedId, messageId, isNativeOpenClawCommand, presentationRoot));
                 // Reserve BEFORE the first health/reaction await. Otherwise an ending
                 // owner can ordinary-drain this row while its handler is still waiting,
                 // and the later steer would submit the same message a second time.
@@ -1364,21 +1395,34 @@ export class FeishuBot {
             return;
         }
         const identified = compatible && !!activity.activeRunId && !!activity.sessionId && !activity.archived && !status.archived;
+        // A4 (2026-10-17 protocol audit): positive blockers are gateway assertions,
+        // not unknown states. An archived session, an incompatible session
+        // generation, or confirmed busy-without-injectable-owner each positively
+        // forbids fresh ordinary admission, so the bounded fallback below must
+        // never hand such an input to the ordinary queue; it stays retained.
+        const archived = !!status.archived || !!activity.archived;
+        const generationConflict = !!activity.sessionId && !!status.sessionId && activity.sessionId !== status.sessionId;
+        const positivelyBusy = activity.busyConfirmed === true;
         // Bounded retention (2026-10-17 deadlock): an input that has stayed
         // activity-unbound for over 60s despite re-checks must not be held forever.
         // Hand it to the ordinary queue — the gateway's own chat.send admission is
-        // the authoritative answer and admission custody already dedups.
+        // the authoritative answer and admission custody already dedups. This
+        // rescue is reserved for GENUINELY unknown states; positive blockers are
+        // excluded above and keep the never-attempted input retained.
         const unboundSince = current?.activityUnbound ? (current.unboundSince || 0) : 0;
-        if (!identified && unboundSince && Date.now() - unboundSince > 60_000) {
+        if (!identified && !archived && !generationConflict && !positivelyBusy && unboundSince && Date.now() - unboundSince > 60_000) {
             this.store.saveInsertion(this.config.name, chatId, rowId, current.insertionId, 'ordinary', { ...current, activityUnbound: false, reason: 'gateway state unconfirmable over 60s; ordinary admission is authoritative' });
             return;
         }
+        const blockerReason = archived ? 'retained: archived (gateway positively reported archived session; 60s ordinary fallback suppressed)'
+            : generationConflict ? 'retained: generation-conflict (activity session generation differs from runtime status; 60s ordinary fallback suppressed)'
+                : positivelyBusy ? 'retained: positively-busy (gateway confirmed busy without an injectable owner; 60s ordinary fallback suppressed)' : '';
         this.store.saveInsertion(this.config.name, chatId, rowId, current?.insertionId || JSON.stringify([this.config.appId, chatId, messageId]), 'pending', {
             messageId, text, stopEpoch: epoch, sessionKey: this.getSessionKey(chatId), sessionId: identified ? activity.sessionId : status.sessionId,
             expectedRunId: identified ? activity.activeRunId : '', ownerId: identified ? `external:${activity.activeRunId}` : undefined,
             batchId: identified ? activity.activeRunId : undefined, activityUnbound: !identified, attempted: false,
             ...(identified ? {} : { unboundSince: unboundSince || Date.now() }),
-            reason: identified ? 'current Gateway run observed; insertion custody only' : 'current Gateway activity/run identity unavailable; retained without admission',
+            reason: identified ? 'current Gateway run observed; insertion custody only' : (blockerReason || 'current Gateway activity/run identity unavailable; retained without admission'),
         }, Date.now() + (identified ? 0 : 5000));
     }
     /** CAS includes the actual batch, not merely the queue Promise, and excludes
@@ -1410,11 +1454,22 @@ export class FeishuBot {
             this.forceExpireQueueOwner(chatId, 'current session confirmed schedulable; exact result observation retained');
         return true;
     }
+    presentation(work) {
+        try {
+            return work();
+        }
+        catch (err) {
+            console.warn(`[${this.config.name}] presentation unavailable; business custody unchanged:`, this.errorSummary(err));
+            return undefined;
+        }
+    }
     stopGeneration(chatId) {
         return this.stopEpoch.get(chatId) ?? this.store.getStopGeneration(this.config.name, chatId);
     }
     reactionChecks = new Set();
     async receiptReaction(chatId, rowId, messageId, desired, runId = '') {
+        if (desired === 'DONE' && !this.store.isOrdinaryInput(this.config.name, chatId, rowId))
+            return;
         const previous = this.store.getReactionIntent(this.config.name, chatId, rowId);
         const record = { ...previous, messageId, desired, shown: previous?.shown || '', runId: runId || previous?.runId || '', stopEpoch: this.stopGeneration(chatId) };
         this.store.setReactionIntent(this.config.name, chatId, rowId, record);
@@ -1533,20 +1588,20 @@ export class FeishuBot {
                 item.sessionId = sessionId;
                 if (item.state === 'accepted') {
                     this.store.clearPendingTrigger(this.config.name, chatId, item.rowId);
+                    void this.queuedPresentations.insertionAccepted(chatId, item.rowId, item.expectedRunId).catch(() => { });
                     const reaction = this.store.getReactionIntent(this.config.name, chatId, item.rowId);
                     if (!reaction || reaction.desired === 'Typing')
                         await this.receiptReaction(chatId, item.rowId, item.messageId, 'Get', item.expectedRunId);
                     if (!stillCurrent())
                         continue;
-                    const settled = await this.openclawClient.exactRunSettled?.(item.expectedRunId);
+                    await this.openclawClient.exactRunSettled?.(item.expectedRunId);
                     if (!stillCurrent())
                         continue;
-                    if (settled) {
-                        this.store.saveInsertion(this.config.name, chatId, item.rowId, item.insertionId, 'committed', item);
-                        await this.receiptReaction(chatId, item.rowId, item.messageId, 'DONE', item.expectedRunId);
-                    }
-                    else
-                        this.store.saveInsertion(this.config.name, chatId, item.rowId, item.insertionId, 'accepted', item, Date.now() + 60_000);
+                    // Boolean queue acceptance + expected root settlement (including
+                    // error/timeout) cannot establish this exact input's commitment,
+                    // actual receiver, consumption, or result. Keep Get and no-replay
+                    // custody, with paced observation. Do not invent a host input ID.
+                    this.store.saveInsertion(this.config.name, chatId, item.rowId, item.insertionId, 'accepted', item, Date.now() + 60_000);
                     continue;
                 }
                 const batchAtCheck = owner?.batch, runAtCheck = owner?.runId;
@@ -1589,6 +1644,21 @@ export class FeishuBot {
                     }
                     else if (state === 'target_ended')
                         state = 'pending';
+                    else if (state === 'pending') {
+                        // Safe recovery for a NON-INSERTABLE target (audit P1 #2
+                        // 2026-10-17): this branch only runs for EXPLICIT no-effect
+                        // receipts (attempted===false, definitively not inserted — the
+                        // outer guard). If the exact target run has settled, or the
+                        // target has refused insertion for over 60s (e.g. a long-lived
+                        // maintenance run), hand the input to the ordinary queue: the
+                        // gateway queues it behind whatever currently holds the session
+                        // instead of parking it in bridge-side limbo forever. Unknown
+                        // receipts never enter this branch and are never replayed.
+                        const boundSince = Number.isFinite(item.boundSince) ? item.boundSince : Date.now();
+                        item.boundSince = boundSince;
+                        if (originalRunEnded || Date.now() - boundSince > 60_000)
+                            state = 'ordinary';
+                    }
                 }
                 if (state === 'target_ended')
                     state = 'rejected'; // prior explicit backend refusal; never silently move it to a successor
@@ -1613,6 +1683,7 @@ export class FeishuBot {
                     // Durable acceptance drives Get, including after bridge restart when
                     // its ephemeral pendingAckMessages array no longer exists.
                     await this.receiptReaction(chatId, item.rowId, item.messageId, 'Get', item.expectedRunId);
+                    void this.queuedPresentations.insertionAccepted(chatId, item.rowId, item.expectedRunId).catch(err => console.warn('insertion presentation checkpoint failed', this.errorSummary(err)));
                     if (!stillCurrent())
                         continue;
                     const ack = (this.pendingAckMessages.get(chatId) || []).find(a => a.rowId === item.rowId);
@@ -1868,11 +1939,12 @@ export class FeishuBot {
             owner.runId = undefined;
             owner.admitted = false;
             owner.collecting = false;
+            owner.observationDetached = false;
             owner.yielded = false;
             owner.sessionId = undefined;
             this.queueRunTokens.set(chatId, batchToken);
-            // A fresh batch starts: steered inputs admitted into the PREVIOUS batch
-            // completed with it (consumed or not); their failure observers are stale.
+            // A fresh batch starts: previous ephemeral handles are stale. Accepted
+            // insertions remain durable/unconfirmed, NOT completed with that batch.
             this.runFailureObservers.delete(chatId);
             this.admittedSteerAcks.delete(chatId);
             const pendingMessages = this.store.getPendingTriggerMessages(this.config.name, chatId);
@@ -2023,6 +2095,11 @@ export class FeishuBot {
             }
             const processedMessages = [...contextMsgs, ...mergedTriggers].filter((m) => m.id);
             const queueStartedAt = Date.now();
+            // Recovery/drain has no ingress handler: establish the same local-only
+            // queued presentation before ensureSession or metadata RPCs as well.
+            if (!isNativeCommandTrigger)
+                this.presentation(() => this.queuedPresentations.receive(chatId, triggerId, lastHuman.messageId || "", false));
+            const liveStatus = this.presentation(() => this.queuedPresentations.claim(chatId, mergedTriggerIds, owner.id, owner.batchId, isNativeCommandTrigger));
             let sessionKey;
             try {
                 sessionKey = await this.ensureSession(chatId);
@@ -2034,6 +2111,7 @@ export class FeishuBot {
             catch (err) {
                 if (!current())
                     break;
+                await liveStatus?.pauseForUnconfirmedResult(this.isEn(chatId) ? "Session setup failed before admission" : "会话准备失败，尚未提交 Gateway", this.isEn(chatId) ? `${this.config.name} setup unavailable` : `${this.config.name} 会话准备未完成`).catch(() => { });
                 // Model policy/capability failures happen before chat.send. Clear the
                 // busy marker, report the actionable error, and retire only this batch
                 // so the chat cannot remain wedged indefinitely.
@@ -2054,9 +2132,9 @@ export class FeishuBot {
             }
             console.log(`[${this.config.name}] Sending ${mergedTriggers.length} trigger(s) as 1 run to OpenClaw for ${chatId.slice(-8)} (context=${contextMsgs.length}, dropped=${droppedTriggerIds.length})`);
             let foregroundRunId;
+            let initialPresentationRunId;
             const foregroundSessionId = this.store.getActiveGoJob(this.config.name, chatId)?.executorSessionId;
             let runAcceptedByOpenClaw = false;
-            let liveStatus;
             try {
                 const releaseActiveDeliveryTarget = lastHuman.messageId ? this.setActiveDeliveryTarget(chatId, triggerId, lastHuman.messageId) : () => { };
                 let reply;
@@ -2075,20 +2153,13 @@ export class FeishuBot {
                         currentMarkedSubmitted = true;
                     }
                 };
-                liveStatus = this.shouldUseLiveStatus(chatId, isNativeCommandTrigger)
-                    ? new LiveStatusController({
-                        create: (view) => this.sendOrdered(chatId, () => this.replyLiveStatusCard(lastHuman.messageId || "", view, chatId)),
-                        edit: (messageId, view) => this.sendOrdered(chatId, () => this.patchLiveStatusCard(messageId, view, chatId)),
-                        warn: (message, err) => console.warn(`[${this.config.name}] ${message}:`, this.errorSummary(err)),
-                    }, {
-                        botName: this.config.name,
-                        model: this.config.model,
-                        thinkingLevel: await this.fetchThinkingLabel(sessionKey),
-                        locale: this.isEn(chatId) ? "en" : "zh",
-                    })
-                    : undefined;
                 guard();
-                liveStatus?.start(this.isEn(chatId) ? "waiting for OpenClaw" : "等待 OpenClaw 回复");
+                // Metadata is decoration, never a reason to postpone receipt/admission.
+                if (liveStatus)
+                    void this.fetchThinkingLabel(sessionKey).then(thinking => {
+                        if (current())
+                            liveStatus?.setMetadata(this.config.model, thinking);
+                    }).catch(() => { });
                 const activeTargetForStatus = this.activeDeliveryTargets.get(chatId);
                 if (activeTargetForStatus?.triggerId === triggerId && liveStatus)
                     activeTargetForStatus.liveStatus = liveStatus;
@@ -2106,6 +2177,7 @@ export class FeishuBot {
                         includeBridgeAttachmentHint: !isNativeCommandTrigger,
                         onSendAttempt: (submissionId) => {
                             guard();
+                            this.presentation(() => this.queuedPresentations.attempted(liveStatus, submissionId, owner.id, owner.batchId));
                             if (submissionId && lastHuman.messageId) {
                                 this.store.bindDeliveryRun(this.config.name, chatId, submissionId, { triggerId, triggerIds: mergedTriggerIds, messageId: lastHuman.messageId, runId: submissionId, stopGeneration: this.stopGeneration(chatId) });
                                 for (const ack of this.pendingAckMessages.get(chatId) || [])
@@ -2122,6 +2194,8 @@ export class FeishuBot {
                             guard();
                             owner.runId = runId;
                             owner.admitted = true;
+                            initialPresentationRunId = runId;
+                            void this.queuedPresentations.admit(liveStatus, runId, owner.id, owner.batchId).catch(err => console.warn("queued presentation ACK checkpoint failed", this.errorSummary(err)));
                             this.store.saveDispatchCustody(this.config.name, chatId, { id: owner.id, batchId: owner.batchId, runId, sessionId: owner.sessionId, admitted: true, stopEpoch: owner.stopEpoch, sessionKey });
                             void this.reconcileInsertions(chatId).catch(() => { });
                             this.bindRunDeliveryTarget(chatId, runId, { triggerId, messageId: lastHuman.messageId || '', liveStatus });
@@ -2146,7 +2220,7 @@ export class FeishuBot {
                             // INSERT OR IGNORE in message_sync.
                             markSubmittedBatch(`submitted:${runId}`);
                         },
-                        onProgress: (event) => current() ? liveStatus?.progress(event) : undefined,
+                        onProgress: (event) => current() && runAcceptedByOpenClaw && !!initialPresentationRunId && owner.runId === initialPresentationRunId ? liveStatus?.progress(event) : undefined,
                         onCollectionStarted: runId => { guard(); if (owner.runId === runId)
                             owner.collecting = true; },
                         onYieldHandoff: runId => {
@@ -2205,7 +2279,7 @@ export class FeishuBot {
                         guard();
                         this.store.bindDeliveryRun(this.config.name, chatId, submissionId, { triggerId, messageId: lastHuman.messageId || '', runId: submissionId, stopGeneration: this.stopGeneration(chatId), sessionKey: `agent:main:${sessionKey.replace(/^agent:[^:]+:/, '')}` });
                     },
-                    onSubmitted: async (runId) => { guard(); owner.runId = runId; foregroundRunId = runId; this.bindRunDeliveryTarget(chatId, runId, { triggerId, messageId: lastHuman.messageId || "", liveStatus }); },
+                    onSubmitted: async (runId) => { guard(); const previousRoot = owner.runId; owner.runId = runId; foregroundRunId = runId; void this.queuedPresentations.advance(liveStatus, previousRoot, runId, owner.id, owner.batchId).catch(() => { }); this.bindRunDeliveryTarget(chatId, runId, { triggerId, messageId: lastHuman.messageId || "", liveStatus }); },
                 });
                 guard();
                 const parsedReply = this.extractBridgeAttachments(reply);
@@ -2231,21 +2305,12 @@ export class FeishuBot {
                         console.log(`[${this.config.name}] Empty-final cleanup skipped; trigger ${triggerId} already has an answer delivery`);
                     }
                     else {
-                        await liveStatus?.noReply().catch(() => { });
+                        await liveStatus?.pauseForUnconfirmedResult("尚未确认最终回复，保留原运行结果观察").catch(() => { });
                     }
                     console.warn(`[${this.config.name}] Empty reply for ${chatId.slice(-8)} trigger=${triggerId}; not replaying submitted message(s)`);
-                    const pendingAcks = this.pendingAckMessages.get(chatId) || [];
-                    const remainingAcks = [];
-                    for (const ack of pendingAcks) {
-                        if (completedTriggerIdSet.has(ack.rowId)) {
-                            await this.receiptReaction(chatId, ack.rowId, ack.messageId, 'DONE', foregroundRunId || owner.runId);
-                        }
-                        else {
-                            remainingAcks.push(ack);
-                        }
-                    }
-                    guard();
-                    this.pendingAckMessages.set(chatId, remainingAcks);
+                    // Bare empty text carries no attributable terminal disposition. Exact
+                    // silent/empty outcomes use NO_REPLY or the exact settlement callback.
+                    // Retain acceptance reactions; neither a timeout nor empty string is DONE.
                     break;
                 }
                 // Mark current triggers only after the run produced a non-empty result.
@@ -2267,6 +2332,9 @@ export class FeishuBot {
                     this.store.clearPendingTrigger(this.config.name, chatId, id);
                 const shouldReply = trimmedReply.length > 0 && !explicitNoReply;
                 const isRuntimeFailure = shouldReply && this.isRuntimeFailureText(trimmedReply);
+                const ownedVisibleDelivery = this.store.getDeliveryByKey(this.config.name, chatId, `trigger:${triggerId}`);
+                let visibleOutcomeConfirmed = explicitNoReply && !hasAttachments && (!ownedVisibleDelivery ||
+                    this.store.getDeliveryDispatchOutcome(this.config.name, chatId, `trigger:${triggerId}`).state === 'delivered');
                 // Receipt-aware dispatcher owns all shared assistant context rows.
                 // Wait for all pending tool event messages to be delivered first
                 const toolSends = this.pendingToolSends.get(chatId) || [];
@@ -2280,6 +2348,7 @@ export class FeishuBot {
                 if ((shouldReply || hasAttachments) && lastHuman.messageId && !isRuntimeFailure) {
                     if (triggerId && this.store.hasDeliveredReply(this.config.name, chatId, triggerId)) {
                         console.warn(`[${this.config.name}] Reply already delivered, skip duplicate for ${chatId.slice(-8)} msgId=${triggerId}`);
+                        visibleOutcomeConfirmed = true;
                         await liveStatus?.complete().catch(() => { });
                     }
                     else {
@@ -2287,14 +2356,18 @@ export class FeishuBot {
                             // Keep live status and final answer as separate messages. The final
                             // answer is created at completion time so it remains at the bottom
                             // even when the user inserted more messages during the run.
-                            await this.enqueueAndDispatchDelivery(chatId, "assistant_visible", this.deliverySourceId("visible", `${triggerId}|${(shouldReply ? visibleReply : "").trim()}|${JSON.stringify(parsedReply.attachments)}`), shouldReply ? visibleReply : "", parsedReply.attachments, lastHuman.messageId, `trigger:${triggerId}`, this.config.model, foregroundRunId ? { runId: foregroundRunId, sessionKey, ...(foregroundSessionId ? { sessionId: foregroundSessionId } : {}), final: true } : undefined);
-                            await liveStatus?.complete();
-                            // Mark every merged trigger as delivered so retries/restarts do
-                            // not re-process any of them.
-                            for (const id of mergedTriggerIds)
-                                this.store.markDeliveredReply(this.config.name, chatId, id, lastHuman.messageId);
-                            // After a successful reply, warn the user once if context is high.
-                            void this.maybeAlertHighContext(chatId);
+                            const outcome = await this.enqueueAndDispatchDelivery(chatId, "assistant_visible", this.deliverySourceId("visible", `${triggerId}|${(shouldReply ? visibleReply : "").trim()}|${JSON.stringify(parsedReply.attachments)}`), shouldReply ? visibleReply : "", parsedReply.attachments, lastHuman.messageId, `trigger:${triggerId}`, this.config.model, foregroundRunId ? { runId: foregroundRunId, sessionKey, ...(foregroundSessionId ? { sessionId: foregroundSessionId } : {}), final: true } : undefined, undefined, mergedTriggerIds);
+                            visibleOutcomeConfirmed = outcome.state === 'delivered';
+                            if (!visibleOutcomeConfirmed) {
+                                await liveStatus?.pauseForUnconfirmedResult("飞书投递回执尚未确认；保留原投递保管，不重复发送").catch(() => { });
+                            }
+                            else {
+                                await liveStatus?.complete();
+                                // Mark every merged trigger only after receipt confirmation.
+                                for (const id of mergedTriggerIds)
+                                    this.store.markDeliveredReply(this.config.name, chatId, id, lastHuman.messageId);
+                                void this.maybeAlertHighContext(chatId);
+                            }
                             // Go supervision: record the delivered final reply as evidence and
                             // arm a debounced checker round (busy gates apply inside).
                             // Actual body/attachment receipts are recorded by dispatchPendingDeliveries.
@@ -2365,7 +2438,7 @@ export class FeishuBot {
                 const pendingAcks = this.pendingAckMessages.get(chatId) || [];
                 const remainingAcks = [];
                 for (const ack of pendingAcks) {
-                    if (completedTriggerIdSet.has(ack.rowId)) {
+                    if (visibleOutcomeConfirmed && completedTriggerIdSet.has(ack.rowId)) {
                         guard();
                         await this.receiptReaction(chatId, ack.rowId, ack.messageId, 'DONE', foregroundRunId || owner.runId);
                     }
@@ -2375,29 +2448,15 @@ export class FeishuBot {
                 }
                 guard();
                 this.pendingAckMessages.set(chatId, remainingAcks);
-                // Steered messages admitted into THIS batch were consumed with it:
-                // flip their Get → DONE alongside the batch's own triggers.
-                // B9 (2026-10-16 audit): flip only THIS batch's admitted steer acks. A
-                // superseded inner completing late must never DONE a newer batch's
-                // steered inputs — foreign acks stay for their owning batch.
+                // Root success and Feishu receipts cover ordinary triggers only. The
+                // legacy SDK acknowledged enqueue, not per-input commitment. B9 still
+                // fences cleanup by batch; durable accepted/Get custody remains held.
                 const allSteers = this.admittedSteerAcks.get(chatId) || [];
-                const admittedSteers = allSteers.filter((s) => s.batch === batchToken);
                 if (allSteers.length > 0) {
                     this.admittedSteerAcks.set(chatId, allSteers.filter((s) => s.batch !== batchToken));
                 }
-                if (admittedSteers.length > 0) {
-                    for (const s of admittedSteers) {
-                        guard();
-                        const custody = this.store.getInsertion(this.config.name, chatId, s.insertedId);
-                        if (custody?.state !== 'accepted' || custody.expectedRunId !== owner.runId)
-                            continue;
-                        this.store.saveInsertion(this.config.name, chatId, s.insertedId, custody.insertionId, 'committed', custody);
-                        await this.receiptReaction(chatId, s.insertedId, s.messageId, 'DONE', owner.runId);
-                    }
-                    const acksAfter = this.pendingAckMessages.get(chatId) || [];
-                    guard();
-                    this.pendingAckMessages.set(chatId, acksAfter.filter((a) => !admittedSteers.some((s) => a.messageId === s.messageId)));
-                }
+                if (visibleOutcomeConfirmed && owner.runId)
+                    await this.queuedPresentations.settleRun(chatId, owner.runId).catch(() => { });
             }
             catch (err) {
                 if (!current() || err instanceof SupersededObservation) {
@@ -2442,6 +2501,17 @@ export class FeishuBot {
                     this.pendingAckMessages.set(chatId, acks.filter(ack => !completedTriggerIdSet.has(ack.rowId)));
                     break;
                 }
+                if (err instanceof CollectorStalledError) {
+                    // Not a task failure: do not restore/replay accepted insertions or
+                    // mark DONE. Retain exact dispatch/result custody; release the local
+                    // owner independently of potentially hung card/reaction effects.
+                    owner.observationDetached = true;
+                    const epoch = owner.stopEpoch;
+                    if (this.stopGeneration(chatId) === epoch && !this.store.hasDeliveredReply(this.config.name, chatId, triggerId))
+                        void liveStatus?.pauseForUnconfirmedResult(err.message).catch(() => { });
+                    console.warn(`[${this.config.name}] local observer stalled for ${chatId.slice(-8)}; durable exact-result custody retained`);
+                    break;
+                }
                 if (err instanceof InactiveRunObservation) {
                     this.fireRunFailureObservers(chatId);
                     await liveStatus?.pauseForUnconfirmedResult(err.message).catch(() => { });
@@ -2469,12 +2539,14 @@ export class FeishuBot {
                 console.error(`[${this.config.name}] processQueue error:`, safeErrorSummary(err));
                 this.fireRunFailureObservers(chatId);
                 const errorText = this.formatUserVisibleError(err, chatId);
+                let errorOutcomeConfirmed = false;
                 if (lastHuman.messageId) {
                     // Error message goes through the normal delivery path; the live status
                     // is a separate message that we mark interrupted afterwards.
                     await this.enqueueAndDispatchDelivery(chatId, "provider_error", `trigger:${triggerId}:provider-error`, errorText, [], lastHuman.messageId, `trigger:${triggerId}:provider-error`)
-                        .then(() => {
-                        if (current() && triggerId)
+                        .then(outcome => {
+                        errorOutcomeConfirmed = outcome.state === 'delivered';
+                        if (errorOutcomeConfirmed && current() && triggerId)
                             this.store.markDeliveredReply(this.config.name, chatId, triggerId, lastHuman.messageId);
                     })
                         .catch(() => { });
@@ -2498,7 +2570,7 @@ export class FeishuBot {
                 const pendingAcks = this.pendingAckMessages.get(chatId) || [];
                 const remainingAcks = [];
                 for (const ack of pendingAcks) {
-                    if (completedTriggerIdSet.has(ack.rowId) && runAcceptedByOpenClaw) {
+                    if (errorOutcomeConfirmed && completedTriggerIdSet.has(ack.rowId) && runAcceptedByOpenClaw) {
                         guard();
                         await this.receiptReaction(chatId, ack.rowId, ack.messageId, 'DONE', foregroundRunId || owner.runId);
                     }
@@ -2513,7 +2585,7 @@ export class FeishuBot {
             finally {
                 if (current()) {
                     this.busyChats.set(chatId, 0);
-                    if (owner.batchId && !owner.yielded)
+                    if (owner.batchId && !owner.yielded && !owner.observationDetached)
                         this.store.clearDispatchCustody(this.config.name, chatId, owner.id, owner.batchId);
                 }
             }
@@ -3069,8 +3141,8 @@ export class FeishuBot {
                         return;
                     }
                 }
-                await this.enqueueAndDispatchDelivery(chatId, "delayed_error", `trigger:${triggerId}:delayed-error`, text, [], replyToMessageId, `trigger:${triggerId}:delayed-error`);
-                if (triggerId)
+                const outcome = await this.enqueueAndDispatchDelivery(chatId, "delayed_error", `trigger:${triggerId}:delayed-error`, text, [], replyToMessageId, `trigger:${triggerId}:delayed-error`);
+                if (outcome.state === "delivered" && triggerId)
                     this.store.markDeliveredReply(this.config.name, chatId, triggerId, replyToMessageId);
             })()
                 .catch((err) => {
@@ -3097,21 +3169,22 @@ export class FeishuBot {
         const sourceId = `discussion-system:${Date.now()}:${Math.random().toString(36).slice(2)}`;
         await this.enqueueAndDispatchDelivery(chatId, "discussion_system", sourceId, text);
     }
-    async enqueueAndDispatchDelivery(chatId, sourceType, sourceId, text, attachments = [], replyToMessageId, deliveryKey, finalReplyModel, provenance, errorNoticeId) {
+    async enqueueAndDispatchDelivery(chatId, sourceType, sourceId, text, attachments = [], replyToMessageId, deliveryKey, finalReplyModel, provenance, errorNoticeId, completionTriggerIds) {
         if (provenance?.sessionKey && !/^agent:/.test(provenance.sessionKey))
             provenance = { ...provenance, sessionKey: `agent:main:${provenance.sessionKey}` };
         if (provenance?.sessionKey && provenance.runId && this.store.isStoppedObservation(provenance.sessionKey, provenance.runId))
-            return;
+            return { state: "suppressed", outboxIds: [] };
         if (text.trim().toUpperCase() === 'NO_REPLY')
             text = '';
         if (!text.trim() && attachments.length === 0)
-            return;
+            return { state: "suppressed", outboxIds: [] };
         const attachmentsJson = JSON.stringify(attachments);
         const normalizedPayload = `${text.trim()}|${attachmentsJson}`;
         const contentHash = this.stableHash(normalizedPayload);
         const finalDeliveryKey = deliveryKey || sourceId;
         const deliveryMetaJson = JSON.stringify({
             botIdentity: this.config.appId,
+            ...(completionTriggerIds?.length ? { completionTriggerIds } : {}),
             deliveryStopEpoch: this.stopGeneration(chatId),
             ...(finalReplyModel?.trim() ? { model: finalReplyModel.trim() } : {}),
             ...(provenance ? { provenance } : {}), ...(errorNoticeId ? { errorNoticeId } : {}),
@@ -3122,14 +3195,14 @@ export class FeishuBot {
             this.store.promoteExactRunFinal(this.config.name, chatId, identity.sessionKey, identity.runId, contentHash, text, attachmentsJson);
             if (!deliveryKey && this.store.hasExactRunFinalPayload(this.config.name, chatId, identity, text, attachmentsJson)) {
                 await this.dispatchPendingDeliveries(chatId);
-                return;
+                return this.store.getDeliveryDispatchOutcome(this.config.name, chatId, finalDeliveryKey);
             }
         }
         if (sourceType === "verbose_transcript") {
             if (this.store.hasRecentSimilarDelivery(this.config.name, chatId, contentHash, 60_000, ["verbose_transcript"]))
-                return;
+                return { state: "suppressed", outboxIds: [] };
             if (this.store.hasRecentOverlappingDelivery(this.config.name, chatId, text, attachmentsJson, 60_000, 8, ["verbose_transcript"]))
-                return;
+                return { state: "suppressed", outboxIds: [] };
         }
         const deliveryId = this.store.enqueueDelivery({
             sessionKey: this.deliverySessionKey(chatId),
@@ -3146,6 +3219,8 @@ export class FeishuBot {
             targetMessageId: "",
             deliveryMetaJson,
         });
+        if (completionTriggerIds?.length)
+            this.store.bindDeliveryCompletionTriggers(this.config.name, chatId, finalDeliveryKey, completionTriggerIds);
         if (deliveryId === null) {
             // Another path already owns this stable logical delivery (commonly the
             // proactive callback racing the chat-final path). Never show the full
@@ -3159,7 +3234,7 @@ export class FeishuBot {
                     this.store.renewUnsentErrorDelivery(existing.id, text, contentHash, deliveryMetaJson);
                 }
                 await this.dispatchPendingDeliveries(chatId);
-                return;
+                return this.store.getDeliveryDispatchOutcome(this.config.name, chatId, finalDeliveryKey);
             }
             // A failed owner must not permanently poison a logical trigger. Re-enqueue
             // the payload under a deterministic recovery key so a later authoritative
@@ -3256,12 +3331,14 @@ export class FeishuBot {
             }
             // Dispatch recovery/correction/supplement rows together in creation order.
             await this.dispatchPendingDeliveries(chatId, replyToMessageId);
-            return;
+            return this.store.getDeliveryDispatchOutcome(this.config.name, chatId, finalDeliveryKey);
         }
         await this.dispatchPendingDeliveries(chatId, replyToMessageId);
         if (sourceType === "assistant_visible" && (text.trim() || attachments.length > 0) && text.trim().toUpperCase() !== "NO_REPLY" && !this.isRuntimeFailureText(text.trim())) {
-            this.lastRealDeliveryAt.set(chatId, Date.now());
+            if (this.store.getDeliveryDispatchOutcome(this.config.name, chatId, finalDeliveryKey).state === "delivered")
+                this.lastRealDeliveryAt.set(chatId, Date.now());
         }
+        return this.store.getDeliveryDispatchOutcome(this.config.name, chatId, finalDeliveryKey);
     }
     async inspectErrorNotice(record) {
         if (this.store.hasRunFinalDelivery(this.config.name, record.chatId, record.provenance, true)) {
@@ -3429,6 +3506,61 @@ export class FeishuBot {
             this.stopGeneration(chatId) === notice.stopEpoch && current.sessionId === notice.sessionId &&
             Number.isFinite(current.unknownSince) && Date.now() - current.unknownSince >= 45_000;
     }
+    deliveryDeadlineReason(id) {
+        try {
+            const effect = this.store.getDeliveryEffectState(id);
+            return effect === 'unknown' ? 'deadline_attempted_unknown' : effect === 'accepted' ? 'deadline_after_acceptance' :
+                effect === 'rejected' ? 'deadline_rejected' : 'deadline_before_attempt';
+        }
+        catch {
+            return 'deadline_local_checkpoint';
+        }
+    }
+    /** Durable local obligation, separate from the platform retry budget. */
+    retainLocalDelivery(chatId, id, reason) {
+        let custody = this.localDeliveryRetryCustody.get(chatId);
+        if (!custody) {
+            custody = new Set();
+            this.localDeliveryRetryCustody.set(chatId, custody);
+        }
+        custody.add(id);
+        let failures = 10;
+        try {
+            failures = this.store.deferLocalDelivery(id, reason);
+            custody.delete(id);
+        }
+        catch { /* Process-local custody remains until SQLite is writable again. */ }
+        this.scheduleDeliveryRetry(chatId, failures, true);
+    }
+    isDeliverySettlementRevoked(chatId, metadata) {
+        const meta = JSON.parse(metadata || '{}'), p = meta.provenance;
+        return typeof meta.deliveryStopEpoch === 'number' && meta.deliveryStopEpoch !== this.stopGeneration(chatId) ||
+            !!(p?.sessionKey && p.runId && this.store.isStoppedObservation(p.sessionKey, p.runId));
+    }
+    /** Also runs for a late accepted SDK receipt, without replaying the final. */
+    settleConfirmedDelivery(chatId, item) {
+        const meta = JSON.parse(item.deliveryMetaJson || '{}'), p = meta.provenance;
+        if (this.isDeliverySettlementRevoked(chatId, item.deliveryMetaJson))
+            return;
+        const triggerKey = /^trigger:\d+(?=$|:authoritative:|:attachments:|:recovery:)/.exec(item.deliveryKey)?.[0];
+        if (!triggerKey && !meta.completionTriggerIds?.length)
+            return;
+        const key = triggerKey || item.deliveryKey;
+        if (this.store.getDeliveryDispatchOutcome(this.config.name, chatId, key).state !== 'delivered')
+            return;
+        const root = this.store.getDeliveryByKey(this.config.name, chatId, key);
+        const rootMeta = JSON.parse(root?.deliveryMetaJson || '{}');
+        const triggerIds = rootMeta.completionTriggerIds || (triggerKey ? [Number(triggerKey.slice(8))] : []);
+        for (const id of triggerIds)
+            this.store.markDeliveredReply(this.config.name, chatId, id, item.replyToMessageId);
+        if (p?.runId) {
+            this.store.settleRunReactionIntents(this.config.name, chatId, p.runId);
+            void this.reconcileReactions(chatId).catch(() => { });
+            const target = this.deliveryTargetsByRun.get(this.deliveryRunTargetKey(chatId, p.runId));
+            // Never await the card's own sendOrdered link from inside this send link.
+            void target?.liveStatus?.complete().catch(() => { });
+        }
+    }
     async dispatchPendingDeliveries(chatId, replyToMessageId) {
         this.installGoReceiptCapture();
         for (const id of this.localDeliveryRetryCustody.get(chatId) || []) {
@@ -3447,6 +3579,11 @@ export class FeishuBot {
             if (pending.length === 0)
                 break;
             for (const item of pending) {
+                if (this.inFlightDeliveryWork.has(item.id)) {
+                    retryScheduled = true;
+                    this.scheduleDeliveryRetry(chatId, 10, true);
+                    continue;
+                }
                 const notice = JSON.parse(item.deliveryMetaJson || '{}').insertionNotice;
                 if (notice) {
                     const info = await this.openclawClient.getSessionInfo(this.getSessionKey(chatId), 1500).catch(() => null);
@@ -3467,233 +3604,246 @@ export class FeishuBot {
                     ...this.store.listDeliveryReceipts(item.id),
                     ...(deliveryJob ? this.store.listGoVisibleEvidence(deliveryJob.id).find(e => e.sourceKey === `outbox:${item.id}`)?.receipt?.messages ?? [] : []),
                 ];
-                await this.sendOrdered(chatId, () => this.goDeliveryReceipts.run({ receipts, goId: deliveryJob?.id, outboxId: item.id, chatId, stage: "body", ordinals: new Map(), effectGuard: () => {
-                        const meta = JSON.parse(item.deliveryMetaJson || '{}'), p = meta.provenance;
-                        if (!this.insertionNoticeCurrent(chatId, meta.insertionNotice))
-                            throw Object.assign(new Error('Insertion notice no longer current'), { deliveryStopped: true });
-                        if ((p?.final || item.sourceType === 'run_error') &&
-                            (typeof meta.deliveryStopEpoch === 'number' && meta.deliveryStopEpoch !== this.stopGeneration(chatId) ||
-                                p?.sessionKey && p.runId && this.store.isStoppedObservation(p.sessionKey, p.runId))) {
-                            throw Object.assign(new Error('Delivery revoked by explicit stop before platform attempt'), { deliveryStopped: true });
-                        }
-                    }, onReceipt: () => {
-                        if (deliveryJob)
-                            this.store.recordGoDeliveryReceipt(deliveryJob.id, `outbox:${item.id}`, { messages: receipts, partial: true });
-                    } }, async () => {
-                    if (!item.id || !this.store.claimDelivery(item.id))
-                        return;
-                    let failureStage = "text";
-                    try {
-                        this.store.flushKnownDeliveryReceipts(item.id);
-                        this.store.registerPartialAttachmentContext(item.id);
-                        const job = deliveryJob;
-                        const provenance = JSON.parse(item.deliveryMetaJson || "{}").provenance;
-                        const goSource = `outbox:${item.id}`;
-                        const eligible = job && ["assistant_visible", "verbose_transcript", "run_error", "provider_error", "delayed_error", "proactive", "go_executor_error"].some(k => item.sourceType.startsWith(k));
-                        if (eligible)
-                            this.store.recordGoVisibleEvidence(job.id, goSource, { sessionId: provenance?.sessionId ?? "",
-                                runId: provenance?.runId ?? "", kind: item.sourceType, text: item.content, attachments: JSON.parse(item.attachmentsJson || "[]") });
-                        const attachments = JSON.parse(item.attachmentsJson || "[]");
-                        // Final text is always sent as a NEW message. Never patch it into the
-                        // older live-status card: user messages inserted during the run must
-                        // stay above the eventual final answer, not below it.
-                        if (item.content.trim() && !item.textDelivered) {
-                            const replyTarget = item.replyToMessageId || replyToMessageId;
-                            const shouldReplyToSource = Boolean(replyTarget) && (item.sourceType.startsWith("assistant_visible")
-                                || item.sourceType === "verbose_transcript"
-                                || item.sourceType === "provider_error"
-                                || item.sourceType === "delayed_error"
-                                || item.sourceType === "wait_paused");
-                            let finalModel;
+                this.inFlightDeliveryWork.add(item.id);
+                try {
+                    await this.sendOrdered(chatId, () => {
+                        const work = this.goDeliveryReceipts.run({ receipts, goId: deliveryJob?.id, outboxId: item.id, chatId, stage: "body", ordinals: new Map(), effectGuard: () => {
+                                const meta = JSON.parse(item.deliveryMetaJson || '{}'), p = meta.provenance;
+                                if (!this.insertionNoticeCurrent(chatId, meta.insertionNotice))
+                                    throw Object.assign(new Error('Insertion notice no longer current'), { deliveryStopped: true });
+                                if ((p?.final || item.sourceType === 'run_error') &&
+                                    (typeof meta.deliveryStopEpoch === 'number' && meta.deliveryStopEpoch !== this.stopGeneration(chatId) ||
+                                        p?.sessionKey && p.runId && this.store.isStoppedObservation(p.sessionKey, p.runId))) {
+                                    throw Object.assign(new Error('Delivery revoked by explicit stop before platform attempt'), { deliveryStopped: true });
+                                }
+                            }, onReceipt: () => {
+                                if (deliveryJob)
+                                    this.store.recordGoDeliveryReceipt(deliveryJob.id, `outbox:${item.id}`, { messages: receipts, partial: true });
+                            } }, async () => {
+                            if (!item.id || !this.store.claimDelivery(item.id))
+                                return;
+                            let failureStage = "text";
                             try {
-                                const meta = JSON.parse(item.deliveryMetaJson || "{}");
-                                finalModel = typeof meta.model === "string" && meta.model.trim() ? meta.model.trim() : undefined;
-                            }
-                            catch { /* legacy/malformed metadata: send without model footer */ }
-                            const needsStatus = Boolean(finalModel) || item.sourceType.startsWith("assistant_visible") || ["provider_error", "delayed_error", "wait_paused"].includes(item.sourceType);
-                            const finalStatus = needsStatus ? formatSessionFooter(await this.readSessionStatus(chatId)) : undefined;
-                            if (needsStatus && !finalModel)
-                                finalModel = this.config.model;
-                            if (item.sourceType === "run_error") {
-                                const meta = JSON.parse(item.deliveryMetaJson || "{}");
-                                const record = this.store.getErrorNotice(this.config.name, chatId, meta.errorNoticeId || "");
-                                const verdict = record ? await this.inspectErrorNotice(record) : { state: "pending", reason: "missing_persisted_provenance" };
-                                if (verdict.state !== "terminal" || verdict.terminalKey !== item.deliveryKey || verdict.text !== item.content) {
-                                    this.store.withdrawErrorDelivery(item.id);
-                                    if (record) {
-                                        if (verdict.state === "pending" || verdict.state === "terminal")
-                                            this.deferErrorNotice(record, { ...verdict, state: "pending" });
-                                        else {
-                                            record.status = verdict.state;
-                                            record.verdict = verdict;
-                                            this.store.saveErrorNotice(record);
+                                this.store.flushKnownDeliveryReceipts(item.id);
+                                this.store.registerPartialAttachmentContext(item.id);
+                                const job = deliveryJob;
+                                const provenance = JSON.parse(item.deliveryMetaJson || "{}").provenance;
+                                const goSource = `outbox:${item.id}`;
+                                const eligible = job && ["assistant_visible", "verbose_transcript", "run_error", "provider_error", "delayed_error", "proactive", "go_executor_error"].some(k => item.sourceType.startsWith(k));
+                                if (eligible)
+                                    this.store.recordGoVisibleEvidence(job.id, goSource, { sessionId: provenance?.sessionId ?? "",
+                                        runId: provenance?.runId ?? "", kind: item.sourceType, text: item.content, attachments: JSON.parse(item.attachmentsJson || "[]") });
+                                const attachments = JSON.parse(item.attachmentsJson || "[]");
+                                // Final text is always sent as a NEW message. Never patch it into the
+                                // older live-status card: user messages inserted during the run must
+                                // stay above the eventual final answer, not below it.
+                                if (item.content.trim() && !item.textDelivered) {
+                                    const replyTarget = item.replyToMessageId || replyToMessageId;
+                                    const shouldReplyToSource = Boolean(replyTarget) && (item.sourceType.startsWith("assistant_visible")
+                                        || item.sourceType === "verbose_transcript"
+                                        || item.sourceType === "provider_error"
+                                        || item.sourceType === "delayed_error"
+                                        || item.sourceType === "wait_paused");
+                                    let finalModel;
+                                    try {
+                                        const meta = JSON.parse(item.deliveryMetaJson || "{}");
+                                        finalModel = typeof meta.model === "string" && meta.model.trim() ? meta.model.trim() : undefined;
+                                    }
+                                    catch { /* legacy/malformed metadata: send without model footer */ }
+                                    const needsStatus = Boolean(finalModel) || item.sourceType.startsWith("assistant_visible") || ["provider_error", "delayed_error", "wait_paused"].includes(item.sourceType);
+                                    const finalStatus = needsStatus ? formatSessionFooter(await this.readSessionStatus(chatId)) : undefined;
+                                    if (needsStatus && !finalModel)
+                                        finalModel = this.config.model;
+                                    if (item.sourceType === "run_error") {
+                                        const meta = JSON.parse(item.deliveryMetaJson || "{}");
+                                        const record = this.store.getErrorNotice(this.config.name, chatId, meta.errorNoticeId || "");
+                                        const verdict = record ? await this.inspectErrorNotice(record) : { state: "pending", reason: "missing_persisted_provenance" };
+                                        if (verdict.state !== "terminal" || verdict.terminalKey !== item.deliveryKey || verdict.text !== item.content) {
+                                            this.store.withdrawErrorDelivery(item.id);
+                                            if (record) {
+                                                if (verdict.state === "pending" || verdict.state === "terminal")
+                                                    this.deferErrorNotice(record, { ...verdict, state: "pending" });
+                                                else {
+                                                    record.status = verdict.state;
+                                                    record.verdict = verdict;
+                                                    this.store.saveErrorNotice(record);
+                                                }
+                                            }
+                                            return;
                                         }
+                                        record.verdict = verdict;
+                                        this.store.saveErrorNotice(record);
                                     }
-                                    return;
+                                    if (item.sourceType === "run_error") {
+                                        // Exactly one platform operation per guarded attempt. A card/text
+                                        // fallback must not bypass a fresh finality check.
+                                        await this.sendErrorNotice(chatId, item.content);
+                                    }
+                                    else if (shouldReplyToSource) {
+                                        try {
+                                            await this.replyFinalMessage(replyTarget, item.content, finalModel, finalStatus);
+                                        }
+                                        catch {
+                                            await this.sendFinalMessage(chatId, item.content, finalModel, finalStatus);
+                                        }
+                                    }
+                                    else {
+                                        await this.sendFinalMessage(chatId, item.content, finalModel, finalStatus);
+                                    }
+                                    const bodyReceipts = this.store.listDeliveryReceipts(item.id).filter(r => r.stage === 'body');
+                                    if (!bodyReceipts.length)
+                                        throw new Error('No confirmed body receipt');
+                                    this.store.registerPartialBodyContext(item.id, true);
+                                    this.store.confirmDeliveryStage(item.id, 'body', item.content, bodyReceipts, 'text');
+                                    if (item.deliveryMode === 'patch_live_status' && item.targetMessageId)
+                                        this.store.markDeliveryCleanupPending(item.id, true);
+                                }
+                                // Repair a checkpoint/context gap without resending. Legacy rows
+                                // lacking actual receipts are exposed through the explicit audit API.
+                                if (item.textDelivered) {
+                                    const bodyReceipts = this.store.listDeliveryReceipts(item.id).filter(r => r.stage === 'body');
+                                    if (bodyReceipts.length)
+                                        this.store.confirmDeliveryStage(item.id, 'body', item.content, bodyReceipts, 'text');
+                                }
+                                // Attachments are independent from status-card cleanup. An unpatchable
+                                // or deleted status card must never block otherwise-sendable files.
+                                failureStage = "attachment";
+                                const cursor = Math.max(0, item.attachmentCursor || 0);
+                                for (let i = cursor; i < attachments.length; i++) {
+                                    const context = this.goDeliveryReceipts.getStore();
+                                    if (context)
+                                        context.stage = `attachment:${i}`;
+                                    await this.sendBridgeAttachment(chatId, attachments[i]);
+                                    const stage = `attachment:${i}`;
+                                    const attachmentReceipts = this.store.listDeliveryReceipts(item.id).filter(r => r.stage === stage);
+                                    if (!attachmentReceipts.length)
+                                        throw new Error('No confirmed attachment receipt');
+                                    const visiblePayload = attachmentReceipts.map(r => {
+                                        try {
+                                            const payload = JSON.parse(r.payload?.content || '{}');
+                                            return payload.text || JSON.stringify(payload);
+                                        }
+                                        catch {
+                                            return '';
+                                        }
+                                    }).filter(Boolean).join('\n');
+                                    const description = `[Attachment: ${attachments[i].type || 'file'} ${attachments[i].path}]${attachments[i].caption ? ' ' + attachments[i].caption : ''}\n${visiblePayload}`;
+                                    this.store.confirmDeliveryStage(item.id, stage, description, attachmentReceipts, i + 1);
+                                }
+                                // Cleanup last, after all payload is visible. Cleanup-only rows and
+                                // attachment-only finals enter here as a separately retryable stage.
+                                const refreshedBeforeCleanup = this.store.getDeliveryByKey(item.botName, item.chatId, item.deliveryKey);
+                                const needsCleanup = Boolean(refreshedBeforeCleanup?.cleanupPending)
+                                    || (!item.content.trim() && item.deliveryMode === "patch_live_status" && Boolean(item.targetMessageId));
+                                if (needsCleanup && item.targetMessageId) {
+                                    failureStage = "cleanup";
+                                    const meta = JSON.parse(item.deliveryMetaJson || "{}");
+                                    this.assertSendEffectLease(chatId);
+                                    this.goDeliveryReceipts.getStore()?.effectGuard?.();
+                                    await this.patchLiveStatusDoneSummary(item.targetMessageId, meta, chatId);
+                                    this.store.markDeliveryCleanupPending(item.id, false);
+                                }
+                                if (eligible && receipts.length) {
+                                    this.store.recordGoDeliveryReceipt(job.id, goSource, { messages: receipts, outboxId: item.id });
+                                    if (provenance?.runId && provenance?.sessionId === job.executorSessionId) {
+                                        const kind = ["run_error", "provider_error", "delayed_error", "go_executor_error"].some(k => item.sourceType.startsWith(k)) ? "run_error" : "assistant_reply";
+                                        const evidence = JSON.stringify({ text: item.content, attachments, receipt: receipts });
+                                        if (ownerId)
+                                            this.goController?.notifyExactRunOutcome(job.id, kind, goSource, evidence, provenance.sessionId, provenance.runId);
+                                        else
+                                            this.goController?.notifyRunOutcome(chatId, kind, goSource, evidence);
+                                    }
+                                }
+                                this.store.markDeliveryDelivered(item.id);
+                                this.settleConfirmedDelivery(chatId, item);
+                                const settlementCurrent = !this.isDeliverySettlementRevoked(chatId, item.deliveryMetaJson);
+                                if (settlementCurrent && item.sourceType === 'run_error' && provenance?.terminalEvidence?.state === 'terminal' && provenance.runId && !provenance.runId.startsWith('announce:')) {
+                                    this.store.settleRunReactionIntents(this.config.name, chatId, provenance.runId);
+                                    if (provenance.sessionKey)
+                                        this.store.finishRunObservation(provenance.sessionKey, provenance.runId);
+                                    void this.reconcileReactions(chatId).catch(() => { });
+                                }
+                                if (settlementCurrent && provenance?.final && provenance.runId) {
+                                    this.store.settleRunReactionIntents(this.config.name, chatId, provenance.runId);
+                                    void this.reconcileReactions(chatId).catch(() => { });
                                 }
-                                record.verdict = verdict;
-                                this.store.saveErrorNotice(record);
-                            }
-                            if (item.sourceType === "run_error") {
-                                // Exactly one platform operation per guarded attempt. A card/text
-                                // fallback must not bypass a fresh finality check.
-                                await this.sendErrorNotice(chatId, item.content);
                             }
-                            else if (shouldReplyToSource) {
+                            catch (err) {
+                                if (failureStage === 'text') {
+                                    try {
+                                        this.store.registerPartialBodyContext(item.id);
+                                    }
+                                    catch { /* Durable operation receipts retain recoverable context custody. */ }
+                                }
                                 try {
-                                    await this.replyFinalMessage(replyTarget, item.content, finalModel, finalStatus);
+                                    this.store.registerPartialAttachmentContext(item.id);
                                 }
-                                catch {
-                                    await this.sendFinalMessage(chatId, item.content, finalModel, finalStatus);
+                                catch { /* Confirmed payload remains in receipt custody. */ }
+                                const activeJob = deliveryJob;
+                                if (activeJob && receipts.length)
+                                    this.store.recordGoDeliveryReceipt(activeJob.id, `outbox:${item.id}`, { messages: receipts, partial: true });
+                                if (this.isOutOfChatError(err))
+                                    this.markCurrentBotUnavailable(chatId, err);
+                                if (err?.deliveryStopped) {
+                                    this.store.markDeliveryFailed(item.id);
+                                    return;
                                 }
-                            }
-                            else {
-                                await this.sendFinalMessage(chatId, item.content, finalModel, finalStatus);
-                            }
-                            const bodyReceipts = this.store.listDeliveryReceipts(item.id).filter(r => r.stage === 'body');
-                            if (!bodyReceipts.length)
-                                throw new Error('No confirmed body receipt');
-                            this.store.registerPartialBodyContext(item.id, true);
-                            this.store.confirmDeliveryStage(item.id, 'body', item.content, bodyReceipts, 'text');
-                            if (item.deliveryMode === 'patch_live_status' && item.targetMessageId)
-                                this.store.markDeliveryCleanupPending(item.id, true);
-                        }
-                        // Repair a checkpoint/context gap without resending. Legacy rows
-                        // lacking actual receipts are exposed through the explicit audit API.
-                        if (item.textDelivered) {
-                            const bodyReceipts = this.store.listDeliveryReceipts(item.id).filter(r => r.stage === 'body');
-                            if (bodyReceipts.length)
-                                this.store.confirmDeliveryStage(item.id, 'body', item.content, bodyReceipts, 'text');
-                        }
-                        // Attachments are independent from status-card cleanup. An unpatchable
-                        // or deleted status card must never block otherwise-sendable files.
-                        failureStage = "attachment";
-                        const cursor = Math.max(0, item.attachmentCursor || 0);
-                        for (let i = cursor; i < attachments.length; i++) {
-                            const context = this.goDeliveryReceipts.getStore();
-                            if (context)
-                                context.stage = `attachment:${i}`;
-                            await this.sendBridgeAttachment(chatId, attachments[i]);
-                            const stage = `attachment:${i}`;
-                            const attachmentReceipts = this.store.listDeliveryReceipts(item.id).filter(r => r.stage === stage);
-                            if (!attachmentReceipts.length)
-                                throw new Error('No confirmed attachment receipt');
-                            const visiblePayload = attachmentReceipts.map(r => {
+                                const localFailure = String(err?.code || '').startsWith('SQLITE_') || this.goDeliveryReceipts.getStore()?.persistenceError === err;
+                                if (err instanceof SendDeadlineError) {
+                                    this.retainLocalDelivery(chatId, item.id, this.deliveryDeadlineReason(item.id));
+                                    retryScheduled = true;
+                                    return;
+                                }
+                                if (localFailure || this.store.hasUnknownDeliveryOperation(item.id)) {
+                                    this.retainLocalDelivery(chatId, item.id, localFailure ? 'local_checkpoint' : 'unknown_requires_audit');
+                                    retryScheduled = true;
+                                    return;
+                                }
+                                const willRetry = this.store.retryDelivery(item.id, DELIVERY_MAX_ATTEMPTS);
+                                if (willRetry) {
+                                    retryScheduled = true;
+                                    console.warn(`[${this.config.name}] delivery ${item.id} ${failureStage} failed (attempt ${item.attempts + 1}/${DELIVERY_MAX_ATTEMPTS}); retry scheduled:`, this.errorSummary(err));
+                                    this.scheduleDeliveryRetry(chatId, item.attempts + 1);
+                                    return;
+                                }
+                                // Cleanup is cosmetic once text/attachments are visible. Exhausting
+                                // cleanup retries must not turn a successful answer into a scary
+                                // user-facing failure.
+                                if (failureStage === "cleanup") {
+                                    this.store.markDeliveryDelivered(item.id);
+                                    console.warn(`[${this.config.name}] status-card cleanup abandoned after ${DELIVERY_MAX_ATTEMPTS} attempts:`, this.errorSummary(err));
+                                    return;
+                                }
+                                this.store.markDeliveryFailed(item.id);
+                                if (item.sourceType === "run_error")
+                                    return;
+                                const label = failureStage === "attachment" ? "附件发送失败" : "最终回复发送失败";
+                                const errorText = `⚠️ ${label}（已重试 ${DELIVERY_MAX_ATTEMPTS} 次）：${this.errorSummary(err)}`;
+                                const replyTarget = item.replyToMessageId || replyToMessageId;
                                 try {
-                                    const payload = JSON.parse(r.payload?.content || '{}');
-                                    return payload.text || JSON.stringify(payload);
+                                    if (replyTarget)
+                                        await this.replyMessage(replyTarget, errorText);
+                                    else
+                                        await this.sendMessage(chatId, errorText);
                                 }
-                                catch {
-                                    return '';
+                                catch (notifyErr) {
+                                    console.warn(`[${this.config.name}] Failed to notify terminal delivery error:`, this.errorSummary(notifyErr));
                                 }
-                            }).filter(Boolean).join('\n');
-                            const description = `[Attachment: ${attachments[i].type || 'file'} ${attachments[i].path}]${attachments[i].caption ? ' ' + attachments[i].caption : ''}\n${visiblePayload}`;
-                            this.store.confirmDeliveryStage(item.id, stage, description, attachmentReceipts, i + 1);
-                        }
-                        // Cleanup last, after all payload is visible. Cleanup-only rows and
-                        // attachment-only finals enter here as a separately retryable stage.
-                        const refreshedBeforeCleanup = this.store.getDeliveryByKey(item.botName, item.chatId, item.deliveryKey);
-                        const needsCleanup = Boolean(refreshedBeforeCleanup?.cleanupPending)
-                            || (!item.content.trim() && item.deliveryMode === "patch_live_status" && Boolean(item.targetMessageId));
-                        if (needsCleanup && item.targetMessageId) {
-                            failureStage = "cleanup";
-                            const meta = JSON.parse(item.deliveryMetaJson || "{}");
-                            await this.patchLiveStatusDoneSummary(item.targetMessageId, meta, chatId);
-                            this.store.markDeliveryCleanupPending(item.id, false);
-                        }
-                        if (eligible && receipts.length) {
-                            this.store.recordGoDeliveryReceipt(job.id, goSource, { messages: receipts, outboxId: item.id });
-                            if (provenance?.runId && provenance?.sessionId === job.executorSessionId) {
-                                const kind = ["run_error", "provider_error", "delayed_error", "go_executor_error"].some(k => item.sourceType.startsWith(k)) ? "run_error" : "assistant_reply";
-                                const evidence = JSON.stringify({ text: item.content, attachments, receipt: receipts });
-                                if (ownerId)
-                                    this.goController?.notifyExactRunOutcome(job.id, kind, goSource, evidence, provenance.sessionId, provenance.runId);
-                                else
-                                    this.goController?.notifyRunOutcome(chatId, kind, goSource, evidence);
-                            }
-                        }
-                        this.store.markDeliveryDelivered(item.id);
-                        if (item.sourceType === 'run_error' && provenance?.terminalEvidence?.state === 'terminal' && provenance.runId && !provenance.runId.startsWith('announce:')) {
-                            this.store.settleRunReactionIntents(this.config.name, chatId, provenance.runId);
-                            if (provenance.sessionKey)
-                                this.store.finishRunObservation(provenance.sessionKey, provenance.runId);
-                            void this.reconcileReactions(chatId).catch(() => { });
-                        }
-                        if (provenance?.final && provenance.runId) {
-                            this.store.settleRunReactionIntents(this.config.name, chatId, provenance.runId);
-                            void this.reconcileReactions(chatId).catch(() => { });
-                        }
-                    }
-                    catch (err) {
-                        if (failureStage === 'text') {
-                            try {
-                                this.store.registerPartialBodyContext(item.id);
-                            }
-                            catch { /* Durable operation receipts retain recoverable context custody. */ }
-                        }
-                        try {
-                            this.store.registerPartialAttachmentContext(item.id);
-                        }
-                        catch { /* Confirmed payload remains in receipt custody. */ }
-                        const activeJob = deliveryJob;
-                        if (activeJob && receipts.length)
-                            this.store.recordGoDeliveryReceipt(activeJob.id, `outbox:${item.id}`, { messages: receipts, partial: true });
-                        if (this.isOutOfChatError(err))
-                            this.markCurrentBotUnavailable(chatId, err);
-                        if (err?.deliveryStopped) {
-                            this.store.markDeliveryFailed(item.id);
-                            return;
-                        }
-                        const localFailure = String(err?.code || '').startsWith('SQLITE_');
-                        if (localFailure || this.store.hasUnknownDeliveryOperation(item.id)) {
-                            let custody = this.localDeliveryRetryCustody.get(chatId);
-                            if (!custody) {
-                                custody = new Set();
-                                this.localDeliveryRetryCustody.set(chatId, custody);
                             }
-                            custody.add(item.id);
-                            let failures = 10;
-                            try {
-                                failures = this.store.deferLocalDelivery(item.id, localFailure ? 'local_checkpoint' : 'unknown_requires_audit');
-                                custody.delete(item.id);
-                            }
-                            catch { /* Retry custody remains live even if SQLite cannot record it yet. */ }
-                            retryScheduled = true;
-                            this.scheduleDeliveryRetry(chatId, failures, true);
-                            return;
-                        }
-                        const willRetry = this.store.retryDelivery(item.id, DELIVERY_MAX_ATTEMPTS);
-                        if (willRetry) {
-                            retryScheduled = true;
-                            console.warn(`[${this.config.name}] delivery ${item.id} ${failureStage} failed (attempt ${item.attempts + 1}/${DELIVERY_MAX_ATTEMPTS}); retry scheduled:`, this.errorSummary(err));
-                            this.scheduleDeliveryRetry(chatId, item.attempts + 1);
-                            return;
-                        }
-                        // Cleanup is cosmetic once text/attachments are visible. Exhausting
-                        // cleanup retries must not turn a successful answer into a scary
-                        // user-facing failure.
-                        if (failureStage === "cleanup") {
-                            this.store.markDeliveryDelivered(item.id);
-                            console.warn(`[${this.config.name}] status-card cleanup abandoned after ${DELIVERY_MAX_ATTEMPTS} attempts:`, this.errorSummary(err));
-                            return;
-                        }
-                        this.store.markDeliveryFailed(item.id);
-                        if (item.sourceType === "run_error")
-                            return;
-                        const label = failureStage === "attachment" ? "附件发送失败" : "最终回复发送失败";
-                        const errorText = `⚠️ ${label}（已重试 ${DELIVERY_MAX_ATTEMPTS} 次）：${this.errorSummary(err)}`;
-                        const replyTarget = item.replyToMessageId || replyToMessageId;
-                        try {
-                            if (replyTarget)
-                                await this.replyMessage(replyTarget, errorText);
-                            else
-                                await this.sendMessage(chatId, errorText);
-                        }
-                        catch (notifyErr) {
-                            console.warn(`[${this.config.name}] Failed to notify terminal delivery error:`, this.errorSummary(notifyErr));
-                        }
+                        });
+                        return work.finally(() => { this.inFlightDeliveryWork.delete(item.id); });
+                    });
+                }
+                catch (err) {
+                    if (!(err instanceof SendDeadlineError)) {
+                        this.inFlightDeliveryWork.delete(item.id);
+                        throw err;
                     }
-                }));
+                    // The old promise is still alive. Reconciliation must not claim this
+                    // outbox again until it settles; attempted unknown stays no-resend.
+                    this.retainLocalDelivery(chatId, item.id, this.deliveryDeadlineReason(item.id));
+                    retryScheduled = true;
+                }
             }
             // Drain subsequent pages immediately after successful batches. If any row
             // was returned to pending, honor its backoff timer instead of hot-looping.
@@ -3797,8 +3947,7 @@ export class FeishuBot {
         const liveStatusEnabled = this.store.getBotLiveStatus(this.config.name, chatId) && !this.store.getBotVerbose(this.config.name, chatId);
         const liveStatus = liveStatusEnabled
             ? new LiveStatusController({
-                create: (view) => this.sendOrdered(chatId, () => this.sendLiveStatusCard(chatId, view)),
-                edit: (messageId, view) => this.sendOrdered(chatId, () => this.patchLiveStatusCard(messageId, view, chatId)),
+                ...this.liveStatusCallbacks(chatId),
                 warn: (message, err) => console.warn(`[${this.config.name}] ${message}:`, err instanceof Error ? err.message : err),
             }, {
                 botName: this.config.name,
@@ -3862,12 +4011,16 @@ export class FeishuBot {
             const roundMarker = `—— 第 ${meta.round}/${meta.maxRounds} 轮 · ${this.config.name}`;
             displayReply = `${displayReply}\n\n${roundMarker}`;
         }
+        let discussionDeliveryConfirmed = false;
         if (isVisible || parsedReply.attachments.length > 0) {
             const storedContent = [displayReply, ...parsedReply.attachments.map((a) => `[Attachment: ${a.type || "file"} ${a.path}]`)]
                 .filter(Boolean)
                 .join("\n");
             try {
-                await this.enqueueAndDispatchDelivery(chatId, "discussion", `discussion:${Date.now()}:${Math.random().toString(36).slice(2)}`, isVisible ? displayReply : "", parsedReply.attachments, undefined, undefined, this.config.model);
+                const outcome = await this.enqueueAndDispatchDelivery(chatId, "discussion", `discussion:${Date.now()}:${Math.random().toString(36).slice(2)}`, isVisible ? displayReply : "", parsedReply.attachments, undefined, undefined, this.config.model);
+                discussionDeliveryConfirmed = outcome.state === 'delivered';
+                if (!discussionDeliveryConfirmed)
+                    await liveStatus?.pauseForUnconfirmedResult("飞书投递回执尚未确认；原投递仍受保管").catch(() => { });
             }
             catch (err) {
                 await liveStatus?.fail().catch(() => { });
@@ -3877,12 +4030,15 @@ export class FeishuBot {
         // Mirror the normal path: a NO_REPLY/empty discussion turn should finish the
         // status card with a "no content" summary, not a plain done summary.
         if (!isVisible && parsedReply.attachments.length === 0) {
-            await liveStatus?.noReply().catch(() => { });
+            if (rawVisibleReply.toUpperCase() === 'NO_REPLY')
+                await liveStatus?.noReply().catch(() => { });
+            else
+                await liveStatus?.pauseForUnconfirmedResult("尚未确认最终回复").catch(() => { });
         }
-        else {
+        else if (discussionDeliveryConfirmed) {
             await liveStatus?.complete().catch(() => { });
         }
-        return { botName: this.config.name, text: cleanVisibleReply, visible: isVisible };
+        return { botName: this.config.name, text: cleanVisibleReply, visible: isVisible && discussionDeliveryConfirmed };
     }
     buildLiveStatusCard(view, chatId) {
         const en = this.isEn(chatId);
@@ -3925,7 +4081,7 @@ export class FeishuBot {
             elements.push({ tag: "markdown", content });
         }
         else {
-            elements.push({ tag: "markdown", content: en ? "_working…_" : "_正在启动…_" });
+            elements.push({ tag: "markdown", content: view.state === "queued" ? (en ? "_Received locally; waiting for admission_" : "_本地已收件，等待提交确认_") : view.state === "admitted" ? (en ? "_Accepted; waiting for activity_" : "_已接收，等待活动_") : (en ? "_working…_" : "_正在启动…_") });
         }
         elements.push({ tag: "hr" });
         // Keep the active model visible while the run is in progress or failed.
@@ -3955,6 +4111,31 @@ export class FeishuBot {
     escapeCardText(text) {
         return String(text || "").replace(/</g, "\uff1c").replace(/>/g, "\uff1e");
     }
+    /** Keep receipt ownership below sendOrdered's Promise.race. Nothing here
+     * changes business-message/outbox ordering or retries. */
+    liveStatusCallbacks(chatId, replyTo) {
+        const send = async (fn) => {
+            try {
+                return await fn();
+            }
+            catch (err) {
+                if (err instanceof LiveStatusEffectRejectedError)
+                    throw err;
+                const code = err?.response?.data?.code ?? err?.data?.code;
+                if (typeof code === "number" && code !== 0)
+                    throw new LiveStatusEffectRejectedError(`Feishu rejected card: ${code}`);
+                // Network/SDK failures may follow an accepted effect. They are NOT
+                // eligible for automatic retry, unlike a definitive platform rejection.
+                throw new LiveStatusEffectUnknownError(err);
+            }
+        };
+        return {
+            create: (view, effect) => this.sendOrdered(chatId, () => effect.run(() => send(() => replyTo !== undefined
+                ? this.replyLiveStatusCard(replyTo, view, chatId)
+                : this.sendLiveStatusCard(chatId, view)))),
+            edit: (id, view, effect) => this.sendOrdered(chatId, () => effect.run(() => send(() => this.patchLiveStatusCard(id, view, chatId)))),
+        };
+    }
     async sendLiveStatusCard(chatId, view) {
         try {
             const res = await this.client.im.message.create({
@@ -3965,6 +4146,10 @@ export class FeishuBot {
                     msg_type: "interactive",
                 },
             });
+            if (typeof res.code === "number" && res.code !== 0)
+                throw new LiveStatusEffectRejectedError(`Feishu rejected card: ${res.code}`);
+            if (res.code !== 0)
+                throw new LiveStatusEffectUnknownError(new Error("Feishu card receipt missing code"));
             this.store.clearBotUnavailableInChat(this.config.name, chatId);
             return res?.data?.message_id || res?.message_id;
         }
@@ -3982,13 +4167,21 @@ export class FeishuBot {
                 msg_type: "interactive",
             },
         });
+        if (typeof res.code === "number" && res.code !== 0)
+            throw new LiveStatusEffectRejectedError(`Feishu rejected card: ${res.code}`);
+        if (res.code !== 0)
+            throw new LiveStatusEffectUnknownError(new Error("Feishu card receipt missing code"));
         return res?.data?.message_id || res?.message_id;
     }
     async patchLiveStatusCard(messageId, view, chatId) {
-        await this.client.im.message.patch({
+        const res = await this.client.im.message.patch({
             path: { message_id: messageId },
             data: { content: JSON.stringify(this.buildLiveStatusCard(view, chatId)) },
         });
+        if (typeof res.code === "number" && res.code !== 0)
+            throw new LiveStatusEffectRejectedError(`Feishu rejected card: ${res.code}`);
+        if (res.code !== 0)
+            throw new LiveStatusEffectUnknownError(new Error("Feishu card receipt missing code"));
     }
     /**
      * Render the /compact progress card. While running it shows a phase line plus a
@@ -4645,8 +4838,10 @@ export class FeishuBot {
      * The chain must never wedge: a single hung Feishu call used to block every
      * later send in that chat forever (live-status patches fire per tool event),
      * which froze cards and stranded /stop confirmations. Each link is therefore
-     * raced against a deadline, so a stuck send is abandoned and ordering resumes.
-     * Prefer a larger OPENCLAW_LARK_MULTI_AGENT_SEND_TIMEOUT_MS on slow links.
+     * raced against an observation deadline. The queue advances, but an already
+     * attempted SDK request is NOT cancelled and can settle late. Its outbox keeps
+     * custody; the expired lease forbids any subsequent new SDK effect. This is
+     * not a strict platform-order guarantee for uncancellable in-flight requests.
      */
     sendOrdered(chatId, fn) {
         const prev = this.sendQueue.get(chatId) || Promise.resolve();
@@ -4658,9 +4853,10 @@ export class FeishuBot {
     /** One send link: resolve with fn(), or reject at the deadline so the chain advances. */
     async withSendDeadline(fn, chatId) {
         const limit = SEND_DEADLINE_MS;
+        const lease = { expired: false };
         let work;
         try {
-            work = Promise.resolve(fn());
+            work = this.sendEffectLeases.run(lease, () => Promise.resolve(fn()));
         }
         catch (err) {
             return Promise.reject(err);
@@ -4670,7 +4866,7 @@ export class FeishuBot {
         work.catch(() => { });
         let timer;
         const deadline = new Promise((_, reject) => {
-            timer = setTimeout(() => reject(new Error(`send deadline ${limit}ms exceeded for ${chatId.slice(-8)}`)), limit);
+            timer = setTimeout(() => { lease.expired = true; reject(new SendDeadlineError(chatId, limit)); }, limit);
             timer.unref?.();
         });
         try {
@@ -5156,6 +5352,7 @@ export class FeishuBot {
             // supervision instead of letting the checker judge a wiped transcript.
             void this.goController?.onExecutorSessionChanged(chatId, "执行会话被 /reset");
             this.stopEpoch.set(chatId, this.store.bumpStopGeneration(this.config.name, chatId));
+            this.presentation(() => this.queuedPresentations.retire(chatId));
             this.store.stopInsertions(this.config.name, chatId);
             this.store.cancelReactionIntents(this.config.name, chatId, this.stopGeneration(chatId));
             void this.openclawClient.cancelSteerSession?.(sessionKey, this.stopGeneration(chatId)).catch(() => { });
@@ -5189,6 +5386,7 @@ export class FeishuBot {
             // Bump the stop generation FIRST so any in-flight auto-retry loop sees the
             // cancellation on its next iteration and stops retrying immediately.
             this.stopEpoch.set(chatId, this.store.bumpStopGeneration(this.config.name, chatId));
+            this.presentation(() => this.queuedPresentations.retire(chatId));
             this.store.cancelReactionIntents(this.config.name, chatId, this.stopGeneration(chatId));
             void this.reconcileReactions(chatId).catch(() => { });
             this.store.stopInsertions(this.config.name, chatId);